Income and Poverty in the United States: 2019 - <AUTHOR> https://www.census.gov/library/publications/2020/demo/p60-270.html <comment><USER3> Wouldn't the large number of Americans in their 20s living in their parents homes have affected this?

I suspect a lot of those who have moved back into their parents' homes were likely earning below the median household income. Remove them as a household, and suddenly the median family is one higher on the income scale.

<comment><USER4> Hey look, 2019 household data validating the household size growth part of your conjecture:

[https://www.pewresearch.org/fact-tank/2019/10/01/the- number-...](https://www.pewresearch.org/fact-tank/2019/10/01/the-number-of- people-in-the-average-u-s-household-is-going-up-for-the-first-time-in- over-160-years/)

<comment><USER5> Hrmm, not consistent with Census Bureau current population survey which shows household size hitting a record low in 2019.

[https://www2.census.gov/programs- surveys/demo/tables/familie...](https://www2.census.gov/programs- surveys/demo/tables/families/time-series/households/hh4.xls)

<comment><USER6> What conclusion should I draw from these seemingly inconsistent statistics?

<comment><USER7> I would say it is wiser to draw a conclusion using the census household size data, since the headline statistic of household income is also sourced from the census. Why compare apples and oranges when you have apples and apples?

<comment><USER8> Well the inferences would only be as good as the sampling then. I know for me, the census was the last thing that was on my mind, and it was only completed it because my spouse was did it. There has been many issues with Census data collection (take a google news search).

<comment><USER5> This data is from the Current Population Survey where they select households and then either visit or call on the phone. It's not a thing where they just mail out the survey. The CPS also repeatedly selects the same household in consecutive surveys, which gives them continuity that other surveys lack.

</comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> Pretty dense report with lots of interesting statistics.

These got my attention:

 _The 2019 poverty rate of 10.5 percent is the lowest rate observed since estimates were initially published in 1959_

 _The 2019 real median incomes of White, Black, Asian, and Hispanic households all increased from their 2018 medians [between 5.7% (Blacks) and 10.6% (Asians)]_

 _Percentage change in share of aggregate income was highest for the lowest income quintile (+1.8%). High income quintile saw decrease in share of aggregate income (-0.6%)_

<comment><USER9> The poverty line has not scaled with the increase in expenditures associated with modern living, nor increased worker value. The only adjustments made in the last half-century have been for inflation and bare-minimum at that.

America is a lot more poor than these statistics let on when compared to the rest of the first world. Furthermore debt is not considered in many such analyses.

<comment><USER10> What? America is like the top 3 in median disposable income in the world: [https://en.wikipedia.org/wiki/Disposable_household_and_per_c...](https://en.wikipedia.org/wiki/Disposable_household_and_per_capita_income)

US wealth per adult is higher than Finland, Sweden, Denmark, Germany, and the Netherlands: [https://en.wikipedia.org/wiki/List_of_countries_by_wealth_pe...](https://en.wikipedia.org/wiki/List_of_countries_by_wealth_per_adult)

<comment><USER11> They include retirement income as income, but do they exclude retirement savings? In US there's a huge burden to save for your own retirement, and modern retirement vehicles (e.g. 401k and IRA) pay out in full even if you die young (no longevity risk pooling), so they're a lot more expensive to fund.

<comment><USER10> It's PPP adjusted disposable income after all taxes and transfers, so that includes Social Security, welfare, etc.

It's debatable if this is able to adequately capture all forms of non-cash transfers (like food stamps). To get around this, the World Bank uses consumption as a metric for well-being. By that metric, the poorest 20% consume more than the average person in most OECD countries[1][2], including Canada, the UK, Sweden, Australia, Japan, Denmark, New Zealand, and Iceland.

[1] [https://www.nber.org/chapters/c12831.pdf](https://www.nber.org/chapters/c12831.pdf)

[2] [https://fee.org/articles/the-poorest-20-of-americans-are- ric...](https://fee.org/articles/the-poorest-20-of-americans-are-richer-than- most-nations-of-europe/)

<comment><USER11> I was referring to money set away for retirement. Since moving from Norway to US, I can't really spend all my disposable income, given that maximum social security benefits are so low.

<comment><AUTHOR> Using my google skills it looks like the maximum supplemental pension in Norway is NOK 293 583 or $32,216 USD.[1]

The maximum US social security pension is $49,680 USD.[2]

Obviously it scales based on income, but at least for US tech workers, you're likely to get close to the maximum amount since you'd be earning over $110,000 for a significant chunk of your career.

The US has a much higher maximum pension amount than Canada, where it's $1,176 CAD or $889 USD. You do get an old age benefit on top of $613 CAD, which bring it up to $1,351 USD or $16,212 USD per year.

[1][https://ec.europa.eu/social/main.jsp?catId=1123&intPageId=47...](https://ec.europa.eu/social/main.jsp?catId=1123&intPageId=4713&langId=en)

[2][https://www.ssa.gov/policy/docs/progdesc/ssptw/2010-2011/ame...](https://www.ssa.gov/policy/docs/progdesc/ssptw/2010-2011/americas/united_states.html)

<comment><USER11> You shouldn't look only at supplementary pension for Norway. Everyone gets the basic pension as well, and if you're employed your employer must also contribute on your behalf.

<comment><AUTHOR> So what is the maximum for someone with a high income? I'm not that familiar with Norway's pension system, so definitely open to being educated on it.

It's complex, but if you have a high salary it looks like the basic pension is NOK 89 872, so another $9,889 USD, for a total of $42,105 USD?

<comment><USER11> Disclaimer: this is awfully complicated, and I'm not an expert

What's most relevant for this discussion is the system for people who are earning now for retirement in the future. The amounts are adjusted yearly, but the current maximum rate is about $14300. This is tax funded, and so doesn't come out of your disposable income. Gaps from illness, unemployment, military service and caregiving are covered. When you start withdrawal, the accrued amount is adjusted for changes in the average national income and your life expectancy based on your age. I.e. the money is paid back to you at a rate that draws your balance to zero at the expected date of your death. If you live longer, it keeps going of course, funded by the people who die earlier. The maximum rate is therefore achieved by retiring at the oldest age (74), or roughly $97000/year with today's numbers. This would require making well above the national average salary starting at age 13.

If you max out your income based pension described above, the base pension gets reduced substantially. Looks like it can go as low as $4300/year of benefits currently.

On top of these two pension types, your employer must save at least 2% of your income up to $134000, and pay for insurance that covers contributions if you become disabled. The employer must cover all associated costs. These plans vary a lot and have no maximum.

I will add that you need substantially less income in retirement in Norway since you won't be paying for healthcare, and property taxes are extremely low.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Why is household income such a common statistic to use - it seems like it doesn't tell us much unless you at least normalize it by the number of earners in the house and the cost of rent?

For example - I'm pretty sure large numbers of people living together and sharing rent is _way_ more common nowadays than it used to be. From 18 - <USER2> (I'm 27 now) I was always living in a house with at least 3 other people (usually 4-5), because that was literally the only way I could afford to pay rent if I wanted to eat as well and I'm still splitting rent 50/50 with one other person now.

Most of us were working (low paid) full time jobs, so our total household income would have been pretty big - but this situation is obviously not _at all_ an improvement over what we had a few decades ago when one minimum wage full time income could afford their own house _and_ a full belly.

<comment><AUTHOR> Average household size has been decreasing significantly and is at a low as of 2019.

[https://www.census.gov/content/dam/Census/library/visualizat...](https://www.census.gov/content/dam/Census/library/visualizations/time- series/demo/families-and-households/hh-6.pdf)

<comment><USER13> Does that include children under 18, though? If so, then they're not counted in the income calculation. That means the problem is _worse_ , not better.

<comment><AUTHOR> _" The term "size of household" includes all the people occupying a housing unit."_[1]

And household income is all income earned, including those down to 15 years old.[1]

Plus, the report breaks out individual income as well and the numbers are similar.

[1][https://www.census.gov/programs-surveys/cps/technical- docume...](https://www.census.gov/programs-surveys/cps/technical- documentation/subject-definitions.html)

</comment></comment></comment></comment><comment><USER5> This survey comes with a chapter-length caveat that says the current data should not be used to compare with the prior year, because the survey response rate was exceptionally low and potentially biased by COVID-19. The survey was conducted in spring of 2020 and asks respondents to report their 2019 income, which is where the estimate of 2019 HH income growth is coming from. But, beginning on page G-9 (353rd page) of [1] the Census itself says:

""" it is likely that the characteristics of people for whom a telephone number was found may be systematically different from the people for whom the Census Bureau was unable to obtain a telephone number. While the Census Bureau creates weights designed to adjust for nonresponse and to control weighted counts to independent population estimates by age, sex, race, and Hispanic origin, the magnitude of the increase in (and differential nature of) nonresponse related to the pandemic likely reduced their effectiveness. Using administrative data, Census Bureau researchers have documented that there are more (and larger) differences between respondents and nonrespondents in 2020 than in the prior three years. Of particular interest for the estimates in the ASEC reports are the differences in median income and educational attainment, indicating that respondents in 2020 had relatively higher income and were more educated than nonrespondents."""

1: [https://www2.census.gov/programs- surveys/cps/techdocs/cpsmar...](https://www2.census.gov/programs- surveys/cps/techdocs/cpsmar20.pdf)

</comment><comment><USER14> Interesting... in 2018, 2017, and 2016 it only really increased by 1 or 2 percentage points.

[https://www.census.gov/library/publications/2019/demo/p60-26...](https://www.census.gov/library/publications/2019/demo/p60-266.html)

[https://www.census.gov/library/publications/2018/demo/p60-26...](https://www.census.gov/library/publications/2018/demo/p60-263.html)

[https://www.census.gov/library/publications/2017/demo/p60-25...](https://www.census.gov/library/publications/2017/demo/p60-259.html)

<comment><USER15> They're could be some lag in tax cuts making their way into household income, and some of this could be from corporations onshoring profits.

<comment><AUTHOR> These numbers are pre-tax.

<comment><USER16> There isn't "one tax" that effects households. There's also second and third order-of-effect tax changes that affects income as well.

</comment></comment></comment></comment><comment><USER17> This[1] is from the year prior, but it indicates that wages may not be going up and causing income to go up. People may just be working more. Not sure if it applies to 2019 as well, though.

[1] [https://www.brookings.edu/blog/up-front/2018/10/04/if- real-w...](https://www.brookings.edu/blog/up-front/2018/10/04/if-real-wages- arent-rising-how-is-household-income-going-up/)

</comment><comment><USER18> The mental gymnastics some commenters use to turn this into bad news...

Occam must be spinning in his grave.

<comment><USER19> Generally everyone in the US views the US negatively right now.

maybe some mumbo jumbo stat that has nothing to do with the real world says things are better. Or maybe they frankly are not better.

<comment><USER20> No a weird subsect view america that way

<comment><USER19> Multiple subsects, on both sides.

</comment></comment></comment></comment><comment><USER21> Related from the Census Bureau:

[https://pbs.twimg.com/media/EiCLL- _UYAIBJ_T?format=jpg&name=...](https://pbs.twimg.com/media/EiCLL- _UYAIBJ_T?format=jpg&name=small)

The middle class is disappearing ... into the upper class.

<comment><USER22> That's interesting but I think also a little misleading. The income brackets are held in constant dollars, which is helpful, but many of the important things in life have scaled like crazy in constant dollars as well.

$100k equivalent income in the 1960s was enough to buy a family home almost anywhere, and now it's not enough to buy a family home in most major metros.

<comment><USER23> The way that CPI inflation is calculated accounts for spending pattern changes already, including mortgage/rent. If you don't have a nuanced critique of the CPI calculation method, I'd argue that this point is moot.

It's also worth pointing out that the average square footage of a home has grown considerably in this time, and that even if you are comparing a similar sized home, it is unfair to compare a home 3 miles from city center in a city of 1 million people to the same in a city of 2 million people, after it has grown through the years.

</comment></comment></comment><comment><USER24> Interesting to see such a good improvement. My questions is why the Fed cut interest rates in 2019. Everything i read is the economy is strong. Curious what the fed saw that warranted a drop in the interest rate.

<comment><USER25> They started cutting because broad economic growth was softening noticeably.

The labor market was extremely tight though, which was pushing wages up at an accelerating rate. Most of the slack in the labor market was gone.

GDP growth had been grinding lower for multiple years, the very long economic expansion was probably increasingly due for a recession (which we have now gotten out of the way).

If a more natural recession had occurred circa 2020 or 2021 (without the pandemic), it likely would have been shallow, with the Fed always guns-ready to pump (since the great recession). The economy was strong in the sense that there wasn't anything major structurally wrong with it such that it was about to implode, however growth was not anything to write home about leading up to the pandemic.

</comment></comment><comment><USER26> This is good to see but I'm curious how 2020 will turn out. I would guess that with with the pandemic driven shutdown median household income will drop pretty dramatically. Maybe more than this 6.8% gain.

<comment><USER27> Could also increase with households growing in size (other article about kids going back to their parents).

</comment></comment><comment><USER28> I wonder how much that increase scales further up the pay scale. Given the still widening income inequality, I wonder if its exponential

<comment><AUTHOR> They only show the change in the share of aggregate income. In other words, of total income, how much did each quintile account for?

Lowest quintile +1.8% Highest quintile -0.6%

So it would appear it didn't go to the highest income earners.

</comment></comment><comment><USER29> This is good. Rising incomes are a good thing.

My only problem is that it comes along with rising inequality. We needed to have more billionaires and multimillionaires (and thus raise asset values and debt much higher) for the wage increases to happen. Which basically means that the wage increases don't lead to a better quality of life.

More incoming money, more outgoing money.

<comment><USER20> Wage i.e. income increased is exactly what did happen. Billionaires and millionaires aren't bad. And income equality not a good goal. If we create more rich people at the same time incomes increase for the lower and middle class at historic who cares about the ratio split.

<comment><USER29> Equality isn't a good goal. But expansive inequality isn't either.

I'm not arguing for socialism. I'm arguing for proportionate slice of the pie for the work done. The share of the pie is heavily skewed towards owning wealth in the first place today and the only way to keep the vast majority employed seems to be making the rich richer.

<comment><USER20> If expansive inequality isn't the goal why does it matter.

What does the percent of the pie matter even if you slice is getting bigger at historic paces because the pie in general is bigger. Would you rather have a higher percentage of a smaller pie or a lower percentage of a smaller pie.

Equality isn't the goal, equal opportunity is and higher standard of living I'd guess and focusing on equity may not be helping.

</comment></comment></comment></comment><comment><USER20> Its basically been growing like crazy since 2008. Check out the difference between the US growth vs most first world countries growth. The GDP per capita was 45k in 2008 and 48k in 2019. The US when from 48k to 63k.

</comment><comment><USER30> > _The 2019 real median earnings of men ($57,456) and women ($47,299) who > worked full-time, year-round increased by 2.1 percent and 3.0 percent, > respectively_

If individual earnings gains are less than household income gains, it means people aren't necessarily _making_ more money, it means they're _working more_ total hours. I don't consider this a good thing for the richest country in the world. It's also interesting to note that women earnings increased almost a full percentage more than mens.

<comment><AUTHOR> Working more might be a person going from a part-time 30hr per week job to a full time 40hr per week job.

That's a good thing, no?

<comment><USER30> I think of it more as people needing to work more hours overall just to afford the same lifestyle.

<comment><AUTHOR> That would be inflation. And the income increase is _real_ income, so inflation is accounted for.

<comment><USER30> I feel like the inflation measurement is BS. It tracks prices of goods, but doesn't account for people paying for things they didn't pay for in the past (day care, bottled water, health insurance, retirement savings), and comparing that to their income. 25 years ago it was normal for families to live fairly well-off on a single income...nowadays you'd barely make ends meet.

It's deceiving nowadays because we're basically living the same lifestyle quality we were 25 years ago, except that either _both_ parents are working like dogs, or the even sadder reality of couples foregoing/delaying kids because of their finances.

</comment></comment></comment></comment></comment><comment><USER31> Coincides with $15 minimum wage showing up in a lot of places. Coincidence????

<comment><USER32> This is median, so maybe if you're saying the mechanism is fewer low income jobs available? 15/hr at 40h/50wk is 30k, so it would not raise median to bring the floor up.

</comment></comment><comment><USER33> Ah...statistics..

</comment><comment><USER8> Can we trust the numbers these days? At least several Federal departments have been politicized recently..e.g. interference in CDC reports and others e.g. [https://www.govexec.com/management/2020/09/calls- investigati...](https://www.govexec.com/management/2020/09/calls- investigations-resignations-ramp-over-allegations-political-interference- federal-agencies/168497/)

edit: moreover, the impact of COVID on census data collection isn't likely to be equal across income groups.

<comment><USER34> Similar assertions were made during previous administrations. I suspect that such claims will not become less familiar as the partisan gap widens. I don't believe that outright fraud is happening in either case, but is our duty (and that of the press) to watch the numbers and methodology statements carefully. If the news was a bit more precise in its reporting of statistics it would go a long way to making large scale manipulation more difficult.

[https://m.washingtontimes.com/news/2015/feb/10/donald- lambro...](https://m.washingtontimes.com/news/2015/feb/10/donald-lambro-obama- hides-jobs-failure-by-not-coun/)

<comment><USER8> There is no rational, evidenced argument that the last four years has been on par with the Obama administration in terms of the corruption of political appointees, or the degradation of our institutions. The what-about-ism you put forth is a false equivalency in magnitude and kind.

We are in truly dangerous times, and I say this as a libertarian-leaning, conservative-friendly individual: Trump is an existential threat to our Republic.</comment></comment></comment>


Ask HN: How should I connect with the London start-up scene? - <AUTHOR>

I'm a Toronto-based entrepreneur and today, I was supposed to be leaving London, England, for a short vacation. Originally, I planned to stop here for a few days to see family.
Unfortunately, due to weather conditions, my flight has been postponed until Saturday morning.
But, in every disappointment, there's an opportunity.
In this situation, I'd love to connect with the London start-up scene. I'm not sure how to do it, but I'm hoping the HN community might be able to help.
Any suggestions? <comment><USER2> Dev tank is on Monday, if you ask nicely you might be able to skip the waiting list <http://www.meetup.com/DevTank/calendar/15487391/>

If you're still around on Thu 9th, you could check out OpenCoffee <http://www.meetup.com/londonocc/calendar/clgdnynqbmb/>

</comment><comment> adam-_- Not quite what you're looking for but London Perl Workshop is on Saturday <http://conferences.yapceurope.org/lpw2010/></comment>


Show HN : One click DDG search  - <AUTHOR> http://h3manth.com/content/one-click-duckduckgo Search any selected text <comment><USER2> Weird : On chrome this website prompts me to download a file named ddg.ogg

<comment><AUTHOR> Oops! Which OS? Mac?

<comment><USER2> Windows 7 using Chrome 18 (stable)</comment></comment></comment>


Ask HN: What are the sources to read about applications built on blockchain? - <AUTHOR> <comment><AUTHOR> I am building an application for finding credible businesses and individuals who have little or no formal credit history. Since it involves access to sensitive financial information, I want to remain up-to-date with the new computing platform that blockchain is. We are the cusp of a tech-tonic shift as computers and softwares were in 70s,80s,90s and so on.</comment>


Ask HN: Do you want to be a billionaire? - <AUTHOR>

Not the typical question on HN. But just seeing so many people in the Valley aiming to be the next Mark Zuckerberg / Bill Gates. Such a goal comes at a great cost. Not only the amount of work required but you'll probably need to chase high risk opportunities which the vast majority of the time end in failure.
Or do you want something like 37signals? More of a lifestyle company, with 4 day workweeks on the Summer. Jason Fried is influential in many circles.
Or something like patio (kalzumeus.com)... solopreneur. I think I read he works 10 hours a week but stills makes an impact?
Pluses and minuses to each. <comment><USER2> IMHO:

Reaching a level of success can still be "suffering" if that success is built on the suffering of others.

So, while yes I'd certainly love to be a Billionaire in theory, I have a hard time thinking of how that could come about in a way that wouldn't compound and produce more suffering in the world. My own, and others'.

<comment><USER3> How does earning money cause others suffering?

<comment><USER4> The difficulty of having an entire business that earns you a billion while paying a living wage, let alone the supply chain. See Apple's efforts to be green (eg mercury free in 2010-ish) but Foxconns' suicides.

<comment><USER5> Are you talking about the suicide rate that's lower than the general Chinese population?

[https://en.wikipedia.org/wiki/Foxconn_suicides#cite_note- eco...](https://en.wikipedia.org/wiki/Foxconn_suicides#cite_note-economist-6)

Does Facebook exploit any of its workers? (I'm not being rhetorical, I truly haven't looked into it)

<comment><USER4> Oh, fair enough. I just believed the media.

As for Facebook I haven't heard anything about non-US workers, barely anything about non-tech workers except that painter who took stock.

</comment></comment></comment></comment></comment><comment><USER6> Not given the ethical cost required to get anywhere near there, no.

Though "Do you want to" makes it sound like it's as much of a choice as "Do you want to move to another country?" (Which is itself a rather restricted thing)

<comment><USER3> What are the ethical costs?

</comment></comment><comment><USER7> Is 37signals really a "lifestyle company"? Sure the founders are not billionaires, but I think with the (what I assume are) 8-figure revenues they must have, they'd be considered more than "lifestyle".

<comment><USER8> It depends on how far into the 8 figures they have made it, their headcount, net income and their stated goals, in my opinion.

I have worked a lot with SMB market (as well as tech startups) and there are a lot of smaller 7 and lower 8 figure type businesses where owners travel for significant chunks of time and the business keeps running. That to me is a lifestyle business, as the owner(s) aren't required to be sitting there everyday. At the same time most that I have met that have this luxury aren't going to be going public or seeking outside investments etc (nor could they likely).

The first one I met I thought was a huge anomaly but after now having done a lot of SMB work in the past 6-7 years, I have found a lot more of these types of businesses around the US then I ever thought. They aren't usually glamorous nor tech focused but they are "lifestyle" businesses in my opinion because the owner can really set his/her schedule and doesn't have to be there daily or worry about income. I also have seen a fair number of these businesses are family owned and may go back 1-2 generations.

So not sure what 37Signals founder goals are, but they seem like the grow slow (relatively speaking) and grow long, versus the typical tech company that is trying to do it all in 3-5 years using OPM.

<comment><USER9> Could you give more insight onto these types of companies? Employees, industries, products, revenue/profit, everything. They sound interesting.

<comment><USER8> Sure. Like I said most aren't glamorous nor necessarily tech in their core nature. I know some of the rough FTE counts, but also some of these used quite a bit of part time help.

Electrical Contractor - ~$14M/Annual revenue, less than 30 FTE's. Honestly a couple variations of this too around, one was a regional HVAC supply company etc.

Small boat manufacturer - ~$25M annual revenue, less than 60 FTE's (IIRC) Family owned, started only about 10 years ago. Owners worked their asses off until the past few years (I think he said when he crossed the $18M mark as that was some magic number for them).

Family that has purchased many Franchise stores from Texas to Virginia and Florida - ~$8M annual rev and they never work in a store other than when it opens to help set the tone. They visit them often though. I have no clue the count of employees they have, but in the holding company we did work for it was only about 4-5.

Plumbing contractor - ~$9M annually, they started as a pure service contractor and then also opened up regional distribution of supplies. Supply side is the higher growth side for them, even through the real estate market stupidity. I guess everyone needs a toilet that works and pipes that don't leak though, so makes some sense.

Financial Auditing Software - ~$14M annually, they wrote custom software 15-18 years ago (and keep updating it) that analyzes loan risks and compliance for underwriters. Around a dozen FTE's, owner would rarely wear shoes when he came to the office, always made me laugh.

Consumer wearables (shirts, hats, backpacks etc) - ~$11M annually, < 25 FTE's. Actually a few of these types of business we have worked for, but they seem to come and go more than others, so my sense is sustainability doesn't seem to be really easy in that market place.

Some of these numbers are old and I know at least 2 of these are likely doing considerably better now. The things I noted when I was doing work for these and others is how they structured their companies. They always focused on hiring people to manage things for them and focused on training the leadership. They never made the business all about them, maybe to help get it off the ground but not after. That lets them pick and choose what they do and allows them the freedom of the "lifestyle" business. I probably have done work with 25-30 over the past 7 years that would fit into this category now. I can't say I have seen too many with > $25M in revenue, as that seems to be when people start selling out or they have to jump back in 100% and push to a new level (just my observation/guess).

Also, in talking to them the other common theme is it was never "lifestyle" in the early days, it was only after they hit their magic tipping number or a certain number of years of profitability at a certain level that it became "lifestyle" for them.

<comment><USER10> All the rich people I know IRL have businesses like this. None are in websites or startups. I know millionaires who don't have an email address. I wish I had gone into one of these fields, the web feels like the most saturated place on the planet right now.

<comment><USER8> Almost all the wealthy people I know did it through a combination of real estate and small businesses too. Only a few came directly from anything technology based.

I don't necessarily think the web is saturated it is more that the tech media and places like HN have a small but very active community and so things seem very crowded. I personally intentionally sought out a lot of the traditional companies to consult with because I knew they have been underserved and frankly not well appreciated by the general tech community. Sure, lots of SaaS solutions get built but many times they are 65% of what the company needs etc, and with a little extra help and integration work we can give them a cost effective, 98% solution that they can live with and helps them make more money. It comes with challenges though too as these same small businesses can be a challenge to work with at times more than a startup or an enterprise client, so its not a panacea by any means.

Personally, I have been diversifying for years and working to acquire real estate and work in markets that have little to do with technology as a core. Not because I don't love the tech industry, I just am playing the odds, diversifying and doing stuff that I love so it all works out for me. Plus something appeals to me at some level not to be behind a computer day in and day out the rest of my life.

</comment></comment></comment></comment></comment></comment><comment><USER11> I dont think there would be any difference in my lifestyle between 50 million in the bank and 5 billion. It would be cool to be able to donate hundreds of millions of dollars to charities though.

</comment><comment><USER12> The 37signals people probably got where they are via long stretches of living the consultant life style (since they were consultants). Before things scaled, they weren't working Ferris-Four-Hour-Work-Weeks but grinding for clients.

I've been thinking about the next company I try to build a lot lately. I don't really care about being a billionaire nor do I care about emulating Zuckerberg...it's too late for me to get admitted to Harvard, much less drop out. But winding up with a fuck-you money sized exit would be nice and what I've come to believe is that it's not appreciably more work to build a $2 billion company than a $2 million one. I'll probably have to work my ass off either way, and there's still a lot of risk that either winds up a $0 million company in the end.

People can work decades to build a company that makes them a multi- thousandaire. Scale comes from businesses that scale not in proportion to hard work.

</comment><comment><USER13> > Or something like patio (kalzumeus.com)... solopreneur. I think I read he > works 10 hours a week but stills makes an impact?

Let's not give in to SV newspeak where running a business means "making an impact".

<comment><USER3> Creating a product or service which people find valuable enough to purchase is 'making an impact'.

<comment><USER13> Really? So literally every business activity (e.g. running a small grocery store on the corner) is 'making an impact'? For me, this term implicitly means making SIGNIFICANT impact, not just any impact.

<comment><USER3> Yes. There was no prior mention of magnitude. I benefit vey greatly from my local grocer, s/he provides with quality goods at a reasonable price -- making an impact on me.

Now, how do you draw the line with 'significance'?

<comment><USER13> I think it's purely intuitive concept, with no clear definition. But without it, literally every particle in this universe is making an impact.

<comment><USER3> In other words, it's a hazy and easily misinterpret-able term. No, defining a prerequisite/s instead of relying on an general idea of 'intuitiveness' would be a more appropriate approach.

Everything 'makes an impact' the magnitude of the impact makes all the difference.

</comment></comment></comment></comment></comment></comment><comment><USER14> I don't think many people will outright say on the record they want to be billionaires on here because then it looks like they're just in it for the money. There's a stigma against wanting to be rich in this industry over just 'passionate'.

I wonder how many people say internally to themselves they want to be like one of those people, but are willing to put in the work to get there. How many people are really willing to make the sacrifices to be at the top.

</comment><comment><USER15> I do want and I;m putting the time, effort and thinking into it to be a billionaire. At the same time I'm absolutely enjoying the route towards it and really like how I spend most of my time just working in the right direction.

</comment><comment><USER16> > Do you want to be a billionaire?

Yes but it will never happen. I will never even see 1 million, unless economic collapse starting in Greece causes rampant inflation here.</comment>


Neural networks in JavaScript – free 19-part course - <AUTHOR> https://scrimba.com/g/gneuralnetworks <comment><USER2> Hey guys! I'm the creator of the course and lead developer of brain.js and would love to answer any questions you may have.

<comment><USER3> Hey Axel! Just started watching but the interactive guide is incredible. It's like having Screenhero with a private tutor.

Only thing is, I kind of wish there were something like the time-coded comments SoundCloud has. At the end of the second guide, we're asked to play around with the tests.

I added: console.log(net.run([0, 4])); console.log(net.run([3, 3])); console.log(net.run([8, 4]));

Based on the training data, I would expect this to resolve to ~4(or 1), ~0, ~8(or 1) by standard logic expectancies (if same return 0, else return the higher number or 1). But instead I received ~0, ~0, ~0.

It's not immediately obvious what is causing this. But it seems like the model created is inherently ignorant of basic logic (at least by my narrow definition), and there isn't any immediate discussion of caveats as to error margin.

I'll admit this might be a n00bish concern based on never programing neural nets before, but as this guide seems focused on introducing NN's to n00bs like me: a way to discuss concerns with other viewers/the author would be amazing.

Aside from that, incredible work! I'll keep watching to see if I can figure out my misunderstandings.

Update: Just discovered the Q&A tab, this should likely be adequate for my concerns. Well done. This may be the best online demo/tutorial I've ever seen.

<comment><USER2> Ty! This means a lot! Can you point me to the tutorial you added new tests with?

<comment><USER3> Hey sorry for the delay, it was at the end of the second tutorial "Our First Neural Net!" I think you were instructing us to try testing the outputs for the other sets in the training data which all work as expected, but I took the "play around with the outputs" instruction to mean, see how the NN responds to novel inputs like the ones I mentioned.

</comment></comment></comment></comment><comment><USER4> Thanks Robert for putting this together. Coming from PyTorch ecosystem. What is the _actual_ requirement for this course? Would a smattering knowledge of ES6 do? Been leching at browser based implementations since Karpathy demoed his CNNs a few years ago but just havent had enough motivation and courage to pickup JS. Perhaps my main reson for anxiety is the confusing JS ecosystem.Also what are some real world use cases for training and deploying NNs on the browser rather than training and deploying it on a _tradional_ cloud backend environment?

<comment><USER5> afaik it's mostly for cool demos and educational purposes, or extremely latency intensive applications that funny require large models.

for most deep learning models, training on the client is completely unreasonable, as they require weeks of training even on multi thousand $ pro equipement.

For training, tiny metalearning models are the only reasonable thing to train on the clients in most useful scenarios, as they are pretrained to take as few examples as possible to train on a specific task (see MAML).

For inference, aside from educational applications, the only potential advantage of in browser over in server is the lower latency. the main disadvantages are that you need to send the model to the client (multiple MB), with the longer loading time and potential problems with intellectual property this entails. maybe for some extremely small models in very latency driven applications, it can be worth it.

So, overall, either educational purposes, training and use of latency hungry tiny metalearning models or inference with tiny pretrained latency hungry models, like computer vision on webcam sort of deal

<comment><USER2> Keep in mind that while the tutorial is in javascript, in the web browser, the neural network easily apply for node based solutions as well.

We're adding GPU support that use either client side OR server side GPU, so that any case you mention can be handled.

<comment><USER5> yes, but afaik node with webgl is strictly slower than cuda/cudnn with Python or whatever serving

</comment></comment></comment></comment><comment><USER6> This is fantastic! The tutorials are very simple to understand and can be actually used in your very familiar JavaScript env and the Scrimba editor is great coupled with the author editing things in real time that you can play with, brilliant. Thanks Robert!

</comment><comment><USER7> I just watched the reinforcement learning video and was very confused -- where did the reinforcement learning happen? I thought reinforcement learning was giving an agent positive / negative signals to learn without example output data, but in the video the network was just retrained with more data? Is it an overloaded term maybe?

<comment><USER2> Ty for asking this question! "Reinforcement learning" has a wide definition, but in this case because we are using a simple feed forward neural network, "reinforce" is more principled by dynamic programming with supervised learning. We are not actually using a "Deep reinforcement learning" algorithm.

The idea here is that the net can continue to train, reinforcing its previous understanding with new understandings, if new training data is provided.

It may be that we need to clarify the tutorial, as your point is based around unsupervised learning, not having training data.

Is it an overloaded term? YES!

<comment><USER7> Thanks for the clarification!

</comment></comment></comment><comment><USER8> Totally add to the collaborative list of interactive Machine Learning, Deep Learning and Statistics websites [https://github.com/stared/interactive- machine-learning-list](https://github.com/stared/interactive-machine-learning- list) (waiting for a PR! :))

</comment><comment><USER9> why would you do ML in JS?

<comment><USER10> Why would you do web dev in python?

<comment><USER11> Because you don't know Ruby

</comment></comment></comment><comment><USER12> Is there a Numpy equivalent for JS yet? How easy is it to use (considering that JS doesn't have operator overloading)?

<comment> jimmy-dean Not effectively. From what I've read, JS lacks SIMD support which makes Numpy- like vectorizations unachievable. Would be nice though...

<comment><USER12> I think Numpy is written in C, so in principle they could use the same approach for JS (and invoke SIMD functions from C). The problem, however, is that there is no operator overloading in JS. So you can't write things like a[:,:,3] *= 2.

</comment></comment></comment><comment><USER10> This seems to exactly follow the examples from the readme. Guessing this is by someone that worked on the project. Either way great tutorial.

One complaint... `#` THIS IS NOT AN ASTERISK! (he said it like 5 times in one video)

Otherwise great tutorial

<comment><USER2> Doh! You found a mistake. I'll try and take care of that asap. Ty for pointing this out.

</comment></comment><comment><USER13> interesting - it seems to me, anecdotally, that more and more ML/AI emerging in JS (vs python as the default goto).

Anyone know if anyone is tracking this (similar to github language usage stats)?

</comment><comment><USER14> Awesome! Bonus point for doing a js course

</comment><comment><USER15> Thank you for doing this! Can't wait to check it out.

</comment><comment><USER16> Why the heck Javascript?

<comment><USER17> One very practical reason is to save on computation costs. GPU servers are not cheap and if you're going to run on CPU anyway, you might as well run it locally on the user's browser.

Some demos such as real time object detection isn't possible at all if you had to pay roundtrip server latency (not to mention the complexity of streaming video to and from your server): [https://github.com/ModelDepot/tfjs-yolo- tiny](https://github.com/ModelDepot/tfjs-yolo-tiny)

And a lot of web demos such [https://affinelayer.com/pixsrv/](https://affinelayer.com/pixsrv/) I don't believe will be up for such a long time if the author had to pay ongoing server costs.

<comment><USER18> There is NO save on computation cost. CPU is slow for NN whatever language you are using.

OP has a point, if I want to learn PRACTICAL front end programming, I will choose javascript, not Python. Same for Neural networks, just switch the place.

<comment><USER19> What's wrong with js for neural networks? JS/V8 is faster than python, not accounting for python bindings to native NN libs that may as well be bound to js.

<comment><USER18> There is nothing wrong to use js, like there is nothing wrong to call it impractical.

JS is faster than Python, but in the land of DL, there is C++ and everyone else. No one is using Python to do the actual computation anyway.

<comment><USER20> "No one is using Python to do the actual computation anyway."

Depends what "actual" computation is. If you're definition of "actual computation" is something which requires extreme optimization then your definition precludes the question. In the real world there is an extraordinary amount of computation done with inefficient languages though simply because development time costs very often outweighs run time costs.

<comment><USER21> Python is used because there are C/C++ bindings for working with NNs.

The point is that none of computations are done in pure Python. Python just provides a convenient wrapper over non-Python code.</comment></comment></comment></comment></comment></comment></comment>


The best exception message - <AUTHOR> https://twitter.com/eduardsi/status/1085978458071711745 <comment><USER2> Not funny... Yesterday I had a rare occuring bug with something not much more useful than this. The code was written in 2016 in a relatively broad exception handling branch. Took time to understand what's up.

</comment><comment><USER3> I wonder if I could edit visual studio's NotYetImplemented exception template to add this as an internal text string.</comment>


How core.async and CSP help you prove your async code works - <AUTHOR> http://reaktor.com/blog/why-csp-matters-i-keeping-things-in-sync/ <comment><USER2> > How can I know that my sync algorithm works?

TLA+ is one such language that can help you. It models computation at a higher level using the _Temporal Logic of Actions_. Essentially you define some variables to model your problem in and declare a bunch of next-state relations. You can then check your design against your correctness and liveness invariants to see if your expectations hold against all possible executions.

If you are so inclined you can even go as far as proving it correct.

I recently just grasped the proof of the strong-fairness property and it's amazing to me that we don't use predicate and temporal logic more frequently in software development.

There are other languages of course such as Event-B and Z, but I find for learning these concepts TLA+ is a great introduction.

[0] [https://www.youtube.com/watch?v=iCRqE59VXT0](https://www.youtube.com/watch?v=iCRqE59VXT0)

<comment><USER3> FWIW the linked article is just the problem description, the interesting stuff is part II which talks about CSPm (and FDR3) whose whole point is asserting properties of CSP models.

<comment><USER2> That is much better.

So the take away here is that modelling in the domain of CSP is easier because some language frameworks directly implement CSP?

I guess that's one of the challenges I'm having learning TLA+ and formal methods. I have this high-level specification of a semaphore lock that the model checker can verify and might even have a proof. How do I now implement this in code?

But that's kind of moot: a blueprint doesn't implement the building. However if we follow the blueprint, if our reasoning was sound and the mathematics hold, then the sky-scraper will stand and everyone is happy.

What's neat about FRP and functional languages like Haskell is that we can encode some of the correctness invariants into the type system; essentially having the compiler guarantee the implications for us. (Or as TFA mentions, directly synthesize our CSP program from the specification; which seems very neat but restrictive...)

And what's _really_ cool about strong fairness is that it doesn't say anything about _when_ a relation has to happen. It could be that your lock will be held for a thousand years before the next process gets to acquire it... but the strong fairness property guarantees it will happen.

The question may then be... _well what about the implementation? How do I know it will satisfy this property without waiting for the heat-death of the universe?_ Computers are not theoretical machines. They are complex, physical devices with non-theoretical limitations. They won't last until the heat-death of the universe so don't worry. You can prove that every process will get a chance to acquire the lock in the implementation without saying anything about the specification.

The reason why I thought this was beautiful was because now we can reason about the soundness of our design without concerning ourselves with timers, memory limitations, network connectivity... etc, etc. The properties of those things will change over time but our specification will remain solid and useful.

All very interesting stuff and to answer the conclusion, yes I think adoption of these tools and ways of thinking can be done in practice by the wider industry. I'd even go as far as saying that it's necessary. If we want software developers to become capital-P _professional_ software engineers we need to introduce liability and rely on tools to verify the soundness of our thinking before we go asking the world to trust our creations.

I don't think the math is terribly difficult; the problem is that thinking is hard and programmers don't seem to enjoy doing it very much. For some reason computer science is allergic to math and programmers in industry think their job is to write code. CSPm is neat but you're so close to a more general and useful language one step up.

<comment><USER4> "I have this high-level specification of a semaphore lock that the model checker can verify and might even have a proof. How do I now implement this in code?"

You do them side by side in a way that looks and behaves similarly. That's the traditional route going back to Orange Book A1-class systems. The seL4 work did something similar. Two other routes are: (a) gradually refining abstract spec into something concrete enough for code like B method does; (b) using tools like Coq that support extraction of code from specs. Also look into "abstract state machine" specification, code, generation, and so on. Much work happened under that label in both hardware and software.

</comment></comment></comment></comment><comment><USER5> Big hairy core.async go blocks like shown in these articles makes me a tad uneasy (see the sync source in the second part to this article). Because they seem to be programmed in a mostly imperative style. Almost every time I see a go block loop, I see code that could be better written with core.async/pipeline. `If` statements can be come filters, transformations can become map. And with the addition of transducers all this becomes much cleaner.

So in that sense, I think many FRP-esque libraries have something going for them, they force their users into a model that is more declarative than imperative. That sort of programming can and should be done with core.async. Go blocks are a primitive, build abstractions on top of that and keep your app code declarative.

<comment><USER6> The go blocks in here are really ugly, but to be honest I just found it difficult to refactor in this particular case. The issues were a) I wanted all the events in a single event loop to make timing issues clear and to fit the model semantics better b) core.async go blocks, because they are macros, can't be refactored like functions (>! and such need to be in a go block) and c) the sync logic otherwise was easier to reason about with all of the logic in one place. One better way to factor this would be to have a declarative format for what each action performs, but it ended up being more difficult to follow the logic when I refactored it this way. Types would help, and I think in general there is unexploited potential for types and CSP and FRP approaches. But if you have suggestions for how to make this better I'm all ears.

</comment></comment><comment><USER7> The only things that have been shown are that an overly simplified CSP model of what the author is actually doing might work, that the author does not have a clear understanding of concurrency, and that the author is prone to making grandiose claims like "The matching of models means that CSP can be used to solve complex problems using core.async in a way that would be more difficult using another approach like functional reactive programming or actors", without basis.

In this particular case, uniquely-identified, timestamped property updates, with last-update-wins, for named objects, would have trivially worked, in any language, without the modelling complications. Actors, FRP and CSP are all capable of doing that, without error.

<comment><USER5> Agreed, I'm not even convinced you need anything async here. In that sense you could probably write this with OS threads and you language of choice.

<comment><USER8> Generally I see the idea that "technology X makes the problems of concurrency go away" is a bad smell.

In the JVM world I am always seeing people screwing around with Actors and things like that and failing and then after days of suffering I break out some simple Executor and I have it working correctly in 10 minutes and performance tuned in another 10.

Look at the example of the LMAX Disruptor to see how adults face reality and develop real solutions instead of snake oil.

I like ReactiveX because it provides a way for thinking about these things that is cross language

<comment><USER4> The only ones I've seen that delivered [with caveats] were Concurrent Pascal, Ada's Ravenscar, Eiffel's SCOOP, and recently Rust. SCOOP got the most CompSci work with a Java port, one proving no deadlocks, one proving no livelocks, a formal verification in Maude that caught problems, and one modification to almost entirely eliminate performance penalty.

So, it can happen but does rarely enough to arouse strong skepticism. I usually don't buy it.

</comment></comment></comment></comment><comment><USER9> This is a bad title. The only point at which the post even talks about FRP is in the sentence "And are there practical reasons that a library based on the CSP language is useful in ways that, say, an FRP or functional reactive programming library is not?". Doesn't mention FRP after that, not even in part II.

<comment><AUTHOR> My bad, I just noticed that too and changed the title to reflect it. Thanks for pointing it out!

</comment></comment><comment><USER10> Couchbase is perfect for this use case and, in fact, a grocery list app that syncs between clients is their primary demo app.

</comment><comment><USER11> This article doesn't talk about FRP at all. The title should be changed

<comment><AUTHOR> Thanks for pointing it out - title changed to better fit article content.

</comment></comment><comment><USER12> That thing where someone calls core.async CSP and my eyelid twitches.

Reading the paper, it has very little to do with core.async.</comment>


David Eppstein's Wikipedia Gallery Contributions - <AUTHOR> https://commons.wikimedia.org/wiki/User:David_Eppstein/Gallery <comment><USER2> LucasVB is another great contributor with some fantastic animations: [https://en.wikipedia.org/wiki/User:LucasVB/Gallery](https://en.wikipedia.org/wiki/User:LucasVB/Gallery)

Two personal favorites are:

Line integral of a scalar field: [https://en.wikipedia.org/wiki/File:Line_integral_of_scalar_f...](https://en.wikipedia.org/wiki/File:Line_integral_of_scalar_field.gif)

and Fourier Transform: [https://en.wikipedia.org/wiki/File:Fourier_transform_time_an...](https://en.wikipedia.org/wiki/File:Fourier_transform_time_and_frequency_domains.gif)

<comment><USER3> What software are these folks using to produce these images/animations?

<comment><USER2> From his tumblr: [http://1ucasvb.tumblr.com/faq](http://1ucasvb.tumblr.com/faq):

The 3D stuff (with shadows and such) was created using the excellent, free raytracer POV-Ray.

The rest were created using a custom-made PHP library that uses GD for graphics. The library adds a whole lot of functionality that isn't present in GD or PHP: drawing anything with alpha blending, geometry and math primitives, 2D and 3D rotations (including quaternions), better anti-aliasing, object- oriented interface, etc.

<comment><USER4> I find it disappointing that even in the litany of alternate technologies tried, there's no reference to using Web technologies, so these animations could be interactive. Obviously the author's choice, but some could benefit now and going forward.

</comment></comment></comment></comment><comment><USER5> I took courses with Eppstein at UCI. I was always impressed with his ability to construct clear example diagrams to explain any question.

Glad to see some of these great diagrams were shared with a wider audience :)

<comment><USER6> He's a legend, I remember in our Graph Algorithm's class our "text book" was mostly composed of the articles that he had written. Glad to see UCI representing here.

<comment><USER7> The UCI campus ACM club is quite distinguished as well ;)

</comment></comment></comment><comment><USER8> No disrespect to those who do original research, however it seems that these images, made freely available to hundreds and thousands of people seeking to educate themselves, contribute more to the advancement of human knowledge than all but the most important published theorems.

<comment><USER9> I'm not sure there's a point to rank either, but it is certainly true that research and education are both complementary and monumentally important for the advancement of knowledge.

<comment><USER8> I guess my point is just that the utility of this kind of work seems undervalued in comparison to people proving endless minor theorems in little- read papers, which gets romanticized as 'finding out stuff no-one has ever known before'

<comment><USER10> If not for the research, though, there'd be nothing that needed explaining through illustration.

</comment></comment></comment></comment><comment><USER11> I've commented this before but it's worth mentioning these fantastic interactive SVGs again:

[https://en.wikipedia.org/wiki/User:Cmglee](https://en.wikipedia.org/wiki/User:Cmglee) [https://upload.wikimedia.org/wikipedia/commons/0/06/Burj_Kha...](https://upload.wikimedia.org/wikipedia/commons/0/06/Burj_Khalifa_floors.svg)

</comment><comment><USER12> David Eppstein is a mainstay of WikiProject Computer Science[0]; I encourage anyone interested in contributing to Wikipedia in that area to refer to the group for help & support!

[0] [https://en.wikipedia.org/wiki/Wikipedia:WikiProject_Computer...](https://en.wikipedia.org/wiki/Wikipedia:WikiProject_Computer_science)

</comment><comment><USER13> I hadn't reflected on it before, but it seems an unintended consequence of power users like this is that it has created a de facto wikipedia math illustration "style". Not sure if that's a good thing or a bad thing

</comment><comment><USER14> almost as talented as seedfeeder:

NSFW!!

[https://en.wikipedia.org/wiki/Seedfeeder](https://en.wikipedia.org/wiki/Seedfeeder)

</comment><comment><USER15> Beautiful! Thanks for posting.</comment>


More Encryption Is Not the Solution - <AUTHOR> http://queue.acm.org/detail.cfm?id=2508864 <comment><USER2> Encryption can be circumvented. It's hard, but doable for a state, when it targets one high-value suspect. But if everything is encrypted, they can't go "big data" on it and collect everything about everyone: if proper encryption is generalized, spying doesn't scale anymore.

Big companies' ability to break the encryption between them an you is irrelevant: if they're the legitimate receiver of the communication, they can offer the plain text directly to governments.

The ability for a third party to break the secrecy between two individuals has a pretty good solution though, and that solution is local encryption + open source. It makes it very difficult for states to compromise the scheme, and every time they use this ability, they're at risk of having their exploit discovered, and going blind again. They'd only use information gathered that way for legitimate national security reasons, and will never show it in a court for instance. A discovered 0-day exploit in OpenSSL or GPG isn't as easily replaced as one in Flash player.

The biggest potential impact of Snowden's revelations is that now, any security scheme relying on trusting a third party companies _has to_ be considered unacceptably weak, at least if you mind governments--or companies sponsoring politicians--reading everything you exchange.

TL;DR: encryption isn't the absolute weapon against illegal spying by governments, but it helps making it extremely difficult, expensive and unscalable. Which is good enough a reason to promote it in addition to political action.

<comment><USER3> I think the take-away from this article is that the political/legal environment is part of implementation detail you need to consider when considering a "private" communication mechanism.

No crypto-system is truly secure unless BOTH sides can be trusted. If either one is even remotely possible to compromise, then that _will_ _happen_. In the case where one of those parties is well-known and has something to lose, you can be certain that the powers-that-be will focus their attention on that party. (nb: Skype)

SO yeah, crypto _en masse_ will make casual collection harder, but it's not even halfway towards what is needed. There has to be an awareness of the downside to reduced privacy that can be tangibly grasped by the populace otherwise we're all pissing in the wind. Any crypto-system that requires anything approaching trade-craft on the part of the user is probably going to fail miserably.

I was fresh out of the military when the USG was proposing the widespread deployment of the "Clipper" chip that included key-escrow as a fundamental feature for LEA access to keys. That failed, but I would not be surprised to hear that we got it anyway through quiet "arrangements" with major crypto- system equipment/software providers.

Have YOU inspected your CPU/Firmware/OS/Applications for backdoors? Even with the full source code?

It's a hard problem and requires a lot more than just neat technology to solve. In fact, it probably can't be solved with technology at all.

<comment><USER4> > Have YOU inspected your CPU/Firmware/OS/Applications for backdoors? Even > with the full source code?

this is absolutely spot on, especially the firmware. nobody talks about it and the attack surface is huge.

just to be explicit, hardware backdoors exist as well :)

<comment><USER5> Completely agree. Anybody recall the TPM? Security is pretty much turtles all the way down.

Encryption isn't going to help stop a guy with a stick from beating the information out of you. A functional state, however, can help prevent such things from happening.

</comment></comment></comment></comment><comment><USER6> "if a nation-state decides that somebody should not have privacy, then it will use whatever means available to prevent that privacy."

One thing a lot of these discussions miss is that the entire point of doing privacy and anonymity correctly is that _you_ are never on a list of people that any particular nation state wants to deny privacy to. That your True Name (to borrow the idea from Vinge's story of the same name) is never the target, is never even interesting.

I personally don't advocate a world where everything I do is encrypted and anonymized, I think that that is as unachievable and sacrificing as living an entirely private life. Use gmail, skype, facebook, twitter, send non-encrypted messages about christmas to your friends and family, etc.

But what we do need is an online equivalent of a private life as well. And people need to be educated in the tools and techniques that can make this possible when necessary. Use tor, hidden services, pgp, i2p etc Use completely different online identities, ways of speaking and never login to a HN account associated with your real identity from that private space. Create and participate in hidden online communities, but don't center those communities around your real life family and friends (ie facebook-esque hidden service would be a very bad idea).

The idea is not to challenge, fight or oppose nation states with surveillance capabilities, that's a losing proposition; the idea is to create a space away from them.

<comment><USER7> It's like hygiene. A few hundred years back people weren't washing their hands and health was very bad. As soon as we understood the germ theory of disease, we learned hygiene and now we are much better.

With encryption and privacy it will be the same. People will need to learn new skills.

Unfortunately, what we need to do is as cumbersome as a surgeon prepping for operation - it takes too much care to make sure you don't mix things up. You never login into your Gmail on Tor, don't refer to your reddit user name on Gmail, etc.

Unless you already did, in which case you're toast. They already have years of data on your views and interests.

Could we make a browser extension that would compare all you do and force privacy for you? For example, if you mistakenly mention your _anonymous_ identity in your official mail, to catch it before sending. It should have a list of forbidden things - keywords, user names, etc - and send watch people not to mix the pots. Take care to separate cookies between anonymous mode and public mode. I am sure such an extension would go 99% of the way to making your private online life private again.

I envision a whole suite of apps - browser, mail, messaging, file sharing - written with this goal in mind - to separately manage identities - private and public - based on the content of communication. Like spam filters, but applied to all our data leaks.

<comment><USER8> And if there's a backdoor on your hardware then they have access to all your plaintext before encryption ...

I can imagine a day when face to face communication gets really popular, even critical for some people.

<comment><USER9> I wonder if one day, 3d printing will be cheap enough so that one could go to the local hackerspace, Print print out chips, assemble the board/internal devices and be sure to be free from hardware backdoors?

<comment><USER10> This is feasible today. Although it takes a decent skill set. Open source communities like OpenCore.org have enough FPGA architecture to build your own RISC computer from scratch. I suspect as FPGA's become more popular and speeds improve the hacker community will move towards one-off computers they made themselves.

This coupled with your idea of 3d printing for casing is interesting.

<comment><USER11> Doesn't that just offload the backdoor potential to the FPGA rather than a CPU?

<comment><USER12> I think it would be impossible, from a computer science standpoint, to create a backdoor in an FPGA that could compromise your own OS, in a general case. Perhaps, the computer that you use to program the chip could be compromised, to change the code that is put on the FPGA.

<comment><USER11> When I wrote that, I was under the assumption that people would use open- source CPU designs from OpenCore for convenience. With a little help from Xilinx and Altera, it wouldn't be too hard for a government to have the synthesizer detect when an OpenCore design is being used and surreptitiously put a backdoor in. I admit that it would be hard to write software to simultaneously detect a completely unique CPU design is being synthesized, figure out its instruction set and weaknesses, and finally create a hardware backdoor that could circumvent any software written for that device.

As always, there's a tradeoff between cost and security. How many hardware hackers are good enough (or motivated enough) to design their own brand new ISA and CPU design, then bootstrap a compiler and OS for their homemade CPU? Maybe 0.001% of the population, if that.

<comment><USER9> Well, I'd be down to try at somepoint, if I knew where to start. I feel like moving forward from now, in general, the future will require these skills in order to maintain some sovernty over onself.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Because we are technical people, it's very tempting to think of a technical solution to the problem. This author is right on the money though. Against a state level actor there is little hope of securing your own person and effects, and thus, your technical solution.

<comment><USER14> I agree that a political solution is strongly preferable, but I'm not sure if that's ever going to happen. The only reason that the NSA can listen in on your Facebook, Google, Skype (etc) activity is because:

1\. These communication tools are operated by a company under American jurisdiction, that can therefore be strong-armed into cooperation

2\. These communication tools store your data unencrypted

3\. The world outside that company has no way of figuring out what is happening inside (i.e. no transparency)

I am therefore of the opinion that the only viable _technical_ solution to Prism has to be

a. Completely decentralized

b. Fully (end-to-end) encrypted

c. Open source

If our communication tools were decentralized, encrypted and open source, then the NSA would have had a much harder job listening in. What needs to happen is that we need to build those systems, and basically divorce Facebook the company from Facebook the tool.

We need to change the playing field, and remove the capability to listen in on our communications. The internet is an amazing tool, but it's still in its infancy. It could very well be that, decades from now, we will look back at this period and wonder how it was even possible that the NSA was listening in on every single person in the world. We're not there yet, but it's not impossible.

<comment><USER15> That's mostly true - but in the Facebook example (and Twitter, and to a much lesser extent gmail and Skype) - the whole purpose of using the service for most people is to be at least partially "public". Facebook wouldn't work if every message was encrypted - at least not unless it was encrypted in such a way that a large number of nodes on your social graph can all decrypt them. If my ~250 Facebook friends or ~500 Twitter followers can't read what I write there, the services would be useless. I'd _prefer_ the marketers and the NSA didn't also have access to my personal and professional interactions on Twitter/Facebook, but they're fundamentally "public". (I know there's "privacy" control for both services, but they only cut things down from "everybody sees what I post" to "all or perhaps just some of my contacts see what I post", not actually "private")

And the fundamental problem is, out of those 500 or 600 "contacts" I've got on Twitter/Facebook, I've got maybe 2 dozen PGP keys matching them. By far the greatest portion of any email I send is going to have to arrive in friends/colleages/clients mailboxes as cleartext, and I strongly suspect there are people who's PGP keys I do have, who'll decrypt mail I send them and store the cleartext somewhere vulnerable to NSA snooping anyway. Same with just about every other "technical solution", until everybody has properly managed and secured keypairs - most communication is going to have weakest-link vulnerabilities that are trivially defeat-able to a "globally present network embedded adversary". Having said that, it's still worth doing, from the point of view of increasing the level of difficulty for a ubiquiously surveilling adversary. (with the probably downside of drawing attention to myself by asserting my ethical "right to privacy", which is no doubt interpreted as "doing something suspicious" by the opponent)

<comment><USER14> You make two good points, but only the first one is structural. How do you keep information secure if it's meant to be semi-public? That's a rather fundamental question, and I don't have an answer to it. There must be a better way than storing everything in plain text in a centralized database, though.

Just think about it: the current communication tools store all the world's communication in plain text databases on American soil. No wonder the NSA engineered access to it - it is a prize too good to be true. I think we can and should at least try to change that.

Regarding the availability and use of PGP key pairs and related technology: you're right. Almost no one uses them, save for security enthusiasts. They're difficult to use, overly technical, make you feel like a paranoid conspiracy theorist and are frankly a pain. Those are all issues that could be overcome, though. There are no real, actual, structural reasons why good security has to be difficult to use.

But what I'm really wondering about is the best way forward. Like I said, I would strongly prefer a political solution, but I'm skeptical if that will ever pan out. I've been mulling this for a while, and if we would really want decentralized, encrypted, open source means of communications, shouldn't we take a structural approach to this?

<comment><USER15> The Diaspora guys had some ideas – but they were either not good enough ideas or too difficult to execute on to gain much traction, from what I can see.

It's an interesting question – who's going to fund writing the software that effectively needs to replace Facebook while making it impossible to monetise in the ways Facebook can?

(Random half-baked ideas: what about something built on top of BitTorrentSync? A distributed encrypted file storage repo with sufficient storage/bandwidth on every users machine to store many encrypted blobs, some of which are encrypted using your public key. A client-side app that gives you a personal view of that data showing only the stuff meant for you. Work backwards from there to a Facebook or Twitter like service, with a whole bunch of strong crypto using PGP keypairs and self-signed TLS certs authenticated with your social graph's web of trust. It's almost certainly more difficult than that though - I feel like like this guy: [http://xkcd.com/793/](http://xkcd.com/793/) – and we're now back at the "everyone just needs a PGP keypair" showstopper…)

</comment></comment></comment></comment></comment><comment><USER16> I have seen more bad things happening from politics than from encryption. Politics, in just about any nation, is the never ending cancer of "making deals". The never-ending tit for tat, the compromise. We need NO compromise. I'm in my 60's now, and have seen the internet been born. Actually I contributed to that birth while working at Arpa. Privacy, no matter how I look at it, is ABSOLUTE. Also for criminals, and yes, even for terrorists. Humans have the natural expectation of privacy. That's probably difficult to absorb for many reading this medium. Every human being has the ultimate right to be in charge of his or her own mind. Politics conflicts with privacy, all the time. Politics established the rule of law, and, did so by and at the convenience of those with the loudest noise and the toughest axes. Since none of us is capable, willing or able to put the politicians out of (our) business, we can only find resolve in taking care ourselves, and thus deploy encryption. And we do have good quality crypto. And it is even free. Can it be broken? Over time, yes. But complexity, volume and speed can make that a fairly long trajectory. Can it be broken by quantum-cryptanalysis? Probably yes, but even that is more than 30 years away to be in infant stage. The real problem is the endpoint security. Well, work on it, make it better, improve it. Don't just stand there and accept God knows who to run away with YOUR thoughts, ideas, inventions, preferences or problems. And by all means, please do NOT think that government, any government, is the only one looking at your data. There is an entire commercial world busy with your stuff without you knowing about it. ---RTF PS: and yes, this is anonymous. My students would probably scaffold that I'm a weakling :)

</comment><comment><USER17> More Encryption is not the _final_ solution to the problem. I fully agree here. However, encryption should be the default for all communication. It provides a certain degree of privacy after all. Yes, there are weaknesses in some of the tools used. That can always happen. As the technical crowd, we should fix those weaknesses instead of screaming "encryption is useless".

I for one don't feel like making it easy for the NSA, a foreign agency in my case, to spy on me. I owe it to my privacy to at least try and protect it.

The political change that is necessary is out of my reach in the case of PRISM, as I am not from the US. I can only hope that the American public will realize how bad this really is and act accordingly. After all, this is still a democracy and it will be until all privacy has been taken away completely.

</comment><comment><USER18> This silly defeatism is killing you guys.

Just use bloody SIP or any other cryptographically-sound protocol; maintain trust with people and their personal endpoints, rather than companies which are obviously under enormous state pressure(the threat of violence and imprisonment, and the rape included with that, for life) to give up the goodies.

We have other issues, including the pervasive use of proprietary software trading convenience over the pragmatic requirement of not having industrial or governmental espionage committed against you.

Intel is under grave pressure to inject these bugs into their CPUs, and even a well-audited system such as OpenBSD is not modular enough to prevent remote exploitation through network stacks(see the last two remote vulnerabilities), but laziness leaves them on monolithic kernels.

Even if the systems worked correctly, proprietary firmware in PCIe devices like network cards and graphics cards allows them to directly access memory on the bus, generally with very little protection, and often enough with none at all.

You guys are buying all of this crap, supporting the people who subjugate and bend.

You paid them knowingly to do all of this crap(in addition to raping, killing, and enslaving hundreds of millions or billions in other countries), and you continue to today.

If you want this stuff to stop happening, you need to simply stop knowingly supporting these things, and playing dumb when you learn the specifics.

</comment><comment><USER19> This viewpoint became very popular recently and it strikes me as odd. Does the author always leave his house unlocked because there is a law against theft? "Your" nation state over which you presumably have some degree of political control is absolutely not the only adversary. There are foreign states, there are cybercrime gangs etc.

Also, while politics sometimes trumps cryptography, the opposite happens just as often. All the police force is useless if they don't know where to point their guns (see Silk Road)

<comment><USER20> On top of that, increasing encryption definitely helps for _mass surveillance_ \- it's impractical to break all the keys for all the messages all the time.

Maybe they will still be able to spy on a select few individuals (just like they can order a locksmith to open a safe, or just blowtorch through). But then again, there are much cheaper and old school ways to spy on a select few individuals

</comment></comment><comment><USER7> Encryption is not absolutely safe because it relies on trusting in who's at the other end, but it surely is much better than using clear net. We can still trust a few entities, right? We need to collectively scrutinize and make informed guesses about who to trust.

At the moment I set up TOR and use Starpage.COM instead of Google. Auto-delete cookies after closing the tabs and actively remove ads and tracking JS from web pages with the help of a few browser extensions. It's not perfect, but it's above average for the moment.

You know how we could become anonymous? Just pipe the traffic of 1000 people through the same box, mix their searches and pages loaded in the same stream. Then send them on the clear net - they can't trace back who requested what. Hiding in the crowd, in plain sight.

<comment><USER21> That's a good idea, but it falls down the first time someone in the crowd starts downloading cp. Instead of having one, or a few, people being traced to their IP and investigated for cp, you now have 1,000 people under suspicion. You can protect users by ensuring that the box doesn't log _any_ information about them, but then the box's admin is the one being held responsible.

<comment><USER22> 'cp' above apparently means child porn.

I read it wondering 'If at first they come for cp, what about mv? rm?'

</comment></comment></comment><comment><USER23> > POLITICS, NOT ENCRYPTION, IS THE ANSWER

And how would author convince Russia or China not to spy? Or some people who are not government at all? (terrorists, scam...). Also NSA lied several times and said it would lie again.

Lets just treat it as any other security issue. Banning XSS in parliament is ridiculous.

<comment><USER24> The difference is the country in which the hardware or the business resides has many more tools for getting at private data. They can just hit you with a wrench until you give up your secrets.

[http://xkcd.com/538/](http://xkcd.com/538/)

</comment></comment><comment><USER25> I agree that if the privacy laws are strong, and anyone from any agency breaks those laws, he should be severely punished. In such a society and such an environment, you'd still be free to use services however you want.

Unfortunately, the current environment lets even the intelligence chief get away with blatantly lying to Congress about who's he spying on and why. I agree that a policy solution is definitely preferable in the long run, but for now we should protect ourselves however we can, until we get to turn the "surveillance state" into a "privacy state".

</comment><comment><USER26> In general, the points are OK. Small detail which the author got wrong: According to the now famous Prism slides, Skype was a part of that program before it was sold to Microsoft. It seems that MSFT engineers didn't need to change the architecture just for that feature.

That also proves that the end users can't assume that they can get any idea when some company starts to be the part of such a program, even if now everybody likes to feel smart and more secure in his abilities to spot the difference: "look it was the architecture change."

</comment><comment><USER27> I think the author is spot on, but not for the technical reasons given. As individuals, we don't share a need or desire for the type of operational discipline required to operate securely.

The US DoD/DISA publishes some of their documentation for how to operate iOS devices that access unclassified DoD networks (google for "ios stig"). It's inflexible -- no app store (except for internal, whitelisted app store), no music/etc, no iMessage, etc. They have a need to operate that way because even simple things like the physical location of personnel are potentially meaningful to adversaries. They also have the budget to do so.

I think that you need to scale up your security measures to meet your _needs_. If I were a political candidate running for a significant office, I'd demand a level of operational discipline to ensure that communication with key people was secure. Ditto if I were personally involved in some sort of extended litigation for attorney-client email.

Beyond that, what's the point? I _could_ send pictures of my one-year old's birthday party to my mom with GPG. But why? And how would I expect my mom to handle that picture afterwards? Secrets (encrypted or not) are as strong as their weakest link -- I think that we all learned that lesson in high school.

</comment><comment><USER28> Inconvenient Fact #4 about Privacy:

The US government was already tracking every citizen's postal mail, and storing a copy of the contents for potential later use, for many years before networked computers, "email" and the "world wide web".

Further, anyone working at a government security contractor could at their own discretion inspect any such postal mail.

I would hope you're now thinking "Wait a second. That would be quite difficult to do." Truthfully, I have no idea whether postal mail was tracked and stored; I am only trying to make a point.

My point is that one reason we're seeing a mass scale dragnet now is because _it is so easy to accomplish_.

phk seems to ignore this inconvenient fact.

I see no reason for him to try to persuade citizens to choose politics _over_ use of technology as a means to preserve their right to privacy. Why does his frame of reference need to be binary: that it's either one or the other? Is there a rationale for this?

Maybe citizens should pursue _both_?

If citizens routinely through their choice of technology make surveillance of their communications _ridiculously easy_, then how will they be perceived when they come forth and demand greater privacy? Who would take them seriously?

If citizens are to persuade their representatives that the privacy of their communications is important to protect, then I would argue they must practice what they advocate. They should not be communicating by megaphone. Or plain text.

</comment><comment><USER29> Encryption is not the silver bullet, I agree with that.

All the points he makes are possible scenarios. After Snowden, almost nothing that can be done seems unlikely to have been done. Heck, even the movie "The Net" looks like prophecy come true now.

It's weird to think that encryption is not as secure as we all believed but it still makes it more difficult for the Big Brother to watch over all of use.

In the end, encryption is only completely useless if each and every provider reports to the government. It's a shame and disgrace for the western world that we even assume that this could become a reality.

</comment><comment><USER30> > Several nation-states, most notably the United Kingdom, have enacted laws > that allow the police to jail suspects until they reveal the cryptographic > keys to unlock their computers. Such laws open a host of due process and > civil rights issues that we do not need to dwell on here. For now it is > enough to note that such laws can be enacted and enforced.

Doesn't steganography mitigate this issue if used properly?

</comment><comment><USER31> The main issue is governments can't be trusted, a technical solution (which may not be encryption) is that only option we have.

<comment><USER32> When a government couldn't be trusted by the general population in the past, you got revolution.

Or if it couldn't be trusted by a part of the population (e.g blacks) you got civil rights activism.

Only a very lazy and apolitical society would say that technology is the only recourse.

<comment><USER33> > * When a government couldn't be trusted by the general population in the > past, you got revolution.*

To get a revolution the government would have to start to starve people. I don't think there was any period in history of organized nation-states when people trusted those in power.

> _Only a very lazy and apolitical society would say that technology is the > only recourse._

Technology is a force multiplier. Moreover, technology shapes the environment we live in. We can all see that groups of people behave like water. They do what they have always done (i.e. move down the potential gradient). You can try and do politics all you want, but this tend to be as pointless as arguing with water to start flowing upstream. What you can do is to change the potential gradient, and let the people achieve your goals by doing what they were always doing.

That's why I think technological solutions _are_ important, and probably we should focus mainly on them.

<comment><USER32> > _To get a revolution the government would have to start to starve people._

That's like the naive marxist notion that it's all about the economy. People have revolted without being starved and people have starved without revolting. Culture, patriotism, hummiliation, religion, and tons of other factors come into play.

> _Technology is a force multiplier._

Yes, and if the government is allowed to have 10 times the force of regular citizens, then the government ends with 10 _multipler power using technology, where the people with just 1_ multiplier. That's why technology is not a solution.

> _Moreover, technology shapes the environment we live in. We can all see that > groups of people behave like water. They do what they have always done_

The last 3000 years of history show great shifts of power, strikes, revolts, changes in government and culture etc. And the 2400 of them (e.g 1600 AD and before) are not even related with any great changes in technology.

Of course if people are convinced that they "behave like water", they will behave like water.

But that's not what history shows they did (and do).

</comment></comment></comment></comment><comment><USER34> He made a point saying the privacy problem will not be solved with more encryption. The problem is that there is no way to stop a terrorist plot or illegal activity without the ability to know of it's existence.

The author says the solution can only be on the politics side, but frankly I see a dilemma and don't see how to solve it.

The author makes an interresting parallel with the privacy loss we have at work and we accept. But I know I accept it because there are rules and higher authority that can punish abuse. The problem is that this doesn't exist with states spying.

If there was an authority who could punish states who abuse the information gathered for surveillance, then I beleive we could reconcile the need of surveilance for collective security interest and trust in privacy.

We may need some more decades to reach such evolution stage.

</comment><comment><USER35> One worrying thing about more encryption is that there is a sudden flurry of more bad encryption. Many products are trivially easy to break. (If I can break them any idiot can break them.)

The combinations[1] mean that many people are not protected, and do not know that they are not protected.

I think that I tend to avoid paranoia. But ([https://news.ycombinator.com/item?id=6132613](https://news.ycombinator.com/item?id=6132613)) and the Debian rng bug ([https://www.schneier.com/blog/archives/2008/05/random_number...](https://www.schneier.com/blog/archives/2008/05/random_number_b.html)) are scary.

[1] Good products used carefully; good products used carelessly; bad products used carefully; bad products used carelessly.

</comment><comment><USER36> The point of ubiquitous encryption isn't to make all communications unbreakable. That would be nice, but it's not a practical goal.

But it doesn't have to be unbreakable, either. It only has to be more of a hassle than getting a warrant.

</comment><comment><USER37> What a bunch of establishment hacks... technological workarounds to political problems _is_ politics. The current regime put this here, they're not going to remove it because we ask politely. That's a childish hope.

</comment><comment><USER38> Politics is the answer yes in an ideal world. But politics does not scale, encryption does. What I mean is its very tough for just one country to respect privacy in their laws. So if we want the world to do so will be impractical.

</comment><comment><USER39> This author reaches pretty far. The NSA paid Microsoft to acquire Skype? You can't just materialize multiple billions of dollars on a public company's income statement.

<comment><USER40> You can indeed. The figures are very large and you cannot view item level detail in the financials, only general concepts. The NSA may be propping up the Azure division or one of countless others through backroom deals over this type of thing.

<comment><USER41> In addition to selling extra-high priced items to NSA/Military/Government, the Government could allow the company tax breaks it wouldn't get otherwise.

Tax rules for a company of the size of Microsoft are not simple. It's not impossible to hide stuff.

</comment></comment></comment><comment><USER42> i realise that this doesn't affect the main point of the article, but the example on non-random symmetric keys in https is wrong, isn't it? the key is chosen by the client, not the server. [http://stackoverflow.com/questions/3936071/how-does- browser-...](http://stackoverflow.com/questions/3936071/how-does-browser- generate-symmetric-key-during-ssl-handshake)

</comment><comment><USER8> "The only surefire way to gain back our privacy is also the least likely: the citizens of all nation- states must empower politicians who will defund and dismantle the espionage machinery and instead rely on international cooperation to expose and prevent terrorist activity."

<comment><USER37> The most surefire way isn't in trusting those who betrayed the trust. It's in making their efforts to spy on us futile.

<comment><USER32> TFA just explained why this is not a "surefire" way.

Not to mention that the last 40 years not much progress has been made in this direction (if any).

Also: the other proposition also helps putting a better government in place. The "technological" solution, even if it worked, it would only solve the very specific problem of privacy. Not the much more important problem of a government that betrayed the trust of the people.

<comment><USER37> _Not the much more important problem of a government that betrayed the trust of the people._

We've built a system that makes sure liars and demagogues get into office. Until people are on board with putting an end to such a system of elections, the only way to change the political landscape will be to circumvent it.

</comment></comment></comment></comment><comment><USER43> More encryption is not the best solution I agree.

However, given the situation, it is the only one available to us.

</comment><comment><USER44> I think the obvious answer is: both

</comment><comment><USER45> In general I agree, but I think encryption is still also an answer. You "simply" need to reduce the number of people you trust in, i.e. don't use Skype, write your own chat program.

</comment><comment><USER46> This is an easy argument to reject. It is a false dichotomy.

The answer involves more encryption. We need it, anyway, to secure us against crooks.

But we also need to control governments. We need to do both.

</comment><comment><USER28> He has a conspiracy theory about Ebay's purchase of Skype.</comment>


Longitudinal Analysis of Public Perception of Opportunities, Challenges of IoT - <AUTHOR> https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0209472 <comment><USER2> sentiment analysis between 2009-2016. I'd argue that public perception has gotten a lot worse since then. People are waking up to the facts of databreaches, botnets, risks to ICS and even in consumer-land public mood is turning thanks to media spelling out the risks</comment>