Neural Stem Cells in the Hypothalamus Shown to Control Rate of Aging in Mice - <AUTHOR> https://www.sciencedaily.com/releases/2017/07/170726132107.htm <comment><USER2> Amazing! And also remember the article about positive thinking making people younger?

I wonder how much the brain can control aging processes.

Since statistically, senescence is kind of super-exponential, one wonders if it's a mix of several factors that compound together. If you achieve improvements in just some of these factors, perhaps the human life span can be extended to hundreds of years!!

</comment><comment><USER3> A few years back, researchers found that manipulating levels of NF-κB in the hypothalamus influenced the pace of aging in mice [1]. That work was several steps removed from any idea as to what exactly was going on under the hood; changing the amount of a specific protein in circulation can have any number of effects, both direct and subtle. NF-κB is already an area of interest in the study of aging and metabolism, and so there are many mechanisms to speculate on in this context. There was indeed speculation at the time. Other indirect evidence suggests that the quality of cellular function in the hypothalamus is connected to the pace of aging, such as results arising from investigations of autophagy and its relevance in this part of the brain. Other researchers have made some inroads into mapping possible ways in which the hypothalamus might influence the operation of metabolism throughout the body in order to modestly speed or slow aging. It is well known that the hypothalamus regulates all sorts of aspects of metabolism, but the open question is which of these relationships are relevant to the matter at hand.

The team that investigated NF-κB in the hypothalamus has since been hard at work, seeking a better understanding as to why this part of the brain is important in the way in which metabolic processes determine individual variations in aging and longevity. In a recently published paper [2], the team now points to one particular small population of stem cells in the hypothalamus that diminishes with age; losing these cells more rapidly appears to speed processes of aging throughout the body. The researchers believe that signals generated by these cells are the mechanism of action, and a closer investigation of these signals is the next step in this line of research. It has to be said that this sounds quite similar to the situation for Parkinson's disease, at least at the high level, in which one small but critical population of cells in the brain is diminished at a different pace in different individuals, and where autophagy - and disruption of autophagy in aging - might be important in determining the rate of loss. It also clearly parallels what is known of the age-related decline of stem cell populations in all tissues. We become damaged, and stem cell loss and inactivity is a downstream consequence of that damage.

Either way, this might make an interesting target for cell therapy: certainly, replacement of stem cell populations is on the rejuvenation research checklist. Whether it is a priority in this case rather depends on the size of the effect, however, which in this study looks like a ~10% gain in life expectancy resulting from a single cell therapy treatment carried out in middle-aged mice. Unfortunately, significant changes in longevity in mice on the basis of altered metabolism so far do not translate to significant changes in longevity in humans, at least in the few areas where the data exists for comparison. The life spans of short-lived mammals are far more plastic in response to circumstances and interventions than those of long-lived mammals. In the case of stem cell replacement as a way to reverse declines, however, it is hard to say how the comparisons will turn out - the data just isn't there yet. It is the fond hope of many in our community that approaches based on repairing loss and damage, very different from approaches based on altering metabolism to modestly slow damage accumulation or resist the consequences of damage, will turn out to have similarly scaled effects on life span in mice and humans. Maybe so, maybe not. As I said, the data isn't there. In order to find out, rejuvenation therapies based on repair must be rigorously tested in humans, and that hasn't yet happened in any useful way, even in the stem cell field.

[1]: [http://dx.doi.org/10.1038/nature12143](http://dx.doi.org/10.1038/nature12143)

[2]: [https://doi.org/10.1038/nature23282](https://doi.org/10.1038/nature23282)

<comment><USER4> It seems like evolution would have had to stumble on several different pathways for slowing aging in order to produce long-lived species to begin with.

Perhaps the smaller mammal research doesn't seem to apply to humans because our aging pathways have already been somewhat optimized?

<comment><USER5> There is no evolutionary pressure to increase the life-span of individual organisms, past a certain point.

To the contrary, there might be an evolutionary benefit in having your parents die off shortly after they've done all they can to increase your, and your siblings, chance of reproducing. The reason a timely death might increase the chance of the gene-line's survival is because the parent might otherwise consume scarce resources that are better invested in the offspring.

<comment><USER6> I don't know why you are down-voted.

All that evolution "care about" are genes, no individuals. That doesn't mean that sometimes big life-span of individuals can't be a good strategy for some genes.

About the down-voting thing: it seems to me that if you disagree with somebody, instead of down voting, the best strategy is to answer.

If you don't care enough about the comment for answering maybe you shouldn't be down-voting.

In my opinion, down-voting should be use for keeping the conversation civil and on the subject at hand, or things like fighting spam, not for expressing disagreement.

<comment><USER7> I agree with that, and it makes sense, but unfortunately pg (Paul Graham) said years back that you CAN use downvotes to disagree on HN and so now it's law or something.

<comment><USER6> Really? I was not aware of that. Then, I suppose is me who is not following the rules.

It doesn't look like a rule that makes the conversation more interesting, though.</comment></comment></comment></comment></comment></comment>


Scaling Postgres for time series data using partitioning, Django and Architect - <AUTHOR> https://www.notion.so/portcast/Scaling-Postgres-for-time-series-data-using-table-partitioning-Django-and-Architect-aa75330e2f744507b4fb9c468f313137 <comment><AUTHOR> We utilise the Architect library to achieve table partitioning in PostgreSQL. It's a garage version of the Timescale extension but it allowed us to stay with AWS RDS.</comment>


Why Is Barrett Brown Facing 100 Years in Prison? - <AUTHOR> http://www.vice.com/read/why-is-barrett-brown-facing-100-years-in-jail

<comment><USER2> I'm not disputing that what he's charged with (nothing that whitehats and journos don't do all the time) doesn't suck, or that potential maximum sentences in computer crime aren't oddly out of whack at times.

But lets cut the crap - Barret was a target because he dedicated a considerable amount of his time to being the mouth piece of some of the more radicalized groups inside anonymous, who went out of their way to directly antagonize the US government over and over, the more public the better.

If you're going to ask as a spokesman for an ongoing criminal enterprise that are making fools out of law enforcment you'd better hope to hell they get caught before too long. Because you will always represent a decent 2nd place trophy for them if push comes to shove.

I'm not saying it's right, it's just realism. It's nothing that wouldn't go down the same way (or much worse) in a vast majority of nations.

It's like rolling your cat in bacon grease and sending it out to play with the mountain lions. No doubt you loved your pet and it's sad that it died. And maybe you're dumb enough that you didn't realize how stupid that was in advance.

But you can't really blame the mountain lions, it's just their nature.

<comment><USER3> you're not saying it's right, but you accept it.

so aren't you part of the problem? corruption shouldn't be the norm. justice should be blind, not vengeful.

<comment><USER2> You're right that I'm not an active part of the solution, here. If you have the energy to actively campaign against every injustice you know of in this world or anything even close then I honestly thank you for working so hard for the public. From where I sit though, most of the world appears corrupt and injust to varying degrees, many far worse than what's going down here. So I pick other fights.

And while I have no illusion that I'm somehow being of any real help here, i think it is fair to say that pointing out that it is extremely unsafe to play in traffic is a reasonable approach to reducing the number of people who will get hit by a bus.

</comment></comment></comment><comment><USER4> > even though there technically isn't one) is facing up to 100 years in jail > for three separate indictments. The most recent two indictments—the > threatening of an FBI officer in a YouTube video and the concealing of > evidence—do not seem worthy of such a harsh sentence, considering a man in > Houston recieved only 42 months for threatening to blow up an FBI building, > and a former dentist got 18 months for threatening to kill an FBI agent.

Interesting slight of hand comparing maximum possible jail time for three separate offenses to actual sentences for one.

<comment><USER5> >Interesting slight of hand comparing maximum possible jail time for three separate offenses to actual sentences for one.

I don't think cutting a century into thirds would do much to refute the disproportionality of the sentence to the underlying action.

And the fact that the maximum and what the typical guilty party receives are so divergent is a big part of the problem. It leaves too much to the discretion of prosecutors and courts and is unacceptably coercive to the accused to have to risk anything like that sort of penalty merely in order to exercise any of the constitutional rights that effectively evaporate the moment you accept a plea bargain.

<comment><USER6> We've had this discussion before. The maximum sentence available under law is not a good guide to the maximum likely sentence. Think about the fact that murder can get the death penalty of life in prison with no parole, but the mean sentence is about 20 years and the median about 24 (from which you can infer that quite a few people get short sentences in the 6-10 year bracket).

you can't talk about the disproportionality of the sentence because none has been handed down yet. It's meaningless to talk about the disproportionality of the maximum sentence when the law is designed to accommodate offences from the trivial to the truly egregious.

You think this allows too much discretion to prosecutors and courts, OK, so did a lot of other people at one point, and that's how we wound up with standardized sentencing guidelines and mandatory minimums. Typical sentence lengths went up, because the sentencing guidelines are so exhaustive that prosecutors pile on obscure enhancements. Mandatory minimums were recently found to be unconstitutional, in _US v. Booker_. Federal sentencing guidelines were put in place in 1984. It's not a coincidence that the US incarceration rate took off for the stratosphere around the same time. Sentencing was more lenient, albeit less consistent, when it was left to the discretion of the courts.

You don't lose any of your constitutional rights when you accept a plea bargain. The reality is that people take them because they don't expect to win in court. The standard of proof in criminal trials is very high, so defense lawyers have little incentive to accept a plea bargain unless the evidence overwhelmingly points to guilt.

<comment><USER7> You don't lose any constitutional rights when you accept a plea bargain, but you voluntarily give up many constitutional rights.

To suggest that the only reason people take plea bargains is because they don't expect to win in court is hardly reality. Many, many people take plea bargains because of the cost of a protracted legal battle, not to mention the stress.

You're right on one thing though: we _have_ had this discussion before. But if it was a clear-cut as you implicate, there would be no reason Aaron Swartz shouldn't have accepted a plea bargain.

<comment><USER6> He should have. 6 months for a case where he was caught red-handed was a good deal. He would have been in a minimum security prison with white-collar criminals and possibly been a candidate for early release after 3-4 months. Forget about JSTOR; it's _obviously_ against the law to secretly patch your computer into someone else's network wiring closet and repeatedly circumvent the security measures designed to keep you off the network.

Something that has bothered me about the HN debate on this is that people think that because the MIT security response was weak and easily bypassed, there was no real offense in doing so. This is equivalent to saying that that only those with fortress-like security deserve legal protection from criminal access. _Numerous_ people have objected that because the MIT wiring closet wasn't secure enough then there can't be anything wrong about plugging into it; essentially they're arguing that 'because I could' should be a valid legal defense.

<comment><USER8> 1\. People are upset that Aaron Swartz faced losing the right to vote, hold public office, serve on a jury, or own a firearm, penalties entirely unrelated and disproportionate to the crime.

2\. Your analogy fails because MIT IT certainly know what they could do to secure their systems more robustly, and chose not to do so. This debate has gone on long enough; most of HN disagrees with your position. Let it drop.

<comment><USER9> > People are upset that Aaron Swartz faced losing the right to vote, hold > public office, serve on a jury, or own a firearm, penalties entirely > unrelated and disproportionate to the crime.

The "Felony" idea comes from the _maximum possible_ sentence for a crime. CFAA has been on the books since like 1986 so as soon as Aaron decided to run afoul of its provisions that was a done deal.

As it turns out many states have provisions to restore voting rights to felons, firearm rights, etc. But this type of case is one of the few things prosecutors _don't_ have discretion on, except by dropping charges completely (which I understand is what you think should happen, but that's not going to match what most of the rest of the country thinks, where fairness of justice and due process are at least theoretically the ideal).

> This debate has gone on long enough; most of HN disagrees with your > position.

Oh! Is HN the decider now? I browse this site and I wasn't aware my opinion had been pre-determined for me. Are there any other HN-mandated opinions I should adopt now that this question has been raised? Am I still allowed to like Microsoft products? Are iPhones mandatory or can I keep my Android?

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Facing 100 years so that he'll waive his constitutional right to a trial (undoubtedly before jury entirely incompetent in the matter) and accept a mere 10 years in a plea bargain.

<comment><USER6> He's not facing 100 years for god's sake.It's ironic seeing you complain about juries being incompetent when you're showing off such ignorance of the legal system.

<comment><USER11> Well, please do share your insights with us. That's what this site is for, not ad-hominems.

<comment><USER12> He has in another comment on this submission: <http://news.ycombinator.com/item?id=5155342>

</comment></comment></comment></comment><comment><USER13> Why does US have such a stupid system that seems to be abused to get people to accept plea bargains, which should be illegal in the first place, anyway? Is there any other country where they "stack" sentences on top of each other? Maximum sentence should be 20 or 25 years for 99.9% of criminals, and only the most cruel ones (mass murderers, etc) should get "life".

<comment><USER14> Hear, hear!

</comment></comment><comment><USER15> So he's facing 100 years for releasing thousands of credit card numbers and security codes. He was leaking information and the numbers were not the motivation. Seems quite harsh, but am I missing something?

Edit: He also appears to have just posted a link. Unless he actually uploaded the data, hopefully he's acquitted for that. By this standard, wouldn't Google be guilty of all sorts of terrible crimes?

<comment> ryan-c I read the indictment, and indeed, it appears that they charged him for sharing a link to a pastebin of credit card numbers from Stratfor customers on IRC. It's an absurd charge, and I hope it gets dropped.

What he's in real hot water for is threatening a specific FBI agent, that agent's family and law enforcement in general. I also seem to recall reading that he posted something along the lines of "if any heavily armed people dressed as law enforcement show up at my home I'm going to shoot them because they're probably zetas dressed as cops".

</comment></comment><comment><USER16> Why? Are you playing naive? Information today is the ultimate power, those surveillance systems are operated by the most powerful people in the world. A guy takes actions against them, how shocking he's getting punished.

</comment><comment><USER17> "Facing 100 years" != "will serve 100 years."

<comment><USER18> That's the problem. The only way to guarantee serving a reasonable amount of time instead of "he murdered his family and wore their skins to work" time is through plea bargaining, which perverts the justice system.

<comment><USER9> The "maximum sentence" isn't even the recommended sentence that the accused would be having to plea bargain against, which is determined by the Federal sentencing guidelines.

We went over _all of this_ with Aaron's case, and yet people apparently still refuse to pay attention to how the U.S. legal system works, and instead continue to use MPAA/RIAA tactics when discussing these cases. I have to say it's certainly not very heartening to know that there is seemingly no ideology that won't use propaganda just as soon as it suits their cause. :(

<comment><USER18> Is it in any way conceivable that the so-called "maximum sentence" could, speaking legally not about averages or practicalities, be applied in these cases?

As far as I can tell, it is legally possible. And that's a big problem. Because it exposes the defendant to an exceptional amount of risk, regardless of their innocence or the facts of the case. It makes people much less likely to actually make use of their rights and to go to trial because no sane person is going to let even a tiny chance of going to prison for a century happen if they have a better out through plea bargaining.

This case is a perfect example of that. If the defendant was facing a more reasonable maximum penalty such as, say, a year or two in prison he would likely be far more emboldened to take it to trial and have his day in court.

<comment><USER9> Risk is simply a probability, so it's inappropriate to treat a risk with a probability of approximately epsilon the same as a level of risk that could actually be seen on a pie chart.

You're saying that because the risk of hitting the maximum sentence is not actually zero, that the defendant is exposed to an exceptional amount of risk, but this doesn't even make logical sense.

Either way, whatever else defense attorneys might say to the prosecutors, judges, and the public, they know how the risks translate for their client even better than you or I do and have a professional responsibility to inform their client of the same.

So there's no reason for a defendant to freak out about a theoretical maximum sentence, they should only be worried about the one the judge might actually assign after all the arguments and motions are made.

> If the defendant was facing a more reasonable maximum penalty such as, say, > a year or two in prison he would likely be far more emboldened to take it to > trial and have his day in court.

The maximum should be whatever is most effective for the interests of justice overall, not just whatever is most convenient for whoever happens to be sitting in the defendant's seat that day.

I have a First Amendment right to say and speak my mind, but that doesn't mean I would go picketing funerals with hateful messages like WBC. I have a Second Amendment right to bear arms, but that doesn't mean I would stand near a school carrying a Bushmaster. And I would certainly never expect the government to provide me a Bushmaster and have me stand outside a school just to demonstrate that they care deeply about my rights.

So yes, by all means, take your day in court if it comes to it, but it's not the government's job to ensure that is the only course available to you the defendant, it's the government's job to secure the blessings of liberty for _all_ of the people.

</comment></comment></comment></comment></comment><comment><USER19> He's not facing 100 years.

To get the maximum sentence for a Federal crime, you have to (1) be the Hitler or Moriarty of that type of crime, and (2) have an extensive prior criminal record.

</comment><comment><USER20> maybe Vice can go interview him , forget to sanitize the EXIF data, and somehow make things worse.

<comment><USER9> Well they linked to Barrett Brown stating that many of them (Anonymous) would not hesitate to employ the same amoral "might makes right" tactics that they deplore from the government, if they found it necessary:

<http://pastebin.com/WPE73rhy>

I guess he thinks "might makes right" is OK as long as the dictator is benevolent enough?

</comment></comment><comment><USER21> _"considering a man in Houston recieved only 42 months for threatening to blow up an FBI building, and a former dentist got 18 months for threatening to kill an FBI agent"_

Nonsense! I bet those guys were also _facing_ decades if not centuries of jail. What they got after the trial or a plea bargain is another story.</comment>


Jeff Bezos unveils a lunar lander and BE-7 rocket engine - <AUTHOR> https://www.cnbc.com/2019/05/09/jeff-bezos-unveils-blue-moon-lunar-lander.html <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=19872439](https://news.ycombinator.com/item?id=19872439), which was posted a bit earlier.

</comment><comment><USER3> I think Jeff Bezos is the most talented CEO currently around. He is the rare CEO that has off the charts vision combined with off the charts ability to execute. I am glad he is invested in space travel.

<comment><USER4> Have you heard of Elon musk?

<comment><USER5> > Have you heard of Elon musk?

The guy who failed at Neuralink and the Boring Company?

Might have to add Tesla to the above sentence, depending on if they run out of cash this year or not.

<comment><USER6> Neither Neuralink, The Boring Company, nor Tesla has 'failed' yet.

<comment><USER7> And even truly failing there would be irrelevant. Spruce Goose flew once, yet Hughes isn't a failure. Goddard developed his engines alone and didn't get too far - after initial successes, but he's not a failure at all. You just have to push enough to get high grades - possibly even once, after which you have that "mark". Not too many know what Max Plank did beside quantum hypotheses, but his name is on scientific centers.

</comment></comment></comment></comment></comment><comment><USER8> ITT: "she has ugly knees, would not hit it"

<comment><USER2> Please don't do this here.</comment></comment>


Ask HN: 'Accounting' for startups / product businesses? - <AUTHOR>

Hi all,
Whilst building our current startup we have found that there is no tool ideally suited to recording the expenses, revenues and other transactions within a startup.  We've tried a few and, in our opinion, none of the current accounting packages are _really_ working for us.
Most packages tend towards companies that sell product in a store or mail out invoices.  SaaS businesses don't work like this.
The ideal solution would let us automatically add revenues directly from our web app via an API, capture expenses from our email or an iPhone app, capture these figures against individual users and allow us to more easily monitor metrics such as cash burn, cash left in the bank, user contribution margins and others that we now calculate with a spreadsheet.  All of these are of course extremely useful in making good decisions about our product.
It would make sense to me if this product also kept the numbers organized for our accountant.  I.e. it was built around a compliant accounting engine, without the fuss.
We've had a think and we feel that the accounting system we want would treat data entry like programming. Here's a landing page we have built: http://moneeapp.com.
Is there a pain point here? What are the flaws? Let the open discussion begin! We would love your feedback. <comment><USER2> That name is a non-starter for me. I couldn't show it to my bookkeeper with a straight face. That said:

a) I have this problem and would prefer a SaaS w/ a web hook and API to my current homegrown bookkeeping kludge that I built. My bookkeeper would prefer it, too.

b) As I say a) I realize that I've known that for four years and have never made good on my threats to switch to QuickBooks or anything else.

c) ... And for that matter, I don't have an accountant (yikes).

</comment><comment><USER3> QuickbooksOnline has done an amazing job innovating over the past few years - it's the best product in its class now, easily. Yes, there are certain things it still can't do - and that makes it very frusturating, but I don't see a reason to use any other service.

I think the main flaw with this idea is that everyone wants to make accounting "simple." Unless you are going to focus on a specific niche, I think you're not going to solve the problem.

It sounds like you want to solve the problem of visualizing accounting data better than any other product or service. Why not build an app that works with the quickbooks API (Bill.com is the most notable app out there that sync's with QB). Just an idea..</comment>


How a Quest by Elites Is Driving 'Brexit' and Trump - <AUTHOR> http://www.nytimes.com/2016/07/03/upshot/how-a-quest-by-elites-is-driving-brexit-and-trump.html?rref=collection%2Fcolumn%2FEconomic%20View&action=click&contentCollection=The%20Upshot&module=Collection&region=Marginalia&src=me&version=column&pgtype=article <comment><USER2> I may be reading this too late at night, but the theory seems to be that our benevolent, perfectly logical Ivy League-educated overlords regrettably have to break a few eggs to make a delicious omelette of economic prosperity for all, and those broken eggs are enough to make people throw up their hands and vote for Trump/Brexit/whatever just for a chance to cling to the present, the good old days, at the expense of that shining, golden future.

I have a feeling that people are _actually_ pissed off because they don't think the established elite are generally benevolent, but rather that they act in their own interests at the expense of the prosperity of the middle and lower classes. Whether this is true is beyond the scope of this comment, but any discussion of this seemingly relevant alternate theory is conspicuously absent from the article.

<comment><USER3> Pretty much this. And that's the issue with globalisation; it's great for those at the top, decent for those at the very bottom and often rather awful for those in the middle.

The votes for Brexit, Trump, various far left and right wing parties, etc are a way of saying "let's watch the elite's world and system collapse on itself". They've seen how little any of this is doing for them as workers, and how every system seems stacked in favour of the well off, and they just want to see it all burn to the ground.

<comment><USER4> > are a way of saying "let's watch the elite's world and system collapse on > itself"

I don't think people want to replace the elites with void. Maybe that's the case for nihilistic, fringe far-right or far-left parties. But when majorities or near majorities are voting for Trump or Brexit, they want to replace the elites with _something else_ `.

It's funny to watch the elites suddenly renouncing democracy because she stopped serving their purposes (It was quite a relevation to watch reddit go full-on military-dictatorship this past week, but hey reddit is not reality).

Democracy is a very adaptive concept and there is a saying that there are no dead ends with it.

<comment><USER5> Replacing the "elite" with an underspecified, possibly unachievable "something else" is begging for a void.

Come on, we're software engineers; we know how crazy it is to turn off a working system without having a viable plan for its replacement.

<comment><USER4> > underspecified, possibly unachievable "something else"

I think it's pretty well outlined what is that "something else". The implementation is not there (obviously), but the API exists, for example anti- immigration, [edit]pro-protectionism etc. Most people dismiss it as non- existent though, due to liberal reflexes.

<comment><USER5> Being anti-immigration _is_ protectionism, though. Especially for the services sector. The two things are in direct contradiction to one another. The specific motivation for objecting to immigration (other than straight racism) is "protecting jobs".

<comment><USER4> yep. sorry typo

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I don't think the distinguishing characteristic of bankers is their desire for economic efficiency. It's their desire for self-enrichment.

Maybe the author doesn't mean actual _bankers_ , but is instead referring to central bankers, in which case I'd argue that the meager GDP growth achieved from an unprecedented expansion of central banking assets has been anything but efficient.

Regardless, the fact that the author can look back the past 10 years of economic policy and find among all the mad and destructive monetary actions a "quest for efficiency" just shows that the author is as out of touch as the bankers.

What's happening is that the public at large is figuring this out (and this part the author gets right) using the imperfect vehicles of Trump and Brexit to try and stop it.

<comment><USER7> I don't think the average banker has a greater desire for self-enrichment than say, the average lawyer or the average sales manager. And anyway, there's nothing wrong with a certain amount of greediness in a capitalist system, this is what drives innovation and efficiency. The problem with banking has been that the system is broken. Unlike other companies, mismanaged banks cannot go bankrupt because they drag the entire system with them.

<comment><USER8> > And anyway, there's nothing wrong with a certain amount of greediness in a > capitalist system, this is what drives innovation and efficiency.

I wonder how many years will pass before people realize this mantra is an article of faith.

<comment><USER9> We're currently at 240 years, so I wouldn't hold my breath.

> _It is not from the benevolence of the butcher, the brewer, or the baker > that we expect our dinner, but from their regard to their own interest. We > address ourselves, not to their humanity but to their self-love, and never > talk to them of our own necessities but of their advantages._

[http://geolib.com/smith.adam/won1-02.html](http://geolib.com/smith.adam/won1-02.html)

<comment><USER10> Greediness is not the same as simply regarding one's interest, though the line is subjective.

<comment><USER9> The greed that people talk about when they say that greed is good (by way of Wall Street, the 1987 movie) is, though.

Also, a great many uses of the word in (lazy) criticism of markets and capitalism is that too.

<comment><USER8> > The greed that people talk about when they say that greed is good (by way of > Wall Street, the 1987 movie) is, though.

Thing is, you can't reduce the pursuit of self interest to accumulating wealth. Therefore, even if we accept the definition of greed as merely pursuing wealth, we misunderstand Smith's quote and fail to acknowledge many sources of creativity. By disproportionately rewarding greed and not other work incentives, we build a society for the few that are driven by it, at the expense of most, and ultimately, we cannot thrive.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Quote from OA

 _" Voters in large numbers have been rejecting much of the underlying logic behind a dynamic globalized economy that on paper seems to make the world much richer."_

In the UK, we don't actually _know_ why 17+ million chose to tick the leave box.

My conversations with a handful of people who did vote leave suggest a range of reasons from immigration, through to 'loss of control'. Macroeconomic policy does not seem to figure prominently.

The government of Mrs May is further to the right of that of Mr Cameron. Her published statement does mention a softer approach to social factors and a desire to spread the rewards around more evenly...

[https://www.gov.uk/government/speeches/statement-from-the- ne...](https://www.gov.uk/government/speeches/statement-from-the-new-prime- minister-theresa-may)

...we shall see how that actually goes over the next few years in terms of actual law (look out for 'red tape' discussions - your red tape may be my employment rights) and policy (look out for some systematic way to replace the EU grant system that has recycled tax income from London/South to North).

<comment><USER12> Do you think millenials being priced out of London as it became a global money laundering hub had anything to do with it? That's what I hear from my friends there.

<comment><USER13> Unlikely. If you look at the age breakdown of the vote, millenials and other assorted youngsters voted overwhelmingly for "Remain", while the older cohort voted for "Leave".

<comment><USER14> > If you look at the age breakdown of the vote

That's not the breakdown of the vote but of _exit polls_ and other opt-in polling such as YouGov surveys. Both of which are biased towards those (1) likely to contribute and (2) not concerned about sharing how they voted.

The actual demographic composition of the vote is unknown, it _could_ be determined ( all UK ballot papers are linked to their voter ) but that would be unprecedented and probably bad for democracy.

<comment><USER15> > (2) not concerned about sharing how they voted

Are exit polls not anonymized in the UK? At the last federal election in Germany, I was asked to contribute in an exit poll, and they had their own voting booth and urn set up for that purpose next to the actual voting room.

The ballot was mostly identical, except for additional checkboxes for age group and gender, which they wanted to break down in their analyses. So still reasonably anonymized.

<comment><USER14> The exit poll for the EU referendum at my local voting station was conducted by a man with a tablet computer! I didn't stop to investigate the process, unfortunately.

<comment><USER3> Haven't ever seen an exit poll round here. No one was trying to gage who voted for what near any of these polling stations.

Guess it's more common in some areas than others.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> I'm pro-economic liberty and voted for Brexit. Every analysis like this has tunnel vision: yes, the free trade opened up by the EU brought prosperity to an entire continent. Had we been voting for the 1970s era EEC, I'd have gladly voted Remain.

But in 40 years the EEC has evolved into the EU, with a constitution, a parliament, a president, a national anthem, a flag, supreme law-making powers and a currency.

 _Maybe_ the Merckel anti-integration faction will remain dominant and they'll stop there. Given the Juncker faction pushes further integration as the solution to every crisis, and given the EU is in constant crisis, the next 10 years should be interesting.

The EU is a world-historical experiment in social democracy - free markets + state regulation + the welfare state. The consensus is that this system represents the current pinnacle of political evolution. (Both 'progressive' Scandinavia and 'capitalist' America implement variants of it). An alternative perspective is that it's simply a compromise system which emerged after WWII and is already showing severe cracks.

Maybe the EU will create prosperity by such actions as forcing Google to break up, throwing state money at impoverished regions, etc. Maybe the populations of France, Spain, Italy et al will accept that they can't fund welfare states by borrowing in perpetuity and stop voting in radical left-wing governments. Maybe they'll find an alternative solution to the ever growing debt-burden, over Piketty's proposal for seizing 15% of all bank accounts. [https://en.m.wikipedia.org/wiki/Proposed_long- term_solutions...](https://en.m.wikipedia.org/wiki/Proposed_long- term_solutions_for_the_Eurozone_crisis)

I have no idea. I would like to see pro-EU articles which actually address these issues, and not simply assume that the only reason to be against the EU is that you're an ignorant racist, deluded by propaganda and lies.

<comment><USER17> > The EU is a world-historical experiment in social democracy - free markets + > state regulation + the welfare state. The consensus is that this system > represents the current pinnacle of political evolution.

Where does the EU provide the means for a welfare state? Do jobless people get money from the EU? Any country can handle its own version of welfare state. There is no mandate from the EU.

The perception is usually actually the other way round: many people think the EU caters too much to the multinationals and bends over backwards to let the "turbo capitalists" have their way with the little people. At least that is what I hear from pretty much everyone I know in the south of Europe, the left in France and Germany, and UKIP supporters in the UK (think of the TTIP discussions). So which is it now? A socialist welfare state or bureaucrats pleasing bankers and corporations?

<comment><USER18> It's the "quantum immigrant" problem - where simultaneously immigrants steal all jobs and at the same time sit at home and claim all the benefits.

</comment></comment></comment><comment><USER19> > "Voters in large numbers have been rejecting much of the underlying logic > behind a dynamic globalized economy that on paper seems to make the world > much richer."

That's a very different narrative than the one I recognise. From what I've seen the main effects of globalisation have been twofold:

1\. Lowering prices by getting the working classes of all countries to compete with each other.

2\. Giving multinational companies greater leeway in tax avoidance.

The narrative that either benefits us all is somewhat misleading. Furthermore, with increased automation we'll see an even more rapid concentration of wealth in the hands of the few.

On a semi-related note, if you have the time to watch it (it's roughly 2 hours long, but it stays interesting throughout IMO), I can recommend this video, it's a conversation between Yanis Varoufakis and Noam Chomsky, it helped me develop a further understanding of the problems in the EU, and the issues that come from unelected bodies taking over our democracies:

[https://m.youtube.com/watch?v=2WG-uEND74E](https://m.youtube.com/watch?v=2WG- uEND74E)

<comment><USER20> Exactly. The average citizen doesn't see much of the benefits of globalization. It mostly helps governments and companies.

<comment><USER21> Tell that to my cheap phone made in China running an OS made by developers from around the world. My Turkish t-shirt, the Spanish tomatoes I ate this morning or the server I'm remotely setting up on the other side of the planet, so my company can sell their services there.

<comment><USER5> You benefit as a _consumer_ , but you may lose as a worker.

We end up in this strange environment where manufactured goods are very cheap compared to housing and professional non-importable services like health and education.

</comment></comment></comment></comment><comment><USER22> The person does not seem to draw to anything actionable, and his conclusion is vague.

I am not sure what he even means by 'optimizing for efficiency'

If your business depends on the happiness of your employees then optimizing for their happiness increases your bottom line.

If your business will be shut down if you commit fraud then optimizing for transparency is in your interest.

Is this person blaming economists for something that they do not have much control over - and that is thinking about individual lives. Its mathematically not possible for economists to worry about each person.

The reason why people are angry is that employment is closely linked to your ability to feed yourself and be a consumer of the global economy.

So when politicians talk about employment - what they mean is a person's ability to survive.

<comment><USER23> For economists, efficiency is simply that goods should be created where the surroundings are best suited for it - first described by David Ricardo in the 19th century. E.g. Cotton should be planted where there is the most fertile soil etc. This works best in a globalized economy where production can move around freely and where there are no trade restrictions. As a result, productivity is higher, meaning that goods are cheaper (if there is competition), meaning that - provided the result is used for consumption - that everybody is better off. This doesn't take into account that a) labor doesn't move freely, meaning the change process creates winners and losers, and uncertainty (locals are in constant danger that their job is reallocated to some other place), b) it gives an incentive to move production to places with lowest priced-in externalities (labor market frictions like unions, environmental damage).

<comment><USER24> "Cotton should be planted where there is the most fertile soil etc."

Nitpick: this statement is about _absolute_ advantage, whereas Ricardo emphasised _comparative_ advantage: [https://en.wikipedia.org/wiki/Comparative_advantage#Ricardo....](https://en.wikipedia.org/wiki/Comparative_advantage#Ricardo.27s_example)

Imagine that you're better than me at everything (both programming and needlework). You can program three times as fast, and sew twice as fast as I can. Does that mean you should do all your own programming and sewing? No.

However small my contribution, I can save you _some_ time by doing some sewing for you. In that saved time, you can do more programming than I could have achieved in the time I spent sewing. So in sum we're better off. So, there are potential gains from trade.

<comment><USER25> Yes, but at a certain threshold that is no longer true due to logistics. For instance, I could try to sell back all the plastic bags I got at the grocery store, and even if I folded them flat, made sure they were clean and ready to reuse, no matter the price, the grocery store owner would with all likelihood refuse to buy them from me.

Because, regardless of how much money would be saved from buying my bags over the ones fresh from the factory, it wouldn't be able to cover the logistical cost to the company's workflow.

<comment><USER24> My simplified example was designed to demonstrate the difference between absolute advantage and comparative advantage, and show that there are gains from trade, even when one party has absolute advantage for all output goods.

There is no doubt that transactions costs and other friction make some potential exchanges uneconomical. So, what you say is true. But it doesn't help or hinder my explanation, and is irrelevant to the point I was trying to make.

</comment></comment></comment></comment></comment><comment><USER26> The issue he's talking about here is financialisation of the economy. It's an economy that's efficient at delivering large profits for an increasingly concentrated number of businesses and people.

Jobless recoveries, debt deflation, etc.

The answer of course is a reversal of the trend of neoliberalism over the past 40 years, to re-regulate banking and finance, increase government spending and return to full employment as a policy priority.

This is all achievable through understanding Modern Monetary Theory. If anyone is interested in finding out more check out this Facebook group[1].

If anyone in Australia is interested I'm also starting a political party based on these principles.[2]

[1] [https://www.facebook.com/groups/introductiontommt/](https://www.facebook.com/groups/introductiontommt/)

[2] [http://www.australianemploymentparty.org/](http://www.australianemploymentparty.org/)

</comment><comment><USER27> An interpretation:

\- Many people want to be able to have agency in what their future is like.

\- A quest for economic and technological growth makes the future unknowable, and makes predictions about what skills (and capital) will provide a livelihood to support your family as tricky as predictions about how much a startups equity will be worth. Many (most?) people can't effectively make these predictions and they suffer pretty badly.

</comment><comment><USER28> _Perhaps the pursuit of ever higher gross domestic product misses a fundamental understanding of what makes most people tick. Against that backdrop, support for Mr. Trump and for the British withdrawal known as Brexit are just imperfect vehicles through which someone can yell, "Stop."_

Did the author communicate at all with Trump supporters and leave voters, or is this just speculation? The support given in the article seems pretty weak: an unrelated abstract experiment about efficiency versus equality and a reference to another newspaper article about a BMW worker.

</comment><comment><USER29> I think this idea that Trump is anti-establishment is a play right out of the Game of Cards show.

Look at Obama, he had the Hope and Change rhetoric going, they even gave him a Nobel Peace Prize.

What did he actually accomplish? Medical costs are 5x what they were in some cases. The middle east is still in disarray. Police and protesters are clashing.

They talk a big game before getting elected, but the reality is that they have very little power once they are elected.

They would be better off reading Economics in One Lesson by Henry Hazlitt then working off improving minor things.

<comment><USER30> Even trying to fix your three examples is fairly impressive for a US politician. Particularly as his opposite numbers (Trump included) run on a platform of intentionally making these things worse.

</comment></comment><comment><USER31> People voted _for change_ (Brexit?) in order to keep things unchanging?

Not sure the theory fully checks out, but it seems very clear indeed that the policy narrative that's all about economics is not something normal people can feel connected to. It's just that it's easy (?) to measure and thus has taken over the debate. But if I'm a German or Dutch worried that TTIP will bring America's 'chlorine-soaked chicken' on my plate you can tell me as much about job gains as you want and i won't hear it - statistics and numbers don't feel real. Policy has to find the reconnect with reality, that means probably to purge the lawyer and economist thinking that pretty much dominates all ministries and government.

</comment><comment><USER32> Is there some source that elites want "hyper-efficient global economy"? From what I see, there is a push towards bigger government spending and higher taxes. A lot of that actually decreases efficiency, to the point it suffocates some industries.

<comment><USER33> The American health care system seems to be way less efficient than the state run systems in Europe.

</comment></comment><comment><USER34> Rent control and protectionism are different, and immigration for instance, a hot subject in today's politics, is another thing altogether.

Supporting rent control doesn't make you stupid/uninformed, but the only other option is evil.

Protectionism is a complex topic in a world with currency manipulation, labor laws variability and geopolitical conflicts; it's only simple (and evil/stupid) in a world without these things.

And immigration is not just about economics, it's about who you want to live next door and vote. Here, people can disagree regardless of economic views.

</comment><comment><USER35> > favored equality over efficiency

I think this is the wrong trade off. More equality does not necessarily mean less efficiency.

</comment><comment><USER36> It might have something to do with the fact that the weaker the economy gets the more the rich get rich and people know it. Whether they recognize that it through inflating of the stock market, bonds and real estate with cheap credit or not.

Central bankers can't seem to get it into their thick heads that their 'wealth effect' is a 'poverty effect' for those who didn't get the chance to own those assets before they pumped them up out of reach.

The fact that the central banks of Japan and Switzerland own most of the companies that we are employed by and pay money to thanks to their ability to create money out of nothing should make people angry.

</comment><comment><USER37> I recall a study that showed that above average income workers supported Trump at a higher percentage. If that's true, it seems to contradict the whole premise of this article. They should have asked those same Yale grads if they were voting Trump or not.

<comment><USER30> You're probably thinking of this:

[http://fivethirtyeight.com/features/the-mythology-of- trumps-...](http://fivethirtyeight.com/features/the-mythology-of-trumps- working-class-support/)

One thing that confounds it is that Hispanic and African-American voters avoid Trump due to his appeals to white supremacy, and they are poorer than average. So if you only count "real Americans" then there may still be some truth in it.

</comment></comment><comment><USER38> I'm a little amazed at the tone of this article.

People rent a home, and then exploit the democratic process in a beggar-thy- potential-neighbors strategy. They use things like rent control and other anti-migrant policies (e.g. anti-Google bus policies in SF, anti-Hijab laws in France) to enrich themselves at the expense of others.

Because her wealthy uncles lost their job, and had a small drop in their standard of living, "Andrea" wants to screw over a bunch of desperately poor people a world away.

Unlike "Andrea", our elites behave far better. Populists try to protect their favored ethnic groups - witness Shiv Sena trying to pass laws preventing non- Marathis from driving taxis, or "tech bros" entering SF. In contrast, I've never heard a white banker complaining about allowing a Marathi to be the CEO of Citi. Elite institutions - think of banking or tech - tend to be truly global enterprises, open to anyone who can demonstrate the requisite ability.

Somehow the author doesn't draw the obvious conclusion: that our elites are honest, moral and principled individuals, while our masses are selfish, tribal and greedy people out to beggar their neighbors. For good policy making the conclusion is that we should try and increase the power of the elite.

<comment><USER25> "Tech bros" don't like their jobs outsourced to India. That's comparable to your examples, yet they are mostly upper class.

In addition, people are concerned about things that effect _themselves_. The elites don't care about the neighborhoods they don't live in, or the jobs they don't have to compete for.

But they do care about profit, and about getting richer. In all of the examples you gave, that motivation would work just as well as being "principled" as to explaining their allegiance to the opposite side of the issues as to that of the lower class.

If the world ends up 99.99% of us are either starving or doing jobs such as building a carbon fiber toilet for some rich guy's yacht, simply because the elite "own" everything, the world would be a worse off place, wouldn't you agree?

And, IMO, that's what will occur if we strip away all laws meant to protect the little guy.

<comment><USER38> I've never actually met a tech bro who objected except on HN. Everyone I've met has been fine with economic competition from people unlike them. But I could be wrong - do you have evidence that tech is even remotely as protectionist as the trump/Bernie voting masses?

The local elites don't need to compete for CEO jobs with Satya Nadella or Sunder Pichai? That's news to me.

<comment><USER39> The people you are talking about are either your coworkers or those you've met in a workplace related environment, correct? Management wants to do the best things as quickly and cheaply as possible, and anyone who speaks out about it publicly or to their coworkers would be doing harm to their career.

The same is true in any industry. On the factory floor, workers who complain loudly about immigrants working side by side them at the workplace will get them fired.

The same people who you _think_ are all for globalization of the workforce, may also be part of the "trump/Bernie voting masses" behind closed doors.

As for the CEO jobs, there isn't a large group of voters that identify with candidates. I mean, this is getting kind of silly. Do I really need to explain why someone competing for a CEO job with an immigrant can't look to the political process to help them?

And anyway, even if I'm wrong and tech workers are for the race to the bottom, you are quibbling about minor things while ignoring my main point. Do you really think there is morality in denying the lower class a voice to help change the situation they are in? Are the laws shat out by our ancestors so great we cannot change them, even though the result turned out not to be so good? Is it like a board game, in that if you lose, it's unfair to complain because you should have been able to deduce what would happen from the beginning?

What, exactly, do you mean when you refer to the elite as "honest, moral and principled individuals" in your parent post?

<comment><USER38> By honest, moral and principled, I mean they don't try to exploit politics to screw over their neighbors. They just compete economically. Kind of like the article claims, and mg experience agrees with.

Some people also didn't want to get into a race to the bottom with negros. I think it's perfectly moral to deny lower class whites the right to change their situation by harming the competition.</comment></comment></comment></comment></comment>


Zerologon: Instantly become domain admin by subverting Netlogon cryptography - <AUTHOR> https://www.secura.com/blog/zero-logon <comment><AUTHOR> Blog post with a little more explanation and links to exploits: [https://www.tenable.com/blog/cve-2020-1472-zerologon- vulnera...](https://www.tenable.com/blog/cve-2020-1472-zerologon- vulnerability-in-netlogon-could-allow-attackers-to-hijack-windows)</comment>


FDA approves Theranos test for HSV-1 - <AUTHOR> http://fortune.com/2015/07/02/theranos-fda-approval/ <comment><USER3> One guess I have about theranos , is that they are going to radically change healthcare in Africa. Why ?

Well let's start with the fact that the main thing preventing labs-on-chip devices transforming Africa today is business reasons - its just not seen as a good investment by western companies.

But what's unique about theranos is that it is owned by Holmes ,which seems very idealistic(as her main motivation here ) , and her father worked for years helping African healthcare .

So I think Holmes will use the strong business it will build in the west to create and extremely low cost African healthcare .That also explains why she has advisors like foreign state secretary and why bill gates is very impressed with her.

<comment><USER4> Yeah, I suppose commodisation of services has the advantage that the benefits tricle down easier to developing economies as boxed solutions require less infrastructure and human capital. Everybody wins.

<comment><USER3> I think it's more than commodification. My guess is that price in the west would be much higher than in africa(where products will be sold at cost) - <USER2> still relatively low, mainly because investors want profits. And whole in whole it's the moral thing to do, especially with the fact the healthcare quality in the west will increase.

As a general note, i've seen research talking about prices of 0.01 CENTS PER TEST for some lab-ob-a-chip methods.

</comment></comment></comment><comment><USER5> The biggest problem with mass testing are the false positives. When you're testing 100 million people even a low false positive rate of 0.1% will still mean that 100 000 people will think they're sick when they're not. I once even saw an example where they calculated that when everybody did an HIV test most positives actually would be false positives.

</comment><comment><USER6> All that hype for a microfluidic sandwich ELISA?

<comment><USER7> Agreed. I was expecting something revolutionary in the report linked from the article. I'm pretty shocked that a technique from the 1970's is only now "disrupting" the medical laboratory industry. I'm not saying that this isn't impressive, just that it seems it should have been done a long time ago!

</comment></comment><comment><USER8> I didn't realize that Walgreens is already doing Theranos tests.

[http://www.walgreens.com/storelocator/find.jsp](http://www.walgreens.com/storelocator/find.jsp)

What tests do they perform? Is this something that we should be doing yearly?

[update] fixed typo

<comment><USER9> Walgreens and Walmart are two different companies, despite the similarity of their names.

Walgreens had $76b in revenues last year and was founded in 1901. Walmart wasn't founded until 1962, but had $485b in revenue.

[https://en.wikipedia.org/wiki/Walgreens](https://en.wikipedia.org/wiki/Walgreens) [https://en.wikipedia.org/wiki/Walmart](https://en.wikipedia.org/wiki/Walmart)

<comment><USER8> Fixed the typo. I know the difference. I walk by Walgreens daily, but never shop there.

</comment></comment></comment><comment><USER10> What the heck, I posted this exact same link like 12 hours ago.

<comment><USER11> Entrepreneurs know not to bitch like this. Not only the idea is important, timing is important. The market was not ready for your idea 12 hours ago. Also luck plays a role. The right people did not see your post at the right time to upvote it.

<comment><USER12> I'd love to see a postmortem of why the original post failed. It would be useful for future posters. Honestly, we've all been there, even though you always feel like you have to tell people you're "killin' it!" with your HN submissions.

<comment><USER13> There was a discussion about the best timing to post on HN a couple of years ago :

[http://silverman.svbtle.com/the-best-time-to-post-on- hacker-...](http://silverman.svbtle.com/the-best-time-to-post-on-hacker-news)

[https://news.ycombinator.com/item?id=4757790](https://news.ycombinator.com/item?id=4757790)

And also who said it was irrelevant:

[https://news.ycombinator.com/item?id=9426040](https://news.ycombinator.com/item?id=9426040)

[http://antontarasenko.com/2015/04/23/best-time-to-post- its-i...](http://antontarasenko.com/2015/04/23/best-time-to-post-its- irrelevant/)

</comment></comment></comment></comment><comment><USER14> I started reading this article and ended up reading Meditations by Marcus Aurelius... totally forgot about the original article</comment>


Tesla Cybertruck to become New York man's power source for tiny home - <AUTHOR> https://www.teslarati.com/tesla-cybertruck-tiny-home-power/ <comment><USER2> Wow, this reads like an ad.</comment>


Ask HN: iPhone/mobile devs: Please help me by filling out this quick survey...  - <AUTHOR> http://surveys.polldaddy.com/s/5E272885C166F4D1/

<comment><AUTHOR> I'm posting this under a new account, but I've been around HN for a couple years now...

I just wanted to get a feel for how developers are approaching the choice between native iPhone apps and mobile web apps.

If you could help out, the survey shouldn't take more than just a couple of minutes max.

Thanks!

<comment><USER2> Will do - but please share results!</comment></comment>


Stop putting two spaces after a period (2014) - <AUTHOR> http://www.cultofpedagogy.com/two-spaces-after-period/ <comment> dallas-stuart I'm well under 40, and happily use two spaces. I find it helps with clarity of reading for many fonts, and is worth the millisecond to double tap SPACE.

BTW, I do this mostly from Emacs, while indenting with Tabs.</comment>


TrendMicro Node.js HTTP server listening on localhost can execute commands - <AUTHOR> https://code.google.com/p/google-security-research/issues/detail?id=693 <comment><USER3> Props to Tavis for maintaining his composure in the face of this incompetence. Despite his mounting frustration, you can see he keeps repeating his request, "Turn it off, apologise for the disruption, and then get it audited before turning it on."

Even when they perform their half-solution, he still evaluates it on its merits, and then suggests how they can do better. A model of professionalism in the face of an absurd situation.

</comment><comment><USER4> What an absolute clusterfuck. I work at a multinational company who's IT department (over my objection) installs Trend Micro on all user end points. I'll be sending this the department head's way, Trend might lose some business over this

<comment><USER5> This is clearly a terrible design flaw by Trend Micro. I hope some responsible are looking for new jobs.

Still, there isn't much faith I put in any endpoint security solutions. They are all terrible.

Bromium seems to be bucking the trend of traditional endpoint security but they have one of the worst sales / business dev programs I have ever seen. They should be much more ubiquitous than they are.

<comment><USER6> "I hope some responsible are looking for new jobs."

If they look for (and find) new jobs wouldn't that just mean the problem is diffused? Personally I would hope they learn from the experience of failing than to get punished for it.

<comment><USER7> Personally, I hope everyone else (not at Trend Micro) learns from this experience. Computer security auditing is a serious expertise, it's hard but made much harder to impossible when you don't have experts on the team and instead consider security expertise as a hobby for the qualifier.

trendmicro.com > About > "Smart, simple, security that fits"

And then second is, "a global leader in IT security" and "25 years of security expertise".

What a crock. I'm supposed to take the company's position statements and products seriously after reading this issue report? This is like finding a sponge in the body cavity of a patient. It's functionally malpractice. The CIO and CTO should be fired. The CEO probably should resign, what else is the purpose of a CEO other than to make sure the main things the company stands for are true, and actually ships products that demonstrate it stands for those things? If they don't resign the board needs to fire them.

<comment><USER7> I'd like to point out that it'd be an even bigger and redder red flag (if that's possible), should Trend Micro fire some team "security" developer, or even the product manager.

How is it possible, that a company which describes itself in the terms it has [1], have not done a thorough code review of all products before making them public? That is implicit in their own description of what their business does.

I'm not even sure the worst parts of this particular product's flaws would have escaped cursory code review by someone who is actually a security expert. And if that's true, then selling this product as it was before patching, might be fraud.

[1] [http://www.trendmicro.com/cloud- content/us/pdfs/about/ds_cor...](http://www.trendmicro.com/cloud- content/us/pdfs/about/ds_corp-facts-stnd-size.pdf)

</comment></comment></comment></comment></comment><comment><USER8> From the email thread:

> I happened to notice that the /api/showSB endpoint will spawn an ancient > build of Chromium (version 41) with --disable-sandbox. To add insult to > injury, they append "(Secure Browser)" to the UserAgent.

> I sent a mail saying "That is the most ridiculous thing I've ever seen".

This is indeed unbelievably ridiculous.

<comment><USER5> More ridiculous than that time Microsoft shipped an operating system with no firewall enabled by default and a feature designed to allow for remote commands to be executed?

I think the Blaster Worm and other variants that took advantage of that excellent decision were far worse.

[https://en.wikipedia.org/wiki/Blaster_(computer_worm)](https://en.wikipedia.org/wiki/Blaster_\(computer_worm\))

[https://books.google.com/books?id=_TgEAAAAMBAJ&pg=PA60&lpg=P...](https://books.google.com/books?id=_TgEAAAAMBAJ&pg=PA60&lpg=PA60&dq=steve+gibson+windows+xp+firewall&source=bl&ots=-INXwLArT3&sig=rAt1aZ9PrKdl4ZeJhrfi1KqVMEU&hl=en&sa=X&ved=0ahUKEwiKvNrr06LKAhWBSCYKHS6sBmEQ6AEIPzAF#v=onepage&q=steve%20gibson%20windows%20xp%20firewall&f=false)

<comment><AUTHOR> You can make a lot of things sounds comically insecure, very much including virtually all open source software, if you use 2003 as the benchmark.

<comment><USER9> Not really.

A FreeBSD 4.x system with a (modestly) stripped down kernel and running sshd was not only rock solid in 2003, but would probably be rock solid today.

Just to pick one random example.

<comment><USER10> Doesn't sound like a random example to me. It sounds like one of the most secure examples you could think of.

</comment></comment></comment></comment></comment><comment><USER11> Having studied their Linux Antivirus (TrendMicro ServerProtect), it's far from a clean, safe and well maintained piece of software:

* It comes with its own http server (apache, with a conf file mentioning NCSA (!))

* Their realtime kernel module barely compiles (on quite old kernel versions), has a disgusting code and Makefile and makes the computer slow or simply crashes when it kind of works.

* They ship their Antivirus with quite old libraries, some compiled more than 10 years ago, and some probably impacted by several CVEs (openssl < 1.0.0, quite old libxml).

* Their init scripts are an ugly thing written in perl lauching several services in one script.

* Their rpm packages are just mindfucking. You have one rpm package to install the software, and other rpm packages to patch it... WTF.

From a piece of software, running as root (or even worst, in kernel space), written in C and analyzing untrusted inputs by definition, it's a bit worrying to say the least.

<comment><USER12> Why is a conf file mentioning NCSA so surprising? Mosaic has a lineage that can be traced to modern browsers like Edge, so it'd make sense to have conf items geared toward the NCSA family of browsers.

<comment><USER13> That'll be talking about NCSA HTTPd, the ancestor of Apache. Apache forked in 1995.

[https://en.wikipedia.org/wiki/NCSA_HTTPd](https://en.wikipedia.org/wiki/NCSA_HTTPd)

Any Apache configuration file mentioning NCSA would be from the Apache 1.x lineage.

</comment></comment></comment><comment><USER14> With regards to TrendMicro I still remember having to deal with an end user who had this installed and had the "internet security" feature enabled.

It intercepted the not-quite standard response header "Content-Encoding: ps- bzip2" to our windows client application, stripped off the header it didn't understand but, of course, didn't decompress the payload.

So our application has not seen a Content-Encoding header and thus tried to run with the presumed-non-compressed response - that went really well.

Since that day, our server uses a content-type header that contains the word bzip2 :(

The icing on the cake: The customer in question told me that their cousin is working at TrendMicro and that they are by far the best virus scanner out there and that this must clearly have been my fault.

I'm not surprised that they also get other stuff wrong.

However, I'm surprised at the level of incompetence shown here. This is a _security_ product after all.

<comment><USER15> > It intercepted the not-quite standard response header "Content-Encoding: ps- > bzip2" to our windows client application, stripped off the header it didn't > understand but, of course, didn't decompress the payload.

I think this is actually a feature in many different products from different vendors. If I recall correctly, ISA Server (since 2004!) and the like inspect HTTP and SMTP traffic and validate it for conformance to published standards. If a malformed SMTP message comes in, it discards it. This prevents your mail server from being exposed to malformed messages, which could lead to denial- of-service/remote-code-execution/maybe it will be fine who knows.

<comment><USER14> The content encoding header is meant to be extensible. This is where chrome added sdch and now we're about to get brotli compression in Firefox and chrome. If that release of trendmicro was still in use, people wouldn't be able to visit Google with chrome nor any upcoming site with brotli support.

Also, if they didn't like my ps-bzip2 encoding, they could have also stripped it off the clients accept-encoding header, causing the server to not compress the response. But they left it there and just stripped off the content- encoding response header.

<comment><USER16> Headers are meant to be flexible in theory, but in reality it seems that anything outside the most common few are going to break things.

The series of blog posts linked below might interest you.

[http://noxxi.de/research/http-evader- explained-2-deflate.htm...](http://noxxi.de/research/http-evader- explained-2-deflate.html)

</comment></comment></comment></comment><comment><USER17> What a shamble.

This thing with so called security products should be regulated somehow. These sort of exploits should carry a huge fine from the FTC or something of the sort as this, and many other "security" products (I'm looking at you AVG) is blatant deception, if not the exact opposite.

<comment><USER18> We should all demand 3rd-party audits of our security products.

<comment><USER19> I've been saying for years that unregulated information security will lead to an Enron-level disaster and eventually result in legislation similar to Sarbanes-Oxley. It's a shame it will take a huge disaster for this to happen.

<comment><USER20> The huge disasters have been happening, repeatedly, for years.

There are botnets in the millions running on supposedly "Norton-protected" PCs.

No one cares. It's not a problem the people in a position to do anything about even understand.

</comment></comment></comment></comment><comment><AUTHOR> This is so bad that Tavis Ormandy was "astonished" by it. That has to be saying something.

<comment><USER21> The title on HN understates the case at this point. It's not just remote code execution (more than bad enough, by itself). If you are foolish enough to trust Trend Micro, they install a password store, whence:

       Then you can use the decryptString API to decrypt all the strings, and then
       POST them somewhere else.

       So this means, anyone on the internet can steal all of your passwords
       completely silently, as well as execute arbitrary code with zero user
       interaction. I really hope the gravity of this is clear to you, because I'm
       astonished about this.

You can convince their shit product to _POST ALL YOUR PASSWORDS_ to an arbitrary server.

<comment><USER22> This really is a horrific security flew. Hard to believe that software made specifically to protect users and their computers, opens up the floodgates and serves their passwords on a plate.

I wonder has much damage such a flaw has caused?

<comment><USER23> Where did you get the idea that this software is "made specifically to protect users and their computers"?

<comment><USER24> > Where did you get the idea that this software is "made specifically to > protect users and their computers"?

Read the marketing copy for it.

[http://www.trendmicro.com/us/home/products/software/password...](http://www.trendmicro.com/us/home/products/software/password- manager/)

Note also

* that TM charges _$15 /year_ for any non-toy use of the software (that is, if you want to store more than four passwords)

* the language that describes the "Secure Browser" feature, which is really an ancient version of Chrome/Chromium that has sandboxing turned off.

</comment></comment></comment></comment></comment><comment><USER25> I'm finding it harder and harder to understand why I should ever install software that hooks into my OS on multiple levels and opens holes to the outside world without any notification in the name of "security"

<comment><USER26> You shouldn't. Antivirus is a relic of the early 2000's.

<comment><USER27> Let me back this comment up with some reading material and useful resources:

[http://decentsecurity.com/about/](http://decentsecurity.com/about/) (This entire website)

[https://www.microsoft.com/emet](https://www.microsoft.com/emet) (for Windows)

[https://paragonie.com/blog/2015/06/guide-securing-your- busin...](https://paragonie.com/blog/2015/06/guide-securing-your-business-s- online-presence-for-non-experts) (basic web security advice for non-technical people)

You don't need AntiVirus.

<comment><USER28> I it is not that we don't need it but it is finally obvious that there is no reliable way to detect harmful software. All we are left with is putting each and every application in sandbox, unable to interact with any other software or user data. It is just very hard to make that user friendly and acceptable for average Joe.

</comment></comment></comment></comment><comment><USER29> How did no one within the company catch it? Aren't security products developed by at least somewhat security-minded people? Is it all just a sham?

<comment><AUTHOR> No, security products are not typically developed by people who understand secure programming, even at companies that employ teams of people to do vulnerability research. The people who build security software are the same as the ones who build everything else.

<comment><USER27> Companies that produce "security products" don't give a damn about secure development. They do give a damn about infographics and sales presentations citing "sexy-sounding" research projects.

<comment><USER30> > They do give a damn about infographics and sales presentations citing "sexy- > sounding" research projects

Sort of like the startup community?

<comment><USER27> Not too different. Most antivirus is based on a flawed premise, and most hackers know this.

[http://www.sevagas.com/IMG/pdf/BypassAVDynamics.pdf](http://www.sevagas.com/IMG/pdf/BypassAVDynamics.pdf)

</comment></comment></comment></comment></comment><comment><USER26> Just another reminder that antivirus is dead. Any antivirus can be trivially circumvented. Based on the level of incompetence of multiple antivirus developers over the past few years, and my own experience with antivirus slowing down and heating up my machine, antiviruses themselves are more trojans than anything.

<comment><USER31> GPO with AppLocker (app whitelisting) seems to be a good solution for Windows, kind of a pain to setup though.

<comment><USER32> While that seems like a somewhat sensible approach for non-technical end users (modulo various kinds of runnable scripts), a whitelisting approach can't possibly work in an organization doing software development.

I can't think of any technological approach that _would_ work in such an organization, short of completely redesigning end-user client systems.

</comment></comment></comment><comment><USER33> > They are already in discussion with stakeholders regarding the emergency > deployment of this fix.

You know a company is managed ineffectively when you can't even deploy security patches without talking to stakeholders. In any reasonably-managed company, stakeholders would only be involved with the press release announcing the issue (if at all).

<comment><USER27> This is true. The only time I ever had to talk to my CEO about a security patch was, "Sorry, this bug is kind of urgent and the fix needs to be deployed before tonight. Bring be back some orange chicken?"

<comment><USER34> Stakeholders != CEO. It can be, but it's hardly the only option.

<comment><USER27> We don't have puppeteers, so, it's the only approximation I could muster from my experience.

<comment><USER35> I don't understand this thread at all.

Where I live, "stakeholders" just means the people responsible for or affected by something. Being "in discussion with stakeholders" about a fix just means talking to everyone involved in getting it deployed.

Is this term used with other meanings?

<comment><USER27> I misread it as "shareholders" to be honest.

</comment></comment></comment></comment></comment></comment><comment><USER36> This is so blatantly incompetent that I can only imagine the situation being a result of corporate _dance_.

While there are many oblivious developers, I highly doubt that incompetence was the root cause. I'd point to a lovely mix of a) deadlines; b) slow internal procedures to approve the usage of third-party libraries; and c) requirements being passed to developers without context. It's hell, what corporate environments can push us to do. I'd bet that most of the people who worked in big corps have their own stories about internal procedures making them do things they objectively knew were wrong.

</comment><comment><USER37> Well this is scary. How am I to trust a password manager if something as obvious as this is allowed to be shipped to the end user?

<comment><USER38> Most password managers are heavily audited. Likely why the Trent Macro one wasn't is because nobody with any technical sense is installing their nonsense to begin with.

But LastPass, Keypass, Chrome's password manager, Firefox's manager, and IE are audited all the time, with tons of exposé articles supposedly trying to inform us about how weak they are (but all these articles do is further clarity how strong they are, since they only find trivial issues, or they misunderstand a feature as a bug).

I cannot recall the last time any of these had what I would consider a REAL security bug.

<comment><USER39> Chrome and firefox both store saved passwords in plain-text in easily accessible local databases. Don't rely on them to keep passwords safe. I have no experience with IE's password locker.

<comment><USER38> > Chrome and firefox both store saved passwords in plain-text in easily > accessible local databases.

All password managers store plain text passwords. That's literally a requirement for them to work at all.

Chrome encrypts the password in the SQLite database[0] using Windows' CryptProtectData() API, and Firefox encrypts the passwords either using your master password, or if none is set then it encrypts but stores the encryption key in the key3.db.

> Don't rely on them to keep passwords safe.

You've presented no justification for that. If you're using a root compromised machine then no password manager is safe. If your machine is secure then your passwords are secure in both Chrome and Firefox, but more secure in Chrome.

[0] [http://www.howtogeek.com/70146/how-secure-are-your-saved- chr...](http://www.howtogeek.com/70146/how-secure-are-your-saved-chrome- browser-passwords/)

<comment><AUTHOR> _All password managers store plain text passwords. That 's literally a requirement for them to work at all._

I'm not sure this is what you mean to say, because, obviously, good password managers don't store passwords in cleartext.

<comment><USER38> You cannot hash passwords in a password manager. It has to be reversibly encrypted and turned back into plain text before utilisation.

So when people complain about password managers storing plain text (as opposed to hashing) they're barking up the wrong tree, it is a necessary evil.

You just want to see them encrypt those plain text passwords so that offline recovery is harder. That's what both Firefox's master password, CryptProtectData() for Chrome/IE, and the key-chain in OS X provide.

<comment><AUTHOR> I think you're trying to say something akin to but not quite "plaintext equivalent", and your terminology is mangling your argument.

</comment></comment></comment></comment></comment></comment></comment><comment><USER40> > To be clear, you can get arbitrary code execution whether they're using it > or not, but stealing all the passwords from a password manager remotely > doesn't happen very often, so I wanted to document that.

Best part.

</comment><comment><USER41> This recent one in regards to an AVG Chrome extension is slightly "less-worse" than this TrendMicro issue: [https://code.google.com/p/google-security- research/issues/de...](https://code.google.com/p/google-security- research/issues/detail?id=675&can=1&sort=-id)

</comment><comment><USER42> [http://www.trendmicro.com/us/about- us/index.html](http://www.trendmicro.com/us/about-us/index.html) Smart, simple, security that fits

As a global leader in IT security, Trend Micro develops innovative security solutions that make the world safe for businesses and consumers to exchange digital information. With over 25 years of security expertise, we're recognized as the market leader in server security, cloud security, and small business content security. Trend Micro Inc. is a global security software company ....

</comment><comment><USER43> > TrendMicro helpfully adds a self-signed https certificate for localhost to > the trust store, so you don't need to click through any security errors.

Anyone know if this uses a non-unique key pair like the Lenovo one did?

<comment><USER44> I don't think it really matters, as long as it's only a certificate for localhost rather than a root CA as in the Lenovo case. I can't think of an attack scenario where an attacker already able to run an HTTP server on localhost would be aided by being able to use HTTPS on that server. Of course, I could be missing something.

</comment></comment><comment><USER45> I can't even begin to describe my loathing for antivirus products. I haven't used one personally in years, but there is a real quandary for a few of my colleagues--they are not very technically inclined. This ranges in consequence from needing help with simple tasks to having absolutely zero instinct/ability to recognize phishing or questionable emails and links. I usually end up putting _something_ on their machines to help but often feel like it's a lost cause.

<comment><USER46> I'm presuming Windows because "not very technically inclined" but at this point when I help such people it's mostly a matter of A) verifying UAC is active and at or higher than the default [1], B) verifying Windows Defender and Smart Screen are active and up to date (Windows Update).

In every case I've seen of Windows Defender or Smart Screen being disabled or out of date it almost always seems to be the fault of a "security product" the user was talked into buying (especially the Norton Insecurity Suite). Defender and Smart Screen together silently but capably do their job at handling the main issues for a not very technically inclined person's systems and I find the harder issue is convincing them not to install games from disreputable sources (random poker websites, the weird shadows of once sort of reputable places like RealArcade and WildTangent) that install irritating adware and occasionally spyware, short of "taking away the UAC keys" and forcing them to call me to type in an admin password to install software for them, which I don't have the time/inclination to do.

[1] If a not very technically inclined user complains they see too many UAC prompts they are probably doing something wrong and you should help them figure that out.

<comment><USER47> Windows Defender on Windows 10 works fine. You'd be crazy to either disable it and/or install a different security product.

</comment></comment></comment><comment><USER48> It's absurdities all the way down!

My favorite part is that they use the address pwm.trendmicro.com. (I had to finger peck that now, my muscle memory kept typing something much more fitting.)

</comment><comment><USER49> Is there a US-CERT advisory for this yet?

Why are those APIs even there? A "retrieve all passwords in the clear" API? A "run browser insecurely" API?

Has anyone considered charging Trend Micro with reckless endangerment or material support of terrorism?

</comment><comment><USER50> On the bright side, they reacted relatively quickly for such a large company, and fixed the vulnerability.

Whoever is in charge of security for that project must be pretty embarrassed (or the person doesn't exist)... Also no audit? cmoooon.

</comment><comment><USER51> Is there any reasonable reason why anti-virus vendors often include shady or insecure software like this? It honestly the worst case of security theater where it looks like its helping but is honestly doing the opposite. And I really wish AVs didn't try to include extras, as this really lowers my disposition against the (scammy) Anti-Virus market. And this isn't the first time that an AV turned out to make the computer less secure.

I have Avira Free installed, But only have the AV part and have disabled Web/Mail Protection. So I am hoping that Avira are trustworthy enough and don't push anything my way.

<comment><USER23> Of course, it's not the first time. As a matter of principle, antivirus software cannot work. The whole idea is a scam. So, how is it surprising that they bundle other equally useless/scammy software?

</comment></comment><comment><USER52> Wow. Feel kinda bad for the TrendMicro team. This has to be rather embarrassing.

<comment><USER53> No I do not feel bad for them at all. More often we see that Antivirus products are total scams. The people behind it are basically criminal. They install rogue certificates, are full of exploitable vectors, share our data with third parties, inject ads in our browser traffic and are just horrible and slow our computers down. From a security perspective, installing an AV actually sounds like a really bad idea these days. They're basically really horrible viruses in disguise. The most horrible kind of virus. These people need to be shamed and I wish these companies nothing but the worst.

<comment><USER54> I still sympathize with a subset of the ICs, those that must see so many problems (maybe even futilely trying to fix them) but being crippled from doing much by internal dynamics. I wish them the courage to pack up and leave for someplace better, while on those who have been responsible long-term I agree with you.

</comment></comment></comment><comment><USER55> Windows defender is the only av I trust to not totally duck up my pc.

<comment><USER56> It's pretty much ineffectual though, as Microsoft themselves admitted some time ago.

It consistently scored lower than most other products in detections/heuristics.

The only thing it has going for it is the light foot print.

<comment><USER57> I think the other might be that it doesn't have glaring, obvious holes like Trend Micro.

</comment></comment></comment><comment><USER58> Can someone ELI5 why TrendMicro would do this? Sincerely--I don't know what they get out of it, unless they're bad guys. Not trying to be snarky here.

<comment><USER32> This seems like a textbook case of Hanlon's Razor ([https://en.wikipedia.org/wiki/Hanlon's_razor](https://en.wikipedia.org/wiki/Hanlon's_razor), "Never attribute to malice that which is adequately explained by stupidity"). They wanted some way for their website to interact with the user's local installation of their software, and somehow arrived at the idea of running a web server on localhost and accessing it from their website, without thinking through the security implications at all. Even their responses in this bug show that they _still_ don't really understand the implications.

Less broken software tends to solve this same problem using a browser extension with a whitelisted domain for access, but that has the disadvantage of requiring a browser extension for each browser, and doesn't fully protect against hostile networks. Including the "[https://"](https://") in the whitelist would provide somewhat more security, especially with HSTS, a pinned certificate, and a carefully-audited single-purpose domain.

But an even better design would eliminate the entire concept of connecting back from the vendor website to the client software. Sometimes the right answer to "how do I" is "don't".

<comment><USER58> Thanks for the explanation, and...

        Sometimes the right answer to "how do I" is "don't".

Beautifully put.

</comment></comment></comment><comment><USER59> Okay so piecing this together, let me know if I am correct. The TrendMicro password manager will utilize a ShellExecute command to open a URL defined in a query string? I feel like not trusting/passing $_GET/REQUEST params was one of the first things that I learned when doing PHP development 12 years ago. Is this a concept that needs revisiting with new-age Node developers?

<comment><USER60> The problem wasn't that they were trusting GET params it's that they forgot that they weren't the only ones capable of sending requests. If you wrote a website that could old be accessed by people/computers you trust then trusting the parameters is no problem.

TL;DR It's not how the data is sent but where it came from.

<comment><USER59> Oh okay, the expectation was that the web server that the application run was to be private to the application and not anything else. I wasn't aware that apps ran their own web servers, how often is that done?

<comment><USER61> Obviously at least once too often. :)

</comment></comment></comment></comment><comment><USER62> >let's worry about that screw up after you get the remote code execution under control. Please confirm you understand this report.

This is an awful vulnerability and their immediate attempts at mitigation are sad but I feel like the Open Source community could do itself a lot of favors by avoiding this kind of tone. Not everyone working as a programmer is as good as you. Not everyone working as a programmer is any good. If you care about security here, why not concentrate on educating them. It's pretty likely the devs at any consumer hardware company aren't world-beaters; if we wanted that we would be willing to pay more than $100 for a router. It's also likely any large company has a chain of command these things have to go down through and back up again and for every link in that chain there's a greater than 0 chance the person has no idea about proper security. You may feel the security flaw is an obvious red flag that should have peoples' hair on fire but not everyone understands what you do.

<comment> nezza-_- > If you care about security here, why not concentrate on educating them.

They are selling a security product. They are the ones that should already know these things.

<comment><USER63> To add on to this, by submitting the bug report, Tavis did not somehow magically become responsible for educating Trend Micro programmers about security.

</comment></comment></comment><comment><USER64> 1/11 Trend Micro. Never forget! I can see how it can happen, I really do. Few code reviews back, I had to request a fix for a remote path traversal able to read any file on the system.

This is worse since TM is an AV vendor and probably has this deployed across so many desktops.

</comment><comment><USER65> > This bug is subject to a 90 day disclosure deadline. If 90 days elapse > without a broadly available patch, then the bug report will automatically > become visible to the public.

Why is it visible already?

<comment><USER66> Because there is a broadly available patch. See eg [https://googleonlinesecurity.blogspot.com/2015/02/feedback-a...](https://googleonlinesecurity.blogspot.com/2015/02/feedback- and-data-driven-updates-to.html)

</comment></comment><comment><USER67> Can anyone explain why a security product needs a local HTTP server, or why it needs endpoints at all, let alone 70?

WTF it would have components written in Node or JavaScript?

<comment><USER68> in regards to your second question: Why wouldn't you write components in a modern, generally well-sandboxed safe language? (Of course you shouldn't break the sandbox to do so, but using JS in general is not a bad thing)

<comment><USER67> I guess my (potentially old-school) thinking is that for something that needs to be a solid as a security layer, integrated with the OS, I would only consider memory and type-safe languages.

<comment><USER69> Type unsafety of js can lead to exceptions, not buffer overflows.

</comment></comment></comment></comment><comment><USER70> Why do browsers let websites send AJAX requests to localhost anyway? I feel like that's bound to cause trouble.

<comment><USER71> It's pretty standard when you're developing a web application. Your backend runs on your machine, your frontend requests stuff from within the browser.

<comment><USER70> Sure, but why can external sites access localhost?

<comment><USER72> They external sites don't access it, they just ask the browser to load an image. So the external site can't read the result, but that's not actually stopping them from owning your machine.

</comment></comment></comment></comment><comment><USER73> I'm lost for words...

</comment><comment><USER74> It's "enterprise"!

</comment><comment><USER75> Jesus Christ on ten motorbikes!

</comment><comment><USER75> Jesus Christ on ten motorbikes.

</comment><comment><USER76> What could possibly go wrong?

</comment><comment><USER31> I'm kind of surprised that their reaction is to expect Tavis to continue to volunteer his time to audit the security of their product.

<comment><USER77> They're asking him to help verify the fix since he's in the best position to do so, having caught the bug. I think this is better than them saying "thanks, we'll take it from here, bye"

</comment></comment><comment><USER78> This, by the way, is a new normal. Organizations, teams and individuals within an organization, especially its buoracracy have self-preservation and keeping their status in mind rather than any engineering discipline, leave alone craftsmanship. Such is the nature of any bloated social formation, be it government, church, army or corporation.

The very first person who suggested Node http server must be fired that very day for offensive incompetence. I could hardly imagine any more satirical example. Hypervisor in Java, perhaps.

But idiots are bullshitting another idiots (PHP, Mongo, Node, Hadoop - <USER2> name it) whose only concern is to convince those one step higher in the hierarchy that they are still worth keeping, so any bizzare mix of trending [among idiots] memes would do.

Hey, Bivis, Node is cool, huh huh. Single-threaded callback hell in a language with implicit coersion, without standard module system (leave alone versioning) as a yet another useless layer of complexity to utilize lots of man-hours for o e more year? Lol wut? Node is cool.

So, all this is rather normal.

<comment><USER79> So what technologies do you actually like for writing web servers?

I think this comment is a good example of "contempt culture," which we've probably all been guilty of, and which we should do less.

[http://blog.aurynn.com/86/contempt- culture](http://blog.aurynn.com/86/contempt-culture)

<comment><USER78> Considerable amount of intelligence is required to understand that nginx, due to its design choices and attention to implementation details (which are hallmarks of truly remarkable systems, such as Plan9/Inferno, Erlang, Smalltalk, etc) is more portable than Node (it runs on more architectures, including Windows) require order of magnitude less resources providing close to optimal effeciecy, could be easily extended via modules and scripted in Lua with less lines of code, less pain, less nonsense.

BTW, contempt to incompetence or corruption is natural and healthy emotion. It is what contempt has been evolved for.

</comment></comment></comment><comment><USER80> The funny part is how the TrendMicro guys keep asking Travis to validate their fix - as if he's their tech support guy.

</comment><comment><USER81> This is why I don't like installing free AV or paid AV or doing anything other but burning my computer and living in the woods.</comment>