Facebook paid $4.5K for disclosure of my user account exploit - <AUTHOR> http://www.yvoschaap.com/weblog/facebook_values_the_privacy_of_its_billion_users_at_4500 <comment><USER2>
       Churchill: "Madam, would you sleep with me for five million pounds?"

       Socialite: "My goodness, Mr. Churchill... Well, I suppose...
                   we would have to discuss terms, of course... "

       Churchill: "Would you sleep with me for five pounds?"

       Socialite: "Mr. Churchill, what kind of woman do you
                   think I am?!"

       Churchill: "Madam, we've already established that.
                   Now we are haggling about the price"

You're either a black/grey hat or a white hat. Either you're a white hat and believe selling to malicious hackers is fundamentally wrong and you wouldn't do it at any price, or you're a black hat waiting for the right price.

The purpose of reward schemes is to reward white hats, not to compete with the bad guys for the black hat discoveries.

<comment><USER3> > Either you're a white hat and believe selling to malicious hackers is > fundamentally wrong and you wouldn't do it at any price, or you're a black > hat waiting for the right price.

That sentence is such a false dichotomy it's hard for me to take you seriously.

Is it evil to want to feel appreciated for your work? The message facebook is sending is that they honestly don't care if you find huge, potentially costly security holes in their software and go out of your way to let them no.

edit: It seems from reading other comments $4500 is actually quite reasonable. I was basing my comment on the author saying it was a "paltry fee".

<comment><USER4> Facebook is doing the right thing here. Very few companies have a responsible disclosure policy, much less a reward system.

You take a huge risk even notifying companies of a security flaw you found, since that usually implies you were doing unauthorized penetration testing and they'd have a case against you under the oh-so-wonderful CFAA. Or they'll just ignore you completely and never patch the flaw.

</comment></comment></comment><comment><USER5> Less money = less incentive = fewer disclosures = less secure.

Facebook is abusing the good will of white hats by offering such trivial sums, and they're reducing the security of their platform in the process. They have how many $100k+ engineers who couldn't find this? And how much does the average security breach cost per record, $100-$200? This exploit alone could have exposed them to millions in losses at that cost.

This is what turns white hats into black hats, and I wouldn't blame the guy for selling his next exploit rather than disclosing it. A famous guy once said "we create our own demons". And then the guy in Iron Man 3 said it. And now I'm saying it.

<comment><USER6> "Trivial sums"? This is squarely in line with what Google pays for vulnerabilities. Who is paying drastically more for website flaws?

And, because you think the thank-you Facebook offered was too low, you _wouldn't blame him_ for selling vulnerabilities to criminals? Really? Selling vulnerabilities to criminals is itself a crime.

<comment><USER7> > Who is paying drastically more for website flaws?

Black hat markets, presumably. At least that is the point being made by commenters here. Granted, selling the vulnerability is illegal and immoral, but that doesn't stop it from happening. The 'market rate' for vulnerabilities seems to be higher than what Facebook and Google are paying out.

<comment><USER6> Why do you "presume" that? Not all vulnerabilities are equally valuable, and the value for a vulnerability is not as straightforward as people here seem to think it is. Or at least, I don't think it is.

<comment><USER7> I use the word "presume" because I don't frequent black hat markets and I have no personal experience with current pricing. The general agreement I'm seeing in the comments (and anecdotes gathered elsewhere) is that exploits and vulnerabilities command a higher price when sold to black hats rather than responsibly disclosed through a bounty system. (Isn't this what the grandparent and article are implying?)

This makes sense economically to me. In order for it to be worthwhile for a vulnerability discoverer to sell the exploit, the reward should overcome the cost. In this case, the cost is the probability of getting caught multiplied by the severity of the punishment.

</comment></comment></comment></comment></comment><comment><USER8> I think many people reading this get a sort of uncomfortable feeling thinking about 'white hat' security researchers receiving bounties for disclosure -- it sounds a bit like extortion, especially when people talk about "wondering how much more you can get elsewhere."

But at the same time, the reality is that we're in somewhat of a security crisis. Businesses responsible for the security and privacy of our personal information and identities are clearly not in fact capable of protecting those on their own. (In part because it is a very hard task). They need help. And they're not going to get enough help purely from unpaid volunteers.

In a more reasonable world, the government would have armies of 'white hat' hackers trying to find security holes (they surely do), and then _telling the effected about them_ (they definitely don't, they keep them instead for their own use). Because that would result in increased security for us all, isn't that in theory the mission of police agencies, increasing our security?

<comment><USER9> Unfortunately or fortunately, I think much of the world would disagree with you and argue that such behaviour would be 'meddling' and gross overstepping by the government, right now.

Perhaps this sort of governmental 'help' would be possible in the future, but right now it seems that such behaviour would almost certainly result in cries that we had entered into a police state. :/

Edit: he notes that when he says 'we', you and I are almost certainly not in the same nation state. :P _shrug_

<comment><USER10> I don't see it a much different from the fire chef telling you how many people can occupy your building. FAA inspecting aircraft matence schedules, FDA inspecting a slughterhouse, the fed keeping track of a banks balancesheets or thousands of other areas where private companies interests are not aligned with the public.

<comment><USER11> There are and will be growing pains as this becomes reality... for example, there would be unintended consequences one might even imagine one such as:

" you get fined for hosting ogv videos because they're deemed unsafe and the FCC decides you should be fined per video that is not an MPEG format... after all these unsafe video's hurt people real people "

So, yeah the government could be a good vehicle for helping to secure our internet, but it could also have unintended consequences of preventing growth and innovation under the guise of "security" e.g "fear"

</comment></comment></comment></comment><comment><USER12> _...intrigued by the bold sentence on Facebook's security researcher page "There is no maximum reward" I went out and started giving Facebook's code another peak._

I'm not surprised that you feel this wasn't enough since it appears the reward is your motivation for finding an exploit in the first place. The reward shouldn't be viewed as payment for services rendered, but rather as a gesture of good will for performing your duty of responsible disclosure.

 _Without the disclosure of whitehat hackers, like I did, these exploits can also become available to dubious parties who could wreak (digital) havoc._

If you are truly a white hat then you aren't motivated by money. You are principally motivated by wanting to make the world a better, safer place. Since you're well-versed in computer security, that motivation will propel you to apply that knowledge to the web (or really to any vulnerability) when the opportunity presents itself.

If the reward is your motivation then at best this makes you a grey hat. You did the right thing, but for the wrong reasons. Note that for the following I'm not saying you personally will necessarily do this; but it would be easy from that position to start treating the group of people who you're willing to disclose a vulnerability to as a marketplace. Facebook will pay $4,500? Fair enough. L33tBotNetHaxz0r will pay $20,000? Done.

If you're someone who possesses the skill to discover security vulnerabilities, I think it's important to think through what your real motivations are. Is it for the rush capturing the flag? Is it for the money? Is it to help people? Your actions can affect many, so act wisely.

Edit: I should clarify that I mean that money can't be the _principal_ motivation for a white hat hacker. I believe it's fine as a secondary motivation. I give an example in another comment below.

<comment><USER13> > If you are truly a white hat then you aren't motivated by money.

False.

> You are principally motivated by wanting to make the world a better, safer > place.

Probably true.

That's not contradictory. And neither is wanting to disclose a vulnerability responsibly, wanting Facebook to be secure against the vulnerability you just found (even only because it affects you, your friends, family, people you care about) and _at the same time_ feeling that $4,500 is a bit of a meagre bounty for a find of some particular severity.

You can argue about whether $4,500 is, or is not, reasonable. But as you may notice, it's not like he held the bug "hostage" threatening to sell it to the black market otherwise, or even hinting at perhaps doing that the next time.

He can be wanting to make the world a better place (or Facebook a safer site), and still be dissatisfied with the reward he got.

Even rationally: for instance, one could reason that even though they could sell the bug for $20k on the black market, this could cause damage and harm to innocent people on a scale (and with a _certainty_ , because they won't buy the bug to just sit on it) that isn't worth the extra money he could gain (and for people with a decent moral compass that threshold is passed easily without even having to consider the risks of dealing with the black market etc). Then, having come to this conclusion, one could say "Well, I did the right thing, and I am disappointed that Facebook isn't offering more incentive for others to do the same".

Also, the incentive is not _just_ for convincing people to give the bug to the good guys instead of the bad guys. It's clear from the article that he spent a deliberate and non-trivial amount of effort on finding this bug, he didn't just stumble across it. This Facebook bug was found because they offered a mystery prize, prompting him to search for a bug and dig deep, then he got disappointed that the prize was less than he anticipated. It's not so much a question of "will he sell it to the bad guys next", rather it's "will he bother going through that much trouble again to help fix a flaw in Facebook, knowing what the payoff will be?"

That said, my question: is $4,500 really too little? How much hours did this cost him (times a price appropriate to his specialist knowledge, of course), so how much should it have been, for doing the right thing? 2x, 3x this? I don't think straight up matching it up to black market prices really makes a lot of sense, there's too many external factors that make it a very different deal.

<comment><USER14> > is $4,500 really too little? How much hours did this cost him (times a price > appropriate to his specialist knowledge, of course), so how much should it > have been, for doing the right thing? 2x, 3x this?

I don't think that's the right way to look at it—it's not a straight manual labor thing ($/hour * hours = $). The question is, how much money is it worth to Facebook to fix a potentially embarrassing vulnerability. For a complete profile exposure type bug, I would expect that's more than $4.5K.

</comment></comment></comment><comment><USER15> Much of the conversation here centers around the value of reporting to Facebook vs. selling to black hat. This is the wrong paradigm to view this issue through.

Taking the view that selling to blackhats is ALWAYS wrong, it may still make sense for Facebook to pay significantly more to find vulnerabilities in their system. A less vulnerable system is one with a competitive advantage, and I think Facebook is missing an opportunity to tout their security credentials.

Let's take a back of the envelope calculation. Say instead of $4,500, they paid each of the 66 people who submitted a vulnerability $50,000. And since we're not halfway through 2013 yet, let's assume that in total 150 people will submit valid security holes to FB this year. That's $7.5 million dollars paid out.

Now, once word of a $50k payout gets out, say 10x the number of people try to find vulnerabilities, and the success rate increases linearly. So Facebook pays $75 million a year.

What are the benefits of this program? I'd say you get a few major benefits vs. the current situation: 1\. You will definitely convert some blackhats away from exploiting FB data in exchange for $50k legally obtained 2\. You convert a lot of people currently looking for security exploits in Google, Amazon, etc... to searching for FB vulnerabilities. 3\. As a result you have a much more secure platform. 4\. You can leverage these payments through media and PR to legitimately show that you care about security. 5\. You combat competitors by touting a more secure platform.

$75 million is not small change when you look at FB's operating income, but it's not going to break the bank either.

The point is that it may well be a rational decision on FB's part to offer significantly more and it has nothing to do with the black hat market value of the exploit.

<comment><USER16> This assumes a linear relationship between (Bounty for vulnerabilities) :: (Identified outstanding vulnerabilities)

Presumably, one would see diminishing returns in the ability to find "low hanging fruit" exploits, and thus the economics @ a $50k pay-out would be even more attractive for Facebook.

<comment><USER17> It's a market. As the vulnerabilities become harder to find, Facebook will have to increase the payout to continue to find takers, if they view it as a worthwhile investment (they may decide that since vulnerabilities are harder to find the program has less merit, which I would disagree with).

</comment></comment></comment><comment><AUTHOR> I posted a more detailed description of the exploit: [http://www.reddit.com/r/netsec/comments/1fe9mj/facebook_pays...](http://www.reddit.com/r/netsec/comments/1fe9mj/facebook_pays_45k_for_disclosure_of_my_complete/ca9ehfe)

</comment><comment><USER6> $4500 sounds about right for this vulnerability.

<comment><USER18> In what sense? I'm sure you could find people who would pay $20,000 to view anyone's private photos.

<comment><USER6> If you say so. Where would you find them? There appears to be a functioning market for drive-by clientside RCE. The Interwebs seem to have interpreted this as evidence that there is a market for all kinds of vulnerabilities. I am skeptical that this is the case, and, unlike the RCE markets, I have no evidence to suggest that the website auth bypass markets are real.

I suppose the ability to generate unbounded Facebook likes or Twitter followers is monetizable.

<comment><USER19> _I have no evidence to suggest that the website auth bypass markets are real._

You could definitely contact your local firm of private investigators, insinuate that "I can access anyone's FB account," and make a tidy sum from doing just that.

Playing devil's advocate, admittedly, but there is still a very active market for quite petty-yet-nasty stuff, e.g. land developer wanting to access email accounts of local residents protesting against the plans.

Actually, you want weird? Thanks to my latest "seeking work" post on HN (and "Hacker" appearing in the page's title), I had someone ask me to hack the local authority computers responsible for registering peoples' deaths. This was, apparently, in order to give his funeral director company a leading edge.

Does Matasano never get cranks asking for stuff of a similar nature?

<comment><USER6> There's a difference between a functioning market for something and your ability to one-off 1:1 contracts for things. Hyperbolic comparison: you can also pay to have someone killed, but random people on the Internet don't have access to a market for putting out hits.

</comment></comment></comment></comment></comment><comment><USER20> $4.5k is decent. Were you expecting to get rich? There are contests where you can rake in much larger amounts, and you could make a killing forming a penetration team if money is the issue.

<comment><AUTHOR> Yes, 4,5k is decent. But put that in perspective of type of data and content Facebook exposed of its billion users.

And personally if Facebook's says "no maximum reward" (<https://www.facebook.com/whitehat>) I was expecting something different for a complete account access exploit.

<comment><USER21> The $4.5k is intended as a "thank you" card, not a paycheck.

</comment></comment></comment><comment><USER22> $4.5k is surely a small amount of money if they had employed someone to do this kind of work.

However, since you the work was done for free the author had sunk the time and risked getting $0 for it. Even if the author is inclined to go black hat, there's a lot more (likely illegal) work to be done for author to extract value from it.

As such, $4.5k is a good deal for the author - Facebook offered it knowing that and author accepted it knowing that.

I don't think this remotely reflects Facebook's true value of privacy (although this admittedly may not be high).

Facebook's only potential loss by making this offer is that it may make it slightly less likely for talented people to work externally on white hat exploits.

</comment><comment><USER23> Hi - I built Facebook's Bug Bounty program with a few other FB folks. There's a couple things I want to add to the conversation about how we look at rewards.

(Also, in 2009 it was just myself and a couple others running our disclosure program. It wasn't even bounties at that point. We'll get you a shirt, you can pretty much just blame me for that.)

1\. We don't compete with the bug market, so our rewards will not look like market prices. It's true that "Bad Guys" would pay enormous amounts for a bug. They also pay a premium for the criminal risk being taken, and for the opportunity to exploit it which will theoretically make them a lot of money. However, we're good guys and we don't plan on profiting from bugs.

2\. You, the researcher, are safe to post and talk about the vulnerability you found when Facebook is held to the disclosure policy. If your bug is extra- awesome, we'll sometimes send a bunch of reader traffic your way from our bug bounty page. This has shown to be worth a lot to researchers. Several of our bounty hunters have started companies, gotten jobs, became internet famous from this program and value this more than any bounty.

3\. We are pretty lenient on what qualifies as a bug, which means we have a higher volume of payments to researchers than you might expect. If a researcher showed amazing skill in finding something that didn't actually turn out to be a bug, we'll probably reward them anyway because we want them to keep trying. We are pretty lenient on duplicates as well. If we see that someone truly discovered a bug independently (and also showed significant skill discovering it) then they'll probably get a reward too. The theory here is that we want more responsible disclosures instead of pissed off researchers.

Overall I don't want to argue with the amount we rewarded here, but show that we're doing a lot of stuff that's benefiting a lot of researchers. We're one of the first companies to launch a bounty program, and most of the researchers you have listed would probably say they think we're doing pretty well. Not too many companies have a bug bounty program, and I'm really proud of ours! :)

</comment><comment><USER24> What's the point/argument of this article? That 4.5k is not enough money?

(serious question, not hating)

<comment><USER25> The other market would pay orders of magnitude more for such an exploit.

<comment><USER6> Do you _know_ that or are you just assuming that there's an effective black market for all kinds of vulnerabilities, and not just drive-by clientsides?

<comment><USER25> My bad, I didn't read further. I assumed this was server-side. After reading, 4.5k sounds right from Facebook, and while I'd imagine the other market price to be higher, I don't think it'd be above 3x, much less 10x, without something special (e.g. high-profile user data) accompanying it.

<comment><USER6> It is serverside (most web app vulnerabilities are). I'm suggesting serversides are worth much less than clientsides.

<comment><USER25> What I meant is that the user needed to load a flash payload and be logged in properly. The data harvesting happens client-side. The vulnerability itself is server-side, yes, but computers are faster at copying data than engineers are at figuring out what's going wrong. The data you could potentially harvest with an exploit like this, given good planning and enough time to affect a large amount of people, is definitely worth quite a bit of money. This vulnerability could even have helped to make a very convincing phishing attack, which, again, properly executed, leads to very valuable data.

It's not remote execution, but I still think it's valuable.

</comment></comment></comment></comment></comment></comment><comment><USER26> Pricing 101: Goal: Get as much as you can from the thing that you're selling.

Purchase Negotiation 101: Goal: Pay as little as possible for the thing you're buying.

To me what's funny about this is that if Facebook didn't pay the author at all, we probably wouldn't be reading this blog post right now.

</comment><comment><USER27> These bounties should be thought of more as an "award" than a "reward". In this case, the author has received a great honor for his cleverness.

</comment><comment><USER28> $4.5k for spec work isn't that bad. They could've paid $0.

With that said, I keep my facebook account only for testing applications.

<comment><USER29> But perhaps now there's a signalling problem. If you find an exploit of a similar nature you can expect a mid-four figure sum from FB. Now if you're feeling less than white-hatty you can wonder how much more you can get elsewhere.

It's easy to say that FB could have paid $0 but if people knew that, it would make "responsible disclosure" even less likely to happen.

<comment><USER28> "Responsible disclosure" shouldn't be up to a financial incentive. It's up to the law and basic ethics.

The real choice is between a 4.5k bonus or a subpoena. If you want to try the other path, go ahead....

<comment><USER30> Actually its a legal gray area. The prosecution would have to prove that you knew that you were selling to known criminals. This means you would have to sell to someone that literally told you what they are going to use it for.

<comment><USER28> Interesting. I think we can agree the alternative is the wrong choice, though.

Shouldn't have assumed the law was sound in this area... Given that it's not usually sound in any..

</comment></comment></comment></comment></comment><comment><USER31> I've been paid as part of their white hat program, $4.5k doesnt seem that high compared to what i was paid for my 'exploit'. I picked up $1k for finding a bug in their event invitations, a user could add friends to a private event when using a mobile phone.

The fact that his exploit was getting actual private data from people, i'd of thought he'd of been paid more. Thats not to say $4.5k isnt a lot of money, its a very nice reward.

</comment><comment><USER32> I think many of the comments are just saying 'do not work for free. if you work for free, do not expect big rewards'. I have to agree with that. So, OP don't take it personally. All good work on your part but do not expect too much for free work. That's the way the world rolls.

</comment><comment><USER33> What is the actual black market value of an exploit like this? Is it in the realm of $4,500?

<comment><USER6> I think it's tricky to assess. There's a lot of support for the idea of high black-market prices for drive-by clientside remote code execution. Those vulnerabilities have a long half-life (because of the latency of patching) and maximal value to attackers (collect zombies, snarf payment card information, &c). Neither is true of website vulnerabilities.

For a vulnerability that can be instantly eradicated, everywhere, as soon as the target finds out it exists? There might not be much of a market at all.

(I don't know).

<comment><USER34> I think if you market this as a way into any private account, think celebrities, politicians, etc. You could catch quite a price if you wait for the right buyer.

Think about what shady gossip newspapers pay paparazzi for breaking laws to get intimate pictures. In the right hands this exploit could be worth tons.

<comment><USER6> If you say so. I'm sure _somebody_ will buy anything. But the idea that there's an easily-tapped market for Facebook vulnerabilities, similar to the one for browser vulnerabilities? Like I said, I don't know. But I'm skeptical.

<comment><USER35> How would you sell the exploit? Your buyer would want to verify it works before buying, but then you've already given it away. It's not like you could enforce a contract on this.

<comment><USER34> You don't sell the exploit, you sell the hack. You could sell someone private access to all facebook data of one person. Proving you have the ability is easy, you can just show one image that is supposed to be private, and promise the rest.

</comment></comment></comment></comment></comment></comment><comment><USER36> I'm not sure about the law in these situations. What happens if a hacker (right now let's not label them black or white hat just yet) decides to tell Facebook that hey know of an exploit which can gain access to anyone's account given an email address. This is a monumental bug, obviously. Is the hacker allowed to negotiate a price and then withhold the info if his demands are not met? Or is this against the law?

I would guess as long as they doesn't use the exploit or sell it to some 3rd party (nefarious or otherwise) then they should be safe, right?

<comment><USER6> Nothing happens. He has the option of doing that. He can probably even use it as a negotiating tactic; without "force, violence, or fear", extortion probably doesn't come into the picture†, and my (IANAL) understanding is that courts read the "fear" thing narrowly, like, "fear or force or violence".

What he probably can't do is threaten to sell the vulnerability to "black hats"; you can't threaten to commit a crime unless you're paid a protection fee.

† _Source: model jury instructions_

</comment></comment><comment><USER37> It's very simple. If you had a certain price in mind, negotiate the price first, before delivering the service.

<comment><USER38> IANAL, but saying "pay me because I have a 0day exploit against your business" is often construed as extortion. You can end up in jail for that. Consult your lawyer before negotiating like this.</comment></comment>


Kids See Bearded Men as Strong – But Unattractive, Study Finds - <AUTHOR> https://www.npr.org/2019/07/30/746616246/kids-see-bearded-men-as-strong-but-unattractive-study-finds <comment><USER2> I was the assistant coach of a kindergarten soccer team together with a woman who was experienced coaching soccer.

One thing I noticed was that many kids were afraid of my facial hair so I shaved it. I think many kids at that age are used to female caretakers and they just aren't used to beards.</comment>


Bootstrapacitor - A meta-startup to keep your energy levels up - <AUTHOR> http://www.bootstrapacitor.com/ <comment><AUTHOR> This is the renamed, rebranded, and relaunched RejectedByYC.com, previously announced here ( <http://news.ycombinator.com/comments?id=16234> ).

Bootstrapacitor provides a place to show off your work to a bunch of other startup founders without necessarily launching for the whole world to see. When you register your startup, you're randomly assigned to a "demo group" of up to 8 other startups. (The assignment algorithm tries to put startups in the same geographic area together, to facilitate RL meetups.) You can then post feature announcements of everything you implement, and get instant feedback from the members of your group. Until you list your startup as "launched", these announcements are visible _only_ to your group members, so you can put your startup up well before it might be considered ready for the public. You _and your group_ get "karma" based on how many features you push out and how many people look at them or comment on them, so it's to your advantage to release early and release often.

Our intent is to create the sort of friendly competitive atmosphere of a math competition or hacker lab. To me, this is the biggest advantage of YCombinator and clones: they create a peer group of motivated, passionate people that show off their work to each other. IMHO, that's far more valuable than money or even the advice and connections: most startups fail because the founders give up, not because they make a single mistake or can't get VC.

<comment><USER2> _'... Our intent is to create the sort of friendly competitive atmosphere of a math competition or hacker lab. To me, this is the biggest advantage of YCombinator and clones: they create a peer group of motivated, passionate people that show off their work to each other. ...'_

Nice work. I'll check it out when the login lets me in. Is there an RSS post per user?

<comment><AUTHOR> No RSS feed yet, but I could probably rig one up fairly quickly.

Is there something wrong with the login? Your login status says "Active"...

<comment><USER2> _'... Your login status says "Active"... ...'_

think I made the comment on/around the same time. Login is OK.

</comment></comment></comment></comment><comment><USER3> Good thing you don't have to be able to pronounce the name to sign up.

<comment><AUTHOR> That's what just about everybody we ran it by said. We went through several dozen possibilities, but they all either sucked or were just totally nonsensical (startupduck.com?) This seemed like the best option we could come up with.

Ironically, the coworkers I ran it by said "I liked RejectedByYC better". Ah well.

<comment><USER4> How did you come up with that name? I agree with danielha. It took me a while to figure out what the name came from. It's been a long time since I typed capacitor (this is the suffix right?) and now it takes me more than half a second to type.

What about the more web2.0 style names? untaken: bootstrappd, bootstrapping, bwootstrap... to name a few

<comment><AUTHOR> It's from bootstrap + capacitor, as you figured out. We were looking for something that connotes "keeping your energy levels up". I threw out a bunch of physics-related terms, but if you saw particleinabox.com or blackbodyradiation.com you'd think physics and not startups. A lot of our potential names had that problem: there was nothing in them that really suggested "startup".

Then there were names that had the opposite problem: they didn't suggest anything _but_ startups, and the added suffix was just completely random. Startupduck.com fits in this category. So would bootstrappd, bootstrapping, bwootstrap, etc, IMHO. My cofounder also suggested startup-orphans.com, which I nixed as too negative, since negativity was what everyone jumped on RejectedByYC.com for.

My cofounder also proposed dotcamaraderie.com, which I liked, but we didn't think anyone would be able to spell "camaraderie". We also considered shortening it to "dotcomrade.com", but it sounded too communist for me.

</comment></comment></comment></comment><comment><USER5> Did anyone else see the logo and start daydreaming about having electric boots?</comment>


Mozilla about to change video policy - <AUTHOR> http://blog.lizardwrangler.com/2012/03/18/video-user-experience-and-our-mission/ <comment><USER2> I think this became inevitable. There is no point in losing energy to fight a lost battle, especially when in 10 years the patent will have expired and the codec will be free anyway.</comment>


Why do my chrome use so many memory and cpu (up to 17G memory)? - <AUTHOR> https://albin.oss-cn-shanghai.aliyuncs.com/1527168658334.jpg <comment><AUTHOR> it's 3.2G now, and can be up to 17G... any guy knows?

Is my computer infected something?</comment>


FEMA Contractor Predicts 'Social Unrest' Caused by 395% Food Price Spikes - <AUTHOR> http://motherboard.vice.com/read/fema-contractor-predicts-social-unrest-caused-by-395-food-price-spikes?trk_source=homepage-lede <comment><USER2> At least it's not 400%.</comment>


Attack Surface Discovery Using Passive Data Sets - <AUTHOR> https://dnsdumpster.com/footprinting-reconnaissance/ <comment><USER2> The CIDR search is a quick way to assess a netblock.</comment>


Lanyrd - the social conference directory - <AUTHOR> http://lanyrd.com/beta/

<comment><AUTHOR> Couple of interesting points I'd noticed (reading the colophon page): * Using Geo location to map a conference in a location tree, so you can (presumably) drill up and down the tree to find the right 'level' * Node.js - sound like a real time twitter stream for each conference * Solr for faceted search. Sound like an improvement over upcoming.org in helping find interesting events

That's a neat collection of tools. _</comment>


Gave up a day job. Now what? - Income report #2 - <AUTHOR> http://www.kreci.net/reports/gave-up-a-day-job-now-what-%E2%80%93-income-report-2/

<comment><USER3> Does anyone else think this guy is making a mistake going for ad-based income. Looking at his income report, he is already making 50% of his income (and almost all his passive income) from stockphotos and ebooks. Comparing this to his current income from ads, it is obviously more profitable. I accept that he has more ad-based projects coming up, but in terms of effort, is producing ad- based software really going to be worth it? Another downside is that photos and books don't need the same level of ongoing maintenance as software.

Perhaps someone here has some insight into how much money software with embedded ads can realistically make.

<comment><AUTHOR> I am still going to work on my photos and make as much income as possible with it. But I do not feel good with ebooks for a long term. If ads will not bring me a revenue I expect I will rather move only to photos. But I really believe in long term income with ads.

<comment><USER4> You're making a mistake: ebooks have a much higher value, overall, than photo licensing. You just need to learn more about it.

And investing more time into monetizing with ads is a waste.

I recommend two resources for you: Desperate Buyers Only and How to Launch the ____Out of Your Ebook.

(For the record, I made $40k off my last ebook.)

<comment><AUTHOR> Thanks for a valuable comment. The problem is that I can not do all things at once. And I have precise business plan for making money on things I write about. If I will not be able to realize it I may try ebooks again. But I am not too talented writer at all and as I said this ebook has been written "by accident". But I can not say I will not write more in a future :)

<comment><USER4> OK, it's your life. But I'd like to draw your attention to this idea:

You can't do all things at once. Yes, naturally.

So you choose to focus on the things you can least control.

Does that make sense?

</comment></comment></comment></comment></comment><comment><USER5> Well done. I think this goes to show that when you want to generate cash and your focus is on the money, it's better to do several small things instead of investing time on a single product that takes a long time to make cash.

Your income is going to rise and rise, just remember not to get lazy. Keep yourself hungry, otherwise at some point you will stop growing.

<comment><USER6> How do you keep yourself hungry? I've hit a point where life is very comfortable and I don't need to worry about the immediate finances or food or shelter. I've become lazy. I'm certainly not as motivated/hungry as when I was fresh out of uni and broke.

<comment><USER5> Tie up your money in long term investments

<comment><USER7> Max's advice here is good even if you don't subscribe to the "I need to be worried about the rent to do decent work" philosophy. I have never met someone who said "You know, I saved too much for retirement", and given that most of us are 35+ years from it a dollar invested today is likely to be a dollar or more of income per life _plus_ $25 to your children or favorite cause after you die.

(Well, less whatever tax your local jurisdiction charges rich plutocrats like yourself.)

</comment></comment></comment></comment><comment><USER8> I was critical of some of your prior posts, but this is pure gold. Your writing has improved, and this blog post has a lot of meat on the bones. Well done, thanks for sharing, and keep it up!

<comment><AUTHOR> Thanks for your support. I am really happy to hear such words - <USER2> from someone who was critical before... :)

</comment></comment><comment><USER9> I would focus 80% of your time towards the ebook. Your sales page could be optimized a little more (and there _are_ typos). If you pull in more user testimonials and run some adwords, you could see this come in and be your primary source.

<comment><AUTHOR> Thanks Steve. I have been thinking about it. But it does not fit my long term business model. I am developer and want to make web and software development my main income source. And as I want to make it passive I am doing it by putting ads on free content or software (to make it long term income).

<comment><USER10> Don't limit yourself like that.

If you want to be web developer go get a job.

If you want to be an entrepreneur then you better go where money is. Besides how do you expect web development to function as passive income source? Offering a service/application may be such an opportunity - but then you're an entrepreneur who uses code to leverage his business.

BTW. Your project is mint - love every installment of it!

<comment><AUTHOR> This ebook has been done "by accident". As a developer I want to make passive income from selling many copies of application or via ads on web pages/in software.

<comment><USER11> Accidents sometimes result in much profit. Don't limit your horizons.

</comment></comment></comment></comment></comment><comment><USER12> Am I the only one surprised that people still buy web marketing ebooks?

<comment><USER7> The industry is built around fulfilling the aspirational goals of people to be Making Money Online, rather than actually improving their outcomes. Since you don't succeed merely from buying an ebook, you must have bought the wrong ebook, so you're always in the market for the right ebook next time.

</comment></comment><comment><USER13> I never knew you could make so much at istockphoto? Has anyone else tried that? Do you need to be an awesome photographer, do you have to be lucky? What sort of photos are best?

<comment><USER14> > Do you need to be an awesome photographer, do you have to be lucky?

No. You need a decent camera (as in a fairly expensive SLR model) and to know what people are looking for on Stock photo sites.

kreci seems pretty good at it - he's got a huge portfolio containing lots of very similar photo's (which is what you usually get) covering all the themes that are popular on stock photo sites.

If you want to do well his portfolio is good inspiration :)

There are people earning a _lot_ more than this.

</comment></comment><comment><USER15> Congratulations on achieving your goal! A word about adsense and admob.. you could make a larger income from your app or website traffic by having your own offers instead of leaving it up to an outside source to decide. You could either direct them to your own real estate (ebook or other apps) or you could find an offer that you truly like, such as the hosting company you wrote about and direct traffic to there. Doing this should result in a higher return, and once established you can negotiate a higher payout as well.

<comment><AUTHOR> This is my very first attempt with mobile soft and it was my first bet (to use AdMob). But I am going to implement mediation layer to my soft so I would easily be able to "swap" ads and test what brings me best income.

<comment><USER16> i'm sure that admob doesn't generate a great number, at least not for the iphone. do you have other ad service ? you can do a/b testing with ads, just put an 'if' in your code and check which service works better for you.

</comment></comment></comment><comment><USER17> Congratulations on your increasing success. We all know how hard it is and you are putting yourself out there trying your best. Thanks for sharing!

<comment><AUTHOR> Thank you for your support!

</comment></comment><comment><USER18> Do you see an 'HN' effect? I wonder how much of this was driven by your postings here? That is - how much of your stock photo and ebook sales are truly organic?

<comment><AUTHOR> From stock photo I got no more downloads even when my post is on top of HN. I got two referrals that made me $20 bucks (but I am unsure if it is from HN). About ebook I got just a few sales after posting here - most is from promotion on marketing forums where people are waiting for such products and really want to spend a few bucks to improve some of their marketing techniques (like increasing PR).

<comment><USER18> Cool! Thanks for being so open with the info.

</comment></comment></comment><comment><USER19> I think this is pretty impressive, he is clearly doing lot of work.

<comment><AUTHOR> I am trying all my best. Thanks!

</comment></comment><comment><USER20> What is interesting, how little income Amazon affiliate generated.

<comment><AUTHOR> I know that some people report a huge affiliate commissions with Amazon... but for me it is a really bad converting website. Mostly I send traffic from just a one website - computer hardware niche. Looks not to be a good choice but I do not know any better alternative...

</comment></comment><comment><AUTHOR> As usual comments are very desired and more than welcome =)

<comment><USER21> Does that goal of $1,000 cover your rent and other living expenses, or are you living off of previously saved money while trying out your new business?

<comment><AUTHOR> Yes it does. I have described in one of my previous posts that it is what I earned monthly in my full time job. It is why it was a goal. Not sure where are you living but in Poland $1000 is enough for usual everyday living expenses...</comment></comment></comment>


Solving the Web security challenge ("80 percent of the vulnerabilities that we see are input validation errors") - <AUTHOR> http://news.com.com/Solving+the+Web+security+challenge/2009-1002_3-6189437.html?tag=nefd.lede <comment><USER2> Don't other languages used in web development have something like BRL's define-input?

(define-input

a

(validation-function b))

You see at a glance that you're validating b and not a.</comment>


How often should you beat your kids? (1990) - <AUTHOR> https://fermatslibrary.com/s/how-often-should-you-beat-your-kids <comment><USER2> Well that's a clickbait title if I've ever seen one

</comment><comment><USER3> Simply figure out how often your kids should beat you and invert the result.

</comment><comment><USER4> Never;

<comment><USER5> I was going to guess until either their ears or nose bleeds. lol I hate click bait articles.</comment></comment>


Google App Engine Blog: Open sourcing Thoughtsite, forum for Google App Engine - <AUTHOR> http://googleappengine.blogspot.com/2010/06/open-sourcing-thoughtsite-discussion.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+GoogleAppEngineBlog+%28Google+App+Engine+Blog%29&utm_content=Google+Reader <comment><USER2> Full text search is the best part of this thing. It was the only thing keeping me from adopting gae whole sale.</comment>


SEC Votes To Propose Equity Crowdfunding By Unaccredited Investors - <AUTHOR> http://techcrunch.com/2013/10/23/crowdfunding-by-unaccredited-investors/

<comment><USER2> So where do I go if I want to participate in the public comment?

Because I think that the $1M limit on how much a company can raise is unreasonable. I think that it will prevent public participation.

<comment><USER3> [http://www.sec.gov/cgi-bin/ruling- comments?ruling=s70913&rul...](http://www.sec.gov/cgi-bin/ruling- comments?ruling=s70913&rule_path=/comments/s7-09-13&file_num=S7-09-13&action=Show_Form&title=Crowdfunding)

<comment><USER2> Thank you.</comment></comment></comment>


What do you use your iPad for? - <AUTHOR> I've recently bought a 12.9 iPad pro and have struggled to find a good use case. For me, a kindle is better for books, paper and pen is better for notes, and a computer is better productivity. <comment><USER2> Back when I was flying at least 3x per month, my iPad was perfect for staying on top of emails and Slack messages while in the air. Cramped seats and poor wifi are not conducive to laptops, even my 13" MBP. It also helped me focus bc it prevented me from falling into the trap of having a dozen tabs open. I have not found much use for it since COVID.

</comment><comment><USER3> Displaying sheet music while I play the piano. And before that, nothing. I only have an iPad because I needed it to demo the app I was working on at the time.

</comment><comment><USER4> Gave my iPad pro to my son because it wasn't as useful as my PC or laptop. He now use it to read online webtoons and casual gaming.

<comment><USER5> Yeah, I got an iPad Pro from the Apple store. Took it back right away got bored from inability to use programs or create on it.

Got a Surface Go instead. More portable and it's a computer with a Linux shell.</comment></comment>


The next big thing: a site that schedules Mormon visits to people houses. - <AUTHOR>

Just wanted to share this idea. <comment><USER2> Why not focus on a market with actual demand.

Political campaign managers might use something like that to organize block walking and canvasing activities.

<comment><USER3> I just laughed so hard. Agreed with @redspark political campaigns, PAC's, and grass roots could benefit greatly.</comment></comment>


Uber Self-Driving Car That Struck Pedestrian Wasn't Set to Stop in an Emergency - <AUTHOR> https://www.ntsb.gov/investigations/AccidentReports/Reports/HWY18MH010-prelim.pdf <comment><USER3> Direct link to NTSB preliminary report: [https://www.ntsb.gov/investigations/AccidentReports/Reports/...](https://www.ntsb.gov/investigations/AccidentReports/Reports/HWY18MH010-prelim.pdf)

 _According to data obtained from the self-driving system, the system first registered radar and LIDAR observations of the pedestrian about 6 seconds before impact, when the vehicle was traveling at 43 mph. As the vehicle and pedestrian paths converged, the self-driving system software classified the pedestrian as an unknown object, as a vehicle, and then as a bicycle with varying expectations of future travel path. At 1.3 seconds before impact, the self-driving system determined that an emergency braking maneuver was needed to mitigate a collision (see figure 2). 2 According to Uber, emergency braking maneuvers are not enabled while the vehicle is under computer control, to reduce the potential for erratic vehicle behavior. The vehicle operator is relied on to intervene and take action. The system is not designed to alert the operator._

<comment><USER4> I worked on the autonomous pod system at Heathrow airport[1]. We used a very conservative control methodology; essentially the vehicle would remain stopped unless it received a positive "GO" signal from multiple independent sensor and control systems. The loss of _any_ "GO" signal would result in an emergency stop. It was very challenging to get those all of those "GO" indicators reliable enough to prevent false positives and constant emergency-braking.

The reason we were ultimately able to do this is because we were operating in a fully-segregated environment of our own design. We could be certain that every other vehicle in the system was something that should be fully under our control, so anything even slightly anomalous should be treated as a hazard situation.

There are a lot of limitations to this approach, but I'm confident that it could carry literally billions of passengers without a fatality. It is _overwhelmingly_ safe.

Operating in a mixed environment is profoundly different. The control system logic is fully reversed: you must presume that it is safe to proceed unless a "STOP" signal received. And because the interpretation of image & LIDAR data is a rather... fuzzy... process, that "STOP" signal needs to have fairly liberal thresholds, otherwise your vehicle will not move.

Uber made a critical mistake in counting on a human-in-the-loop to suddenly take control of the vehicle (note: this is why Type 3 automation is something I'm very dubious about), but it's important to understand that if you want autonomous vehicles to move through mixed-mode environments at the speeds which humans drive, then it is absolutely necessary for them to take a fuzzy, probabilistic approach to safety. This will inevitably result in fatalities -- almost certainly fewer than when humans drive, but plenty of fatalities nonetheless. The design of the overall system is system is inherently unsafe.

Do you find this unacceptable? If so, then then ultimately the only way to address this is through changing the design of the streets and/or our rules about how they are be used. These are fundamentally infrastructural issues. Merely swapping out vehicle control systems -- robot vs. human -- will be less revolutionary than many expect.

1: [http://www.ultraglobalprt.com/](http://www.ultraglobalprt.com/)

<comment><USER5> This is absolutely the right analysis of how these systems work and why you can't expect autonomous cars to halt traffic deaths. What the Uber crash has shown us is that the tolerance for AVs killing people is probably exactly zero, not some (very meaningful) reduction like 10x or 100x less.

My company didn't start with this zero tolerance thing in our minds, but it turns out our self-delivering electric bicycles have a huge advantage for real world safety because they weigh ~60lbs when in autonomous mode and are limited to 12mph. This equals the kinetic energy of myself walking at a brisk pace, or basically something that won't kill purely from blunt force impact. I think the future for autonomy will be unlocked by low mass and low speed vehicles, not cars converted to drive themselves.

<comment><USER6> > This equals the kinetic energy of myself walking at a brisk pace, or > basically something that won't kill purely from blunt force impact.

This is an analogy that cannot completely map to cycling.

A fall at any speed from a bike is literally a potentially crippling or deadly scenario.

<comment><USER7> Potentially deadly? Maybe, sure, but at low speeds, up to 10 mph say, it is _incredibly_ unlikely that falling off a bicycle (even with no helmet) will do more than cause bruises and damaged ego.

<comment> xkcd-sucks Falling while stationary is the second most common type of accidental death, can't imagine a bicycle makes it any safer lmao

<comment><USER8> Is this including the elderly who often will break a hip that way and then die of the complications? Because if so, that would not be comparable to a healthy young (< 60 yo) person falling.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> "According to Uber, emergency braking maneuvers are not enabled while the vehicle is under computer control, to reduce the potential for erratic vehicle behavior."

If you can't give your "self-driving software" full access to the brakes because it becomes an "erratic driver" when you do that, you do not have self- driving software. You just have some software that is controlling a car that you _know_ is an inadequate driver. If the self-driving software is not fully capable of replacing the driver in the car you have placed it in, as shipped except for the modifications necessary to be driven by software, you do not have a safe driving system.

<comment><USER10> > _If you can 't give your "self-driving software" full access to the brakes > because it becomes an "erratic driver"_

You misunderstood. The Uber software had sole control of the brakes (plus the human of course). The Volvo _factory system_ was disabled so that it didn't have negative interaction with the Uber system.

Your mistake is understandable. The article was poorly written, perhaps due to a rush to publish, as is the norm these days. Even if the NTSB report was unclear, that doesn't excuse clumsy reporting.

If you've ever done significant mileage in a car with an emergency braking system you probably have experienced seemingly random braking events. The systems favor false positives over false negatives.

<comment><USER9> I wrote it carefully and I stand by it. If it can't deal with it because your system is getting too confused for any reason, you don't have a self-driving system. Being able to function enough like a human that the safety features on the car don't produce an unacceptable result is a bare minimum requirement to have a self-driving car.

This isn't horseshoes, as the old saying goes. I unapologetically have a high bar here.

<comment><USER11> Far as I can tell, the done thing in the industry is to disable all other safety systems (or to not have any in the first place) and to delegate safety entirely to the self-driving AI.

The charitable interpretation of this is that the industry believes that self- driving AI is a safety feature of greater quality than, say, lane assist or auto-breaking.

The less charitable one is that they find it too much work to integrate their AI to other safety systems. Which, to be fair, is really going to be a lot of extra work, on top of developping self-driving.

</comment></comment></comment></comment><comment><USER12> So, can't read the article but I did read the ntsb report directly. Basically, it sounds like Uber was not ready, but reassured themselves with "but there's a human driver who can intervene". The fact is, humans are very bad at remaining vigilant for long periods of doing nothing, then needing to intervene at a moments notice. Computers are good at that (and Volvo's built- in safety systems might have worked if Uber had not disabled them), but humans are bad at it.

Volvo has it right: human driver, computer backup. Uber's idea of a human acting as a last-second backup to a computer gets the relative strengths and weaknesses of each exactly wrong.

<comment><USER13> Worse than just assuming a human driver could intervene: they put a human in the car and then overloaded that human with additional tasks.

<comment><USER14> Worse, they knew they needed two people and previously had two individuals, but then felt that was unnecessary and went to only one person per vehicle.

</comment></comment></comment><comment><USER13> I'm irritated at myself for swallowing Uber's initial line on this (and the interpretation of the officers who reviewed the cam footage provided by Uber) without sufficient critique.

This accident should have been avoided. No excuses.

<comment><USER15> The sensors observed the pedestrian 6 seconds before impact! That's more than enough time to come to a complete stop.

That's enough time to play a bell that alerts the driver and for the driver to manually react, press the brakes, and come to a complete stop.

And this was a pretty easily preventable scenario (which just makes it more tragic of course). Software is nowhere near ready to drive cars on real roads.

<comment><USER13> I'd caution at avoidance of over-extrapolation.

UBER software is nowhere near ready to drive cars on real roads. There are multiple competitors in this space (Waymo and Argo immediately come to mind); they don't generally have Uber's reputation of "move fast and break things" or of "cut human costs as soon as feasible."

In my initial assessment, I was reasoning the other direction---from practices I was familiar with from stories of those companies to Uber---and falsely assumed Uber was behaving more responsibly than they were. This Uber tragedy doesn't significanly update my prior assumptions about its competitors.

<comment><USER15> I agree this incident doesn't give evidence about Uber's comepetitors, but I just don't believe software is anywhere near ready to safely navigate neighborhood driving. Many of the challenges involve assessing the knowledge, goals, and capabilities of other people and objects in the environment which is far ahead of anything AI can do except in specialized scenarios with lots of accurate training data. Many of the scenarios wil be unique and not encountered in prior training data. So I'm very skeptical.

</comment></comment></comment></comment><comment><USER16> Does anyone else find these two quotes a bit hard to stomach?

> Although toxicological specimens were not collected from the vehicle > operator, responding officers from the Tempe Police Department stated that > the vehicle operator showed no signs of impairment at the time of the crash.

> Toxicology test results for the pedestrian were positive for methamphetamine > and marijuana.

So they tested the victim for drugs but not the Uber employee in the car??

Other than that, Uber's so-called "self-driving" system sounds like crap and should never have been allowed to be used in that state.

<comment><USER17> The test is probably a routine part of an autopsy, whereas it likely wasn't a routine part of the police response (which use visual and verbal cues to preliminarily assess inebriation).

</comment></comment><comment><USER18> What's the point of this emergency braking system if it can't take action and can't alert the driver?

Maybe it reports so many false positives that Uber turned those off and just collects the data to improve the algorithm?

<comment><USER19> I could be totally wrong, but I thought I read the emergency braking function was Volvo's, and built into the base vehicle. Uber had disabled because they were testing their own software.

<comment><USER20> The NTSB report mentions the standard automatic emergency braking features from Volvo:

> _The vehicle was factory equipped with several advanced driver assistance > functions by Volvo Cars, the original manufacturer. The systems included a > collision avoidance function with automatic emergency braking, known as City > Safety, as well as functions for detecting driver alertness and road sign > information. All these Volvo functions are disabled when the test vehicle is > operated in computer control but are operational when the vehicle is > operated in manual control._

However, that appears to be separate from emergency braking under Uber's self- driving system:

> _At 1.3 seconds before impact, the self-driving system determined that an > emergency braking maneuver was needed to mitigate a collision (see figure > 2).[2] According to Uber, emergency braking maneuvers are not enabled while > the vehicle is under computer control, to reduce the potential for erratic > vehicle behavior. The vehicle operator is relied on to intervene and take > action. The system is not designed to alert the operator._

> _[2]: In Uber's self-driving system, an emergency brake maneuver refers to a > deceleration greater than 6.5 meters per second squared (m /s^2)._

It sounds like Uber didn't trust their own self-driving system enough to allow it to initiate sudden crash stops. Too many false positives, I guess? Of course, simply disabling the function leads to other obvious problems, as shown.

<comment><USER21> That's a really weird interpretation. Uber's system could obviously brake but not 'emergency brake'? The system disabled a part of itself? How is that any different than it just never deciding to 'emergency brake'?

I think the better interpretation is that the Uber system disabled another separate (non-Uber) system.

<comment><USER22> _Uber 's system could obviously brake but not 'emergency brake'?_

There are two systems in the vehicle. One is the manufacturer's, let's call it System V after Volvo, and the other is System U, for Uber.

System V provides collision detection and emergency braking. It played no part in this incident, since it's inactive if the car is under control of System U, which it was at the time.

System U can decide that the car should slow down in some situations. Let's call gradual slowdown Action U1, and emergency slowdown Action U2. The incident called for Action U2, by Uber's criteria. What Uber said is that a) they disabled automatic execution of Action U2, punting it to the driver (really, a bored passenger in driver's seat), _and_ b) that the driver would get no indication of emergency situations from the system.

The idea is, presumably, that driver should watch the road and react in emergencies. But we also know that the driver had the duty of working with the onboard console, which must have been quite a distraction. Effectively, Uber has set themselves up for failure, and it happened.

<comment><USER21> You were right. It seemed so stupid I refused to believe it!

</comment></comment></comment></comment></comment></comment><comment><USER23> Why on earth would they mention that someone's been on weed and meth when they are the victim of a car not stopping?

<comment><USER24> Because more context makes for a more comprehensive story.

Fact of the matter is, the person was not allowed to cross there. Not only was it not allowed [0], it was also extremely dangerous. Why would she do this?

That's one part of the conversation.

The other part of the story is that the self-driving car was mismanaged and misprogrammed, and that this was likely also a reason why the woman died.

There is therefore reason to believe both parties could have prevented this death. You're not sure. Perhaps drugs weren't a factor. And perhaps a driving person could not have braked quickly enough either to save her. You don't really know. But when you have information which lets you speculate plausibly to explain unknowns, I think it's relevant to include that information as a journalist. Meth use falls within that range of relevant information in this case, if you ask me.

It feels a bit analogous to saying a woman got shot and killed at a gun range. She ran into the shooting range and got shot. Why would she do this? The person shooting wasn't paying attention and was just firing casually down the range. Knowing the woman was on meth helps explain a lot. As a journalist I'd think that was relevant, and as a reader it offers a possible explanation for this kind of behaviour. It doesn't negate the fact the shooter didn't follow procedure and could have prevented this death, too.

I thought it was fitting at the very end of the article like it was in the original analysis that they refer to. Not so much in the subtitle, I feel that was in poor taste and driven by clickbait. It shouldn't be the focus of the article.

[0] [http://darychuklaw.com/legal-services/personal-injury- claims...](http://darychuklaw.com/legal-services/personal-injury-claims/what- is-the-law-personal-injury-claims/who-is-at-fault-when-a-pedestrian-is-hit- outside-a-cross-walk/)

<comment><USER25> > the person was not allowed to cross there.

Have you seen the intersection in question?

[https://pbs.twimg.com/media/DYrspoFVwAAtJCs.jpg](https://pbs.twimg.com/media/DYrspoFVwAAtJCs.jpg)

I think the pedestrian is very low on the list of who to blame, with the intersection designers and Uber engineers _high_ above her.

<comment><USER24> I have seen it. Check streetview too, it's helpful.

I really hate to defend this position because I feel terrible for her and it's quite obvious uber made some very bad calls here. (in fact I even used the very loaded word murder in another comment, see my post history). I'm definitely not arguing to put all or even most of the blame on the woman.

The intersection is indeed absolutely terrible. It makes no sense. You're not allowed to cross there, there are even signs which state it on both sides, referring to a crosswalk a minute walking up ahead. i.e., there is just no way you're allowed to cross there, despite the island in the middle having the cosmetic design of a walkway, you're not supposed to get on the island or get off it or cross the roads at that location. It's a terrible design choice, both inviting people to cross (in a dangerous spot), while also saying it's illegal. With better infrastructure planning you could have railing there preventing crossing, and no island at all.

That having been said, I can't for the life of me imagine crossing there and not seeing an oncoming car with its headlights on, assuming I was paying attention to the road I was illegally crossing. The fact meth is involved is a helpful possible explanation for why this kind of attention was not given.

You can check out the road on google street view, it definitely helps. I think you'd agree on two things, one is that it's not allowed to cross there and two that if you were to cross there, it'd be pretty easy to see cars. The reverse isn't necessarily true if you wear dark clothing at night.

<comment><USER26> AFAIU, the pedestrian who was killed has indeed part of the blame, and we probably would not feel as guilty saying that if it was a normal car that killed her. But for the topic of this general discussion, that is irrelevant; the emphasis is (and should be) on the incompetence and negligence of Uber, which lead to a person's death, albeit her negligence is at play too, and which demonstrated that (i) Uber is not capable of this sort of business as an unscrupulous and unethical company and that (ii) we should still be deeply sceptical of the capabilities of automated vehicles in responding to arbitrary reconfigurations and movements their paths.

</comment></comment></comment></comment></comment><comment><USER27>
      - 70mph to 0 around 184 ft. [1]
      - 43mph = 63.066667 Feet per Second
      - At 6 seconds the car was 378 ft. away.

[1] [http://media.caranddriver.com/files/2016-volvo- xc90-t6-awd-i...](http://media.caranddriver.com/files/2016-volvo-xc90-t6-awd- inscriptioncomplete-specs-and-performance-data-2016-volvo-xc90-t6-awd- inscription-september-2015-road-test.pdf)

<comment><USER24> The detection at 6 seconds was just of an object though, not an object moving in to the car's path. You couldn't drive a car if you had to constantly break because objects (such as people standing by the road) were being detected.

It's not clear at what point the car ascertained a collision would occur between detection 6s before and the determination that emergency breaking was necessary 1.3 seconds before.

Was there any other determination in between, and when? What I'd like to see is Uber's modelling of the woman's trajectory and the likeliness of collision across the 6 second window. That's completely left unsaid.

The average braking distance of a car is about 24m at 40mph, which is approximately the distance between the woman and the car at 1.3 seconds out. So perhaps the 1.3s figure wasn't the first moment the car determined a brake was necessary, but rather, the last moment the car could have braked to prevent a substantial collision. I want to know the first moment the car determined a brake was necessary at all. It's likely not 6s, but it's also likely not 1.3 seconds. It seems this was entirely preventable, or at least the collision impact could have been mitigated severely, had there been a braking and/or warning system in place.

Shutting off brakes on literally the only driving agent tasked with full attention is inexcusable. But that's what they did. To me that's murder. They used to have two passengers, one for tagging circumstantial data, the other to override the car when necessary and keep eyes on the road at all times. Either keep that and shut off emergency brakes from the car and put a warning system in place for the 'driver'. Or do not shut off emergency brakes. Instead they put a single person in the car, tasked to do things that kept her eyes off the road half of the time, and shut off brakes for the AI. That's insane.

<comment><USER15> > You couldn't drive a car if you had to constantly break [sic] because > objects (such as people standing by the road) were being detected.

Yes, you could -- that's how I drive. Do you not? If I detect a mobile object that might be moving into my path, I slow down to give myself time to react until I am reasonably certain of safety. When doing so I take into account my situation-specific knowledge -- have I made eye contact with the pedestrian and do they know I'm coming? Is the dog on a leash and is the owner being attentive? Does the cyclist seem aware of my presence?

I would expect no less from anyone licensed to drive a car, be they human or software.

<comment><USER24> You're misinterpreting my point.

I didn't say you can't drive a car without being cautious.

I said you can't drive it without constantly braking the moment you detect an object, irrespective of what the object is doing. (e.g. moving into or away from the driving path).

i.e., just because an object was detected 6 seconds before impact did not mean the car ought to have started braking at that moment. It could be that the object was 200 feet away and moving away from the car's driving path, 6 seconds before impact. It'd be absolutely ridiculous to brake in that situation.

We have no information about this context, e.g. the car's data or determinations within the 6 second window. We only know it detected an object 6 seconds before impact.

It appears like the person I was replying to implied 'the braking distance was 180 feet, but the person was 380 feet away, thus uber could have prevented killing this woman had it not shut off the brakes'. In reality, the 6 second figure isn't relevant. What is relevant is the context that allowed a reasonable driver/AI to determine at a particular point in time, that the car should have slowed/braked. And we don't have that information yet. That's what I'm interested in.

<comment><USER15> I don't think I'm misinterpreting, just disagreeing about the level of caution. One point is that humans are quite good at immediately recognizing objects and evaluating threat level (at least when attentive). So a human is rarely in a scenario of "there's something up ahead I have no idea what it is or where it's going." But if they were, I don't think it's at all ridiculous to slow down until determining those things. If software is in that scenario, I absolutely expect it to slow down until it can determine with high confidence that no object ahead is a likely threat. (edit) For instance, an attitude like "in my training data, unidentified objects rarely wander into the road" is not good enough for me, I want to hold software (and humans) to a much safer standard.

<comment><USER28> Humans are frequently in this scenario, especially at night. For example, a reflection from a rural roadside mailbox's prism looks similar to the eyes of a deer, and shredded truck tire treads look similar to chunks of automotive bodywork debris. This doesn't invalidate your point about slowing down.

But we're asking a lot from this software (for good reasons), but humans commit similar leaps of faith of various severity on the roads daily -- failure to yield, failure to maintain following distance, assuming other drivers immediately adjacent to you will keep driving safely and carefully -- and only a small subset of these situations results in accidents. We're expecting an algorithm coded by humans to perform better than a complicated bioelectric system we barely understand.

Waymo has opted to commit to thoroughly understand its environment, which is why their cars drive in a manner that bears no resemblance to how humans actually drive. We as a society have to eventually reconcile the implications of the disconnect.

<comment><USER29> > reflection from a rural roadside mailbox's prism looks similar to the eyes > of a deer

Deer hits a major cause of fatality out in the country. If your driving at night in deer country and you aren't eyes wide open then you are going to have an unhappy experience at some point. Their instincts are essentially the exact opposite of what they should do when encountering a car. They will stay in the middle of the road, and they will jump in front of you if startled.

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> Nice little FUD by WSJ in their subheadline: "Pedestrian tested positive for methamphetamine and marijuana" \-- not referred to again in the article, moreover I have trouble seeing the relevance to the accident.

<comment><USER31> It is mentioned again at the end of the article. It's relevant to the accident because it provides an explanation for the pedestrian crossing the road outside a crosswalk without adequately checking for traffic.

<comment><USER32> Yeah only druggies J-walk.

<comment><USER33> Not at all, sober people jaywalk too. They just tend to check their surroundings a bit better than their high counterparts for any cars coming to potentially hit them.

<comment><USER34> Nice try, but that doesn't apply to this specific case, where the car could and should have stopped but didn't.

<comment><USER31> The car should have stopped automatically, but that system was disabled. The pedestrian shouldn't have been there, but made a bad decision. The pedestrian should have been more aware of her surroundings, but was impaired or not paying attention. The safety driver should have been paying more attention to the road, but was also monitoring system displays.

This crash didn't have a single cause. Any one of those factors being handled correctly would have prevented it.

<comment><USER34> > _This crash didn 't have a single cause._

It is not the fault of the pedestrian for having been slaughtered, especially due to the immense amount of time after the car saw the pedestrian until the time that the accident occurred.

</comment></comment></comment></comment></comment></comment></comment><comment><USER35> Does this mean the technology is so early that they are struggling to program it to do the right thing in normal conditions, let alone to prevent an accident?

<comment><USER12> It sure suggests the possibility of, "that thing keeps braking when we don't want it to, turn it off". When, you know, human drivers manage to do quite fine with it on. If you have to disable the built-in safety features of the Volvo to get your driving software to work, then you're not ready to do a road test.

<comment><USER36> I don't think that is right. My understanding is that they didn't HAVE to turn the built-in safety features of the Volvo off to make it work, but instead they had to in order to test their equivalent safety feature. If they have a feature that exactly mimics Volvo's, it can't be tested while Volvo's is active (or at least that is the idea, I think it probably could be tested in some way.)

But then they turned their own safety feature off, because it failed to be as good as Volvo's. And then did not turn Volvo's feature back on.

<comment><USER37> You either works with higher error margins than the Volvo software (what should be the case, since yours is being tested), or you log your software decisions and compare with the Volvo's one after the fact.

<comment><USER36> Right, that makes sense. I think they were really underestimating the risks of distracted driving. Which I think a lot of people (myself included) do.

</comment></comment></comment></comment></comment><comment><USER38> Isn't the person actually driving the car supposed to be driving the car?

I've ridden in these self driving Ubers. When I rode in one, the driver drove almost the entire time, except on a few straight stretches of road. They always had their hands ready to grab the wheel, were always attending to what was happening etc.

It seems like the marketing and the engineering got crossed here. Marketing says these were self driving, but anybody who rode in them knew they weren't. They were supposed to be getting driven by real drivers. From the report, it sounds like the drivers were listening to the marketing instead of the engineering team (who presumably would have told them that the system doesn't brake on its own).

It sounds like the real driver wasn't driving as they were supposed to be. From the video, it looked like they were reading something on their phone[1] instead of driving the car.

Compare this to a pilot flying in an autopilot. They don't shut their radios off and stop paying attention to the flight, they still fly the airplane and remain attentive to what is happening with it. That's what this driver should have been doing, not looking at their phone.

It frustrates me that this level of negligence could set self driving tech, something that will save countless lives, back. This was the Chernobyl moment for self driving tech. It's safer than alternatives, but now this is all people are associating it with.

[1]:the driver states that they were interacting with the Uber self driving system, not their phone.

<comment><USER39> > That's what this driver should have been doing, not looking at their phone.

According to the NSTB report, they were looking at a separate diagnostic panel and flagging messages which Uber asked them to do as part of self-driving training duties.

> It's safer than alternatives

The system also decided it should have applied the emergency brakes, but then didn't. I don't think this system is safer than alternatives.

</comment></comment><comment><USER40> The number of occurrences of "break" in place of "brake" in this discussion is very disconcerting.

<comment><USER41> Someone at Uber probably recently committed:

        if (personDetected())
        -   break();
        +   brake();

<comment><USER42> Maybe it's written like a game engine

        for (;;) {
            if (detect_obstacle()) break;
            move_forward();
        }

</comment></comment></comment><comment><USER43> Let me get this straight:

The driver has to look down on a console to see warnings like this AND drive the car? This and that the emergency system was off tells me that the accident was 100 % the fault of Uber even if the "driver" were dancing in the backseat.

</comment><comment><USER44> Yet another reason in favour of professional engineers being required to design and implement safety-critical features using software: because "move fast, and break things" becomes unacceptable when those "things" are the lives of living, breathing people.

</comment><comment><USER45> Yikes, it had not occurred to me that even Uber would ignore their automation system's pleas to emergency brake because it was making their cars look too jumpy.

</comment><comment><USER46> The one thing I spent years teaching my wife is that when there's anything untoward on the highway, JUST STOP. I've avoided at least two major accidents by stopping instead of swerving — in a few feet you can get your speed down to levels where a crash won't be fatal or severely injurious. And even if you get rear ended by stopping short, it's usually at a much lower speed. All autonomous cars should just STOP when something is not right.

<comment><USER47> Or just slow down a lot. The fatality is a way lower at 18mph than it is at 43mph.

[https://ec.europa.eu/transport/road_safety/specialist/knowle...](https://ec.europa.eu/transport/road_safety/specialist/knowledge/speed/speed_is_a_central_issue_in_road_safety/speed_and_the_injury_risk_for_different_speed_levels_en)

</comment></comment><comment><USER48> Someone should be facing manslaughter charges here.

<comment><USER49> It's gonna be a case of distributed responsibility

</comment></comment><comment><USER50> "Struck" is a strange euphemism for "killed". :(

<comment><USER51> I agree, but in this context "struck" is what happened. "Killed" was the consequence in this case but not necessarily a guaranteed one (although at the speeds involved in this particular case, it was almost certainly guaranteed).

<comment><USER50> Pedantically true, but in this case (and most) the result is more newsworthy than the action. See "person pulls trigger many times in school".

<comment><USER52> The event of interest is the vehicle striking/killing someone. Pulling the trigger is not that in the context of a shooting, and "pulling the trigger" is not really a euphemism for shooting and killing someone with a firearm.

<comment><USER53> "person shoots at people in school" still doesn't convey them _killing_ anyone when the effect is a newsworthy subject (though maybe not that much in the US).

</comment></comment></comment></comment></comment><comment><USER34> Article from 1996 about Space Shuttle software: [https://www.fastcompany.com/28121/they-write-right- stuff](https://www.fastcompany.com/28121/they-write-right-stuff)

 _But how much work the software does is not what makes it remarkable. What makes it remarkable is how well the software works. This software never crashes. It never needs to be re-booted. This software is bug-free. It is perfect, as perfect as human beings have achieved. Consider these stats : the last three versions of the program — each 420,000 lines long-had just one error each. The last 11 versions of this software had a total of 17 errors. Commercial programs of equivalent complexity would have 5,000 errors._

Also from the article: "If the software isn't perfect, some of the people we go to meetings with might die." _

</comment><comment><USER54> Future engineers growing up today will read about this incident alongside the Therac-25 and the Tacoma Narrows Bridge.

</comment><comment><USER55> Isn't the problem here much like the presumed cause for Air France 447 ([https://en.wikipedia.org/wiki/Air_France_Flight_447](https://en.wikipedia.org/wiki/Air_France_Flight_447))? The pilots are so used to automatic operation that happens 99.9% of the time that they are not prepared for the random time when it does. A bit like someone guarding a bank for 20 years and then gets robbed and can't react in time because they mind has taught them that nothing ever happens.

<comment><USER56> Well, I'd say that's _an_ issue, but not the only one.

<comment><USER55> I was thinking that the assumption in the design is that the operator can always handle the hard/fringe cases but the reality is that due to the AF447 principle (whatever it's called), this is precisely what the operator cannot do reliably.

<comment><USER56> Yeah, I agree, but it seems that they also had no alert and were asking the operator to simultaneously record data, leading to them not even looking at the road at the time the crash happened.

</comment></comment></comment></comment><comment><USER57> That's so irresponsible. So the system cannot apply emergency braking, but why didn't it try at least to decrease the speed?

Those cars are not ready for public roads. If your sensors give too many false alarms then you should improve them.

Also I think initially there should be a speed limit for self-driving cars. For example, 15-20 mph should be enough for driving in the city and won't cause too much harm in the case of an accident.

</comment><comment><USER11> >> Roadway lighting was present.

It's worth remembering that the video of the acciedent that Uber made available showed a pitch-black road with very little lighting, something that is not corroborated by the NTSB report. Given that the only comment about visibility in the preliminary report is that "(r)oadway lighting was present" it sounds very likely that Uber deliberately tried to create a misleading impression.

>> The forward-facing videos show the pedestrian coming into view and proceeding into the path of the vehicle

This is a little less clear-cut but it also seems to cast doubt onto the initial statement by the Tempe police chief, that Uber was not at fault because the pedestrian dashed onto the road suddendly and the crash was basically "unavoidable". [1]

______________

[1] [https://www.sfchronicle.com/business/article/Exclusive- Tempe...](https://www.sfchronicle.com/business/article/Exclusive-Tempe-police- chief-says-early-probe-12765481.php#photo-15257361)

</comment><comment><USER58> This one is a complete no-brainer: At the first hint of an anomaly, the AI should have 1) alerted the driver and 2) started to gradually slow down.

If that strategy produces too many false positives, it's time to go back to the drawing board. The right answer in that case is absolutely NOT to say, "Ah, just fuck it" and deploy the system in the field.

</comment><comment><USER59> Two semi-automated types of cars are out there:

1\. Ones where a human pilots them most of the time, but a computer steps in in emergencies. 2\. Ones where a computer pilots them most of the time, but a human steps in in emergencies (hopefully).

For some reason I don't understand, people treat (2) as an evolution of (1). But it is the inverse.

<comment> forgot-my-pw What would be the point of #2? Humans have bad reaction time at emergencies most the time.

<comment><USER60> Presumably the point of #2 is that it's easier than the implied #3 ( _" The computer always drives"_) which is their as-of-yet unrealized goal. Of course deploying #2 into the wild may prove to be ethically unjustifiable. Being easier than the implied #3 is a poor excuse.

</comment></comment></comment><comment><USER61> Funny, all this contention around technology that simply doesn't exist yet. When automakers market SAE Autonomy L2 ([https://en.wikipedia.org/wiki/Autonomous_car#Classification](https://en.wikipedia.org/wiki/Autonomous_car#Classification)) certified vehicles as "self-driving" in official marketing media, and even more so when their sales reps blatantly lie to customers (both of which should be illegal), they're responsible for lost lives and undermining their companies' image, ethics and financials.

There's only one car certified for SAE L3 / "eyes off" and it's the 2018 Audi A8, only up to 60kmph - this is still not self-driving.

The primary concern here is false advertising as pervasive as it is blatant.

</comment><comment><USER62> Why not alert to the driver????

BMW has collision detection system that makes a loud beep when it determines an imminent collision. The beep alerts the driver regardless of false positives or false negatives. Its a simple solution which many cars have had for over 10 years.

Why Uber engineers chose to not alert the driver is beyond me.

</comment><comment><USER63> Coverage on Ars: [https://arstechnica.com/cars/2018/05/emergency-brakes- were-d...](https://arstechnica.com/cars/2018/05/emergency-brakes-were- disabled-by-ubers-self-driving-software-ntsb-says/)

</comment><comment><USER64> > According to Uber, emergency braking maneuvers are not enabled while the > vehicle is under computer control, to reduce the potential for erratic > vehicle behavior. The vehicle operator is relied on to intervene and take > action. The system is not designed to alert the operator.

Wow. So the vehicle and these tests were run knowing full well that an accident like this would not be preventable. This isn't manslaughter, this is murder. Uber was letting its car drive without any safety systems, without even an alert driver behind the wheel because her job was to monitor the panel. Fuck me. Wow. They should never be allowed to operate another autonomous vehicle again. The ceo should go to fucking jail. Fucking murderers.

</comment><comment><USER65> If any non-rich, non-corporate individual had done the following: sent out a vehicle on city streets, driving fast under computer control, which did not have any capability to brake and which did indeed strike and kill someone, I think that non-rich person would certainly be sent to jail for their reckless behavior and also receive very large fines and civil judgments. It wouldn't even be close. The judge would shout at them during sentencing and the papers would cheer.

So, let's see what will happen to the Uber personnel involved.

By the way, it's insane to be an Uber test driver under these circumstances. They're going to hang you out to dry. Quit.

</comment><comment><USER66> Interestingly, the picture shows that the car seems to have tried to avoid the collision by moving to the right.

Of course, every human drivers with experience knows that you pass pedestrians behind, not ahead. The Artificial Intelligence obviously was not smart enough.

In other words, as suspected, the self driving cars are a pipe dream. One can't just mix a bunch of statistical woodoo into a neural net and hope it will work. It may work most of the time, but the mistakes would be catastrophic and incredibly stupid.

</comment><comment><USER67> Now I understand why Uber started their advertising campaign. They know this will come out and show the world how irresponsible they are, and they wanted to get in front of that.

</comment><comment><USER68> Uber should bail on doing their own and work a deal with Waymo.

<comment><USER69> I have this weird hunch that those two companies' self-driving car divisions may not be huge fans of each other these days.

<comment> forgot-my-pw It's possible. The lawsuit is settled and Waymo actually owns like 1% of Uber. In the past, Google also invested on Uber.

<comment><USER68> Google owns more like 7% or maybe 8% of Uber. They already owned a piece before the lawsuit.

Think they also own a piece of Lyft.

</comment></comment></comment></comment><comment><USER70> This entire debate reminds me of this classic Milton Friedman video (I think the key difference with Uber, and where they are likely to get in trouble, is that they never made any estimate about how many lives their car experiment would cost that I am aware of): [https://www.youtube.com/watch?v=EYW5I96h-9w](https://www.youtube.com/watch?v=EYW5I96h-9w)

</comment><comment><USER47> a. _the self-driving system software classified the pedestrian as an unknown object, as a vehicle, and then as a bicycle with varying expectations of future travel path_

All of those things are bad things to hit, why not slow down?

b. _1.3 seconds before impact, the self-driving system determined that an emergency braking maneuver was needed_

Too late for either a human or computer.

c. _operator is responsible for monitoring diagnostic messages_

There is superseding responsibility to drive the car safely. Uber's policy sets up the test driver for failure, and puts people's lives at risk.

d. _emergency braking maneuvers are not enabled while the vehicle is under computer control_

The pedestrian had no chance.

The very feature that should make the car safer was disabled, but also the judgement was poor and too late, and Uber policy sabotaged the car driver judgement as the exclusive (not merely primary) safety mechanism by distracting them with data that in most every way would have been more diverting than talking on a cell phone or fiddling with the radio.

I hope the family got a lot of money in the settlement.

</comment><comment><USER71> So as many pointed out quite early, this isn't litterally a case of Uber killing people because they cared more about taking I up miles than safety an in effect human lives. They disabled safety measures because they where getting in the way.

Hopefully they will get the book thrown at them and then a couple of chairs.

</comment><comment><USER72> Someone from Uber needs to go to jail over this. That woman's death was the result of pure criminal negligence.

</comment><comment><USER73> A good podcast on the risks of semi-automation: [https://99percentinvisible.org/episode/children-of-the- magen...](https://99percentinvisible.org/episode/children-of-the-magenta- automation-paradox-pt-1/)

</comment><comment><USER74> Perhaps Uber is going to once again "ask for forgiveness". (As in, it's better to ask for forgiveness than permission.)

This time, I don't think they should get it.

(Not that I, for one, should have received it, previously.)

</comment><comment><USER75> Move fast and break, nay, kill people.

I hope this accident weighs on the people who made these decisions so that they will be more careful in the future. I would hope they would not see it simply as a bug in the system.

</comment><comment><USER76> Uber is a prime example that the "Move fast; break shit" mentally that Facebook pioneered and the Valley companies so love is now costing lives.

</comment><comment><USER77> Even if the emergency braking was disabled, why was there a lack of automatic steering, e.g. to change lanes, to avoid the collision?

</comment><comment><USER78> It won't load for me. Are they referring this to the Justice department? Someone needs to go to prison.

</comment><comment><USER79> All Uber executives should be forced to recreate this scenario as the pedestrians crossing the street, while their test vehicles drive the loop, over and over again until there are no pedestrians killed by their self- driving cars!

</comment><comment><USER80> For a government-authored report, that was very readable.

</comment><comment><USER81> This is what happens when software companies that have traditionally had an incentive to "fail fast, fail often" mentality ship something in the physical world.

Especially something as powerful as a ton of steel moving like a missle on our roads.

Absolutely stunningly stupid that there are teams that built this and felt incentivized to put this on our roads without any concerns or safety mechanism. Shameful.

Legally, it will be amazing in the future to hold these people - <USER2> engineers, product managers, the PR people and the CEO (ex and current) all accountable. We did for something far less serious with VW...

<comment><USER82> I have to blame management in this regard. There must have certainly been engineers that spoke up about this problem who may be silenced by NDA's (or other means), even if they did resign in protest.

Stopping in time to not run over an unexpected pedestrian crossing the road would be item number one on any sensible person's agenda. Uber needs to be liquidated.

<comment><USER83> We shouldn't assume that engineers have spoken up about this problem. All the same incentives (stock, bonuses) and fears (pushback for whistleblowers, an anti-truth company culture, getting fired) that apply to management apply to engineers, too. Engineers are fallible people, too.

</comment></comment></comment><comment><USER84> Criminally negligent.

</comment><comment><USER85> Uber has the ability to learn from it's mistakes, I hope.

<comment><USER86> Mistake? Turning off emergency braking because it happened too often _then continuing to drive on public streets_ isn't a mistake. That calls for a custodial sentence.

<comment><USER87> Vast majority of cars on the road and majority of new cars sold in US has no emergency braking assist. Who should we sentence every time somebody dies because of lack of EBA?

<comment><USER88> The vast majority of cars are being driven by humans who we expect to carry out an emergency stop if necessary. Replacing the human with a computer driver which is intentionally incapable of any kind of emergency stop and trying to justify this by relying on a human supervisor who's required to take their eyes off the road for much of the trip to stop the car is basically murder.

(Besides, relying solely on an unassisted human driver - even an attentive one - is dangerous enough that the industry wants to make automatic emergency braking systems mandatory on all new cars as soon as it's practical.)

</comment></comment></comment></comment><comment><USER89> Does anyone have a non-paywalled link? Thanks :)

<comment><USER21> Yeah, I'm of two minds of the usefulness of sharing links to things that a significant proportion of people might not be able to access.

This is actually a good use-case for that pay-per-article site/app (but I can't remember its name off the top of my head). Unfortunately, I don't know how easily I could find the article in it. I emailed them about that and they told me they were working on integrating with publisher sites; maybe they should look into integrating with _aggregator_ sites instead.

<comment><USER21> [Blendle]([https://blendle.com](https://blendle.com)) was the site of which I was thinking.

<comment><USER21> Here's my Blendle link for the article (which costs $0.49):

[https://blendle.com/i/wsj-com/uber-self-driving-car-that- str...](https://blendle.com/i/wsj-com/uber-self-driving-car-that-struck- killed-pedestrian-wasnt-set-to-stop-in-an-emergency/bnl- wsj-20180524-SB11988325855978843674704584244083984615954?sharer=eyJ2ZXJzaW9uIjoiMSIsInVpZCI6Imtlbm55ZXZpdHQiLCJpdGVtX2lkIjoiYm5sLXdzai0yMDE4MDUyNC1TQjExOTg4MzI1ODU1OTc4ODQzNjc0NzA0NTg0MjQ0MDgzOTg0NjE1OTU0In0%3D)

</comment></comment></comment></comment><comment><USER90> Notwithstanding a click-baiting take from the headline writer, why on earth would that be a configurable option?

<comment><USER91> I'm not sure the title is click-baiting; the reality sounds exactly as dire as the headline.

> The agency, which investigates deadly transit accidents, said Uber's self- > driving system determined the need to emergency-brake the car 1.3 seconds > before the deadly impact. The NTSB report said that, according to Uber, > automatic emergency braking isn't enabled in order to "reduce the potential > for erratic vehicle behavior" and that the system also isn't designed to > alert the operator in case of an emergency.

</comment></comment><comment> matt-attack > the operator said she had been monitoring the self-driving system interface

I guarantee that driver was on her phone. Just watch.

<comment><USER68> Yes they were. You can not be kind of driving. Google has indicated this several times. Either the car can drive itself or not. This half way is dangerous.</comment></comment>


The Technology 202: 200+ companies are calling for a national privacy law - <AUTHOR> https://www.washingtonpost.com/news/powerpost/paloma/the-technology-202/2018/12/06/the-technology-202-more-than-200-companies-are-calling-for-a-national-privacy-law-here-s-an-inside-look-at-their-proposal/5c0819be1b326b60d128012e/ <comment><USER2> there should be a way to appeal decisions about being denied service.</comment>