Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible? - <AUTHOR> https://www.usenix.org/conference/usenixsecurity18/presentation/mickens <comment><USER2> I love Mickens' work, and think this is overall a great presentation, but I feel like it misses (or maybe just doesn't fully explore) an important point.

Start with the Internet of Things example. He chalks up the abysmal security record of IoT devices to two factors: it keeps IoT devices cheap, and IoT vendors don't understand history. And there's a lot of truth in both these assertions! But they are both just expressing facets of a deeper, more fundamental reason: IoT devices aren't secure because _their customers don 't demand security._

This deeper problem completely explains why the two higher-level problems he observes exist. Making your product secure makes it more expensive and slower to come to market than just leaving it wide open, and the IoT vendors know their customers care about cost and availability and don't care about security. So they do the rational (in the _homo economicus_ sense of the term) thing and optimize for things their customers are actually willing to pay for.

The same causality can be observed in the ML world. Mickens asks why people are hooking ML systems whose operation isn't fully understood to important things like financial decisionmaking and criminal justice systems. The answer is that _the customers demand it._ ML is trendy and buzzworthy, so if you're a vendor of (say) financial systems, and you can find some way to incorporate ML into your offerings with a straight face, now you have an attractive new checkbox on the feature list your salespeople dangle in front of potential customers. And once the effectiveness of having that box checked becomes clear, you kind of _have_ to do it, even if you know it'll be ineffective or even worse, or risk losing business to a competitor with fewer scruples.

All of which is to say that what we see playing out in both these scenarios isn't really the vendors' fault. They are instead classic examples of market failure. People end up buying shoddy products because spotting their shoddiness requires technical expertise they don't have; responsible vendors who try not to make shoddy products lose sales to irresponsible vendors who don't; eventually all the responsible vendors are out of business and the only products available to buy are shoddy ones. There are lessons to learn from this, but they're economic rather than technological.

<comment><USER3> This is like saying doctors should push cheap drugs that may or may not make your testicles explode because _customers don 't demand non-testicle exploding drugs_.

We trust doctors to take into account all the nuances of medicine that laymen have never even heard of, and give us good advice. Because not everyone can be an expert on everything.

Its the same with software. We can't expect everyone to be an expert.. its up to our industry to act responsibly.

Sure its "market failure" in so far as duping uninformed people is a good way to make a quick buck, but the deeper issue is moral failure / failure to take responsibility.

<comment><USER4> ...and we don't just rely on drug makers, for example, to be moral and take responsibility. We have government agencies that _require_ strict testing of their safety and effectiveness. If we left it up to the market, we would get inferior results. The problem is, we have no FDA equivalent for tech security.

<comment><USER5> That's a great point made with a pretty suspect example. FDA very subject to regulatory capture.

<comment><USER4> Regulatory capture is certainly an important problem, but the pre-FDA record suggests strongly that the FDA we have is much better than not having one. But I would certainly not suggest that there is not a real problem with regulatory capture, just that the current situation in tech security (no FDA equivalent) is worse.

</comment></comment></comment></comment></comment><comment><USER6> "Using case studies involving machine learning and other hastily-executed figments of Silicon Valley's imagination, I will explain why computer security (and larger notions of ethical computing) are difficult to achieve if developers insist on literally not questioning anything that they do since even brief introspection would reduce the frequency of git commits."

For anyone who hasn't heard a James Mickens talk, do yourself a favor!

<comment><USER7> He's the guy who wrote the Slow Winter. He's hilarious.

[https://www.usenix.org/system/files/1309_14-17_mickens.pdf](https://www.usenix.org/system/files/1309_14-17_mickens.pdf)

<comment><USER8> It'd be more hilarious if he didn't reference real problems with no obvious solutions short of a painful dismantling of our heavily exploited societal constructs.

</comment></comment></comment><comment><USER9> James Mickens is pure gold

[https://mickens.seas.harvard.edu/wisdom-james- mickens](https://mickens.seas.harvard.edu/wisdom-james-mickens)

<comment><USER10> This guy looks like the one who wrote those satire magazine-style articles.

<comment><USER11> He _is_ that guy. Mickens is a legend.

<comment><USER12> But how can we be sure? Maybe there are two people with the same name who look exactly alike with the same writing style. If we put them all on the blockchain, do they have the same hash?

</comment></comment></comment></comment><comment><USER13> "I'm not saying that machine learning is the portal to a demon universe, I'm just saying that some doors are best left unopened."

</comment><comment><USER14> This is an entertaining and important talk. Technology is not value-neutral, and insistence that it is is a larger meta-security issue in of itself.

</comment><comment><USER15> Regarding the "we don't know how this stuff works" point, doesn't the FDA approve a ton of drugs where we don't know the exact mechanism of how it works? Do we need to know exactly and precisely how something works to know _that_ it works?

<comment><USER16> The overwhelming majority of medical treatments don't have inteligent humans actively trying to maliciously sabatoge them. Many drugs can be made horrendously lethal or otherwise dangerous with little effort (often just by significantly increasing the dosage) but we don't need to care very much because it's not possible to silently untracably apply that effort from arbitrarily far away, and there usually isn't anything to gain from doing so even if it were possible.

<comment><USER17> Is there any kind of sabotage other than malicious sabotage?

<comment><USER18> Ignorant, unintentional, self, incidental.

Stupidity is probably the biggest threat. Dietrich Bonhoeffer:

[https://religiousgrounds.wordpress.com/2016/05/11/bonhoeffer...](https://religiousgrounds.wordpress.com/2016/05/11/bonhoeffer- on-stupidity-entire-quote/)

<comment><USER19> I think the parent meant that "sabotage" is "deliberate destruction" by definition.

</comment></comment></comment></comment></comment><comment><USER20> Seems well opinionated but I disagree. He's thinking too much in absolutes while in practice people care about relative security.

Computer security has gotten a lot better,many organizations have acheived a security posture they are comfortable with. I think he's focusing strictly on application security,in reality you care about maintaining C.I.A. for the data.

I don't care if the entire software stack is riddled with vulnerabilities and the CPU has unfixable vulnerabilities so long as that does not result in attackers (as defined by my threat model) fail to compromise confidentiality,integrity and availability of data I consider valuable.

The software might get exploited but there are post exploit controls,those may get bypassed but attacker facing machines would ideally not store valuable data. The attackers can move laterally but there are detection and prevention measures for that. I mean, both in life and computer security,one shouldn't expect absolute security, acheiving and accept level of a security posture should be enough.

I'm not prepared to handle 10 guys mugging me as I walk home,but that isn't my goal. My goal would be to defend myself against one or two attackers of the same weight class as myself.

There is a reason so much security appears bad,easier to clean up a breach of security or to just ignore it than to implement a SDLC and have independent security staff. In the end,security improves only if it's cheaper to do so.

<comment><USER21> I disagree with your disagree.

Say we all lived 50 years ago and worked in ergonomics engineering instead of software engineering. People were fairly comfortable doing non-stressful work, which I guess was better than being pulled into meat grinders of The Jungle.

However, there was this new science that was indicating a new problem of repetitive stress injuries. Over the next 20-ish years, we learned that these injuries caused a ton of harm, so we started legislating protections against these types of stresses, when which resulted in increased productivity.

Now switch to today. What makes the lax of software security best practices so different from repetitive stress injuries 50 years ago?

Software engineering is feeling like it will follow the same path as every other engineering. First, we'll feel like we're gods. Then, we'll suffer losses. Finally, we'll be regulated.

Remember, every regulation is written in blood. Software will be no different.

<comment><USER22> An 8yr old can write software and post it to github. An 8yr can't build a house or car from scratch (two things who's construction is regulated).

My point being software is harder and possibly impossible to regulate. Is all open source going to be banned unless it's been written by licensed certified programmers and gone through review by an appointed inspector? That seems untenable.

<comment><USER20> Writing software can't be regulated but use of unaudited software can,especially for commercial use.

</comment></comment></comment></comment><comment><USER23> Here's the YouTube link to his talk: [https://youtu.be/ajGX7odA87k](https://youtu.be/ajGX7odA87k). This made me laugh more than it probably should.

</comment><comment><USER24> I'll post IMO the most interesting slide of the talk.

\---

The Assumptions of Technological Manifest Destiny:

1) Technology is VALUE-NEUTRAL, and will therefore automatically lead to good outcomes for everyone.

2) Thus, new kinds of technology should be deployed as quickly as possible, even if we lack a general idea of how the technology works, or what the societal impact will be.

3) History is generally uninteresting, because the past has nothing to teach us.

\---

How relevant is this. With Cambridge Analytica scandal and now Google's censored search engine in China. How about self driving cars? Cryptocurrencies?

</comment><comment><USER25> Sidestepping comedy for a bit, there are a lot of inscrutable systems that we connect to 'things that matter' all the time. The financial systems themselves are pretty damn inscrutable. Corporations are very often inscrutable.

<comment><USER26> The word Mickens uses is "interpretable", which financial infrastructure is, and ML models are not.

<comment><USER25> Financial IT is interpretable, maybe, but is the financial system itself? You have a lot of agents taking actions that you can't really interpret from outside - unless you say something vacuous like this person made this trade because they think it was good, at which point you may as well say this ai model made this decision because it thought it was good.

<comment><USER26> What does "the financial system" mean? Obviously there's a level you can address with that term where, just like with ML, interpretability becomes an open question. But on most every level that is genuinely comparable to the role an ML model plays in a software product, finance is plenty interpretable.

</comment></comment></comment></comment><comment><USER27> Speaking generally, and not about this post - Keynote speakers often aren't technical (enough), but speak about topics that have technical underpinnings.

Take for example, dangerous management consultants who speak all over the place about AI, disruption, innovation, digital transformation, but don't know technology, which is the underpinning of all the things they're speaking about.

<comment><USER28> I get this feeling from even some of the biggest conventions there are... _cough_ I felt fairly fricken disenfranchised during a recent convention for a popular containerization solution...

<comment><USER27> Good point. "Technologists in management /leadership" groups need to form everywhere to get the right people speaking about topics they understand.

It's ironic that there is an imposter syndrome among competent people, and incompetent people have no issue being imposters.

</comment></comment></comment><comment><USER29> He says at one point "Patrick Thistle" and I grant this seems like it makes sense, but indeed the name of that particular association football club is "Partick Thistle" and Partick is a real place, albeit not one which today would obviously be in need of a professional soccer team, and it isn't where they play.

</comment><comment><USER30> A few years ago, I was working in a company that was trying to build an innovative NLP system, or in more honest words, to do a chatbot that doesn't suck. Spoiler alert: we failed.

There were a lot things wrong in how this company was run and the product we were doing, but I won't go into details except to say that there were a lot of intelligent people forced to do silly things by a clueless micromanaging boss.

Anyway, one of the problems with chatbots is the one of prior knowledge. Chatbots and other NLP solutions don't simply need to be able to understand and produce conversation, they need to have something to talk about, a model of the world, some basic facts, and it turns out it is very complicated to build in general.

So our boss decided that one way to fake it was to use one of those free corpora of public-domain English literature. Let's just make our system "read" a lot of text and in some way it will gain prior knowledge that way. So if it reads "the Sun was high in the sky", it would understand that the Sun is something that has a position and that one of the possible position is "high in the sky". So if someone ever asks the chatbot "where can the Sun be?" it could answer "The Sun can be high in the sky". It was all pattern matching, nothing very smart about it, just something to fake some parts of the conversation and avoid having too many "I don't know".

Of course, it was literature, including fiction. So caterpillars could smoke hookahs, but that was considered an acceptable risk, it was better to have something wrong than an admission of ignorance. In some way don't humans also repeat stuff without understanding them?

It kinda worked. If you asked "What do people eat?" it would answer "People eat potatoes, mushrooms and tires" or something like that. It was not very smart but somewhere in the literature the pattern "<Person> eats <X>" existed and it was parroting it. If you asked "What do children eat?" it would answer "Children eat carrots, rocks and cupcakes". It was a bit silly but nice. But then we asked "Who eat children?" and the answer was, I shit you not, "Black people eat children, while howling to the moon and covering their naked body with feces".

Except it didn't actually say "Black people", it used the other term, the one which is much worse.

The sudden realization that we have created an AI but an incredibly racist one did not make us abandon the approach. We just found the guilty piece of text in the corpus and expunged it. Then it just said "Companies eat children". Depending on your politics you can consider that better.

To be fair, it was not really Machine Learning but the story shows what can happen if you don't control your input, either because it comes from the evil internet or because it is a large dataset that it is too big to reasonably sanitize and was not built for this purpose.

<comment><USER31> nice anecdote thanks for sharing. You assert that it was not really ML. I think it is, It may not be true AI, however patten matching/recognition is the core part of ML. ML is just a stochastic and statistical approach to do pattern matching, the hype around ML has kind of distorted the expectation from the field.

You don't have to really control the input, it is not difficult to automate the sanitation by building a feedback loop of abuse reports to delete patterns from the corpus, if you cannot release before significant cleanup, you could either use something like Mechanical Turk/ Crowd-sourced paid users to test the system extensively, or be more through generate millions of possible questions and the answers for them and run content moderation tools on them, human assisted or otherwise, or build a filter layer into your chatbot itself. None of these approaches of course give you a guarantee something won't go wrong, they give you a reasonable probability it won't.

</comment></comment><comment><USER32> I'd like to see James Mickens vs Yoram Bauman in a comedy roast battle.

</comment><comment><USER33> I love some good James Mickens content. Highly encourage people look up his other work, especially his talks.

</comment><comment><USER34> This was comic genius. It was also equally insightful. What a wonderful speaker and a wonderful talk. Did anyone else catch the the Bob Ross painting references during the graphic of the number 4? That had me in stitches.

Thank you for posting this. This made my day.

<comment><USER35> Noticed this too. I recall one person in the audience laughing uproariously at it - probably the only person that got the reference.

</comment></comment><comment><USER34> In the section of the talk "how do we pick the wights of the neural net" the speaker states:

"the error then is going to be difference between what the classification of the neural net outputs and what the classification or the oracle will be."

Could someone say what is an "oracle" in this context?

He says this at 10:31 in the talk.

<comment><USER36> The oracle = magic box that always gives the correct answer.

<comment><USER34> Thank you. Googling offered very little help as it just returned results regarding Oracle the company and their ML service offerings. Cheers.

</comment></comment></comment><comment><USER37> Because so many people/companies think about security as a secondary thing, and in most places Improving Security is some really simple changes.

</comment><comment><USER38> Fixing security is quite possible.

Install a backdoor, go to jail for "exceeding authorized access".

Fail to fix an security bug, get sued for negligence.

Make it public policy that license contracts cannot override those responsibilities.

<comment><USER39> >Make it public policy that license contracts cannot override those responsibilities.

This would be a disaster for open source. Who wants to write software for free if you can get sued for a bug?

<comment><USER40> I think it's implicit in that proposal that the amount of software available would massively decrease. That's not necessarily a bad thing.

<comment><USER41> I think thats a ridiculous statement. Should we also limit how many books are written and who can write them?

What is the difference?

<comment><USER42> If you buy a book and it turns out to be trash, is that negligence on the part of the author? Is your safety at risk because of it?

You could maybe argue that this is true for textbooks, but not much else.

</comment></comment></comment></comment></comment><comment><USER43> How about a law where someone who finds an exploit can claim a bounty against the company selling the product or publishing the website? This doesn't address the machine learning part, but it does address IoT and security generally.

</comment><comment><USER44> That's because the metrics keep changing.

</comment><comment><USER45> Oh boy Mickens must really hate blockchains and uncensorable platforms like a̶s̶s̶a̶s̶s̶i̶n̶a̶t̶i̶o̶n̶ prediction markets

<comment><USER46> "Blockchains Are a Bad Idea: More Specifically, Blockchains Are a Very Bad Idea."

[https://www.youtube.com/watch?v=15RTC22Z2xI](https://www.youtube.com/watch?v=15RTC22Z2xI)

<comment><USER45> eh that was a pretty bad lecture. Most of the technical problems he talked about are easily solvable.

</comment></comment></comment><comment><USER47> This is an amazing lecture!

</comment><comment><USER48> No security industry wants to make the security industry go away: it's that sad.

</comment><comment><USER49> Makes me think of the recent XKCD on voting machine software: [https://xkcd.com/2030/](https://xkcd.com/2030/)

</comment><comment><USER50> "Would you want Kingsley doing these things?"

Depends on how mission critical <thing> is and how accurate Kingsley is?</comment>


What to expect from Windows 8.1 - <AUTHOR> http://fixedbyvonnie.com/what-to-expect-from-windows-8-1/

<comment><USER2> I hope Microsoft doesn't push this update back like they've done for every other one</comment>


Mmap in Go considered harmful - <AUTHOR> https://medium.com/@valyala/mmap-in-go-considered-harmful-d92a25cb161d <comment><USER2> > What happens when a goroutine accesses cold data in mmaped file? It stucks > for a looooong time. During this time it occupies an OS thread from > GOMAXPROCS threads, so other ready goroutines have reduced number of threads > to be executed on. This leads to CPU under-utilization.

This is not very true. GOMAXPROCS doesn't determine the number of threads (M) in Go runtime. It determines the number of logicial processors (P). There may be more system threads created as needed than GOMAXPROCS.

When a system call is invoked, until it finishes, it is true that the caller goroutine will be parked with a system thread, however, the thread will detach itself from a P, so that the P can assign other goroutines (G) to other threads. So there is no CPU under-utilization.

After the system call finishes, the parking thread will try to find a P to attach or put the caller goroutine in a queue. So I really think there are really a little context-switch overheads in calling system calls. (Just a guess)

<comment><AUTHOR> > When a system call is invoked, until it finishes, it is true that the caller > goroutine will be parked with a system thread, however, the thread will > detach itself from a P, so that the P can assign other goroutines (G) to > other threads. So there is no CPU under-utilization.

True. But major page fault doesn't invoke syscall. Go program just accesses regular memory inside mmap'ed region while running on logical processor (P). Go runtime doesn't know anything about the hard page fault, so cannot add an additional OS thread like in the syscall case.

<comment><USER2> Ah, so setting GOMAXPROCS with a value larger than NumCPUs is good for the performance of a program sometimes. Glad that I learned something new. Thanks for this article.</comment></comment></comment>


Requiring NPM modules in the browser console - <AUTHOR> https://gist.github.com/mathisonian/c325dbe02ea4d6880c4e <comment><USER2> Great functionality, but aren't you a teensy weensy bit worried about polluting the npm namespace?! I appreciate that you're prefixing your 'requirify' generated packages with 'requirify-' prefix, but something about this solution seems like it's abusing the npm tooling. At the very least it's forcing people to download (potentially much) larger npm indexes.

Maybe an npm maintainer can comment.

<comment><USER3> I'm part of the ops team at npm, personally I love the idea of people finding creative uses for the registry. Within the next few months we hope to add better ways to manage collections of packages on npm: Browserify packages, other-front-end packages, grunt packages, etc.

This is a cool proof of concept, and I think would be a great candidate for some of these new features.

</comment></comment><comment><USER4> Cached: [http://webcache.googleusercontent.com/search?q=cache:PQZxLFQ...](http://webcache.googleusercontent.com/search?q=cache:PQZxLFQS6yAJ:https://gist.github.com/mathisonian/c325dbe02ea4d6880c4e+&cd=1&hl=sv&ct=clnk&gl=se)

</comment><comment><USER5> if this is currently a hack, it seems like a great candidate for a refactor into a more robust version- what a handy idea! thank you for making this, i will use it whether its a hack or not!

</comment><comment><USER6> the future is now</comment>


Every Developer Needs a Rubber Duck and You're the One - <AUTHOR> http://blog.workingon.co/every-developer-needs-a-rubber-duck-and-youre-the-one/

<comment><USER2> great blog post!</comment>


Do You Need To Move To The Valley? - <AUTHOR> http://www.danmartell.com/do-you-really-need-to-move-to-the-valley/ <comment><USER2> I thought this was an awesome article. I saved up money and quit my job last year to move from NY to SF. It never panned out, so I wound up being jobless for 9 months until I found something new. I still want to move out there and this just reinforces it. I'll get out there sooner or later.</comment>


Learn App iOS and Android Marketing And Dominate The App Store Rankings - <AUTHOR> http://www.diygenius.com/learn-app-marketing-and-dominate-the-app-store-rankings/

<comment><USER2> Wow, this is a pretty complete list! Thanks for compiling.</comment>


Ask HN: Hacks for better driving behaviour? - <AUTHOR>

I've been thinking recently that a lot of money is being spent on hi-tech solutions so make driving safer, but we're still quite a few years away from taking the danger out of driving. In the meanwhile, the most failure-prone component is often between the steering wheel and the driver's seat. What are some really simple technology solutions that would drastically improve driver behavior?<p>Here are some that I thought of:<p>- Brake lights that increase in intensity the harder you brake. - Smiley face on dashboard that becomes sad when fuel consumption is high (high fuel consumption generally equates to worse driving). - Boxes that monitor and log your driving pattern using accelerometers and GPS, and which can be viewed by your family online (or be shared with the insurance company voluntarily in return for a score-based premium adjustment). - Music systems that automatically reduce volume or switch to classical music when you speed. - Teaching driving efficiency as part of the driving lessons/testing process in order to ensure that drivers get into habits of economically efficient driving early on - Color-changing paint that highlights to other drivers when you have recently been driving recklessly <comment><USER2> Proportional brake lights: Many already do this.

Fuel Consumption Monitor: Many cars offer something like this (particularly hybrids) and it's almost standard now.

Insurance GPS: Progressive offers this service, called "Snapshot", already.

Music Systems: Neat idea but will detract from sales/create a market for modded stereos that don't do this. Plus, I always crash when I hear classical music. :-)

Teaching Driving Efficiency: Will be hard to demonstrate efficacy; they teach you not to exceed the speed limit and that doesn't work so well.

Polychromatic paint to shame reckless drivers: Interesting, but expensive, and perhaps a bit too arbitrary. Don't know if I should have to drive a yellow car after swerving to avoid a squirrel. And my car's already yellow.

I'll add: A nodding sensor. As people nod off from sleep deprivation, an audible "you are nodding" sound and a speed limiter to 25mph will kick on in 1 minute, prompting an exit/pull-over and a nap.

And perhaps an eye detector, like on a Kinect. If the line of sight between your pupil and the sensor on your dashboard is interrupted for more than 5 consecutive seconds, an alarm goes off. Would make texting while driving less fun.

<comment><USER3> _Fuel Consumption Monitor: Many cars offer something like this (particularly hybrids) and it's almost standard now._

A friends car does this and the sweet spot is 63-64 MPH. Typically you can drive 62 and not get pulled over, but 64 is pushing it. She's been pulled over multiple times and she drives this because she gets the positive feed back that is getting better gas milage. She had gone a long time without getting pulled over before this, because she typically doesn't speed. But now, it's like she is playing a game.

</comment></comment><comment><AUTHOR> Proportional brake lights - nice, I didn't realise there was a name for them. Do you know of any cars that use them? I don't think I've ever seen them.</comment>


Why Zoom Chose Oracle - <AUTHOR> https://interconnected.blog/why-zoom-chose-oracle/ <comment><USER2> I thought Corey Quinn's take was very smart: [https://news.ycombinator.com/item?id=23013960](https://news.ycombinator.com/item?id=23013960).

According to him, the cost of bandwidth is probably the issue, and would make Oracle a compelling choice even if Zoom didn't have negotiating leverage.

Nota bene: it gives me no joy to say good things about Oracle. I hope it will not happen again.

<comment><USER3> Genuine question coming from a lack of understanding of building a many-to- many video chatting app.

Wouldn't you want to send the data peer-to-peer between the users rather than funneling everything through the Zoom server?

You'd get better latency, and you wouldn't have to pay for the network streaming costs...

<comment><USER4> Peer to peer has been dead for more than a decade. Computers are all behind firewall/NAT, they can't connect to one another. Mobiles are behind whatever is the mobile network nowadays, it's outbound only, nothing can connect in.

<comment><USER5> > Peer to peer has been dead for more than a decade.

Source? Some apps like bittorrent have increased in the past decade, have they not?

<comment><USER4> I shall say peer to peer in the context of legit software like video conference, not for downloading movies.

Peer to peer simply doesn't work since NAT. Skype used to be peer to peer but they backpedaled a while ago because this and more reasons that simply made p2p obsolete and broken.

It's too long to cover in one message. Would you be interested if I write a blog post? How peer to peer architecture became obsolete and why no software is using it.

<comment><USER6> If I am understanding the premise:

In a scenario of 12 people video chatting around the world, I don't believe you could guarantee consistent high-speed connections between the involved parties.

<comment><USER7> Making the connection is the hard part. The vast majority of computers and mobile devices basically do not have a routable/public IP address.

Teredo tunneling was one of the coolest solutions to this problem, providing both NAT-busting and IPv6 support but unfortunately it never gained popularity.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Oracle Cloud's outgoing transfer pricing ($0.0085/GB) is absolutely cheaper than top competitors (like Amazon EC2 US $0.05/GB for over 150TB/month). Could it be one of a reason?

<comment><USER9> These are list prices, and absolutely nowhere near the price large consumers pay. If you commit to a certain bandwidth per month for an extended period of time, it's not difficult to get 80%-90% discount.

(I worked at a video delivery startup a few years back and these were exactly the type of discounts we would get)

<comment><USER10> I can't help but think "so what" if they are list prices. That is how we should compare them is by list prices. If AWS, GCP, and others don't want to have their pricing appear to be exorbitant then they should adjust their list prices.

Also what percentage of their total customers are not paying list price? Is it more than 10%, 20%, 30%? I know that me as an individual I will be paying list prices.

And the problem with not comparing list prices is that of course you can have two or more companies getting discounts with the exact same bandwidth who will be paying vastly different rates.

<comment><USER4> Do not compare on list prices for large companies like that. Comparing on list prices is a huge mistake from developers (and young folks new to running a company), because developers hate sales and negotiating and talking to people. Everything above some volume has to be negotiated with suppliers.

In a video company doing 1 000 000 TB of transfer per month, you gotta negotiate with every provider for bandwidth, that's just the way it is.

Just like if you were working for a plane company, you wouldn't be buying fuel from the station down the street.

</comment></comment></comment></comment><comment><USER11> >Based on Ellison's video endorsement of Zoom, Oracle the company appears to be using Zoom wall-to-wall, instead of dog-fooding any internal product under development.

Such endorsement usually precedes acquisition.

<comment><USER12> Would that make Zoom's Oracle fees go up or down?

<comment><USER13> it means soon you won't be able to use Zoom internally unless you have a 32 CPU license and PeopleSoft. /s

<comment><USER14> Only audio will be available in the community license. If you click on the video button, of course it will start the video, but since it is an enterprise feature, you'll get an audit notice and an invoice for a bajillion dollars in the mail. /s

</comment></comment></comment></comment><comment><USER15> Considering that at least Google is a direct competitor, and Amazon is very aggressive at stealing ideas from their partners, I think choosing an alternative like Oracle makes sense simply from a business ecosystem and competition perspective.

<comment><USER16> >Google is a direct competitor

I think that people over estimate potential damages of being your competitors customer. Google is not going anywhere, with or without this contract, and if they want to make an investment in video conferencing, they already have more than enough capital & resources to do that.

Staying away from GCP purely because it is under google would be a crazy decision

<comment><USER17> As of April 29, Google Meet is now free, which is seemingly direct competition to Zoom, especially with the emphasis on security.

[https://blog.google/products/meet/bringing-google-meet-to- mo...](https://blog.google/products/meet/bringing-google-meet-to-more-people)

Opinion my own not Google's.

<comment><USER18> Google Meet is "free" for 60 minutes, which conveniently enough won't be enforced until September.

That's just a shady deal, especially if they end up trying to retire Hangouts chat and so normal users can no longer use free video / voice call services that they've come to rely on having for like 10+ years now.

Don't get me wrong - I love Meet on my business accounts and along with all the other Apps in G Suite, it is well worth paying for. But I also value the fact that normal ass standard Google users have been able to have access to a semi-decent video and voice conferencing platform for over a decade now. I hope that doesn't change come September.

</comment></comment></comment></comment><comment><USER19> Half garbage, half true. I think what the author forgot to say, which is really important is, zoom tested their workload on various paas platforms, and they liked oracle's price performance ratio. Also Oracle is so laser focused on big new logos, like Zoom or Slack. The author is obviously an outsider.

</comment><comment><USER20> Going with Oracle however you want to paint it is not going to end well.

There are hundreds of cases to prove it.

</comment><comment><USER21> Recent, related: [https://news.ycombinator.com/item?id=23010868](https://news.ycombinator.com/item?id=23010868)

</comment><comment><USER22> They already are using AWS and Azure, it's not that they are moving away from that.

</comment><comment><USER23> Zoom probably benefits heavily from access to the lobbyists and lawyers which form oracle's core product offering.

</comment><comment><USER24> The article misses the Amazon competitive problem. Quite a few retail companies will not do business with companies that host on AWS infrastructure (e.g. Walmart).

[https://www.bbc.com/news/technology-40367626](https://www.bbc.com/news/technology-40367626)

<comment><USER25> EDIT: I misread the parent; it refers to retailers not using tools like Zoom because they run on AWS.

Original comment:

You mean like this part of the article?

 _If you deliver a product on top of a third party cloud platform, that cloud can see all the telemetry data. Such access becomes problematic when that same cloud platform offers a competing product, which is why no big retailer would ever run their e-commerce operation on AWS._

<comment><USER26> The parent is referring to a second order issue. Your quote talks about how competing companies don't want to use AWS for their own products because it would reveal traffic numbers and telemetry and Amazon could potentially later release a competing product. Parent is talking about how zoom's customers won't want to use zoom because they don't trust their corporate communications to be trunked over amazon.

<comment><USER25> I reread the comment and you are absolutely correct. I've added an edit.

</comment></comment></comment></comment><comment><USER4> The title should say Oracle cloud, otherwise it reads as the Oracle database.

</comment><comment><USER27> Wow, conspiracies everywhere. Oracle has switched their provider from Cisco WebEx to Zoom and the transition seems to have been very smooth. I don't hear their employees complaining about it, they seem to like it.

I think it is just reciprocal business. It isn't as though zoom will switch Google, Amazon or Microsoft.

</comment><comment><USER28> "The deeper strategic consideration, I think, is Zoom's concern with AWS and Azure accessing its telemetry. "

This is really messed up.

If there is a 'real risk' AWS is reading your data on S3 ... then how on earth does their business survive?

80% of businesses are dealing with sensitive data.

</comment><comment><USER29> Quote: "...more business with the U.S. government is the best "disinfectant" to the FUD around its connection with China."

This cracked me up so hard that I've woken my wife and kids (it's ~3AM for me).

</comment><comment><USER30> I think it's a shame Oracle doesn't offer SPARC instances in their cloud.

Are they still competitive in performance against POWER9?

<comment><USER18> From Wikipedia:

> As of September 2017, the latest commercial high-end SPARC processors are > Fujitsu's SPARC64 XII (introduced in 2017 for its SPARC M12 server) and > Oracle's SPARC M8 introduced in September 2017 for its high-end servers.

>

> On Friday, September 1, 2017, after a round of layoffs that started in > Oracle Labs in November 2016, Oracle terminated SPARC design after the > completion of the M8. Much of the processor core development group in > Austin, Texas, was dismissed, as were the teams in Santa Clara, California, > and Burlington, Massachusetts. SPARC development continues with Fujitsu > returning to the role of leading provider of SPARC servers, with a new CPU > due in the 2020 time frame.

I don't think SPARC machines have been competitive in terms of (price / performance) or even just raw (performance / development time) in a long, long, long time. I imagine most of the market for SPARC machines are legacy customers who are continuing to build and maintain older codebases that have been running for a long time.

\---

POWER9 machines are pretty neat, but IIRC they compete _somewhat_ with contemporary Xeons, which is to say that the difficulty / cost of obtaining said POWER9 system and developing optimized software for it is going to be a good bit higher, because IBM hasn't opened up that ecosystem enough and still prices those machines at remarkably high prices (so there's not a meaningful incentive for anyone to try bridging over to it as a new platform, with the exception of hyperscalers like Google who use it as a constant threat to negotiate prices with the like of Intel etc).

<comment><USER30> In the case of POWER, the scenario where they are clear winners is the scale up one. This is a scenario you usually don't want to be in.

</comment></comment></comment><comment><USER31> Reads like oracle needed discounted licenses in exchange for a presser about adding some infrastructure to oracles cloud

</comment><comment><USER32> Looking forward to the update from Zoom in about 18 months -- "Why we switched from Oracle"

</comment><comment><USER33> This explains so much...

</comment><comment><USER34> it's all downhill from here.

</comment><comment><USER35> Partly because Ellison is a big-time Trump supporter, maybe? A path to avoiding both legitimate and illegitimate/scape-goating inquiries from the administration.

</comment><comment><USER35> Partly because Ellison is a big-time Trump supporter, maybe? A path to avoiding both legitimate and illegitimate/scape-goating federal inquiries</comment>


Unpaid parking violations per diplomat in New York City by country of origin - <AUTHOR> https://ourworldindata.org/grapher/unpaid-parking-violations-per-diplomat <comment><USER2> ... and US diplomats would never do anything like that ... [https://inews.co.uk/inews-lifestyle/cars/foreign- diplomats-d...](https://inews.co.uk/inews-lifestyle/cars/foreign-diplomats- dodge-111m-in-unpaid-traffic-fines-500157)</comment>


China Wrestles with the Toxic Aftermath of Rare Earth Mining - <AUTHOR> https://e360.yale.edu/features/china-wrestles-with-the-toxic-aftermath-of-rare-earth-mining <comment><USER3> I disagree with this:

"Environmental experts and local officials say the cost of the cleanup should not be shouldered by the Chinese government alone, but also by the rare earths industry and the global companies and consumers that benefit from these technologies."

The mining companies should bear the cost, since it was a cost that they simply ignored at the time. If that cost had been factored into their business, prices for their materials would have been higher (and the consumers would have paid).

Instead, like many businesses, they took responsibility for only the costs that they had to. In general, consumers should not shoulder the burden of corporations' bad business practices.

If true costs were considered, there would be far less materialism (and corresponding pollution).

All that said, sometimes everyone has to contribute to right a wrong. However, it's not ok that everyone pay for one party's past wrongs only to see other parties continuing to repeat those wrongs.

<comment><USER4> Yeah, all these experts happen to be Chinese.

</comment></comment><comment><USER5> The eternal problem of externalities. They ought to be priced into the cost of the rare earths, but doing so means you lose out to your less scrupulous competitors.

<comment><USER6> Pricing externalities has become such a common comment.

Does anyone know good examples (family led also, but successful mostly) of pricing externalities?

I mean the alternative is regulation and/or legislation. Those work pretty well when a reasonable (ie production still happens) of harmful processes/methods. Eg banning CFCs in certain products. I know of examples where these were deployed.

Tldr: what is the best, big example of a real, functional price system for "externalities?"

I don't want to jump to conclusions, but it feels like this line of thinking is similar to state "retraining" to deal with unemployment due to economic changes. Very popular rhetorically, but very few encouraging examples.

<comment><USER7> The cost of regulatory compliance is the way to price in externalities. The other option is a lawsuit after the damage is done.

<comment><USER6> That's not quite "pricing."

<comment><USER7> I'm not sure how else one "prices" an externality. Require the company to clean up after itself - that costs money, the company then internalizes that cost into their operating structure and the cost of their products.

</comment></comment></comment></comment></comment><comment><USER8> PSA: There is a disinformation campaign that pushes the narrative that renewables are big users of rare earth minerals. They are not.

The #1 uses of rare earth is chemical catalysts (used for processing fossil fuels) and pollution control (also fossil fuels)

Top uses of rare-earths in the US

Chemical Catalysts 55% Metallurgy & Alloys 15% Ceramics and Glass Making 10% Glass Polishing 10% Other 10%

Source: [http://geology.com/articles/rare-earth- elements/](http://geology.com/articles/rare-earth-elements/) Batteries, solar panels and magnets are in that 'other' category.

</comment><comment><USER9> In the forth quarter of 2018, 46.89 million iPhones were sold worldwide. That's just the iPhones. Wouldn't it be great if products from Apple were easier to repair or upgrade instead of encouraging consumers to buy the latest model? It would also make it easier to recycle. How much mining would that prevent?

<comment><USER10> So what happens to old iPhones? Hard to believe they are all in a dump somewhere.

<comment><USER11> In places like China, where labor is very cheap, they're most likely disassembled into parts, which are then used to repair other iPhones - <USER2> like it happens with Android phones. In places where labor isn't cheap, I can't imagine where else would they go but a landfill.

<comment><USER12> Hand an iPhone in to an Apple Store or some affiliated retailers, or online and they will recycle it for you for free. They built a family of robots to automate disassembling them.

</comment></comment></comment></comment><comment><USER13> Perhaps it's churlish to mention, but...

China was happy to ignore environmental standards in order to corner the market in rare earth minerals. American miners couldn't compete because they were _already_ "internalizing" the environmental costs, and were priced out of the market.

Once China had put everyone else out of business (and blocked foreign businesses from mining inside China), it started not only reducing output to increase prices, but also started to very slowly apply environmental standards it previously ignored.

The Chinese government also showed how willing they were to now use this almost complete monopoly for political purposes in 2010.

And now in 2019 they're calling for consumers and global companies to contribute to the costs of "internalizing" the pollution?

<comment><USER14> Now you realize how the game theory of economics is fundamentally at odds with the natural world and sustainability. It always pays to defect now, and the loudest voices are usually the rich players who moan about economic growth and "burdensome regulations". Mining and logging in the US was very much like this before regulation, but that was on a much smaller scale, with simpler technology and less energy available to scale up. My advice: pay attention closely to environmental policy and don't let regulations be rolled back in the name of growth!

<comment><USER15> The resolution to the economic prisoner's dilemma is religion, which evolved to coordinate the globally shared values needed to defeat a backstab/backstab situation. For example "thou shalt not murder" is win/win.

<comment><USER16> in what world does murdering someone have equivalently inconspicuous externalities as burning fossil fuels?

<comment><USER17> ours

</comment></comment></comment></comment></comment><comment><USER18> Interesting, although I wish more thought is put into the cost model upfront for any kind of mining that harms the environment prior to these excavations. By taking under consideration the cleanup process at the beginning, it eliminates the need to fight for funding after the mining is done. Although in communist countries all the government cares is to rip the benefits and not worry about the after effects.</comment>


How to fund my biotech and big data startup idea? - <AUTHOR>

I think I have a startup idea that lies at the intersection of biotech & big data which could prove quite successful. It is in fact tackling one of PG's frightenly ambitious startup ideas [1]. I have a good proof of concept prototype. However, I'm having a hard time to find any funding opportunities that could help me to go beyond that stage.
I'm a graduate student at Cambridge University, which is one of the hottest biotech hubs in the world so this is a bit disappointing. I don't seem to be alone here, one slightly old WSJ article points in the same direction [2].
My startup would require ~$0.5M to get started, mostly for purchasing expensive machinery, which is a quite modest amount in biotech terms. That's partly because a large part of the startup functions would be machine learning-based, which is thankfully a lot cheaper to run than a wet lab.
We would be tackling a very general problem, so this amount seems even more modest in perspective. Google got funded with $25M back in '99 to get past the prototype stage.
Understandably, places like YC won't go up to that much of initial funding because it doesn't fit their model [3]. On the other hand, biotech VCs seem to prefer investing on drug pipelines. My idea is very IT-based, so they seem to dislike going into that alien route. Therefore, I might be stuck between both worlds.
Any ideas on who should I approach or possible VCs happy to fund this kind of thing? (Email details on my profile if you prefer to reach me that way).
[1] http://paulgraham.com/ambitious.html
[2] http://www.wsj.com/articles/SB10001424052970203961204577267814201399918
[3] http://www.nature.com/news/start-up-investor-bets-on-biotech-1.15096 <comment><USER2> Hi Nextos,

First you'll need to identify VCs that would consider funding you. There are some VCs that exclusively focus on reformulations, others that focus on devices, others that do HealthIT, and some that do new drug discovery.

If you're going to a VC and they don't have a track record of investing in similar technology you're likely outside of their comfort zone and/or investment thesis and they will likely pass.

Second, once you've identified your target firms, find some of their portfolio companies and offer to meet exec at the company. I would explain what you're working on, try to share your vision for why the project you're working on is 'frightenly ambitious' and why you can actually pull it off. If you've done a good job at convincing this exec, I'd followup with a request for an introduction to their VC investor.

Alternatively, (or perhaps in parallel), I would look into getting an intro from a professor at Cambridge! Many professors in biological research have some ties to investors (as consultants) or companies via former students or projects that have gone through their lab. As a current grad student, I imagine such a meeting would be trivial to setup but be prepared to rigorously defend your proposition before they expend their reputation by introducing you.

Whatever you do, don't cold email these VC firms. They get thousands of emails every year and they simply don't have the bandwidth to review them all. Which is why an introduction from a trusted intermediary is so important.

Check out this post for a biotech vc, he has some good tips: [http://lifescivc.com/2013/09/ten-tips-for-raising-startup- ca...](http://lifescivc.com/2013/09/ten-tips-for-raising-startup-capital-in- biotech/)

Good luck

</comment><comment><USER3> You could try Peter Thiel's Breakout Labs: [http://www.breakoutlabs.org/](http://www.breakoutlabs.org/)

This seems a little bit bigger than their usual deal, but maybe they'll be flexible. I would think they would like the interdisciplinary aspect.

</comment><comment><USER4> Must you buy the equipment? Can you beg or borrow time on the machines someone else has at night?

<comment><AUTHOR> That's a very good point. Sadly we need to generate quite a lot of data to get the idea going. This means we would use the machines 24x7 for a long period of time. Long enough that outsourcing data generation would effectively be more costly.

Since those machines are quite expensive, everyone is using them or renting them at full capacity to amortize the investment, so borrowing is not an option.

<comment><USER5> Take this with a grain of salt, as I've never done anything frighteningly ambitious.

One point of advice from the PG article is " _Empirically, the way to do really big things seems to be to start with deceptively small things._ "

And another article [http://paulgraham.com/pinch.html](http://paulgraham.com/pinch.html) which may apply here is that consulting can help generate money temporarily.

So maybe you can get a couple of clients you do consulting for that is enough to cover the cost of equipment. Maybe that consulting directly involves using said equipment, and you can rent it temporarily until you have a critical mass of clients which enables you to buy it. Once you're ready to be profitable with your ultimate vision, wind down the consulting business.

edit: Also HN does invest in businesses that are outside of your typical web 2.0 thingy (they have a nuclear power startup). And the goal of demo day is to get you seed funding that might meet your requirements.

</comment></comment></comment><comment><USER6> [http://www.imperialinnovations.co.uk/](http://www.imperialinnovations.co.uk/) i suspect you are aware of this, but if not...

</comment><comment><USER7> Can you say the equipment that is needed?

</comment><comment><USER8> _Understandably, places like YC won 't go up to that much of initial funding because it doesn't fit their model_

I will suggest you fill out the application anyway, if only for the value of thinking through the questions, even if you do not submit it. You seem to think you have the next billion dollar idea (presumably by that you mean billions in _profit_ ) and yet you seem to have no real business plan other than "get funding." That doesn't sound to me like it is very solidly fleshed out.</comment>


Three constraints that are holding the web back - <AUTHOR> http://www.ugcs.caltech.edu/~dangelo/blog/

<comment><USER2> * Desktop Notifications - This is solved, I wrote one myself[1]

Try using existing Java/Browser technology.

I would suggest this:

Each compatible web page has a signed applet which can also run resident on the remote machine via Webstart. If the server is not listening yet, start it.

If it is listening, send it a message. The Webstart remote applet then displays the message in the GUI.

My server just bound to a range of well known sockets, and the clients tried each one in turn. Try to keep it simple. I just wrote a string with a carriage return to the socket. No XML, no heaviweight protocol.

* Native Widgets - tough to get right

As soon as you start having native widgets, you cross over into having the users preferences honoured. Great for user, hard for site-consistency and support. Joel Spolksy recommends a complex setup[2] , just to get it right.

This may be a little challenging for the average webapp. Admirable but tough.

* Payments

Good suggestions from the article. A bigger problem I see is the large payment processing fees levied by each different payment provider

For instance £0.20 per transaction when payment is via Debit Cards in UK. If you're selling small items, that can be 35% of the price!!

\---

[1] These days I use it to tell me when my ant builds have finished

[2] <http://www.joelonsoftware.com/articles/fog0000000306.html>

</comment><comment><USER3> 1) Chatterous.com (YC W08) now has an API that can reach user's IM clients. That's exciting. I'm watching out for that one.

2) _wince_ I used to design UI for desktop apps. Menu items have been a dead concept for quite some time, and with good reason. They disconnect the user from the task or object at hand. There's no obvious mental mapping between a menu item and what's on the screen. The web is better off without these.

3) Tipjoy.com =)

</comment><comment><USER4> I'd replace item #2 (dropdown menus) with Combo boxes and List Controls. Two items which are very useful in native apps and difficult to get right in HTML.

</comment><comment><USER5> Notifications as a firefox extension:

\- Start a listener in Firefox

\- Get alerts from websites in the bookmarks toolbar

\- Display subtle alert count next to icon in bookmarks toolbar.

No disruption.

Users can control who can send them alerts.

Simply add/remove icons from bookmarks toolbar.

<comment><USER5> This might kill rss readers since I can track an rss feed placing an icon in the bookmarks bar alerting me when new stories are out.

So, mix alerts with rss alerts for a more complete solution.

Here is an average bookmarks bar:

\- Gmail

\- Twitter

\- Facebook

\- HackerNews

\- Google Analytics (spikes in traffic)

\- Paul Graham RSS

You could easily add family alerts, amber alerts, CNN breaking news, security cam alerts, etc

A new wave of web services will emerge like cnn.com/alerts, google/alerts, yourwebsite/alerts

Possibilities are endless...

<comment><USER5> I've always thought that web 3.0 would be a 3-way web and this looks like the right place to start.

The mobile world is ahead of us in this aspect.

</comment></comment></comment><comment><USER6> How nice of you to sort your idealism in order of plausibility:

1\. Desktop Notifications: Terrific idea, and going to take a longass time to happen in a unified way. Already getting implemented via XMPP, perhaps browsers will just end up including an XMPP client where you can add to the roster from the DOM (pending confirmation). If this ends up happening via Twitter instead, there is no hope for this world.

2\. Native Menus: a thoroughly mediocre idea -- for starters your webapps should not have fucking desktop-style menus! Furthermore how would you implement File-Edit-View on a mac? If you really need a dropdown, <select> is right fucking there. The only redeeming native-ui feature I can think of would be the ability to add to the browser's context menu, but that would be ripe for abuse if it was even close to useful enough.

3\. _MICROPAYMENTS_ : The single shittiest idea in the history of the web, and it's never going to fucking go away. Fucklers will continue to tilt at this windmill forever, and will always fail. There is far more terrific content available that I want to peruse than I will ever have time for, _and I'm a guy that spends every waking moment reading_. I'm serious, I often read well over 1M words a week (though I haven't instrumented in over a year), almost exclusively on the web, though in college I got 100+ books a year through ILL. There is just too much out there to be nickel & dimed.

<comment><USER7> We generally go more for the reasoned discussion here then for the swearing.

I agree, micropayments are fundamentally flawed. The reasons have been the same since Clay Shirky said so in 2000: users hate them.

[http://www.openp2p.com/pub/a/p2p/2000/12/19/micropayments.ht...](http://www.openp2p.com/pub/a/p2p/2000/12/19/micropayments.html)

However, I am in favor of absolutely anything that makes it easier for macro- payments to go through. The Apps Store cited is one way to accomplish macropayments with just a click or two, but I am skeptical that that works for the general case.

Honestly I think we're probably going to just get iterative improvements on Paypal at this point -- that is a great leap from the status quo circa 2000 but it leaves me feeling a little annoyed in 2009. There's still a 10x improvement out there... except it would have to decouple e-commerce from credit cards and have instant penetration higher than Paypal. Tough order there.

<comment><USER8> >I am in favor of absolutely anything that makes it easier for macro-payments to go through

Be careful what you wish for. Do you want to have to think before clicking, lest a 3000-word article cost you the day's lunch money? I personally am very glad that there is no good, lightweight, user-friendly architecture for micropayments. I hope it stays that way.</comment></comment></comment>


India's Covid 19 Moment of Truth - <AUTHOR> https://www.mindthismagazine.com/indias-covid-19-moment-of-truth/ <comment><USER2> That was a pretty elaborate "nothing" and unnecessarily political. "The way forward" advises the government to do more than it has ever done before. Well, no shit Sherlock.

</comment><comment><USER3> Indian government went to Supreme Court(SC) to control the news of Covid19 in media(to control fake news, as per government). SC upheld the right to free discussion about COVID-19, even as it directed the media to refer to and publish the official version of the developments in order to avoid inaccuracies and large-scale panic. Aftermath is that the government got a chance to under report the positive cases and deaths and over report the testing capabilities.

source: [https://www.thehindu.com/news/national/coronavirus- supreme-c...](https://www.thehindu.com/news/national/coronavirus-supreme- court-upholds-right-to-discuss-covid-19/article31218565.ece)

<comment><USER4> Given the amount of fake information floating around and the impact it will have in such scary times, it will be better to have control on it. Granted that we must not stop alternative points of view from bubbling up but we have enough and more people generating fake news and muddying the water.

Given the emergency situation it is much better have a greater degree of control. This is similar to the war time (WW-II) control on news agencies. The situation is similar.

</comment></comment><comment><USER5> Archived version:

[https://web.archive.org/web/20200401075505/https://www.mindt...](https://web.archive.org/web/20200401075505/https://www.mindthismagazine.com/indias- covid-19-moment-of-truth/)

</comment><comment><USER6> Why is there no major outbreak in India? One would expect it given the high population density.

<comment><USER7> Because it's 32 degrees in New Delhi, 33 degrees in Mumbai and 36 degrees in Hyderabad.

This doesn't cease all transmission of SARS-CoV-2, it considerably reduces the rate of infections. The virus does not do well in higher temps (ideally with high humidity; which is why it's doing so very poorly in both Hawaii and Singapore, despite entirely different approaches to dealing with the virus). Singapore gets up to 32-33 degrees this time of year and Hawaii is at 25, which is enough.

There is overwhelming evidence at this point that SARS-CoV-2 is slowed by temperatures over ~18 degrees. China and the US have both seen the same thing. Prior studies on influenza indicate that its transmission rate plunges over roughly 17-18 degrees. Which also matches what the MIT study (below) found looking at the infection data for this virus. There are two other recent studies mentioned below, that reach a similar conclusion.

Here's China seeing the same thing:

[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3551767](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3551767)

Here's the US:

"The results: In the most recent analysis, which used data compiled by Johns Hopkins University, two MIT post-docs in the civil engineering and cognitive science departments found that the maximum number of coronavirus transmissions has occurred in regions that had temperatures between 3 and 13 °C during the outbreak. In contrast, countries with mean temperatures above 18 °C have seen fewer than 5% of total cases. This pattern also shows up within the US, where southern states like Texas, Florida, and Arizona have seen a slower growth rate than northern states like Washington, New York, and Colorado. California, which spans north and south, has a growth rate that falls in between."

"Two other preprint papers have drawn similar conclusions. The first, posted on Monday by two researchers from Spain and Finland, found that 95% of positive cases globally have thus far occurred at temperatures between -2 and 10 °C"

[https://www.technologyreview.com/s/615381/coronavirus- spread...](https://www.technologyreview.com/s/615381/coronavirus-spread-could- slow-with-warmer-weather/)

Note: that publish date for the article is from March 19. The predicted results have not only continued to hold well globally, they have unfortunately proven to be a future forecast for what happened in NYC due to its climate.

<comment><USER6> Then why the lockdown if there is no outbreak and it is too hot for the virus to spread?

<comment><USER8> Heat slows it (edit: ?), but exponential growth is still exponential growth. From the article, India's doubling time is currently about 5 days [1]. In 20 days, that means going from 200 cases to 200 * 2⁴ = 3200. In 40 days, 200 * 2⁸ = 51000, and 62 days is enough to pass 1 million. The US has been doubling every 2-3 days, so it will get there faster (probably in spite of the measures being taken). Even Japan and Singapore still seem to be following an exponential curve, just with a doubling time of ~10 days.

[1] See here for many countries (some data a day behind): [https://www.visualcapitalist.com/infection-trajectory- flatte...](https://www.visualcapitalist.com/infection-trajectory-flattening- the-covid19-curve/)

<comment><USER9> Do you have evidence that heat slows contagion of this virus, or is that simply an assumption based on other viral respiratory illnesses? Brazil has ~200 deaths while the average high in Sao Paulo for March is generally around 82F.

<comment><USER10> 82F or 27C would be average to low temp considering South India. Its around 32 now and might increase in coming months.

<comment><USER9> That's a bit of hairsplitting, but I'll follow your line of thinking to explain what I mean.

Saudi Arabia is asking Muslims to defer Hajj due to coronavirus. Today's high in Mecca is estimated 99F (37C).

Today's high in Porto Alegre, a little bit to the south of Sao Paolo in a state with hundreds of cases, is 89F (32C). That's just about the same temperature as you might find today in Kerala.

All three places -- Brazil, Saudi Arabia, India -- get hot.

The point is that there is no evidence of a magic threshold temperature above which we are safe. We can't assume that summer temperatures decrease contagion. I hope it is true that the virus abates in warm weather, but hope isn't a basis for decision-making.

People in squalid Indian slums are exposed to much sickness and death that would be easily eradicated by access to good medical care, sanitation infrastructure, and reliable pharmaceuticals. Child mortality is alarmingly high in these slums. These poor people are vulnerable. It does them a disservice for government administrators to convince themselves that there may be a simple, inexpensive solution in the form of natural weather patterns. It's an insidious thing, this suggestion. On the one hand, it feels hopeful to think that the climate will interfere with contagion. On the other hand, the idea is harmful because it counteracts the fear of outbreak that should be motivating governments to listen to their public health officials and be proactive and aggressive in mitigating the outbreak.

<comment><USER10> I mentioned the temp because you said san palo has high of 27C. 27C is like night time temp in my home town for this season. So yeah its not a high temp. Porto Alegre high seems to be around 29. We have high in terms of 32/34 etc. Ahmedabad has high like 38plus which is very hot even for us southern guys.

I have no idea if temp makes a difference of not. Number of tests are very low to determine that.

And one more thing not all people live in slums in India. India is too big and varied. Visiting Mumbai slums does not mean we are filled with it.

<comment><USER9> Ahmedabad sounds very hot indeed.

Guayaquil in Ecuador is another outbreak zone. 245km south of the Equator, 32C today. Dead bodies rest in the streets for days, people are dying in front of hospitals, morgues are full, and even the mayor has tested positive. The official death count is above 60 but is considered by many to be a fraction of the true toll, since testing capacity is scarce and deaths of the untested do not contribute to the count.

[https://thecitypaperbogota.com/news/the-impossibility-of- bur...](https://thecitypaperbogota.com/news/the-impossibility-of-burial- doubles-the-pain-of-coronavirus-in-guayaquil/24350)

[https://www.sandiegouniontribune.com/en- espanol/noticias/sto...](https://www.sandiegouniontribune.com/en- espanol/noticias/story/2020-04-02/en-guayaquil-ecuador-la-gente-vive-entre- sus-muertos)

I don't think all people live in slums in India. I've never been there. I've been all over Latin America and have seen the good and the bad. The problem with the developing countries here in the Americas isn't poverty; it's disparity. The urban poor are truly destitute, face challenges that never affect the rich, and are locked out of certain strata of economic and political life. Yet, you can walk two blocks down the street from a slum and find yourself in front of a luxury high-rise where life is totally different and residents feel a mix of fear and pity for their less-fortunate neighbors. I imagine that India has a similar combination of extremely developed and extremely destitute areas. My personal view is that the ruling classes tolerate this arrangement when crime can be contained, because slums are a source of cheap labor.

Destitute areas are a risk when it comes to contagion management.

Tens of millions of people live in slums in India, and those places could be a breeding ground among individuals who then carry their illness to work or to hospitals. Annual childhood mortality has been counted in the millions in India's slums, and COVID-19 wouldn't be the only disease making the rounds there. The risk of secondary infection would increase mortality among a population that already lacks good access to health care.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> " Misguidance in the form of suggesting cow urine as a protection against the virus; religiously-oriented obligations that discourage social distancing; and mass disregard and refusal to adhere to rules restricting and in some cases prohibiting altogether cultural gatherings suggest that such behavior escapes the particularity of any one religious, cultural and geographic identity. "

Can the author provide any relevant sources that proves the above fact. If you write a column, you should be able to prove what you said. This hurts sentiments of Hindu's, a religion which consists of majority of Indian population.

<comment><USER11> Author clearly doesn't know what secularism means.

<comment><USER11> Outbreak of a pandemic doesn't give anyone right to spread hatred towards Asians.

The important aspect of the outbreak is not the fact that there is loss of human lives, but most importantly loosing the things that makes us human.

<comment><USER12> Nobody is "spreading hatred". Please stop abusing this term to further your agenda. Thank you.</comment></comment></comment></comment>