A Huge Overnight Increase in a Drug's Price Raises Protests - <AUTHOR> http://www.nytimes.com/2015/09/21/business/a-huge-overnight-increase-in-a-drugs-price-raises-protests.html <comment><USER2> It appears Martin Shkreli has tried this a couple times before.

[http://blogs.sciencemag.org/pipeline/archives/2015/02/20/mor...](http://blogs.sciencemag.org/pipeline/archives/2015/02/20/more_price_hikes_on_obscure_medication)

In the past, he actually planned to limit access to the existing drug (ie. the one he increased the price on) to prevent a competitor from creating a new generic formulation and gaining FDA approval. It appears he modeled this heinous approach on a maneuver by Celgene to prevent production of generic thalidomide.

[http://blogs.sciencemag.org/pipeline/archives/2014/09/11/the...](http://blogs.sciencemag.org/pipeline/archives/2014/09/11/the_most_unconscionable_drug_price_hike_i_have_yet_seen)

It seems to me that the FDA needs sharper teeth in this arena to ensure access to an existing drug is not a limiting factor in the approval of generics.

<comment><USER3> Celgene are currently engaged in shenanigans in the UK.

There are currently two main chemotherapies used for pancreatic cancer in England. First line is folfirinox. But that can have nasty side effects, so the less effective gemcitabine is used because it has less side effects.

Celgene make abraxane. Abraxane (by Celgene's own data) isn't as good as current first treatment; and has many side effects so can't be used as second line treatment.

Celgene's data shows median life extension on abraxane as two months.

A charity - pancreaticcanceraction.org - has started a petition to get NICE to change the decision. The petition states abraxane gives two years extra life which is true for a few people. Equally true would be "abraxane gives two days extra life".

The shenanigans come from the amount of funding and campaigning material Celgene has provided to pancreaticcanceraction.org, while making it seem like they don't have any connection.

[https://www.nice.org.uk/news/press-and-media/the-cost-of- nab...](https://www.nice.org.uk/news/press-and-media/the-cost-of-nab- paclitaxel-is-not-justified-by-its-limited-benefit-says-nice-in-draft- guidance-2)

[https://pancreaticcanceraction.org/news/english-patients- nic...](https://pancreaticcanceraction.org/news/english-patients-nice-decides- fund-abraxane/)

</comment></comment><comment><USER4> My first thought was generics since it's so old, but this is simply amazing:

> With the price now high, other companies could conceivably make generic > copies, since patents have long expired. One factor that could discourage > that option is that Daraprim's distribution is now tightly controlled, > making it harder for generic companies to get the samples they need for the > required testing.

> The switch from drugstores to controlled distribution was made in June by > Impax, not by Turing. Still, controlled distribution was a strategy Mr. > Shkreli talked about at his previous company as a way to thwart generics.

How can this be true?

<comment><USER5> >"This is still one of the smallest pharmaceutical products in the world"

What Turing is doing is exploiting the natural monopoly that has formed for this drug. I was able to find only two global producers of this drug after a quick search (Turing and a generic Alibaba listing), which if true means Turing is the only game in town for a lot of supply channels. In addition, the medical market is relatively unable to adapt to these sorts of market fluctuations due to 1. supply chain being slow to respond (high regulation and insurance) 2. high need of patients themselves and 3. lack of knowledge about the drug and alternatives due to the infrequency of its prescription.

What this adds up to is that Turing can buy up the manufacturing of this drug, jack up the price, and pocket the gains for a year or two while the market adapts. Make no mistake, the market will adapt and undercut him and he will destroy his monopoly by doing this, but he will also achieve perhaps many hundreds of percent ROI on his purchase of the drug. Afterwards he can sell the drug to another company and move on to another vulnerable natural monopoly in the drug space.

>"It really doesn't make sense to get any criticism for this."

It absolutely does, though. If he's able to exploit a pricing inefficiency as a producer, then the press can exploit him by hanging him out to dry in the public eye. Companies can, and should, face public relations campaigns against them for unethical, if legal, behavior.

<comment><USER6> >It absolutely does, though. If he's able to exploit a pricing inefficiency as a producer, then the press can exploit him by hanging him out to dry in the public eye. Companies can, and should, face public relations campaigns against them for unethical, if legal, behavior.

What does bad PR mean for them? Nobody's going to refuse treatment if they would otherwise afford it.

<comment><USER7> I don't know much about monopolies, but, didn't Microsoft get in trouble for creating one? Also, back in the days of trustbusting were there not penalties for such actions? Is it in anyway against the law to do what they did? I can't answer these questions... but what the eye of the press can do is look deep into all of his practices and if there is anything illegal going on it my get noticed far quicker.

<comment><USER8> >didn't Microsoft get in trouble for creating one?

Sort of. Their competitor-plaintiffs are no longer going concerns, and MS are still going relatively strong; so one might argue that the "trouble" was of little consequence. The length of time all of that took to wind its way through the courts means that patients will die waiting for the market/courts to sort itself out.

</comment></comment></comment></comment></comment><comment><USER9> There are people who are evil. I don't care what economic language in which they couch it. They deserve what they get -- and I hope it is coming to them, soon. (This is not a threat, just a strongly held sentiment.)

P.S. I hope that micro-laboratories and production diversification will soon put a final "paid" to such exploitative strategies and tactics. Yeah, the "risk" of a chemistry and biologics lab in every back yard and basement... I'm increasingly of the sentiment that it is less than the increasing risk of autocratic and monopolistic control of centralized production and distribution.

This is a somewhat surprising development in my own attitude, to me. As I recall observing all the bone-headed and sometimes downright risky and uncaring behavior of e.g. chemistry students, including potential majors -- and some of the instructors -- back in college. Part of me is strongly concerned about keeping them from poisoning others and whatever environment they find themselves in.

Nonetheless, as I observe an increasing momentum towards artificial scarcity and profiteering -- often by people with no credit for making or enabling the original discoveries and creations -- I see decentralization as the only effective response.

I, and many others, tried "playing by the rules." Turns out, they've been increasingly rigged, and us, screwed. I'm not the only one deciding, "you have to take care of yourself." Not just in general, but seemingly in every aspect.

<comment><USER10> I think if we depend on people to Be Good when there are big financial incentives not to, we're already screwed. We have to look at why the incentives are bad.

> With the price now high, other companies could conceivably make generic > copies, since patents have long expired. One factor that could discourage > that option is that Daraprim's distribution is now tightly controlled, > making it harder for generic companies to get the samples they need for the > required testing.

This should've been the second paragraph of the article, not buried near the bottom. The author seems to be expecting a system to make legal monopolies behave nicely. Instead we should stop creating legal monopolies.

</comment></comment><comment><USER11> >Doxycycline, an antibiotic, went from $20 a bottle in October 2013 to $1,849 by April 2014, according to the two lawmakers

wft? I'm kind of confused. Wikipedia says "Doxycycline is available as a generic medicine and is not very expensive. The wholesale cost is between 0.01 and 0.04 USD per pill." Why on earth are they paying $1,849 a bottle? Maybe they are only allowed to buy of certain suppliers with FDA licences or some such rather than just buying it from India for a few cents?

edit: I see the " $750 a tablet" "Daraprim, known generically as pyrimethamine" is avilable on AliBaba for "US $1-10 / Kilogram " [http://india.alibaba.com/country/products_india- pyrimethamin...](http://india.alibaba.com/country/products_india- pyrimethamine.html)

Some weird import restrictions going on I guess?

<comment><USER12> The rules for pharmaceutics manufacturing in the western world are very strict.

Any competent university lab could turn up a few Kg of pyrimethamine. You need a GMP compliant FDA-approved facility to make it for medical use.

</comment></comment><comment><USER13> I'm fairly sure this guy has been discussed here before. A year ago or so: [https://web.archive.org/web/20150420142850/http://pipeline.c...](https://web.archive.org/web/20150420142850/http://pipeline.corante.com/archives/2014/09/11/the_most_unconscionable_drug_price_hike_i_have_yet_seen.php)

<comment><USER14> Discussed at [https://news.ycombinator.com/item?id=8302451](https://news.ycombinator.com/item?id=8302451).

<comment><USER15> Feature request: Along those lines, I was trying to find an article (using algolia) which discussed different names for AWS service names confusion and it was useless for that purpose (given search terms I tried). Since I always clear my browser history I couldn't see the links that I had visited.

A nice feature would be if there was a way to note which article links I clicked on or which comment threads I have visited. (If I comment then it's easy to find but I read more than I comment). That way I could just browse back that history and could have easily found that article that I was looking for.

<comment><USER6> You can see which ones you've upvoted at [https://news.ycombinator.com/saved?id=larrys](https://news.ycombinator.com/saved?id=larrys) (only works for you).

<comment><USER15> Thanks for that. But for some reason both that and the save comments seems incomplete. Hard to believe those are all of the stories I upvoted I upvote everything I read typically and upvote (from memory) more comments then "saved comments" indicates. Also "saved" should be "upvoted".

</comment></comment></comment></comment></comment><comment><USER16> This is scary. If the TPP passes, drug pricing will suddenly rise in every country, not just USA.

</comment><comment><USER17> Ok,

I am somewhat ignorant about how the drug system works in america, but theoretically, can one buy the drug where it's cheaper (say, India) via the darknet markets like silkroad or whatever and have it shipped to the US?

<comment><USER18> Yes, but there are two problems:

1) You can't guarantee they are real. The upside of buying drugs in the US is that if you get fake pills, it is a huge deal and people get sued out of business for this. Rite Aid (A national drugstore chain) got caught shorting the pill count in prescriptions and they got into big trouble.

2) The Department of Homeland Security will open packages from companies that they suspect are selling medicines from abroad and shipping to the US and impound the pills. The odds are good that you won't get caught, but if you do, it can become a real hassle.

<comment><USER19> Neither are a problem. Typically, you don't get repeat business if you're selling fake pills, so online sellers of prescription drugs almost always provide you with what you're buying. This applies to both prescription drugs as well as recreational drugs purchased through darknets.

Regarding DHS and CBP, both are overblown concerns. You'll receive a letter in the mail noting they've confiscated the material in question, which you usually send to the seller who will replace the shipment at no charge to you.

<comment><USER20> (Heavy metal or other) contamination of the drugs you receive could be an issue. Who's testing the India-/China-produced drug?

You might receive an Official batch that may or may not be checked by their local governments, but it might also be from a more shady source.

</comment></comment></comment></comment><comment><USER21> >> _"This seems to be all profit driven for somebody," she said, "and I just think it's a very dangerous process."_

Don't worry! It's just capitalism.

</comment><comment><USER6> On this topic, read [http://www.forbes.com/sites/matthewherper/2012/09/05/how-a-4...](http://www.forbes.com/sites/matthewherper/2012/09/05/how-a-440000-drug- is-turning-alexion-into-biotechs-new-innovation-powerhouse/).

</comment><comment> tuna-piano The thing that I think many people are ignoring is the positive effect that high drug prices (& profits) leads to in the economy.

Economic resources such as entrepeneurs, capital, equipment and scientists follow the money. If there's money to be made on Wall street, resources go there. If there's money to be made in mobile apps, resources go there.

As mentioned elsewhere in this thread, the price being so high now shows that the people buying it at that price truly value it that much. When it comes down to it, many people are willing to spend almost anything to stay alive and healthy.

The extremely high prices (and therefore profits) for specific drugs simply leads more resources to go into the development of additional similar money- making and life saving drugs.

It would be a shame if we capped drug prices at some artificially low level, as that lowers the incentive for additional resources to develop additional drugs.

<comment><USER22> No offence to you, but you're so capitalist it's to the detriment of human health and you should be ashamed.

I'm asthmatic, My life can cease in a pretty painful way if I'm denied access to drugs- my illness is an easily preventable one, so why should I die gasping? You're right I'll pay anything to keep living.. I'll literally starve before I stop paying for my medication. But why would you wish that upon me? Because drug companies can have an extra slice of pie?-- forgive me if I'm wrong but isn't private healthcare mostly about making shareholders rich and -not- about significant R&D on preventable diseases (which would then be a tax on the ill for their life).

I come from a country with social healthcare, I grew up the product of a bottle of whiskey and a bad decision, thus, poor.. I'm currently putting _more money_ into my government through taxes than I ever __could have possibly __taken out- but given the draconian practises you seem to favour, I would have died as a child because there is no way my mother could have afforded to buy my medication -and- keep me fed.

<comment><USER14> > you should be ashamed

I know this is an internet convention of sorts, but please don't do it here, even when someone advocates bad policy. HN comments should be free of personal swipes, especially otherwise decent comments like this one.

<comment><USER22> You're quite right, I apologise.

I was rather dumbfounded when I wrote it and I should have taken the time to calm down and proof before submitting.

<comment><USER14> It happens to all of us!

</comment></comment></comment></comment></comment><comment><USER15> While shocking people have to keep in mind that pricing relates to more than cost but more importantly value. The fact that a particular product or service was priced a certain way for years is not as relevant as it might seem on the surface. I pay a very low price for a generic drug (copay doesn't even matter) but the value to me of the drug is much higher. The non generic version is priced perhaps 10 times as much but still provides value at that price. Perhaps these prices in the article are super inflated but my point is the fact that a drug was priced at $5 per tablet and now is $50 per tablet is not a non-starter in itself. Who cares what the % increase is? The question is does the drug provide value at $50 per tablet? Also a particular person's ability to pay doesn't really factor into this. I am sure the drug companies would love to be able to charge some classes of people more (Larry Ellison) and some less (jobless). But they are not allowed to do this. I know people's automatically will think "ripoff" (and maybe it is a "ripoff" whatever that is) however a price increase in itself does not indicate a ripoff.

"Cycloserine, a drug used to treat dangerous multidrug-resistant tuberculosis, was just increased in price to $10,800 for 30 pills from $500 "

Right and I don't take any drugs that even cost $500 for 30 pills (let alone $10,800). So this article could have just easily compared the pills that I buy 30 for $10 to 30 for $500 and written a similar article.

<comment><USER23> No, unless you feel that people who use medicine are nothing more than a resource to be exploited.

Were it not for a (probably illegal in this case) monopoly, other people would be able to make that same pill for $5 per tablet. And then nobody would pay $50 for the pill.

Supply and demand IS NOT the same as "charging everyone as much as they will pay for everything". It's inherently unfair to everyone who has to buy that thing, and that's why people think it's a rip-off, because it is.

[edited to remove some hyperbole]

<comment><USER6> The question is, if it costs me X to make a product, and the value to you is 100X, who captures the 99X spread? I could charge 99X, you would pay it since the value is higher, and I'll capture most of it. I could charge 2X, it's still worth it to me to produce it, and you'll capture most of it. What value here is most fair? Why is one value fairer than another? The standard economic answer is "let the market decide", and that works, up to a point. If you reject that, you need a better way to decide. Let's say you have a government agency set prices: how do they choose?

You've just pushed the problem around. Saying "get rid of the free market" in only a solution if you have a concrete alternative.

<comment><USER24> The thing is, the value for these products is infinite. If people don't have them, they'll die.

<comment><USER6> The value of a human life is not infinite, at least not in health budgets. Insurance companies set a non-infinite value to decide what procedures to cover.

In theory, you could calculate the exact value provided by this drug (under the QALY model).

<comment><USER25> The value of a human life to the individual who's life it belongs cannot be calculated in economic terms (at least for most people) because it is unbounded, i.e., there is not a price that most people will accept for their life. The economic value of a human life to society can be calculated.

Under your theory a fair method to price life saving drugs doesn't exist. The person getting the drugs will effectively extract infinite value while the company will only extract a finite value.

<comment><USER26> _The value of a human life to the individual who 's life it belongs cannot be calculated in economic terms (at least for most people) because it is unbounded, i.e., there is not a price that most people will accept for their life._

Not really true, I'm afraid. People killing themselves (or allowing others to kill them) to ensure a payout to their families happens with some regularity.

<comment><USER25> 1\. My qualifier "most people" covers that situation, because it is very very rare.

2\. Usually this happens because they place a higher value on their children's life and well being than their own. So even in the case were someone does place a value on their own life, it's only in relation to someone else's life.

The case of 2 is interesting because it shows that of the people who would accept a finite sum for their own life, very few would accept a finite sum for their chidren's life.

Since paying for the child's healthcare is the responsibility of the parent in a free market, we are back to my previous point that their is no fair free market way to price life saving drugs.</comment></comment></comment></comment></comment></comment></comment></comment>


Why Gates is richer than Allen - an Ed Roberts story - <AUTHOR> http://www.cringely.com/2010/04/the-last-ed-roberts-story/

<comment><USER2> I guess the question is - would Allen have made the same decisions had he been in charge of Microsoft? It is very possible he would have made different decisions that would have made his 64% share not worth as much as his eventual 36% share. This is a really interesting bit of history.</comment>


Meet the 15-year-old certified blockchain developer (B9lab) - b9lab-nicole https://blog.b9lab.com/15-year-old-blockchain-developer-b9lab-3d8c318665de <comment><AUTHOR> Love the positivity of this post! Keep it up!</comment>


Ask HN: Next steps after being dropped from a startup? - <AUTHOR>

The story is: two months ago myself and two other friends were approached to help develop, deploy and own what we thought was a pretty cool product, and we were told we would have equal shares in the company.
Today however, the story changed significantly. Suddenly we had no shares in the (yet to be created) company, and the development work was going to be completed by a third party IT company and paid for using a grant that we had helped obtain. One of us was offered a consulting role to manage the IT company, but the need for an in-house coding capability wasn't seen as necessary (…for the entirely IT driven product!). This is in the context of two founders whom we now realise are fairly clueless about IT in general (one hadn't heard of Dropbox), and who seem to believe that hackers and code are a generic commodity.
We feel a bit let down and foolish for believing the hype, but my question is: What do people normally do when deals like this fall through? We're taking this loss as a sunk-cost, but are still keen to produce something great. <comment><USER2> You have just received what is commonly known as "experience".

What do you do with it? Learn from your mistakes (get things in writing and signed beforehand next time, interview/evaluate the people you consider going into busines with, etc.), chalk it up and move on. There is little you can do in this case beyond picking up and starting over at something new.

</comment><comment><USER3> When I enter an arrangement where there is nothing developed I generally have a contract put together in which I get equal ownership of the resulting software, and that that ownership is vested on the same timetable as all other owners. As I look at a pure equity arrangement as me being the technical guy, I am doing all the other guys a huge favor. As a technical person you need to look at these arrangements in that manner. I am not necessarily saying be a jerk about it, but all things tallied you will be taking the most amount of risk on as the developer, as you put the lions share of the work in up front.

Once you start to look at this arrangements as you doing the other guys a favor then arguing your fair position becomes a whole lot easier. The thing to remember is that you can go out and build any idea, you could be working on your own and taking 100% of the equity, model that in your mind in these situations, if you view it as they are not letting you in on their idea (which are worth little), but rather you are, letting them in on your equity by taking their idea over your own, it sets the stage for negotiating, up-front to not get in the situation you experienced.

Unfortunately clueless founders are on the rise again, I have had a recent rash of dealing with them, where these hipsters are going to change the world with a dumb idea and all they need is some of those tech guys to whip it up for them. The good news is that they become easier and easier to spot once you have had one or two dealings with the type. In doing so you start to only loose a week or so instead of spending months of your life on what amounts to nothing.

Finally what I personally do when a deal or start-up I have been working on falls through is I go back to freelancing to built up my reserve to take another swing. It helps me recharge, learn some new things and see what the rest of the industry is doing.

</comment><comment><USER4> Ask your local lawyer but if no compensation ever exchanged hands and paperwork signed, you may well own your IP depending if it's work for hire etc.

If so, you may have an option of licensing said work. However, it may not be worth the time, money and effort. That is something that you will have to decide and possibly chalk it up to a learning experience. But regardless, do not do any more work. Good luck...

</comment><comment><USER5> > _"What do people normally do when deals like this fall through?"_

Look for another deal. Write a proposal.

When one hits. Cash the retainer and start work.

I'm a consultant.

When it comes to forming a business, it's different.

In that case, it's like getting married. Except that you're both in it for the money not just domestic bliss.

If you don't absolutely trust the other person to protect your welfare, don't own a business with them. And if you do trust them, get a contract.

The upside of your experience is that you were not alone, three of you were conned - it's a pattern. My recommendation to the one staying on as a consultant is to require a retainer to be applied to final payment and wait for the check to clear before doing any work.

</comment><comment><USER6> I'd say just move on, its not worth getting into a legal dispute unless you're absolutely certain you can win. You're lucky you only lost two months. Live and learn. Besides, it may be revenge enough just knowing that the company is going to flop as outsourcing IT to another firm rarely works for early stage IT companies - especially if the founders haven't a clue.

PS: not knowing what Dropbox is isn't really a good indicator that they're clueless - though outsourcing the tech in a tech company is.

<comment><AUTHOR> Your PS just made posting this worthwhile, cheers.

</comment></comment><comment><USER7> Check any contracts and paperwork you might have signed. Read them thoroughly and then read them again. Get someone else to read them if you can.

What you are 'told' is rarely what actually happens at a startup, unless you have fully understood, signed contracts.

What is it you want do? Create the same or competing product? Get some compensation / shares / revenge? Or simply move on?

If you only worked on this thing for two months, then it's no great loss is it?</comment>


UK student wins Microsoft Excel World Championship - <AUTHOR> http://www.bbc.co.uk/news/technology-14401766

<comment><USER2> It would be nice if we had some screencasts of the winners at work.

<comment><AUTHOR> Agreed. I'm curious about what kinds of tasks they were asked to perform.</comment></comment>


Ask HN: How to Deal with Agile Card Scope Creep - <AUTHOR> Hello everyone,
I have a coworker that whenever he reviews anyone's merge request, he comments about fixing other things that are related to that MR.
For example, if I pull a card from Trello and it says something like 'Disable selecting future dates in Peferences', after you code it and submit, he will add 'I think you should also fix this for all calendars in the app'
Is that appropriate to require in an Agile environment? I could see how that is being flexible and responding to change, but I lean toward it should be a separate card to include all inputs instead of extending the current card.
I'm new so I was hoping to get y'alls opinions on this. Thanks! <comment><USER2> It seems like the comment would be better as a note for the next Sprint retrospective / planning meeting since it should be a separate card. Under the ticket/card/issue/MR seems non-productive to me but if your coworker seems to do it often, it might be because he doesn't understand or didn't have clear instruction for where comments like that can go.</comment>


How to brick Samsung phones - <AUTHOR> https://medium.com/@fs0c131y/how-to-brick-all-samsung-phones-6aae4389bea <comment><USER2> Presumably letting the battery die and turning it back on will "unbrick" it? If so, I wouldn't call that "bricking"

<comment><USER3> You're right, it is not bricking since the device is still bootable and somewhat usable, just locked as a result of the application running.

Just rebooting the phone won't clear it up, however, it would be a little more complicated than that. The use case this dev is presenting is that they have somehow gotten a user to install this malicious app and approved it for the permissions it requires.

Once it locks the device you don't even need to wait for the battery to die, you can simply hold down the power button and it will power off after a few seconds.

The issue is that the app sets to auto run on boot which means you would have a small window to uninstall the application before it locks the device again.

So if you were lucky enough to have enabled USB debugging prior to installing this app you could run an adb command to uninstall it. If you're technically savvy enough you could load a custom recovery and delete the malicious app from there.

..or, simply, you could just factory reset the device and the malicious app would be erased as part of the profile reset.

</comment></comment><comment><USER4> Remember when we respected the distinction between a device itself, and the manufacturer's tweaked OS installation? Pettridge Farm remembers.

Speaking of bricking Samsung phones, there's a well known bug in the emmc chip of the i9300 that will eventually brick the phone. I'm pretty sure my i9500 fell victim to the same problem.

</comment><comment><USER5> TL;DR - Malicious apps are malicious.</comment>


Why society should pay the true costs of security - <AUTHOR> http://www.guardian.co.uk/technology/2008/oct/02/chemicals.terrorism

<comment><USER2> Part of the true cost of these products is their security risk. That cost should ultimately be paid by those who use the product. Otherwise there is no incentive for people to find better, safer chemicals/means to achieve their goals.

Passing the cost on to 'society' provides no incentive and so leads to a continued inefficient overuse of these resources.

As usual Bruce Schneier demonstrates no understanding of market economics when he says

> There's no free lunch, of course. "We", as in society, still pay for it in > increased prices

It's not 'we as a society' who would pay for it but those people who chose to use those products or their derivatives. The crucial difference is that one option provide incentive to change and the other doesn't.

</comment><comment><USER3> It's a simple argument, but it's interesting if you extend it to securing personal information in the cloud. The amount you pay a company to store your data (incl per-capita ad revenue they make from you) is effectively a cap on the amount they'll spend to secure it.

<comment><USER4> The chemical company's situation is different - the people who care about an attack (nearby people) and the people acting on the reputation (customers) are different, so there is incentive for the nearby people to pay towards their own protection. The attack is rare and unlikely so sympathy is high as long as the company is putting "reasonable" measures in place.

Cloud data theft - the people who care about the attack (customers) are the same people acting on the reputation, so the reputation hit matters more. Such attacks are common and predictable, so sympathy will be lower. People nearby aren't involved so there is no incentive for anyone else to pay to protect your data. Knock on economic effect is spread much more widely over more systems and so is less intense and more difficult to gague, and you'd be taking time off work and using your weekends to sort it out so it would have less impact.

So the cloud company has incentive to spend more on security than you might think, if they judge the reputation boost will help future earnings enough. It may do so where it may not for the chemical company.

</comment></comment><comment><USER5> since when is "there might be a terrorist attack" a legitimate argument for more government regulati....oh, right. I forgot that after being attacked once we all turned into whiny babies. mission accomplished hijackers.

</comment><comment><USER6> i don't get why this is on hn.

and to take the article example, if there is a chemical plant producing critical / dangerous products, it should be taxed by the government accordingly; with the taxes spent on security

<comment><AUTHOR> _"... i don't get why this is on hn. ..."_

Situation awareness.

Vigilance is required in an era of <http://en.wikipedia.org/wiki/Asymmetric_warfare> Schneier is simply highlighting that what appear to be safe, reliable everyday industrial chemicals can in fact be used against civilians. For example check the disruptions of unintentional chemical spills in my own home town, Melbourne ~ <http://www.google.com.au/search?q=melbourne+toxic+chemicals> then consider the effects of intentional use in a large city. With a bit of forethought this can be minimised. While the obvious chemicals like fertilisers (Ammonium Nitrate) are now controlled (you need to apply to purchase large quantities) chemicals manufactured or stored in large concentration are a potential weak spot and should be systematically plugged with minimum security guidelines.</comment></comment>


Crow Intelligence Study Shows Birds Can Solve Puzzles Inspired by Aesop's Fables - <AUTHOR> http://www.huffingtonpost.com/2014/03/31/crow-intelligence-solve-puzzles_n_5062314.html

<comment><USER2> I much enjoyed this old TED talk on the _Intelligence of Crows_ by Joshua Klein: [https://www.youtube.com/watch?v=bXQAgzfwuNQ](https://www.youtube.com/watch?v=bXQAgzfwuNQ)

</comment><comment><USER3> Fascinating! I found that reading Marvin Minsky's The Emotion Machine, explained a lot about how might a brain be built to produce such results. And there is an entire chapter about what scientists in this article are calling analogical machines. Minsky calls them difference networks.

</comment><comment><USER4> "University of Auckland in Australia" Sigh. New Zealand is its own country.</comment>


SeaHash: Explained - <AUTHOR> https://ticki.github.io/blog/seahash-explained/ <comment><USER2> Discussion that came up the other week for those that missed it.

[https://news.ycombinator.com/item?id=13057797](https://news.ycombinator.com/item?id=13057797)

</comment><comment><USER3> > `f : {0,1}^n → {0,1}^n` is a perfect PRF if and only if given a distribution > `d : {0,1}^n → [0,1]`, `f` maps inputs following the distribution `d` to the > uniform distribution.

Is this even possible? If the distribution `d` always returns 0, how can a function make it uniform?

It would be nice, if the article would go into more details on how SeaHash obtains this property, and how it related to collision avoidance.

<comment><USER4> It's not clear what the author means here. This is not a very mathematical article.

(Nit: d is a distribution so it can not always return 0 -- it has to sum to 1. But your point stands.)

<comment><USER5> I believe the point is that you get a uniform distirbution of 1s and 0s after going through the PRF irrespectively of the distribution of 1s and 0s in the input. This is certainly a desirable property for a hash function.

</comment></comment></comment><comment><USER6> ticki and the rest of the crew working on Redox (jackpot51) are really doing some neat stuff. a lot of it is over my head but it is cool to see something being built from the ground up using some new techniques and ideas.

</comment><comment><USER7> Could someone explain what the point is? Is there a use-case for this for "general hashing" and such, where sha256 is _genuinely_ insufficient?

<comment><USER8> A good example is for a bloom filter: using sha256 is much too slow for good filter performance, you want something like siphash or some other non- cryptographic hash.

Here's a good story of the performance benefits of switching from cryptographic to non-crypto hashes: [https://github.com/bitly/dablooms/pull/19](https://github.com/bitly/dablooms/pull/19)

(But I don't recommend you use murmur anymore: [https://emboss.github.io/blog/2012/12/14/breaking-murmur- has...](https://emboss.github.io/blog/2012/12/14/breaking-murmur-hash- flooding-dos-reloaded/) (although tbh I could be wrong on this one, not an expert))

(Shameless plug for my bloom filter tutorial [https://llimllib.github.io/bloomfilter- tutorial/](https://llimllib.github.io/bloomfilter-tutorial/) )

<comment><USER9> > But I don't recommend you use murmur anymore

I think xxHash was/is the fastest good non-crypto hash, and now SeaHash may be best. Although I'd like to see a bit more data on that (small keys? large keys? benchmarking methodology) than SeaHash's author is providing.

<comment><USER8> yeah I should look into that more. aapleby seems to have given some pretty good arguments against SeaHash in the previous discussion: [https://news.ycombinator.com/item?id=13058652](https://news.ycombinator.com/item?id=13058652)

<comment> Null-Set That argument depends on the initial values being the same, you can easily make sure they are not.

</comment></comment></comment></comment></comment><comment><USER10> > SeaHash has mathematically provable statistical guarantees

I'm all for proofs but would love to see an empirical head-to-head against metroHash. Is it as good or better output distribution?

<comment><USER11> Should be easy to plug it into smhasher.

<comment><USER12> According to the author, it passes.

</comment></comment></comment><comment><USER13> > there is a major difference between cryptographic and non-cryptographic hash > functions. SeaHash is not cryptographic

Is this in reference to most used hash functions not leaving any way to trace the contents of what was hashed, or not being able to reliably reconstruct contents to generate a certain hash? Or something else entirely?

<comment><USER14> The latter. Even a very simple hash algorithm will almost always make it impossible to get the original contents back. You'd have to write an intentionally pathological algorithm to achieve that.

<comment><USER15> Well, yeah, unless the input is smaller than the digest, hashing is effectively a very lossy compression!

</comment></comment></comment><comment><USER16> I've been using blake2(b) for file hashing in some content addressable db stuff. What might be a scenario where i would choose Seahash over Blake2?

My main concern was speed and assurance that i would not see collisions. Beyond that, i am clearly naive on the subject.

<comment><USER17> The main question, aside from performance, is...

\- Is there an (abstract) attack model? (Assuming that you have one if you ought to)

\- Then: Can an attacker insert collisions into the DB, and is that problematic?

\- Then: A non-cryptographic hash might be much easier to "reverse", especially for short inputs. Is that problematic?

If none of these are problematic you probably don't need a cryptographic hash.

Regarding performance: BLAKE2b on a Haswell gives you, in a "naive", pure C implementation (compiled to pure, non-vectorized AMD64 assembly), about 230 MB/s / GHz. (Referring to [https://github.com/borgbackup/borg/issues/45#issuecomment-22...](https://github.com/borgbackup/borg/issues/45#issuecomment-221234832) ), ie. something like 850-1000 MB/s on a desktop SKU. There are implementations that are around 10-30 % faster than that.

AFAIK all these newer n-c hash functions that popped up in the last couple years perform (on desktop SKUs) in the area of beyond ~10 GB/s.

<comment><USER18> [https://github.com/ticki/tfs/issues/5#issuecomment-266031657](https://github.com/ticki/tfs/issues/5#issuecomment-266031657)

<comment><USER19> SeaHash is obviously not cryptographic (nor is SipHash), but I hope it is a secure PRF (i.e. the keys cannot be extracted), and this was the best attack I was able to construct. Still, it isn't a practical attack, but I suppose it is possible to improve.

Note that I am not a cryptographer, and my only piece of advice is: For the sake of god, don't use hash functions not designed for cryptographic security, if you need cryptographic security. It's that simple.

<comment><USER20> SipHash is a cryptographic hash with a pretty good pedigree. The distinction between SipHash and Blake2 is more subtle than "cryptographic vs not".

<comment><USER19> No, it's not a cryptographic hash function. It's a MAC function.

The paper clearly states that it is not collision resistant.

<comment><USER21> I believe that you and tptacek may be using differing definitions of "cryptographic", because he tends to knows what he's talking about when it comes to cryptography (e.g. [https://gist.github.com/tqbf/be58d2d39690c3b366ad](https://gist.github.com/tqbf/be58d2d39690c3b366ad)).

<comment><USER19> Oh, well.

What I think of as "cryptographic hash function" is a function resistent to pre-image attack, second pre-image attack, and collision generation.

Neither of those are satisfied by SipHash, and can thus not classify as a cryptographic hash function by the normal definition.

<comment><USER20> It's a cryptographic hash function, but not one suitable for all of the same applications as SHA2. It has security characteristics that other hash-table hashes (for instance) lack.

<comment><USER19> If you know the key, it is as weak as it gets (as the paper notes too, you can construct collisions easily if the key is known), so I disagree.

<comment><USER20> Honestly, I really don't care about this debate, except to the extent that it's about whether SipHash "isn't cryptographic and therefore you might as well use CityHash or SeaHash", which just isn't true.

<comment><USER19> I agree. SipHash is certainly strong if you don't know the key.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Previous discussion: [https://news.ycombinator.com/item?id=13057797](https://news.ycombinator.com/item?id=13057797)

</comment><comment><USER22> How does this compare to murmurhash3?

<comment><USER23> Seahash is about 3x faster then murmur3

[https://docs.rs/seahash/3.0.3/seahash/](https://docs.rs/seahash/3.0.3/seahash/)</comment></comment>


48% of U.S. adults say climate change is due to human activity - <AUTHOR> http://www.pewinternet.org/2016/10/04/public-views-on-climate-change-and-climate-scientists <comment><USER2> These kinds of surveys are worthless. Who cares what the 99.999% of laypersons think about anything?</comment>