Ask HN: What do you do if some other startup got funding for your exact idea? - <AUTHOR> We were working on an idea on the side. We also have an MVP. But the exact same idea got funding today from A list investors. I agree there are at least 2 sets of people working on same ideas but shall we keep going ? <comment><USER2> I'd say that it sounds like a bunch of A-list investors just co-signed and approved your business plan. That'd be a clear signal to me to keep pushing and turn the heat up! It's just validation; that other company isn't eating your lunch yet. Unless you let them!

To put it another way: If you had zero well-funded competitors, you might have to second-guess moving forward. This is the opposite; this is a great thing. You just have to focus on becoming the Google to their Lycos.

<comment><USER3> Offtopic: Positive responses like this are why I come to HN. Excellent response to OP.

</comment></comment><comment><USER4> I once listened to a talk from Alexis Ohanian about the founding of Reddit. He tells a story about how they found out there was this big new site called digg doing exactly the same thing their smaller site Reddit was doing.

They said cool, and kept on working.

</comment><comment><USER5> I was listening to a podcast the other day where the presenter asked their listeners if anyone _hadn 't_ heard of the ridiculously successful _Serial_ podcast - he was bombarded with responses!

Unless you're Microsoft or Google, there are _always_ audiences in your niche who _haven 't even heard of the other guys_. I encounter this all the time in my own business.

So unless your business was something specific like creating a scheduling system for vetinary surgeons based in Utah, you've just had your business idea partially validated and you still have a huge audience _who are not yet your customers._ Be agile, outinnovate your competition, and use all the advantages you have. There's room for both of you.

</comment><comment><USER6> Definitely keep going, even if they seem better than you. Sometimes a VC track startup implodes fast while the turtle gets the prize. Things change quite a bit over time, in my experience.

What you have gained is free market research. Since they have funding, they are going to be fairly public about how they progress. Look at what they do, consider why they did it and weigh the responses. DON'T shy away from things that they are doing - if they had a great idea you didn't think of, TAKE IT. If they have the same idea, don't change it, look at their results and see if it can be improved. Otherwise, keep it the same.

You have the advantage of being reactive. Let them spend money and effort validating, you can focus more on executing.

</comment><comment><USER7> What does "same idea" mean?

\- Same problem being solved

\- Same solution to the problem being solved

\- Same solution to the problem with exactly same target audience and brand positioning

etc..

I hope you see what I'm getting at.

You need to look at your target customers and see if they are going to disappear - if no, then just keep working on the idea, and serve your customers well. If the space is such that the customers will use both products great. If you feel they are targeting the same segment and have already started eating your customers (and you can't offer anything to them that will take them away from that product), cut your losses and pivot - see whether you can solve the same problem differently, more elegantly, or identify a different target audience (for e.g. move from consumer market to Enterprise, or target different geographies).

Think about it as a business - wanting to survive. Don't compete for competitions sake - try to contribute the best you can. If someone else is doing a much better job than you at something, take a step back and see whether you can outdo them or it's easier to do something slightly differently.

</comment><comment><USER8> Before Google there was Altavista.

Before WhatsApp there was ICQ.

Before Facebook there was MySpace.

First isn't always that important. Whatever your current vision is ... it's likely to evolve in ways your competitor may view differently. It's rarely about the original idea, but often way more about how you execute, and how your idea evolves over the long-term.

<comment><USER9> _Before WhatsApp there was ICQ._

Pretty sure there were a few other IM platforms in that 15 year or so gap :-)

</comment></comment><comment><USER10> I've had this happen twice with ideas I was actively pursuing. Both turned into YC companies, both successful, the latter meteorically so.

How you should respond often is dependent on the situation. The hard part is that the only person who is truly acquainted with the relevant facts is you (and your co-founder, if you are so fortunate).

The first time, I was blindsided by the launch of a startup I should have known existed. Despite doing tons of market research, it somehow flew under my radar, and the result was that I ended up wasting months of my time.

In that case, deciding not to play catch up to a company with more traction, funding and resources than I had, in a space with very little room for differentiation, was probably the right call to make. It burned, but in hindsight the decision to move on was almost certainly for the better.

Using that experience as a catalyst for the idea that followed, the second time there would be no blindsiding. Instead, I became aware of the other startup almost as soon as it came into existence. While not a threat initially, I watched over the course of a year as it became more and more similar to what I was working on, gaining incredible amounts of traction along the way. It felt like my product was dying in slow motion before even being born.

The only difference this time, was the particular space allowed for quite a bit of differentiation. While that's a good thing, it also makes the questions you have to ask yourself that much harder.

After agonizing for quite some time, I came to realize most of my fears were irrational. Internalizing what it truly meant to have a _second mover advantage_ helped tremendously on this front.

Now I think in terms of celebrating their success, and building off of it every way I can (in an ethical manner). The more successful they are, the more successful my product will be.

For anyone in a similar situation: chin up, don't torture yourself, and try to build off of it in a positive way. It might have been that you were only in competition with yourself.

</comment><comment><USER11> Depends on your idea and your plan of execution, I'd say.

If your idea is to build a social network or similar community thingy where value is directly proportional to how many people use it and your monetizing strategy is to get big enough to make money off of advertising, then you should pivot your idea.

On the other hand, if your idea is to provide a service or product that has value even if only 1 person ever use it (e.g. you file out people's tax forms with 1 click of a button, you host adult fetish videos, you write funny stories, you make ridiculous little wooden figurines of LoL / Dota characters, you make low-calorie edible women's undergarments for men, etc.), then you should keep at it.

</comment><comment><USER12> "If you give me an amazing idea, maybe I'll give you a dollar for it".

Good ideas are ubiquitous and are neither necessary nor sufficient for building a successful company.

They have spent the last few months raising money, not building a product. They will likely end up doing this again.

They now have a different incentives than you. Their investors will encourage them to sacrifice short term growth for potential explosive growth (likely to the detriment of the company).

</comment><comment><USER13> Yes, your idea is validated, like everyone said. So that's good. But there's more...

Make sure your version of the idea is differentiated in a way that's not too easy to reproduce.

You make a good version of your idea => they have more money => they clone what you've done and market it more effectively => not a winner for you.

"Do it better than them" is the right idea, but they should be thinking the same about you.

</comment><comment><USER14> That's exactly what happened to me and I almost lost my house in bankruptcy going to the limit trying to compete. Ignore the advice that your market is validated - your market is gone is more the reality.

Cut your losses and move on. Seriously, there are plenty of other untapped markets to try out, don't burn your bank accounts needlessly like I did. I lost all my savings, my 401k and almost my house.

<comment><USER15> Don't want to rub it in, but I thought the rule #1 of modern start up is to never bet your own money.

<comment><USER14> A good rule for sure but also an easy rule to ignore because we always think we are the exception, surely I will turn the corner on this business, I've sunk a year+ into the code...

It's a lot harder to walk away than you might imagine.

<comment><USER11> Out of curiosity, what was your idea and why did it fail? Pls share your wisdom.

</comment></comment></comment></comment><comment><USER16> As long as you don't see any hurdles/impediments (i.e. legal, copyright, patents, etc) on your idea, then by all means keep pursuing it. Otherwise, it may make more sense to move on to the executing on your next idea.

I'd also like to point out that keeping pursuit of your idea, you should ensure that what you are offering would be at par or greater than the one which got recently funded.

<comment><AUTHOR> thanks for your answer. We do not infringe any IPs neither do they. My concern is more about competing with someone funded while trying to bootstrap or pre- funded.

<comment><USER17> If you've found a meaningful product category, you're going to spend a lot of your existence competing with very well funded companies. Some will be well funded startups, some might be massive corporations that can leverage vast assets and an existing customer base. There is no escaping competition. You have to build a better product; you have to treat your customers better; you have to be more nimble than the big guy, move faster, execute better, provide better attention to your customers due to your size.

</comment></comment></comment><comment><USER18> Going anonymous for that one...

I am in a similar situation. I am trying to bootstrap my startup, and someone who has exactly the same idea got some funding - I don't know how much, I would guess between $500k and 1M.

I spoke to the guy about two months before he got his funding, to see if we could work together, and at the end I chose not to because it was clear to me that he had no clue on how to build the product we both had in mind.

How did I react to the news of his funding? I personally took it well. I am not too worried about competition given the size of our market, so it validates my idea. And if things don't go well with my unfunded startup, I will probably be able to get a job for him, so it becomes an insurance for me.

So, unless your product is in a very small niche, you shouldn't worry about that. I don't recall his exact essay, but Paul Graham said that what kills startups is not competition, but rather the lack dynamism to try and try new ideas.

best of luck!

</comment><comment><USER19> It depends on your market. Some ideas are winner take all (e.g., Google, Facebook, Linkedin, Youtube) while other ideas can have multiple major market players (e.g., Uber, Lyft, etc.). Depending upon your market, you may or may not have to worry.

In my opinion, the best way to a successful start-up is to ensure that your own economics works (cost of customer acquisition + cost of serving customer < life time value of the customer). If your company can be profitable, it really doesn't matter what your 'competitors' are doing. In fact, focusing too much on your competitors can be a very bad thing.

If you idea falls into the camp of winner takes all, then you will need to raise money to capture the market.

In reality, very few start-ups fall into winner take all and the fact that there is funding in this space is a good thing. You don't ever want to work on an idea that cannot be validated in the market.

</comment><comment><USER20> First of all will agree with whatever has been said so far, that this is a sort of validation that the idea is not totally bonkers. However the validation at the moment is from investors, not customers - which is much more important.

Also, you benefit from the second mover advantage in the sense that you get to learn from them and also benefit from the market they create and improve upon it.

However, one thing to note.. you said you're working on it "on the side", while the other company just got some funding which not only implies that now they have money but also that they were most likely already doing this fulltime. So, if anything, you need to make a serious decision right now - whether you want to drop it or pick it up fulltime. Most likely keeping on doing it on the side is not going to cut it anymore since the race is now on..

</comment><comment><USER21> It depends why you want to start a company. If it's because "this product needs to exist", you may have lost your motivation. If it's because "this product is inevitable, and I believe I can do a better job than other people", then keep at it.

<comment><AUTHOR> thanks !! this is a very valid point. We started with "this product needs to exists" though. I will probably post a comparison of ours to theirs on HN.

</comment></comment><comment><USER22> On the plus side, think of it as a type of market validation. A bunch of investors think your idea is solid.

On the minus side, try to avoid focusing too much on competing and not enough on listening to the market directly and reasoning from first principles. It's good to watch this competitor and learn from them, paying particular attention to their weaknesses. But it's not good to fixate on them and direct your attention to trying to "beat" the other guy instead of giving the market what it wants. The market is your customer, not your competitor. It's also good to try to do things a little bit differently so your product doesn't end up being a mere imitation -- if you do that, you'll probably lose.

</comment><comment><USER23> The only people you should worry about are your customers who don't know you exist, don't know someone else had a similar idea, and don't care that a small group of people who are generally appalling at picking good companies chose that one.

</comment><comment><USER9> Validation is cool. But there's a couple of questions you have to ask yourself:

1) Do I need to go from an "idea on the side" to full-time? Pretty sure the funded company has multiple full-time folks.

2) Is it possible to function without funding? This totally depends on your business. If it's a SaaS app that can be funded by customer payments, you're probably ok. If it's a consumer app that relies on network effect (marketing spend), you may have issues.

</comment><comment><USER24> There's a bunch of VCs who will invest in a space, once another firm has made the initial investment in a different startup. The bandwagon effect is real. Your mission (should you choose to accept it) is to contact those other VCs, get funding, and ship a customer-pleasing product faster than the other guys.

</comment><comment><USER25> Cool, validation. But what type of validation? Market, team and/or product, etc? Seems there's more to their offering than market and ideas. I'd be looking deeper into why they are validated. Then I'd step on the gas pedal.

</comment><comment><USER26> A list investors mostly fund companies that go bust by pushing to go big. They grow massive or fail or become irrelevant. Odds are you and the people you know use Facebook more than Myspace.

</comment><comment><USER27> Go out, go watch a movie or have dinner or hang out with friends or whatever. Get some sleep. Then wake up tomorrow and keep doing what you were doing anyway ... and do it better than them.

</comment><comment><USER28> Thank them for market validation and get stuck into it. Lots of people have ideas and then produce MVP's. But execution and level of funding will determine who survives.

It's not a zero sum game.

</comment><comment><USER29> It's not the idea itself, but the execution. Do you think Facebook was the first social network? Or Google the first search engine? Or Reddit the first social news site?

</comment><comment><USER30> It's not even validation. A huge majority of funded companies fail. Just go about your business. Investors, even A+ ones != paying customers.

</comment><comment><USER31> Ship it. The idea is now valid and you can learn from their mistakes.

</comment><comment><USER32> Think of Paypal and X.com -- how'd that work out?

</comment><comment><USER33> think of competition as market validation.

</comment><comment><USER34> They've validated your space. Learn from their mistakes. Hijack their customer feedback. Do it better than them. Think of ways to partner with them. Keep your enemies closer. Make it simpler than they do for the consumer or enterprise. Yahoo, Excite, AllTheWeb, HotBot, Lycos etc were all search engines before Google. Compuserve, Geocities, TheGlobe, Friendster and MySpace were all essentially social networks before Facebook.

</comment><comment><USER35> This is why you want to get patents before spending time and money.

<comment><USER36> Problem is, you have to spend time and money to get patents.</comment></comment>


Gone in Six Characters: Short URLs Considered Harmful for Cloud Services - <AUTHOR> https://freedom-to-tinker.com/blog/vitaly/gone-in-six-characters-short-urls-considered-harmful-for-cloud-services/ <comment><USER3> Also notice the different attitudes of affected services:

\- OneDrive "[...] reiterated that the issues we discovered do not qualify as a security vulnerability"

\- Google Maps "[...] responded immediately. All newly generated goo.gl/maps URLs have 11- or 12-character tokens, and Google deployed defenses to limit the scanning of the existing URLs."

Well done, Microsoft!

<comment><USER4> The fact that anyone considers a shortened URL as a means to secure a piece of data outside of authentication saddens me. I think that should be the key point here. Did you just get a URL that gives you a bit of data without the need to authenticate? Then it's not secure.

<comment><USER5> How is a URL with that's not linked anywhere different from a password?

<comment><USER6> It is not. The problem is that short URLs are often only six characters long, so they are just as safe as a six character password (ie. not very safe)

<comment><USER4> Far less safe because you use a password in combination with a userID so to crack someone's account you must have their login name and password. Six characters are six characters, easy.

</comment></comment></comment></comment></comment><comment> d--b This is breathtaking. This article is not only very important for the vulnerability it uncovers, but also it is one of very few articles that shows with very specific examples why breaches of privacy do matter.

Even if you 'don't have anything to hide', you don't want anyone to know that you sent someone the directions to a planned parenthood center. Not because you think it's a bad thing to do, but because the publicity of this information could be harmful to you.

<comment><USER7> I mean, doesn't that count as 'having something to hide'? I think we're in agreement though. As has been rehashed on HN many times, it's a bogus argument.

<comment><USER8> That's probably quite technically correct, although I think the wording "hide" implies you've done something wrong.

"If you've got nothing to protect..." definitely has a different feeling to it.

<comment><USER7> Absolutely. That's a much fairer phrasing of the 'nothing to hide' argument.

Next time someone presents the 'if you have nothing to hide argument', tell them to send you a video of each of their family members on the toilet.

<comment><USER9> Right! The ole toilet argument seems to win over everybody. I was in the Army for a long time, and right after 9/11 during our pre-mobilization for our first deployment, we mobilized out of Fort Stewart, in Georgia. We were put up in these awful billets from WW2. Just awful. Anyways, the bathrooms only had rows of toilets immediately behind rows of sinks. So if you went to shit in the morning (literally knee-to-knee with the guy shitting next to you), someone's ass was in your face as they brushed their teeth. It was at once one of the most enlightening moments of my life about the cultural concept of privacy that we have these days. We have an expectation of privacy that obviously they did not enjoy in days of yore. And we have _got_ to fight to keep it.

</comment></comment></comment></comment></comment><comment><USER10> Sharing a link with someone via email or chat - a private channel - <USER2> becomes a share in a public channel because of the lack of entropy in the shortened link.

Even more surprising is the number of people on here who don't understand why this is problematic, essentially blaming the victim for not understanding that their private channel is leaking information. It certainly is not obvious to the general public, and wasn't obvious to the people who implemented these services, that a side-effect of a shortener with insufficient entropy is leaking information from private channels.

<comment><USER11> Yup. Even if Google and MS disabled their built-in shorteners or made them not-actually-short, if I send a URL over a Twitter DM, it will get shortened... and I doubt that twitter's url-shortening forwarder will restrict access to the url to sender and recipient.

Fundamentally, long-urls-as-security makes mathematical sense but doesn't actually work with the way the web behaves. URLs are shared constantly, freely.

If we had everybody using the same auth systems so we could do whitelists without "oh you need a google account" or "oh you need an MS account" then whitelists would be a solition, but In Real Life whitelists get in the way so instead people just rip out the security altogether and count on the security of the URL.

Imho, public-with-shared-password would be the right feature to add, even though it's anachronistic.

<comment><USER10> Is it reasonable to expect driving directions to be password protected? That example is used in the article and I think it's an excellent test case for thinking about alternative approaches.

Driving directions by themselves are usually pretty innocuous. When one end is something like an abortion clinic, it gets a bit more sensitive; when the other end is a specific house, even more so. And I don't think you can expect driving directions to ever get password protected.

Some links are like words - merely a reference; some are like sentences - describing some relation or fact; and some are like passwords - describing how to find or access something that you wouldn't otherwise know.

The first are not revealing when out of context; the last are always dubious. It's the middle case, describing a relation (like driving directions) that's most problematic.

<comment><USER11> It would be reasonable to offer the option when you hit the "share" button. I would assume people who care about privacy but are sharing with non-Google people would like the ability to add a shared password to the map.

</comment></comment></comment></comment><comment><USER12> I don't understand the use of URL shorteners for 99% of what people use them for.

Unless you're sending your link over a relatively short fixed-length limited medium like Twitter or SMS, there is no fucking point.

I've seen people post links to download apps, which go from their own site > some random bit.ly/etc URL > dropbox. I'm already seriously doubting if I want to run your app if you can't manage something better than dropbox file sharing, but to then rely on a bit.ly URL that could go fucking anywhere, when you're just putting the link on a webpage is beyond belief.

<comment><USER13> 1) Let's say I am doing a presentation, the computer has internet connection but can't use USB drives, etc. So I would shorten the url (to, e.g., google drive file) and write down the token. Much better than logging into personal account on shared machine.

2) Analytics. I've seen many times different shortened urls used in different locations for the same campaign. I assume that makes it much easier to track your offline marketing channels.

<comment><USER14> Analytics Analytics Analytics. Shortened urls automatically have very decent analytics making it WAY easier than setting up UTM params or other campaign identifies.

Add a "+" to any bitly or goo.gl link and see what I mean. [https://goo.gl/forms/9fA366pQ1f+](https://goo.gl/forms/9fA366pQ1f+)

I use goo.gl to see how many people click a link I share on facebook too.

<comment><USER15> Wow that seems like information that someone might occasionally want to keep private.

<comment><USER14> Yeah I agree. Anytime I see a bitly or goo.gl I check the stats just for fun. I've seen some other shorteners that track other stuff, one even had ip addresses!

</comment></comment></comment></comment></comment><comment><USER16> The ability to traverse the full content of a OneDrive account starting with a short URL and in some cases /upload malware to them/ which gets synced back to the user's computers is shocking. Even more shocking is that Microsoft apparently declared this to be as designed, not a security bug. That's some terrible software design.

<comment><USER17> As a developer who helped out with QA one of the most annoying things was reporting bugs and then getting into a debate about wether or not it was a bug as it was working as designed with the functionality was clearly terrible/broken.

<comment><USER18> It's like pushing rope. Then to really get the party started, throw in some "business analysts" and "scrum masters".

</comment></comment></comment><comment><USER19> If your security depends on someone not walking your DNS zone, you're doing something wrong.

If your security depends on someone not guessing a URL, shortened or not, you're doing something wrong.

<comment><USER20> > If your security depends on someone not guessing a URL, shortened or not, > you're doing something wrong.

Why? Done properly, a secure URL should be as long and contain as much entropy as a strong password.

Are all systems which depend on someone not guessing your strong password wrong? Are practically all encryption schemes wrong?

<comment><USER21> URLs leak in a bunch of ways. Cached in browsers and proxies, sent in referers, sent in toolbar requests, logged in access.log files.

I'm not saying that it's necessarily wrong to use a long URL as security; sometimes the problem constraint means that is the only way to do it. I've done it on rare occasion. But I also made sure that management knew there was a risk here.

<comment><USER22> If that URL is being sent over an HTTPS link (which of course it should be) then the only two points that can log/cache it are the browser at the local end, and the server at the remote end.

The latter is up to server design, the former is an interesting point.

Browsers are unlikely to cache get parameters, but these things might end up in history etc..

<comment><USER15> The "Referer" header can also leak URLs.

</comment></comment></comment></comment></comment><comment><USER23> Scary, but isn't really more like 'using a trivially computable string as a trampoline for live authorisation tokens considered harmful for supposedly secured cloud services'.

Not as catchy, I admit.

</comment><comment><USER24> I think short URLs are great for Twitter, sending people to public URLs, for other services where you're literally _just shortening a public URL_ , if they want to include a tracking / redirect to harvest all your juicy habit information - but I don't think it's a great thing for _private_ URLs.

<comment><USER25> Twitter considers every link, regardless of length, as 23 characters so they're not even that useful there.

<comment><USER26> I think that's precisely because they are always shortened automatically on twitter's side.

</comment></comment></comment><comment><USER27> A long time ago, perhaps 6-7 years, I used an OS X app that took screenshots and put a link on the clipboard. I noticed that it used very short paths and they appeared to be sequential, so in a moment of boredom I made a little PHP script that just gave you next/previous buttons to iterate through them. It was amusing and I considered actually scraping them and then trying to OCR for sensitive information or something out of curiosity, but I never got around to it (pity, I could have scooped this article!).

Well, fast forward about two years, and that script is still sitting around on a forlorn webserver of mine. Somehow, I have no idea why, some random person ended up tweeting a link to it and it spread around a bit until the software vendor got wind of it. They ended up sending me a probably too-polite email asking if I could do something about it, and after a bit of back-and-forth I got instructions from them on how to enable more secure "long URLs" in the software (an option that I think was new since I made it, so I wonder if I may have actually inspired it...) and added those to the bottom of the page.

It's long gone now, and to be honest I can't remember which app was affected. Possibly tinygrab.

The point of this anecdote is that the problem is not at all new, and the problem of how to deal with it isn't new either. I suggested to the developer at the time that they should probably use long URLs by default, but it seems users just like those short URLs too much. Going to non-sequential assignment would have helped, but the space was still just too small.

Really, I think the fix is just communication. Microsoft's workflow used to be sensible in that OneDrive gave you a long URL and then you had to click another button to get a short one. That second click should come with a warning that there should be no sensitive information in the document, and it will potentially become public after shortening. Users will have to be trusted with the judgment, at least you've CYAd.

</comment><comment><USER28> Speaking of short urls, am I the only one that refuses to click on them? I hate that I can't see where the link is going to take me.

<comment><USER14> I've never heard this before. What would be an example of somewhere you don't want to go? I've never clicked a shortened URL and had unexpected results.

<comment><USER28> Most of the time it happens on Twitter. Someone will tweet a bitly link with some enticing headline but I refuse to click it because I don't know where the link is taking me. Perhaps I'm just overly cautious...

</comment></comment></comment><comment><USER29> I pointed this out when I was at Twitter when they were still using the normal short t.co URLs inside DMs. We quickly switch to using very long tokens for those generated URLs. To me it seems completely obvious and I struggle with the developer that stored private information in something so eminently scannable.

</comment><comment><USER30> When you use a URL shortener, you are effectively encrypting the URL and telling someone they have to go to some 3rd party to get the plaintext. Without any checksum to verify that the 3rd party didn't send an incorrect URL, either maliciously or by accident.

</comment><comment><USER31> Well... The article is a little dis-engenuous about the shared folder stuff. If a user selected to share the folders with anyone that has the link and also allows write into the folder publicly from anyone, then that's by design. Obscurity on the url part isn't necessarily required, and it may even be a feature to allow easy dumping.. This is on the end user to make sure they aren't auto-downloading public data that has been dumped there.. I can see why this may not be ideal from a security standpoint, and allowing data mining/unauthenticated file drops may not be a great way to handle it, but I don't think the article actually gives the full details. Unless I'm completely wrong, and there is no options in OneDrive for sharing permissions (public, select group, etc) then yes it's a security vulnerability.

</comment><comment><USER32> "...For Cloud Services" doesn't seem like an appropriate title to me. I would say it's more like "For Cloud Service _Users_ ".

</comment><comment><USER33> This is an article about how people are using url shorteners for the wrong reasons and/or not using security on private data.

<comment><USER34> It shouldn't be easy to misuse a shortener that is built into a service like OneDrive.

<comment><USER33> Until today I had no idea what OneDrive is, so I'll take your word for it. I would suggest that the problem is that access to the OneDrive resource starts and stops at the URL. Conventional security protocols are conventional for a reason.

</comment></comment></comment><comment><USER35> _" After an email exchange that lasted over two months, "Brian" informed us on August 1, 2015, that the ability to share documents via short URLs "appears by design" and "does not currently warrant an MSRC case."_

What is it with these large companies ignoring serious security issues while paying attention to smaller ones? I reported something to Facebook that was a moderate privacy concern and got a bug bounty. A few months later, I discovered that I could make Facebook falsely report the domain that a posted URL goes to, and they denied that it was even a bug. So I could share a URL on mydomain.com, customize the contents of the share posting ("Obama says he's going to nuke Russia"), and Facebook would show users in the post that the link goes to Whitehouse.gov or CNN.com or any other domain I choose. This still works perfectly.

These companies really need to take a look at the analytical abilities of those they are employing to screen bug reports.

<comment><USER36> One also needs to take into account how these larger companies' internal groups function.

"Brian" probably looked into it, knowing that obscurity != security, but got a response back from the group responsible that was the way they intended it to work, and that group's management wasn't going to do anything about it. "Brian" may have even put messages in the right ear up the management chain such that it would actually effect the outcome.

The fact that the email exchange lasted 2 months before "Brian" said "Sorry, not a case." probably means that "Brian" was trying to make it happen and had actually done an analysis.

* Note: I'm NOT Brian. I've never worked for Microsoft.

<comment><USER37> Probably some metric says that if "Bob" gets less than X cases per year he gets a bonus. Problem is "Bob" determines "Frank's" wage and "Frank" is "Brian's" boss. It is probably more complicated than that but that's what it always boils down to.

</comment></comment></comment><comment><USER38> OneDrive _publicly writeable_? Why is that even possible?

</comment><comment><USER39> IMO the author is conflating two separate "issues".

> TL;DR: short URLs produced by bit.ly, goo.gl, and similar services are so > short that they can be scanned by brute force.

This is not the issue for OneDrive. Everyone knew this already, right?

For Google Maps, it's definitely more nuanced. I'm glad Google acted swiftly.

> Our scan discovered a large number of Microsoft OneDrive accounts with > private documents. Many of these accounts are unlocked and allow anyone to > inject malware that will be automatically downloaded to users' devices.

This is the issue for OneDrive. I'm not a OneDrive user, but if the documents are publicly editable per a setting the user controls, this isn't a "vulnerability" either.

<comment><USER40> > if the documents are publicly editable per a setting the user controls, this > isn't a "vulnerability" either.

These services advertise it as "editable by anybody with the link" not "editable by anybody"

There is an implication that people can't get the link without you giving it to them.

</comment></comment><comment><USER41> Honestly this title feels a bit like FUD. Sure restricting the space of possible URLs decreases the difficulty of brute forcing urls, but honestly if you don't want something publicly accessible put it behind a auth wall.

<comment><USER42> Yes, the title does. But let's take a look at the actual content:

 _OneDrive generates short URLs for documents and folders using [..] the same tokens as bit.ly. [..] In our sample scan of 100,000,000 bit.ly URLs with randomly chosen 6-character tokens [..] 19,524 URLs lead to OneDrive /SkyDrive files and folders, most of them live. [..] From the URL to a single shared document ("seed"), one can construct the root URL [from which] it is easy to automatically discover URLs of other shared files and folders in the account_

In other words, the links provided by these shorteners contain authorization information. And:

 _Around 7% of the OneDrive folders discovered in this fashion allow writing._

And in the case of Google Maps:

 _goo.gl /maps URLs used 5-character tokens. Our sample random scan of these URLs yielded 23,965,718 live links, of which 10% were for maps with driving directions. These include directions to and from many sensitive locations: clinics for specific diseases (including cancer and mental diseases), addiction treatment centers, abortion providers, correctional and juvenile detention facilities, payday and car-title lenders, gentlemen's clubs, etc. The endpoints of driving directions often contain enough information (e.g., addresses of single-family residences) to uniquely identify the individuals who requested the directions_

<comment><USER43> Thanks. This was a good summary of the problem.

Do Google et al not have any kind of rate limiting which looks at suspicious behaviour like scanning lots of short URLs?

<comment><USER44> Did you read the article? At the bottom it said that they have both increased the key size to 11 or 12 characters and deployed methods for preventing the brute forcing of these URL's. I think that it's safe to assume that one of these methods is rate limiting.

<comment><USER43> Thanks. I asked specifically about rate limiting as the article didn't specifically mention it.

</comment></comment></comment></comment></comment><comment><USER45> To me, this is like saying Base64 encoding is dangerous; sure, if you think Base64 is encryption and are using it to store passwords, please stop.

Almost all tech can be used in the wrong way, this does not make the tech bad if use correctly.

<comment><USER46> The story is that products as huge as OneDrive and Google Maps use it in terrible ways.

</comment></comment><comment><USER47> Seems like the problem is not with the URL shorteners, but with OneDrive braindead security model. Somehow having a link to one file allows the attacker to see all the user's files? What were they thinking?

</comment><comment><USER48> Instead of trying to make brute force more costly, couldn't these services make it impossible, by forcing the fulfilment of a CAPTCHA when trying to expand/follow a shortened URL?

</comment><comment><USER49> [http://arxiv.org/pdf/1604.02734v1.pdf](http://arxiv.org/pdf/1604.02734v1.pdf)

[http://www.icir.org/vern/papers/monarch- oak11.pdf](http://www.icir.org/vern/papers/monarch-oak11.pdf)

</comment><comment><USER50> I agree this could become a big issue - but I wouldn't consider it a "security vulnerability" per se.

URLs aren't secure, and shouldn't really be considered so.

<comment><USER51> I think it's less about the URL itself and more about the services which automatically generate them for content without the user being fully cognizant of what that implies/means. It has the potential to publicize information without the user's intent or knowledge; in the case of OneDrive from the article, it exposed documents with sensitive information when the URL itself wasn't even shared, it was just brute-forced. Prior to Google's changes to the URL shortening, it sounds like it was possible to get quite a bit of personal identifying information just by guessing at the shortened URL, even if the URL itself was never shared.

Even if URL shortening is a feature that users are aware exists, the consequences of it certainly aren't immediately clear, and to my knowledge, not many of these services include a way to disable the generation of a shortened link or have a means to prevent this type of scanning from happening.

</comment></comment><comment><USER52> This probably can be significantly helped from a UI design perspective. As more and more services auto-shrink links for readability there may not be as much of a compelling need to shorten links. Why in 2016 must we keep displaying everything as "raw text". This is a perfect example of the power of richer displays.

</comment><comment><USER53> As a very late adopter of twitter, I was shock when I first run into shortened URL, not understanding their values and seeing only the risks.

Interestingly, a lot of email client also replace links by their own creating similar risks, but nobody talks about those...

I have to applaud Slack for displaying and linking to links the they were meant to.

</comment><comment><USER54> What's more worrying to me than the enumerating of all short URLs, is the directory traversal when you know one URL. This is someone I know, and have specifically shared one file with, being able to see ALL my other documents. Glad to see that's gone now.

</comment><comment><USER55> My URL shortener makes the user come up with their own short URL so they can decide how long to make it.

[http://oc9.org/<insertYourShortURLHere>](http://oc9.org/<insertYourShortURLHere>)

<comment><USER56> It's possible to create a redirect loop, i.e, a URL that redirects to itself. I don't know if it's something that should happen or not, but Chrome gives me an error after too many redirects.

</comment></comment><comment><USER57> Is anyone else getting the following JSON for all requests to 1drv.ms?

{"error":{"code":"generalException","message":"General Exception While Processing"}}

</comment><comment><USER58> One solution [0]: Password Protected URL Shortener [http://thinfi.com/](http://thinfi.com/)

[0] - at the cost of usability

</comment><comment><USER59> I'd still like to see delete added goo.gl

</comment><comment><USER60> It's hard to believe so many people consider the use of shortened URLs a security measure. It is not, and was never intended to be. A URL is exposed, by definition, whether long or shortened. A shortened URL is a convenience, not a security tool. Some people misuse base64 encoding for "security" as well, but it does not mean we should get rid of base64 encoding.

<comment><USER61> URLs aren't secrets.

<comment><USER62> Why not, if you've tried to keep it secret? They're an incredibly common means of giving out things to a limited set of people without having to explicitly authenticate them. They're used by a lot of mailing lists for e.g. unsubscribe links. If there's enough entropy and they're once-only it's a reasonable approach.

Otherwise you end up with people just sending around "go to this url with this login and password" through email and chat instead, which is slightly harder to automatically exploit but not really more secure.

</comment></comment></comment><comment><USER63> simple script to brute force goog.gl urls for fun. :) [https://gist.github.com/cyc115/f22db26de6a5d723ef6094a97f0ed...](https://gist.github.com/cyc115/f22db26de6a5d723ef6094a97f0edc6d)

</comment><comment><USER64> This vuln probably also exists on imgur

<comment><USER65> Yeah, imgur's predictable too. Go look up "imgur roulette".

<comment><USER39> Well the URLs are predictable...

But I don't think you can find out one's imgur username or more of their photos from just having a link to one of their photos.

I also tested from an arbitrary image in an album, trying to go backwards to find out what album it belongs to, but that doesn't seem possible either.

</comment></comment></comment><comment><USER66> There is nothing inherently wrong with a short URL, provided that supporting infrastructure has proper security.

Even now, if you connect to your favorite "trusted" long domain names, nothing stops that from being totally hijacked by an untrustworthy Internet service provider or other entity that has access (or more insidiously, inserting crap like ads that were not in the original source).

And heck, long URLs are suspicious as well. I'm sure by now everyone has received one of those ridiculous "firstname.lastname@example.com".

The push should be for broader adoption of mechanisms that make it hard to subvert what you download, and easy to verify what will happen when you click a link.

</comment><comment><USER67> This article is more interesting from a UX point of view. It seems that many people think the gibberish-ly looking URL, however short, is nice and safe. That confers a false sense of privacy.

The part about automatically-generated short URLs in MS docs is (was?) worriesome. Few users understand the implication of having a public URL that directly references their document which, in all likelihood, were intended for a restricted audience.

I should point out that Slack has the same bug, though their URLs are simply obfuscated with a longer token. Shameless plug: Cisco Spark[0] has solved that with end-to-end encryption.

[0] [https://support.ciscospark.com/customer/en/portal/articles/1...](https://support.ciscospark.com/customer/en/portal/articles/1339052-how- secure-is-the-cisco-spark-app-?b_id=8722)

</comment><comment><USER11> Sounds like the web-office tools need a "partially public" option. I mean, I want to do whatever, whenever to my private documents, but when I open a document for public editing because my collaborators don't have a google account and so I just share out a long-URL with them, the expectation is that the worst thing that coudl happen is that a malicious actor that finds the URL could mangle the document and I'd have to revert it.

Giving my collaborators enough power to inject executables is far beyond my needs and my intent when I make the doc "open". At worst I'd expect to find a document edited with a link to an external malware exe, not some horrifying autorun problem.

You could also do warnings when the user clicks a link ina publicly editable doc "this document is publicly editable, which means that any rando on the internet might have set this link, not just your buddy who made the doc. Are you really sure you want to go there?"</comment>


Show HN: Hulu With Me (Firefox/Chrome add-on + Node) - <AUTHOR> http://huluwith.me <comment><AUTHOR> More details:

I recently left my job at Mozilla to start a company. Before I do that, I wanted to work on some fun, quicker projects. Hulu With Me lets you watch TV shows in sync with someone else.

A few random notes:

* I wanted this to be frictionless as possible. Click the HuluWithMe button, get a link to send to a friend, and done. Let me know if you have problems or get confused.

* Debugging meant Firefox and Chrome, each running a flash video, each with an extension, and each with Firebug/Inspector open... it's amazing my computer survived. And each time I needed to test something, I had to watch commercials. So, debugging was a bit slow overall.

* This uses node.js + socket.io.

* Sorry non-Americans :(

* If you want to test with yourself on one computer, use Chrome + Firefox (not Firefox twice, etc).

* I couldn't do Netflix for technical reasons, but would love to. If you know someone at Netflix that can help, I'd love an intro!

* Work at Hulu? Say hi!

<comment><USER2> How does it work with ads? For example, if I get a 30s ad and the other person gets a 60s ad, does it still sync up?

I watch shows like this (on hulu, hbo go, netflix) w/ my SO fairly often and one thing I found with hulu is that oftentimes our videos get out of sync due to minor glitches here and there, e.g. we'll sync up after the end of a commercial break, but by the next commercial break we're out of sync by 5+ seconds. Just something to keep in mind...

<comment><AUTHOR> That was the hard part :) I keep track of where everyone is in commercials. If you finish early, the video is paused and it says you're waiting for the other person to finish.

As for glitches: I experimented with a good way to fix this, but settled with just resyncing at every action (pause/play/commercial/etc). It would be annoying to have it keep syncing constantly, and a few seconds due to dropped frames isn't a huge deal.

</comment></comment></comment><comment><USER3> Thanks. I've got a friend who moved across the country. I've been looking for something like this for a long time. Recently we've been using synchtube (<http://www.synchtube.com/>) which works really well. Now if there were only a way to do this with netflix.

</comment><comment><USER4> I just sent this to my girlfriend, who is in China this summer while I'm in California. I'd actually been considering the best way to do something like this, so this will be perfect for us - thanks!

<comment><USER5> But, if she's in China... how is she getting Hulu?

<comment><USER4> Haha... so that's the same thing she just replied to me when I sent her this link. Womp. So much for that idea.

<comment><USER6> Try a VPN :)

</comment></comment></comment></comment><comment><USER7> Wow, this is neat! Hulu should hire you immediately.

This sort of thing gets shown at every Netflix hack day. It's technically very doable; my three-year-old out-of-date memories are that licensing constraints --in which N promised to never, ever allow anyone to "frame" their video or support any sort of live user commentary--prevent it from going into production.

</comment><comment><USER8> This is exactly what I was searching for this morning! Thanks :)

Edit: also, the slanted screenshots above the steps (1, 2, 3) create an uncomfortable optical illusion that the whole page is slanted.

</comment><comment><USER9> I just launched Autobahn, a plugin for banning stories on Hacker News as well as instant profiles with twitter photos. Took me three weeks because I focused on graphics, UI, etc. How long did it take you?

<http://news.ycombinator.com/item?id=4197062>

So happy we weren't working on the same thing. :)

</comment><comment><USER10> I think this idea is great. One idea I had was creating a real time connection between friends watching the same live sports games in different cities ...

That way they can curse each other out or scream in unision and talk about strategy as the game is progressing.

</comment><comment><USER11> Something like this would've been possible through Hangouts if Google bought Hulu, but that didn't happen.

<comment><USER8> I'm pretty sure this is already possible with hangouts? Or you could use SynchTube with or without hangouts.

<comment><AUTHOR> SynchTube doesn't do Hulu, and hangouts wouldn't be able to account for things like pausing or commercials. You could watch and chat, but this add-on makes it so that if one person pauses or skips around, it happens for the other person.

</comment></comment></comment><comment><USER12> I love this idea. I wish this could be expanded to any video on the web. That would be great!

</comment><comment><USER13> Nice work Greg!

</comment><comment><USER14> Is this done by capturing the multimedia stream at the TCP level (with node_pcap)?

<comment><AUTHOR> Hulu phones home every time anything happens, so I use the add-on to watch for new activity and send it to Node. The Node server is actually pretty dumb -- it just adds people to a room, and "broadcasts" any JSON it gets.

<comment><USER15> Well done! I worked on an Android/Node app a few months ago that also uses socket.io to do the same thing (synchronize video playback among a set of users). I was impressed at how well the Node server performed as the number of users grew, especially compared to a blocking TCP socket implementation.

<comment><USER16> Did you use any particular js lib to control the video on the players? Or was that part not js.

I ask this because I was doing a server/video player that syncs up to 20 slave audio players with the media, to allow for multilanguage, and did not find anything specific.

<comment><USER15> The video playback app was on Android devices, so it used the regular Android Java APIs. Still, the chatroom approach that gkoberger describes would work for any platform, as long as each player can play, pause, and seek, and have a separate thread that emits and receives events in the chatroom.

<http://popcornjs.org/> appears to be a library for controlling HTML5 video, if that might work for you.

<comment><USER16> Thanks, I will have a look at popcorn. I was tinkering with jPlayer for a bit but it was a hog on the mobile client devices.</comment></comment></comment></comment></comment></comment>


OrderAhead claiming business listings on Google - <AUTHOR> http://www.geekwire.com/2015/orderahead-restaurant-website-deception-includes-widespread-violations-of-google-terms-of-service/

<comment><USER2> need to be raised to google</comment>


The Heroes of America's Startup Economy Weren't Born in America - <AUTHOR> https://www.inc.com/arnobio-morelix/inc-entrepreneurship-index-2018-q1.html <comment><USER2> That's mostly because most Americans are informally encouraged by their family/friends to "hedge their bets" so to speak, "go to college and get a job".

Startup success is pretty binary, either millionaire or broke. College success is a gradient of like 50-125k per year in income.

Though now with student loan monthly payments approaching a plurality of one's paycheck, college is even less of a hedge than it used to be.</comment>


What Should You Do If You Find a Piece of China's Crashed Space Station? - <AUTHOR> https://www.livescience.com/62112-what-if-you-find-china-space-station-debris.html <comment><USER2> > Presumably, Pearlman said, the space station is carrying all manner of > hazardous materials not safe for human contact, including fuel tanks with > noxious fuel inside.

I buy this argument when it comes to radioactive materials but I never heard Tiangong-1 had a source for them on board. Everything organic (like fuel) should be made harmlessly by the reentry heat. This leaves us with inorganic compounds like asbestos which are dangerous, but still ubiquitous in most parts of the world. So I think this warning is a bit sensationalist.

<comment><USER3> Probably they are worried about hydrazine like product, that have a lot of nitrogen. I'm still not 100% convinced it can survive a crash like this, but I read the same warning before many times, so I'd prefer to be safe.

For example read: [http://www.spacesafetymagazine.com/space-debris/falling- sate...](http://www.spacesafetymagazine.com/space-debris/falling- satellite/atlas-v-centaur-hydrazine-tank-found-in-spain/)</comment></comment>


Show HN: Pilot: Bookkeeping for startups, using humans and software - <AUTHOR> https://pilot.com <comment><AUTHOR> Hi HN!

Pilot is a bookkeeping company that specializes in startup companies. We started it because we really struggled to find a good bookkeeping solution in our previous startups (Ksplice and Zulip).

Amazingly, the state of the world of bookkeeping has largely been unchanged for the past 20 years: you hire a bookkeeper who buys a copy of QuickBooks and does a ton of clicking around and hand-entering to bring everything up-to-date every month.

Which is a little crazy because the underlying data is quite structured (dates, amounts, memos), and 90% of the work is effectively "Execute well- defined rule X on data Y". The first-principles solution to this problem would definitely not be "Hire a person, hope all the rules fit in their head, and make them click a lot"— it would be software.

But our feeling was: people don't want more bookkeeping software—they'd rather not worry about bookkeeping at all. So we started Pilot: a bookkeeping _service_ powered by our expert team of (human) bookkeepers in San Francisco, who, under the hood, use a bunch of software we've written to automate the most tedious, error-prone parts of the work. Every month, we deliver up-to- date accrual basis books for you, in QuickBooks Online.

We're currently doing the books for a bunch of startup companies (ranging from pre-seed all the way to Series B), including 30+ YC companies, but we're just now starting to tell the story more broadly.

We'd love to get your feedback! I'll be around all day watching this thread, or you can just shoot me an email (email@example.com).

<comment><USER2> If you're casting a broad net, speak to the moderators on [https://www.reddit.com/r/msp/](https://www.reddit.com/r/msp/) \- they have a steady supply of early-stage managed service providers asking for msp-aware business logic and money handling.

</comment></comment><comment><USER3> Do you guys have an ability to provide advice about what startups at early stages need to do for book keeping, filings, etc? You seem to be more affordable than competitors for early stages, so you would also deal with less experienced founders who are graduating from TurboTax into something that handles an ever-increasing load, done with dubious thoroughness at start. My biggest challenge is getting proper advice about everything needs to be done and making sure I don't miss something. Provide resources on that, maybe via SEO (YC for bookkeeping and compliance for early stage founders) and you'd have a never ending stream of leads.

<comment><AUTHOR> I definitely like the idea of providing some good, clear writeups about "You have a company--now what?".

There's some care needed—we're a bookkeeping firm, so we can't give accounting/tax/legal advice, but there's a lot we _can_ do to help (and we can always connect you with e.g. a tax prep firm we know and trust for the stuff we can't do ourselves.)

</comment></comment><comment><USER4> This is a brilliant startup idea. Highly needed. Nice to see the "Ksplice Mafia" still at it.</comment>


Forced Exercise's Effects on the Brain - <AUTHOR> http://well.blogs.nytimes.com/2011/10/12/what-parkinsons-teaches-us-about-the-brain/?src=me&ref=general&gwh=E4BF7E8ADDE0D4187FA2C07FE7836D88 <comment><USER2> I'd be interested to see the difference in "forced" versus "high intensity" exercise. What if the animals are forced to run at a much lower pace than they prefer? Do we get the same results?

My guess is that the forced part of this has little to do with the effects. It's the increased intensity that is providing benefits.

<comment><USER3> No kidding. The emphasis on forced made it a little confusing. It seems extremely likely that the "forced" can be internal. When I'm at CrossFit, the criteria of the workout force me to exert much more strenuously than I'm comfortable with.

<comment><USER4> ha, when I read that article all I had in my head was images of me doing death-by burpees and thinking "... I hope there are health benefits to that, because it really hurts..."

<comment><USER5> > death-by burpees

a most unpleasant way to die!

</comment></comment></comment></comment><comment><USER6> I am not an exercise physiologist, however, moving people from an inefficient noodling cadence of 60 rpm to a highly efficient 90 rpm may have played a role in shaping the results.

As any cyclist knows, over the long term, 90 rpm's is far more comfortable than 60 and it is my understanding that 180 strides per minute (i.e. 90 with each foot) is also optimum for distance running.

<comment><USER7> Most amateur runners don't hit close to 180 spm unless they are barefoot runners. The general idea around a shorter stride for amateurs isn't about efficiency, as I understand it, but about injury prevention. Smaller strides means less time flying in the air, less mass displacement, and a softer landing.

edit: that doesn't mean you aren't right about professionals doing it for efficiency reason, I just don't know.

<comment><USER8> The faster cadence is technically less oxygen efficient, but since oxygen is not the limiting factor, that doesn't really matter. The reasons cyclists pedal at a fast cadence is because it uses the aerobic system more heavily than the anaerobic system, and the aerobic system is easy to keep "on" for a long time. You breathe harder, but your legs never hurt.

(I decided to start following this advice a few months ago. A 30 mile ride in 2.5 hours at 75-80rpm used to tire me out. My first 40 mile ride at a high cadence (95 rpm) took the same amount of time but I wasn't even close to being tired. My usual "training rides" of 20 miles take almost no effort unless I make a conscious effort to go anaerobic for a few minutes at a time.)

<comment><USER9> That's a lot more individual than the aggregate study results generally indicate. I'm a cranker, not a spinner, and I used to do 250 miles/week -- that included a "century Sunday" -- with little fatigue (no more than I was looking for, certainly). Most of the folks with me would be turning at about 150% of my rate at any given point. I tried the 90 cadence, and it just didn't work for me; I'd get pooped over a piddling 20-miler, and never really improved in endurance.

<comment><USER8> Yeah. It's important to keep in mind that the pros are pedaling their 100rpm in a 53/11 gear, whereas most of us non-pros are ... not.

</comment></comment></comment></comment></comment><comment><USER10> How are you forced to produce power output on a tandem bicycle? You can force the cadence but what happens if you just relax and let your legs go around with the pedals? I would think you would be producing zero power on your own, not exactly a grueling forced workout, or am I missing something?

<comment><USER11> Read the NYTimes article... you learn that the two sets of pedals are 1:1 connected. Your partner pedals faster and _you_ have to pedal faster. Maybe not _harder_ \- but you do have to keep pace.

<comment><USER12> It says that the power output was higher.

<comment><USER13> Power is work done per unit time. Inducing someone to pedal faster is going to increase their power output, so long as they do not slack.

<comment><USER12> Alviva was wondering why the people on the back were not slacking. MediaBehavior says they were only pedaling faster, not necessarily harder. I'm pointing out that the article clearly says they were pedaling harder.

</comment></comment></comment></comment></comment><comment><USER14> Wankerish speculation: Involuntary exercise may tell the body that it needs to work smarter, not harder. Hence, more brain cells. In prehistoric times, it would be a warning signal that risk of death or is elevated. In a world of few calories, the body must prioritize, and relies on certain signals to set priorities. Voluntary exercise doesn't indicate nearly as much danger.

</comment><comment><USER15> Is it the "forced" part that yields results, or the simple fact that it was more exercise? The article said they were forced to go at a speed faster than what they were comfortable with, yet the rodent study had them forced to go slower than their natural pace, with better results. A follow up study forcing people to go slower than usual would be interesting.

<comment><USER16> I think it matters more if you are cognitively present for the exercise, rather than the intensity of the exercise. It doesn't matter if you go fast or slow, it only matters that you are doing something you're not used to and as a result actively think about it when you are doing it.

For example, writing with your left hand if you are right handed may be an equally effective method of achieving similar cognitive results.

One well worn piece of advice from health fitness trainers has always been to vary up your routine. I think this is the key to making sure you work out different muscle groups, but also a way to keep your mind engaged.

My hunch is that this is partially what's going on in the study.

<comment><USER17> I agree with the basic hypothesis. Though wonder how it can be measured. I know my preferred term is awareness, but neither is it any more measurable. My experience suggests two tasks at a time is a reasonable substitute to make sure you are aware. For ex: counting the steps while running

</comment></comment></comment><comment><USER18> In Parkinson's disease equilibrium is usually very impaired, yet from this article apparently the subjects are still able to ride bicycles. I wonder how big of a confounder that is, or perhaps it's patients in very early stages of the disease, or relatively young. Having an elderly patient risk falling from a bike or a forced-effort threadmill machine doesn't seem to me like a reasonable risk to take. What other forms can this forced exercise take? Swimming, running on sand, these can be taxing but how do you incorporate the "forced" factor in? Parkinson's is an auto-immune disease, so other approaches involve trying to minimize immune responses, via diet. Apparently ketogenic diets have also been used with varying degrees of success.

<comment><USER19> Is the forced part even necessary? It says the people were pushed harder than comfortable. You don't necessarily need someone cracking the whip to do that, especially with that kind of thing hanging over your head.

<comment><USER20> _"You don't necessarily need someone cracking the whip to do that..."_

You'd be surprised. Long-term goals are notoriously bad at motivating most people in the short run (hence, why procrastination is such a powerful force). So, even if you have the specter of something like total physiological degeneration looming over you, you're still going to work only to the brink of your comfort level unless someone pushes you further.

Anecdotal, but: I broke my arm a few years back in a really bad fall. Totally shattered a few of the bones in my right wrist (and I'm right-handed). Got a metal plate put in, and went through a year of physical thereapy. At the outset of the PT, I was told in no uncertain terms that I'd never regain proper movement of my right hand unless I worked my ass off every day at range-of-motion exercises -- which, at the time, were extraordinarily painful. So, in theory, sure, I could do them at home and never actually go in for PT. But whenever I did that, I'd work up to the edge of my comfort level, but never go past it. Conversely, when I went in for PT, having someone there to "crack the whip" pushed me past that discomfort threshold, and that's how I broke through the plateaus on the path to recovery.

The body's (and mind's) natural inclination is to avoid pain and discomfort, so you trick yourself into thinking you're working as hard as you can when you're actually not. And exercise isn't about working as hard as you can; it's about working _harder_ than you can. That's where the progress happens.

<comment><USER21> I suppose the question is over the nature of forced.

I have a rowing machine which gives me a readout of speed/distance/cadence etc.

I 'force' myself to maintain a certain speed for a certain time even when it is quite uncomfortable. Is that sufficient for the 'forced' effect to come into play. I suspect it is.

<comment><USER20> Do you work out to the point of muscle failure? Do you maintain a speed so grueling that you literally can't row at all after a certain point? That's my interpretation of "forced," at least as experienced in my PT. Granted, I don't know what "forced" meant in the context of the study being talked about in this article. Accordngly, I can only guess at it. (No desire to play "No True Scotsman" on this, I assure you.)

<comment><USER19> In the article they said they tested them and if you went around 60 RPM on the bike the forced part was at 90 RPM. So they could measure swim pace then have them train at a higher pace.

</comment></comment></comment></comment></comment></comment><comment><USER22> "In one study from 2008, rats forced to run wound up with significantly more new brain cells after eight weeks than those who ran when they chose, even though the latter animals ran faster. "

This earlier study's conclusion that the forced aspect was more important than pushing the exerciser outside of their comfort zone. It seems like they should experiment with 45rpm forced exercise to see if that has the same effect. Though, it may have been just the article making that logical jump.

</comment><comment><USER23> Can't wait for the first standing-desks-chained-to-a-treadmill to pop up.

<comment><USER24> You don't have to wait: <http://www.trekdesk.com/>

</comment></comment><comment><USER25> I'm curious to find out if what they're trying to isolate is "discipline." I'm not talking about the colloquial definition of discipline but rather exercising the ability to do what's best even if it's not convenient.

I'm talking about the foresight of the intellect over the mind and body. Often times, when we rationalize things or activities just become habits, the mind and body passively agree. I'd argue that's not actually practicing discipline anymore since there's nothing within ourselves (mind & body) to fight.

</comment><comment><USER26> I'm by no means an expert, but from my reading of body hacking and dieting etc, it seems that higher intensity workouts lead to increased cortisol release, a hormone released in response to stress. I'm not sure if this is the hormone they're referencing though, because IIRC extended periods of elevated cortisol levels are associated with Parksinson's/Alzheimers...

<comment><USER27> But the rats got the benefits even though the forced exercise was _lower_ than the intensity they would choose themselves.

<comment><USER28> The abstract says the rats ran the same distance, so the voluntary exercisers spent less time. That could be the important variable.

</comment></comment></comment><comment><USER29> So running on a treadmill going so fast you can barely keep up actually makes you smarter? Great, quit my corporate job for nothing.

</comment><comment><USER30> It's pretty clear that "forced" in the context of the experiment is being physically forced to do more work, not being "forced" like being forced to eat your vegetables.

I think it has something to do with external energy being added, and the subject not having control over the speed.. I don't know if a treadmill really meets this criteria. I think you would have to be physically strapped into the treadmill :P

</comment><comment><USER31> Honestly, this seems like one of those experiments which, in retrospect, provides obvious results. Exercise is a net positive for physical health. Why wouldn't forced exercise provide an additional cognitive/neurological health benefit in addition to the cardio/muscular benefits? I know this is a completely simplistic and unscientific opinion, but it seems to make sense.

<comment><USER32> > obvious in retrospect

I recommend reading the preface to Everything is Obvious:

[http://everythingisobvious.com/wp- content/themes/eio/assets/...](http://everythingisobvious.com/wp- content/themes/eio/assets/EIO_preface.pdf)

<comment><USER17> I would also recommend reading [http://lesswrong.com/lw/7e5/the_cognitive_science_of_rationa...](http://lesswrong.com/lw/7e5/the_cognitive_science_of_rationality/) and perhaps trying out this experiment* [http://lesswrong.com/lw/7z1/antiakrasia_tool_like_stickkcom_...](http://lesswrong.com/lw/7z1/antiakrasia_tool_like_stickkcom_for_data_nerds/#more)

* - Am just starting out with this one. so no clear data yet</comment></comment></comment>


Show HN: Paralyze – a go package that simplifies parallelization - <AUTHOR> https://github.com/i/paralyze <comment><USER2> Impressive: a single letter username.

</comment><comment><USER3> I'm not sure if this warrants a separate library since it's just an interface for `sync.WaitGroup`.

<comment><AUTHOR> Now that timeouts are supported, I think it makes sense. I'm curious if you agree.

<comment><USER3> Yup, but I like contexts even more. Everything is better with contexts ;)</comment></comment></comment>


Ask HN: Why do people blindly trust closed source security software? - <AUTHOR> You see this over and over again. Here's a great example. Google "how to detect a keylogger" and you get advice to install malware bytes and spybot. The huge problem, of course, is that they want you to install MORE possibly compromised software.
VPN software is another big one. "Hey I really need to protect my privacy. So the very first thing I'm going to do is install third party software for a VPN".
If you want browser security you should install x, y, and z extension. etc.
Have you noticed the same thing or do you think I'm looking at this wrong? <comment><USER2> The solution that is most widely used is to hold accountable the guys you trust. Unless you are a security expert and test everything yourself, you WILL have to trust someone. Open source helps, but does not solve the trust issue automatically.</comment>


Is Gut Science Biased? - <AUTHOR> https://fivethirtyeight.com/features/gut-week-global-guts-western-bias/ <comment><USER2> It could even be the case... and bear with me here because this is a _shocking_ idea... it could even by the case that things that are _not_ necessarily reasons to self-flaggelate are involved too. It surely could be that we don't exercise enough and we are all fat flabbly slobs who need to be beaten until we are good little boys and girls, but it could _also_ be that we have legitimate genetic differences and for all we know our Western ancestors from a thousand years ago would also have had a quite different gut biome than the people isolated in Asia. It could be that we eat starchy processed crappy crap and should apologize repeatedly to ourselves until we stop whipping ourselves which we shouldn't ever do, but it could _also_ be that even a healthy Western diet still involves substantially different fruits, vegetables, leafs, meats, etc. from other diets what with being over 10,000 miles away and in radically different ecosystems even when they were totally wild.

Maybe if we want to do real science and not just find exactly and only what we were looking for, as we go into this new domain that is basically entirely unexplored, we should try to do so with open eyes instead of decades-old preconceptions.

Or it could just be that we're bad, bad people and should feel bad.

(Sorry. Well, sorry-ish. This unrelenting stream of "You Suck And Everything About You Is Wrong And We're Going To Mention It At Every Opportunity" in the news is really getting on my nerves after 30+ years of it.)

<comment><USER3> > Or it could just be that we're bad, bad people and should feel bad.

Why is there always a value judgment assumed? Why are you creating a false dichotomy between "it's out of my control" and "I'm a bad person"?

<comment><USER2> If I were the one "creating" this, why would I be "tired" of it? All I'd have to do to stop it would be to just... stop it. But it's not me.

Perhaps you're simply not as sensitized to it as me, since it is becoming rather a raw spot with me. Go back and read the article again, carefully. Note how all the explanations of difference are assumed to be essentially moral failings of westerners, to eat "properly" [1] or exercise. Note the ingrained assumption that if there's a difference between the isolated primitive and the Westerner, the Westerner is automatically in the wrong, be it in behaviors or gut biomes, which they actually have to remind themselves may not be true, though they don't actually come up with any other possible explanations.

Mind you, I don't disagree that there are dietary issues in the Western diet or that there are exercise issues, but it's still _bad science_ to presume in advance those are the only explanations to be considered, be it explicitly assumed or implicitly assumed. There's a world of variables out there and we've barely _begun_ to shine a light.

[1]: Can't resist scare quoting since a lot of the people telling us what is "proper" in the past 40-50 years have also been _dead wrong_ and quite possibly the dominant reason we're eating wrong in the first place; if not the dominant reason then certainly a _huge_ one.

<comment><USER4> I just read the article, carefully, with your alleged claims in mind. I have no idea how you drew these conclusions about moral failings and such. They seem to go beyond reaching into the realm of imagining things that aren't even hinted at.

<comment><USER5> I have no idea how he came up with his rant either. The article says little to nothing along the lines of what he claims.

Only at the end of the article, someone else other than the author is quoted as saying that negative health outcomes can't be blamed on just your gut biome, but poor lifestyle choices as well.

Somehow this guy took this one statement, which is wholly correct and only points out the obvious, and turned it around to interpret the entire article as fat-shaming, and somehow misses the article's main purpose which is the lack of diversity in current data comparisons in this area of research.

</comment></comment></comment></comment></comment><comment><USER6> This reads like an overly cynical view of early stage experimentation. Will there be a lot of data that has to be simplified and ignored? Of course. That is almost by definition why we look at Calories and other proxy measures.

This will not become a science when someone perfects the one experiment that can answer questions. It becomes a science when people ask questions that they can falsify in ways that other people can replicate. It continues to be a science as long as that is the case.

Edit: I should point out that I misread the headline. I thought it was "Is Gut Science Based?" Not "Biased." .... so, I definitely had a more slanted reading of the article as I was going.

</comment><comment><USER7> An example of this in action: Japanese people have bacteria in their guts which aid in the breakdown of the cellulose-rich nori in their diet -- which probably at least partially explains why if you're a Westerner unacclimated to Japanese cuisine and you go to a sushi bar, you may end up with a case of the sushits. But this was only discovered _recently_ \-- like a few years ago -- it never occurring to people before then that gut microbiomes could be so diverse as to have developed local variants to handle local cuisine. But there you go.

</comment><comment><USER8> The idea that Western Educated Industrialized Rich Democratic (WEIRD as stated in the article) studies are biased is both obvious and not necessarily entirely problematic. The reasons it's not so bad are 2 fold:

1.) Scientists know this and are aware of the caveats (as the article points out).

2.) It's likely that for many biochemical/physiological/medical questions the variation within a reasonably large sample of such a population (male/female, fit/non-fit, manual labor/office work, vegetarian/meat+potatoes, not to mention countless biochemical processes...) swamps out the variation among larger groups.

How many studies fail even with such a homogeneous sample? Tons! My point is biology is messy enough already, that it's likely we've got bigger problems to solve than incorporating different standards of living, continents etc.

Now it's true if you want to make broad claims about microbiota, by definition you have to actually sample much more widely than the WEIRDs. But again, if you want to make narrow claims about differences between healthy WEIRDs and non-healthy WEIRDs, maybe not. I'm sure it would help, but that doesn't mean those studies are useless!

The technologies enabling this kind of work (chiefly next-gen high throughput DNA/RNA sequencing) are about 10 years old. And they haven't really been in relatively low barrier to entry use for much longer than 3 or 4. We're studying a hugely complex system here, and it's the definition of early days. Bias is important, the article is absolutely correct to point it out, but it's way too early to make any conclusions one way or the other about what is important in the microbiome, or the value of the research to date.

The best we can say right now is, "It's probably very important, we don't know how just yet."

</comment><comment><USER9> Living in Southeast Asia, and countries like Nepal, that has taught me to honor my gut, and put inside of it only the things that it feels happy with, but needless to say, I still had to experience some of the worst shit-storms (literally) in my life, all because of mixing together bacteria from one food to the other -- I'm sure they could learn a lot from the Asian people.

Experimenting with probiotics right now, and would love to hear about their effectiveness in a healthy diet.

<comment><AUTHOR> You've heard about the most shocking defecation story related to Nepal, haven't you? United Nations peacekeeping troops from Nepal are thought to have been so lax in digging latrines in their camps that they introduced cholera to Haiti when stationed there after the earthquake there. Until then, the island of Haiti had never had a reported case of cholera, but now cholera is endemic in Haiti.

[http://www.sciencedirect.com/science/article/pii/S1198743X14...](http://www.sciencedirect.com/science/article/pii/S1198743X14641343)

[http://www.npr.org/templates/story/story.php?storyId=2114342...](http://www.npr.org/templates/story/story.php?storyId=211434286)

[http://www.slate.com/articles/news_and_politics/foreigners/2...](http://www.slate.com/articles/news_and_politics/foreigners/2016/04/what_caused_haiti_s_cholera_epidemic_the_cdc_s_museum_knows_but_won_t_say.html)

</comment></comment><comment><USER10> I find it funny that some self-hating SJW came up with the acronym WEIRD to describe the population of the first world.

Ie it's pretty clear they started out with the acronym and then searched for the letters to finish it off. Would this sht pass if someone wanted to come up with an acronym for the illiterate population of the world that subsist on less than $1 a day and ended up with UGLY (for the sake of example)?

I find it equally unpleasant when people denigrate groups - whether they perceive them as 'underprivileged' or 'privileged'.

<comment><USER11> 1\. Calling someone "weird" seems a lot more playful than insulting to me.

2\. Do you find it equally unpleasant when people make insulting remarks about their own group than about a group they don't belong to? I think the latter is usually considered worse.

3\. Speaking of which, "self-hating SJW" is a term used to denigrate a group-- in this case, a group you don't belong to--and to dismiss them as people without considering the validity of their ideas. That's a cognitive shortcut that could be harmful.

<comment><USER10> Yes - it may be more 'playful' than insulting. But I definitely sense a general tone that it's ok to insult white / straight people while prostrating oneself in front of any kind of ethnic or sexual minority. This is a perfect example of this.

Is there any purpose to calling members of the developed world 'weird'? To me it's pure propagation of 'victimhood' culture - where being not white or not straight gives one 'victim points'.

I consider this racist and I'm calling it out.</comment></comment></comment>


Is everything Johann Hari knows about depression wrong? - <AUTHOR> https://www.theguardian.com/science/brain-flapping/2018/jan/08/is-everything-johann-hari-knows-about-depression-wrong-lost-connections <comment><USER2> Original HN Post and discussion. [https://news.ycombinator.com/item?id=16092975](https://news.ycombinator.com/item?id=16092975)</comment>