Rethinking SSL Development in an Appified World [pdf] - <AUTHOR> http://cryptome.org/2014/08/rethinking-ssl.pdf

<comment><USER2> Certificate pinning is a best practice(Google does it for their apps) and deserves to be supported in the SSL api provided by Android. This is my favorite thing the proposal.

</comment><comment><USER3> This is a really excellent piece of research. Congrats to the authors and I hope the Android team put effort into the suggested improvements. Given Google's long term efforts around SSL it would be a good fit.

The off hand remark about SSLSocketConnection not checking hostnames even though it has all the data it needs is a bit worrying. Does UrlConnection on Android do the right thing with respect to SSL URLs? It should do, I hope!

</comment><comment><USER4> The irony of apps breaking SSL by trying to accommodate self-signed certificates during developments are that mobile apps are the one mass-market setting where self-signed certificates are superior to CA-signed certificates _in production_.

</comment><comment><USER5> Hopefully apple will be more vigilant in the approval process with respect to SSL implementations in the coming year.

</comment><comment><USER6> I wonder if app SSL best practices is hindered by Apple's requirements to self-declare crypto and get export permissions from the US department of whatever. It's quite the surprise speedbump for new app developers, being first presented with this form at the point of app store upload. I can easily imagine developers doing a search&replace of "https" to "http" just to avoid dealing with all that.</comment>


Clang compiles much slower and bigger Firefox binaries than GCC 8/9 - <AUTHOR> https://hubicka.blogspot.com/2018/12/even-more-fun-with-building-and.html <comment><USER2> Actual title is "Even more fun with building and benchmarking Firefox with GCC and Clang". The article is actually way more nuanced than the current title.

<comment><USER3> Yes. Editorializing like that breaks the site guidelines: [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html). That led a bunch of users to correctly flag this post, which meant that [https://news.ycombinator.com/item?id=18794382](https://news.ycombinator.com/item?id=18794382) made the front page even if it was posted later.

We've moved most of the comments from this thread into that one.</comment></comment>


Aggregators? Threadsy's gone, but I'm still searching for a universal inbox - <AUTHOR> http://news.cnet.com/8301-33200_3-57354466-290/threadsys-gone-but-im-still-searching-for-a-universal-inbox/?tag=mncol <comment><USER2> Looks like people are only capable of and willing to use webcrap these days. AFAIK, gmail accounts can be accessed via IMAP (although gmail's IMAP is a bit wonky), even several of them from one place. I can't understand this obsession with giving random 3rd party services on the web access to personal stuff.

<comment><USER3> I have 10 e-mail addresses I use day-to-day and I access them all in Mozilla Thunderbird through IMAP. I haven't found a webapp anywhere near as straightforward and efficient as a simple desktop mail client. I definitely don't want to log in to 10 different web apps to check my mail, or even log in to one and sequentially click a "switch account" button and cycle through things.

</comment></comment><comment><USER4> You'll be able to do this with Loggur when it's ready, no problem... along with a number of awesome ways to sort, filter, graph, push/pull data, and set triggers.

<http://loggur.com>

</comment><comment><USER5> Try nimble.com [http://www.trendslate.com/2010/10/16/nimble-crm-startup- by-g...](http://www.trendslate.com/2010/10/16/nimble-crm-startup-by-goldmine- founder/)

</comment><comment><USER6> Joinbox.com and Engag.io are two new attempts to solve this problem.</comment>


Show HN: Scrambled – An iOS Game in HTML5 - <AUTHOR> http://www.scrambledapp.com/

<comment><USER2> I don't have an iOS device but the website looks very good. Appreciate the write-up as well, it's always interesting to read about these things.

Just a minor issue on the code you have on [1]:

          imagesToPreload.forEach(function(src) {
            var img = new Image();
            img.src = src;
            img.onload = hasLoaded;
            img.onerror = hasError;
          })

The onload and onerror callbacks would be best to be assigned prior to setting the image's src attribute so as to make sure they are always called.

Also, on your Element.hasClass method have you considered a non-regex approach, like this.className.split(' ').indexOf(c)? That would most probably be faster. Same goes for removeClass where something like this.className.split(' ').reduce(...).join(' ') may do the trick.

[1] <http://www.scrambledapp.com/articles/for-developers/>

<comment><USER3> iOS Safari supports element.classList since iOS 5. You can do...

        element.classList.add('classname')
        element.classList.remove('classname')
        element.classList.contains('classname')
        element.classList.toggle('classname')

</comment></comment><comment><USER4> HTML5, but I can't try it in my browser? Or play on my Android?

<comment><USER5> Also, wouldn't the JS performance be worse in an App Store app as compared to the browser?

<comment><USER6> Depends: maybe they used something like Ejecta (<https://github.com/phoboslab/Ejecta>) which doesn't use the standard webview but re-implements canvas on top of opengl.

<comment><AUTHOR> We did not use Ejecta, but the standard ios webview. You can read this article for more details on how we built it :

<http://www.scrambledapp.com/articles/for-developers/>

</comment></comment></comment></comment><comment><USER7> I couldn't turn off the volume with the iPhone's default silent switch. So it's not safe for work for the first few secs:) Anyway UX/UI is great, the game is addictive.

<comment><USER8> That would be a problem with the iPhone's default silent switch then.

Not saying it's not an issue the app should try to work around a broken iPhone, but if the iPhone's silence switch can't be trusted to do the simple job of silencing the phone, it's a problem with the device.

<comment><USER9> The silence switch is intended to silence alert sounds. It doesn't silence audio initiated by the user. For example, playing music of video in Apple apps will still play out loud even when switched to silent. With no way of automatically telling what is initiated by the user and what isn't, it's left up to the app to decide.

I tend to always have my phone on silent so it's not a distraction if I get an email or text while talking to someone, but if I play a video I want it to actually make some noise. Google's YouTube app doesn't play audio if switched to silent, and it's frustrating having to frequently switch silent off.

Whether background music is initiated by the user or not is debatable. I'd say it isn't.

<comment><USER10> This is exactly it, and the app for me was not doing learned expected behavior. "Learned" as in, beyond jasonlotito's black and white expected behavior. When I leave it on silent, I want all non-essential audio off, but if I'm going to play a podcast, clearly, I want it to play audio regardless.

Btw, the Youtube app did give me audio while the phone was set to silent.

</comment></comment></comment></comment><comment><USER11> I like the style of the demo website. I downloaded the game and after solving my first word, the app froze on the "Word Complete!" screen. At least I think it froze. I've tapped "next work" and "replay word" and swiped and tapped all over the screen and nothing has happened. Heading back to my "desktop" and back into the app leaves me at the same "frozen" screen. I-phone 4 with 5.1.1

EDIT: More random tapping and swiping got me to the "Achievements" screen which scrolls vertically but I have no idea how to get off this screen and back to the game.

<comment><USER12> > _At least I think it froze. I've tapped "next work" and "replay word" and > swiped and tapped all over the screen and nothing has happened._

A barrage of UI events ("swiping and tapping all over the screen") rarely helps when an app has stuck.

> _Heading back to my "desktop" and back into the app leaves me at the same > "frozen" screen. I-phone 4 with 5.1.1_

Tried killing the app? Open the list of open apps (double click the home button), and "X" it to death. Open again.

I downloaded the app too (on iPhone 5), and had no such problems as of now (I've only played for like 30 minutes though).

</comment></comment><comment><USER13> I just tried the app and I have to say it is impressive! Please tell us more about the way you built this!

EDIT: Me stupid: <http://www.scrambledapp.com/articles/for-developers/>

<comment><AUTHOR> We wrote an article to explain how we did it. You can read it here : <http://www.scrambledapp.com/articles/for-developers/>

</comment></comment><comment><USER14> Very impressive! I tried a few rounds and had no problems. Thanks for posting information on how you developed the app. I am venturing into building mobile apps and your article on how you developed looks very useful.

</comment><comment><USER15> Re "A tiny DOM wrapper" [1] Did you consider using classList [2]? It looks like it's supported by modern iOS safari [3].

[1] <http://www.scrambledapp.com/articles/for-developers/> [2] <http://davidwalsh.name/classlist> [3] <http://caniuse.com/classlist>

</comment><comment><USER16> Web apps are starting to get more and more impressive recently. I've started using Forecast.io as my main weather app and I honestly can't tell it's not native. This is the first good game I've seen though, but it's encouraging.

Anyone know why web apps are getting so good lately? Hardware power, browser optimisations, or what? Looks like there's a bright future ahead anyway.

</comment><comment><USER17> Use this.$el[0].innerHTML = _.template(html) instead of this.$el.html(_.template(html)). It will reduce html rendering time by 30-50%. On desktop browsers you won't see much difference but on mobile browsers it is significant.

Also, where is an android app? It should be easy to port to an android app since android also uses webkit browser?

</comment><comment><USER18> Careful, the website doesn't load properly if the Google Analytics tracks don't fire. Don't always expect that to happen.

<comment><USER19> What?

<comment><USER18> This website uses Google Analytics to track not just the page load, but individual elements being clicked on and such. It attempts to fire off a tracking event, but if GA isn't loaded, it fails, and the page itself fails to load. The author really needs to include some sort of fallback for when this happens.

</comment></comment></comment><comment><USER20> So I was all aboard until I looked in the iTunes store and saw a bunch of in- app purchase items. No deal.

I want to pay for an app up-front, or maybe get it free and pay one fixed fee. Anything else and I will not even try it. I realize I'm in a minority right now, but I think this trend in games needs to go away.

</comment><comment><USER21> Semi-related question: I noticed that on the website, there's an animation of the scrambled wheel. Rather than using a .gif, it's using javascript to sequence a bunch of .png files. Just wondering what the motivation for doing this is? These guys clearly know what they're doing, so I'm guessing there is one!

<comment><USER12> \- Flexibility in changing the files (hence create a different animation programmatically)?

\- Alpha blending (which GIF doesn't have, only has simple transparency).

\- More than 256 colors (which GIF doesn't have. You have to dither to get a semi-acceptable gradient and the like).

</comment></comment><comment><USER22> I have to say it's a really nice design and the game is fun, but it's not really smooth on my iPhone 4, it's a little laggy whenever an animation starts. This is still very impressive for an HTML5 game though.

</comment><comment><USER23> Looks cool; I have a question though.

Why are there two "D" in the following screenshot?

<http://i.imgur.com/WTQNBEs.png>

<comment><USER24> It looks like this allows the GIF to loop smoothly. All the letters change when the "S" passes over them.

<comment><USER23> Right, it doesn't make much sense from a gameplay perspective though.

</comment></comment></comment><comment><USER25> Great stuff! Beautiful flat design and the app runs very smoothly :)

</comment><comment><USER26> Great design on the site as well as great UI/UX for the app - amazing how powerful HTML5 apps are becoming.

</comment><comment><USER27> Looks and feels great! Makes me reconsider using HTML5 for a similar word game I've been working on.

</comment><comment><USER28> Can we get any details about the tech used to build this?

<comment><AUTHOR> Yep. You can read it there : <http://www.scrambledapp.com/articles/for- developers/></comment></comment>


Let's Build a Compiler - <AUTHOR> https://generalproblem.net/lets_build_a_compiler/01-starting-out/ <comment><USER2> This looks like something similar to Crenshaw's excellent tutorial of the same name:

[https://compilers.iecc.com/crenshaw/](https://compilers.iecc.com/crenshaw/)

and its x86 port: [https://github.com/lotabout/Let-s-build-a- compiler](https://github.com/lotabout/Let-s-build-a-compiler)

As interesting as Lisp-family languages are, I still think it's better to use something with more traditional syntax and start with parsing, because that both reaches a much wider audience and gives a very early introduction to thinking recursively --- the latter being particularly important for understanding of the process in general. A simple expression evaluator, that you can later turn into a JIT and then a compiler, is always a good first exercise.

<comment><USER3> I think I partially agree, but that it mainly depends on the audience. I've found that parsing and recursion appear in more areas than just compilers, to the point where it'd be relatively difficult to avoid them. Machine code generation and the underlying implementation of high-level primitives (closures, tail-call recursion, and the like) hasn't, at least in my experience, been "naturally-occurring" to the same extent.

In terms of creating a "learn compilers from scratch" resource, Crenshaw's approach is definitely better. The trade-off would be that it'd take longer to get past the "writing a recursive descent/LR parser" phase, and it might never get to higher-level language features at all depending on the input language you go with.

<comment><USER4> I've worked my way through quite a few tutorials on implementing Scheme I think you're absolutely correct that detailed material on implementing high level features, especially in machine code, is lacking. I'm very grateful for this tutorial. Can't wait for the next part!

</comment></comment></comment><comment><USER5> I have attempted following Ghuloum's paper, too. One difference is I wanted to make it as self-contained as possible and didn't want to depend on a C compiler or binutils. So I wrote a simple assembler. Here it is, all in Clojure:

[https://github.com/nathell/lithium](https://github.com/nathell/lithium)

It's dormant – I was stuck on implementing environments around step 7 of 24 – but someday I will return to it and make progress.

<comment><USER6> When I went over the tiger book back at the university, our teacher had a cool approach to overcome that.

Generate bytecode, but in a form that could be easily mapped to macros on a Macro Assembler, thus we only needed to write such macros for each target platform.

From performance point of view it was quite bad, but we got complete AOT static binaries out of it anyway.

</comment></comment><comment><USER7> Haven't started reading yet, but I'm really digging this trend of syntax- highlighted bare text blogs[0]. Is this a template or is it hand-crafted?

[0]: [https://christine.website/blog/h-language-2019-06-30](https://christine.website/blog/h-language-2019-06-30)

<comment><USER3> Currently I'm using a modified version of the after-dark[0] theme for Zola.

[0] [https://www.getzola.org/themes/after- dark/](https://www.getzola.org/themes/after-dark/)

</comment></comment><comment><USER8> Similar recent thread

"My first 15 compilers" [https://news.ycombinator.com/item?id=20408011](https://news.ycombinator.com/item?id=20408011)

</comment><comment><USER9> In the save vein, I'm also going to recommend [http://www.craftinginterpreters.com/](http://www.craftinginterpreters.com/)

It's a work in progress, but very well made. I think Bob (who is writing the book) is a great educator.

</comment><comment><USER10> it puzzles me sometimes why we programmers are so fascinated by compilers, interpreters, VMs, runtimes, etc. many of these will never make it to the level of, say, a production c++ compiler or a Java VM. and yet we keep building small compilers.

<comment><USER11> I did the Nand2Tetris course which includes building a basic compiler.

It just helps fully understand how you go from words in a file to actually doing computations and how purely abstract ideas like a 'class' are implemented.

To be fair, I studied Physics and not CS so I didn't have the opportunity to study Compilers at University.

<comment><USER12> > so I didn't have the opportunity to study Compilers at University.

Lots of CS people haven't either. My university moved compiler theory to the Masters program.

<comment><USER6> In some countries that is kind of irrelevant because most end up doing masters anyway.

</comment></comment></comment></comment><comment><USER13> As a side note, is there something similar for building a distributed application (could be a very simple NoSQL DB or maybe some stream processor).

</comment><comment><USER6> Props for not being yet another C based tutorial. Quite interesting read.

</comment><comment><USER14> We live in a world were ever PC has at least 2 Gbyte of ram and most CPU's are 64 bits, the section 'Data Representation' begins to explain how 'everything' can be stored in a single 32-bit integer, if we limit integers to 30 bits. What the hack?

<comment><USER3> Generating 64-bit code would be simpler in many ways, but I decided not to go into it until the basic language features are put in place. The extent of the changes involved in switching to amd64 will help directly show why having an intermediate representation for the generated code would be valuable.

Besides, if you're looking for a high-performance Scheme that fully utilizes all available system resources, there are definitely better options available. :)

<comment><USER14> For your initial design you could also have chosen to use an additional byte to represent the type of the value. As representing the type would only require 2 or 3 bits, some bits will be unused (probably some more, due to alignment requirements), but maybe later on in the development of the compiler, those bits could be used to store some additional information. That would have made your code a lot simpler.

As you probably want to combine these valuse together into some structures representing the various language constructs, an additional byte to represent the type of the structure, and thus the type of its elements, would also be needed. Than you could do away with the extra bits representing the type.

I just think this is premature optimization and making things unneccessary complex especially for your readers who might want to learn something from it.

<comment><USER15> The types of user-defined "structures" are usually identified by a tag inside the structure, not encoded in the pointer as for the few primitive types.

<comment><USER16> You'd probably be surprised how many GC'ed languages actually avoid the whole tagged/boxed variable thing in pursuit of the performance benefits. ocaml for example is limited to 30bit ints for this reason, the haskell standard only guarantees 30bits from the 'Int' implementation for this reason.

As I said further down this thread though, it's a 'speed' thing, not memory storage thing, the common belief is that boxing is slow, because it was slow in java, but in reality boxing is a) a mostly acceptable trade-off that only loses out in extreme cache-limited situations, and b) something that could be optimised away anyway.

<comment><USER15> My comment concerned heap-allocated user-defined types, not primitive types like int. Also, these techniques of tagging primitive types predate Java, so whatever convinced people that they are needed, Java wasn't it. (Though things change, so yes, it's a possibility that they are _no longer_ needed. Do you have benchmarks?)

I agree that a lot of boxing can be optimized away, but often it also can't.</comment></comment></comment></comment></comment></comment>


A Note of Explanation - <AUTHOR> http://eugeneross.com/e/

<comment><USER2> Well Eugene, if your as good at web design as you are at self promotion, I can see why you lost.

<comment><AUTHOR> Funny guy.

</comment></comment><comment><USER3> No idea of the context of any of this. I've never heard of Eugene Ross, nor am I familiar with whatever drama occurred here.

<comment><USER4> [http://webcache.googleusercontent.com/search?q=cache%3Aeugen...](http://webcache.googleusercontent.com/search?q=cache%3Aeugeneross.com%2Fi- lost-to-a-dreamweaver-design%2F&oq=cache%3Aeugeneross.com%2Fi-lost-to-a- dreamweaver- design%2F&aqs=chrome..69i57j69i58.4863j0j7&sourceid=chrome&espv=210&es_sm=91&ie=UTF-8)

<comment><USER3> Yeah, high school drama over an event no one's ever heard of and a weird pseudo-apology response without the words "sorry" or "apologize" anywhere to be found.

<comment><AUTHOR> It wasn't an apology, that's why I didn't have the word "apology" or "sorry" in it. It was an explanation, as the title may have given it away...

</comment></comment></comment></comment><comment><USER5> Good to hear that there was a lesson learned today. Some things are best kept in your drafts folder, huh?

<comment><AUTHOR> You couldn't be more correct sir!

</comment></comment><comment><USER6> Why is this here?

<comment><USER7> Kid thinks he got Dong Nguyen'd because he blathered to the internet about how appalling it is that people won a contest using Dreamweaver.

<comment><AUTHOR> Haha!</comment></comment></comment>


Intel is shutting down File Protect app - <AUTHOR> https://play.google.com/store/apps/details?id=com.intelsecurity.fileprotect&hl=en <comment><USER2> If you're looking for an alternative, you might want to try our app Boxcryptor: [https://www.boxcryptor](https://www.boxcryptor)</comment>


Introducing nyancat.js - ze' ultimate terminal animation for node.js - <AUTHOR> http://github.com/niftylettuce/nyancat.js

<comment><USER2> My son ran in from the other room yelling "NYAN CAT!", obviously understanding better than I. And that friends, is how you know you are getting old.

</comment><comment><AUTHOR> we're integrating audio!!! + making it optimized... perffff

watch the git project and check out current version :)

keep up the support!

</comment><comment><USER3> Now just add play.js and you'll be good to go.

<comment><AUTHOR> tasty. ill try to get a nyancat in too, then you will just have to BYOT - bring your own terminal

<comment><USER3> <https://github.com/Marak/play.js>

there it is

</comment></comment></comment><comment><AUTHOR> now with a real nyancat, animated feet, and fully working audio</comment>


Fighting persistent Lyme disease symptoms - <AUTHOR> https://elemental.medium.com/what-its-like-to-have-lyme-disease-forever-e207ae5e6f82 <comment><USER2> My undergraduate work was in microbiology. While I'm now a programmer, I've always been in awe of the microbial world and how it interfaces with humans.

I've developed a theory over the years that many (if not all) misunderstood disorders could be caused by yet discovered virus and or bacteria.

So many people develop bazaar conditions seemingly out of nowhere, that science simply doesn't have an answer for yet. For example - polymyositis/dermatomyositis. Theories abound, but so far none of them point concretely toward infection. I believe (but can't prove) that diseases like this could be caused by infections.

It's a scary proposition that a random bug bite might be enough to alter the course of your life. But I would rather we start discussing this as a very real possibility and not a hypochondriac's way of thinking.

<comment><USER3> That's the exciting thing about biology - despite the amazing advances that have happened in the past few decades, we've barely begun to understand human biology and disease processes.

I think back to the discovery of helicobacter pylori as the disease causing organism for a majority of ulcers. Before that it was always blamed on diet and stress (which probably play some factor). Amazing that a simple antibiotic regimen could _cure_ many people of ulcers was a complete paradigm shift.

<comment><USER4> at the same time how do we reconcile that a majority of the world harbors h. pylori and doesn't suffer from ulcers? From what I understand, there will always be "good" and "bad" bacteria inside us, the important part is the balance between the two. If antibiotics do knock out an h.pylori "infection" that is causing ulcers that's great, but what about the other bacteria that the antibiotics might be affecting? Will that offset the scales in another undesirable way?

</comment></comment></comment><comment><USER5> I've lived in a tick infested area (Ozark Mountains) for 25 years now and get bit at least a 100 times a year (probably a lot more, but I don't keep count).

The trick to avoiding Lyme disease is to do a "tick check" everyday and get them off of you asap. It helps a lot to treat clothes with permethrin but you'll still get a few bites if you're out where they're thick.

Here's a link to video I made last year about killing ticks in my yard:

[https://youtu.be/TFVDv8swzxQ](https://youtu.be/TFVDv8swzxQ)

<comment><USER6> Luckily Lyme disease appears to be very rare in the Ozarks: [https://www.cdc.gov/lyme/stats/maps.html](https://www.cdc.gov/lyme/stats/maps.html)

<comment><USER7> But not Rocky Mountain Spotted Fever. I've had 2 family members get RMSF in the last 2 years.

[https://www.cdc.gov/rmsf/stats/index.html](https://www.cdc.gov/rmsf/stats/index.html)

</comment></comment></comment><comment><USER8> Just yesterday lkrubner posted their multi-year battle with lyme disease. I thought it was a pretty interesting read:

> Slightly off-topic, but for anyone interested, I did write up my own battle > with Lyme, which went on for many, many years, till I found a simple > solution:

> "How I recovered from Lyme Disease: I fasted for two weeks, no food, just > water"

> [http://www.smashcompany.com/philosophy/how-i-recovered- > from-...](http://www.smashcompany.com/philosophy/how-i-recovered-from-lyme- > disease)

[https://news.ycombinator.com/item?id=20494464](https://news.ycombinator.com/item?id=20494464)

<comment><USER9> That was staggeringly non scientific, and the body of the article readily admits that he was not diagnosed with Lyme disease, AND that he's also not sure if it was lyme disease, basing it on the idea that getting bit by a tick = lyme disease

<comment><USER10> It's a personal anecdote of an individual's experience. When you are at your wits end with an illness and doctors have no answer for you, then it's natural to want to try stuff with very little science behind it. It's all you have. The alternative is to do nothing.

Also, Chronic Lyme is notoriously difficult to diagnose conclusively. The diagnoses that we do have are not widely accepted.

<comment><USER11> "Chronic Lyme" is notoriously difficult to diagnose because there is very little evidence that it is a real illness. While there is some research on the subject, the medical community still widely believes that chronic lyme is Not A Thing.

You often find chronic lyme being diagnosed and "treated" by alternative medical practictioners, homeopaths, naturalpaths, etc who then prescribe a wide array of untested treatments, batteries of blood tests and panels of ELISA antigen screens which are so cross-reactive that just about anything will show up. More often than not patients are being swindled out of vast sums of money by these alternative "treatments". A quote from the GP article shows exactly this situation:

> I've gobbled up herbal tonics, CBD oil, a universe of different probiotics, > antibiotics, anti-parasitics, and an endless array of supplements promising > myriad purported benefits. Most provided little, if any, comfort.

> [...] many people with Lyme flock to "Lyme literate" doctors (LLMDs), who, > citing the unreliability of Lyme testing, are willing to make a diagnosis > based exclusively on symptoms. [...] With no scientific consensus on what > causes persistent symptoms and how to treat them, such options aren't > covered by insurance, leaving people like me to fund treatment entirely out > of pocket. I've visited several LLMDs with mixed results. [...] Finding a > trustworthy LLMD can be difficult and expensive for Lyme patients. The LLMDs > I consulted in New York offered initial consultations ranging from $800 to > $2,000, with each follow-up visit costing anywhere between $300 and $500 > each.

It's not to say the symptoms are not real, but they are far more likely to be fibromyalgia or similar than a mysterious chronic infection of lyme which is untreatable. Articles like the above and the GP do not help the situation, and people end up believing random woo on the internet than their medical providers.

<comment><USER12> This response misses the point of the article and perpetuates the same attitude that has caused the author and many others so much suffering. The medical community is starting to recognize that there is a gap in knowledge, diagnosis power, treatment options, and general understanding regarding PTLDS. Many of these people don't seek alternative treatments for the hell of it, they do it when doctors have dismissive attitudes like yours.

<comment><USER11> I left a reply on the OP (before seeing this), which links to NIH, CDC and a review of the subject: [https://news.ycombinator.com/item?id=20511244](https://news.ycombinator.com/item?id=20511244)

It's not that the symptoms don't exist. It's that the symptoms are almost certainly auto-immune or neurological in nature. There is nothing "chronic infection" about the situation, and thus any attempt to treat it with extended anti-biotics, probiotics, diet restriction, etc are almost certainly destined to fail.

Patients need to spend more time listening to rheumatologists and less time listening to "Lyme Literate" providers selling uninsured woo at $2000 a pop.

</comment></comment></comment></comment></comment></comment><comment><USER13> Funny how he only mentions that his blood work was positive for Lyme disease after the first round of antibiotics, and then fails to mention the status after the second treatment.

I'm guessing it was negative after that, so his entire tirade is about asking doctors for antibiotics when there's nothing to indicate that they have Lyme disease other than the patient's own opinion.

<comment><USER14> The article mentions how unreliable testing for Lyme is.

</comment></comment><comment><USER15> Pretty interesting read. I have similar symptoms, which were linked to taking an antibiotic for a kidney infection. I can honestly relate to how this guy feels.

I honestly have seen docs from top hospitals, mayo, rush, northwestern + more and everyone has a different theory and just throws meds at me to try. I just try to manage on my own, which gets really difficult.

I guess I just wish doctors would be more understanding and open about goals/treatments and communicate better especially since patients with chronic symptoms tend to know more than your average patient.

</comment><comment><USER16> The scary thing is that tick-borne illnesses have exploded even within NYC in the last 3 or 4 years. I got bitten looking for morels this spring in one of the NYC parks, and even though I got the tick off within an hour and haven't experienced any symptoms it still makes me nervous that I haven't taken the 21 days of doxycycline.

<comment><USER5> I really wouldn't worry about that. You got it off fast enough to not worry.

<comment><USER16> Tick-borne illnesses can be transmitted in as little as 15 minutes, so it's hard to say whether it was fast enough or not.

<comment><USER5> Yeah but it was in the Spring you got bit and you got the tick off plenty fast enough. And not all ticks carry diseases, so try to keep that in mind too.

I'm not exaggerating when I say I have been tick bit at least a 1000 times over the past 10-15 years and I've never gotten sick from it so I have to think you've made it clear out of those woods after a couple months now and have nothing at all to worry about.

</comment></comment></comment></comment><comment><USER17> Its getting scary out there, my wife has basically banned us going hiking esp in Spring when the nymph ticks are tiny. Going to the movies never looked so good.

<comment><USER18> Are nymph ticks even capable of breaking through human skin?

<comment><USER17> Yes, they are the main problem: _Nymphal ticks cause most cases of Lyme disease. Because nymphs are as small as poppy seeds and their bite is painless, people often don't realize they have been bitten. Adult ticks can also infect humans, but are easier to spot and remove._

[https://www.lymedisease.org/lyme-basics/ticks/about- ticks/](https://www.lymedisease.org/lyme-basics/ticks/about-ticks/)

</comment></comment></comment><comment><USER19> _" "Information related to disease outcome is not collected by states as part of routine disease surveillance, which makes it more difficult to quantify," a CDC spokesperson told me."_

How is this okay? Serious question. I cannot imagine a single reason why this would become standard policy.

<comment><USER20> Presumably because it would require actively polling patients to monitor their outcomes. Its quite common that you don't hear much from those who get better, only from those who continue to seek treatment. And of those who stop seeking treatment you don't know how many are actually better either.

<comment><AUTHOR> I think you are right, this might be the main reason.

<comment><USER21> No, because that reason would apply to any and all diseases that are currently polled and where patients get better. But we still poll those people for there 1 and 5 year mortality rates.

</comment></comment></comment></comment><comment><USER22> The absence of a vaccine is a tragedy: [https://www.nytimes.com/2018/08/14/health/lyme-disease- vacci...](https://www.nytimes.com/2018/08/14/health/lyme-disease- vaccine.html).

There is some progress: [https://www.theguardian.com/science/2019/jul/20/lyme- disease...](https://www.theguardian.com/science/2019/jul/20/lyme-disease-is- solution-on-way), but: "The current leader is Vienna-based biotech Valneva, which is developing a vaccine that can protect against all six most common strains of Lyme disease in the northern hemisphere, and is currently in an ongoing Phase II clinical trial. If everything goes according to plan, this vaccine could be licensed commercially in five years."

<comment><USER23> As that article mentions, there already _is_ a vaccine (LYMERix). It hasn't been widely deployed, largely thanks to anti-vaccine paranoia.

<comment><USER24> And the fact that a subset of the population turns out to have a genotype that made Lymerix a problem for them;

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2870557/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2870557/)

But characterizing the people who claimed exactly these symptoms after getting the vaccine as crazy anti-vaxxers because science is easier.

</comment></comment></comment><comment><USER11> If someone wants to read some real medical texts on the subject, I would encourage them to read the following:

NIH: [https://www.niaid.nih.gov/diseases-conditions/chronic- lyme-d...](https://www.niaid.nih.gov/diseases-conditions/chronic-lyme-disease)

CDC: [https://www.cdc.gov/lyme/postlds/index.html](https://www.cdc.gov/lyme/postlds/index.html)

Lantos, Paul M. "Chronic lyme disease." Infectious Disease Clinics 29.2 (2015): 325-340. [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4477530/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4477530/)

> The CLD controversy does not, however, straddle a simple divide between 2 > opposed scientific factions. Within the scientific community, the concept of > CLD has for the most part been rejected. Clinical practice guidelines from > numerous North American and European medical societies discourage the > diagnosis of CLD and recommend against treating patients with prolonged or > repeated antibiotic courses 1-21

> Many patients referred for Lyme disease are ultimately found to have a > rheumatologic or neurologic diagnosis. Rheumatologic diagnoses commonly > misdiagnosed as Lyme disease include osteoarthritis, rheumatoid arthritis, > degenerative diseases of the spine, and spondyloarthropathies.26,27,41 Some > patients are found to have neurologic diseases, including multiple > sclerosis, demyelinating diseases, amyotrophic lateral sclerosis, > neuropathies, and dementia.27 Some CLD advocates have argued that these > various conditions are simply manifestations of Lyme disease,24,42–44 but > these hypotheses are untenable

In short, there is clearly evidence that people feel symptoms following Lyme Disease, but there is essentially zero evidence that these symptoms are some kind of prolonged, chronic infection that remains impervious to treatment. Extended courses of antibiotics do not improve the situation (and can fatally make it worse), and all the various woo (as mentioned in the article) do not help either.

"Chronic Lyme" is far more likely to be auto-immune (rheumatologic) or neurological in nature. It may be triggered by a lyme infection, just like it can be triggered by other non-lyme infections. Auto-immune responses are commonly triggered by severe bacterial or viral infections, and can persist/linger far after the infection itself has cleared up. But the concept of a "chronic" bacterial lyme infection has little to no medical bearing.

The fact that this continues is largel attributed to A) auto-immune disorders being difficult to diagnose and treat due to their unique nature and B) hucksters, con-artists, and snake-oil salesmen hawking the latest woo to patients desperately trying to solve their problems. And probably C) a general movement towars believeing random blogs (like the OP!) over medical providers, on the basis of "Big Pharma" or other general conspiracy theories.

<comment><USER25> > But the concept of a "chronic" bacterial lyme infection has little to no > medical bearing.

From your first link: "In 2017, scientists at the Tulane National Primate Research Centers, funded in part by an NIH research resources grant, reported evidence of persistent and metabolically active B. burgdorferi after antibiotic treatment in rhesus macaques"

From your second link, to the CDC: "Other experts hypothesize that PTLDS results from a persistent but difficult to detect infection".

</comment></comment><comment><USER26> Just a quick reminder -- if you want people to actually read your stuff, medium is the wrong place.

There is no way I'm signing up for whatever it is they want you to sign up for.

</comment><comment><USER27> It's interesting how split the comments here are. Lots of grey (downvoted) comments

</comment><comment><USER28> Bite with red ring surrounding bite site? Get treatment at once.

</comment><comment><USER29> Note if it wasn't for the alt-health fear of vaccinations, we would have a safe and effective vaccine for Lyme disease and other tick-borne diseases.

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2870557/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2870557/)

So now you get people sick from Lyme going to alt-health practitioners who prevented them from preventing themselves from getting the disease.

<comment><USER30> Sounds like a good business model for alt-health practitioners!

</comment></comment><comment><USER31> What I find particularly annoying is we had a vaccine for the North American strain of Lyme Disease, but no one makes it anymore for humans!

[https://www.vox.com/science-and- health/2018/5/7/17314716/lym...](https://www.vox.com/science-and- health/2018/5/7/17314716/lyme-disease-vaccine-history-effectiveness)

</comment><comment><USER32> Something about this smells fishy. Informing that [Chronic Lyme as a concept is dubious at best]([https://sciencebasedmedicine.org/fake-diagnoses-not-fake- dis...](https://sciencebasedmedicine.org/fake-diagnoses-not-fake-diseases/)), this sounds a lot like people worried about "whole-body Candida infections" or Wi-Fi poisoning or whatnot. Even if the symptoms are real, they could be a result from the nocebo effect or some other untreated illness.

All of this on top of medium blogs being able to be made by anybody sets off my pseudo-science alarms.

<comment><USER33> Ill-defined and/or poorly understood diseases like this are a magnet for cranks and grifters, from "Lyme-literate" doctors who don't take insurance and prescribe muscle relaxants and antibiotics until you run out of money or ignorant bloggers hawking fake science.

There's a lot of noise re "Chronic Lyme", whatever that might be. That being said, ~something~ is going on. My wife tested positive for Lyme, went on a round of antibiotics, and the symptoms didn't go away. She continues to suffer fatigue and chronic pain.

<comment><USER34> There's another tick-born illness that makes people allergic to mammal proteins. Have her abstain from all mammal products for some time to see if the situation improves.

[https://www.mayoclinic.org/diseases-conditions/alpha-gal- syn...](https://www.mayoclinic.org/diseases-conditions/alpha-gal- syndrome/symptoms-causes/syc-20428608)

</comment></comment></comment><comment><USER35> I've heard a lot of success stories of treating Lyme disease with PEMF technology. For those unfamiliar, it is a Tesla-coil emitting pulsed electric magnetic frequencies. Pretty interesting stuff.

<comment><USER36> What's the mechanism of action? Has there been a double blind study? Tesla coils for treating illnesses sets off all kinds of snakeoil alarms in my head.

</comment></comment><comment><USER37> > The author has spent a decade fighting persistent Lyme disease symptoms—and > convincing those who don't believe him that his illness is real

It is real. An illness caused by psychology is no less real than an illness caused by physiology.

Look up the work of John Sarno. You may be amazed that seemingly mysterious diseases which defy diagnosis can be cured by reading a book or watching a few lectures on YouTube.

</comment><comment><USER38> >I've personally found that an anti-inflammatory diet that eliminates caffeine, dairy, grains, and sugar

Me too! I don't (think I) have Lyme though. I had sinus headaches my whole life as well as an array of digestion issues. Cutting out gluten helped a ton, but I kept getting sinus headaches, so I kept identifying and cutting out food. These days I don't eat gluten, sugar, caffeine, sodium nitrites, and msg.

My brother is diagnosed with celiac disease. I cut out gluten before going to the doctor, so I couldn't be diagnosed easily. I feel largely the same way as OP though. The medical system doesn't know jack about this disease. There are no studies about sinus headaches and celiacs, even though there are plenty of reports pairing the two. My doctors never suggested this. They would give me Flonase (treat the symptom!). I told them I had issues with xyz foods and would be told to not eat those (thanks, duh). Never an attempt to figure things out with me.

I've met other people with weird auto immune issues. They're really mysteries. Lyme is actually a big fear of mine. I hear some people develop a meat allergy and that is a major part of my diet right now.

<comment><USER39> Did you follow an elimination diet to find out what you were sensitive to, or was it obvious? I'm considering an elimination diet but everything I read about a diet plan are different.

<comment><USER38> Initially, yes. You're supposed to eat only chicken and rice for a month or two, see how you feel, then add things back in. I was a broke college student at the time, so I did a deli meat and rice diet. I felt a lot better. In hindsight it was kind of stupid since deli meats have sodium nitrites which is a trigger for me, but I still felt scores better.

It took me about 5 years, from 23 to 28 to identify everything. It was a lot of "I got a headache, what did I eat, what were the ingredients", then correlating that over a long period, then testing what ingredient I isolated. For sugar and caffeine it was also a conscious choice to try cutting them out, I think those were more withdrawal situations than the other ones.

An example, I was eating at a gluten free restaurant regularly. No gluten means I'm good, yea? Still getting sinus headaches though. Maybe I'm going crazy, so I ask them what they think. He points out the sodium nitrite in the pepperoni. Correlated that with bacon, other deli meats, "uncured" things that have celery powder instead (contains sodium nitrite!). Then there is the sauce, tomato has glutamate, also tomato sauce often has sugar, these were a different time scale of headache though.

Cutting out sugar was by far the hardest. I went back and forth on it many times. I eventually got sick of the full withdrawal when cutting it out fully and decided to not start again.

Most people asking about this have digestion issues. These are usually caused by FODMAPs [1]. I had digestion issues with gluten and high fructose foods (fructose malabsorption). My brother is lactose intolerant. If that's what you're looking to isolate I would start with those.

Good luck! I highly recommend giving it a shot. Changing my diet changed my life. It's not true for everyone but all of my health issues were coming from what I was eating.

1\. [https://en.wikipedia.org/wiki/FODMAP#Sources_in_the_diet](https://en.wikipedia.org/wiki/FODMAP#Sources_in_the_diet)

<comment><USER10> Issues with deli meats could also point to histamine issues and mast cell activation syndrome. I'm not saying it applied to your case but perhaps it's something for others to be aware of.

</comment></comment></comment></comment><comment><USER40> I've done a lot of research on tick-borne, as well as interviewing others, and my own personal experience.

My protocol for being in tick areas is now as follows:

* No sugar, including "stray" sugar from processed food, like "cane syrup", "apple juice", etc.

* No processed food that digests fast and floods my body with nutrients, e.g. bread, cereal, etc.

* Light diet, intermittent fasting.

* No coffee.

* Lots of fresh garlic.

* Frequent tick checks.

* If I get bitten, no sweets of any kind, including fruit, for a few days.

* If bitten by the smaller species, and it's on long enough to leave a red mark, 2 days of antibiotics _right away_.

<comment><USER31> > 2 days of antibiotics right away.

I wonder if this is actually wise, given antibiotic overuse/resistance. Although, I suppose the downside would be for society, not you.

<comment><USER40> Every animal in factory farms is given antibiotics.

2-day antibiotics doses are commonly prescribed, and in fact as Lyme prophylacsis too.

<comment><USER31> > Every animal in factory farms is given antibiotics.

• This practice is absolutely terrible.

• It isn't _quite_ as bad, as animals usually (!) breed diseases that are harmful to animals rather than humans.</comment></comment></comment></comment>


GoDaddy Pulls Lavabit's Security Creds Because the FBI Got Its Encryption Keys - <AUTHOR> http://www.forbes.com/sites/kashmirhill/2013/10/09/godaddy-pulls-lavabits-security-creds-because-the-government-got-ahold-of-its-encryption-keys/

<comment><USER2> I think the revocation misses the point: "if" the NSA has been logging all the traffic from Lavabit for the last 6 months, they can now use the SSL key to decrypt all the data they've stored. It's not just about future communications, but about decrypting the past.

<comment><USER3> I will repeat my previous comment: Perfect forward secrecy, bitches.

If you use a protocol that supports perfect forward secrecy, and you ought to, then the private key is used only to authenticate the ephemeral session key, not to encrypt it. Compromise of the private key does not allow previous sessions to be decrypted. (Compromise does allow impersonation, though, which is why you need pre-distributed certificate revocations.)

<comment><USER2> I agree. But like virtually any site of which I am aware, Lavabit didn't force PFS. It's browser-negotiated. The "funny" thing is that there's a good chance that any one user might have been using PFS, so it's less likely that they can get a specific user's data (Snowden) and more likely that they can get a random sampling of other, non-target users' data.

</comment></comment></comment><comment><USER4> > "[W]e're compelled by industry policies to revoke certs when we become aware > that the private key has been communicated to a 3rd-party and thus could be > used by that party to intercept and decrypt communications"

This raises an interesting possibility of civil disobedience. Imagine if there was a site hosted in, say, russia, which received tip-offs from NSL recipients about these SSL seizures. And imagine they then informed the SSL issuers, who would revoke the certs, rendering the old ones useless and forcing the FBI back into court, with no-one to point a finger at.

I suppose the FBI would just request an order for all future certs as well.

<comment><USER5> Well, the finger is pointing at the NSL recipients. They are supposed to be the only people that know about the order, so they carry the can if it gets leaked.

<comment><USER4> There'd be a lot of people inside the FBI with knowledge. Proving it was an NSL recipient, let alone nailing down which one, would be difficult if not impossible in court.

Snowden's leaked a whole lot more than any NSL recipient ever did...

</comment></comment></comment><comment><USER6> Maybe ditching one's certs can become the new warrant canary.

<comment><USER7> I have wondered what the legal implication of revoking certificates after complying with a court order to turn over private keys would be. I assume that the court would hole you in contempt for doing so, but IANAL.

<comment><USER3> This is why competent people use write-only key modules with aggressive tamper-detection and self-destruct capabilities.

<comment><USER8> Can I buy these on Amazon?

<comment><USER9> Sorta? [http://aws.amazon.com/cloudhsm/](http://aws.amazon.com/cloudhsm/)

</comment></comment></comment></comment></comment><comment><USER10> already discussed at [https://news.ycombinator.com/item?id=6517553](https://news.ycombinator.com/item?id=6517553)

no need for a Forbes link of all.things.

<comment><USER11> I found it interesting that GoDaddy revoked the certificate - previously, I had assumed Levison did it himself.

<comment><USER12> I am curious if the FBI could step in and prevent GoDaddy from taking this action. Secret courts do not seem to have realistic limits.

In this context, can SSL be trusted?

<comment><USER13> Well, now that the certificate has been revoked, it's too late for the FBI to do anything: either users saw that the certificate has been revoked, or they didn't yet but if a new certificate is installed they will see that it's a new one with a different fingerprint (at least their browser should warn them of that).

</comment></comment></comment></comment><comment><USER14> _Thanks to Lavabit's design, Levison could not simply offer a tap of a particular user's communications if that user had paid for a secure, encrypted account._

That line really bothered me. The government demanded access to all user's data and this line places the responsibility for that onto Lavabit. The government wants all of our data, all of the time. They are the responsible party not Lavabit.

<comment><USER15> While the government might want all of our data, the NSL in question (at least according to the New Yorker piece ) requested only the data on one user(presumably Snowden). Levison was unwilling to put the software into place to tap into this single person's communcation. There was a warrant, but he wanted to charge $3.5k for the effort. I don't know how I feel about that.

In any case the Judge then said to just hand over the SSL keys so that they could do it "the old fashioned way" (listening to everything on the line).

Anyways, the point is that the original intent was not to get everyone's data, yet this is the point everyone keeps on parroting. The original intent was always to specifically get this single user's information, not some sort of power play by the FBI.

Maybe things changed down the line but I feel like none of us are in a position to know that (although who knows, Mulder might spend his time trolling HN)

<comment><USER16> > There was a warrant, but he wanted to charge $3.5k for the effort. I don't > know how I feel about that.

How would you feel if the police/FBI came to you with a warrant that requested all video footage from outside your home so they could spy on your neighbor's comings and goings. Oh, and by the way, you don't have a security camera system, and they aren't going to reimburse you to install one. If you do not produce video evidence, you are then disobeying the warrant and are in contempt of court.

Lavabit's system was not designed to listen in to one persons communications. It would cost money to implement that system. He requested he be compensated for his effort ($3500 is a piddly amount of money anyways), and they came back and said that was too much effort, so they'll take the entire thing. Back to the analogy, should the cops/FBI be able to possess your home in order to spy on your neighbor because you don't have a security system installed?

<comment><USER15> your analogy is wrong, it'd be more like "should the cops be able to get keys to your house".

In fact , it isn't even that, it's "should the cops be able to see who is coming in and out of your house, and searching them when they come in".

How did Lavabit's system work? I mean at one point there's an entry point, and the FBI wanted the info for the metadata, so just checking at the entry point for who's logging in would do it. You're going to have to convince me that it's non-trivial to implement something to scrape the metadata at the door (as in more than a couple hours work at most).

I don't know how to feel about it because $3500 is way too much money for what is asked, if this were a contracting job, and I think that if the police have a warrant for something they are reasonably entitled to what they're looking for. But asking people to do work without compensation.... I feel like there must be a precedent somewhere. At one point things become obstruction. I don't know what we should consider to be reasonable in these situations.

<comment><USER17> Remember that Levinson was not just a private contractor looking for work; taking time to build a whole new wiretapping system into his product wouldn't just cost him development time, but it's an opportunity cost as well, since he could have spent that time otherwise developing his business.

As for the triviality of implementing a metadata tap, I don't think the FBI was looking just for Snowden's IP address and browser. IIRC, they wanted metadata from his communications: email titles, recipient email addresses, time of transmission, etc. Lavabit was designed in a way that this was impossible. Levinson would have had to implement a system that flagged particular users and then saved metadata before encryption.

In a production, business environment, this isn't just a one-liner. Especially given the security-focused nature of Lavabit, the required development time and effort makes $3500 appropriate for the task.

<comment><USER15> Ah, I didn't know they wanted that information as well. Does seem like a hefty task.

I wonder if there's a precedent for paying people for this sort of work.

</comment></comment></comment></comment></comment></comment><comment><USER18> People still use GoDaddy?

<comment><USER19> Price is why, for a 2 year wildcard certificate:

GoDaddy is $180 per year

Comodo is $428 per year

DigiCert is $535 per year

<comment><USER20> I think it also has to do with a lot people who are registering domains don't know any better.

</comment></comment></comment><comment><USER21> The site is down due to Lavabit's decision. GoDaddy pulling it's certificate is just a PR move. GoDaddy supported SOPA, which is very much in line with what NSA demanded of Lavabit.

<comment><USER22> At the risk of saying anything nice about GoDaddy, this seems like it was the right move. Known compromised keys should be revoked. This key was clearly compromised.

Now what other Microsoft/Skype/Yahoo/etc keys can we demonstrate were also handed over to the government?

</comment></comment><comment><USER23> _Knowing that the FBI has Lavabit's keys, GoDaddy shuttered its secure site._

Next: Getting a judge to forbid GoDaddy etc from revoking the certificates.

Interesting times we live, a parallel reality is created</comment>