Covid-19: the harms of exaggerated information and non‐evidence‐based measures - <AUTHOR> https://onlinelibrary.wiley.com/doi/abs/10.1111/eci.13222 <comment><USER2> Firstly, there is 10 weeks of evidence on what other countries have done to avoid transmission. Taiwan, Vietnam, South Korea, China, and Japan all show a variety of strategies and have some successes under their belts. Sure, it's messy social data, and they have systematic differences from other countries, but it's real data about what is working.

Ioannidis says: "If we assume that case fatality rate among individuals infected by SARS-CoV-2 is 0.3% in the general population — a mid-range guess from my Diamond Princess analysis — and that 1% of the U.S. population gets infected (about 3.3 million people), this would translate to about 10,000 deaths."

The Diamond Princess data shows deaths with a functioning health system. From WaPo: "a doctor at Papa Giovanni XXIII Hospital in Bergamo, where he said there are 500 patients in need of intensive care and just 100 ICU beds". The deaths in Italy are often due to an overloaded health system, which can easily double the number of deaths. Why ignore that? Italy has 6000 deaths already with 1/5th the population of the US: you need some powerful evidence to assume the US should expect to have a different path to end up with a total of 10k (by say the end of the year).

I think John has good reason to desire evidence based decisions, but sometimes you have to make decisions without enough data and change your game as it develops e.g. look at what effective entrepreneurs do in uncertain times?

<comment><USER3> > "If we assume that case fatality rate among individuals infected by SARS- > CoV-2 is 0.3% in the general population — a mid-range guess from my Diamond > Princess analysis — and that 1% of the U.S. population gets infected (about > 3.3 million people), this would translate to about 10,000 deaths."

Why would we use the Diamond Princess CFR instead of China's, or Italy's, or South Korea's? Where does the idea of 1% come from? Both of those numbers sound ridiculously optimistic to me. Furthermore, death isn't the only negative outcome - what do we know about permanent organ damage (lungs, heart, liver, kidneys) in survivors?

<comment><USER4> >Why would we use the Diamond Princess CFR instead of China's, or Italy's, or South Korea's?

because everyone on the diamond princess was tested. So we know for sure how many cases we are dealing within the sample.

~0.3 and ~0.9% are also not optimistic guesses but the current numbers for Germany and SK. Italy sits at 9%. So the situation is either that Italy is vastly underestimating cases, or Germany and South Korea have lost a magnitude of corpses somewhere. I find the latter less likely than the former.

<comment><USER5> John's analysis is cherry picking in many ways. Death rate in Diamond Princess is 1.1% today and 2% is listed as severe. Assuming 50% of severe make it, final fatality rate for the ship may end up closer to 2%. John then adds a 50% discount factor but it is not clear how he picked that number. Also, the 1% of population infected seems to be another number pulled out of a hat. If we are basing our figures based only on the ship with no other assumptions, we have to go with 20% infection rate. Thus, one reasonable estimate of risk from the ship data is 20%x2%x330M = 1.3M deaths if we wait for "evidence" and did nothing. Clearly, this argues for doing something!

Edit: Also, Germany does not test dead folks for coronavirus while Italy does. Further, SK death rate has gone up to 1.3% (0.9% is an old number) and many more are in severe category. Thus, the sub 1% numbers seem more like the outliers than the above 1% numbers.

<comment><USER6> The Diamond Princess is also likely not a random sample of the population - they are healthy enough to be fit for travel.

<comment><USER7> You don't need to be particularly fit or healthy to go on a cruise. Yes, sure, you can't be on life support, but generally 'healthy enough' to travel on a cruise is exactly what I'd expect from any random sample of the overall population.

<comment><USER8> You may not understand what "random sample of the overall population" means if you would expect every single person in the sample to be healthy enough to travel on a cruise. Almost 1% of the population in the US has Alzheimer disease or other dementias, for example.

<comment><USER7> I noted exactly that in my comment. Yes, not all the population can go on a cruise. No, it's not like it's only the healthiest 20% of the population that can. If I randomly sampled the population I'd expect the majority to be capable of a cruise. What do you think cruises are like?

<comment><USER8> If you agree that they are not a random sample of the population - they are healthy enough to be fit for travel (like the majority of the population) you are not trying to contradict ant6n's comment as I thought. I misunderstood, my apologies.

<comment><USER9> and it's not a small travel (e.g. the British tourists that went on board the Diamond Princess).

If you are not in good health at the beginning, you don't adventure yourself 10 hours+ from your home. So this group is likely in better shape than average population.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> The title is funny, since Ioannidis is actually the one proposing measures ("do nothing") based on no evidence and exaggeration. Basically every number in the paper is tainted by him cherry-picking the most optimistic number possible, and then trying to twist it further into something even better.

Like his argument for the R0 being near 1.3 is just that it's "probably" the case.

At some point we need to be able to call the data we have good enough for making decisions.

<comment><USER11> Weirdly enough, just yesterday I took all available sequence data currently on GISAID, used it to estimate R0, and got ... 1.3.

<comment><USER12> If that were true then how can you possibly explain how rapidly the pandemic is spreading?

<comment><USER13> It's curiously spreading at the exact same rate that tests are being administered. Curious indeed..

</comment></comment></comment></comment><comment><USER14> I saw the videos from Wuhan hospitals 2 months ago and it was clear that the severity of this was off the charts. You can pretty much scale up the situation from a single hospital, because it tells you that it's impacting locally more than the hospital can respond.

You don't need "evidence" of how many are actually infected or what is the correct R or CFR or which way it spreads. Just look how it's impacting the local health care system. If it exceeds the capacity by X % that's how big a problem it is.

<comment><USER15> Spot on. Too many comments are see-sawing on details of parameters and trade offs but just talk to a doctor in NYC, they are out of room in ICUs and terrified about triaging that will start taking place.

<comment><USER16> Mt. Sinai in NYC is not currently reporting shortages of any kind. They are _preparing_ for shortages, but are not currently experiencing them:

[https://www.westsiderag.com/2020/03/23/mt-sinai-setting- up-o...](https://www.westsiderag.com/2020/03/23/mt-sinai-setting-up-outdoor- tents-to-extend-emergency-rooms-hopeful-comments-on-supplies)

Perhaps you want to reconsider your news sources.

<comment><USER17> Hospitals in Italy are currently reporting dramatic shortages of many kinds.

</comment></comment></comment></comment><comment><USER18> It's much easier to quantify the harms of allowing business as usual and letting the infection spread (namely # of deaths) than it is quantifying the cascading repercussions of a massive global economic meltdown.

Accordingly, world leaders are being judged based on their ability to contain the spread rather than prevent economic devastation.

As a society we are faced with navigating the delicate balance between how many lives we put to risk vs how much economic turmoil we can tolerate.

With so little data on the latter (economic crashes absolutely can lead to deaths as well), it feels like we aren't equipped to make educated policy decisions on how far we should go to limit the spread.

I hope after all this we can create a more cohesive playbook for navigating these tradeoffs in the future. Many of these public health orders feel like knee jerk reactions lacking evidence.

Better to err on the side of caution I suppose.

<comment><USER19> An economy is not something that one should have to shovels lives into to keep going. And in any case, if we sacrifice all the lives this virus could take to the economy, it won't help the economy at all - the massive dislocation involved in the deaths will certainly be far worse than the shutdown, if you really want to think that way.

All that said, part of the collapse of things like the stock market comes through the financial system having been built up into finely tuned but extremely fragile edifice - end QE created an environment of limitless leverage and short-term thinking. This environment created the situation of not having future resources, of jury rigging everything to work in a super- efficient but fragile fashion (the 737Max being a perfect product of this paradigm).

Covid shock is logical result - in another, a more far seeing society might have made preparations beforehand, had an epidemic team in place, etc.

So a lot of things are collapsing because they weren't built to last to begin with, not because of the virus.

<comment><USER20> >> An economy is not something that one should have to shovels lives into to keep going.

I mean I want to agree in principle, but this is just an incorrect statement. It's a matter of what is a good-enough tradeoff of risk and reward. If you make people drive to work, some will die. If you want to mine lithium, some people will die in industrial accidents that wouldn't have died if you never built a lithium mine. If you are only willing to accept 0.000% risk, then we have to respond with a full economic shutdown whenever there is a flu outbreak, or even a common cold outbreak, because people will die if we don't stop the spread. All economic activity leads to deaths, most of the time the deaths are less obviously linked, and at a much lower rate, so we don't connect the fact that people commute to work in trains, and so the economic activity they are commuting into work to engage in directly causes their death in the form of the flu, train crashes, pedestrian accidents, and so on.

There is also a question of net lives lost, or harm minimization. Economic activity also leads to resources which can be used to tend for the sick and elderly, or better nutrition, or education, and to sum up everything that isn't eating acorns you can find on the ground (except even that is a form of economic activity). I would assume that just letting covid run free would be dramatically worse than shutting down the economy for a few weeks, but then what the endgame is I'm not sure, it really does depend on the death rate in an ICU vs with limited medical support, and the amount of economic harm this causes.

However, I think we can learn a lot from this outbreak. I was very, very embarrassed to wear my filter mask when I went to the store, so I only wore work gloves up until yesterday. Now I'm sitting in bed with a fever wondering whether I'm about to start coughing up blood (probably not, it's still more likely to be the flu). Next flu season (or, sadly, next covid season) I think I will wear my mask, though.

If people start wearing fashionable masks and gloves in the winter, we can virtually eliminate lots of communicable diseases.

<comment><USER21> There is no trade-off. Exponential functions are pretty binary. We contain this (R0<1) or we let this kill 3.6% of the population, and likely permanently harm the lungs of many more.

A core problem is that we're not looking at how to mitigate damage to the economy. We can handle a month or two of the economy shutting down, no problem. You'll get your new car 2 months later.

Most of the damage is auxiliary: businesses going bankrupt, people defaulting on mortgages, etc. All of that can be mitigated with the right measures.

[https://docs.google.com/document/d/1YbtJGn7ida2IYNgwCFk3Sjhs...](https://docs.google.com/document/d/1YbtJGn7ida2IYNgwCFk3SjhsZ0ztpG5bMzA3WNbVNhU/edit)

The economic harm of losing 2 months of production -- or even a year of production -- is much smaller than the economic harm of supporting people disabled by coronavirus for the rest of their lives. That is assuming we mitigate the economic fall.

<comment><USER20> >> The economic harm of losing 2 months of production -- or even a year of production -- is much smaller than the economic harm of supporting people disabled by coronavirus for the rest of their lives.

That is a tradeoff? I don't understand how you are disagreeing with what I said. You are literally spelling out what we are trading off, the fact that its a very good trade (in your opinion, which is based on expert advise and almost certainly correct, but there are no guarantees) doesn't make it stop being a trade. In fact, that is how all tradeoffs work, one option is better than the other so you pick it.

</comment></comment></comment></comment></comment><comment><USER22> Context for the author: [https://en.wikipedia.org/wiki/John_Ioannidis](https://en.wikipedia.org/wiki/John_Ioannidis)

He wrote a column a couple days before this paper. Linking the response as well.

[https://www.statnews.com/2020/03/17/a-fiasco-in-the- making-a...](https://www.statnews.com/2020/03/17/a-fiasco-in-the-making-as- the-coronavirus-pandemic-takes-hold-we-are-making-decisions-without-reliable- data/)

[https://www.statnews.com/2020/03/18/we-know-enough-now-to- ac...](https://www.statnews.com/2020/03/18/we-know-enough-now-to-act- decisively-against-covid-19/)

<comment><USER19> It's kind of a shame that he's wound-up writing an article like this. It certainly discredits him in my eyes and it seems utterly opposed to stated principles of evidence based medicine.

As others have noted here, the article calls for action based on very little data and lots of ad-hoc speculation. It also cheery picks its and falsely claims we don't have enough data.

I wonder if thinking all research is false too much lets jump to the idea you dream any opinion that's convenient.

Moreover, Ioannidιs has absolutely jumped into advocating this position from a partisan political position, with his positions picked up by partisan political sites such as the dailywire.com; Headline: "Stanford Professor: Data Indicates We're Severely Overreacting To Coronavirus" [https://www.dailywire.com/news/stanford-professor-data- indic...](https://www.dailywire.com/news/stanford-professor-data-indicates- were-overreacting-to-coronavirus)

</comment></comment><comment><USER23> What Ioannidis is advocating is to do nothing until we have scientific certainty of what the correct decision should be, and only then act. What he's not taking into account is that the situation is unfolding right now, and if "do nothing" turns out not to have been the correct decision then you can't go back and change that. If we overreact and cause 20% unemployment for the next year, then a harm has been caused, but if we underreact and 20 million people die, then another harm would have been caused. In the face of this alternative, with not enough data to know the probability of outcome #2, but with enough to know that it _can_ happen, then I think it is rational to choose the route that most surely avoids it.

<comment><USER24> > if we under-react and 20 million people die, then another harm would have > been caused

And it's worth noting if anything on the order of millions of people die, then there going to be economic impacts -- that's a hell of a demand crater and productivity shock.

<comment><USER25> Worst case. Instead of quickly developing herd immunity, the US ends up with persistent low level outbreaks over two to three years like the 1918 flu. If that happens the rest of the world will quarantine us.

<comment><USER26> What are you trying to say? If the rest of the world would develop hard immunity, they would have no need to quarantine you.

<comment><USER25> Assume they don't, assume they manage to stop community spread of the disease instead. Then they don't have herd immunity.

</comment></comment></comment></comment></comment><comment><USER27> Let's check back on this piece in...2 weeks, say, when there are 10,000+ Corona deaths in the US. Well see how it ages then.

Source: [https://www.nytimes.com/interactive/2020/03/21/upshot/corona...](https://www.nytimes.com/interactive/2020/03/21/upshot/coronavirus- deaths-by-country.html)

427× 16 =11102

<comment><USER28> That rate is highly unlikely to hold. There's enough stay in place restrictions in effect to drive it down after about a week or so.

FWIW, at this point, it looks like NYC is going to take a huge hit and the other outbreaks (Seattle, California) will look mild comparitively.

<comment><USER19> Washington state doesn't have a statewide lockdown, I don't know if even Seattle has a lockdown. California is doing the best but there are still crowds defying the lockdown at beaches and parks. Just as much, grocery stores are open as usual and even with most people trying to do social distancing, I'm doubtful you're clamping that hard on the infection, unfortunately.

I think the best is that when fatalities spike here in California, we're in better shape to intensify the lockdown.

<comment><USER29> Washington does as of 5:00 pm PDT today.

<comment><USER30> I've dug through everything I can find. I'm feeling really stupid at the moment, but I cannot find a confirmation of that 5pm start time, though it does appear to start today and "immediately." It runs through April 6, but could be extended.

Tweet is from 6:50pm: [https://twitter.com/GovInslee/status/1242267557295321090](https://twitter.com/GovInslee/status/1242267557295321090)

[https://medium.com/wagovernor/inslee-announces-stay-home- sta...](https://medium.com/wagovernor/inslee-announces-stay-home-stay-healthy- order-4891a7511f5e)

[https://www.governor.wa.gov/sites/default/files/proclamation...](https://www.governor.wa.gov/sites/default/files/proclamations/20-25%20Coronovirus%20Stay%20Safe- Stay%20Healthy%20%28tmp%29%20%28002%29.pdf)

<comment><USER29> That's when the announcement of it was broadcast, which is why I used that time.

<comment><USER30> Thanks.

</comment></comment></comment></comment></comment></comment></comment><comment><USER31> Imagine this. Your driving down the freeway at 60 mph, accelerating at 30%. The car in front of you puts on the breaks. Before you react, you first gather your speed gun, check the deceleration rate of the car in front, then calculate based on your speed when you should put your breaks on. I'm all for the scientific approach, but in this particular instance, our survival instincts need to take precedence. Please, we need to stop peddling evidence based approaches for an exponential situation.

<comment><USER32> Stepping on the breaks perfectly align with what we know scientifically. People think of science as something very narrow – but it's also evidence and rationality. What China and South Korea have done works. What other alternatives do we have?

<comment><USER33> Except China and South Korea did different things.

<comment><USER32> Which is consistent with what I wrote.

</comment></comment></comment></comment><comment><USER34> "And yet it moves" Galileo Galilei [https://en.m.wikipedia.org/wiki/And_yet_it_moves?wprov=sfla1](https://en.m.wikipedia.org/wiki/And_yet_it_moves?wprov=sfla1) . I agree that in many axpects the situation is exagerated, in primis by general panic. But If the Covid is not much worse than flu why in Italy we have military trucks convoy that transport death to southern regions because the wait line for crematory in North is becomed too long?

<comment><USER35> In normal times Italy has a death rate of 10 deaths/1000 people. Which translates to ~1500 daily for a population of 60 millions. What were they doing previously with the dead?

<comment><USER36> Those people haven't stopped dying. As a comparison, 700 people have been dying every day for covid-19 in Italy. Also deaths are not (yet) evenly distributed but greatly concentated in the north.

<comment><USER35> You are building the world around your arguments. You have no proof but still talk, talk, talk.

<comment><USER12> What does that even mean? The world is what it is. Italy is seeing huge increases in background death rates at the moment, owing solely to COVID-19 (while at the same time seeing diminished deaths from things like traffic accidents, though not remotely enough to make up for all the extra COVID-19 deaths).

What is your argument exactly? It's a fact that Italy is running at a higher overall mortality rate owing to COVID-19.

</comment></comment></comment></comment></comment><comment><USER37> [http://www.euromomo.eu/](http://www.euromomo.eu/)

Mortality across Europe has drastically declined in the past few months. Seems like everyone sitting at home is saving a ton of lives. Fewer accidents, fewer sicknesses, maybe even people eating a bit healthier.

Why stop locking yourselves indoors when so many lives are being saved by not leaving home?

<comment><USER38> It kinda proves the point that covid19 alone is less deadly than many other causes

<comment><USER39> I don't see how you've come to that conclusion.

<comment><USER38> Did you look at the charts? If you didn't know there is a global epidemic, would you have been able to see it on these curves?

In France and Italy, there were between 50000 and 60000 deaths per month in 2018 and 2019. If most of those people died because of 2 or 3 accumulated factors, covid19 would be just one more factor. But maybe those people would have died one month later anyway without covid19

<comment><USER39> I don't understand people like you who can look at the current numbers and say "Oh, it's not so bad" while also conveniently ignoring that the numbers are growing exponentially. People that are raising the alarm are not talking about the numbers now, they are talking about the numbers in the future if nothing is done to address it.

<comment><USER38> This is a new virus, _no one_ knows about the future. Data we have now could be biased toward an hidden variable we didn't figure out yet.

<comment><USER40> One can predict the future with bounded error bars though. Weeks of observation yielded some numbers including R0 around 2 and CFR around one digit percent (yes, we still don't know if it's around 1% or 2%, but it is certainly not 0.1% [1] or 10%), so 0.1---5% of the total population will die somehow due to COVID-19 if absolutely nothing is done. For the reference, less than 1% of the total population dies each year in developed countries. Enough reason to be alerted.

[1] CFR is a function of age (notably among others) and more careful analysis would involve demographics. Still, the rough order of magnitude doesn't change.

</comment></comment></comment></comment></comment></comment></comment><comment><USER41> It's easy to point at others for imperfect data and imperfect science when the situation is evolving so fast and data is so hard to come by. It seems to me that papers being retracted due to inaccurate evidence is not a sign of sensationalism but of sound science. Once can argue that more diligence should be practiced in the review process, but I assume everyone is trying their best to get the information out there ASAP.

In any case, policies need to be enacted now (or rather two weeks ago) in any but the best case scenarios. There is no time to wait for more accurate information. If one argues that exaggeration is rampant and we should learn more before making hasty decisions, then that's essentially arguing for inaction. Even if that was the right action I suspect the induced panic in the society will be even greater.

The author also seems to be implicitly weighing the dire consequences of a pandemic (maybe millions more people dying) against the supposed reputation damage to science, which is bizarre to say the least.

<comment><USER42> The response will have it consequences too, lost lives, destroyed businesses, ruined families, lost requirement savings.

<comment><USER39> That's not an argument for letting this disease burn through our entire population. That's an argument for the government to step up and assist people during this time.

Edit: and who gives a shit about your retirement account.

<comment><USER43> People who for whatever reason are utterly dependent on support from the state might well give a shit about the state's decreased capacity to provide aid thanks to additional demand on the part of those whose retirement funds (which allowed them to be self-sufficient) have been destroyed.

<comment><USER44> At least in my country a big chunk of grandma and grandpa's retirement is subsidized by government programs, if not directly provided by government programs. The same way we provide disability coverage for people who end up out of work through no mistake of their own due to on-the-job injury, etc. You might have your own 401k you deposited salary into or have extra private disability insurance but a big chunk of your safety net here is a government program that you pay into while you're able-bodied and working and then draw out of when you're disabled and/or retired.

It's not as if a disease mitigation shutdown is the only thing that's going to crater grandpa's 401k. His stock holdings took a big hit during the 2008 crash too (as did mine).

Acting to preserve the economy first and foremost will not help those people. You have to keep them alive first while coming up with effective strategies to look after them later in the event that their retirement funds somehow evaporated. What good is protecting their retirement funds if the retiree isn't around to spend them?

</comment></comment></comment></comment></comment><comment><USER45> The answer seems so obvious. Do a hard, air tight quarantine of people of advanced age. People who are borderline or sick are told to stay inside. Encourage the rest of society to go about business as usual. Provide government support for all of it. Some people will die but probably less than if we have to do this over and over again without ever gaining herd immunity. And few enough to massively ease the burden on hospitals. And it's the best way to avoid Great Depression 2020.

<comment><USER46> ...keep in mind, that it may be the case that we're being lied to when we're told that young and healthy people have nothing to fear. The following article seems to suggest otherwise: [https://www.propublica.org/article/a-medical- worker-describe...](https://www.propublica.org/article/a-medical-worker- describes--terrifying-lung-failure-from-covid19-even-in-his-young-patients)

<comment><USER46> Another data point: The following source gives additional detail on the kind of thing that is meant by "preexisting condition" when they say "people without preexisting conditions have nothing to fear". One of them is high blood pressure. Who doesn't have high blood pressure, these days.

[https://www.cebm.net/global-covid-19-case-fatality- rates/](https://www.cebm.net/global-covid-19-case-fatality-rates/)

</comment></comment></comment><comment><USER47> Ioannidis continues to push this evidence-based approach, but I have not yet seen an adequate response to critics such as Nassim Taleb or Yaneer Bar-Yam. They argue that one doesn't need raw evidence to act if the statistical evidence shows that the risks are catastrophic. They published a paper on January 26th which lays out arguments for why conventional risk management approaches are inadequate in these situations. [1]

This paper was met with disregard on HN [2], but the persistent reach of Ioannidis shows why Taleb's arguments have value.

Some on Twitter argue that the WHO statement on January 14th shows where Ioannidis' approach fails: "Preliminary investigations conducted by the Chinese authorities have found no clear evidence of human-to-human transmission..." [3] Authorities were looking for evidence before taking any action.

[1] [https://necsi.edu/systemic-risk-of-pandemic-via-novel- pathog...](https://necsi.edu/systemic-risk-of-pandemic-via-novel-pathogens- coronavirus-a-note)

[2] [https://news.ycombinator.com/item?id=22154333](https://news.ycombinator.com/item?id=22154333)

[3] [https://twitter.com/WHO/status/1217043229427761152](https://twitter.com/WHO/status/1217043229427761152)

<comment><USER48> I find Taleb's argument specious. The risk inherent in a reaction can be pretty catastrophic as well; for example we are now seeing some project 20%+ unemployment in the next quarter.

In addition, we do have data on the possible harms from Coronovirus, since we have more CFR data at this point. This puts bounds on possible harms. For more detail see John's other article in statnews. The results of the Diamond Princess cruise ship also are telling [1].

It looks like Iceland has about 1% of its people infected [2]. This didn't happen overnight, and Iceland is doing OK.

[1] [https://twitter.com/maximlott/status/1241718453700038658?s=2...](https://twitter.com/maximlott/status/1241718453700038658?s=20)

[2] [https://www.government.is/news/article/2020/03/15/Large- scal...](https://www.government.is/news/article/2020/03/15/Large-scale- testing-of-general-population-in-Iceland-underway/)

<comment><USER49> Well, consider if we reacted late January when he wrote that article it would have been very cheap to contain...

<comment><USER4> Then the immediate question is, the next time we react early and it turns out we overreacted, is that something you're going to register as well? In particular in authoritarian countries like China which actually have a history of vast overreaction based on a 'security-first' mindset.

Ioannidis actually points to one other example in the article. There are several corona strains already in circulation with fatality rates as high as 8% among the elderly. If this reaction is rational, are we irrational not locking down everything every winter?

<comment><USER49> Maybe we can just lock things down when we sport extremely dangerous new viruses. It doesn't seem that tricky to me. I was following this from late December, and it was clear it was a potentially huge risk.

</comment></comment></comment></comment></comment><comment><USER50> You need to know if you're walking through a two way door or a one way door. A two way door you can course correct. A one way door you can not which requires a different risk strategy. Evidence suggests a one way door.

</comment><comment><USER51> Common sense needs to prevail over mania, numbers over hyperbole and science over conjecture. But even then, this is hard if our data is collected poorly and then poorly disseminated.

So what is the answer then? Maybe a strengthening of resolve against all forms of panic?

Is there a single event in history has been solved by panic?

<comment><USER52> The craziest stat I heard today was on my local news, and it was about COVID19 in the county, Davidson County (Nashville, TN,) they said of all the active cases in the county only 2 had been hospitalized. That's out of 163. The others were sent home to be quarantined and medicated. I was floored. Why are stats like that not shared? That seems like very valuable information. Hospitalization rates should be one of the main stats being shared, imo.

<comment><USER19> Sure but most of those are new cases. Do you have any idea what happened with those cases two weeks later or even if it's been two or three weeks for the cases? You'd only expect that 16-32 would require hospitalization in any case. But on the other hand, you can expect 326 visible or invisible cases the next week and gradually things get difficult, if the trend that's been documented continues.

<comment><USER52> I can see that, but I also can see that this could give us insight into the virus as it spreads throughout the population. Like, what if it is mutating, becoming weaker/stronger, hospitalization rates would give us insight into that.

</comment></comment></comment></comment><comment><USER53> The acid test for this article will take place towards the end of this week and into next according to the Surgeon General.

Honestly, we're all holding our collective breath and waiting to see whether or not the U.S. begins to approach the same values associated with the Diamond Princess.

So far, the mortality rate of those testing positive, asymptomatic and symtomatic, published by the CDC today, is 0.0119 compared to the DP's 0.013.

The mortality rate as a percentage of all passengers and crew aboard the DP is 0.002 (9/3711).

The infection rate as a percentage of all passengers and crew aboard the DP is 0.192 (712/3711).

Dr. Deborah Brix indicated during today's WH presser that it's possible 70% of the U.S. population will be "exposed" to the virus by the end of 2021.

(327,000,000 * 0.70) * 0.19 = 43,491,000 potential positives if the DP number is used.

To date in the U.S., the reported percentage testing positive of the total number tested is 0.115. I'm not sure where this number keeps coming from.

At the moment, the Diamond Princess represents the best set of data for comparison.

<comment><USER54> Why do we expect to get better mortality data in the US than other countries?

<comment><USER19> I don't think many people knowing the facts are expecting that. It's that people, including me, dread the moments when the facts become manifest. This will prove us right but I will take no comfort in that confirmation. On the off chance that these (implausible sounding) arguments turn out right, well, woohoo, great.

<comment><USER53> Finishing the math on this is very sobering which is why I was intrigued by the original post.

I truly hope John Ioannidis is correct and SARS-CoV-2 is not as virulent. We are about to see in the next week or so.

<comment><USER19> The big thing is he's making a big assumption that there's some natural limit to the total infection rate that can be achieved by the virus - less than 100% and less than the 30% of the cruise ship. That seems plausible but it's essentially based on zero evidence. Diseases have wiped out societies so there's no rule I can saying Covid couldn't achieve a disastrous 30% penetration of the population. No country has had the guts just say "let's see how far this can go" and fortunately so.

An extreme worst case would be maybe 3% of the population dying. The Syrian civil war killed 2% of the Syrian population over several years, so this sounds bad. But US regular death rate is about 0.88% you could fudge and claim people would barely notice. But Covids is a very messy death and would destroy the health care system, which people would notice.

</comment></comment></comment></comment></comment><comment><USER27> Can we revisit this now that it's clear how wrong John was? The US already has 6000 deaths from only 250k confirmed cases. It is assured we will cross the 10kthreshold,and likely the 100k one.

It's important to hold people accountable for their (massive, scary, indefensible) assertions.

</comment><comment><USER55> I am worried there is a fine line between 'realism' and a backlash against care for the elderly and chronically ill.

When people realise that their earnings have been slashed, they have been burdened with years of increased taxes, the economy has plunged, and swathes of businesses have gone bust, for the sake of people who were going to die soon anyway...

Realism is good. But it is easy to 'evidence' biased anti-vulnerable feeling with 'realism'. I'm not convinced that if most people understood the realistic risk to themselves, they would do what's necessary to protect the people at much greater risk. The last week of the 'let's be realistic' zeitgeist on the news comment thread I visit.

As usual with such pessimism, I really hope I'm wrong.

<comment><USER56> >I am worried there is a fine line between 'realism' and a backlash against care for the elderly and chronically ill.

I guarantee you that if we don't target our lockdowns on the at-risk population (elderly being the most numerous in that group), whatever backlash there is will be worse when the general population realizes they aren't at any significant personal risk.

<comment><USER57> > ... when the general population realizes they aren't at any significant > personal risk

With 15-20% of confirmed cases needing intensive care and symptoms developing at roughly the same rate, it becomes a perfect storm. So deaths may begin with only the elderly or immune compromised, it likely won't stop there as the younger folks need care they can't get. Perhaps they survive anyway, but an unknown number with permanent lung damage and lower quality of life.

General population may come to any number of realizations. The underlying reality may never become entirely clear to any of us. Y2K probably could have been much worse. Yet the media coverage around the aftermath gave the impression it was no big thing.

</comment></comment></comment><comment><USER46> Collecting stats on the progression from clinical presentation of the patient all the way to death seems to me a bit tedious, since death is altogether somewhat rare and when it does occur it's a lot of factors playing together.

But the following article really put the fear of god in me, as it's the first source I've discovered that gives you an idea of the rate at which patients progress from clinical presentation to "going severe". Here a doctor gives details on the criteria they use for separating patients which are not altogether that restrictive, basically just saying that the patient must test positive or have been in contact with someone who did: "We have an observation unit in the hospital, and we have been admitting patients that had tested positive or are presumptive positive; these are patients that had been in contact with people who were positive." Elsewhere in the article there is mention of the rate at which these patients progress to going severe: "About a third have ended up on ventilators."

[https://www.propublica.org/article/a-medical-worker- describe...](https://www.propublica.org/article/a-medical-worker-describes-- terrifying-lung-failure-from-covid19-even-in-his-young-patients)

My guess is that the clinical point of view around Covid-19 is currently probably a well-kept secret among clinicians and that Ioannidis probably doesn't have access to that kind of "inside information".

</comment><comment><USER58> This didn't get enough attention the first time around.

 _We know enough now to act decisively against Covid-19. Social distancing is a good place to start_ \- Marc Lipsitch reponding to John Ioannidis.

Previous conversation [https://news.ycombinator.com/item?id=22620283](https://news.ycombinator.com/item?id=22620283)

</comment><comment><USER59> Link to the paper itself (which I can't find anywhere on the abstract page);

[https://onlinelibrary.wiley.com/doi/epdf/10.1111/eci.13222](https://onlinelibrary.wiley.com/doi/epdf/10.1111/eci.13222)

</comment><comment><USER60> I published a paper on outbreaks in a hospital setting and the problem is there is not a single RCT on methods to stop outbreaks. The problem is no organization is willing to approve a trial where you don't follow your protocols and commonly accepted methods to control the spread (ex. closing common areas, isolating patients, cohorting staff, enhanced cleaning). There is a good blog post about 'Riding the Wave' that basically says that perhaps the outbreak would have ended itself and we simply just take credit saying "what we did worked" but in reality we'll never know.

<comment><USER2> South Korea got their infections down and their economy isn't in the toilet. Compare to Italy's reactive policy and subsequent failure.

Or look to Taiwan and Japan with economies running and infection rates under control (at present).

Your "perhaps the outbreak would have ended itself" will be shown to be false in multiple countries that lack the resources to manage their infection transmission rates... We have heard of Iran, but wait until we find out what happens in other poor countries...

<comment><USER61> I'm really worried about India. So far it's not a huge outbreak there yet, but they are hitting the beginning stages of the steep curve.

</comment></comment></comment><comment><USER62> A discourse vacuum was produced by lack of proper channels. I myself wouldn't have been so engaged in reading those papers and sifting through videos from obscure sources had I felt that the officials were not sleep at the wheel.

I'm still dumbfounded that China is let off the hook for delaying information a whole month, but even after declaring mass quarantines the west's officials took more than a month to take notice.

</comment><comment><USER63> One thing that seems really important is that we get testing right. Here is a paper stating up to 80% of false positives: [https://pubmed.ncbi.nlm.nih.gov/32133832/](https://pubmed.ncbi.nlm.nih.gov/32133832/) If that was true it would make all the stats nearly useless. I have also heard that the so called 'quick tests' are even worse.

<comment><USER64> The group at Charité Berlin which developed the WHO test claims they had no false positives in hundreds of trials.

</comment></comment><comment><USER65> What if corona is already very widespread and not especially lethal? The increase in cases may be a function of test coverage.

</comment><comment><USER66> There's a tonne of speculation about CFR still at this time. Maybe I'm hyperbolic, but there are still ~1,500 serious/critical cases in China which is 1/3rd of all active cases. I have a feeling like the 4% CFR is high here because many of the COVID cases became clinical diagnoses instead of rtPCR; in other words, the Chinese physicians started using CT scans and clinical presentation to diagnose COVID instead of testing. Normal viral pneumonia diagnostic criteria is a chest radiograph and clinically compatible features (e.g. fever, cough, dyspnea, etc.). My take away is that they probably ran out of test kits and therefore many asymptomatic patients are out there.

As time progresses I have a feeling that the official CFR in China is going to spike soon when they start deciding to take people of ventilators, unless the CCP decides to pour massive resources into keeping these patients alive. Regardless, I have a feeling like the number of deaths/resolved is significantly lower than what it actually is and I wanted to nerd out here for a second because I love talking about medicine.

Edit: I want to say that I still think that we should be taking this entire pandemic seriously and am in no way commenting on this article's suggestion that we are in anyway over/underreacting. I'm making a comment on CFR.

</comment><comment><USER67> I found this bit from the paper interesting.

      A Google search with "coronavirus" yielded 3,550,000,000 results on March 3 and
      9,440,000,000 results on March 14. Conversely, "influenza" attracted 30- to 60-fold less
      attention although this season it has caused so far about 100-fold more deaths globally
      than coronavirus.

First off, I am not sure how to comprehend those numbers. Back in the day a "result" was a page. What is that today? Are there really $9bn+ pages of useful content that mentions coronavirus? The number seems a bit arbitrary...

Second, the major issue with comparing flu deaths and coronavirus deaths is time. We have only known about covid-19 for a handful of months. The flu in all its forms has been with us for millennia. You simply cannot compare the two. For me this bit throws the credibility of the paper out the window.

</comment><comment><USER68> If this is exaggerated, then surely there have been other epidemics that have gone through the world and had similar effects numbers wise (with cfr for example), and he would be able to refer to them as par for the course.

<comment><USER69> [https://en.wikipedia.org/wiki/Epidemiology_of_pneumonia](https://en.wikipedia.org/wiki/Epidemiology_of_pneumonia)

</comment></comment><comment><USER70> The virus mostly kills old people and people with comorbidities who would die anyway. Economic crisis come every ~10 years so it would come anyway. See what I did there?

</comment><comment><USER71> This sounds more like an opinion paper than a study.

</comment><comment><USER72> Someone ought to research out the number of cell phone accounts that have been terminated in China in the last three months. I saw a video last night claiming it was on the order of 2.1 million.

If you didn't know, the Chinese government tracks their citizens movement, social activities and pretty much everything through their phones. If you don't have a phone in China, you are a non-person, or perhaps you've died.

</comment><comment><USER73> How was this peer reviewed?

</comment><comment><USER74> Is this paper basically saying China and Italy's troubles with COVID-19 "ain't no big deal", and that New York and Washington are not struggling?

>"Leaving the well-known and highly lethal SARS and MERS coronaviruses aside, other coronaviruses probably have infected millions of people and have killed thousands"

This is not cited, and seems like potentially exaggerated non-evidence based information.

<comment><USER75> For what it's worth, the US CDC has said this about (H1N1)pdm09. I'm not sure if H1N1 is a coronavirus though and I don't know if there's any published research supporting this. But the author's statement seems reasonable enough given it was qualified with "probably".

> From April 12, 2009 to April 10, 2010, CDC estimated there were 60.8 million > cases (range: 43.3-89.3 million), 274,304 hospitalizations (range: > 195,086-402,719), and 12,469 deaths (range: 8868-18,306) in the United > States due to the (H1N1)pdm09 virus.

[https://www.cdc.gov/flu/pandemic- resources/2009-h1n1-pandemi...](https://www.cdc.gov/flu/pandemic- resources/2009-h1n1-pandemic.html)

<comment><USER76> Nope - MERS and SARS were the only large Coronavirus outbreaks. H1N1 is an Influenza A strain (similar to the so-called Spanish Flu).

<comment><USER77> That is untrue. There are coronavirus outbreaks all the time. What makes MERS and SARS special is that they are the only known human coronviruses with high mortality.

</comment></comment></comment></comment><comment><USER17> > An argument in favor of lockdowns is that postponing the epidemic wave > ("flattening the curve") gains time to develop vaccines and reduces strain > on the health system. However, vaccines take many months (or years) to > develop and test properly.

It's not only about vaccines but about treatments in general. There is a good chance that we'll have a drug that significantly improves outcomes long before we have a vaccine. I don't understand how a peer-reviewed paper can overlook this.

</comment><comment><USER78> Sadly, my takeaway/tl:dr Everything you've heard or read is fake news, we know almost nothing. Ironically uses 'gone viral' when he crits a fellow doc (cite 12) on the mask 'issue', and clearly we can't even get these experienced pros on this very topic to agree on much of anything, but will print regardless.

<comment><USER79> I'm also in this camp. I feel like it is the rational position too.

So much margin for error in about 300 different facets.

<comment><USER78> Based on my comment's downvotes, and no feedback, I have to assume I've either 1) Misread the article, 2) Misinterpreted the article, 3) Didn't clarify my position sufficiently.

This recent HN post has a pretty good summary of where I think we all are on the given 'mask issue' topic:

[https://news.ycombinator.com/item?id=22673242](https://news.ycombinator.com/item?id=22673242)

Suffice it to say, these clap-back articles among the medical elite in supposed positions of authority don't clarify the facts any better than the sketchy policies being made on nebulous data. But I guess we are in a state of 'real-time' peer review, and everyone left guessing the outcomes.

</comment></comment></comment><comment><USER80> I will go out on a limb here (I'm hardly a domain expert) and make the following prediction: In retrospect this will be seen as the moment when peer perception of Ioannidis fell from major scientific figure to reckless (or worse!) fraud.

The problems with what he writes seem to me to be so severe, I cannot fathom how it ever made peer-review.

His original article assumed, with no measures taken, a peak infection rate in the US of 1% of the population. For that to be true, R0 would need to be around 1.01 (herd immunity to restrict further spread is achieved at around 1-1/R0). This is totally insane, there is literally no way covid-19 could have spread internationally as fast as it does with this R0 (you can work out R0 quite well from the growth rates, the main problem is reporting quality, but death figures are presumably fairly accurate).

He also gave a plausible lower bound of CFR of around half of seasonal influenza, 0.05%. For comparison the Italian CFR currently skews closer to 9%! Even accounting for immense underreporting, there is no way to reconcile these discrepancies (a factor of 200x). He upwards adjusts a tiny bit in this article, but it is still extremely hard to reconcile the situation on the ground in Italy with what he is writing.

All the countless additional severe problems with his argument (cost asymmetries, health care capacity, ...) pale in comparison to these two.

<comment><USER80> There are two pretty simple and detailed arguments above why what Ionnidis wrote is preposterous, if you disagree, why not engage with them?

</comment></comment><comment><USER81> Is this a case of Frequentist vs Bayesian?

</comment><comment><USER42> There was a comment on HN a few days ago basically saying, "what's wrong with panic, maybe we should be panicking" and I just found that comment frightening. We mock all the "idiots" buying up the toilet paper, but panic clouds the clear thinking of even the "intelligent". It can absolutely effect our leaders and medical professionals.

<comment><USER82> Reading that comment charitably, I guess they meant something about fear sometimes being a productive motivating emotion. In my view, panic is fear strong enough to override rationality. Cool-headed fear might be a good thing, but panic usually isn't.

<comment><USER42> Right, panic is pure emotion, fight or flight, hard be rational in that state. Covid19 is "sobering". 100 years since the 1918 flu and we still aren't ready. Even with the billions we spend on health care.

</comment></comment></comment><comment><USER83> So.... was this sponsored by the airlines or by the hotels chains?

EDIT: After what happened in Spain and Italy, countries where the initial reaction was "let's not overreact", I don't believe any scientist can speak on those terms without a hidden agenda.

<comment><USER84> Whatever the numbers say, it is hardly the case that anybody has underreacted. Everywhere, we've always been at least three weeks behind the curve, which is an eternity when dealing with this virus.

<comment><USER85> Do you mean overreacted where you have written underreacted?</comment></comment></comment>


Free Fonts for Web and Design - <AUTHOR> http://www.fontsquirrel.com/ <comment><USER2> Just a quick tip while we're on subject.

If you use any exotic type for your @font-face, be sure to give it a _text- shadow: 0px 0px 1px #fff;_ to smooth out the edges.

The shadow colour should be the same as the background colour. So technically, it's just a smoother, not a shadow.

The result is the same smooth render you would get with sIFR. Works wonders.

<comment><AUTHOR> Nice tip - but the @font-face generator on the linked site actually does font smoothing before generating the output.

<comment><USER2> I just tried it. It's not the same, they're using Hinting to render better, but it's definitely not smooth.

my comparison <http://img709.imageshack.us/img709/9537/textshadow.png>

It's even worst at smaller font-size. My test font is relatively simple also, imagine the disaster the NYT font would be without a blank shadow.

<comment><USER3> What browser is that in, and do you have anti-aliasing enabled in your OS? The 'original' text in your screenshot isn't anti-aliased at all, which I don't think should happen unless you have AA off on a system level.

<comment><USER2> You know what, it just dawned on me that at one point I had my IE7 ClearType disabled because I didn't like it's smoothing effect. I don't know if that setting is carried on to Chrome or not.

I'm on XP + Chrome.

<comment><USER3> AFAIK, ClearType settings apply system-wide. It should be pretty easy to tell though; if any non-image text in your browser is smoothed, it's on. If it's not, it's off.

What it sounds like the white drop shadow did in your case was simply force ClearType on for that text.

<comment><USER2> Thanks dude. I had initally turned off ClearType because smaller texts were too blurry or you could see a hint of red in some letters.

Found a tool that optimizes the contrast <http://www.microsoft.com/typography/ClearTypePowerToy.mspx>

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> Google should host and cache some nice free fonts for everybody to use in their sites, so we can give the web a face lift.

<comment><USER4> <http://code.google.com/webfonts>

</comment></comment><comment><USER5> Their font face generator tool is an incredibly useful one: <http://www.fontsquirrel.com/fontface/generator>

</comment><comment><USER6> Additionally, if you're looking for higher quality fonts, the same guy (Ethan) who runs the squirrel runs a boutique for @font-face fonts: <http://fontspring.com>

<comment><AUTHOR> Yep. They've got great fonts - but a friendly note: they're _not_ free. Well worth the money, though... and very sensibly priced.

</comment></comment><comment><USER7> <http://www.theleagueofmoveabletype.com/> is another place that has a bunch of good open-licensed and free-to-use fonts.

<comment><USER8> Those are included here (as you would expect with an open licence product but which is a new thing for fonts):

[http://www.fontsquirrel.com/foundry/The-League-of- Moveable-T...](http://www.fontsquirrel.com/foundry/The-League-of-Moveable- Type)

and

<http://www.fontsquirrel.com/foundry/Barry-Schwartz>

</comment></comment><comment><USER9> And:

<http://www.josbuivenga.demon.nl/index.html>

</comment><comment><USER10> Suggested feature for a @font-face site: include a sample of the font using @font-face for browsers that support it, instead of just images (at least I didn't see any live samples).

<comment><USER8> They are there, just well hidden.

<http://www.fontsquirrel.com/fontfacedemo/GoodDog>

Click _View_ to get the individual font page, then _@font-face Kit_ in the menu bar at the top, then the _demo of this font here_ link.

</comment></comment><comment><USER11> Great resource, though I've personally found cufon to be easier to deal with across browsers.

</comment><comment><USER12> Great batch. A couple I hadn't seen yet.</comment>


Ask HN: Is developing desktop app for Mac worth it? - <AUTHOR> I'm pretty much Windows developer and I have been developing desktop applications for Windows for who knows how long. Recently, I've been interested in Macs. I don't really like Windows anymore for multiple reasons.
I would like to hear experiences about developing desktop apps for Mac. Is the app store worth it? What do you think is the future of OS X? (I've been reading a lot negative comments about new Macs...) Do you make living out of developing desktop applications?
Product I'm planning to write for OS X is this https://cryptoextension.eu/. This is not meant to be an advertisement, just to give you some insight what I'm planning to do. On Windows, sales are more than I ever excepted them to be which is nice of course. I have this image in my head that Mac users are more willing to pay for software, is it true?
Just asking for your experiences really, I'm probably going to buy Mac anyway and write the software for it, as it's fun and I like to do desktop applications :) <comment><USER2> Look into Electron... I hear that more and more desktop apps getting written using web technologies and wrapped into Electron.

<comment><USER3> Yup! Take a look at Discord, they're really popular and they're using Electron for almost all of their applications.</comment></comment>


Ask HN: I have bought myself an e-mail domain, now what? - a-saleh As a weird new year's resolution I have decided to buy myself a domain.
Mostly, because I wanted to start a blog, with hope that one day it might help me with job hunting, if such need arises. And I like writing, and even if I write 3 posts this year, it is better than if were 0 :-)
What I wonder, should I start using the domain as my email address as well?
In my mind, for using it as email address:
* email@example.com trumps firstname.lastname@example.com, especially if I needed to communicate with somebody who doesn't know me yet
* my identity on the net would be better separated from my email provider
Against:
* decent mail provider costs ~50$/year
* I don't plan to go job hunting or start a side-business
* for official things I use surname@university and it is working out fine
But maybe I am missing out and 50$ a year isn't a big deal anyway :-)
What do you think? <comment><AUTHOR> You can just forward the email to your normal inbox. (Actually just writing a service for exactly that). The benefit is you get a proper spam filter what most buyable email hostings dont have, plus only have to check a single inbox.

I also use firstname.lastname@example.com for mostly everything, plus i have a super short one to tell someone my email fast. People are often impressed, many think i run a company. Its very good for my general image.

Edit:// For free professional forwarding check Mailgun which also contains the ŜMTP for sending (something i wont offer)

</comment><comment><USER2> I use fastmail with my domains. It costs 30$/year and I really like it. I make it pull my gmail stuff which I am slowly trying to phase out.</comment>


DHH: Hey's Monolith Stack RoR and TurboLink and MySQL and Elastic and Redis - <AUTHOR> https://twitter.com/dhh/status/1275901955995385856 <comment><USER2> I feel like I'm pretty onboard with everything except MySQL...? I just can't imagine reaching for that, in 2020, over Postgres.

</comment><comment><USER3> Interested in how TurboLinks handles traffic like this?

<comment><USER4> The same as usual? It's the same server side rendering just with dynamic replacement on the front-end</comment></comment>


Winter Storm Highlighted Problems for Power Generators - <AUTHOR> http://www.energycentral.com/c/gn/winter-storm-highlighted-problems-power-generators <comment><AUTHOR> "Extended outages, or retirements, among the region's nuclear power plants would have detrimental effects. At the same time, having stored fuels like LNG and oil at dual-fuel units, combined with imports from Canadian hydro facilities, could help maintain reliability."

We need some kind of disruption in the energy generation market...I mean we're shutting down our nuclear power plants without adequately accounting for the loss in generation capacity...perhaps there will be some innovation in distributed generation, but either way, it'll be interesting to see how things go in this industry.</comment>


The Fascinating History of Autocorrect (2014) - <AUTHOR> http://www.wired.com/2014/07/history-of-autocorrect/ <comment><USER2> A related concept to "autocorrect" (fix it _after_ typing it) is "predictive typing" (expand invisible hit zone around statistically likely onscreen key _before_ the user presses it).

This was the clever technique that Apple programmer Ken Kocienda[1] figured out for the 2007 iPhone to make its tiny QWERTY screen keyboard usable.

Deep link of Scott Forstall explaining it: [https://youtu.be/xxBc1c3uAJw?t=4m55s](https://youtu.be/xxBc1c3uAJw?t=4m55s)

[1] [https://www.wired.com/story/opinion-i-invented- autocorrect/](https://www.wired.com/story/opinion-i-invented-autocorrect/)

<comment><USER3> Isn't Intellisense predictive typing?

[https://en.wikipedia.org/wiki/Intelligent_code_completion](https://en.wikipedia.org/wiki/Intelligent_code_completion)

Does Microsoft still have the best code completion?

<comment><USER4> > Isn't Intellisense predictive typing?

No. Intellisense tells you a list of options based on type inspection and then optionally autocompletes from the set of options. It just says that if you type A and then a dot, according to the grammar of the language, you then must be about to type a member of A. But it's not predictive, because you literally just told the system that you're about to type a member of A by typing A and then a dot.

<comment><USER3> Don't you also get predictive variable and function names? Types? Control structures? enumerations?

The space is much more limited so you should never need to type more than a few characters once you've written something once.

<comment><USER4> > _Don 't you also get predictive variable and function names? Types? Control > structures? enumerations?_

Nothing* in intellisense is predictive in any meaningful sense. It just displays the entire set of options constrained by one or more of [the grammar, structured object inspection, and words seen in the document].

* There is one thing, actually. Intellisense can optionally boost the priority of a suggestion based on proximity to other instances. I would classify that as prediction.

</comment></comment></comment></comment></comment><comment><USER5> I'm not surprised that autocorrect came out of Microsoft. The best autocorrect I have ever used was on the keyboard of the Microsoft Zune HD. If you were even hitting the correct half of the keyboard, it would be able to solve the puzzle and correct your typing. It is the only onscreen keyboard that even comes close to using a physical keyboard on a phone, and I'm routinely disappointed by Apple and Google's comparatively pathetic offerings.

<comment><USER6> Is that because zune is only searching among a small set of song names, not among all possible strings like the phones do?

<comment><USER5> No, I was using it for general purpose typing, for example on MSN messenger which was available as an app on the Zune HD

</comment></comment></comment><comment><USER7> For those interested in AI: the root of autocorrect appears to lie with Warren Titelman (also originator of things like Undo) who was a PhD student of Marvin Minsky at the MIT AI lab. Warren invented DWIM -- Do What I Mean, like an autocorrect for the shell, when he worked on Interlisp at PARC. Simonyi, author of the first WYSIWYG editor, Bravo, left PARC to go to Microsoft and re-implement Bravo as Word, incorporating a lot of other PARC ideas that were in his head.

DWIM was a bit weird and as I was used to typing what I wanted I didn't really like it (though strangely, macro expansion was tied into DWIM so you couldn't disable it completely). Though it was a lisp thing (and Interlisp-D wasn't even written using a text editor) the best way of thinking about it is if you typed 'mr -R /' into Bash and bash suggested both that you meant "rm -r /" and that doing so on the root would be a bad idea.

<comment><USER8> [https://en.wikipedia.org/wiki/Warren_Teitelman](https://en.wikipedia.org/wiki/Warren_Teitelman)

[http://warrenteitelman.com/](http://warrenteitelman.com/)

</comment></comment><comment><USER9> > Without it, we probably couldn't even have phones that look anything like > the ingots we tickle—the whole notion of touchscreen typing, where our podgy > physical fingers are expected to land with precision on tiny virtual keys, > is viable only when we have some serious software to tidy up after us.

This is a nice dramatic sounding intro, but it is really exaggerated. Along the lines of "Nobody can survive without social media in the modern world". Of course you can live without it. Stop trying to inflate a minor inconvenience that you can get used to to "impossible".

I never had autocorrect and I recently found the option to switch of the "suggestions" in the top bar of my phone keyboard. It is heaven. Sure, I have to spend some time fixing my typos, but it's way faster than to fix a completely wrong suggested word that I accidentally touched.

</comment><comment><USER10> It's a shame that the humorless 'fix' of the article's title throws away the joke ….</comment>


$140 adjustable height standing/sitting table - <AUTHOR> http://roostermade.wordpress.com/2011/04/01/140-custom-adjustable-standingsitting-work-station/ <comment><USER2> _After lunch, my wife helps me raise the desk (I work from home). We each stand at one end and lift. I hold my end with one hand and slip an empty plastic bin between the two desks (We just moved so we have like 20 of them in our garage). Then I place a bin on my wife's side._

that doesn't really seem like an adjustable desk. from the title i thought it was a cheap version of something like <http://www.geekdesk.com/>

i use an ikea jerker desk set to its maximum height for standing at: <http://www.flickr.com/photos/symmetricalism/5488994391/>

and when i need to sit, i have a drafting chair that is adjusted high up for the desk's height: <http://amzn.to/fZLkPQ>

<comment><USER3> I wish they still made the jerker desks.

<comment><USER4> I use the Fredrik and it works well for me as a standing desk.

<comment><AUTHOR> I looked into that, The 98cm max-height doesn't work for me. I'm 6'3".

<comment><USER4> The Fredrik I'm standing at right now can go all the way to 150cm, just make sure you get the correct version. There's a short one and a taller one.

<http://www.ikea.com/us/en/catalog/products/60111123>

If you look at this pic you'll see the tabletop plus two shelves. The shelves and tabletop can all be mounted at different heights. I mounted the shelves below the tabletop and my tabletop is at 104cm but can go much higher.

</comment></comment></comment></comment></comment><comment><USER5> I've been standing at my desk for about 2 months now and I can say that it's made a huge difference. I just use a pile of books. It's "adjustable" in that if I want to sit, I just move a few books.

The physical benefits are that my ass doesn't hurt nearly as much and my back feels better (if I am careful not to slouch) [1].

I also feel there is a benefit in terms of the "take-a-walk-and-get-a-good- idea-effect". I'm not sure if there is any science behind this, but I feel that I can think more clearly when I am walking around away from my computer. I've found part of this benefit is acquired by just standing all the time. When I'm in the zone, I don't have to take a break to get up and walk around.

If you're considering trying standing at your desk, try it out for a week by piling up the books by your desk.

Be warned though, one negative is that people definitely come over and interrupt more often. I think the fact that they can see me standing (and no one else) from across the office gives people the impression I'm only casually involved in my work at the moment.

[1] At first my feet really started hurting in the afternoons. I bought a fairly expensive floor mat (e.g. gelpro) and this has _really_ helped.

<comment><USER6> Re: "not sure if there's any science in this". Brain rules by John Medina ISBN 9780979777707 provides compelling evidence that you're probably thinking along the right lines. An interesting read.

</comment></comment><comment><USER7> My $180 solution is much nicer and doesn't require two people to lift.

[http://www.leevalley.com/en/hardware/page.aspx?c=&p=4057...](http://www.leevalley.com/en/hardware/page.aspx?c=&p=40573&cat=3,43586,43594)

Ignore the text about a maximum of 20lb. When you get it, it's actually a MINIMUM of 20 lbs required. 20lbs is the balance point: if you have less than that, it stays permanently up. But if you have less than 20lbs you can take out one of the springs. Of course, most woodworkers using it for it's intended purpose use 20lbs of hardwood, but I use a jerry rig that's much lighter. Then I added a 30lb 30" monitor, and it works great. The springs lift 20lbs, so you only have to put in 10lbs of effort to lift 30 lbs.

I'd worry about adding a lot of heavy weight to the front of it where there is more leverage, but I wouldn't hesitate to add another 50lbs to the back. This thing is solid.

Of course, it's a fixed travel distance. But if your monitor also has a little bit of height adjustment as well, it'll work perfectly.

<comment><USER8> I don't know anyone who only has a 7-inch height difference between when they're sitting and standing.

<comment><USER7> I'm 6'1 and my eye-level difference is 13-inches. My monitor has 5 inches of adjustment.

If you think you need more than 12 inches you're slouching while you're sitting.

<comment><USER8> It's not just about monitor placement though. Keyboard height, at least for me, is more important for a comfortable computing environment that monitor height.

Just checking now, I've got about 18-inches difference between my seated keyboard height and my standing keyboard height.

<comment><USER7> Interesting. I actually appreciate the low standing keyboard height in my setup. My setup is far from ideal, but does have some advantages.

META: why is my 5 ranked post at the top? There's more interesting posts more highly ranked further down. Because it has more comments? To those who care, I think `javan`'s post is the most relevant for somebody looking to make a cheap & easy desk.

</comment></comment></comment></comment></comment><comment><USER9> I use a crank-adjustable base (<http://www.gibraltarinc.com/item.asp?id=66>) and with a birch counter top from Ikea (<http://www.ikea.com/us/en/catalog/products/90014922>). It's easy to adjust and cost around $425 total.

<comment><USER10> Thanks, I've been looking for a crank adjustable base like this. The motor- operated ones seem overly complex for a task that could easily be accomplished manually and the OP's 2 person solution struck me as horribly inefficient.

</comment></comment><comment><USER11> I have a "bar table" from Ikea that works nicely.

<http://blog.ethanjfast.com/2010/08/on-standing-desks/>

Just a warning: I've found that the more I stand, the less I like to sit. Going to class (I am still an undergrad) has become annoying for entirely the wrong reasons...

</comment><comment><USER12> For $120 you can make a permanent standing desk at Ikea. [http://lifehacker.com/#!5508398/repurpose-an-ikea-kitchen- ta...](http://lifehacker.com/#!5508398/repurpose-an-ikea-kitchen-table-as-a- sturdy-standing-desk)

I used a cheap black table top from the desk area. I'm happy with mine. When I need to sit I find a different surface, or use a taller stool.

</comment><comment><USER13> I see all of these solutions to have a giant raisable desk- as a programmer I don't actually use my desk anymore. A desk is a computer, computer monitor, and computer keyboard holder. I normally just make a stack of (free) books or boxes on top of a desk to create a place to set my monitor on. Boxes that still have foam inserts work best, as do books on Java or C.

I use this ballpark-vendor like laptop holder sometimes: <http://www.thinkgeek.com/computing/bags/a988/> The big problem is you have to crane your neck down. I am trying out an artist's easel for a standing desk. Cheap and portable. I Can hold the monitor while I use the connect-a-desk for my keyboard.

</comment><comment><USER14> If you are going to try a standing desk, make sure to buy an anti-fatigue mat. It makes a big difference in how much foot pain you'll experience, even if you are standing on carpet + padding.

<comment><USER15> I agree, some cushioning is vitally important. As I prefer to be barefooted and my floor has no carpet or padding whatsoever my heels started to hurt at the end of the very first day. On the next day I felt that pain from the very beginning, so being productive was out of the question. Contrary to the general consensus I got myself a really cheap gymnastics mat for less than 20EUR which is only 2cm thick, instead of an expensive special purpose mat. Within 2 days the pain was gone and standing/working for more than 10hrs a day was not a problem anymore. So get a mat or wear shoes if you plan on trying a standing desk configuration.

</comment></comment><comment><USER16> Could add ropes and put pulleys on the ceiling with a couple of nautical cleats and make it something that can be done single-handed.

<comment><USER8> I was thinking that you could just install a couple of scissor jacks in the middle and you'd be able to do it yourself as well.

</comment></comment><comment><USER17> My adjustable desk started with this: Monitors in front of tower PC when sitting. When I want to stand, I put my main monitor up onto my tower and get 4 empty shoeboxes which I use to prop up my keyboard and mouse to a comfortable height. I decided that if I really was into the whole 'standing desk' thing I'd prove it to myself by doing this, then maybe one day I could spend my money on a fancy desk, but only after I'd shown that I'd stick to standing while working.

It takes like 30 seconds to move my desk around, I'd be kidding myself if I could justify a $800 desk (if I could even get it in AUS) to save 30 seconds a few times a day

</comment><comment><USER18> I made a standing desk out of a cheap shelf system back in January [1], and haven't looked back. About the only change I've made since putting up those pictures is swapping out the Apple keyboard for a Kinesis Freestyle.

I'd like to build some small shelves off the sides of the top level to add some speakers, but beyond that I've been extremely impressed with making the switch.

[1] <http://elasticdog.com/2011/01/shelf-made-standing-desk/>

</comment><comment><USER19> I used to alternate between sitting and standing. I don't need to any more. The trick for me, figured out by a therapist, was to build the proper muscles, and to _always_ hold proper posture. I find that I can sit anywhere with comfort now, even on the crappiest chairs, because I use my muscles to support me, not the chair. When you stand, you do the same. I've come to appreciate the importance of our muscles and how they contribute to one's quality of life.

</comment><comment><USER20> Damn, that 2 person lifting part really killed it for me.

I guess I'll stick with my "free" standing desk for now - made by stacking 2 existing tables in my parents' basement: <http://d.pr/CG9n> I even get double the surface area for storage on the lower level!

<comment><AUTHOR> Ha ha, ya it works for me. Up or down in less than 15 sec. That's all I really care about.

</comment></comment><comment><USER21> Mine cost about $2,000 more, including a GeekDesk frame and file cabinets, but I like it: <http://bit.ly/d7IH3v>

</comment><comment><USER22> That theme's iPad handler is awful.

<comment><USER23> It's onswipe, and they've just done a deal with wordpress.

I find it really jagged on scrolling and generally annoying enough to be distracted from the articles. Also, what looks like a link to turn it off and go to the old site doesn't work.

</comment></comment><comment><USER24> After it came up in HN comments (by jquery), and despite my protestation of ankle issues, I decided to give a stand-up desk a try.

I spent about $50 on several 2x4's, two pine planks (48" wide x 16" deep for the monitor/laptop, 36" wide x 16" deep for the keyboard/mouse platform), miscellaneous bolts and some poly stain. I'm now using my computer while maintaining proper posture for the first time in as long as I can remember. I plan to buy a $39 'drafting' chair from Walmart for the occasions when my feet hurt.

One important element, by the way, is the fact that my laptop screen and external monitor are truly at eye level now. This has done wonders for my neck. I think this is a major flaw in the linked desk design.

Oh, and it's occurred to me that I could probably design a very functional stand-up desk requiring nothing but Ikea shelving parts, a saw, and some bolts, probably for under $40.

</comment><comment><USER25> a note from poor european: there is this desk that i've been salivating at for quite some time, trully love it for the design, saw it in some danish office - they are very popular over there: [http://www.google.com/search?hl=en&source=hp&q=Works...](http://www.google.com/search?hl=en&source=hp&q=Workstations+EFG+Nostra+Niveau+F) but not quite ready to take the plundge and spend a fortune. on the other hand - im really surprised how expensive these sit/stand desks are - they are no more than couple motors, 2 legs and a table top - why the hefty pricetags...</comment>


Algorithm to gauge how likely a CEO was ousted or faced pressure to step down - <AUTHOR> https://www.wsj.com/articles/did-the-ceo-actually-get-fired-theres-a-decoder-for-that-1502645422 <comment><USER2> A pet peeve I have is when writers particularly journalists use the word algorithm when they really mean heuristic. I understand the word is slightly nebulous particularly in the context of real programs.

See an algorithm both in comp sci and cognitive science always gets the same correct answer but heuristic may or may not be correct and may even produce different results with the same input.

Thus ML is generally heuristic based.

<comment><USER3> afaik an algorithm is literally a logical sequence of steps to produce some output. Whether the output is correct, or approximately correct, or even wrong, is irrelevant to the usage of "algorithm".

Which ofc is why we can say an algorithm is incorrect; correctness is not part of the definition.

<comment><USER4> What you are describing might be called a computational method or process. "Algorithm" has been formalized over the years to have a very well defined technical definition:

To be considered an algorithm, a method must be:

1\. Finite. It must terminate after a finite number of steps. (The program, i.e. the expression of the method must also be finite.)

2\. Definite. Each step must be precisely defined, requiring no 'interpretation' or ingenuity on behalf of the executor of the algorithm.

3\. It must take zero or more inputs, and these inputs must be well-defined.

4\. It must produce one or more well-defined outputs.

5\. It must be an "effective method", which (in addition): 5a. Must always produce a result 5b. The result must always be a correct result 5c. It must always arrive at a result after a finite number of steps 5d. It must work for all defined categories of inputs

This is (almost) literally page 1, chapter 1, book 1 of Knuth. Most probably one of the first things you'll ever be taught on any respectable computer science course.

Of course, the term is used more vaguely and everyone still knows what we all mean, but the above is the widely-accepted formal definition.

<comment><USER5> In computer science, but not in general language.

<comment><USER4> A point I made myself, and I didn't say otherwise. I also clearly mentioned that was the _formal_ definition, not a working definition.

In mathematics and computer science that is indeed the proper definition.

And HackerNews is definitely a mathsy/computersciencey sort of a place, so it might be nice to use the word correctly here.

Out of interest (or is it flippancy?), where do you use the word algorithm, when not talking about mathematics or computing?

Do you consider a discussion about heuristics vs algorithms (which is what this thread is above), on a site like Hacker News, to be 'general language'...? Or would you consider that this might indeed be a suitable context to comment on their proper formal definitions?

</comment></comment></comment></comment></comment><comment><USER6> I have been thinking of Yishan-style CEOs for a while now, including board of directors doing CEO searches publicly. Anil Dash joked about it: [https://twitter.com/anildash/status/893153626247626752](https://twitter.com/anildash/status/893153626247626752)

</comment><comment><USER7> Can someone please explain the verb "to wax" in the sentence "When a release waxes poetic, it can suggest a CEO quit by choice."?

I have checked several dictionaries but I still do not understand what the author meant.

<comment><USER8> "Waxing poetic" is an idiom meaning "talking longwindedly" or "droning on"; "wax" is used to describe talking, but you'll not find it used that way anywhere else.

<comment><USER9> The moon's phases are referred to as waxing and waning, wax being the same meaning in both cases: to grow.

</comment></comment></comment><comment><USER10> Can't read this, it's behind a paywall. Anyone got a link to the full article?

<comment><USER11> you can use this javascript snippet as a bookmarklet:

      javascript:window.location.href = 'https://www.facebook.com/flx/warn/?u='+location.href

and it will let you avoid paywalls

<comment><USER12> Would love to use this, how and where do I set the bookmarklet?

<comment><USER13> Go to the bookmarks manager in your browser and add it the way you'd add a website, with the JS snippet as URL. Then when you navigate to a WSJ piece, click on the bookmarklet to open it with the Facebook passthrough link.</comment></comment></comment></comment>


Elon Musk wants to link brains directly to machines - <AUTHOR> https://www.economist.com/science-and-technology/2019/07/18/elon-musk-wants-to-link-brains-directly-to-machines <comment><USER2> If we can't secure internet connected devices, then what assurance does anyone have that this will be secure and private? Will companies put up billion dollar warranties? Asking because recently there have been security vulnerabilities in pacemakers. This is not where you want RCE's (remote code execution), or in this case, remote patient execution.

<comment><USER3> I think they know that, but humans will do it anyway. And that's sad!</comment></comment>


Norwegian Taxis, Wirelessly Charging While They Wait for a Fare - <AUTHOR> https://www.nytimes.com/2020/08/13/business/jaguar-i-pace-oslo-taxis-charging.html <comment><USER2> I quickly scanned the article, it seems it doesn't address one of the biggest issues I can see right away.

Wasted energy. Phones wireless charging is wasting over 30% of energy. How is this called a green technology if we would have to waste so much power.

<comment><USER3> It's less bad than burning fossil fuels. But yep, it's silly to call EVs good for the environment, the real green alternative is to cut down on cars.

<comment><USER2> > It's less bad than burning fossil fuels

How do you think that electricity will be mainly produced?

<comment><USER3> Norway is a hydro country.

More generally the global shift to renewables (solar, wind) is proceeding rapidly, but is hampered by politics: undertaxed or subsidized supply of very cheap natural gas and coal.

But we need both measures, shift to renewable electricity and scaling down car use, as EVs still have unsustainable co2 footprints.

<comment><USER2> I agree, Norway is in excellent position with hydro as its reliable baseline power source at the scale they have.

Other countries would struggle, and sadly the fission power-plants are demonized to the point of political suicide if you propose to build them. So globaly we are stuck with fossils until a miracle breakthrough in fusion (fingers crossed).

<comment><USER3> Even in nuclear friendly political climates, nuclear is just too expensive and unwieldy due to huge unit sizes, it had its chance in history but is now a dead end due to low cost and rapid improvement in cost per megawatt in renewables.

<comment><USER2> Renewables aren't on demand electricity for the most of cases. Or on required scale to run as baseline for a power grid.

The grid need a way to absorb spikes in renewables production (solar in the day) but also fill in during lows.

Nuclear fission is by far the safest and cleanest way when compared to fossils. Its hardly 'unwieldy'.</comment></comment></comment></comment></comment></comment></comment>


Dropbox employee's password reuse led to theft of 60M+ user credentials - <AUTHOR> https://techcrunch.com/2016/08/30/dropbox-employees-password-reuse-led-to-theft-of-60m-user-credentials/?ncid=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29 <comment><USER2> Troy Hunt's analysis: [https://www.troyhunt.com/the-dropbox-hack-is- real/](https://www.troyhunt.com/the-dropbox-hack-is-real/)

<comment><USER3> ~It's pretty shocking that the SHA1-hashed passwords weren't salted.~

Edit: I misread the article. It says the leaked hashes were salted, but the leak didn't include the salts.

<comment><USER2> Are you referring to _" the bcrypt accounts include the salt whilst the SHA1 accounts don't"_?

I think he's saying that the _leak_ didn't include the salts.

</comment></comment></comment><comment><USER4> This is a really good reason to be careful about what you log to log analytics platforms. I just recently implemented an ETL system that has the credentials (along with other stuff about the job) for data access passed into it from a PaaS framework. While I want to log the information, I don't want to log my DB connection strings! It's very easy to overlook such things and produce them as part of application logging/exhaust without realizing it, especially now that we have mass adoption of things like Splunk, Logg.ly, CloudFront, Cortana Analytics, Elmah.IO, LogEntries, Seq, and a dozen others.

<comment><USER5> > It's very easy to overlook such things and produce them as part of > application logging/exhaust without realizing it

Very true. It is a constant battle between debuggability and not leaking credentials.

In Erlang for example, when processes crash they dump their state, their neighbours, links to other processes, and other such useful stuff. That's very helpful, however it means it could dump credentials as well.

Luckily there a custom function to format the state of a process [http://erlang.org/doc/man/gen_server.html#Module:format_stat...](http://erlang.org/doc/man/gen_server.html#Module:format_status-2) which helps with that. But have to implement that each process which holds credentials.

Also some of those log ingesting services provide a pre-indexer credentials filtering. I know Splunk has it:

[http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Anony...](http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Anonymizedata)

Of course it is better if it is filtered out before that. But it could be a safety net perhaps.

<comment><USER6> >Very true. It is a constant battle between debuggability and not leaking credentials.

And there are so many ways of getting bitten.

Another anecdote for you:

I recently found out that an API wasn't logging errors anywhere.

Easy enough to fix, plug in a library and bam, everything is nicely logged to the database.

Including the HTTP headers.

Headers that include API auth tokens.

 _Ouch_.

</comment></comment></comment><comment><USER7> Its [Current Year] and [Semi-Respectable Tech Blog] still doesn't know the difference between encryption and hashing.

<comment><USER8> Does it matter in this context? What tangible benefit is there for end-use, those that need education the most, to know the difference?

<comment><USER9> I think everyone should know what password hashing is. You wouldn't buy a car without airbags.

<comment><USER10> You wouldn't have an e-mail account without authentication.

You WOULD have an e-mail account without knowing how password hashing works. You WOULD buy a car without knowing how airbag works.

If you think you know everything about every aspect of everything you interact with, you're so clueless you don't even realise.

<comment><USER11> This reply seems a little unhinged in comparison to the preceding comment.

<comment><USER10> The preceding comment suggested that using a website without understanding authentication is like buying a car that has no airbags. That's unhinged. You know those "IQ tests" where they go "the foot is to the leg like the hand is to the..." type analogies? This person would fail hard.

</comment></comment></comment></comment></comment></comment><comment><USER12> > "it does not appear that the encryption protecting them has been cracked"

Please Techcrunch, you are making it sound like you are talking about actual encryption while you are really talking about hashing. From that sentence people would believe that it takes a single "crack" to get them all.

The magic of bcrypt (and hashing in general) is that probably some low-hanging fruits have been picked already while any non-trivial password remains secure.

<comment><USER13> And worse, when you actually need to talk about someone screwing up and encrypting passwords (see [http://www.xkcd.com/1286/](http://www.xkcd.com/1286/) ), this mis-education of your readers will have to be carefully undone first.

</comment></comment><comment><USER14> Not at all surprising. Maybe things have improved, but Dropbox's security was a total joke in 2011-2012. Remember "no password day"? [https://techcrunch.com/2011/06/20/dropbox-security-bug- made-...](https://techcrunch.com/2011/06/20/dropbox-security-bug-made- passwords-optional-for-four-hours/)

</comment><comment><USER15> Glad I deleted my account a while back.

Hopefully all these clouds will pass over and we can get back to personal computing.

<comment><USER16> I dropped it after reading [http://www.drop-dropbox.com/](http://www.drop- dropbox.com/)

<comment><USER17> Because you really like conflating politics with software?

<comment><USER16> Software is more tightly coupled with politics than you think.

</comment></comment></comment></comment><comment><USER18> Are there any decent technical measures to discourage password reuse across sites? Server generates the password?

<comment><USER19> Perhaps someone could come up with a service saying "sorry, this password has already been used somewhere on Internet, are you sure you want to proceed?". Sites would have to adopt it, a-la re-captcha

<comment><USER20> I ask, can we do away with passwords entirely? Trying to defeat computers with human memory seems like the wrong approach.

<comment><USER21> SSH keys all day. They can be troublesome for even an "expert" to look after, so I guess there's no hope for your average idiot. Still, logging in without using a password is the bomb

<comment><USER22> Keys are great until you find a sudden need to log in from your wife's cellphone or a public terminal..

<comment><USER23> opsec 101 - don't use other people's devices / machines

<comment><USER22> Do you never, ever, use devices not in your full possession?

<comment><USER11> Isn't that what you do?

If you have deals with many strangers do you not expect to get your hands dirty in some way?

<comment><USER22> I definitely don't store my SSH keys on stranger computers. I however used passwords on my relatives or customers devices on numerous occasions. Don't pretend you never did, I'm not going to believe you.

<comment><USER23> Sure, I've used other machines in the past. I prefer not to though in most circumstances and assume that any account / password that I use on said machine is compromised from then on.

This was something I changed when I realized that a tax related government agency's machine I was using about 10 years ago man in the middled SSL connections to my online banking. Who knows what was logged and what the retention on that was? I don't have time or the inclination to ensure every relative's / customer's devices are secure, so I use my own or go without.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> If two-factor authentication or single sign-on is not an option, should you force at least partly random passwords for employees to prevent password re- use?

In the past this would have been considered as bad practise, since nobody can remember that kind of passwords but nowadays it is pretty clear that everybody (in IT) is either using some password manager or reusing their passwords between systems.

(And to clarify, I'm not talking about end users of service like Dropbox, but people who are working with security sensitive stuff on the backend)

</comment><comment><USER25> I really wish HIBH would actually _send me_ the data related to my email. I currently have no way of know the current password except by going on to some shady website and downloading a dump. Why not provide the option to send it to the user's email address?

<comment><USER26> Ummmm, wat?

You have no way to know the password you set on sites you signed up with, except from pastes of breaches?

I don't think that's a problem Troy needs to fix...

I think he's chosen very smartly to explicitly and publicly _not_ know anything about the passwords, and only store email addresses. If you think 60mil Dropbox passwords sounds like a spectacular fail, imagine the headlines if an attacker got into HIBP and exfiltrated 1.3_billion_ passwords (or password hashes)! It's be the first "Unicorn credential breach" ;-)

<comment><USER27> Except all those credentials are public anyway, so it has to be assumed that anyone who wants them, already downloaded them.

Unless HIBP is getting its dumps from nonpublic sources..?

</comment></comment></comment><comment><USER28> > Some of the stolen passwords were encrypted with SHA-1, while 32 million > were encrypted with bcrypt, Motherboard reports. The passwords were also > secured with a salt, a random data string added to strengthen the > encryption. Even though these passwords have now been dumped online, it does > not appear that the encryption protecting them has been cracked.

Whenever I've seen passwords stored without a salt it's either because there is no salt or the salt is derived from the username. If it's the latter, it's only a matter of time till the specifics are figured out.

I'd be very surprised if there is a random salt for each of the SHA-1 passwords that's stored separately from the hashes themselves.

</comment><comment><USER29> The report doesn't contain much details, but 2-factor auth might have helped.

What is also not apparent is whether the stolen credentials were utilized to pull off data from the accounts? Users might have had sensitive documents stored!

</comment><comment><USER30> You would think Dropbox doesn't behave like a startup anymore...Proves again that simply passing the responsibilities to a "cloud" provider doesn't fix the security issues.

<comment><USER31> Well, the leak is from 2012. But unfortunately, startups are hardly unique in mishandling their passwords, there are plenty of large companies on [http://plaintextoffenders.com/](http://plaintextoffenders.com/)

At least their passwords were hashed!

</comment></comment><comment><USER32> _> is an evolution of the company's stance on the 2012 incident _

what a nice way to say that they lied before and that they are now finally coming clean - three years too late.

<comment><USER29> > three years too late

From 2012 to 2016 -- it'd be four.

</comment></comment><comment><USER33> Changed the email on dropbox about 2 years ago; seems like i've been pawned on the old email with the same password.

Incredibly poor response from Dropbox on this issue.

</comment><comment><USER34> The email Dropbox sent me was talking about a preventive measure. Did they lie?

</comment><comment><USER35> SHA1 isn't encryption, it's a hash function.

</comment><comment><USER36> Somebody remind me what's justifying those six-figure tech salaries that are pricing everybody else out of the Bay Area?

</comment><comment><USER37> ok thats why I just got a dropbox pop up to change my password :P

</comment><comment><USER38> Oops.

</comment><comment><USER39> Title should say that Dropbox's security procedure provided inadequate security when confronted with well known user behavior.

</comment><comment><USER40> I've been waiting for light to be shed on this incident for a long time, as I have known for years and with zero doubt that invented email addresses used only for Dropbox must have been stolen from Dropbox. I have said so, publicly, too, but I never heard Dropbox admit to a serious incident like this.

<comment><USER41> Dropbox admitted in 2012 that the emails were stolen. The new information coming to light now is that encrypted passwords were also leaked.

Exact phrasing from 2012 blog post:

>A stolen password was also used to access an employee Dropbox account containing a project document with user email addresses. We believe this improper access is what led to the spam. We're sorry about this, and have put additional controls in place to help make sure it doesn't happen again.

<comment><USER42> > A stolen password was also used to access an employee Dropbox account > containing a project document with user email addresses.

The fact that such a document can even exist is plenty of reason to worry about processes and access at dropbox.</comment></comment></comment>


Hacker News horrible logo - <AUTHOR> http://www.horriblelogos.com/hacker-news/ At last a great logo for hacker news! <comment><USER2> I wonder how many of the logo's he gets his kid sister to make and then keeps the beer money.

</comment><comment><USER3> Some of his logos are really good, but most fit the 'horrible' description.

I was tempted to throw some money in and see what I got, until I saw what he does when he's not inspired at all. Some of them are just text on a sheet with no style at all. Forget it.

</comment><comment><USER4> It is a wonderful logo! Let's adopt it and make it our new banner to carry into the world.</comment>