ACIDRain: Concurrency-Related Attacks on Database-Backed Web Applications (2017) [pdf] - <AUTHOR> http://www.bailis.org/papers/acidrain-sigmod2017.pdf <comment><USER2> This is for anomaly detection based on reading logs. It may miss a vulnerability so you still need to test yourself.

I have a Chrome extension which is perfect for race attacks. [https://github.com/sakurity/racer](https://github.com/sakurity/racer)

<comment><USER3> Thank you. This seems pretty neat!

</comment></comment><comment><USER4> On page 11… "Developer's response" section, quote:

"In contrast, the developer of OpenCart responded to the inventory vulnerability by posting a comment—"use your brain! its [sic] not hard to come up with a solution that does not involve coding!"—then closed both the inventory and voucher vulnerability issues and blocked us from responding. "

<comment><USER5> The response seems shockingly arrogant and irresponsible at first. But he is in fact right. A good reminder that people who are unfriendly and argue against public opinion are not necessarily wrong.

I don't know opencart, but I know how it is handled in companies using other onlineshops:

When the stock of an item goes negative, it is noticed by staff when they want to fulfill the order. ("Strange, this customer ordered red socks, but we don't have any").

Staff sets the item as "Cannot be delivered" in the order. Which ups the stock to zero again.

Customer order gets fulfilled with a note "Sorry, the red socks could not be delivered.".

It's not perfect, but also not a big drama.

Same with coupons. You should have them being invalidated _after_ the order process. And if you see the same coupon code used twice, you know it is fraud.

<comment><USER6> The response is arrogant and irresponsible and not necessarily right either. This attitude is precisely the reason why most software is shit that requires constant manual babysitting. Bugs like this are no big deal until they are - even something insignificant as an item missing from the inventory can become a source of drama if you promised exactly this item to your child as a christmas present.

<comment><USER7> I just had a look at the OpenCart issue tracker and its not an isolated incident. There's a bunch of closed issues where the devs were incredibly rude to people while dismissing their concerns. Its true that in many of these cases the issue wasn't with OpenCart, but they could have just said _" This issue isn't with OpenCart, its <blah>, closing."_ Not stuff like (and this is a real comment by a dev of OpenCart): _" you are a moron! svg is not an image format!"_ and then when other people tried to help: _" don't reply to this guy hes a scumbag"_. Riiiiight. Often the issues were closed without response and when the submitter asked why, they get an incredibly rude and arrogant response. I hope I never have to work with these assholes.

<comment><USER8> I reported an issue about them using SHA1 for password storage years ago. I was insulted and attacked personally, called a spammer, blocked, etc. So I washed my hands of the project, when I was considering it for a project at work. (I looked at password security first...)

It's funny, but the dev's response has since "disappeared". Still some ignorance in the thread (thinking that multiple layers of SHA1 was safe) but hopefully history has vindicated my position at that time.

Never use OpenCart for anything. There's no point, when you'll be insulted and unsupported. And don't work with the owner/contributor: [https://github.com/danielkerr](https://github.com/danielkerr)

<comment><USER9> There's quite a few "fun" OpenCart issues listed here whoever is interested: [https://github.com/nikolas/github-drama](https://github.com/nikolas/github- drama)

The dev is indeed really incompetent for behaving like that.

</comment></comment></comment></comment></comment></comment><comment><USER10> While this is cool to harden your transactions, as more locks you add as more deadlocks and blocks appear, and it becomes harder and harder to keep transactions fast and isolated from each other. For example if you do select for update and record is not found, DB should lock key space to prevent adding such records, did you suppose to do this and block other inserts/updates? It's often easy to find problem with transactions in code, but very hard to fix all consequences.

By the way because of this instead of select for update for single record I prefer update with no change. If there is no record, nothing will be locked.

<comment><USER11> Blocking phantom reads/writes is usually only that of a serializeable transaction isolation level - and a range lock shouldnt block other writes, unless they are of the exact range specified, and then you are asking for a consistent view of reality.

Generally I dont find adding more locks hurts things that are well designed - often you will find deadlocks turn into just waiting for your turn in line - and then you can tune your db code or your hardware or your whatever to maximize that throughput.

Also fwiw if you are doing any sort of upsert and you are not locking for the update/insert combo, then you are definitely opening the door to a duplicate key insert - as long as you handle that though, nbd.

</comment></comment><comment><USER12> Along with transactions, I also like to use 'Add' or 'Subtract' operations which usually provide better reliability instead of manually reading and setting, being a source for data races.

<comment><USER10> You may end up with 0xFF items on stock, add/subtract are cool, but not ideal, also negative number is not always more acceptable than exception. I recall FF bug with Civilization [https://www.geek.com/games/why-gandhi-is-always-a- warmongeri...](https://www.geek.com/games/why-gandhi-is-always-a-warmongering- jerk-in-civilization-1608515/)

</comment></comment><comment><USER13> Correct me if I'm wrong here, but wouldn't these attacks be translatable to anywhere there are read/write discrepancies?

</comment><comment><USER14> Does this impact postgres backed applications?

<comment><USER6> Yes! The default isolation level in postgres is READ COMMITTED which is rather weak and allows for the types of concurrency bugs discussed in the article (unless you use SELECT FOR UPDATE or some other kind of locking).

[https://www.postgresql.org/docs/11/transaction- iso.html](https://www.postgresql.org/docs/11/transaction-iso.html)

</comment></comment><comment><USER15> Mobile Friendly View: [http://pdf.cab/openaccess.thecvf.com/content_ECCV_2018/paper...](http://pdf.cab/openaccess.thecvf.com/content_ECCV_2018/papers/Mikael_Persson_Lambda_Twist_An_ECCV_2018_paper.pdf)

</comment><comment><USER16> Very interesting. I wonder if they implemented the nested transactions aspect of 2AD (paper is dated at 2017, and they said they were working on it). That would make it extremely useful in pentesting.

</comment><comment><USER5> Somebody write a TlDr.

You'll be my hero of the day!

<comment><USER17> ABSTRACT In theory, database transactions protect application data from cor- ruption and integrity violations. In practice, database transactions frequently execute under weak isolation that exposes programs to a range of concurrency anomalies, and programmers may fail to correctly employ transactions. While low transaction volumes mask many potential concurrency- related errors under normal operation, determined adversaries can exploit them programmatically for fun and profit. In this paper, we formalize a new kind of attack on database-backed applications called an ACIDRain attack, in which an adversary systematically exploits concurrency-related vulnerabil- ities via programmatically accessible APIs. These attacks are not theoretical: ACIDRain attacks have already occurred in a handful of applications in the wild, including one attack which bankrupted a popular Bitcoin exchange. To proactively detect the potential for ACIDRain attacks, we extend the theory of weak isolation to analyze latent potential for non-serializable behavior under concurrent web API calls. We introduce a language-agnostic method for detecting potential isolation anomalies in web applications, called Abstract Anomaly Detection (2AD), that uses dynamic traces of database accesses to efficiently reason about the space of possible concurrent interleavings. We apply a prototype 2AD analysis tool to 12 popular self-hosted eCommerce applications written in four languages and deployed on over 2M websites. We identify and verify 22 critical ACIDRain attacks that allow attackers to corrupt store inventory, over-spend gift cards, and steal inventory.

<comment><USER4> So, umm... they re-discovered race conditions and gave it a fancy name?

<comment><USER18> The value of tfa is the work they put into practical demonstration and analysis. Anybody can sit in their armchair and speculate about theoretical exploits. It's the actual practical exploits and mitigation techniques that matter.

</comment></comment></comment></comment><comment><USER19> This is awesome! This is another brick in the road to requiring formal methods. Hmm, typed multiple database-call transactions.

Are there type safe database libraries for Idris or Rust?

<comment><USER20> Not what you ask, but squeal is a typed SQL wrapper for Haskell.

<comment><USER21> It's really just an ORM if I'm looking at the project.

<comment><USER20> The ORM part is a thin wrapping that is there to explain Haskell enough to have type-checking. The goal is really to have Haskell type-check the requests you make.

<comment><USER21> Yup and I think it's a noble goal but it's still implemented in a way where you're not writing SQL but some kind of other syntax.

Also the issue is that it's trying to be database agnostic which means that you can't use any of the cool features from your database of choice.</comment></comment></comment></comment></comment>


Go 1.4 is released - <AUTHOR> https://blog.golang.org/go1.4 <comment><USER2> > The most notable new feature in this release is official support for > Android. Using the support in the core and the libraries in the > golang.org/x/mobile repository, it is now possible to write simple Android > apps using only Go code.

This is fantastic! Are there any example Android apps released by the Go team to help get started ?

<comment><USER3> And now things just got interesting. I'll put my money on the availability of Go on Android being the catalyst for its future hockey stick growth.

<comment><USER4> I would be extremely surprised to see a language having no class, no inheritance and no good IDE become successfull in modern app development. Android devs are used to such a different type of programming, i don't expect them to accept banging their heads on so many walls for such little gains.

Ps : my stand is the opposite for server side dev.

<comment><USER5> > no good IDE

LiteIDE is open source, cross-platform and pretty enjoyable. [https://code.google.com/p/liteide/](https://code.google.com/p/liteide/)

<comment><USER4> It's the one i'm currently using, but calling it enjoyable is really excessiv. You can't compile or get any kind of completion while running your program, you can't define a script to be called when hitting "run" ( it always tries to launch your current file). It doesn't have any kind of macro or refactoring features, etc..

Coming from xcode and pycharm, it still feels a decade younger.

</comment></comment></comment></comment></comment><comment><USER6> Damn, another project giving up on Mercurial and switching to Git. :-/ A few more major ones and basically nobody is using Mercurial anymore. How sad.

<comment><USER7> I have never use hg. I don't really see much difference. What do you like about it?

<comment><USER8> There isn't much of a difference. The underlying principles of how they work are essentially the same. However hg has IMHO a more pleasant UI, and it's easier to customise. I believe Facebook chose hg for the latter reason: [https://code.facebook.com/posts/218678814984400/scaling- merc...](https://code.facebook.com/posts/218678814984400/scaling-mercurial-at- facebook/)

</comment></comment></comment><comment><USER9> Even if I don't agree with all design decisions, Go is certainly coming forward.

Congratulations to everyone involved.

</comment><comment><USER10> Can someone give me a compelling reason to start programming in Go? My default language at the moment is C, or C++.

<comment><USER11> Once Go is installed, I can make a simple web app from scratch that displays parameters from the URL or request body in just over 95 seconds with Go, using only the standard library. I can cross-compile it for another OS and architecture, then deploy a single binary file without worrying about dependencies, dynamic linking, or segfaults.

Try doing that in C/C++.

Maybe a better comparison is to more systems-level applications like you might code up in C. The same benefits carry over to those, without a significant performance hit (usually).

(And to be fair, sometimes C/C++ is the better tool for the job. But give it a shot; Go is pretty handy when you don't need to drop down to lots of unsafe memory and CPU operations.)

By the way, your existing C skills will be very useful in Go. For example, struct fields will still be padded unless you pack them carefully. Your experience with buffers, streams, memory allocation, and data structures will definitely not be wasted in Go.

<comment><USER12> You can still get segfaults in Go.

"panic: runtime error: invalid memory address or nil pointer dereference"

<comment><USER13> But you also get a stack trace without needing an IDE and debugger.

<comment><USER14> I've been working with Go daily for a few months now at my job and I'd like to point out that Go stack traces have a really big signal to noise ratio. There is a lot of cruft that mostly nobody cares about and sometimes it can be hard to pinpoint exactly where something crashed (at which line) with a panic.

Just saying, they should probably improve it to be less verbose and more concise.

<comment><USER15> In that case you would say it has a really low signal-to-noise ratio.

<comment><USER14> Yes, you are 100% correct, I dun goof'd. I would edit the post but apparently I can't, so I'm sorry for that. Same for the other person commenting on it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> There is a new range syntax[1]. The release notes say it's rarely used, but makes code cleaner. In which cases would the syntax be useful?

[1] [https://golang.org/doc/go1.4#forrange](https://golang.org/doc/go1.4#forrange)

<comment><USER17> If they added support for `range 10` to iterate 0-9 this would be useful for doing things a certain number of times. Now it's probably mostly useful for emptying iterators.

<comment><USER18> Why do they need to add support for this?

it already exists...

[https://github.com/bradfitz/iter/blob/master/iter.go](https://github.com/bradfitz/iter/blob/master/iter.go)

<comment><USER17> I don't think that would be considered good Go code. It's no shorter than writing out the 3-part for loop, and it is probably slower.

<comment><USER18> what extra operations do you think range on a slice would do? The generated assembly is probably the same. Stylistically it is odd however.

</comment></comment></comment></comment></comment><comment><USER19> Nice. Now all I need is for someone to turn [https://github.com/jcla1/gisp](https://github.com/jcla1/gisp) into a slightly more complete LISP and I'll have a nice environment for all kinds of ARM systems.

Edit: typo/autocorrect

<comment><USER20> this your project? i'm down to do this

<comment><USER19> Nope, just something I've been keeping track of. Needs macro support, for starters, and this fork ([https://github.com/masukomi/gisp](https://github.com/masukomi/gisp)) is adding tests.

</comment></comment></comment><comment><USER21> I wonder why they didn't move the main code repo to GitHub as well. [https://go.googlesource.com/](https://go.googlesource.com/) is somewhat poor compared to GitHub.

<comment><USER22> Because we want a good code review system, and GitHub doesn't have that.

More discussion: [https://news.ycombinator.com/item?id=8715529](https://news.ycombinator.com/item?id=8715529) [https://news.ycombinator.com/item?id=8605204](https://news.ycombinator.com/item?id=8605204)

<comment><USER23> Gerrit looks pretty horrid to use to be honest.

<comment><USER24> Its UI can appear clunky in some ways, but once you get the hang of its nuances code review is very clear and easy to manage.

</comment></comment></comment></comment><comment><USER25> At first glance it seems like you will be able to use go on Android the same way you can use C and C++ through a jni bridge between the java and go code: [https://github.com/golang/mobile/blob/master/example/libhell...](https://github.com/golang/mobile/blob/master/example/libhello/README)

I'm very curious to how the go runtime and GC will work.

</comment><comment><USER26> Now you can write Android application and eventually iOS ( I don't know if I need that ), this is quite interesting. Congrats go team !

<comment><USER27> Did I miss something? I didn't see anything about iOS.

<comment><USER28> [https://groups.google.com/forum/#!searchin/golang- nuts/ios/g...](https://groups.google.com/forum/#!searchin/golang- nuts/ios/golang-nuts/mmB2q8RqB-Y/LDog1d7ZM5kJ)

Quote:

gophers,

I'm happy to announce that the iOS port of Go recently gained full cgo and external linking support.

I've also got a simple C based application working on a real iPad.

The port lives in ios3 branch of [https://bitbucket.org/minux/goios](https://bitbucket.org/minux/goios). Read misc/ios/README for some rudimentary documentation.

The port is Go 1.4+, and it's based on upstream dev.cc branch. I intend to propose for inclusion into Go 1.5 after finding a way to test it (either build each test as an App, or use the open source xnu/arm port). Brad mentioned that inclusion of iOS support might happen in Go 1.5 in his talk the state of the gopher ([http://talks.golang.org/2014/state-of-the- gopher.slide#40](http://talks.golang.org/2014/state-of-the-gopher.slide#40)), now I believe it really will happen.

The iOS port is my first Go OS port, but it's the only one that takes almost 3 years to complete. :)

Go build iOS Apps. Let's see when can we see a Go based App in the store.

Minux

<comment><USER29> I love Rob Pike's contribution to the thread:

 _Ken and I ported Plan 9 to the SPARC in 6 days over one fun Christmas break._

 _I wrote the disassembler (for the debugger) and Ken wrote the assembler, so we could cross-check each other 's work. The hardest problem other than fighting register windows occurred when we both misread the definition of an instruction the same incorrect way._

</comment></comment></comment></comment><comment><USER30> Can you build Android UI using Go? I have not found a good UI library in Go.

<comment><USER31> You can access OpenGL, but the full Android framework isn't directly exposed. It's similar to developing in C++ using the Android NDK.

From the documentation ([https://godoc.org/golang.org/x/mobile/app](https://godoc.org/golang.org/x/mobile/app)):

      An app can be written entirely in Go. This results in a significantly
      simpler programming environment (and eventually, portability to iOS),
      however only a very restricted set of Android APIs are available.

      The provided interfaces are focused on games. It is expected that the
      app will draw to the entire screen (via OpenGL, see the go.mobile/gl
      package), and that none of the platform's screen management
      infrastructure is exposed. On Android, this means a native app is
      equivalent to a single Activity (in particular a NativeActivity) and on
      iOS, a single UIWindow. Touch events will be accessible via this
      package. When Android support is out of preview, all APIs supported by
      the Android NDK will be exposed via a Go package.

Alternatively, you could write your UI code in Java and call into a Go shared library via JNI methods, if you aren't worried about graphics and just need code portability. Again, this is similar to working in the NDK.

<comment><USER30> Thanks for the link. I just read about it. So probably it's not a substitute for Java (yet) right? I guess it's kind of a replacement of C++ for multi- platform games development.

</comment></comment></comment><comment><USER32> Doesn't look like it's been pushed to the canonical git repo or Github just yet: [https://go.googlesource.com/go](https://go.googlesource.com/go) [https://github.com/golang/go/releases](https://github.com/golang/go/releases)

Aside from that, this is yet another great release! :)

<comment><USER22> It will be soon. I'm working on it.

<comment><USER32> Looks like it's up now :) Thanks!

</comment></comment></comment><comment><USER33> What's the current roadmap for dynamic linking / shared library support?

Is this the current one? [https://docs.google.com/document/d/16Y4IsnNRCN43Mx0NZc5YXZLo...](https://docs.google.com/document/d/16Y4IsnNRCN43Mx0NZc5YXZLovrHvvLhK_h0KN8woTO4/preview?sle=true&pli=1)

</comment><comment><USER34> Just to make sure I'm not missing it: fsnotify didn't make it into Go 1.4, right? 1.5 maybe? :)

<comment><USER2> Pardon my ignorance but if fsnotify is not available how is Hugo (static site generator) listening for events in the filesystem (to reload the server)

<comment><USER35> By using platform-specific cgo calls.

<comment><USER36> Probably unimportant for the asker, but go-fsnotify uses syscalls, not cgo.

</comment></comment></comment></comment><comment><USER37> I think they ought to add a one argument version of the copy() keyword to bitwise-duplicate and fix up the pointers on the built-in slices and maps. This would support the copy-change-replace semantic their example for Value follows.

</comment><comment><USER37> "Package glsprite blah blah blah TODO". Okay then :-D

<comment><USER38> I was going to suggest that you report this as an issue at [https://github.com/golang/mobile](https://github.com/golang/mobile), but issues are disabled on that repo.

<comment><USER39> They're using one issue tracker for everything: [https://github.com/golang/go/issues](https://github.com/golang/go/issues) Issues for sub-repositories like this go there also.

</comment></comment></comment><comment><USER40> Mobile development will soon be exciting with the fight Go vs Swift

</comment><comment><USER41> Super!

</comment><comment><USER42> Good god. Seriously, another language. I'm just starting out learning how to program, and I find it irritating that there are so many languages and it's not that easy figuring out which ones you should learn and which ones you shouldn't.

<comment><USER43> focus on

step 1. getting good at solving problems in _one_ language

step 2. get really good at that language. (ie., know how to avoid pitfalls, get best performance, know corner cases)

step 3. learn new languages that expose you to newer paradigms (ie., you know "OOP" languages, learn FP langauges next).

</comment></comment><comment><USER44> And they actually stuck with their go generate design? What an unfortunate mis-step.

Let the makefile's continue.

I've seriously thought about moving to gccgo just to try and get a build system where I can actually inject dependencies on .go files builds again.

<comment><USER28> You seem to be confusing compilers and build systems. You can use whatever build system you'd like and with whichever compiler.

<comment><USER45> Is it possible to do away with the typical Go project directory structure? I thought all that was enforced by the tools, but it's possible that I didn't dig deep enough to uncover greater flexibility.

<comment><USER44> No it's not if you ever intend to type `go`.

The go team has decided that the go language doesn't depend on any build system, but pushes a single build system one that requires source code compatibility and provides no benefit over many existing and easy to use build systems (makefiles, tup, etc).

</comment></comment></comment></comment><comment><USER46> This relatively recent trend of company-specific languages annoys and disturbs me.

I don't ever want to be tied to a language and library ecosystem under the thumb of a single (large) corporation. Not Visual Basic, not .NET, not C#, not Objective C, not Go (It's even named after the company, for crying out loud! Yes it is. Don't try to claim otherwise).

I've used Basic, I've used Pascal, I've used C, I've used Python, I've used Lisp, and so on and so on. Those were open platforms, with different companies in the "lead" position in any one time (Microsoft Basic, Turbo Pascal, Borland C, GNU C Compiler, CPython, PyPy, etc.), but the language was not "owned" by a single company which would _loom_ in everyone's mind, always the unspoken fear being "what if _< company>_ doesn't like it?".

I will not use tools which make me afraid. I will not live a life in fear.

<comment><USER47> I'm generally in agreement, but it's hard to say what languages will be considered "company-specific" in the future.

Go back in time 35 years and C could have been called that "AT&T specific language" Or the opposite: Objective C looked like a hopeful contender to be a widely-used language but it just never caught much traction outside the NeXT/Apple (and NeXT ended up buying the developer) and today it's almost completely associated with a single company's ecosystem.

Maybe in 4 years we'll be talking about the new features coming in "ISO Go19" and complaining that VisualGo still doesn't support all of Go18 yet. Who knows?

<comment><USER46> True, but _today_ Go is still specific to Google. If it really catches on in the way you describe, then it _will be_ a viable language. But not today.</comment></comment></comment>


Doctors warn of alarming C-section 'epidemic' - <AUTHOR> https://www.dw.com/en/doctors-warn-of-alarming-c-section-epidemic/a-45856378?maca=en-RSS_en_Flipboard-9487-xml-media <comment><USER2> Women feel enormous pressure (at least here in the UK) to give birth naturally, from both their peers and health professionals.

How a baby is delivered is none of anyone's business but the mother herself.

My wife (an epidemiologist) deliberated for months over having our second by VBAC (vaginal birth after csection) and opted to go for it, due to the overwhelming expectation from everyone around her that she should do it naturally, and despite having read an Australian study indicating higher rates of stillbirth during VBAC [citation needed]. Sadly, our daughter didn't make it through the labor.

Needless to say, the csections that safely delivered my first, and recently (yay) third children seem like a miracle of modern medicine to us both.

Even before this personal tragedy, I was astounded by the sheer force of opinion surrounding the cesarean section and childbirth in general. This is creating an environment where women are not able to make their own choices and I fear that the doctors in this article, however well meaning, by warning of an "epidemic" are only adding fuel to this fire.

<comment><USER3> > How a baby is delivered is none of anyone's business but the mother herself. > I'm sorry for your loss.

Caesarian's costs the NHS around £1,700 a time compared with £750, for a normal childbirth and women also stay in hospital for twice as long on average. There is a general presumption in the UK that avoiding what is an invasive operation is preferable for both baby and mother alike, in the absence of other factors.

I would argue that clearly How a baby is delivered _is_ other people's business since other people are involved. However the ultimate choice should be the mother's.

<comment><USER4> > I would argue that clearly How a baby is delivered is other people's > business since other people are involved.

This is one major reason to oppose publicly funded health care. _Every_ decision becomes a public one.

<comment><USER5> The situation isn't terribly different for private health insurance. You're still spending out of a shared pool of dollars, and you don't have complete freedom in how you choose to do so.

<comment><USER4> And I would never choose a health care system mostly funded out of private insurance either.

</comment></comment></comment></comment></comment><comment><USER6> This really seems like one obvious way in which we are effecting our own evolution and would not be surprised if in a short time (on an evolutionary scale) that humans will require c-sections for successful birth.

This may not be a bad thing, the reason child birth is so difficult for humans vs most other animals is our head size vs the female pelvis. C-sections bypass the evolutionary constraint allowing more large headed babies to smaller pelvis women which could allow greater head size and perhaps even more intelligence.

[https://en.wikipedia.org/wiki/Obstetrical_dilemma](https://en.wikipedia.org/wiki/Obstetrical_dilemma)

<comment><USER7> Do babies with too-big heads regularly die at birth if C-section isn't available?

<comment><USER8> As far as I know, no, because emergency Caesareans are available (I was an emergency Caesarean - my mother was told I was 'small', and I ended up being close to 13lbs[1]), but it can cause other complications - my sister still has a small scar from a forceps birth, and the recovery time was longer for my mother.

[1] The entire pre-birth care was flawed - at one point they couldn't find a pulse for over 24 hours and they were telling my mother to induce labour (because I was dead...).

Edit: spelling fix

</comment></comment></comment><comment><USER9> In 2015 the WHO has issued this [0] [1]:

>Conclusions

Based on the available data, and using internationally accepted methods to assess the evidence with the most appropriate analytical techniques, WHO concludes:

1\. Caesarean sections are effective in saving maternal and infant lives, but only when they are required for medically indicated reasons.

2\. At population level, caesarean section rates higher than 10% are not associated with reductions in maternal and newborn mortality rates.

3\. Caesarean sections can cause significant and sometimes permanent complications, disability or death particularly in settings that lack the facilities and/or capacity to properly conduct safe surgery and treat surgical complications. Caesarean sections should ideally only be undertaken when medically necessary.

4\. Every effort should be made to provide caesarean sections to women in need, rather than striving to achieve a specific rate.

5\. The effects of caesarean section rates on other outcomes, such as maternal and perinatal morbidity, paediatric outcomes, and psychological or social well-being are still unclear. More research is needed to understand the health effects of caesarean section on immediate and future outcomes.

[0] [https://www.who.int/reproductivehealth/publications/maternal...](https://www.who.int/reproductivehealth/publications/maternal_perinatal_health/cs- statement/en/)

[1] (PDF) [http://apps.who.int/iris/bitstream/10665/161442/1/WHO_RHR_15...](http://apps.who.int/iris/bitstream/10665/161442/1/WHO_RHR_15.02_eng.pdf)

<comment><USER10> Well said, I think where all things indicate it will be healthy normal births should be the default, but when medical risks indicate otherwise than c sections can provide life saving help.

<comment><USER9> Yep, if you think about it, the above advice is nothing but "common sense" and good medicine practice.

The point is that the decision between a normal birth and a C-section is to be taken on a case by case basis by a (hopefully) competent doctor and not "planned" (one way or the other) in advance or decided because of other reasons.

Anecdata, my uncle was a surgeon and he always repeated us that "if it is really-really, and I mean _really_ needed, than go for it, but otherwise never let anyone cut through your body".

</comment></comment></comment><comment><USER11> Relevant counterpoint: [http://www.skepticalob.com/2018/03/what-if-c-sections- are-be...](http://www.skepticalob.com/2018/03/what-if-c-sections-are-better- and-safer-than-vaginal-birth.html).

The article doesn't actually say why C sections are bad, it presupposes that fact, and assumes that rising C section rates must indicate some sort of "epidemic."

<comment><USER12> Caesarians are way more dangerous than vaginal births. A C-section patient can die of pulmonary embolism from the blood clots from the procedure, directly from bleeding (the surgeon can nick an artery or the incision can lacerate during the actual birth), the wound can get infected (it's quite a large wound), and, of course, it's major surgery, so the anaesthesia can kill you (even if you're not all the way under; my wife had a near miss when our first was born). The risks get worse in subsequent Caesarians.

<comment><USER13> You would think this is true, but the mortality rate for c-sections tends to be higher because they are often performed in the presence of other extreme complications that contribute to the higher mortality rate. The mortality rate for non-complication (elective) ceasarian is actually lower.

 _The Birth Trauma Association found that mortality rates are lowest for women who have elective caesareans._ [0]

[https://amp.theguardian.com/lifeandstyle/2017/jan/21/how- ris...](https://amp.theguardian.com/lifeandstyle/2017/jan/21/how-risky-are- caesarean-births)

<comment><USER12> All the link you're providing says is that uncomplicated C-sections are less risky than complicated ones. Sure, that sounds right.

<comment><USER14> Direct quote from the very first paragraph of the article:

> _The Birth Trauma Association found that mortality rates are lowest for > women who have elective caesareans._

The context is comparing maternal death rate for vaginal delivery vs caesarean.

Here's a Telegraph article that goes into more detail, including giving actual numbers: [https://www.telegraph.co.uk/news/uknews/1584671/Women- choosi...](https://www.telegraph.co.uk/news/uknews/1584671/Women-choosing- caesarean-have-low-death-rate.html)

From the Telegraph article, the maternal death rate for pre-planned caesareans is 3.1 per 100,000 women, whereas the maternal death rate for everyone else (natural birth plus emergency caesarean) is 3.9 per 100,000 women (and the original article gave the maternal death rate for vaginal birth at 4 per 100,000 women).

<comment><USER12> I read the Guardian article differently than you did but concede the Telegraph article makes the comparison plainer.

</comment></comment></comment></comment></comment></comment><comment><USER15> My sister-in-law just had her first baby, and got very into all of these statistics and the "medical industrial complex take on childbirth"

I believe the WHO recommends around 10-15% of births should be C-Section in a healthy population, but the figures in first world countries are at least 3-5 times that.

There are about 3 million stories of ladies "booking in" their birth a month or three in advance. I.e. I want my baby on the 3rd of May, lets schedule a C-Section now. It's more convenient that way. Also tons of stories of doctors wanting to go home for the weekend or to play golf, so they do a C-Section after only an hour of labor so they can hurry it up.

It's horrifying that hospitals will market a "natural birth" as anything that is vaginal. i.e. it doesn't matter how many drugs they give you, it doesn't matter what drugs they give you to speed up the afterbirth, etc. etc. It's still "natural".

<comment><USER16> "natural" like half of women dead in childbirth natural?

<comment><USER17> When there are problems, you operate. Otherwise it's preferable for natural birth for mother and baby, for reasons mentioned above.

<comment><USER18> no.

There are a whole host of reasons for having a c-section. The risk of having a massive tear (ie vag to arse(4c tear), or literally tearing a new arsehole) is 1 in 4. This has long term life altering consequences.

An "elective" c-section is not the same as "booking in". The less "identity politics" that are wrapped up in this, the better.

<comment><USER19> No.

> The risk of having a massive tear (ie vag to arse(4c tear), or literally > tearing a new arsehole) is 1 in 4.

Yes and it usually heals very well. The tissue there is made to deal with that. My sister had that happen 5 years ago, it even continued into her gut for a few cm. So that was a very bad case, but it still healed perfectly, although it took about 3 month.

<comment><USER18> ... 3 months. Unless she had corrective surgery then she's almost certainly got some level of incontinence.

There will(or should) have been physiotherapy to get some semblance control back.

Look, there is nothing wrong with a c-section or a vaginal delivery. To make women feel that they are somehow inferior for having one is totally unacceptable. Something like 10-20% of births endup in caesarian, otherwise there is a massive chance of a bad outcome for both child and mother.

Source: wife who is a paediatrician and attends lots of births where the child is in distress.

</comment></comment></comment></comment></comment></comment><comment><USER20> Find it interesting that the article seems to place the blame on the women, when it's long been said that the docs and hospitals, ever in search of time compression and profits, were encouraging c-sections versus vaginal birth. That, to my knowledge, is the likely cause of the procedure appearing "fashionable" and "modern."

<comment><USER21> I actually think it is probably more insidious than that. We have a lot fewer full-time homemakers. Women are much more likely to have paid jobs.

The only way to schedule the birth is by scheduling a C-section. Waiting for the baby to show up when it decides to do so is a very organic, let nature take its course, humble thing to do and it is pretty alien to how most people live these days in developed countries.

Historically, we farmed. We had to figure out how to respect nature and work with it. Most jobs today don't really do that. We think we are in control.

<comment><USER22> Actually historically, we foraged and hunted. After reading _Sapiens_ I'm convinced that _farming_ actually set humans on the path towards this very suffering. Large scale war, famine and pretty much every post agrarian revolution ill, is a direct consequence of having food surpluses.

<comment><USER23> I haven't had my first coffee in the morning yet, so it may be me, but I'm struggling to see the link between food surplus & farming and war?

<comment><USER24> Hunting/gathering/swiddening tribes may have wars but they're just tribal wars, which are more like random murders. Lots of regret but those left alive can move on. In order to get awful generation-destroying authoritarian _war_ wars, you have to have a sovereign. A sovereign requires what James C. Scott has called "legible" surplus. This is a surplus the sovereign can expect at regular intervals in the same locations. That is, fixed agriculture, preferably of grains or similar crops that don't spoil easily but require lots of related industry in order to support life.

</comment></comment></comment></comment></comment><comment><USER25> Interesting article. I also thought that encouraging cesarean sections was something obstetricians did often to avoid the time spent waiting for delivery. However, in my training I witnessed quite the opposite. My resident and attending physicians were very cautious with going forward with cesarean sections, and would do whatever they could to continue with vaginal delivery when the mother wanted that, and also encouraged patients that wanted cesarean to consider vaginal delivery.

Obviously this is one hospital, but it did help me not be as cynical of the profession, and will probably help serve as a reminder to do what's best for my future patients.

<comment><USER26> With the birth of our daughter, we had a different, and more complicated experience.

Pre-delivery there was no pressure to do a c-section. None at all. My wife definitely did not want one.

At the time of delivery, though, there was very much pressure to do a c-section. Although the admitting resident didn't seem to pressure my wife, care was quickly transferred (because of shift reasons) to other physicians (resident and attending) who did.

The way this manifested, though, was sort of subtle. For example, my wife had a procedure done to speed up the delivery; however, as we found out later, we were definitely not sufficiently informed of the consequences of the procedure, one of which was increased likelihood of a c-section. They tried to talk my wife into a c-section, and then when she declined, they tried to talk her into other procedures that would speed up the delivery, and would omit mention of the fact that they were associated with increased likelihood of c-section. Overall, even if c-sections weren't being explicitly mentioned, they were kind of relied on or assumed, for time and convenience reasons. The discussion was sort of like "Oh you don't want a c-section? Ok, then how about X to speed things up? Oh--I forgot to mention that now we probably have to do a c-section? Oops!" It came across as manipulative to me.

My wife did not have a c-section, but this was probably only because the nurses there (who were phenomenal) were actively arguing with the physicians to not do one, and to wait. We weren't really in the hospital that long either.

<comment><USER27> This is a well-known phenomenon called the cascade of intervention: [http://www.childbirthconnection.org/maternity- care/cascade-o...](http://www.childbirthconnection.org/maternity-care/cascade- of-intervention/)

</comment></comment></comment><comment><USER28> My opinion based on living with a midwife for most of my life. Not fair to blame the women for this The reason is more to do with the doctors or medical staff being cautious about complications from a normal birth than caused by the preference of a women for chosing a c section.

</comment><comment><USER29> C-section babies are prone to certain ailments later in life:

"Giant study links C-sections with chronic disorders" -

[http://sciencenordic.com/giant-study-links-c-sections- chroni...](http://sciencenordic.com/giant-study-links-c-sections-chronic- disorders)

My guess is that this is tied to the reduced exposure to the mothers' vaginal and anal microbiome that occurs during vaginal delivery but which is absent in C-section.

Much as childhood exposure to animals reduces autoimmune disorders in later life, natural birth also likely does the same.

"Study: Children who grow up on family farms and drink raw milk have fewer allergies, autoimmune disorders"

[https://www.naturalnews.com/035802_raw_milk_farms_allergies....](https://www.naturalnews.com/035802_raw_milk_farms_allergies.html#)

<comment><USER30> As the article says, the cause is not certain. From some study, higher c-section rate correlates with higher income, so my guess is that it could just be an outcome of better hygiene according to the hygiene theory.

</comment></comment><comment><USER31> I wonder what its correlation with induction is. Artificially inducing labor does not tend to give the body enough time to adjust and progress.

<comment><USER32> Elective induction of labor at 39 weeks results in a _lower_ c-section rate than expectant management (waiting to see if labor will start naturally).

[https://www.nih.gov/news-events/news-releases/induced- labor-...](https://www.nih.gov/news-events/news-releases/induced- labor-39-weeks-may-reduce-likelihood-c-section-nih-study-suggests)

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4049989/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4049989/)

Normally though, induction happens because there is some problem or because the pregnancy has gone past the due date, and in these cases your risk of a c-section is already elevated.

<comment><USER31> Makes sense. As mentioned in the comments, there are different ways of inducing labor. I was referring to usage of pitocin or similar too early in the process, instead of gradually inducing the labor with other medications. We had success with just misoprostol during our labor, but the process was quite long.

<comment><USER32> These inductions would have been primarily pitocin and / or cervical ripening agents like cirvidil.

<comment><USER31> Misoprostol is also a cervical ripening agent comparable to cervidil.

</comment></comment></comment></comment></comment><comment><USER33> Several papers were released as part of a series, and are available currently in full text form:

[https://www.thelancet.com/series/caesarean- section](https://www.thelancet.com/series/caesarean-section)

The more sensational language being reported appears to come from the FIGO position paper rather than the research. I'm not sure about the relationship between the two but they look to have been published together.

</comment><comment><USER34> C section saved the life of my child. I do not care if there is an "epidemic" (what a heck does it mean in a context of a surgical procedure at all???).

<comment><USER35> It means that in some cases the procedure is life saving, and in other cases unnecessary and potentially riskier than vaginal delivery. (Happy for you and your family that your child made it out OK — don't know if it was recent, but congrats nonetheless!)

<comment><USER34> Well I was kind of interested how can somebody use epidemic as a noun for a surgical procedure. There are many factors to this but c-section is often safer for the child than normal birth. I am not sure if there is any problem with c-sections, in my country it is widely used even as an elective option without issues. It is hard to see the downside.

<comment><USER36> Again, study is pointing out that c section is being performed more than necessary, in fact so much more that it's epidemic. From data WHO calculated that about 20% deliveries should require c section. But numbers are reaching to 45%. Bad Effects in children born with c section are un clear and major surgery has risks for mother as well. Doing a surgery when not necessary is always a bad idea. So if you had a good out come, good for you. But understand you're one data point and can not be reflective of what should be.

</comment></comment></comment></comment><comment><USER37> My mother was in labor for over 36 hours (maybe more, she told me but I forgot) in 1976. You know that would be a C-section nowadays. She had two more children after that. I don't know how long her labor was for those but I assume it wasn't as bad.

<comment><USER38> My wife was in labor for 40ish hours in 2016. There was never any pressure for a c-section.

</comment></comment><comment><USER39> Every article I read on c-sections misses some really important facts:

1\. c-section mortality and complication rates are often not separated between the women who get c-sections pre-scheduled and women who get them after hours of damaging labor and something already going horribly wrong. In fact, when I looked at the data for my own c-section, it seemed to indicate that scheduled c-sections were as safe if not safer than vaginal birth.

2\. Vaginal birth leads to lifelong incontinence and sexual dysfunction in many women. Would I take a miniscule chance of death in exchange for not peeing my pants for the next 50 years? Yes. In exchange for having a way higher chance of a pain-free sex life again? Yes. Quality of life matters. Your relationship with your partner and with your own body matters. So many of these studies basically end in the hospital - i.e. did mom and baby survive, but then do not look at long-term outcomes of the MOM at all. I know many women with these issues. Women with horrific tearing and scarring, too. They're still dealing with it years later. It's not trivial even though these studies make it sound like the only thing is whether you live, not how you live.

3\. c-sections do not carry the risk of baby being deprived of oxygen during birth. No risk of cord getting stuck around the head, etc. The people trying to convince me that I shouldn't have a c-section because of very ambiguous studies dealing with asthma or allergies are totally missing the forest for the trees on this one.

Lastly, and this is an experiential point from someone who has actually had a c-section: the whole thing was completely painless. I was on my feet the same day. I only had a bit of trouble going from laying to standing in the first couple of days, but I otherwise was in pain and could walk, sit, take care of the baby, everything else. By the time I was out of the hospital on day 5 I felt completely back to normal and could do anything and everything. Is it major surgery? Sure. But I can tell you that women who had vaginal deliveries were still in pain weeks after the delivery and for months if they had extensive tearing or episiotomies. Most of my friends on the "natural" train, now having done that and seen my experience in comparison, wish they hadn't gone that route because they're still dealing with the damage it caused them.

<comment><USER39> Otherwise _not_ in pain.

</comment></comment><comment><USER40> Thats nothing.. perth western australia has been the csection capital of the planet

Heres 2012 figures

[https://www.birthsavvy.com.au/caesarean-section-rates- perth-...](https://www.birthsavvy.com.au/caesarean-section-rates-perth-2015/)

<comment><USER41> Hello from Perth. Just recently had our daughter at SJOG Murdoch but was not a Caesar. However we went with our obstetrician partially because he was less likely to push towards Caesar and that ended up being our experience. He was happy to wait and deliver late.

We had some non trivial complications though from going natural.

There was however clearly a high rate of those around us but I think basically it's one of the more well known private hospitals for people to visit where you get the choice so plenty of people are just choosing to go that way for various reasons. also we are 30 but most of the people in our prenatal class were older except one.

</comment></comment><comment><USER42> Interesting perspectives from cesarean born people:

[https://cesareanvoices.com/](https://cesareanvoices.com/)

See in particular this presentation by Jane English:

[https://cesareanvoices.com/SHOW-small.pdf](https://cesareanvoices.com/SHOW- small.pdf)

</comment><comment><USER43> Babies ingest vital microbes during natural birth helping kick start their immune system when exciting from the mothers vagina. It also helps to get the babys breathing started. The microbes that babies get in contact with during natural birth help form their gut microbes. Gut microbes are essential to human health. If we eat food from animals that have been given antibiotics or we take antibiotics, we mess with the gut microbe system that prevents us from getting sick.

To clean environment is not good for humans. Ie with a little dirt our immune system is better. That is why for example people growing up on the country side has less allergy.

[https://www.wired.com/2014/04/missing-microbes-antibiotic- re...](https://www.wired.com/2014/04/missing-microbes-antibiotic-resistance- birth/)

The Normal Gut Microbiota: An Essential Factor in Health. Article [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3983973/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3983973/)

</comment><comment><USER44> I know most people on HN are guys, but I've heard a lot of women talk about the peer pressure. In fact some women look down on those that have children via a C-section. It's despicable.

<comment><USER45> C-section all in all hurts more and you heal longer after that and you need more help afterwards. Plus it limits how many kids you can have safely.

The dominance of guys shows up mostly by completely ignoring practical considerations.

</comment></comment><comment><USER46> I'm surprised C-section rates are higher among wealthier, education women. I would assume educated women are more likely to understand the risks associated with C-sections.

<comment><USER47> Heads of their babies are larger, while vagina is same, so higher risk to rip vagina and die, so higher C-section rate.

<comment><USER48> It's not the size of the vagina that's the issue, it's the size of the pelvis. The vagina is extremely flexible. Bones much less so.

</comment></comment></comment><comment><USER49> Years ago c-section rise was due to medical malpractice lawsuits from people like John Edwards, now it's a fashion trend by the well to dos. Wow.

</comment><comment><USER16> Ok so no mention of the health implications of so called "natural" childbirth, which aren't trivial and have an increasing risk as your age. No mention of the rising age of mothers in wealthy countries. No mention of different trade offs for fit 19 year olds and less active 35 year olds. A lot of 30+ women decide they don't want to piss their pants and have painful intercourse for the rest of their lives. Word gets around and it undermines trust in doctors advice when they don't even mention the issues. A higher proportion of doctors make the c-section choice. They're kind of educated, doctors, less likely to be bullshitted into higher, unnecessary fees too.

But you're not an idiot so you want the actual numbers. So did I. Not available, no research done and/or no doctors know of it and can hand you print outs of the papers.

So much for evidence based medicine... There's an epidemic of women not just doing what they're told! FFS Lancet. How's their credibility nowadays? Taking hits?

<comment><USER50> Women have been giving birth since creation with minimal enough problems for humans to survive and succeed as a species - it absolutely is natural, no idea why you put that in quotations. Why stop at C-sections? Raise them in test tubes a la Brave New World, skip the biological process entirely. After all, it's much safer, quite possibly even zero risks on the woman's part.

The thing with C-sections is that until fairly recently, children weren't inoculated with the mother's vaginal canal microbes. Now they know better and do a smear, but that means many children failed to receive a proper immune boost when they needed it most. There's an growing body of evidence that suggests early microbial exposure is required for proper immune development and function, and that the lack of this exposure is linked to allergies and other self-inflicted immune diseases. I can't speak of any data off the top of my head, but perhaps the doctors recommending against C-sections are aware of decades of data on C-sections and childrens health?

<comment><USER51> At a species level yes, childbirth works fine.

Before the modern era deaths of both child and mother were very high (10%+) when giving birth.

That said, the U.S. approach to childbirth is clearly not working, with childbirth deaths at 3 times that of Canada, and higher than the rest of the developed world.

<comment><USER24> Like lots of things in USA this is tied to racism. Whites in USA have risks similar to those of other developed nations. Analysis has found that nonwhite immigrants have largely the same results as USA whites. However, their daughters have the same elevated risks as other minorities in USA. Public health experts don't have any idea why this is, so they're no closer to solving this problem than e.g. the public education system is to fixing its own racist outcomes.</comment></comment></comment></comment>


Study: Most projects on GitHub not open source licensed - <AUTHOR> http://www.theregister.co.uk/2013/04/18/github_licensing_study/ <comment><USER2> Not surprized. github.COM is a commercial venture. I'd expect more open source projects on gitorious.ORG

<comment><USER3> Why would the for profit status of the hosting organization affect the types of projects hosted there?</comment></comment>


Lazarus 1.9 on HaikuOS - <AUTHOR> https://discuss.haiku-os.org/t/lazarus-1-9-trunk-qt4-and-qt5-interface-screenshots/5767 <comment><USER2> I suppose then that Cudatext is buildable there?</comment>


Show HN: Human-readable index of Brazilian Government expenses - <AUTHOR> http://gastospublicos.com.br <comment> eduardo-costa Hey! BR HUE here too! I've made one similar but with election expenses! [http://tomaladaca.org/](http://tomaladaca.org/)

Great Work man!

</comment><comment><USER2> I hope you're proud of your project, that's really great one. ;-)

</comment><comment><USER3> Nice visualizations.

</comment><comment><USER4> Nice :)</comment>


Probabilistic Programming in Quantitative Finance - <AUTHOR> http://blog.quantopian.com/probabilistic-programming-quant-finance/ <comment><USER2> For those confused by the title, Probabilistic Programing = Bayesian Statistics.

<comment><USER3> I was confused by the article not delivering on the title. 1) you can't measure it so "model it" , and throw out fancy acronyms like MCMG and hand- waving.

Just in case anyone's wondering, there are other avenues (read: real science) where BA and other analysis are applied toward a definite result. An actuarial table will accurately predict what an insurance premium should be. These "quant" people are pseudo-scientists, alchemists.

Just ask this question: what results are they delivering ? 2 days ago there was, on HN, a 2010 article about how "investment bankers" don't actually _do_ anything. What does a quant do ? What value do they deliver to anyone ?

Guess what ? I can "model" the statistical distribution of mold growing in my fridge or "monty carlo" simulate the path of rodents in my garage and I've arrived at nothing more substantial in the end. It's a disgrace what these people are doing. Bright minds wasting their talent.

<comment><USER4> > These "quant" people are pseudo-scientists, alchemists.

To a certain degree, you're right. Their job is essentially that of a fortune teller - to predict the future.

Markets are so complex that there is no single 'model' that can predict them. Furthermore, there are always winners and losers, people who lag the market and those who beat it. Coming up with a 'model' to beat the market is essentially the same as coming up with a model to win at poker. You can use statistics and math to inform yourself, but at the end of the day there's a certain amount of the unknown you have to deal with...</comment></comment></comment>


VW supervisory board demands inquiry into diesel fume tests - <AUTHOR> https://www.reuters.com/article/us-volkswagen-emissions-monkey/vw-supervisory-board-demands-inquiry-into-diesel-fume-tests-idUSKBN1FI0VR?feedType=RSS&feedName=businessNews&utm_source=twitter&utm_medium=Social&utm_campaign=Feed%3A+reuters%2FbusinessNews+%28Business+News%29 <comment><USER2> Holy s __* they actually tested diesel fumes on people and monkeys

> On Sunday, German daily Stuttgarter Zeitung reported that EUGT also > sponsored scientific studies testing nitrogen dioxide, a gas found in > exhaust fumes, on people.

>It said around 25 healthy young people inhaled nitrogen dioxide in varying doses over a period of hours at an institute belonging to Aachen University in Germany.

This is what the headline is about.

>The German government said on Monday that any auto emissions testing on monkeys or people were unjustifiable.

Definitely worth the read.</comment>


ES2017's async/await is the best thing to ever happen to JavaScript - <AUTHOR> https://certsimple.com/blog/javascript-equals-async-await?a=23 <comment><AUTHOR> Author here. There's a part II coming later today, focusing on how to refactor an existing codebase.</comment>


Climate Myths You'll Hear This Week - <AUTHOR> http://www.motherjones.com/blue-marble/2013/09/top-climate-myths-ipcc

<comment><USER2> On the whole, MJ is one of the worst sources for news or information on the internet.

<comment><USER3> [http://en.wikipedia.org/wiki/Genetic_fallacy](http://en.wikipedia.org/wiki/Genetic_fallacy)

<comment><USER4> [http://en.m.wikipedia.org/wiki/Straw_man](http://en.m.wikipedia.org/wiki/Straw_man)

<comment><USER3> [http://en.wikipedia.org/wiki/Non_sequitur_(logic)](http://en.wikipedia.org/wiki/Non_sequitur_\(logic\))</comment></comment></comment></comment>


The Guardian also open-sourced a test SSL cert - <AUTHOR> https://github.com/guardian/frontend/blob/master/nginx/frontend.key

<comment><USER2>
      Issuer: C=GB, ST=London, L=London, O=GU, OU=tech, email@example.com
      Subject: C=GB, ST=London, L=London, O=GU, OU=tech, email@example.com

This isn't the Guardian's certificate. It's self-signed, for starters.

</comment><comment><USER3> This is just a self-signed cert.

<comment><USER4> Before everyone gets hysterical, please vote ^^^ that comment up. It's a self- signed cert, it is not used in production:

[https://news.ycombinator.com/item?id=6875023](https://news.ycombinator.com/item?id=6875023)

<comment><USER5> Yep. Though it opens up a (probably hypothetical) potential attack if this cert is widely trusted on, say, Guardian employees' development machines.

</comment></comment></comment><comment><USER6> HTTPS does not seem to be properly configured on their servers anyway, I get an "You attempted to reach www.theguardian.com, but instead you actually reached a server identifying itself as *.a.ssl.fastly.net." error when trying to connect over HTTPS.

That's interesting because they do have content protected by a sign in system. Are they just not using HTTPS for that? I kind of expected more from the Guardian.

<comment><USER7> It's a CDN. CloudFlare operates the same way.

</comment></comment><comment><USER8> Wouldn't this allow someone to do a full man in the middle attack with a compromised server/dns server?

<comment><USER9> If it were the actual cert they're using, yes.

<comment><USER8> Oh I see now that it's just the self signed cert. Awesome :)

</comment></comment></comment><comment><USER10> So now anyone snooping on visitors to Guardian's site can decrypt the communication. Don't see why anyone would waste time on this given that there is no 'money' involved.

</comment><comment><AUTHOR> Yes, just checked now.

</comment><comment><USER11> it's not the real one it's a test SSL cert</comment>


The "It" Crowd Doesn't Like Me and I Finally Don't Care - <AUTHOR> http://juliefredrickson.tumblr.com/post/43321974630/the-it-crowd-doesnt-like-me-and-i-finally-dont-care <comment><USER3> You can curse us all you want. I curse things at random all the time. But then get back to work. The challenge you've briefly engaged with isn't a problem; it's a market opportunity. While the "it" crowd is repeatedly failing to achieve any lasting success with their completely pointless photo-sharing applications running on their 4th successive new storage backend (was mysql, then mongo, then homebrew, now postgres; really, was database-of-the-week really the social scene you wanted an entry pass into?), pick out offerings specifically based on what the "it" crowd would find unfashionable.

See if they're not begging you for jobs a few years from now.

The valley clique isn't a privilege for 20-something men; it's a trap for them. It eats their time, and, at least where it intersects with Hacker News, serves to out people you'll know never to work with professionally.

<comment><USER4> Could not agree with you more. Part of the reason I wrote this was so I could mentally reset myself to get back to work. Frankly I'm embarrassed I got caught in the trap and spent valuable emotional energy on it caring about it in the first place. - <USER2>

<comment><USER5> It might help to think of the Hollywood model. The pretty young men they put out front are the actors and you are the writer. It's been noted before many times that writers don't get much respect, but they are the geniuses who come up with the narrative, the dialog, and the ideas that make up a successful production. Writers usually don't show off well to investors or at parties. That's where the pretty faces come in. I'm usually dismissive of the next young genius on the cover, because I'm more interested in the real brains behind the outfit, who may or may not be marginally social-able introvert living in an eco-bunker somewhere who definitely does not want the attention.

<comment><USER6> Michael Lewis' book, The New New Thing, probably offers a good insight to this. Jim Clark is probably the character that all the choreographers of pretty faces seek to emulate.

</comment></comment></comment></comment><comment><USER7> Generally, being profitable precludes a company from getting "silly [high] valuations" & buzz in Silicon Valley. Unless they're really, really profitable.

Big valuations usually stem from _not knowing_ how much a company will make once they start charging for stuff. So the "it" crowd works itself into a frenzy and VCs take a big gamble.

But once you make a dollar, all the mystery is gone. You're judged & valued pretty much on your revenue alone. Which is usually low (startups are hard) and unsexy (so not a ton of buzz).

Not saying a agree with it. But that's how it is.

<comment><USER8> Interesting. So "Lets not risk growth my premature monetization, like ads, which could repel early adopters." is often just an excuse to avoid income and thereby improve valuations?

<comment><USER9> Not necessarily. The issue is that usually there is no roadmap beyond:

1\. Explosive Growth

2\. ???

3\. Profit!

</comment></comment></comment><comment><USER10> I've never had much regard for Silicon Valley business types. I am convinced that the only thing that truly matters to succeed in tech is to create something that people want but don't necessarily know it yet. Everything else is just fluff.

</comment><comment><USER11> Nice post. I'll take revenue and profitability over media hype and "it" status any day of the week. It's kind of shocking how many early stage companies have absolutely no plan for revenue/profit, and point to outliers like Facebook and Twitter as their playbook for success. There are meaningless debates about 10 millions users being the new 1 million ([http://www.businessinsider.com/10-million-users-is-not- the-n...](http://www.businessinsider.com/10-million-users-is-not-the- new-1-million-2012-8)). To me, it is just indicative of a pervasive sickness in early stage tech. Remember, it doesn't matter how many users you have unless you can monetize them.

<comment><USER12> "I'll take revenue and profitability over media hype and "it" status any day of the week."

All that is fine of course and true. But there are side benefits to "it" status. For one thing it can help you attract talent and get the type of attention that can lead to success.

Let me give you an example. I've helped both high profile people and people who are nobodies with advice. In general the nobodies are much more thankful for the advice (and have even sent me gifts as thank you's). The high profile people say "thank you".

"Name dropping". But the fact that I do the work for high profile people, well, I use that in my marketing to attract paid customers that actually put money in my pocket. And it works.

<comment><USER11> If name dropping high profile people is an important part of your businesses marketing strategy, then it seems reasonable to pursue that <i>if it leads to more revenue/profit</i>

I think OP's issue relates to the weird, self-referential culture of Silicon Valley, where success is measured in buzz and money raised. It goes something like:

Build free software product -> ? -> profit

where ? = Get lots of buzz/hype, grow userbase quickly, raise VC money

Or course, this is similar to another business plan: <http://www.youtube.com/watch?v=tO5sxLapAts>

</comment></comment></comment><comment><USER13> This interview with Girl Talk [1] posted on the thread about Wanz [2] shows, to an outsider, a lot of parallels between the music and startup scenes.

This is likely to have been raised before, but the two are similar in many ways: vast and fragmented with many paths to and definitions of success, prone to fads, full of both hard workers and poseurs, controlled near the top by gatekeepers who pride themselves, correctly or not, on evaluating potential success, jealousy of success, rules that apply to the majority of aspirants and smaller players but not the minority of the very successful, people who look with disdain at others' choices, seeing those choices as more important than they really are, etc.

So it is good to realize that, just as in music, success is context-dependent, and one's popularity with the current stars and hangers-on is a weak indicator of success, and it's good to act on that realization in a useful way, including planting a stake in the ground saying "I'm done with that."

That said, once one's self-confidence and happiness are restored it's also good to not completely reject all aspects of whatever and whoever are popular. Unless someone is a close competitor (in which case they must be crushed or scared off to other pastures ;) ), why not wish for their success and celebrate it? Similarly, conferences are a great way to learn, to teach, and to meet those with the same interests, and so long as attending the conference is not only about being seen by others as attending a conference (or, say, being invited to a panel), and going does not interfere with work, why shouldn't one go?

[1] <http://pitchfork.com/features/interviews/6415-girl-talk/> [2] <http://news.ycombinator.com/item?id=5235168>

<comment><USER14> I live in both worlds and it's funny, bar the obvious differences in technical skills, there are far more similarities, especially with regard to your second paragraph.

</comment></comment><comment><USER15> Lost it at "Liked by the kind of men that determine who is or is not "one of us" in tech.". Silicon valley culture is almost, but not quite, entirely irrelevant to the overwhelming majority of "techs". The number of people active in that scene represent a rounding error compared to the rest of the people working in industry in technical roles outside of the valley. Get out of the echo chamber.

</comment><comment><USER16> What is this mysterious drivel?

Who is brianvan5155 and why hasn't he made any comments?

How has this made it to the front page?

What can it all mean?

<comment><AUTHOR> I'm a web producer and developer. I'm an early commenter from Slashdot, Ars Technica, and Gawker. I've been using online communities for 22 years, longer than some people around here have been alive. I've read quite a few threads on HN and respect this as a news source, and I haven't felt fit to contribute until now.

I've been talking with Julie about her experiences as a like-minded professional and I also remain baffled why her extremely sensible business plan continues to //receive tepid interest// (EDIT: originally wrote "go unfunded" here but I'm speaking inaccurately and out-of-line) despite an aggressive half-year VC campaign while the most harebrained ideas in the world (founded by prep school dudes) seem to effortlessly accumulate resources provided by others... including free press from many of the news sources that get shared here frequently. I believe business leaders in our industry play favorites and manipulate us into believing their partners are somehow better and more deserving than the rest of us... and that it fattens their bottom line and increases their domination of the culture of this industry. I think more of us need to take a stand against this... if not just on principle, but because it's good business and certainly a better plan than the lengthy boom/bust cycles this VC ruling class keeps leading the rest of us through like lemmings, leading to capital shortages and employment drop-offs that starve families and stifle innovation.

So, let's use this as a forum to discuss what may or may not be wrong about this view of things.

<comment><USER17> _remain baffled why her extremely sensible business plan continues to go unfunded despite an aggressive half-year VC campaign while the most harebrained ideas in the world_

Maybe cuz it's an API for social games. No Silicon Valley VC will fund anything that has to do with games these days. Untried harebrained ideas at least don't have dismal track records yet.

<comment><USER4> Heh I'm stoked someone called us an API for social games. Usually people call us wildly less accurate things. YAY!

We are technically a suite of tools (which you know depending on your executional ability is an API, or a set of SDKs, or us hand holding you through using them) for brand managers and marketers to build applications and games with their own data. Layer up content + actions and out pops your very own custom THING.

We have found that there is a huge demand for brand creative, as digital marketing requires more marketing, not less, with newer storylines & media format being demanded w/ever more frequent turns.The advertising agencies are struggling to deliver quality, timely results, and brand managers struggle to afford the associated cost of traditional, all original (or custom) marketing.

We believe that if brands could rapidly create compelling new campaign media by leveraging a standing (and hopefully ever improving) body of component elements with their own brand data and concepts this is a powerful

Obviously this approach is well accepted today in software creation and the good news in we have worked with host of brands to try this theory out in practice- aka in client paid efforts.

Essentially what we're seeing, is if the tools allow quality brand marketing results, that reflect the brand's story telling objective, then the brand manager is satisfied.

If the creative cost & delivery are both materially lower, this is a winning path—and the birth of a potentially formidable new cloud based SaaS business

<comment><USER18> I'm in the industry so I get what you're saying here - but I'm pretty sure most VCs and your customers are going to be mighty confused. You should try and simplify a 'what we do' message that is easier to understand.

The first 30 seconds of introduction to your concept is the most important - make sure people can understand it!

<comment><USER4> Indeed! We've rarely had a confused customer thankfully.

<comment><USER19> This is also consistent with confused people not becoming customers.

<comment><USER4> Heh well yes. Logical win :-)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> Thanks for the blog post and valid point of view. Couple of suggestions on your business: \- I couldn't find your site by googling play api. I think that's a pretty bad situation for prospective investors \- your logo is one of the most unreadable ones I've come across \- your title is very broad and not sure who its targeted at. How about something simpler like "create multiplatform branded games in seconds"

Good luck.

<comment><USER4> Thanks!

</comment></comment><comment><USER17> It's pretty easy to get "liked" by the "it crowd" in silicon valley - you just hire a better PR agent.

<comment><USER21> Or just explicitly bribe people with free cash, free services, etc.

<comment><USER17> That's part of what the PR agent is supposed to be doing.

</comment></comment></comment><comment><USER4> I will upvote my own ramble!

<comment><USER22> And did it serve its purpose?

<comment><USER4> Unburden myself from otherwise useless and unproductive emo feelings? I sure hope so.

<comment><USER23> If only we could unburden ourselves from J2EE in the same way...!

</comment></comment></comment></comment><comment><USER24> Great article but I'm kinda sad that it missed drawing the bigger point: the dichotomy perceived value vs. actual value goes much beyond products and companies; it's something that permeates our entire lives as social animals.

</comment><comment><USER25> Stop worrying about what other people think, and focus on making a great product or service. If you make something great, people will want a piece of it no matter if they like you personally or not.

Also, getting all emo and throwing a public temper tantrum railing against the people whose help you might need someday isn't doing you any favors.

Get back to work.

<comment><USER4> You got it. :-)

Though I admit I wasn't quite expecting a personal Tumblr post to make it to Hacker News.

</comment></comment><comment><USER21> Part of the problem is that the more successful businesses in the traditional sense (revenue, etc) are run by people who, as a whole, are more humble. There are plenty of successful business owners here and elsewhere who feel no need to stroke their ego or fight for mindshare in the glamour of silicon valley.

</comment><comment><USER26> You are right, and thank you for writing this. Our company agreed early on that tech interest wasn't essential for the success of our business. However, I do think it can be useful for finding engineering talent.

</comment><comment><USER27> >>>Being cool has never been about begging to be liked.

>>>It turns out I've got a startup that happens to be a business. You know what that means? We make money.

That second part. _That_ is what is cool.

<comment><USER4> Heh. Thanks. Glad someone thinks it is cool!

</comment></comment><comment><USER28> I've been thinking a lot about this as well. Once you start meeting people and seeing the reality behind the media, you realize that "great" outcomes in startups are rarely perfect (acquihire forced by investors, over-dilution, etc.) and that things aren't always going as well as people say.

In reality, being happy seems to be the hardest thing to achieve, but I'm starting to think that is what success really is.

</comment><comment><USER29> _> Because as it turns out the market for being an "it" founder and a flavor of the week startup isn't the reality market. It is the perception market._

Perception Market. Also known as a "reputation bubble."

(Anyone know where the original "reputation bubble" article went? I've been trying fancy tricks with Google, but getting nowhere. The fashion industry and the "it" girl supermodel are prime examples in the article.)

</comment><comment><USER30> I really wish the author would even once mention _how_ she was warping herself/her company to impress the tech crowd. It's hard for me to understand what she's complaining about without a single example of the type of "how to be popular" advice that people were giving her that she found so poisonous...

</comment><comment><USER31> Get out of the hellacious Silicon Valley and move to Boston. You'll like it better.

</comment><comment><USER32> Any second wasted to popularity, either seeking it, or decrying it, is a wasted second. Enough navel gazing, create some lasting value and reap the rewards.

</comment><comment><USER33> I found the old maxim to be true, "Chase after honor, and honor runs away from you. Run away from honor, and honor chases after you."

</comment><comment><USER34> "It is better to be feared than loved, if you cannot be both." -- Machieavelli

</comment><comment><USER35> Apparently she doesn't care about 5000 words.

</comment><comment><USER36> VC-istan isn't "technology". It's cutting-edge _marketing_ , and only as technological as it needs to be in order to not look foolish in 2013. It took me a few years to understand that, if only because the disinvestment of our society in R&D, academia, and anything with a focus longer than one quarter has reached such completion as to leave our society too imbecilic to have a square sense of what technology even is.

That doesn't mean a company can't be technological _and_ VC-funded, but the "cool kids" sideshow isn't about true technology. It can't be. The VPs and Product Managers are all imbeciles and the engineers, while smart in an IQ- sense, are too steeped in bad practices to know anything. (The Founders are talented marketers but 80% are sociopaths.)

The VC-istan "It" crowd is not comprised of technologists, but of people who've found it advantageous to incorporate technological fetishism into their vapid marketing. The jokers in the in-crowd don't know anything, and the best technologists only tag along to their projects if they can get something out of it... and those sorts of managerial conditions (hands-off management, high autonomy, interesting projects and self-direction) don't tend to last for long.

</comment><comment><USER37> Believe it or not, what follows is meant to be a SUPPORTIVE comment.

> I wanted to be one of those founders, you know, the type that gets silly > valuations and love from the name brand ventures firms, the type that gets > written up by the tech press, the sort that powerful angels vouch for and > send around glowing intros for as being "the next big thing," and the sort > that jets around to conferences.

I truly hope you've come away from all this and understood that _the problem isn't 'them,' it's you._

Once you focus on identity — worse yet, _how others perceive your identity_ — then it's just a hop, skip and jump to narcissism, when 90% of your effort and emotions is about projecting and protecting your identity at the sacrifice of making things happen, or worse yet, forming relationships.

It SOUNDS like you figured that out.

On the other hand, since you've already found yourself vulnerable to _identity focus_ , you should watch yourself and make sure this "I Don't Care!" thing isn't a new way to form a (fragile) identity in need of propagation and defense.

Focusing on other people, and your work, is the way to avoid this trap.

<comment><USER4> Thanks for this! The fact that I got wrapped up in constructing the identity of a company (thank god not the actual product or how we related to our clients) to be appealing to someone that wasn't its core client was definitely my problem and not theirs!

While I can't deny that I was responding to a certain kind of risk/reward perception that has a certain value it wasn't right for what we ultimately wanted to build as a company.

And I think this happens in so many areas of life. How we date, how we pick our hobbies, how we choose our education. Because forming a core identity and a core business is actually tremendously hard. Picking up one that is already socially validated seems easier. It just isn't a recipe for long term happiness or success.

<comment><USER38> Fiona Apple said it best :)

<http://www.youtube.com/watch?v=GSLwYrPbuts>

</comment></comment></comment><comment><USER39> I've been reading Hacker News since 2007. This is the single most worthless post to ever grace the frontpage.

Everyone here should think long and hard about what can be done to prevent a community from degenerating to the point where it is colonized by trivial attention whoring.

In fact, whoever thinks hardest might just make the next billion dollars.

<comment><USER40> What was second?

</comment></comment><comment><USER41> Someone has PMS...

<comment><USER42> Was that you trying to make an ironically chauvinistic joke, or are you just a sexist ass?

<comment><USER4> Heh well you know actually I do have PMS! I'm due to start maybe tomorrow or Tuesday. Wow and to think my epiphany was just hormones. Man those things are useful!

<comment><USER41> Nothing to be ashamed, everyone has bad days. But please DO NOT downplay hormones effect on behaviour. People with Thyroid or other hormones misbalance will disagree.</comment></comment></comment></comment>


Show HN: SimpleCove – Share What You Make - <AUTHOR> http://www.simplecove.com

<comment><AUTHOR> Being a woodworker([http://www.simplecove.com/sean](http://www.simplecove.com/sean)) that was learning django/python, I wanted to build a site that let me tell the story of my projects. Check it out and let me know what you think. Thanks</comment>


PG on the cover of Forbes - <AUTHOR> http://yfrog.com/7chcajj <comment><USER2> Already covered, with comments:

<http://news.ycombinator.com/item?id=1831471></comment>


Wires and Lights in a Box (1958) - <AUTHOR> https://youtube.com/watch?v=RHaV59RB8A8 <comment><AUTHOR> Transcript:

[https://www.rtdna.org/content/edward_r_murrow_s_1958_wires_l...](https://www.rtdna.org/content/edward_r_murrow_s_1958_wires_lights_in_a_box_speech)</comment>