Opmsg – A GPG Alternative - <AUTHOR> https://github.com/stealth/opmsg <comment><USER3> I am not qualified to review how it implements forward security, for instance.

But this shares a lot of the problems that GPG has. It relies on existing mail standards, so it leaks metadata all over the place, and security can easily be defeated by "accidentally replying without encrypting." It's configurable -- every choice you have to make is a chance to make the wrong one. It implements RSA, which nobody should be using anymore.

<comment><USER4> > It relies on existing mail standards

This is a feature, not a bug. Nobody actually wants to rely on a single entity (for or non-profit) for their communication. Nobody wants to be stuck in crappy Electron and mobile clients.

I had some hope that Matrix may be able to alleviate those concerns and provide a modern, federated chat solutions. Unfortunately their quality of implementation seems to be rather low with slow, laggy and resource-hungry clients and ridiculously resource-hungry servers and their current setup still apparently include a single "identity server".

<comment><USER5> Have you used Riot on mobile recently? Sure it's not perfect, but it consistently outperforms FB Messenger on my very poor phone.

<comment><USER4> No, mostly because the Matrix homeserver still needs ridiculous amounts of memory. Apparently 1GB if you want to join one of the more crowded channels – what for could a chat server actually use 1GB of memory?! That's a billion characters you can store in there, even at hundreds of messages per second (which I suppose would make the channel unusable anyways?) you don't get to a billion characters very quickly.

</comment></comment></comment></comment><comment><USER6> Forgive me if I can't read but I couldn't quickly find the following. Is it possible to use Opmsg as a library?

If you want to use GPG as library in your application right now, you can't. The best thing you can do is parse GPG output which is ... less-than-ideal at best and downright wrong and dangerous at worst. If one can use this as a library rather GPG that would be a huge win.

<comment><USER7> I've been reading about crypto lately and [https://download.libsodium.org/doc/](https://download.libsodium.org/doc/) seems to be the goto library for what you're pointing out.

</comment></comment><comment><USER8> The perfect forward secrecy here seems to involve deleting a "persona". I an not sure how that is any different from doing PFS by deleting a PGP subkey. Like with PGP if you do this you lose email archived under that persona. There is no automation to re-encrypt the archive with a different key.

So I am not really sure if this has a killer feature that would make anyone want to go to the bother of abandoning PGP...

</comment><comment><USER9> I think a perhaps unclear part of the recent post "The PGP Problem" is that PGP is bad _for email_.

If you don't use it for email, I don't see it as really a problem. Unless, maybe, you are a reporter or otherwise not clear on the principles behind using something like GPG. I think personally that the point about all the discussion is that for laypeople PGP and email is just too complicated (even for myself as a programmer and evidently for others it is complicated).

In that same vein, I can see how PGP has fundamental limitations with email, e.g.: Having someone's email address does not imply that you have their public key. Is it possible to state in simple terms whether OP's program does to improve this?

<comment><USER10> My understanding is quite different. _Email_ is inherently _insecure_ and there is nothing you can do about it.

PGP is insecure for everything else _as well_

The Latacora article was eye-opening for me on the email problem - <USER2> simply if I send an encrypted mail to a friend / collegue - which I intend them to read, and they read it and quote it to someone else in plain text then that's it - my plaintext and my cipher are available in the wild and my key (my _long term_ key) is effectively broken.

I simply never thought it through that way. But that's how email is _supposed_ to be used - it will be used that way.

Mind Blown.

<comment><USER11> Wait, what? No. Leaking plaintext doesn't reveal your long term key. I definitely didn't write that.

<comment><USER10> I finally got that when someone pointed out that the long term key is not used to encrypt the mail content - i made that leap incorrectly and went from there.

I made the change down thread - was too late to edit the original - and i hope clearly pointed out that your article did not say that

It takes me several run ups to understand most security issues and I got all excited before having my coffee that day.

</comment></comment></comment></comment><comment><USER12> The reality of the situation is that you can't remove the human factor from security. So someone copying your email to someone else is a human problem that can't be fixed - someone could just as easily photograph the screen.

The reality is email will continue to be used, and there is a use case for being able to send an email securely to another person.

EFail was pretty bad, but only affected HTML email.

Having a modicum of backwards compatibility is how to encourage transitioning to new tech, so the RSA implementation makes sense.

I must say this is the first decent alternative I've seen for GPG instead of rants about Signal and specialised tooling that just ignore the issue that folks want to be able to send secure emails to each other.

<comment><USER13> I would love to see a sound implementation of secure e-mail, but I also believe that such a system should not be built on top of SMTP.

Signal's cryptography seems stellar, but to me it feels a bit weird to use instant messaging as a full replacement for electronic _letters_. I'm guessing here, but it would probably not be impossible to build a more traditional e-mail client on top of the Signal Protocol.

<comment><USER14> I don't see why this should not be possible.

Isn't this mainly about adding a a subject metadata field an a client that just displays messages differently, enables sorting into directories and so on?

Is there a real technical difference between messaging and long form emails that I don't see?

<comment><USER15> Email is based on open, federated protocols. Every successful instant messaging service (sorry XMPP) as been a single closed provider.

</comment></comment></comment></comment><comment><USER16> The "MITM on all HTTPS traffic in Kazakhstan" issue suggests that relying on STARTTLS for email encryption isn't that great.

<comment><USER17> To be fair e-mail is garbage trough-and-trough. You can't even use SNI, nothing cares about certificate validity, even less about Staple and CT.

<comment><USER13> How about MTA-STS? I guess that improves the situation a bit, no?

<comment><USER18> Not really. Until MTA-STS is deployed in "hard fail" mode by almost everybody it doesn't matter.

Similarly, SPF/DKIM did not solve spam because nobody was willing to _really drop incoming mail_ with bad or missing signatures.

Email is an "ossified" protocol. It should fade away, and be replaced with something else modern and secure like a "federated Signal".

If that something else allows anyone to send to anyone without permission, it too will be killed by spam.

</comment></comment></comment></comment><comment><USER19> Slightly off-topic, but having the donate button placed first on the page, even before I can read what I'd be donating to, seems a bit greedy.</comment>


GCC 8.2 Released - <AUTHOR> https://gcc.gnu.org/gcc-8/changes.html#GCC8.2 <comment><USER2> > When reporting on mismatching template types, the C++ compiler will now use > color to highlight the mismatching parts of the template, and will elide the > parameters that are common between two mismatching templates, printing [...] > instead

I'll be interested to see if [...] can make instantiation error messages a lot smaller. I hope so.

Also:

> AddressSanitizer integration for std::vector, detecting out-of-range > accesses to the unused capacity of a vector.

<comment><USER3> The most verbose type of template errors I can think of are instantiation errors with multiple candidates and type deduction failures. In these cases there won't be any elision so it won't help much.

I still hope one day we'll see GCC & clang implement some kind of parsable diagnostic output (e.g JSON). Simply folding all the candidates on a UI would be a massive step forward in reading template errors.

<comment><USER4> > Simply folding all the candidates on a UI would be a massive step forward in > reading template errors.

well... that's already what happens if you use an IDE ? That's at least the case on Qt Creator

<comment><USER3> I've heard a lot of good about QtCreator lately, from multiple people, I'll give it a try soon.

Still, some parsable output would be great for many cases, a CI with diagnostic on a web page for example

</comment></comment></comment></comment><comment><USER5> Can anybody comment on the love for Clang vs. the declining importance of GCC? As it seems to me:

GCC supports more platforms GCC creates more performant code

Is it a license thing or a technical driven issue?

<comment><USER6> More performant I am not sure. Would have to see specific benchmarks comparing and the assembly for the newest gcc and newest clang.

The reaosn why I vastly prefer clang is for three main reasons.

Firstly, clang and llvm are written in c++ so it's much easier for me to work with. Secondly, it has proper documentation on how to, for example, add new optimization passes or adding a new instruction. This includes tons of talks and presentations on doing this live. Thirdly, the tooling for it is great, such as clangd, llc, lld, clanggtidy, etc.

Gcc seems to have none of this. Oh, and almost forgot, most importantly llvm + clang is actually open source (more open) via a MIT license instead of gpl.

<comment><USER7> I was with you until the end of your comment: > llvm + clang is actually open source (more open) via a MIT license instead of gpl

How is a license that allows someone or some corporation to take some code, add to it, and make those additions proprietary "more open" than a license that specifically disallows that type of scenario? The GPL ensures that derived code stays open while MIT does not. In my eyes, that's "actually open source". I can see the argument that licenses like MIT allow consumers of some piece of code more freedom to do as they please, but that hardly makes it more open.

<comment><USER8> _How is a license that allows someone or some corporation to take some code, add to it, and make those additions proprietary "more open" than a license that specifically disallows that type of scenario?_

This gets argued all the time. What the corporation did was freedom for them not the code. GPL protects the code, MIT/BSD protects the people. Depending on your definition of "freedom" you will prefer one over the other.

<comment><USER9> GPL protects the freedom of the users of the software.

<comment><USER8> It protects the code which happens to protect the users, but it doesn't let people do whatever they want with the code. Which you prefer is up to you. Using the word freedom is just problematic when there are restrictions.

</comment></comment></comment></comment></comment></comment><comment><USER10> Is there any significant work done on GCC optimizer these days? Most of the changes in recent releases are about nicer error messages (which I love), sanitizers/UB detection (which I also love), new C++ features support (which I think is waste of brain power and time but well, most people like it) but there is little in optimizer department.

From me experience GCC generates by far the fastest code (faster than Intel, Clang and Visual Studio). I realize it's hard to make progress after so many years but I am wondering if there is any promising direction which is researched these days or is it only about small fixes here and there.

<comment><USER11> There needs to be work done, because for my usecases icc is usually a few percentages faster and newer clang almost twice as fast, with proper constexpr support. It's only memset, memcpy though, so who cares.

<comment><USER11> To the downvoters: This is the benchmark where GCC looses big time to clang: [https://github.com/rurban/safeclib/blob/master/tests/perf_me...](https://github.com/rurban/safeclib/blob/master/tests/perf_memcpy_s.c)

My clang compiled memcpy_s is faster than the handoptimized glibc assembler and twice as fast than the GCC version. So with a proper compiler you can get rid of handoptimized unportable optimizations easily. In this case memcpy, but also memset, memmove, memchr, ...

</comment></comment></comment><comment><USER12> This release also fixes LTO bug with large binaries

</comment><comment><USER13> Have they added a way to turn off spellcheck suggestions yet? Compiling with newer gcc feels like some monty python skit:

        #include <stdio.h>
        int main() { retrun 0; }

        $ gcc a.c
        a.c: In function 'main':
        a.c:2:14: error: 'retrun' undeclared (first use in this function); did you mean 'setbuf'?

Say gcc, why don't you try 'setbuf' yourself before suggesting it? Ugh...

</comment><comment><USER14> Meanwhile, RHEL 7 uses GCC 4.8, which first shipped five years ago. How about the Red Hat Developer Toolset? Is that pretty commonly used, or do most Red Hat users stick with the default packages?

<comment><USER15> Lucky you. We're stuck on RHEL 6. That's GCC 4.4. And nobody we knows installs the toolset (I think the target user also needs to have it, because C++ libs?)

<comment><USER16> Nope, your users need not have the toolset, that's the beauty of it! It creates binaries compatible with any distribution newer than the machine where you are compiling. E.g., if building on CentOS 6.7, anyone on 6.7+ can run your binaries.

We also have an application stuck on RHEL 6 because of end-users, and I'm happily using devtoolset-7 which gives me GCC 7.x, and quite a bit of C++17 support :)

Edit: My understanding is that it achieves that by statically linking in the "newer" parts of libstdc++.

</comment></comment></comment><comment><USER11> Tile-Gx is dead? That's sad and a bit early. Afaik MikroTik routers, the fastest routers available, are still selling.

</comment><comment><USER12> And LLVM 7.0 rc 1 soon too - Aug 1 :)

</comment><comment><USER17> Seems like a minor bugfix release, not what special relevance or interest this has

</comment><comment><USER18> Here are the release notes: [https://gcc.gnu.org/gcc-8/changes.html#GCC8.2](https://gcc.gnu.org/gcc-8/changes.html#GCC8.2)

<comment><USER19> Mods: Can you change the submission to point to this instead?

<comment><USER20> Sure thing. Thanks! Updated from [https://gcc.gnu.org/ml/gcc/2018-07/msg00378.html](https://gcc.gnu.org/ml/gcc/2018-07/msg00378.html).</comment></comment></comment>


Silicon Valley is high on innovation. And pot - <AUTHOR> http://www.businessweek.com/articles/2013-02-28/silicon-valley-is-high-on-innovation-dot-and-pot <comment><USER2> Wow. I had no idea.

I have been to college and have had many great times since then with all sorts of artificial stimulation. To this day, I really look forward to weekends and can't imagine a world without (my drug of choice) beer.

But I have never done any of this while working. No drugs, no alchohol, no medication, just a rare cup of coffee.

I have been programming for 34 years in startups, small businesses, and enterprises. And I'm doing my best work ever right now. And I've done all of it naturally; I don't think I would have made it this long any other way.

If my back or wrists hurt, I get up and move.

If I'm sleepy, I sleep.

If I'm hungry, I eat.

If I can't figure something out, I either knock off or work on something else.

The idea of popping the artificial help cherry has always terrified me. I never wanted to sacrifice my natural soul for the sake of any project. I also have this strange Newtonian belief when it comes to personal energy: "What goes up, must come down." (And never without a price.)

My most important tools are my mind and my body, so they always come first, before any emergency, deadline, or impasse. The crisis du jour will soon be gone, but I'll still be cranking along like the Energizer Bunny.

What I do is a marathon, not a sprint. I want to be doing this for the rest of my life, so natural is really the best way for me to go.

Just something to think about before you reach for <whatever>.

<comment><USER3> > The most important tools I have are my mind and my body

Alcohol gives you a buzz by destroying your brain cells. There are better (and smarter) ways to enjoy yourself.

<comment><USER4> >Alcohol gives you a buzz by destroying your brain cells.

That's totally incorrect.

Alcohol INCREASES levels of norepinephrine, the neurotransmitter responsible for arousal. Elevated norepinephrine also increase impulsivity.

Alcohol REDUCES activity in the prefrontal cortex and temporal cortex. This is where decision making, rational thought, memory formation, and aggression suppression is managed.

In large amounts it's much harder on your liver than your brain, but in moderation it's fine.

<comment><USER3> Hm. Thanks for that, I always just assumed that was true.

</comment></comment></comment></comment><comment><USER5> In my experience (that is, anecdotally) i'd say the rate of pot use in Silicon Valley (that is, the tech community) is lower than average. I've seen one startup where employees openly smoked pot in the office, and i've seen pot smoked at parties etc. and a handful of friends smoke every now and then, but it isn't anything near how prevalent pot smoking is in other parts of the USA and the world.

The big one is smart drugs - Modafinil/Provigil and Nuvegil. I met a sales rep at a party who told me the bay area was one of the highest selling areas for Modafinil. That is a bit better than anecdotal evidence that there is something there. On top of that I know[0] that a lot of users are importing it from India using online stores.

There are then the pharma stimulants, adderall and ritalin, spread out through the colleges, where usage rates are high. I knew one person who couldn't wait for each years batch of interns to show up at his company because he knew at least some would have a connect to get Adderall.

Then you get the standard illegal class A stimulants, which I don't think are used any more or less in the tech community than in most other communities of similar social-economic standing (that is to say, quiet a bit).

[0] Techcrunch wrote about Modafinil in 2008, I was at TC at the time:

[http://techcrunch.com/2008/07/15/how-many-of-our-startup- exe...](http://techcrunch.com/2008/07/15/how-many-of-our-startup-executives- are-hopped-up-on-provigil/)

There were a lot of interesting follow-up comments and conversations after it was published, least not the intro to the sales exec.

<comment><USER6> "pot use in Silicon Valley... is lower than average. I've seen ... employees openly smoked pot in the office, ...pot smoked at parties etc. and a handful of friends smoke"

Based on my experience in the DC metro area, pot use in Silicon Valley is FAR higher than here. Aside from a few friends who smoked in the their teens and early-20s, I don't see it much at all.

Maybe DC is even lower than average because of the high concentration of government jobs (and the accompanying clearance process)?

<comment><USER7> By comparison, DC is a pretty conservative area for precisely the reason you mention.

The fact that so many tech jobs require clearances causes engineers to self- select in or out depending on their temperaments and leanings, as well as curbing the behavior outright.

Compare to California, where it is largely decriminalized and possible to acquire legally and it's no wonder there is a significant difference.

</comment></comment></comment><comment><USER8> Like many others will likely comment, I'm a huge advocate of the legalization of marijuana. I smoked quite a bit of it in my younger years. I could go as far as saying I was a connoisseur. These days I find it cripples productivity and turns me into a zombie. I stay away from it.

This leads me to conclude that this article is total shit. I honestly can't name a single engineer, designer, or writer I know who regularly smokes pot. Yet this article ends with the following line: "There is a raging culture of marijuana use among tech workers in Silicon Valley."

How this was allowed to be published is beyond me.

Edit: A better story would have been "How Silicon Valley is high on innovation. And Adderall."

<comment><USER9> You may not know many people who regularly smoke pot _because_ you "find it cripples productivity and turns me into a zombie. I stay away from it." You may be seen by users as either hostile, or at least not obviously friendly to their activity, so they self select you out of that information.

I think similarly, people who are anti-gay don't _seem_ to know a lot of gay people, despite the fact that N% of the population are gay.

<comment><USER10> Completely concur with your observation, except your analogy with gay people (something beyond one's power of choice) is somewhat uncalled for.

<comment><USER9> But in both cases one can choose to let it be known or not. You can choose to share that you smoke or not, and you can choose to share that you're gay or not. It's that choice to share information or not that I'm talking about.

</comment></comment></comment></comment><comment><USER11> Episode three million of "People With Money Are Somehow Still Surprised The Bay Area Is Weird".

See also: the Priceonomics blog post that was _shocked_ to discover that hippy street kids in Golden Gate Park are pretty content with their lives.

Next up: "Sex Parties? Isn't that dangerous?"

<comment><USER12> Probably far less dangerous than political parties.

<comment><USER13> Likely far more fun too.

</comment></comment></comment><comment><USER14> Another throwaway here.

As a random anecdotes, I was an opiate addict (Heroin mainly) for the last six years, while working as an engineer. Not in the Bay area mind you. As weird as it sounds, opiates help(ed) me focus. I was a very functional addict.

Nowadays I'm clean (have been for the past 9 months), well sort of. I'm on suboxone. It still helps me focus, helps with my severe depression, and is legal and literally 50 times cheaper per day.

I have weird brain chemistry however; opiates don't perk most people up. It makes me laser sharp. However, Heroin has so many other negative effects, it's not worth it financially and legally.

I don't suggest others follow my path, it's too dangerous and a consequence of my idiot 16yo self. But I'm doing great nowadays. Just wanted to add my odd anecdote to the pile.

<comment><USER15> I know this is silly but is SHA-1 of your StackExchange username 28a0b3fe0e151fefc417ad7d526b99d726d0f319?

<comment><USER16> Don't answer this question. This is trivial to reverse.

</comment></comment></comment><comment><USER17> I see far more people abusing "focus" drugs like ritalin as opposed to smoking pot. I guess I have a few friends who still smoke on a regular basis, but most of my social circle pretty much stopped after college.

I personally can't stand being high. It gave me minor panic attacks and made me super anti-social. Not my thing, but I'm all for adults making their own decisions. I can't imagine any top tech company ever enforcing an anti-drug policy, especially outside of work.

<comment><USER18> I found myself surprised yesterday reading the thread about Harvard[1] when 2 people brought up how much Adderall is abused there, how easy it is to acquire, etc.

Can you remark on exactly how much medicine otherwise prescribed for ADHD is abused by people in the valley? Is it 1 out of every 10 employee at Google, for example? Is it mostly concentrated in startup settings?

[1] <http://news.ycombinator.com/item?id=5311168>

<comment><USER19> Might not have very good data from self-reporting, especially in the workplace.

</comment></comment></comment><comment><USER20> It seems we have finally solved the mystery that is Adobe Systems Incorporated.

That said, this article seems to be heavily biased by what is simply local proximity and highly educated clientele.

<comment><USER12> Also, the San Jose dispensaries are so badly run as a legal experiment -- way too many, shadiness, etc. Oakland has done a much better job. No one in the pot industry holds up San Jose as a model.

</comment></comment><comment> guard-of-terra "The Silicon Valley data support recent news reports citing some employers who say they are having a hard time finding candidates that can pass the preemployment drug test,"

I never lived in North America but I want to say that if I wanted to get a job and the employer would suggest me to pass a drug test, I would be extremelly offended and my human rights violated, and I'll tell them to eff off right away.

It's just so humiliating in my opinion.

I'm a software developer not an airplane pilot.

<comment><USER21> In most job markets in the US, refusing a pre-employment drug test would make you literally unemployable, from the crummiest fast-food/retail job, to middle/upper-level management.

<comment><USER22> People I know in industries that require drug tests get panicky when they have to take one, but somehow they never fail them. Apparently the tests aren't very sensitive, and mostly screen out only those who refuse to take them.

<comment><USER23> Yup, and you definitely don't want those annoying people who actually value their privacy and restriction on employer control over their lives!

Drug tests are an effective filter to ensure you have a compliant work force.

</comment></comment></comment></comment><comment><USER24> Very silly article. Yes lots of programmers, good and bad, smoke pot. No, there are not very many good programmers who think they can write good code while high.

<comment><USER25> For me it's not a matter of coding while high, but pot does make me a more effective programmer overall. When stuck with a hard problem, smoking allows my creative side to come out more, and attack the problem from angles that I couldn't even consider while sober. Sometimes that doesn't work, and I go for a run. Sometimes that doesn't work, and I just need time.

But pot remains a primary tool in my toolbox for tackling difficult programming challenges.

<comment><USER26> I call it an "abstraction-enabler" and also appreciate its ability to help me understand complexity. It's not something I find effective while pounding out code (alcohol neither): that's what caffeine is for.

<comment><USER24> dougk16, yesimahuman -- you're right, I didn't mean to imply that it couldn't sometimes be good for thinking about things, including hard things.

</comment></comment></comment></comment><comment><USER27> s/Silicon Valley/California/

If you want to do it fine, I don't do it, but I'm ok with people doing it.

I'm even ok with decriminalizing it.

But don't pretend it's for your wrist pain.

Edit: What about this map "proving" dispensaries are mixed with their "customers". A simple machine learning algo can split the two and point some outliners there...

<comment><USER28> >"But don't pretend it's for your wrist pain."

Then let's pass laws so people don't have to pretend.

<comment><USER29> But then you won't buy alcohol.

There's people near Capitol Hill that would rather that didn't happen.

<comment><USER30> So if they banned nicotine, there would be more people buying alcohol?

<comment><USER31> No, people like to use alcohol and nicotine in combination.

<comment><USER32> There's also plenty of people who say that you need all three for a proper party.

</comment></comment></comment></comment></comment></comment><comment><USER33> about the UX of that site: did anybody else experience (latest chrome stable) the

* "scroll blocking" JS execution on first pageview * jump back up after all JS was loaded

for me it's unbelievable that we finally have really, really, really powerful JS engines in our browsers, and all we can think of is to make the UX experience of users who want simple things (like reading an article) worse.

<comment><USER34> "on first pageview" at least seems to imply that you can scroll at all. On Opera (with Ghostery and AdBlock), it doesn't work at all and I can read as far as 'you can drop by the Palliate'.

So, uh, it's a great article, albeit a little short…

</comment></comment><comment><USER35> I'm in favor of legalization, but I'm very much against public pot smoking being a thing. Pot smells about 10 times worse than tobacco smoke and tobacco smoke already smelt awful.

<comment><USER36> I've never seen anyone else with this opinion.

Cigarette smoke is bad. Stale cigarette smoke is worse. Cheap cigar smoke is disgustingly awful.

But pot smoke? It's not especially bad, and it's not especially strong. Very distinct, but on the scale of offensiveness fairly low.

Maybe you've been around people smoking with cheap tobacco blunt wraps? I dunno.

</comment></comment><comment><USER37> "Marijuana use is "extremely common" among tech workers, says Mark Johnson, 34, chief executive officer of Zite, based in San Francisco."

I've been in tech for 20 years now and never came across anybody on pot or any other drugs for that matter. Maybe I'm living in some kind of bubble or something, but my reaction to the above comment is that he's got a drug problem in his company.

<comment><USER38> Most people who smoke don't tattoo it across their forehead you know.

</comment></comment><comment><USER39> "The long hours sitting at a keyboard can cause back and wrist pain."

Is this really a common problem?

<comment><USER40> Only if you have a really bad chair and computer desk.

On a side note, drugs are for drug dealers and losers. Only one benefits.

<comment><USER41> > On a side note, drugs are for drug dealers and losers. Only one benefits.

So I take it you don't drink alcohol or use caffeine?

<comment><USER40> I did a while, it only gives me trouble like headaches for coffee and mood swings with alcohol.

<comment><USER30> It's weird how marijuana gets grouped with all the hard drugs when it's far less toxic than alcohol, nicotine, or caffeine. You can die with less than 250ml of 200 proof alcohol (about 1 cup), 60mg of nicotine (around 60 cigarettes), or 3 grams of caffeine (around 15 bottles of the 5 hour energy drinks). However, you'd need to consume around 1000lbs of marijuana to kill yourself. 1000lbs would probably bankrupt most people -- it's around $4M.

I doubt anyone in the modern age can claim they have never used drugs before. Most of the OTC drugs at the pharmacy can be more damaging to your health than alcohol. The only people who can probably claim to be drug free are those who claim to heal with prayer.

<comment><USER42> Marijuana is a Schedule I controlled substance in the US (the most restricted set), while cocaine is a Schedule II controlled substance. The US government considers marijuana to be a _harder_ drug than cocaine. There is no logic to this stuff other than:

\- Drugs Are Bad Mmkay(tm)

\- I don't need no 'scientists' to do 'studies,' because everyone knows that Drugs Are Bad Mmkay(tm).

\- Since Drugs Are Bad Mmkay(tm), I can't allow a drug to go _down_ in the rankings, only up!

\- If a drug _were_ to go down in the rankings, it would be political suicide. Political/religious/etc opportunists would come out of the wood-work to ply their silver tongues and attempt to get the general public to tar-and-feather those responsible (while benefiting the opportunists immensely, of course). \- Even if I wanted to allow a drug to go down in the rankings, it would be political suicide

</comment></comment></comment></comment></comment></comment><comment><USER43> So is Jennifer Lawrence, an award winning actress. There's groups who could benefit a lot more from this kind of pain relief just in the states it's legal in, while programmers and actors are the main groups of California.

<comment><USER44> > So is Jennifer Lawrence, an award winning actress.

I'm fine with the legalization of marijuana, but as an appeal to authority, that one gave me a chuckle.

<comment><USER45> Esp for this crowd.

</comment></comment></comment><comment><USER46> I love that Bloomberg Businessweek includes a TLDR for their one page article.

Right at the bottom, too, so you don't know it's there.

</comment><comment><USER28> What this map doesn't highlight: all the ghetto / somewhat ghetto areas on the map with multiple families living in a 1br apt because that's the only way they can afford the $2k/month rent.

I'm sure none of those people smoke trees, though.

<comment><USER47> I'm sure they do, and at the same frequency of most all income brackets. The rate of usage across classes is pretty flat.

</comment></comment><comment><USER48> Fuck this article and all of the instances of New York trivializing the tech industry. Seriously. Bravo comes in and creates the most ridiculously inaccurate depiction of creating a tech company one could ever imagine. And Bloomberg, which owns Businessweek, is writing articles like this. This is getting ridiculous.</comment>


Should This Be the Last Thing You Read on Academia.edu? - <AUTHOR> https://www.academia.edu/16959788/Should_This_Be_the_Last_Thing_You_Read_on_Academia.edu <comment><USER2> Corporations being central to the operations of academia is bad news. It's bad now with Elsevier and its ilk. It'll be bad in the future if Academia.edu starts mattering for tenure.

Here's the solution. It's a steep climb.

Persuasive academics need to start convincing people with money to donate millions and millions to not-for-profit collaborations of universities and government research entities to start open research and open-source journals. Truly altruistic people need to start and run these journals, convinced of their mission of providing open research to all the world. They need to be motivated by the mission. The money needs to be there too. But given the choice between optimizing selling widgets for Amazon, or providing the world with free access to all research the world over... what job would you choose?

The gov't could support it too, but I'd rather their support go towards actual research than a collaboration. There's too much bureaucracy when you take money from the gov't.

</comment><comment><USER3> So the central argument seems to be that Academia.edu profits from the patterns of access and related metadata that academics generate as they do their daily work. Academia.edu then sells this data to private R&D companies to point them in the direction that the academics are moving.

Even after reading through this paper, I'm not convinced that this is inherently a bad thing. Many corporations ( _cough Elsevier cough_ ) profit off the backs of publicly-funded academics in much more pernicious ways.

Now, if Academia.edu were allowing companies to purchase the specific page- views of specific researchers (or allows subsetting the data specifically enough to target one group with decent confidence), then that would be very damning. I suppose I should go re-read the privacy policy: [https://www.academia.edu/privacy](https://www.academia.edu/privacy).

<comment><USER4> While I'm sure there are antecedents, going as far back as Heinlein in the '50s, making use of the firehouse of information being produced by academics and researchers has been identified as a _big_ problem. If Academia.edu can help with this, without doing objectively evil stuff, more power to them.

</comment></comment><comment><USER5> Centralisation of process isn't just about dollars for data. Yes, for the business model to work, the company has to gather a lot of data that it can look at all at once. But that's perfectly possible to do through a network of services, even services you don't own. See ad-servers.

Centralisation on the product level – that is, all activity happens on this particular piece of user facing software – is also a function of ease of use. If a thing is being accomplished by a distributed set of different interfaces, each with their own rules of the road, then there's significant pain for the end user in navigating all of that. In this way, good UX is naturally monopolistic.

Disclaimer: I briefly worked for Academia.edu a few years back.

</comment><comment><USER6> Anyone have a link that doesn't require a signup?

<comment><USER7> I just had to scroll ...yet to read the thing though.

<comment><USER8> Yeah, took me a while to figure that out. The page resizes to fill 100% of your browser window, with the little "Read Paper (down arrow)" link a slightly different shade of gray vs the background. Kind of shady really.</comment></comment></comment>


Ultrasound destroys 80 percent of prostate cancers in one-year study - <AUTHOR> https://newatlas.com/medical/ultrasound-destroys-prostate-cancers-one-year-study/ <comment><USER2> As someone whose family member recently just received a test showing elevated PSA levels (Prostate Cancer indicator); this article is a very real blessing.

# Baseline issues with prostate cancer that suck.

1\. Don't treat a benign version and possibly live with trouble urinating and follow on problems from that.

2\. Don't treat a malignant version and die

3\. Treat it and potentially be impotent

4\. Treat it and end up with bowel dysfunction

5\. Treat it and rehab through surgical scars looking like an upside down T from following from belly-button to waistline or a U shape around the rectum.

6\. Of course there is some tail risk of much much worse situations; and while it's worth remembering, it's not worth enumerating.

# TULSA method

So while this method is not different - it includes things that suck... if you read further upstream of the newatlas article to RSNA primary source [1] you will find that not only do they insert a spinning ultrasound device up the urethra - but it also includes a simultaneous insertion of an endorectal cooling device(ECD)[2]. Given all that: the parts that suck about this method pale in comparison to the traditional list of 6 above.

# Conclusion

There is much to be squeamish about with this method, as with any prostate remediation methodology; but if applied under careful care of patient and doctor - this looks like a very promising prostate treatment. And as a family friend once put it to me: "Welcome to the world of cancers; where pretty much everything sucks."

[1]: [https://press.rsna.org/timssnet/media/pressreleases/14_pr_ta...](https://press.rsna.org/timssnet/media/pressreleases/14_pr_target.cfm?id=2129)

[2]: [https://press.rsna.org/pressrelease/2019_resources/2129/fig_...](https://press.rsna.org/pressrelease/2019_resources/2129/fig_1.jpg)

(edited for formatting)

<comment><USER3> By the way, your family member is probably aware of this but there is another ultrasound treatment option for prostate cancer that is completely non- invasive. It is called hifu.

[https://www.hifu-prostate.com/](https://www.hifu-prostate.com/)

Hifu sends ultrasound from a curved emitter from outside the body in such a manner that the ultrasound ray will be focused on the treatment area. Thus, while you have ultrasound going through your body, only in the treatment area does it become high intensity enough to actually destroy tissue. This way they can burn off cancerous parts without damaging other parts of the prostate and the rest of the sensitive parts around there.

I am not sure why the new atlas did not mention HIFU, it also uses MRI.

HIFU is already cleared by the FDA, and it will become approved by medicare very soon (this coming January, I believe), so it will be paid by medicare and probably most insurance plans (as they tend to follow medicare).

<comment><USER4> Can confirm and sing the praises of HiFu.

Went to China so my spouse could have a procedure done in 2014. HiFu took 1-2 hours and my wife walked away from the procedure. She was hiking the next day.

Tumor was shrinking almost immediately.

The alternatives we had were surgery that would have removed part of her abs or weekly treatments of [https://en.wikipedia.org/wiki/Tamoxifen](https://en.wikipedia.org/wiki/Tamoxifen)

Neither of which was great.

Now we had to pay for the HiFu but it was soooo worth it. I think it was about $25,000 USD so very reasonable and affordable for us.

<comment><USER5> For which cancers does this procedure work (assuming your wife didn't have prostate cancer)?

I understand 25 k USD feels reasonable if it saves your life without surgery and it's complications, but it steep for "just ultrasound". Do you know why it was that expensive?

<comment><USER6> MRI is probably the major technical cost. It's fairly high touch and the magnets wear out, so the capital cost of each test is fairly real. That and the professional component. Interventional radiologists are very much in the consultant/handyman/engineer business of "Treatment: $1; knowing where to put it: $9999"

<comment><USER7> In Japan an you can get an MRI for $160 US I hear

<comment><USER6> Do you get the radiologist's read for $160? Do they put an ablative ultrasound probe in you and hold it for an hour for $160?

<comment><USER7> Honestly I'm not sure with the 160 covers. It's just another one of those things in our medical system that is priced a bit too high to make sense for a good number of folks. I would like to see healthcare be more accessible.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I did my Masters' thesis with the group that invented and developed this in Toronto. I know some of the co-authors on the paper personally since we worked together.

AMA.

<comment><USER9> Is there any chance that these techniques could be equally effective for other cancers? For example Liver, Kidney, Lung cancers?

<comment><USER8> Yes, very much so. Ultrasound in medicine is very cool technology. Obviously many of us have experience with ultrasound imaging, which has revolutionized medicine in a number of ways. But we also learned that if you crank up the amplitude and frequency, you can heat the tissue. Our research group was one of several that figured out that you can use MRI-based thermometry to measure that heating, and use it as the input to your control loop. Then, it's a matter of adjusting the frequency, amplitude, and positioning (i.e. in this case, rotation) to "paint" your heat pattern.

Thus, at least at our site, it was used to develop treatments for uterine fibroids, some types of breast cancer, and some types of brain cancer (using transcranial ultrasound, which is much harder to do because you have to go through bone and adjust for that medium). Generally, areas that you can reach from the skin and/or with a special probe, are potential treatment targets.

Lung cancers are hard to treat with ultrasound, for a few reasons. The biggest is that it moves, which makes it hell for the MRI and system as a whole to keep up without hitting unwanted areas. The other is that ultrasound doesn't travel well through air. For ultrasound ablation to work, you need a good conduction interface. That's why ultrasound technicians slather that clear gel on you when they're imaging you. It's possible to do in the lungs, just exceedingly difficult. It's unlikely that someone will commercialize something there.

The liver and kidneys won't be targeted either because the only way to reach them is by performing an incision. You might as well use other techniques like laparoscopy.

<comment><USER10> Would transcranial ultrasound have the problem of unwanted hotspots because of reflections and a focusing effect of the curvature of the skull? I would assume that this could only be done by scanning the head with a MRI, modelling the tissues in detail, simulating the process and then constructing a wave front from many emitters that does what one wants. Ideally all of that in real time as I guess the heating process will change the properties of the treated tissue in a way that would require it.

<comment><USER8> Precisely. See Ultrasound attenuation coefficient ([https://en.wikipedia.org/wiki/Attenuation#Attenuation_coeffi...](https://en.wikipedia.org/wiki/Attenuation#Attenuation_coefficient))

You'll note that it's measured in dB/(MHz-cm), and that soft tissue is 0.5, while bone is 6.9. Just like light, anytime ultrasound hits an interface, there are reflections and refractions. Furthermore, since bone attenuates ultrasound so much, you have to increase your amplitude greatly (and even more so with higher frequencies) in order to get enough thermal energy to be deposited at your target. If you don't do it right, you can create dangerous hotspots at the bone-tissue interface, and you can also deposit energy where you didn't intend to. Given that ultrasound therapy intends to be more precise than other techniques, you're kind of defeating the purpose!

Edit: in response to your edit, yes that's exactly what they do. They create an array of transmitters to be able to precisely target various locations within the skull. It wasn't my area of research, but I'm pretty sure they used them to create interference patterns as well, so many emitters were activated to work in concert to target one area.

See this image: [https://sunnybrook.ca/uploads/1/_research/about/fus/3-ultras...](https://sunnybrook.ca/uploads/1/_research/about/fus/3-ultrasoundbraindevice.jpg)

</comment></comment></comment></comment></comment><comment><USER11> My father and brother both got prostate cancer, the effects of surgery are life changing. I've been monitoring my PSA and it's still low (at 60). This is so much less intrusive and gives me hope that if I do get prostate cancer, I might be able to lead a normal life if I'm lucky enough to get this treatment. This is no joke of a disease.

</comment><comment><USER12> This is good video[0] explaining how it works. Chosen resonating waves may destroy bridges, not to mention some cell membrane. The problem is there is no money in that for big pharma & co.

[0] [https://www.youtube.com/watch?v=1w0_kazbb_U](https://www.youtube.com/watch?v=1w0_kazbb_U)

<comment><USER13> I always approach these statements with skepticism.

Okay, let's say that there's no money for the big pharma, what about governments with socialized health care? What about rich people and their loved ones who suffer from cancer?

The "not much money in this" aspect seems believable only when the condition is a rare one but cancer is a huge unsolved issue for everyone, including rich people and politicians. How can they not pursue cancer treatment option that's not profitable enough for commercial players?

<comment><USER14> Further to that point, there is radically more money in big healthcare than there is in big pharma. In the US big healthcare is 8x-10x larger than big pharma.

There is a lot of money to be made by big healthcare in any procedure in the US, including one as described by the article. Hospitals, admin, doctors, nurses, techs, medtech, they'll all be thrilled to ring the cash register instead of big pharma.

<comment><USER15> And "big pharma" or "big health" isn't a homogenous unit protecting their own interests (well not entirely).

There's no way one firm won't pass up on a hundred million to save 50 firms from losing a billion.

The only time that happens is when BigCo gets the government to ban things, regulate the small firms out before they can even start selling stuff, or when the FDA drags its feet for a decade.

The fact the latter happens so often is one of the best reasons for public health insurance (IMO) because the US health industry is in many ways very far from a market where competition can efficiently account for stuff like this. But it's not as bad to completely squeeze out whole new classes of treatments (new patented drugs is another story) which would be worse case scenario. Instead it tends to work through a million small rules but that only let the big guys exploit new stuff while potentially dragging their feet or charging 10x the cost, rather than completely excluding the market from it.

</comment></comment></comment></comment><comment><USER16> >The minimally invasive technology involves a rod that enters the prostate gland via the urethra

Ouch.

<comment><USER17> The alternative is death right? So give me some pills, knock me out, and go to town.

<comment><USER18> Prostate cancer is rarely lethal since it develops so slowly, and is often left untreated.

That said, many cases _are_ life threatening.

<comment><USER19> My father died from metastasized prostate cancer.

While statistically your statement may be true (in that a large number of people die of something else before the prostate cancer kills them) it's still a lethal cancer that kills more men each year than breast cancer kills women.

<comment><USER18> This is 100% true, and I could have made that clearer.

Another reason it's left untreated is that the surgery side effects are fairly serious.

<comment><USER20> This is a great point. There is a good book which i think features a statistical perspective on screening in relation to dying _with_ prostate cancer vs dying _from_ prostate cancer. This book is a great read and i would advise anyone who is interested in health issues to get an intuition of "risk".

[https://www.amazon.co.uk/Risk-Savvy-Make-Good- Decisions/dp/0...](https://www.amazon.co.uk/Risk-Savvy-Make-Good- Decisions/dp/0241954614/ref=sr_1_1?keywords=risk+savvy&qid=1576087187&sr=8-1)

</comment></comment></comment></comment></comment></comment><comment><USER21> The headlines don't reflect the results reported in the abstract. In particular, a erectile dysfunction rate of 25% at one year is very high. Furthermore, the criteria for cancer oblation seems to be PSA decrease of 75%, which was achieved in 96% of patients. However, one would generally expect a much larger reduction in PSA if the cancer were truly oblated.

<comment><USER15> The levels of prostate cancer are very much titled toward older males past their sexual prime: [https://www.verywellhealth.com/thmb/Imcc48tegbPKpY2cL18sXOIB...](https://www.verywellhealth.com/thmb/Imcc48tegbPKpY2cL18sXOIBFAY=/1501x1001/filters:no_upscale\(\):max_bytes\(150000\):strip_icc\(\)/prostate- cancer-gender-chart-5b44d65e46e0fb00373a82a3.jpg)

ED may be less of a concern with this group compared to other cancers or diseases. Not to mention the high rates of heart disease at that age in America already causing it.

Plus the rates must be compared to other modern prostate treatment options.

</comment></comment><comment><USER22> My father and my uncle both had this surgery (therapy?) to treat prostate cancer, and not only has it been effective (low to no PSA after over a year), their recoveries and post-surgery experiences are significantly better than any of the individual's they talked to who had a traditional prostatectomy. Not to say they are _unaffected_, but their experiences have not been life changing as the experiences of others they know (eg. incontinence).

I'm so happy to see innovative and less invasive treatments for common diseases being approved.

</comment><comment><USER23> This from the guy who invented the PSA test, well worth reading, [https://www.nytimes.com/2010/03/10/opinion/10Ablin.html](https://www.nytimes.com/2010/03/10/opinion/10Ablin.html)

<comment><USER24> How is this related to this procedure? Both are about prostate cancer, but that's about it.

</comment></comment><comment><USER25> I lost my father and my uncle to rare forms of prostate cancer. Here's to more research funding and accelerated progress on every front.

</comment><comment><USER26> It's great to see this.

I've often wondered why electromagnetic waves could not be focused on a tumor to destroy just it.

</comment><comment><USER27> What is this number like in a comparator group (i.e., placebo or state-of-the- art therapy)?</comment>


Cyber attacks worry Davos elites - <AUTHOR> http://www.bbc.com/news/30925696

<comment><USER2> This is off-topic, but I'm curious why your submission history contains so many duplicates for the BBC's website.[1] Is there a reason both the .com and .co.uk links are submitted for each article?

1\. [https://news.ycombinator.com/submitted?id=jackgavigan](https://news.ycombinator.com/submitted?id=jackgavigan)</comment>


A year of digging through code yields "smoking gun" on VW, Fiat diesel cheats - <AUTHOR> https://arstechnica.com/cars/2017/05/volkswagen-bosch-fiat-diesel-emissions-cheats-cracked-open-in-new-research/ <comment><USER2> While I certainly don't support the 'rogue engineer' excuse that VW originally gave everyone, the idea does bring up an interesting point.

An engineer did write this code. Almost certainly, many of them, working together. Now, their managers told them it was okay to do this, maybe that legal had given the go-ahead or that they had to do it to keep their jobs... But it's still pretty clear that this was not right. They still did it, and then didn't tell anyone. And that doesn't sit well with me.

In my opinion (and I welcome disagreement and debate) engineers have an obligation to say 'no' to wiring unethical code.

<comment><USER3> >In my opinion (and I welcome disagreement and debate) engineers have an obligation to say 'no' to wiring unethical code.

I respectfully disagree. Engineers have an obligation to do whatever is asked of them by management. If that means building nuke-hand-grenades so be it.

Being an engineer( be it software or mechanics ) should be a morally neutral thing. Do the job and keep your morals out of it. This is the only way we can have some semblance of sanity in the field.

<comment><USER4> 'Once the rockets go up, who cares where they come down? That's not my department! says Wernher Von Braun.' [https://www.youtube.com/watch?v=kTKn1aSOyOs](https://www.youtube.com/watch?v=kTKn1aSOyOs)

I really really _really_ strongly disagree with this. As the ones who are most knowledgable about the systems they're building, I definitely think engineers have a moral responsibility to make sure they're at the _very_ least following applicable laws and regulations - I would argue that we have a moral responsibility to act ethically even in cases where it's _not_ covered by laws or regulations, but I'll admit that's a bit more controversial.

<comment><USER3> The problem with "moral obligations" is a person's moral axioms are fundamentally arbitrary. Would you still want engineers to be guided by their moral convictions when you fundamentally disagree with them yourself?

<comment><USER4> Inasmuch as I want everyone to be guided by their moral convictions, yes. I mean, even if I don't agree with them, I'd much rather an engineer's decisions be guided by 'what they feel is right' rather than guided by nothing at all, which seems to be what parent was implying.

Also, this is why we have engineering codes of ethics, at least in Canada and the US (and while I'm not familiar with elsewhere in the world, I would assume similar things hold in most first-world countries). We don't necessarily have to agree on everything, but there _is_ a baseline for what we consider ethical, and engineers _are_ expected to uphold that baseline, otherwise they are not permitted to practice engineering. Unfortunately the line between 'engineers' and other practicioners isn't as well-defined for software engineering as it is for most engineering fields - but that doesn't mean we should ignore it completely.

</comment></comment></comment></comment></comment><comment><USER5> > _In 2015, regulators realized that diesel Volkswagens and Audis were > emitting several times the legal limit of nitrogen oxides (NOx) during real- > world driving tests. But one problem regulators confronted was that they > couldn't point to specific code that allowed the cars to do this. They could > prove the symptom (high emissions on the road), but they didn't have > concrete evidence of the cause (code that circumvented US and EU > standards)._

I don't understand this from a regulator's point of view: as a regulator, all you have to do is test for symptoms. You don't have to explain root causes. You drive the vehicle in conditions as close as possible to real ones, measure emissions, and decide whether or not they're above the norms.

Why would regulators do this in a lab? It's like health inspections that would ask restaurants to send food to be tested, instead of showing up anytime, unannounced.

Regulators should pick up real cars from real owners and test them on the road, at regular intervals.

Or, modern technology should allow to test a car all the time and report emissions and fuel efficiency, etc. during its lifetime.

People cheat, and if cheating is easy they cheat more. The one thing a regulator cannot do is trust the industry.

<comment><USER6> > Why would regulators do this in a lab? It's like health inspections that > would ask restaurants to send food to be tested, instead of showing up > anytime, unannounced.

Because the law on how regulators work was written by the auto lobby. (At least, that's how it is in the EU. Don't know about the US.)

<comment><USER7> Funny you should mention the lobby. The US auto lobby was the reason the US NOx diesel emission requirements are more stringent than EU in the first place, specifically disadvantaging European diesel cars (which are much cleaner overall).

<comment><USER8> >The US auto lobby was the reason the US NOx diesel emission requirements are more stringent than EU in the first place

No, that was a result of the Clean Air Act Amendments of 1990 for the reduction of acid rain. Though it was targeted towards industrial emissions of SO2 & NOx, but stricter regulation for vehicles were an additional effect.

>specifically disadvantaging European diesel cars

That's a weird argument given that diesel passenger vehicles in the US are held to the same standard as gasoline ones, but to a separate standard from their petrol counterparts in the EU. I mean, one could argue the opposite, that an EU emissions policy favorable to diesels amounted to an equivalent 13-16% import tariff. [1] Several domestic rather than just foreign diesel engine manufacturers were also penalized for using defeat devices in 1998.[2]

> (which are much cleaner overall)

That's quite arguable, trading lower CO2 & CO for increased NOx & PM.

[1]: [http://www.eugeniomiravete.com/papers/MMT- Diesel.pdf](http://www.eugeniomiravete.com/papers/MMT-Diesel.pdf)

[2]: [http://articles.chicagotribune.com/1998-10-23/news/981023011...](http://articles.chicagotribune.com/1998-10-23/news/9810230110_1_detroit- diesel-corp-engines-mack-trucks)

<comment><USER7> >but stricter regulation for vehicles were an additional effect

Surely car manufacturers didn't have a say, which is why US and EU emission standards look like this [https://longtailpipe.com/wp- content/uploads/2015/10/us-europ...](https://longtailpipe.com/wp- content/uploads/2015/10/us-europe-emissions-standards-difference.png) .

>same standard as gasoline ones

Well duh, let's keep diesel cars to petrol standards so that their benefits don't matter and their disadvantages are prohibitive!

<comment><USER8> >Surely car manufacturers didn't have a say, which is why US and EU emission standards look like this

As per the source of the image says, "On the other hand, American regulators are focused on smog and health impacts of air pollution." Which the graphic you provided well indicates.

Look, California was probably the first governmental entity to regulate tailpipe emissions. Such so that it's written in the Clean Air Act by name to run its own regulatory scheme to enact stricter regulation(with federal waivers, but that's another issue). The reason being, that LA's unique geography makes smog worse. Heck, in the 1940s, they had an episode severe enough they thought they were under chemical attack by the Japanese. As such, CARB's emission standards were focused on reducing the more directly harmful pollutants like hydrocarbons, ozone, NOx & PM. So, given California's influence on the original 1970 Clean Air Act and the 1988 California Clean Air Act's influence on the subsequent amendment in 1990, I don't see how that graphic would support your argument. I mean, had they such hypothetical power, they could have also blocked the banning of leaded gasoline that was in the same amendment.

>Well duh, let's keep diesel cars to petrol standards so that their benefits don't matter and their disadvantages are prohibitive!

Emissions vs fuel economy. You're being facetious, but if that argument was true, why bother importing diesel passenger vehicles into the states? They didn't even start reintroducing diesels in America until they thought they could harmonize emissions from Euro 5 with Tier II Bin 5.

</comment></comment></comment></comment></comment></comment><comment><USER9> I may be missing something here, but if you take a step back this just seems like a tragedy of misaligned economic incentives.

Both the US & EU would have wanted this information from day one, and this whole fiasco cost VW billions in fines.

There would have been any number of engineers at VW and Bosch that knew exactly how this worked, but there was nothing in it for them to come clear about it. They were never going to get charged for writing that code, and they would have likely been out of a job or destroyed their career at those companies if they volunteered to authorities how this worked.

So why don't investigators just offer a huge cash prices to engineers at those companies who can provide details about exactly how this worked, along with immunity as long as they're forthcoming with information about who instructed them to implement this?

You'd have an army of engineers overnight willing to spill the beans, and you'd save millions in investigative costs, and quickly get to the real root cause of the corruption.

Instead some independent team of investigators is left digging through old firmware images posted on forums to reverse engineer how the defeat device worked.

<comment><USER10> I don't know for certain whether the concept of a bounty was considered, and if so why it was rejected. But I can think of a few possibly good reasons to not do this. For one thing, it could be thought of as rewarding the engineers who wrote the evil code, maybe even creating an incentive for engineers to add such code in the future. There are precedents for enforcement actions having the unintended consequence of causing more incidents. Another thing is that you may actually wish to prosecute the people who wrote the code, to serve as a disincentive to future engineers considering following management orders on a similar defeat device.

<comment><USER11> Why do think the notion of whistleblowers or witness protection exists?

<comment><USER10> I'm pretty sure whistleblower protections are not a get out of jail free card. If you blow the whistle on actions that you took part in, you can still be prosecuted.

</comment></comment></comment></comment><comment><USER12> > Firmware images were gleaned from car-tuning forums and from an online > portal maintained by Volkswagen for car repair shops. Documentation, in the > form of so-called "function sheets," was harder to come by. The function > sheets were necessary to give the binary context, but the sheets are > copyrighted by Bosch and generally not shared with the public. The research > team ended up turning to the auto-performance tuning community again. These > hard-core hobbyists and professionals share leaked function sheets so they > can make aftermarket modifications to their cars.

This is crazy. And, as we move toward self-driving cars, dangerous.

Can someone point me to a well-regarded source in the industry that makes a cogent and convincing argument for why all the software running in a car (save _maybe_ for the entertainment panel) should _not_ be required to be open source?

To be clear: I'm not asking for speculation, or even an explanation from an expert based on years of experience. I'm asking for a publicly accessible reference based on research data that explains the security benefits of not releasing the source code for life-critical software in the car.

Edit: clarification

<comment><USER10> I would be very surprised if such a thing exists. Are there any industries, safety critical or otherwise, where the default is open source? If not, why would anyone think to justify the decision to not open source code, and especially why would anyone think to make such a memo or piece of research public?

<comment><USER13> >Are there any industries, safety critical or otherwise, where the default is open source?

Cryptography.[0] When trustworthiness is paramount, as in crypto (and IMO in safety-critical applications like this), being able to inspect the code helps a lot.

[0] [https://www.schneier.com/crypto- gram/archives/1999/0915.html...](https://www.schneier.com/crypto- gram/archives/1999/0915.html#OpenSourceandSecurity)

</comment></comment></comment><comment><USER14> > The researchers also say that it's high-time regulators dispense with the > kind of lab tests that US and EU governments have required for years. > Instead, some kind of active scan for illegal code needs to be developed.

Alternatively, combine the lab tests with imprecise real-world tests as a sanity check, or keep the exact nature of the lab tests a secret and vary them over time. Really, the first of these seems like a good idea regardless of what else you do.

<comment><USER15> The real world sanity checks for cheating make sense. But the nature of the regular tests can't be secret. Carmakers need to know the bar they are supposed to hit. Building something on the speculation that it might pass, maybe, is a whole different business model.

<comment><USER16> "Build a car that doesn't emit more than X of exhaust Y when a typical driver drives it a) ten kilometers in the city, b) a hundred kilometers on the highway."

That seems like a good enough requirement to me. Define "a typical driver" as "out of a hundred random test drivers, no more than 20 exceed the thresholds, no more than 5 exceed the thresholds by more than a factor two." That forces the car manufacturers to have a sufficient safety margin in their emissions.

I don't know how difficult the actual measurement is, but maybe you could pay a couple thousand people a reasonable amount of money to have some devices attached to their cars for a month or two and collect data. Or make the car makers pay for the procedure.

<comment><USER17> So this is going to happen once they've built the car + engine, and started selling it? Is 'car tester' going to become a side-hustle?

I agree that a degree of randomness is likely a good idea to avoid defeat devices, but one also has to consider that it could have two unintended consequences: 1) more expensive cars, due to more stringent QA procedures 2) relaxing of standards to ensure that companies can still practically make cars that conform to 'standards.'

As ever, it's important to consider that a layman's "seems reasonable to me" is another experts "that's not how things work."

<comment><USER16> "The average driver" is unlikely to change their driving style very quickly, so the tests would be reasonably reproducible from year to year.

</comment></comment></comment></comment></comment><comment><USER18> > In 2015, regulators realized that diesel Volkswagens and Audis were emitting > several times the legal limit of nitrogen oxides (NOx) during real-world > driving tests.

This means that they can detect emissions levels during real world driving tests. What's wrong with just making those tests the actual regulatory ones? So whatever ingenuity automakers can use will be put to minimizing emissions in the _exact same scenarios_ that will be used in real life.

<comment><USER19> > What's wrong with just making those tests the actual regulatory ones?

Nothing. But Germany has a strong position in the EU and to a large degree does what VW/BMW/Mercedes want and they wanted to avoid stronger or better tests. This topic is quite often in the news here and it's clear that there is no political will to establish real word tests.

There are also a lot of other cheats in this firmware:

\- Below 14°C? Just blast the emissions out. It's not like these cars are driven in the winter.

\- Autobahn? Go blast out the emissions!

\- and so on...

This should be a far bigger scandal than it is now.

<comment><USER6> > Below 14°C? [...] in the winter

It doesn't take winter for temperatures to drop below 14 °C (57.2 °F). The morning commute takes place between 6 and 9 AM. Even in the summer, temperatures are probably below 14 °C more often than above it at these times.

<comment><USER19> Indeed the Umweltbundesamt PDF (see my other comment) states that it's at least 50% of the time the case! 50%!

</comment></comment></comment></comment><comment><USER20> Weird conclusion. This kind of activity should just be deemed illegal instead of treating it as an arms race between the manufacturers and regulators. Have 3rd party code auditors look through the code and flag any shenanigans. Instead of treating the code as an unregulated black box.

</comment><comment><USER10> What puzzles me about all this is why the investigators did not compel the companies to produce the exact mechanisms by which they cheated emissions as part of the settlements. I guess it doesn't _really_ matter, since what you're chiefly interested in is the manufacturer ceasing the behavior and not repeating the offense, so that might be why they didn't.

</comment><comment><USER21> Why they were analyzing time/distance curves, steering wheel angles, temperature, etc. instead of just using accelerometer to check if car is really moving?

<comment><USER15> I don't think there's any accessible to the software. They are used for airbags, but I think that's not on the CAN bus. If one were, it might be too dead a giveaway to poll it, since you already have speed via rotational sensors.

</comment></comment><comment><USER22> It smells more like a "smoking tailpipe".

</comment><comment><USER23> An interesting twist to this would be to change liability. Make the driver liable (not the manufacturer) for driving a car breaking the emission standards. This will set in motion the following steps:

\- Car users will be offered insurance against breaking emission standards

\- Insurance companies will hire specialists to lower insurance rates of above insurance

\- Consumers are disincentivized to modify their ECU in a non-compliant way

\- Consumers are incentivized to buy cars offering more transparency in firmware (and car manufacturers will offer more transparency)

I'm a firm believer in: you buy it, then you're responsible for ascertaining its safety. If you can't do this, hire someone to do it for you.

<comment><USER24> > _I 'm a firm believer in: you buy it, then you're responsible for > ascertaining its safety. If you can't do this, hire someone to do it for > you._

This seems like one of those plans that goes

1\. Deregulate everything

2\. ...

3\. All irresponsible companies go out of business when intelligent consumers patronize responsible ones instead

Skipping over the "decades of death/disruption" in step 2, and being awfully optimistic about consumer intelligence in step 3.

<comment><USER23> I don't want to deregulate everything, especially not all security regulations on cars. What is needed is removing distance between regulators and users.

Would you rather buy a locked down laptop which is factory protected against viruses (with a known set of them) but no chance to modify nor understand the virus protection system. Or, choose for a regulating system that punishes those who help spread viruses because no scanner was installed?

The latter teaches the users more and keeps them closer to the product. It creates a market where more parties can enter and provide security advice.

Lastly, the 'stepping over death and destruction' is obviously a straw man. We have seen many deregulations that we in dire need and worked out well. It all depends on transparency and communication.</comment></comment></comment>