Bitcoinica lost customer database, has no up to date record of trading balances - <AUTHOR> https://bitcointalk.org/index.php?topic=81045.msg921245#msg921245 <comment><USER2> From HN thread announcing Bitcoinica's launch, some months ago (<http://news.ycombinator.com/item?id=2973301>):

"I'm going to pitch a different take than a few others: Yes, great initiative, please keep trying things and building things, but end this project now. There are no probable outcomes where you do not end up having to explain where thousands of dollars of other people's money went to some angry people. There's also very nontrivial odds of being on the wrong end of armed Federal agents, based on some of the other comments you've made here. This is a horrible, horrible first-project sort of project."

"Doing your best probably isn't enough. To have any hope you'll have to hire expensive security people and buy lots of insurance.

All you need in order to be exploited is to be using software with 0day exploits. Many known exploits are not public. In a very real sense, you are only protected to the extent that you are a small target.

As the potential payoff of a hacker approaches $1 million, the likelihood of being hacked approaches 90%. Software really is THAT insecure and bitcoin thefts are not prosecuted making it basically risk-free to steal bitcoins."

"-- spectacular failure is your destiny if you don't work very hard to prevent it

\-- spectacular failure may be your destiny even if you do work very hard to prevent it"

<comment><USER3> The problem is that the only kind of person who would start such a project would be a person who would be immune to these warnings...

</comment></comment><comment><USER4> genjix wrote in [https://bitcointalk.org/index.php?topic=81045.msg920554#msg9...](https://bitcointalk.org/index.php?topic=81045.msg920554#msg920554)

      > To the person above, here's what happened:
      > - Bitcoinica has an internet mailing list called firstname.lastname@example.com
      > - It was the email for the website and all sensitive accounts.
      > - You could request a password for that email. In a production system, that
      > should never be possible.
      > - Several people had access to this mailing list (non-admins and business
      > people included).
      > - Patrick got added.
      > - His personal email was compromised. Normally this shouldn't be a big deal; I
      > use my personal email at internet cafes and public computers.
      > - Attacker was able to request a new password and login to rackspace.
      >
      > The assumption here was that email@example.com did not have access to
      > critical infrastructure.
      >
      > Lastly, it was my fault Patrick's email server got compromised. I had a VPS
      > for programming and development which many people had access to - randoms from
      > #c++ IRC, people from this forum, beginners I was teaching .etc It's a
      > public VPS for development. The SSH key on there was added to Patrick's server
      > because we were developing the bitcoinconsultancy.com website on there (that's
      > why it's now down). My SSH key was stolen and he ssh'ed into the box.
      > Then had access to his emails.

So there you have it: it was one of those damn "Forgot Password" buttons, combined with mishandling email. The security of a server can't be better than the security of the least-secure computer with administrative access, and it looks like in this case, that was spread a little further than it should've been. This attack might've been prevented by introducing a delay: send an email saying that a password reset was requested, with a cancelable reset after several hours. But as far as I know, no one does that.

<comment><USER5> It looks to me like the root cause was reusing an SSH key on a secure system and a public system. If the SSH key was compromised, that would lead me to believe that the private key was on the public/insecure system. That is a big security no-no as well.

</comment></comment><comment><USER6> When its founder declared this on HN 8 months back:

"I'm the creator of Bitcoinica. I'm not so established here. To be honest, I'm only 17."

<http://news.ycombinator.com/item?id=2973313>

I was waiting since then to see how bad can things possibly go.

Unlike other sites where people hack for fun, bitcoin offers hackers the opportunity to get some real money.

</comment><comment><USER7> This comment thread is full of people saying that incidents like this are mining the viability of a bitcoin currency. What many don't see is that bitcoin is an algorithmic solution to a problem a lot of people have (decentralized, untraceable money transactions). The implication of being algorithmic is that you don't have to trust people anymore, just the math. Even if this currency fails, the solution remains and will continue to be implemented.

For example, geometry was literally invented to measure land. I'm sure that when the Pythagorean theorem was discovered, some of the first "geometers" did screw up and made a wrong land measurment. Maybe some of the reaction at the time were: "Well this geometry thing is too dangerous, if one small calculus error could make me lose half my land. It will never catch on."

<comment><USER8> I'm not following. You're saying that Bitcoin's discovery is equivalent to the discovery of a new field of mathematics?

</comment></comment><comment><USER9> So basically they used a server that could be deleted online by getting a single password (which was acquired via an SSH key for the bitcoin server being left lying around).

They didn't make offsite backups (sounds like they used to but stopped).

When the server was compromised they didn't realise that it could be deleted by the cracker.

One thing I don't understand, as these appear to have been real servers on Rackspace (you wouldn't exactly use a shared VPS, surely not?!?) couldn't they be recovered after the online "delete server" button was pressed? The top comment on the linked thread says that Rackspace had the server locked down with the only available option for the cracker to delete (which sounds very strange).

<comment><USER10> It was a cheapo cloud VPS server, I shit you not. After getting their ass stolen for that very reason at Linode.

This site had a massive running profit and still went for the very cheapest option. Rackspace even offers financial services grade servers. I bet these aren't cheap though.

</comment></comment><comment><USER11> This seems to be the... 4th problem bitcoinica has had? 5th? Maybe event the 6th, why do people still use this site? Surely it has been shown on multiple occasions they can't be trusted with security.

<comment><USER12> Their database was deleted and their site has been replaced with a form _asking_ former users how much money they remember having.

I doubt very much that anyone is still using the site.

</comment></comment><comment><USER13> Imagine putting your money in a bank where every day, hundreds of burglars attempt to anonymously get in and steal money that cannot be traced back to you for you to recover it.

Sounds like a great place to put money in.

</comment><comment><USER14> I hope people stop making services like this. Bitcoin is distributed for a reason

<comment><USER15> It is rather hard to distribute a market, centralisation be it's key strength.

<comment><USER16> Not really. I mean, there's nothing centralized about dollar bills. As long as people publicly list their prices in bitcoins, everything will work out fine.

People will always need bitcoin exchanges to convert between bitcoin and other currencies, but those don't need to be storing other people bitcoins.

</comment></comment></comment><comment><USER17> This isn't so much a problem with Bitcoin as much as it's a problem with under-qualified people trying to set up "banks" online.

</comment><comment><USER18> I'd like to think that this was some sort of nefarious action from an old- guard finance company who was threatened by Bitcoin enough to resort to the enlistment of some hackers.

In reality, this was plain amateur security practice, and if this sort of sloppiness continues, the bitcoin brand will be trampled so badly it will never get off the ground.

<comment><AUTHOR> It's already well and truly off the ground.

</comment></comment><comment><USER19> What problem does bitcoin solve? I've tried to understand the need for it, but just don't get it.

<comment><USER20> Here are some features that make it appealing.

(1) Fixed total supply, so it can't be manipulated by central banks.

(2) Fast online transactions (e.g. Paypal, without the problems of Paypal); ease of developing all kind of Web services around this.

(3) Anonymous transactions are possible, which can be beneficial in many ways (for example, not getting taxed...)

<comment><USER21> (1) is only a selling point to people well outside the mainstream. Most people would consider this a huge negative.

(2) meanwhile I can buy things with one click using dollars.

(3) tax evasion, drug dealing and money laundering are not things that society generally wants to facilitate

<comment><USER20> Well, I just listed some of the features that many people who like Bitcoin like about it. That other people may not care about those features is kind of irrelevant.

<comment><USER22> Until they shut it down.

</comment></comment></comment></comment></comment><comment><USER23> Wait, is this going to happen to all of them trading sites, _in turn_?! Is it something to say about the kind of people that are attracted to fast and furious trading, or is it just random negligence hiveminding?

</comment><comment><USER24> I'm still offering a deal to people bit by the Bitcoinica failure to rebuild their investment portfolios: [https://bitcointalk.org/index.php?topic=77469.msg901042#msg9...](https://bitcointalk.org/index.php?topic=77469.msg901042#msg901042)

Basically, I'll trade bonds in GLBSE listed mining companies for shares in DMC: ~2/3rds of a BTC worth of bonds for 1 BTC worth of DMC.

Bitcoinica royally screwed a large number of investors, and I want people to know and understand that not all of us are people out to steal their money. Some of us really are completely honest businessmen.

</comment><comment><USER25> This is what a market debasement looks like, ladies and gentlemen. If you can pay someone to keep Bitcoin performing poorly, you can mitigate the loss from your own failing currencies.

Perhaps I'm the only one that feels this way (I almost hope I am), but this news is making me want to put all of my money in bitcoin. it's a good time to get in on the action.

<comment><USER26> If your implication is correct, and someone is paying black hats to debase bitcoin, and nobody has any idea who is behind it so that those efforts will likely continue, then how does it follow that now is a good time to get in on the action and put all your money into BTC?

</comment></comment><comment><USER27> This is nothing compared to the amounts of money involved in the botched Facebook IPO. If this incident proves that Bitcoin is in trouble, then by all mean extend this reasoning to NASDAQ, and other institutions with major incidents.

</comment><comment><USER28> Phew, good thing I haven't been investing in bitcoins..

<comment><USER29> Comically, many of Bitcoinica's customers were those who sent funds to the service to be able to go short (bet against) bitcoins.

But those "investing in bitcoins" wouldn't have lost from this unless they also happen to have been speculating at Bitcoinica with them. Bitcoinica is a service where a financial product called a contract for difference (CFD) is traded.

</comment></comment><comment><USER8> With all the disclosures and absolute failures of security and operations that we've seen coming out of the Bitcoin field, can we start to quell the attitude that the Bitcoin market as it stands today is a real currency market? The only people that seem to work on Bitcoin secondary trading mechanisms are people that just know how to write a Rails app, and most seem to lack security sense or reliability awareness. Personally, as a seasoned developer, even I know that I probably shouldn't write a _currency trading platform_ alone. I'm aware of the ramifications and what can go wrong, and I'm smart enough to rule myself out.

I will _never_ call Bitcoin a real currency until you see a platform that actually knows what it's doing. Really, I'm sorry, that's just how it is, and the Bitcoin fans that are about to show up and try to tell me otherwise are just as misled (and are inevitably going to be victims of being so myopic). If you want to call Bitcoin real money, it needs to be treated like _real money_. In software terms, that means it is a big deal.

There is a reason currency is regulated heavily. You are witnessing it.

Edit: Clarified that I'm not attacking Bitcoin itself.

<comment><USER30> It's a real currency market, it's just at the Bonnie and Clyde stage of its evolution. Consider how lax bank security was in the 1930s that a single couple could rob banks for years with a fraction of the sophistication of modern day bank robbers.

You couldn't get away with it today, not for that long, but it was possible with "real" money, "real" banks, all government backed, at one time. And that had centralization and identity built into it. The bitcoin community isn't big enough to have serious security professionals yet, but that doesn't disqualify it as a currency market.

<comment><USER8> Which is why my comment has said, from the beginning, "as it stands today". Those interested in Bitcoin should seriously learn from those very mistakes that you're discussing, rather than re-learning them all over again.

<comment><USER31> What does is matter? Everyday people get mugged and killed over cash... do you believe cash is not a "real currency" because of this?

<comment><USER32> The difference here is that no one carries around the amount necessary to tip the balance of the economy, which is very much the case with Bitcoin sites such as Bitconica

<comment><USER10> Actually just 18.5K were stolen and it didn't affect bitcoin's valuation. We are enjoying very good stability at this moment there are very few people leverage-trading.

</comment></comment></comment></comment></comment></comment><comment><USER33> "It's my fault to not set up a offline backup schedule."

For fuck's sake.

<comment><USER34> Looks like a bunch of accountants and wannabe bankers bought some developing books and start to "invest" in BitCoin. They are missing the basics.

<comment><USER35> They're not necessarily accountants and business school dropouts. Never underestimate the incompetence of the average IT worker.

</comment></comment></comment><comment><USER36> Protecting physical gold is just as hard a problem. Placing the gold inside a steel and concrete Box where only one person can open it still isn't secure. The problem is that without laws to punish people who steal, they will eventually break all of your security layers.

Perhaps we can design a new currency that goes back to basics. Money is just a contract between two humans, goods or services now are traded for claims on future human labor. Instead of using numbers or possession of objects, use something that can't be stolen. A system that streamlines the ancient bartering system. Trade you 100 gallons of milk for a new transmission. But instead of holding money, you perform the transaction real time. Instead of being paid in money, you get paid in receipts for goods/services performed which can be traded.

<comment><USER26> Adam Smith actually wrote about just such a system, which later came to be called Real Bills.

<http://www.safehaven.com/article/17603/real-bills-revisited>

TLDR: When a merchant buys, say, a dress, from a producer, the merchant pays the producer with a note that gives the note's recipient the right to x% of the eventual sale price of the dress.

The producer can then use notes like that as a form of collateral for their own notes, which they can use like cash to pay upstream suppliers with it (fabric, thread, dye, sewing machines, etc).

Items tend to sell, or clear, within 91 days, so that is the term of the note. Eg, the note is 'self-clearing' within 91 days.

Eventually the dress will sell, and the cash/gold proceeds will remit up the chain, from merchant -> producer -> upstream suppliers, until all the notes and their derivatives are redeemed.

It's basically an alternative to bank credit that's backed by sales of real goods.

</comment></comment><comment><USER37> I don't even run anything close to something as important as Bitcoinica and I have daily database backups. What were they thinking??

<comment><USER38> Are your daily backups set up in a way that they are impossible to delete if your server is 0wned (either offline or using some kind of write-only scheme)? If so, I think you're ahead of most people...

</comment></comment><comment><USER39> Yikes.</comment>


Female hurricanes are deadlier than male hurricanes - <AUTHOR> http://www.pnas.org/content/early/2014/05/29/1402786111.abstract?sid=79a9dd5a-51c7-4dfe-95b0-25c41fec04e9 <comment><USER2> [https://news.ycombinator.com/item?id=7835925](https://news.ycombinator.com/item?id=7835925)</comment>


Trustworthy Chrome Extensions, by default - <AUTHOR> https://blog.chromium.org/2018/10/trustworthy-chrome-extensions-by-default.html <comment><USER2> Chrome's auto-update forces you to trust the author of any extension you install for as long as you use the extension. Google's "Trustworthy by default" effort doesn't change this model since it still provides no guarantees. This works for some extensions backed by companies (e.g. Adblock), but it doesn't work for extensions that add simple functionality.

For small extensions that add basic browser functionality (e.g. reorder tabs, enable autocomplete), I wish Google would enable users to verify open-source extensions. I trust the version of the code that I have reviewed on github. I do not trust that the kid who wrote this extension won't go rogue and upload a malicious version in a future autoupdated release. So the only way I can verify the code that I run is to install it from the Chrome Web Store, copy the code and verify it, uninstall the Chrome Web Store version, and then load the unpacked extension (or even publish my own copy of it to the Chrome Web Store). This is pretty cumbersome.

<comment><USER3> Chrome's auto-update forces you to trust the author of an extension _until it requests more permissions_ , at which point the extension is automatically disabled and the user is prompted to accept the new permissions to re-enable the extension.

Making the permissions as fine-grained as possible - as google is doing here - is a good way to prevent an extension from becoming malicious in the future.

<comment><USER4> Doesn't this simply encourage extension authors to request as many permissions as possible from the outset?

Most users just click yes to all of these things. Those who would skip installing an extension because of this are an extreme minority.

<comment><USER5> The solution to that is to only request extensions when they're needed, and to give users prominent options to grant access "only once" or to revoke access (both of which should be undetectable from extensions without extra work).

This isn't perfect, but it comes with some advantages. It's more work for an extension author to check for the permissions than to just write their application logic normally. This means that the lazy authors start coding their apps correctly (just try to do the thing and let the OS handle asking for permission), and only the malicious authors are left nagging for permissions early.

If you have more legitimate than malicious app on your platform, you can at least sort of train some users to think what the malicious apps are doing is weird. If _most_ of your apps don't ask for permissions up front, then the ones who do start to look weirder.

If I go to a website, and a permission pops up asking to access my webcam, and I didn't do something to make that permission pop up... that is really weird and I'm going to click 'no'. And when I click no, if the website wants to be cranky about it, they have to write _extra_ code to hide whatever content is already loaded and pop up a dialog complaining. If I click OK and then immediately click a button and revoke that permission, they need to have even more code continually running in the background to detect it.

Again, it's not hard for a malicious extension/app to do that, it's just that _only_ the malicious extensions/apps are going to do that. So it becomes easier to educate users with simple rules like, "if a site asks for a permission that's unrelated to what you're doing, _always_ say no." It also becomes easier for users who are already careful about permissions to be paranoid and grant them carefully, because they don't have to decide up-front whether the app is worth installing -- they can decide later on whether or not they trust it to have access to something.

Part of having fine-grained permissions is in getting rid of what I call the Terms of Service version, where you just stick anything you might ever want inside of a manifest and then users either accept everything or the app doesn't install.

<comment><AUTHOR> > Again, it's not hard for a malicious extension/app to do that, it's just > that only the malicious extensions/apps are going to do that. So it becomes > easier to educate users with simple rules like, "if a site asks for a > permission that's unrelated to what you're doing, always say no."

Are you sure it's this simple? Adblockers and password managers for example require wide ranging permissions to work and there's plenty of popular extensions in the same situation.

<comment><USER6> Password managers don't need extensive permissions, they just need a built-in autofill API. Similarly, you could implement a basic adblocker via a declarative content blocking API.

Fine-grained permissions will allow for this sort of thing.

<comment><AUTHOR> Does that cover the functionality of most popular extensions though? When there's an API that matches up with the purpose of the extension, it's more straightforward. I would have thought the popularity of those particular example extensions is what partially drove the creation of those APIs as well.

<comment><USER6> The APIs I mentioned in my previous comment don't exist yet. My point is that Google is going to need to _build_ APIs to fulfill all of the most common use cases (including those ones) in order to succeed in their goal of making extension permissions more fine-grained.

So yes, the functionality of most popular extensions will be covered by the new APIs, because Google will designing the new APIs with those popular extensions in mind.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Now that modern operating systems come bundled with antivirus and complicated kernel security techniques and most-of-all, because the Web is winning and most of our computer interaction is through a web browser, browser extensions are a prime place for malware to enter someone's PC. Both Mozilla and Google have not given it enough attention. It's good to see this taking place. I can understand the concerns about walled gardens and so on, but I think that's just a pill that you have to swallow. If you want to use a self-loaded extension, that's still available and you'll always be able to find a chromium build that does that if it's very important to you. For most people, it's not a big concern.

All that being said, there's still so much that Chrome needs to fix when it comes to extensions. Extension updates are done in a very opaque way. Extensions that alter network requests have precedence based on their install order --- and there's no clean way for two extensions to really coordinate between each other. This means that HTTPS Everywhere and Decentraleyes and uBlock conflict with one another, _and the solution might be to uninstall and reinstall them in a different order_. That is clearly insanity. What happens when you login to Chrome on a new machine and your extensions are pulled in, is the install order guaranteed to match your previous machine?

There's also no centralized storage for extensions, which means that settings are generally going to be completely different between machines unless the extension implements its own syncing/backup code.

There's also no way to disable an extension on one machine without disabling it on another machine. That means that if you want an app on your Chromebook, it's gotta be on your desktop as well.

It's frustrating to use extensions on Chrome.

<comment><USER8> > browser extensions are a prime place for malware to enter someone's PC. Both > Mozilla and Google have not given it enough attention.

Well Firefox has switched to webextensions for security reasons and they received a lot of flak because of it. So I'd say the opposite, since Mozilla pushed this hard and still working on better support.

> there's no clean way for two extensions to really coordinate between each > other

I don't think something like this should be allowed, could be abused. Instead browsers should embrace the fact that they've become operating systems inside operating systems and implement some of the most used extensions natively.

I completely agree about extensions setting sync tho, it's major pita across all browsers not just chrome.

</comment></comment><comment><USER6> This is great. Extensions have long been a weak point in the web security model, since many extensions currently require what is essentially the web equivalent of root privileges (UXSS) in order to function. It's good to see Google finally doing something to try to remedy this.

<comment><AUTHOR> I'm not sure how much this will help to be honest. I haven't looked into the stats for this, but a huge number of popular and useful extensions require access to reading/writing data to all domains to function so users just get used to this being a standard permission they have to allow.

One tip I suggest though: Create one locked down profile in Chrome that you use for email, banking etc. and a separate profile that you can be less careful about installing extension in. Extensions in the second profile won't have access to your browsing activity in the first profile. I have a profile I use for web development for example which I install lots of extensions to that require access to everything.

<comment><USER6> The new user controls are just a temporary stopgap measure. The real solution Google is working towards is Manifest v3, which will be designed as a much better system with fine-grained permissions.

If Google follows the model with Chrome that they did Android, UXSS permissions will eventually be phased out over time and replaced with better, more secure, opt-in, purpose-built APIs in Chrome. (Assuming they can do that without sacrificing _too_ much functionality.)

<comment><USER9> Almost nobody makes well thought out decisions when agreeing to permissions during the extension install process.

EULAs, Terms of Service, Mobile Apps, Cookie Consents have boy-who-cried- wolf'ed everyone except the most paranoid and tech-savvy to the point that they are mostly ignored.

<comment><USER5> Stop taking away people's locks just because other people don't use them.

Yes, many non-technical users do not pay attention to permissions. But permissions are extremely helpful to people who do use them -- and the number of people who do use them is larger than the number of people who audit source code or set up VMs.

Educating normal users to pay attention to permissions is a problem. It is a separate problem than, "do they even have tools in the first place if they want to use them." The problem I want solved is how _I_ verify that an extension is safe. Granular extension permissions solves that problem for people like me.

After that problem is solved, then I can worry about educating my friends and family.

</comment></comment></comment></comment></comment><comment><AUTHOR> "Starting today, Chrome Web Store will no longer allow extensions with obfuscated code...Ordinary minification, on the other hand, typically speeds up code execution as it reduces code size, and is much more straightforward to review. Thus, minification will still be allowed"

I have a Chrome extension that uses Webpack to convert TypeScript to JavaScript which then uses UglifyJS to minify it. If I submit only the minified code, is this compliant?

<comment><USER10> On Firefox the reviewer took my source code, inc package.json, and ran it through the exact same version of my dependencies and then did a checksum of the output against what I submitted. The reviewer also read my source code and reviewed all dependencies.

It was a pain to get through but doing good things for your users takes effort.

<comment><AUTHOR> Is it correct that Firefox makes your extension live in a short time after you upload it as long as you pass some automated checks? But it can get taken down if it fails the review performed by a human later?

<comment><USER11> That is correct. Opera Add-ons remains the last of the larger extension stores that requires a review before a version gets published.

</comment></comment></comment></comment><comment><USER12> > User controls for host permissions

That is really nice.

One of the reasons Firefox is a non-starter for me is because sometimes there's no good way to tell what hosts an extension requires access to:

[https://imgur.com/a/k4rk0](https://imgur.com/a/k4rk0)

</comment><comment><USER13> This seems like a great effort. However, I worry what this means for the future of WebAssembly inside of extensions. There's an undeniable advantage to being able to write extensions in languages other than JavaScript. AgileBits has been writing the 1Password X extension, in Go, compiled to JS. While the JS isn't obfuscated per-se, it's also not very readable.

I hope they can find a path forward that doesn't kill off extensions like 1Password X.

</comment><comment><USER14> I think some more granularity in permissions wrt how extensions may change websites would be useful too.

For example, it would be easy for Google/Mozilla/etc to compile a list of HTML tags and attributes that can never be used to inject javascript. Lots of "HTML sanitization" libraries do this, for instance. Then, we could get permissions like "remove content", "inject non-interactive content" and "inject interactive content". An ad blocker, for instance, should work with no network access whatsoever and should never need to inject code. So I can totally lock it down to not being able to do anything except replace ads by empty <div> tags.

I think there's an opportunity for browser builders here with more granular permissions in other areas too (eg "network access but only to domains x and y", which ofc only makes sense if you can't also inject arbitrary interactive content but ok). No user is of course ever going to read those, or understand which combination of permissions make sense, but a Google reviewer can. Then the reviewer doesn't need to review anymore whether the code does something bad, but only whether the requested permissions would _allow_ the code to do something bad an whether the permissions make sense for what the extension is supposed to be doing.

Eg LastPass ought to work just fine with only "access to *.lastpass.com" plus "inject only non-interactive content".

This could be particularly powerful if browser designers would create a way for extensions to show possibly-interactive content on the top/left/side/bottom of the page (in a popover bar for instance) that is clearly not part of the page DOM. Then, LastPass can remove their "click to auto-fill" icons inside user/pass forms and replace them by a "That looks like a login form. Do you want to auto-login?" popover bar with an ok button. The UX is still great, security is greatly improved.

I don't pretend to be smarter than the teams that build browsers, so I may be missing something. Nevertheless right now I think that this, combined with the feature announced in this post where extensions can be locked down to specific websites, will remove the need for nearly any "can change anything on any website and do anything with it" extensions (which are pretty much the norm right now). Gmail extension? Website-specific. Pinterest "pin it" button? Non- interactive (make the injected button just be a selector and show the final "pin selected images" action in a popover bar). HN-Submit? Non-interactive. And so on.

<comment> X-Cubed A lot of that functionality is already possible through Declarative Content[1] and Optional Permissions[2]. These remove the need for extensions to have permissions to all websites, while enabling them to be given permission to a site after installation. However, these features weren't part of the original APIs, so I think a lot of extension developers aren't familiar with them, don't want to refactor their existing codebases to support these features, or are targeting multiple browsers where other browsers don't support this functionality.

1\. [https://developer.chrome.com/extensions/declarativeContent](https://developer.chrome.com/extensions/declarativeContent) 2\. [https://developer.chrome.com/apps/permissions](https://developer.chrome.com/apps/permissions)

</comment></comment><comment><USER15> Overall this looks great, but I wonder whether extensions will be allowed that are written in compiled languages? Dart, Go (via Gopher), Kotlin, and so on? Is Webassembly supported?

<comment><USER16> Both Chrome and Firefox support WebAssembly in extensions.

So technically you can write whole extension in WebAssebly with thin wrapper written in js.

Although "Starting today, Chrome Web Store will no longer allow extensions with obfuscated code." which might be an issue.

</comment></comment><comment><AUTHOR> So by default Chrome extensions will still be able to access any domain they've asked for permission to in their manifest (which can include all domains) but users can optional restrict this? Is this really going to help non-technical users much?

<comment><USER6> Not at first. The real benefit to non-technical users will come once Google starts using this system to pressure extension developers to migrate to newer APIs with more limited permissions.

Right now, as you say, only power users will use this feature. But once suitable alternative permissions are available for the more common use cases, Google will start to transition to "When you click the extension" as the default setting, which will put pressure on affected extension developers to migrate to the new permissions systems to avoid unnecessary friction for their users.

</comment></comment><comment><USER17> "This includes code within the extension package as well as any external code or resource fetched from the web."

How does this effect Greasemonkey-style extensions where the user imports JS to run on pages?

</comment><comment><USER18> Any updates like these are appreciated since I've all but stopped using extensions, and would like starting using them again one day. I don't think the current system with messages in the UI like "read/change all data on all sites you visit" is acceptable in the current 2018 environment. I feel like a default-deny-all policy and a (user friendly) way to review what data/urls an extension is accessing is needed. There currently is too much trust involved, and it seems like it shouldn't be needed. One idea is for chrome to provide the extension with a sandboxed, virtual dom api that doesn't pass any user identifiable data. The extension registers with chrome the functionality it provides, like "fill the main password field with this string", and chrome executes that action internally. It can never request user/history/etc data, just provide functionality to a black box.

</comment><comment><USER19> Can someone explain to me why it isn't possible to simply give users the option to influence whether an extension can make a request to a remote server?

This way one could simply disallow extensions to do anything that isn't happeninging locally.

<comment><USER20> It's trickier than it seems. To take just one example, suppose you have an extension that modifies pages to insert a related link (e.g. an extension that tries to infer a hacker news user's reddit account and link to it from their HN profile page).

The extension needs permission to modify documents on the hacker news domain. But if it can insert an <a> tag, what's to stop it from inserting an invisible <img href> tag, which could be used to exfiltrate data? Or even just inserting an <a> tag with an onClick handler, or a javascript: url?

<comment><USER9> Right - or even trickier... Imagine Google manages to block extensions from inserting <img> tags that reference other domains as a way of exfiltrating data... There are so many other ways to do it:

Say you have an extension that ONLY wants access to mail.google.com. It might feel safer because it can't load in any third party scripts. But it can just as easily SEND data from your account as an email which it promptly deletes.

Same goes for LinkedIn, Facebook, HN, any interactive website can be used to exfiltrate data.

</comment></comment></comment><comment><USER21> One thing that I'd like to see is mandatory code signing, so that even in the event of a compromised developer account it's not possible for an update to be pushed out unless the attacker also has the signing key.

</comment><comment><USER22> What is the implication to ad blockers as a whole?

<comment><USER23> Ad blockers will continue to function as they currently do. However, users may need to explicitly allow the ad blockers whitelisted access to all hosts if this feature is implemented with default-deny.

<comment><USER5> Which is entirely reasonable IMO.

They _should_ implement default-deny. It'll take two seconds for users to grant the permission, and the vast majority of extensions don't need it.

</comment></comment></comment><comment><USER24> I would like to know more about the review methodology and when the review is triggered. If I ask for wide permissions, get them, and then sell my extension to a malicious third party, what triggers the review?

</comment><comment><USER25> I like the host access restriction policy they describe. I update and fix existing extensions for customers and about 90% of the time the previous author has added necessary permissions and access to URLs.

</comment><comment><USER26> The best way is not to use any extensions to start with.

<comment><USER27> If you care about security, don't use a browser.

<comment><USER26> Actually I vote that browsers should have stuck with Web 1.0, for plain documents.

I still do most of my web development with server side rendering stacks.

</comment></comment></comment><comment><USER28> For context, I have an extension designed for a single html5 game, with roughly ~80k weekly active users. I've been using the chrome web store to deploy and update it for about 2 years, and recently wrote my own installer after Google stopped me from issuing security updates for over a month. I also had to build my own configuration update system to enable me to disable features on an hour's notice due to the security update incident & Chrome taking over a day to install updates - I'm serving about 3GB of configuration and update data per day right now, at around 1kb/user/hr.

Lots of functionality (and thus current extensions) requires requesting blanket access to all websites so they have a big task ahead of them trying to get all those extensions to comply.

In general the way things work for Chrome Extensions right now is bad for users and downright hostile to developers. Because I actually followed best practices on extension permissions I got a lot of confused, paranoid users, and had to explain Google's awful permissions model and UI in detail: [https://www.reddit.com/r/Granblue_en/comments/86bdmo/psa_vir...](https://www.reddit.com/r/Granblue_en/comments/86bdmo/psa_viramate_is_back_on_chromestore/) If I had simply requested a large set of blanket permissions when I first created the extension, I would've saved myself a huge amount of effort.

Users having the choice to scope wildcards down to specific pages is _a start_ but until it's a default it isn't really a meaningful improvement for anyone because few people are qualified to actually set those restrictions properly. The design of the extension API itself tends to require wildcards to provide functionality due to limitations in the other APIs. For example, if you want to do anything fancy with web requests and do it performantly, you may need to inject JS directly into webpages - the background-page-based webRequest API is slow and missing key features.

There's also a risk here that by trying to kludge better access controls into the existing full-of-holes extension model, Google is going to break tons of extensions that ordinary users rely on and they're going to be too frustrated by this to be happy about any security upside.

Some genuinely good changes though:

* Requiring 2FA to deploy extension updates. This is a big vulnerability in the existing system, especially if an extension has many users. It's been exploited in the past.

* Service worker support (probably) - the current model with page/content/background scripts and popup pages is a nightmare both to author and debug, hopefully service workers will provide a better way to architect all of this.

* Narrowly scoped declarative APIs - hopefully this means extension developers can finally get access to smaller features without having to request access to the entire universe. Some of the feature scoping is really absurd and occasionally unrelated APIs are tucked under a larger permission in a way that really confuses users. As I explained to users in my old reddit comment above, Google currently uses "Access your browsing history" to describe an ENORMOUS set of unrelated features.

* Blocking obfuscated JS - this literally will do nothing to protect users, but it's worth denying it anyway. There's no good reason to obfuscate extension JS since it's so hard to debug extensions you didn't write anyway. It's possible this will make it easier for them to apply machine learning to identify malicious extension code, at least, but I bet the machine learning will just randomly reject updates to legitimate extensions without any explanation and you'll be screwed.

The big wildcard here is Google's history of failing to maintain or properly document extension APIs. They're going to be rearranging lots of existing stuff and adding new stuff, so the underlying mess will probably become 10x worse. Core APIs like notifications have been entirely or partially broken for years with no effort made to fix them or update docs. Inertia is one of the main things carrying the chrome extension ecosystem forward and it's possible many extension developers will churn out after they find the migration effort involved here too much, similar to how Firefox lost many extensions during their two transitions (old->multiprocess compatible->webextensions)

</comment><comment><USER29> I'm certainly starting to trust the extensions more than the core browser these days...

</comment><comment><USER10> Reposting this comment as I think it's relevant at the top level.

On Firefox the reviewer took my source code, inc package.json, and ran it through the exact same version of my dependencies and then did a checksum of the output against what I submitted. The reviewer also read my source code and reviewed all dependencies.

It was a pain to get through but doing good things for your users takes effort.</comment>


There are Zero/None/Nil Mass Shootings in Australia - <AUTHOR> http://www.abc.net.au/news/2012-12-17/us-urged-to-consider-australia-gun-laws-example/4431262

<comment><USER3> Martin Bryant? He slaughtered 35 people.

<http://en.wikipedia.org/wiki/Martin_Bryant>

<comment><USER4> Did you read the article?

 _"in the 18 years before the law, Australia suffered 13 mass shootings - <USER2> not one in the 14 years after the law took full effect."_

The laws were introduced as a direct result of the massacre you're referring to.

</comment></comment><comment><USER5> Sure. On the flip side, since no one has a gun at home, people are not afraid to rob or invade your house. A ban isn't the answer either.

<comment><USER6> Just yesterday, I had to fend off invading hordes who came to pillage my house, I wish I had more guns.</sarcasm>

You should try living in a society without guns, you'll quickly realize how useless these things are.</comment></comment>


Include Oracle as a Viable Option When Evaluating Public Cloud Providers - <AUTHOR> https://www.gartner.com/doc/reprints?id=1-1ZKVOIQV&ct=200730 <comment><USER2> Lol i wouldn't touch Oracle cloud even if Oracle itself was paying me to host stuff onto oracle cloud.

Remember kids: oracle has no customers, only hostages!

</comment><comment><USER3> Not surprising to see this from Gartner, tarts.</comment>


Coronavirus Outbreak: How Bad Will It Be? - <AUTHOR> https://www.nationalreview.com/2020/02/how-bad-will-the-coronavirus-outbreak-be/#slide-1 <comment><USER2> What i don't understand is what makes this particular type of virus potentialy more dangerous / likely to mutate into something dangerous, than any other flu ?

We don't see this level of alarmism very often, and yet there are wordlwide epidemics of flus and other type of virus every year...</comment>


Google Reveals the Future of Printing With Google Cloud Print - <AUTHOR> http://mashable.com/2010/04/16/google-cloud-print/

<comment><USER2> I'm of very mixed minds about this idea, but I'm glad to see it being put out there for discussion and development. I kind of get the feeling that something like this will happen anyway, and so starting a dialogue now is a great idea.

<comment><USER3> This does make good steps in solving the problem of printing with devices that are more web/cloud-based. Of course, there are services like FedEx Print Online already that help to a degree.

</comment></comment><comment><USER4> <http://news.ycombinator.com/item?id=1269233></comment>


The house in London that is a 3D illusion [video] - <AUTHOR> http://www.bbc.co.uk/news/uk-23041236

<comment><USER2> 1-7 Ashwin Street, for those that want to visit.</comment>


Italy and South Korea virus outbreaks reveal disparity in deaths and tactics - <AUTHOR> https://www.reuters.com/article/us-health-coronavirus-response-specialre/italy-and-south-korea-virus-outbreaks-reveal-disparity-in-deaths-and-tactics-idUSKBN20Z27P <comment><USER2> Italy has an older population, hence more susceptible to deaths and spreading of the virus:

\- Average age of death due to Coronavirus in Italy is 82 [1]

\- In Italy, 3.65% of the population is 80 or older [2].

\- In Korea, 1.75% of the population is 80 or older [3]

[1] [https://www.epicentro.iss.it/coronavirus/bollettino/covid-19...](https://www.epicentro.iss.it/coronavirus/bollettino/covid-19-infografica_eng.pdf)

[2] [https://www.populationpyramid.net/italy/2019/](https://www.populationpyramid.net/italy/2019/)

[3] [https://www.populationpyramid.net/republic-of- korea/2019/](https://www.populationpyramid.net/republic-of-korea/2019/)

<comment> T-A 3.65% / 1.75% ~ 2.09, so the difference in age profile might explain a factor 2 in the mortality ratio of Italy vs South Korea.

The actual ratio is currently 7.9: 827 out of 12462 cases in Italy (6.6%), 66 out of 7869 cases in South Korea (0.84%).

<comment><USER3> A large number of South Korea infections are even younger due to how it spread.

Italy: Above 80: 1,532 (18.4)% vs age 20-29: 296 (0.0)%

South Korea: Above 80: 243 (3.1)% age 20-29: 2,261 (28.7)%

[https://en.wikipedia.org/wiki/2020_coronavirus_pandemic_in_S...](https://en.wikipedia.org/wiki/2020_coronavirus_pandemic_in_South_Korea)

[https://en.wikipedia.org/wiki/2020_coronavirus_pandemic_in_I...](https://en.wikipedia.org/wiki/2020_coronavirus_pandemic_in_Italy)

Of note, neither country has had anyone under 30 die. Deaths in the 80+ age range are 8.23% in South Korea and 13.2% in Italy.

PS: South Korea saw 2 deaths under age 50 where Italy has seen 1. So this age is by far the largest factor.

<comment><USER4> I'm not sure how the media should report on deaths over 80, or even over 90.

It's not that old people aren't worthy of protection, but when you're 85 in the US you have a 10% chance of dying in the next year for any and all reasons.

So saying this disease kills 15% (for example) of 80+ year olds without context sounds horrific, but contextualized in the actual risks of just being very old to begin with, sounds much less scary.

If Italy, for example, were to report on the number of fatal infections in people younger than the natural life expectancy, the fatality rate would drop in half.

<comment><USER5> Fatality numbers won't reflect those who developed permanent lung damage or had to go into intensive care.

Best not to suggest anything that might down play the seriousness considering how infectious this virus is. (Otherwise it may encourage risky behavior.)

<comment><USER6> but what about the risks of over-selling this disease? Look at Italy for example. I've read self-reports from healthcare workers claiming 200% hospital capacity. I can only image the needless death resulting from such panic.

Mind you that isn't covid 19 putting them over-capacity. In the worst hit region in Italy (Lombardy) confirmed covid 19 cases represent enough cases to take up less than 10% of their hospital beds. So it seems incredibly unlikely anything but panic is to blame for such absurdly high over capacity.

<comment><USER7> > _In the worst hit region in Italy (Lombardy) confirmed covid 19 cases > represent enough cases to take up less than 10% of their hospital beds._

Do you have a source for this comment? This WaPo story from 6 hours ago says differently:

[https://www.washingtonpost.com/world/europe/italy- coronaviru...](https://www.washingtonpost.com/world/europe/italy-coronavirus- patients-lombardy- hospitals/2020/03/12/36041dc6-63ce-11ea-8a8e-5c5336b32760_story.html)

> _Giulio Gallera, Lombardy's health chief, said Thursday that the region > would reach its capacity in "five, six or seven days," even if it tried to > add more beds in hospital "cellars." In an interview with Italy's La7 > channel, Gallera described the possibility of adding 500 intensive-care beds > at Milan's expo center, the kind of rapidly assembled zone that China > created in the hard-hit Wuhan area._

<comment><USER6> lombardy has 7280 confirmed cases [1] lombary has a population of 10MM (wikipedia) italy has 3.18 hospital beds per 1000 [2]

the math for that adds up to 31,800 hospital beds 7280 confirmed cases is 22% - so my sources were off or wiki is wrong as originally I recall reading lombardy has a 16MM population.

I will say that your article claims they haven't run out of ICU beds yet but that number is surprisingly high for ICU needs to cover covid 19. The article implies 600 ICU cases from covid 19 - that's over 12% ICU from confirmed covid 19 cases, which is more than twice what china reported.

It's also very surprising how few ICU beds they have allocated towards ICU....

The USA has something like 14% of hospital beds as ICU beds [3] but Italy appears to only have have less than 3% of their beds available for covid 19 ICU

[1] [https://www.statista.com/statistics/1099375/coronavirus- case...](https://www.statista.com/statistics/1099375/coronavirus-cases-by- region-in-italy/) [2] [https://en.wikipedia.org/wiki/List_of_OECD_countries_by_hosp...](https://en.wikipedia.org/wiki/List_of_OECD_countries_by_hospital_beds) [3] [https://www.sccm.org/Communications/Critical-Care- Statistics](https://www.sccm.org/Communications/Critical-Care-Statistics)

<comment><USER8> Most hospitals don't have all that much slack in bed capacity; especially at the tail end of flu season most of those beds are already filled. The hospitals may be extrapolating the growth rate of the disease and realizing how soon they will have problems. Or given the nature of the outbreak it could be that even within Lombardy there are areas with much higher concentrations of cases, like there are more cases, inc. per capita, in Wuhan than other cities in Hubei.

What's not plausible is ICU beds being taken up by people who don't have the disease (maybe miild-to-moderate flus or bad colds) and are just panicking. Emergency room lines, sure. Test shortages, absolutely. But hospitals will not put someone who's just scared and doesn't even need to be admitted at all into the ICU.

<comment><USER9> > Most hospitals don't have all that much slack in bed capacity; especially at > the tail end of flu season

Remember that there's a difference between hospital beds and ICU beds.

In the UK, we maintain 80% utilisation of our ICU beds all year round[0], with very little change in the number of beds available in real number terms. We have ~4100 total ICU beds, which can be expanded to ~5000 if all operating theatres, etc are shut down and used as ICU equivalent instead.

While getting past flu season will help the total number of beds, it does nothing for the ICU.

This is the other reason why it's increasingly important to [https://www.FlattenThesCurve.com](https://www.FlattenThesCurve.com) and employ social distancing techniques. The rate of patients being admitted into ICUs needs to be slowed as much as possible. Once we're out of capacity, every additional patient has a much higher probability of dying than the overall fatality statistics indicate.

[0] [https://www.england.nhs.uk/statistics/wp- content/uploads/sit...](https://www.england.nhs.uk/statistics/wp- content/uploads/sites/2/2020/03/MSitRep-SPN-v2.1-Ja7T2.pdf)

<comment><USER10> There's a typo, it's [https://www.flattenthecurve.com/](https://www.flattenthecurve.com/)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> > South Korea has since reported 67 deaths out of nearly 8,000 confirmed > cases, after testing more than 222,000 people. In contrast, Italy has had > 1,016 deaths and identified more than 15,000 cases after carrying out more > than 73,000 tests on an unspecified number of people.

Surely the testing is a huge factor. Test more people you'll find more people infected, so the fatality rate will get smaller. If you're like the US and test very few you get the huge fatality rates we saw in Washington.

If you could quickly and accurately test everyone in the country today we would know how to isolate and the whole thing would be over very soon. Not having a reliable test makes this whole problem as bad as it is.

<comment><USER12> Singapore is probably doing as best as any country could hope to.

[https://www.npr.org/sections/goatsandsoda/2020/03/12/8145224...](https://www.npr.org/sections/goatsandsoda/2020/03/12/814522489/singapore- wins-praise-for-its-covid-19-strategy-the-u-s-does-not)

Also, as an American, I'm embarrassed by my country's response and by how my president addresses the nation. PM Lee shows how you talk to your country:

[https://www.youtube.com/watch?v=3mYs1Uyx3c8](https://www.youtube.com/watch?v=3mYs1Uyx3c8)

His original address five weeks prior:

[https://www.youtube.com/watch?v=dExr76Wckr8](https://www.youtube.com/watch?v=dExr76Wckr8)

<comment><USER13> Singapore has been competent, but Taiwan's response has been more impressive.

It's very close to the hot zone, millions of people travel to and from mainland China every year, it has roughly the population of Australia living on 10% of the land Japan has, the WHO refuses any cooperation, and yet there have been under 50 cases and no local transmission.

Not only that, but as a democratic state, Taiwan's control measures have been remarkably measured.

I'd credit two factors:

1) Imposing travel limits three weeks before China even admitted there was an outbreak. After SARS, the TW government had a plan for this epidemic and a healthy skepticism for both official news and the WHO.

2) Taiwan has a relatively high trust society. People generally trust the local CDC and make a genuine effort to take preventative measures, even those primarily for the safety of others. A phone alert is generally all that's needed as a quarantine reminder for those exposed.

<comment><USER14> China reported Covid19 to WHO on 31 Dec 2019, do you say that travel curbs were put in Taiwan in early December?

<comment><USER15> Taiwan started acting on 31st Dec. [https://jamanetwork.com/journals/jama/fullarticle/2762689](https://jamanetwork.com/journals/jama/fullarticle/2762689)

Taiwan has had a spectacular response to the virus - that is the gold standard that Italy (or Korea) should be compared against.

<comment><USER16> They were hit badly by SARS and learnt a lot of valuable lessons. This is our European SARS moment, hopefully.

</comment></comment></comment></comment></comment></comment><comment><USER17> There's sooooo many lies being propagated by different governments on the true state of things. This afternoon I watched a live broadcast of parliament in which the minister of health claimed Belgium was doing far more extensive testing than any other country on earth. This at a time when standing instructions to medical personnel are to _only_ test people that are already admitted to hospital because of severe pulmonary conditions. It is impossible to get a test under any other circumstance as all test request have to follow a central approvement procedure and non are approved barring these conditions.

These outright lies are propagated by the political parties that are far more concerned with 'the economy' than with any public health. It is really saddening that his is going on.

<comment><USER18> The surgeon general just gave a press conference in Baton Rouge with the governor of Louisiana saying we should only test people (or prioritize testing of) people with symptoms. This when we know asymptomatic people can be contagious for days.

The Port of New Orleans is testing embarking cruise ship passengers but not disembarking (!) ones. This when we have community spread in the parish already and have gone from 1 to 6 to 11 cases this week alone.

<comment><USER19> > we know asymptomatic people can be contagious for days

Although it is technically correct, this is the least contagious way. AFAIK most sick people were near sick persons for a considerable amount of time.

[0] [https://www.mhlw.go.jp/stf/seisakunitsuite/bunya/kenkou_iryo...](https://www.mhlw.go.jp/stf/seisakunitsuite/bunya/kenkou_iryou/dengue_fever_qa_00014.htmlhttps://www.mhlw.go.jp/stf/seisakunitsuite/bunya/kenkou_iryou/dengue_fever_qa_00014.html)

<comment><USER18> Your link is giving a 404. (It looks like it's pasted in twice.) And with regard to the cruise ships, see Question 13 of your linked FAQ.

It seems false positives are a real thing [1] but can we afford even one asymptomatic infected individual that might be a super spreader? In shifting away from containment are we just accepting these?

[1] [https://news.ycombinator.com/item?id=22566923](https://news.ycombinator.com/item?id=22566923)

<comment><USER20> His link had the url twice concatenated. If you remove that part then it works [1]. Here is a google translation of the relevant section:

> Although the possibility of transmission from an asymptomatic person has > been reported > ([https://www.nejm.org/doi/full/10.1056/NEJMc2001468)](https://www.nejm.org/doi/full/10.1056/NEJMc2001468)), > little is known on how Coronavirus disease 2019 (COVID-19) spreads from > person to person. Generally speaking, with most respiratory viruses, people > are thought to be most contagious when they are most symptomatic. > [https://www.cdc.gov/coronavirus/2019-ncov/about/transmission...](https://www.cdc.gov/coronavirus/2019-ncov/about/transmission.html)

That CDC link [2] states that:

> People are thought to be most contagious when they are most symptomatic (the > sickest). Some spread might be possible before people show symptoms; there > have been reports of this occurring with this new coronavirus, but this is > not thought to be the main way the virus spreads.

[1] [https://www.mhlw.go.jp/stf/seisakunitsuite/bunya/kenkou_iryo...](https://www.mhlw.go.jp/stf/seisakunitsuite/bunya/kenkou_iryou/dengue_fever_qa_00014.html#Q2)

[2] [https://www.cdc.gov/coronavirus/2019-ncov/about/transmission...](https://www.cdc.gov/coronavirus/2019-ncov/about/transmission.html)

<comment><USER18> As to my second point, the Japanese are not letting people disembark cruise ships willy-nilly without being tested as per that link

</comment></comment></comment></comment></comment></comment><comment><USER21> Italy got caught by surprise - they only found out that they had cases when a 38 year old (!) walked into an ER with advanced symptoms. Given that this age bracket is not commonly affected by these harsher symptoms it is clear that they had long ongoing community transmission which has now culminated in the current catastrophe.

Germany is doing a bit better in this respect, it took them 1000 cases to 'get' the first death, showing that they have caught it very very early, due to their decentralized testiing system. That said, NPI must be ramped up significantly...

The US is maybe the most troublesome target for this virus in the developed world. A healthcare system that works well for few rich cancer patients is the opposite of what you want for a disease like COVID19.

<comment><USER22> Germany is counting deaths differently. If you have heart issues and you die due to a heart attack you're not counted as a COVID death. In Italy you are as long as you test positive.

<comment><USER23> > If you have heart issues and you die due to a heart attack you're not > counted as a COVID death

That doesn't seem to be the case - a man from Baden-Württemberg, who died earlier this month, was only tested positive AFTER he was already dead for a few days and counted towards the statistic.

This means your general statement cannot be true.

</comment></comment></comment><comment><USER24> I noticed something else that might be an interesting correlation: available "acute" hospital beds.

I don't have time to do the full correlation, but here's the data:

[https://stats.oecd.org/index.aspx?queryid=30183](https://stats.oecd.org/index.aspx?queryid=30183)

Select "Curative (acute) care beds"

Scroll down to the Per 1000 population.

Italy: 2.62

Korea (assuming South): 7.14

The list of countries in that table is a good bit shorter than the countries fighting Covid-19, but I think it might be illuminating.

Can someone draw that up? Compare, perhaps, current death rate by country with available "Curative (acute) care beds" per 1000?

<comment><USER25> Italy has not yet reached the limit for ICU beds, whatever it is. People dying here is still within capacity, for now.

<comment><USER26> That disagrees with all the information that has been coming out of Italy for the last _three days_.

Perhaps because hospitals there (and in general) are always running at 80-100% capacity, so it didn't take much for the extra COVID-19 cases to max them out.

<comment><USER27> Indeed most EU ICU services are already usually running at around 90% with the usual issues (including the Flu). And please also do consider that most of theses cases are within the Lombardy region and that most ICU patients are very difficult if not impossible to transfer safely to other regions. While the ICU beds are limited, the amount of ambulances equipped with ICU equipment is probably even smaller (and will also require an ICU nurse+doctor on board during the transfer).

<comment><USER26> And then there is looming material shortage.

For instance, in my home town (Kraków, Poland), hospitals cancelled planned procedures yesterday - not due to the amount of COVID-19 patients itself (Poland still has double-digit number of reported cases), but because the hospitals run out masks, gowns and gloves. Which means that once coronavirus patients start appearing, things will get really ugly real fast.

</comment></comment></comment></comment></comment><comment> 2019-nCoV This outbreak is a litmus test for the competence of countries. It's already shone a bright light on the fragility of global supply lines, cheap travel and open borders. These are the aspects of life most likely to change after this is all over.

<comment><USER28> >These are the aspects of life most likely to change after this is all over.

People will forget about this in a year and go back to life like it's always been. Short term convenience trumps everything except short term negative consequences.

<comment><USER29> No. I remember 9/11, and this feels worse. The world won't be the same for a decade. Are you too young to remember when you could just walk straight onto a plane without being searched? Those days never came back.

<comment><USER28> I remember 9/11, saw the second plane hit with my own eyes. Other than airports and flying being more inconvenient nothing fundamental really changed as I saw it. People still traveled, people still flew and so on. Now you just budget an extra hour before a flight.

<comment><USER30> Geopolitics has seen massive impact since then. For example, the rise of ISIS is a direct descendant of the Iraq war which is a direct consequence of corrupt and criminal decision making by the Bush/Cheney admin in response to 9/11.

Debatable if the Arab Spring would have occurred without it, as the Middle East might have been much more stable.

<comment><USER28> Sure but the comment I responded to wasn't about geopolitics but daily life changes.

<comment><USER31> Because geopolitics does not change daily life? Damn, you should see some geopolitics where I live.

</comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> It's been making the argument that Korea's aggressive testing has allowed them greater control over the epidemic.

Of course, there are a variety of other factors at work. Italy is the second "oldest" country in the world after Japan so Coronavirus infections just would be more deadly there. Also a lot of the Korean infections were confined to a single city in Korea (though the Italian infections also had an epicenter).

<comment><USER32> If Italy is the second oldest country in the world after Japan, how do they have 800 deaths compared to 16 in Japan? Something about those numbers seems off. Is it because Japan's elderly population tend to live in rural areas compared to Italy's or something else societally related?

<comment><USER33> meh. I've been married to a Japanese for over 2 decades now, and lived in Tokyo for many years including when Fukushima happened. I wouldn't trust Japanese politicians with their reported numbers any more as I'd trust China or the US.

There is one difference in Japan to Italy that might explain the lower infection rates: it's socially accepted to wear face masks (not only since covid but since the 90ies actually!)

<comment><USER32> Even if the numbers aren't reliable, reports of Japanese intensive care units being overrun aren't easy to hide, but Japanese hospitals don't seem to be under the same pressure as hospitals in Italy.

Making mask wearing more acceptable might be a cultural adjustment humanity has to make as we become more urbanized and globalized if it'll help reduce the severity of disease transmission. Looks like Japan's stumbled onto a very useful societal adaptation.

<comment><USER34> Japan has _a lot_ of intensive care units. I guess it comes with having a generally older population.

<comment><USER35> but not compared to other developed countries (except England):

              [1] [2]
      Germany 3.7 24.6
      France  3.3 9.3
      England 2.7 3.3
      USA     2.4 20
      Canada  2.4 13.5
      Japan   2.2 4 to 5

1\. Ratio of physicians to patients (per 1,000 population)

2\. Number of ICU beds (per 100,000 population)

<comment><USER36> Do you have a source for those numbers? They differ significantly from [https://stats.oecd.org/index.aspx?queryid=30183](https://stats.oecd.org/index.aspx?queryid=30183), but perhaps your source is more reliable.

Edit: nevermind, I misunderstood the definition of "Curative care (acute care) beds in hospitals".

<comment> Al-Khwarizmi Now that you understood it, can you explain what the difference is? It's not obvious to me either.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER37> Especially relevant to HN:

> This includes enforcing a law that grants the government wide authority to > access data: CCTV footage, GPS tracking data from phones and cars, credit > card transactions, immigration entry information, and other personal details > of people confirmed to have an infectious disease. The authorities can then > make some of this public, so anyone who may have been exposed can get > themselves - or their friends and family members - tested.

<comment><USER38> I wish we developed this kind of capability so that we could opt-in. Wouldn't it be a hell of a lot better than nothing if 50% of the population chose to download the app, allow it to access our location and allow us to input symptoms and status, receive recommendations, then when this is all over, delete it?

<comment><USER39> Except that last part won't happen.

Like the PATRIOT act, it just keeps being extended.

"For the greater good"

</comment></comment></comment><comment><USER40> Just curious, does anybody know how did Japan manage to do so well, inspite of a very old population.

Also what does HN think is the better place to be right now? A mega city or a small village?

<comment><USER41> Japan simply isn't testing enough patients, so I would wait a few weeks before judging how well they did.

That said, inconceivably they don't have many serious cases. (If the virus was really spreading exponentially, we'd certainly see a lot more patients, tests or no tests.) So they must be doing _something_ right. It's just hard to tell if they could keep it this way.

<comment><USER42> I said it up thread, but curious to get more responses.

My hypothesis is this had already spread like crazy everywhere. Now we just are seeing the exponential discovery of it.

What marks the places hardest hit with severe cases is the bad air quality. Which acts as a further agitator on lung related complications.

<comment><USER43> Norway has very good air quality and still relatively hard hit.

<comment><USER42> Do you have the numbers handy?

And note, I mean hit hard with high severity cases. Not just cases. My hypothesis is that it is already everywhere. Most of this exponential growth is just how fast we can deploy testing.

<comment><USER44> I don't know about severity, but Norway is the European country with the highest infection ratio, after Italy and tiny Iceland. As of today:

\- Italy: 1 case per 3.996 inhabitants \- Iceland: 1/4.285 \- Norway: 1/6.710 \- Denmark: 1/9.081 \- Switzerland: 1/10.035 \- Spain: 1/14.831 \- France: 1/23.292 \- Germany: 1/30.160

<comment><USER42> From my searches, they are currently at zero deaths? Low, at any rate.

Feels like this supports my hypothesis. If anyone starts looking, they will find cases. Only if you have a baseline lung damage rate that is elevated will you see severe cases.

<comment><USER45> The first death in Norway was yesterday, an elderly person.

I tried looking up some numbers on severe cases, but the Norwegian Institute of Public Health webpages are currently experiencing some DNS issues.

<comment><USER42> Late responding, but if you find anything, I am still interested!

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER46> >Epidemiologists say it is not possible to compare the numbers directly. But some say the dramatically different outcomes point to an important insight:

Don't compare these numbers....but if we do it anyway...

</comment><comment> 1-6 S. Korea is very interconnected as a society. Technology does have a role but people are generally receptive of personal information being collected and used. For example, in order to hand out the proper number of masks, they have APIs which allows a database to inventory pharmacy mask handouts. In the face of a crisis, are Koreans forfeiting their privacy or are they trying to curb a bad situation? Americans would definitely not tolerate any info sharing and now there are strict laws against information collection.

<comment><USER47> Yes. They're generally quite compliant and community-oriented as well.

If the health minister says the best way to slow this is to stay inside, then generally they'll stay inside.

Meanwhile, I have friends who are giving the middle finger to caution and are heading off on their flights for spring break - all for the privilege of being carriers.

</comment></comment><comment><USER48> I'm curious about the cultural differences. Physical contact, kiss on the cheek, is much more common in Italy than in Korea. That can play a huge factor.

<comment> 1-6 Koreans rarely hold hands in friendship too. Shaking hands, etc. You bow instead. When you go on a date, you're lucky if you get to hold hands on the first date. Kissing in public? Unacceptable.

<comment><USER41> Well, yeah, but go to a restaurant in Korea and everybody thrusts their spoons and chopsticks into shared side dishes and soup bowls. That must count for something. :/

<comment> 1-6 H.Pylori

</comment></comment></comment></comment><comment><USER49> S.Korea is also effectively an island - water 3 sides + sealed N.Korea border. I don't think it's useful comparing large interconnected EU countries response capabilities against Asian Tigers islands (Korea, Singapore, Taiwan) with deep collectivist cultural roots and large demographics that still remember living under centralized authoritarian rule. In the case of Singapore and China, still are.

Italy has too much travel, old demographics and interconnected borders to respond the way Korea did. And we don't even know if Korea is out of the woods yet, they got more clusters recently.

<comment><USER50> > [...] deep collectivist cultural roots and large demographics that still > remember living under centralized authoritarian rule. In the case of > Singapore and China, still are.

From Singapore's Wikipedia page:

> Freedom House ranks Singapore as "partly free" in its Freedom in the World > report,[137] and The Economist Intelligence Unit ranks Singapore as a > "flawed democracy", the second best rank of four, in its "Democracy Index" > [1]

Singapore is a flawed democracy, just like Hong Kong. Its unfair to mention it in the same breath as China which, according to the mentioned index, _is_ Authoritarian.

[1] [https://en.wikipedia.org/wiki/Democracy_Index](https://en.wikipedia.org/wiki/Democracy_Index)

<comment><USER49> It's a valid comparison in the sense that both Singapore and Chinese governance structure allows extremely despotic interventions that other representative forms of governments cannot. The broad point that the countries that responded effectively so far either have the benefit of authoritarian mobilization capabilities or still have vast populations that experienced living under the shadow of authoritarian regimes. I don't think we'll see similar levels of compliance in the west, on top of actually having very difficult borders to police.

</comment></comment></comment><comment><USER51> Reminder for those in despair...

It is merely enough to make the r0 after containment measures less than 1.

Then the problem will eventually go away.

As someone said, social distancing measures to work must be done when it seems to be overreacting.

And if they work, it will seem as if we overreacted.

<comment><USER52> Your last line is the super important point, occurred to me today as well. If we beat this thing with social distancing, idiots will say "See! There was no reason to panic!"

<comment><USER53> and what if it died down due factors other than social distancing? You're positing an irrefutable claim which is sloppy logic.

<comment><USER54> Whether it's social distancing or some other factor, the important point here I think is that it wouldn't have died down on its own. For you to look at the positive outcome alone and say "see, it wasn't a problem to begin with!" is just as irrefutable as to say it was the social distancing. So you have to use understanding of the disease, logic, data from other countries, etc, to come to your conclusion.

(You ask an annoying, but fair and important question here. We shouldn't lose our skeptical mind.)

</comment></comment></comment></comment><comment><USER55> What's interesting is, many South Koreans still believe the South Korean government is to blame. Perhaps no people are satisifed by their government?

Usual counterarguments are like these:

1\. The government should have prevented the entry of foreign nationals who recently visited China. It could buy us some time to develop treatment to the disease. To this day, no such ban has been imposed.

2\. It should have prohibited masks from being exported in January. Many masks are suspected to be exported to China, which is believed to have contributed the scarceness of masks. Thankfully, the exportation is banned now.

3\. The government shifts a little too much responsibility to the cult. In addition, some people blames Daegu, where the cult made thousands of people infected, for not handling the situation properly, to prevent the central government from being blamed.

But after seeing the reactions of other countries, I'm starting to believe South Korea's actions were actually pretty good, at least relatively. What do you think?

<comment><USER56> Counterargument #1, #2 is due to the government's stance towards China. The government is trying to win back China's (so called) friendship, which was shattered when the U.S. deployed THAAD there.

South Korea was able to handle this not because the government did good, but they experienced the MERS outbreak in 2015. Legislative measures to prevent outbreaks were made then. (plus the lesson of impeachment I guess)

</comment></comment><comment><USER57> Korea is doing some robotic testing of the samples:

> Rather than a human mixing the solutions, the samples are instead put into a > diagnostic machine. Inside the machine, a robot arm pipettes the solution > and mixes the liquids on a number of tests at once. According to Chun, this > method takes only four hours to test samples from 94 patients -- four times > faster than the manual method. It also reduces the risk of human error or > contamination.

[https://www.cnn.com/2020/03/12/asia/coronavirus-south- korea-...](https://www.cnn.com/2020/03/12/asia/coronavirus-south-korea- testing-intl-hnk/index.html)

<comment><USER58> I think a lot of places are probably using automated testing machines. Apparently, Public Health England has been operating theirs 24/7 after the staff go home to keep up with the incoming samples, and that's one reason why results take a lot more than 4 hours.

</comment></comment><comment><USER59> Its not tests we should be counting but the number of people seriously sick and work back from that.

If we know that a percentage of the population will get hospitalised we can get a good estimate of the actual infected population.

I think that the UK estimates that 10K people have it in the UK for example. (Number may be wrong, but they have produced an estimate based on the number of sick who tested positive)

The UK is basically saying, currently, to not expect to be tested, that you will get it and that they have good knowledge of the levels. They are testing sick people in hospitals only. They also say that advice is likely to change each week.

</comment><comment><USER60> I do not know how south korea managed to get as many test kits as they did, but Italy (and the rest of europe, the us, everyone except south korea and singapore) simply do not have enough testkits to be able to copy them. So instead we have to limit the spread by telling people to work from home. Also Italy found out they were infected much later than south korea. people estimate the virus had been spreading for weeks when they did.

</comment><comment><USER61> It's clear countries that previously suffered from SARs and Swine Flu reacted to COVID-19 more effectively.

South Korea's outbreak only even got that big because one person was a super spreader.

[https://www.aljazeera.com/news/2020/03/31-south-korea- sudden...](https://www.aljazeera.com/news/2020/03/31-south-korea-sudden-spike- coronavirus-cases-200303065953841.html)

</comment><comment><USER62> Anecdotally, my younger sister spent last year as a foreign exchange student in Modena (northern Italy). She explained that she's not surprised at all about the impressively quick spread there as nearly everyone she knew and interacted with greeted each other with two kisses on the cheek! I can't imagine how difficult it must be to contain a virus with such deep ingrained cultural norms.

</comment><comment><USER63> US is pretty much headed for the italian model thanks to almost non-existent leadership and people unwilling to isolate themselves, feel the right to go everywhere public while sick and cough/sneeze on everyone

A month from now there are going to be so many people sick, hospitals overwhelmed and they won't be able to hide the death count anymore.

</comment><comment><USER64> My understanding is that the epicenter in Korea was a church whose audience skews young, which has affected the mortality rate there. Basically, if you have a bunch of young people get it, your mortality rate will look lower than if it spread through an older segment of the population.

</comment><comment><USER65> > They are testing hundreds of thousands of people for infections and tracking > potential carriers like detectives, using cell phone and satellite > technology.

No but thanks. I do not want to allow a spy-state that might stay after the virus is sunset.

Italy doesn't track people, as EU court ruled.

</comment><comment><USER66> It's not just the number of cases that differ due to different testing regimes. Another difference is that Italy did some post-mortem testing to identify cases that were wrongly reported as flu etc. but were covid19. I assume they were included in the number of dead. I don't know if they did the same in South Korea. Numbers sometimes are difficult to compare.

</comment><comment><USER67> Interesting detail in the article: in Korea testing is free if referred by a doctor, or it is up to 140$ if you just want to be tested.

<comment><USER34> Having a fever, and enough money, I'd happily pay $140 for the peace of mind that comes with that test.

<comment><USER68> Agreed, but unless you can self-isolate, it's not going to last very long.

If you got tested weekly, the costs would soon mount up.....

<comment><USER69> I'd hope to not have a fever weekly.

<comment><USER68> You can be infected without having a fever. That's one of the problems with coronavirus.

Knowing you have the virus won't save you, of course, but you will be able to react accordingly. That will include trying not to infect anyone else....

</comment></comment></comment></comment></comment><comment><USER40> Is there any map of the spread within Italy (or any other country) region wise, so that one could see how effected different regions are, and how region wise quarantined have worked.

<comment><USER70> From a colleague of mine: [http://www.risklayer.com/blog/Tracking%20Coronavirus%20at%20...](http://www.risklayer.com/blog/Tracking%20Coronavirus%20at%20a%20subnational%20level/) .

</comment></comment><comment><USER71> Is there a site that comments on general news, has an educated audience and debunks spurious or dubious claims? I'd like to read my news through such portal.

GN or WN (General, World) vs HN

<comment><USER72> The reason HN works (well one reason) is vigorous moderation and a stamping out of any mode of discourse apart from collegial intellectual discussion. As a result, we don't see memes or most of the other cheap humour you will find on e.g Reddit. It also seems to lead inevitably to people whining about downvotes, and to people whining about people whining about downvotes.

HN is basically ideal for analytical, logic bound folks, and it works because the topics tends to be things that we can reason about and evaluate using logic.

HN would not work if the topics were more general. Anything political for example seems to hardly lend itself to logical discussion. It's impossible to imagine a @dang enforcing civilised discourse on political discussions.

<comment><USER69> HN _sometimes_ has good political discussions - not as often as one would hope, but more often than (I suspect) just about anywhere else.

The rest of the time, yes, the political discussion turns into a steaming garbage pile, and deng has to kill it.

</comment></comment></comment><comment><USER73> How about Occam's razor? A much easier explanation be we err on the number of infected people. Tests are one way to approximate the number of infections.

</comment><comment><USER74> Interesting theory here is the difference in treatments using Chloroquine & Zinc Treatment Combo [https://www.youtube.com/watch?v=U7F1cnWup9M&fbclid=IwAR0GU2S...](https://www.youtube.com/watch?v=U7F1cnWup9M&fbclid=IwAR0GU2SmuRA2MB2bJzBWJnDFQQbyFZWJMFi8Hj1YwCuRg4_ypXWgJHLV_4Y)

<comment><USER75> If it's just numbers, why not post a link to text or type it up instead of linking to a YouTube video

</comment></comment><comment><USER76> One tangential snippet that I heard but I don't know if it is true or not is that in Northern Italy, there are whole garment factories that are staffed and possibly owned by Chinese purely so that they can be designated as Italian clothing manufacturers.

<comment><USER76> To my downvoters see here [https://fashionista.com/2013/02/as-more-chinese- factories-po...](https://fashionista.com/2013/02/as-more-chinese-factories- pop-up-in-italy-what-does-it-mean-for-the-made-in-italy-label)

</comment></comment><comment><USER77> The end of the EU.

</comment><comment><USER78> Hydroxychloroquine

</comment><comment><USER79> TL;DR S. Korea traded privacy and freedom for security.

<comment> 1-6 You're absolutely right. It's been an ongoing part of day-to-day life for Koreans. Fortunately, things are pretty transparent and there aren't big businesses trying to monetize on this information (but this may change in a flash).</comment></comment>


Just published a Node.js module to convert JSON to CSV - <AUTHOR> https://www.npmjs.com/package/jsonexport

<comment><AUTHOR> Feel free to make comments on the module usability or the code =)

Thanks!</comment>