Cheap automatic license plate readers are creeping into neighborhoods - <AUTHOR> https://slate.com/technology/2019/07/automatic-license-plate-readers-hoa-police-openalpr.html <comment><USER2> There are an increasing number of things that were so person-hour intensive before that they were legal but not practical, with the understanding the police would only do them if they had a good reason, like following a suspect as they went about their day. Now with the ability to do it so cheaply I think we have to acknowledge that in these cases a difference in degree has essentially become a difference in kind and we need to go back from square one and evaluate how we use these tools.

</comment><comment><USER3> I want one. Specifically I want one that includes a directional microphone to detect noise violations, then automatically tweets the lic plate number, time, street, direction to the police, and then continues to collect the information providing predictive tweets to the police (Lic plate XYZ is likely to pass at location A at time Y with a volume 10x the legal limit). I live next to a noisy street and sound insulating my bedroom is over $10k. This would be a much cheaper solution to the neighbors crotch rocket at 4am.

<comment><USER4> Brilliant idea, I have the same problem, but unfortunately for me the main culprit is London's overground and the neighborhood cars are a small part of the noise troubles so I'm not sure how much good it'd do me

</comment></comment><comment><USER5> It is dead easy to set up a raspberry pi to do license plate recognition.

In python, it's probably 10 lines of code.

Once you import the openalpr library, then you get a routine that in one call takes a jpg image and returns an array of <plate-number>, <confidence %> pairs.

<comment><USER6> Sucks they charge to use the python library

<comment><USER5> I think it is GPL: [https://github.com/openalpr/openalpr](https://github.com/openalpr/openalpr)

<comment><USER6> OOOOOOO i misread their documentation, thank you!

</comment></comment></comment></comment><comment><USER7> License plates are public information. There is no website or state DMV that you, a private citizen, can go to and get the information on the plate's owner.

<comment><USER2> That is true, but there are ways to get it either with some footwork or money. The second concern is tracking people who you know. Imagine if I tracked every time my neighbors cars entered or left their garages, and every guest that came and saw them. This is perfectly legal, but also very creepy.

</comment></comment><comment> 1-6 It's not only about the big companies being accountable for holding data. What about private individuals uploading gigabytes of data to the public web?

</comment><comment><USER8> So could someone mount these cameras on private property with views of major highways and stand up a subscription service?

<comment><USER8> looks like it's out there - [https://www.irbsearch.com/vehicle- sightings.html](https://www.irbsearch.com/vehicle-sightings.html)

<comment><USER9> Any idea how much this service costs?

<comment><USER8> no idea, didn't look at it too hard.</comment></comment></comment></comment>


Things learned from biking across America - <AUTHOR> http://janedotx.posterous.com/things-learned-from-biking-across-america

<comment><USER2> God---I hope he at least bought a touring bike and not a road bike...

<comment><USER3> Dude--as someone else says, read the article.

And then, check out some of the other entries. Has an interesting (read "unusual") bit of introspection. Worth checking out.</comment></comment>


Signal introduces support for reactions - <AUTHOR> https://signal.org/blog/reactions/ <comment><AUTHOR> The post's title includes an emoji and doesn't make sense without it. I tried using that but HN stripped out the emoji, so I wrote my own title that doesn't need an emoji</comment>


VPN DNS leak test - <AUTHOR> https://www.dnsleaktest.com/ <comment><USER3> And this issue could be easily overcome if more projects implemented the "socks5h://" protocol (note the 'h'), initially introduced by curl[1] to mandate the SOCKS proxy to also tunnel DNS requests. Sadly it seems that very few programs recognize this (non-standard) protocol: git[2] (using curl), python's request (and urllib) module[3] ... And not much else.

[1]: [https://curl.haxx.se/docs/manpage.html#--proxy](https://curl.haxx.se/docs/manpage.html#--proxy) [2]: [https://github.com/git/git/blob/20fed7cad40ed0b96232feb82812...](https://github.com/git/git/blob/20fed7cad40ed0b96232feb828129e3a2ee9860d/http.c#L855) [3]: [http://docs.python- requests.org/en/master/user/advanced/#soc...](http://docs.python- requests.org/en/master/user/advanced/#socks)

<comment><USER4> Firefox over a SOCKS5 proxy done with ssh passes this test if you enable the proxy DNS setting. Creating the proxy is as simple as:

      ssh -D 9999 -q -N <your ssh server>

and then configure that in the firefox proxy settings (socks to localhost:9999). If you want a simple way to enable/disable this in firefox I built a minimal extension to do it:

[https://addons.mozilla.org/en- US/firefox/addon/proxyswitcher...](https://addons.mozilla.org/en- US/firefox/addon/proxyswitcheroo/)

The defaults in the config already match that ssh line so all you need to do is press the globe button to enable the proxy.

<comment><USER5> You might be the right person to ask:

When I tried shadowsocks and enabled "proxy dns" in Firefox, every website became painfully slow. Is this simply because no DNS cache had been built?

<comment><USER4> Don't know but note that shadowsocks is not a traditional socks proxy. If I understood it correctly you do a traditional socks proxy to localhost and then a more heavily encrypted link to the actual host. Maybe that second link was slow, either because of the encryption or because it's written in python? ssh gives you as much or more security anyway as there are few protocols as thoroughly checked than ssh and performance seems nice.

</comment></comment></comment></comment><comment><USER6> Why is a software VPN so difficult to get right? Why are so many of them so poor, or miss certain protocols, or have so many leaks?

Casting aside actual "vulnerabilities" (like buffer overflows, bad encryption, etc...), why can't a software VPN act just like a hardware VPN? Take every byte of traffic sent to a network device, and tunnel it to another endpoint?

I'm assuming there are several major reasons that I don't know about that makes what seems like a really trivial problem super difficult...

<comment><USER7> > Take every byte of traffic sent to a network device, and tunnel it to > another endpoint?

You have to set up routing tables to decide which interface to use for which destination address. Obviously you can't direct VPN packets via VPN - <USER2> would be circular. They have to use your normal, physical connection to get to your default gateway. But what if your default gateway is also a local DNS server? You can't differentiate protocols in routing table.

Hardware VPN have it easier - they already know which packets to tunnel because it has designated hardware port for internal network.

<comment><USER6> Interesting. So from yours and the other comment, it sounds like the issue really comes down to not being able to force all applications to use the "VPN interface", while still keeping the "hardware interface" functional so the VPN itself can use it.

I can see why it can so quickly become a giant mess...

Assuming it's the OS that needs to "fix" this, are there any changes either already made or in the works to better address this use case, or is a hardware VPN still going to be the only "real" way to securely tunnel a system for the foreseeable future?

<comment><USER7> You can use custom kernel filter on Windows and iptables/netfilter on Linux to allow only one process to access physical interface. I've seen Cisco VPN Client (10 years ago or so) do it - apart from CVPND service, all traffic to/from ethernet was dropped. That included kernel stuff - to the point your PC didn't even respond to ARP packets from anything other than gateway.

Of course, introducing custom kernel driver and/or your own mini IP stack is way harder to do in a safe way - that's why it's not usually included.

As for Linux solutions - I haven't seen VPN client that used this technique, but I guess it's a lot easier, since all the required userland tools are already there.

</comment></comment></comment></comment><comment><USER8> It would appear that Firefox's built-in SOCKS support successfully proxies DNS as well, though I've always wondered whether or not there aren't other ways to leak your IP via browser APIs. I imagine that Flash almost certainly would, and I wouldn't be surprised if WebRTC does somehow.

<comment><USER9> Yeah, but you have to set "socks_remote_dns" to "True" in about:config, which is not the default.

<comment><USER10> At least in Firefox 52 ESR there's UI to enable that (so no need to fiddle with about:config):

 _Edit_ → _Preferences_ → _Network_ → _Settings_ → _Proxy DNS when using Socks v5_

But yeah, it's not the default. :\

</comment></comment></comment><comment><USER11> I'm really really interested to find out how they're discovering the DNS server IP addresses I'm using.

The only clue I have is that they're trying to resolve a bunch of fake domain names (which show up as unresolveable in the console).

The webpage has the IP addresses written directly into it (so clearly the data came from the server) which means there's nothing I can investigate (eg, in JS) from my end.

What's going on?

<comment><USER12> "The DNS leak test works by sending your client a series of domain names to resolve within a specific test domain. Each request is sent from your client to your configured DNS server. Even if you have configured a single DNS server, there may be many other servers that the request is passed on to in order to be resolved (normally to load balance the requests). For example if you configure Google DNS then you will often find 6-10 Google DNS servers which are fullfilling the DNS requests."

via [https://www.dnsleaktest.com/what-is-the- difference.html](https://www.dnsleaktest.com/what-is-the-difference.html)

Basically it's sending you unique subdomains and then in turn seeing what IP addresses DNS requests come from. Since the subdomains are tied to you, it can tie the requests from the DNS servers you're using back to you.

<comment><USER13> friendly reminder not to use google DNS if you care about privacy (which you probably do if you're using a VPN in the first place), because you're basically giving them your fingerprint in the form of the websites you visit.

<comment><USER11> Hmmmm.

Google has ~7ms response time for me though. Even my ISP's nameservers are slower than that :( the average everywhere else is 200ms (yup).

My internet is slow enough that this makes it a tiny bit more annoying.

But you make a very valid point, and... _sigh_ convenience is such an hacked catalyst nowadays :(

</comment></comment></comment></comment><comment><USER14> Be carful here. You might not see the IP you expected even if everything is fine. BGP anycast and other load balancing technologies can make it look like the wrong IP. Make sure the IP is owned by the service you expect vs. being the exact IP you have configured.

</comment><comment><USER15> Crap, failed on my home road-warrior setup. Now I have to go figure out which OpenVPN config settings to change to forward DNS better.

<comment><USER16> There is a page on the site that can help you with this [https://www.dnsleaktest.com/how-to-fix-a-dns- leak.html](https://www.dnsleaktest.com/how-to-fix-a-dns-leak.html)

</comment></comment><comment><USER17> This is also a handy way to see if your outbound DNS requests are being hijacked and sent to another resolver instead of your chosen ones. One router I tested redirected everything to OpenDNS if parental controls were in use, some networks redirect everything to their internal resolvers, etc. Mainly for interest purposes/spotting configuration mistakes than anything else.

<comment><USER18> There's a page about transparent DNS proxies [0] on the same site. They also have a page about how to fix dns leaks when using OpenVPN [1].

One way to ensure that DNS responses have not been tampered with is to use DNSCrypt [2].

Can someone confirm that I understand this correctly : if I don't use DNSCrypt and if my DNS responses are tampered with in a phishing attempt, on a site that uses https, the browser will raise a cert error since the attacker won't have a valid certificate. So phishing attempts by spoofing DNS responses are only effective when the site uses plain http.

[0] [https://www.dnsleaktest.com/what-is-transparent-dns- proxy.ht...](https://www.dnsleaktest.com/what-is-transparent-dns-proxy.html)

[1] [https://www.dnsleaktest.com/how-to-fix-a-dns- leak.html](https://www.dnsleaktest.com/how-to-fix-a-dns-leak.html)

[2] [https://dnscrypt.org/](https://dnscrypt.org/)

<comment><USER19> Not just http, any unencrypted channel is vulnerable to this. So SMTP or pop without encryption would also let someone into your email.

</comment></comment></comment><comment><USER20> It makes sense to me to always configure your firewall alongside your VPN. If you are under the impression that all traffic on your system is routed via your vpn, you can state that explicitly in your firewall. If things still work, it must be true :)

</comment><comment><USER21> The test works fine on my iPhone but as soon as I try it on my PC connected through Viscosity it's stuck seemlingly forever. I killed it after a few minutes. Upon disconnecting it's all good and fast. What could I be doing wrong here?

</comment><comment><USER22> [https://ipleak.net](https://ipleak.net) Is similar, but has some useful additional diagnostics.

</comment><comment><USER23> There's a lot of talk about various services being vulnerable to dns leak tests or not. Which I think is slightly funny, since you're WAY more likely to suffer data leaks via the innumerable ways your browser can do it.

For what it's worth though, a modern openvpn configuration can beat it handily. An example of a service that passes with flying colors is ProtonVPN, which I just checked last night since they've got a crazy discount going right now.

</comment><comment><USER24> Pardon my ignorance, but do DNS leaks impact Tor anonymity or are we strictly talking VPNs?

</comment><comment><USER25> ipvanish is good if anyone else is wondering

<comment><USER26> Just tested my Ipvanish and yes it looks fine except some servers eg when connected to Singapore, say Costa Mesa USA (i'm in Australia).

</comment></comment><comment><USER27> VPN is not supposed to hide you, it just provides access to some resources that are not available without VPN.

<comment><USER28> Well, not always or not always like that. For example, I use VPN so I can achieve my true download speed when downloading from Steam, since my ISP limits to download speed in that case.

<comment><USER29> Which country, which ISP, please?

<comment><USER30> I'm not OP, but the same thing happens to me - UK, Virgin Media, even on their highest tier truly unlimited 200mbps bundle. Steam will start downloading at close to 20MB/s and then slow down after 10-15 minutes. When connected via VPN it runs at full speed all the time.

<comment><USER28> Similar speeds here but works differently. Mine just gets throttled to ~2.5MB/s from start until I turn my VPN on, then I get my correct 20MB/s.</comment></comment></comment></comment></comment>


Ask HN: Honouring the Sabbath - <AUTHOR> I am not really religious at all (non-practicing lapsed catholic), but I recently stumbled upon a discussion that got me thinking: Should we as hackers/makers/business people honour the Sabbath? To be clear, I am not asking if it is _morally_ better to honour the Sabbath, but rather: would it make us more productive to be forced to have a "contemplation day"?<p>https://www.reddit.com/r/homestead/comments/4g800g/honoring_the_sabbath/ <comment><USER2> I am Sabbath observant, and I consider the requirement to unplug once a week a real blessing. Perhaps this is confirmation bias, but I feel my work benefits from a relaxation day. I couldn't imagine working a week where I have no end in sight.</comment>


Improved Digital Certificate Security - <AUTHOR> http://googleonlinesecurity.blogspot.com/2015/09/improved-digital-certificate-security.html?m=1 <comment><USER2> What is a "Symantec-internal testing process" that leads to Google certs being leaked outside of Symantec? Is some engineer poking around and just used "google.com" as an example? Seems like a pretty serious wtf moment. If I was Google I would be pissed.

<comment><USER3> The kind where they used Chrome to browse to an internal testing website? Though using a real website, like Google, instead of a mock is quite wtf. What I'm curious about is whether the fired* Symanted engineers were just scapegoats or had they actually been reckless and unprofessional.

* [http://www.symantec.com/connect/blogs/tough-day-leaders](http://www.symantec.com/connect/blogs/tough-day-leaders)

<comment><USER4> > In addition, we discovered that a few outstanding employees, who had > successfully undergone our stringent on-boarding and security trainings, > failed to follow our policies. Despite their best intentions, this failure > to follow policies has led to their termination after a thoughtful review > process. Because you rely on us to protect the digital world, we hold > ourselves to a "no compromise" bar for such breaches. As a result, it was > the only call we could make.

> As much as we hate to lose valuable colleagues, we are the industry leader > in online safety and security, and it is imperative that we maintain the > absolute highest standards. At the end of day, we hang our hats on trust, > and that trust is built by doing what we say we're going to do.

Wow.

I have to say that I respect that decision. Without knowing the circumstances, I have to say that willful disregard for security policy while handling materials as sensitive as a CA cert is indeed not something I'd want to see from employees at a CA.

<comment><USER5> Agreed that the steps taken vis-a-vis these employees may have been the right one if they indeed breached company policy. But I do have an issue with publicizing this so openly, and using this to showoff of how serious "we" are. Even with the best intentions, you will run into bad apples. You still need to have the right controls, preferably automated, to avoid sensitive material to be used for internal purposes. Blogging on how they terminated employees doesn't help to showcase their leadership imho.

</comment></comment></comment></comment><comment><USER6> One has to wonder how much of these CA shenanigans have been going on before these news sytems were put in place systems to catch the rogue certificates.

It would stand to reason that people are more wary of it now that there is a high risk of getting caught.

<comment><USER7> And furthermore, how many CAs have "solved" the issue by outlawing all use of Google Chrome by their staff anywhere near their systems.

</comment></comment><comment><USER8> After reading DrDuh's guide to install yosemite, I thought a bit more about the ~200+ trusted CAs on my computer. I removed about ~50 using various heuristics, mostly arbitrary stuff like removing goverment agencies, and international CAs that I was skeptical of or otherwise assumed I would not need.

To get to my question though, how many CAs does one need to trust for the safest browsing experience? What CAs should be trusted and how can they be evaluated? How many-ish are you guys trusting?

<comment><USER9> Interesting; have you had issues loading any popular websites?

<comment><USER8> Funnily enough, I must have dropped the certificate for bing somehow. It hasn't affected any popular sites yet though.

</comment></comment></comment><comment><USER10> [https://api.ctwatch.net/domain/ycombinator.com](https://api.ctwatch.net/domain/ycombinator.com) is an RSS feed of all issued certificates for ycombinator.com and its subdomains.

Feel free to use that to check your own site's certificates!

(It's possible to directly query the multiple Certificate Transparency log servers for your site's certs, but non-trivial, hence why I implemented the above functionality.)

Code: [https://github.com/certificate-transparency- watch/](https://github.com/certificate-transparency-watch/)

<comment><USER11> It looks like you're using CloudFlare.

This RSS service is useless to all Tor users, as CloudFlare attempts to serve up a catpcha here. Serving a captcha on an RSS feed defeats the purpose of RSS automation.

<comment><USER10> Thanks for letting me know.

Yes, I'm using CloudFlare, for its trivial SSL, DDOS protection, and caching.

I have CloudFlare's DDOS protection (the thing that causes captchas) set to "Essentially Off", the lowest available setting on their free plan.

I just tried to query [https://api.ctwatch.net/domain/ycombinator.com](https://api.ctwatch.net/domain/ycombinator.com) multiple times, each on multiple Tor circuits, but was unable to trigger the CloudFlare captcha.

Did you see the captcha on my site, or is it just that you've noticed captchas on some other CloudFlare sites?

I can look into setting up a Tor hidden service, which'll allow Tor users to bypass CloudFlare, if CloudFlare is actually causing issues.

<comment><USER11> I had issues with newsbeuter retrieving your feed with Tor.

Regardless, CloudFlare shows such disregard and contempt for privacy and anonymity that I'm not comfortable using services that use CloudFlare (Hacker News excepted!).

</comment></comment></comment></comment><comment><USER12> Wtf is a "pre-certificate"?

<comment><USER13> Certificate Transparency is a (mostly Google-developed) program which aims to require that certificates be publicized to some third party, so that mis- issuance (just like this one!) can be detected. You do this by telling a third-party log server that you're issuing a certificate for a domain, and the log server gives you back a proof (essentially a countersignature) saying "Yes, I am a third-party log and I've seen this certificate and I'm publicizing its existence."

You can submit the actual certificate to the Certificate Transparency log, but then you don't have that proof immediately, so the certificate isn't usable until after it exists. (And the easiest way to send the proof to a client is to embed it in the cert itself.) So instead, the CT protocol allows you to generate a "pre-certificate", a modified certificate with a special X.509 extension poisoning it from actually being used as a certificate. It is a promise that you are willing to issue this certificate, but cannot be used to authenticate.

Since it can be exchanged for a CT log proof, just like an actual certificate can, it has exactly the same verification / trust requirements as actually issuing a cert. However, it cannot be used as a certificate.

Chrome now requires Certificate Transparency for all CAs that it has authorized to sign extended validation (EV, green bar with the company name) certificates, as those are held to a higher standard than the rest of the CA system is (currently) held. While Google also operates the logs, they shouldn't have needed any special access: any website operator can ask the logs "Hey, what proofs have you issued recently," and cross-check those against the certificates they actually intended to get signed.

</comment></comment><comment><USER14> This article was already posted, without the mobile formatting.

<comment><USER15> Link: [https://news.ycombinator.com/item?id=10242987](https://news.ycombinator.com/item?id=10242987)

</comment></comment><comment><USER16> Is this a different situation to the CNNIC Google cert issued earlier in the year? If so, how?

<comment><USER13> CNNIC issued the intermediate to someone who was doing non-consensual, large- scale SSL MITM. CNNIC evidently didn't realize that's what they were doing, and _possibly_ the company didn't either (and just accidentally MITM'd their own technician's connection to Google during testing -- not that this makes the story better), but in either case CNNIC should not have issued a non-HSM cert and they should have vetted the technical competence and goodheartedness of the customer. Furthermore, they said they were not issuing intermediates, and had not updated their certification practices statements before entering this "experimental" business.

In the Symantec case, the private key in question remained with Symantec at all times, with employees who legitimately had access to the EV certificate authority as part of their job, in the course of testing. It was never exposed to anyone outside the CA.

CNNIC sold a valid, unconstrained intermediate private key to a completely unqualified customer and had organizational troubles at all levels. We were lucky that the customer was _also_ incompetent, and just got caught. Symantec had a few employees make a mistake internally, and at no point could anyone malicious (other than potential malicious employees) threaten internet security. And those specific employees got fired.

<comment><USER17> > non-consensual, large-scale SSL MITM

Link to this? The story was that they issued it to some v Egyptian company that wanted to run a CA. This company was incompetent and didn't have an HSM. They did have a Palo Alto MITM box that had "CA capabilities", so they used that. Then an engineer at this company plugged his machine into the MITM port, loaded Chrome and tada.

Utterly incompetent and against the CA rules. But not large scale or non- consenual MITM right?

<comment><USER13> Oh, yeah, you're right. They put their globally valid, unconstrained intermediate cert in a device whose primary purpose is large-scale SSL MITM, and they MITM'd themselves without realizing it, but yes, they weren't _intending_ to do large-scale non-consensual SSL MITM. I'd forgotten the part where they were planning on using the device as a way to issue normal certs and ignoring the MITM capabilities.

<comment><USER17> Seeing as how using a trusted CA to do MITM isn't even remotely a valid business plan or idea, I think it's quite possible that they were incompetent enough to use any piece of hardware, yes. It's actually better for the world if they were planning to do MITM, as they'd have been caught so fast and their plans killed so quickly itd be funny. As-is it's just luck that they messed up.

</comment></comment></comment></comment></comment><comment><USER18> This is not a "improvement", they just fixed something going really wrong.

</comment><comment><USER19> One has to commend Google on its transparency on the matter.

</comment><comment><USER20> That's the problem with TLS trust: All it does is tell a browser that a CA trusts the certificate. The process to verify site ownership varies and is error prone.</comment>


Fastmail: Staff access to your data - <AUTHOR> https://www.fastmail.com/help/ourservice/security.html#staffaccess <comment><USER2> Yes, though not routinely... but if you need help with something and we need to see your data for that, our support team will ask for your permission and then take a look for you.

Also: if we have credible evidence that your account has been misbehaving (e.g. spams, scams, etc with the headers that show they originated from your authenticated connection) then we'll investigate to see if you're a bad actor breaking our terms of service or just some poor soul who had their credentials stolen.

And if your account is the subject of an Australian warrant, and a judge has been convinced that there's cause to access your individual data, then we don't place ourselves above the law. We consider ourselves good citizens of the world, and that includes working with law enforcement where they have a warrant.

What we don't do is sell your data or profile you in order to allow you to be targeted by those wishing to exert undue influence based on knowledge gleaned from your private communications. That's the privacy that's being bought and sold by many in the current world, and leading to poor consequences. We stand firm against the sale and manipulation of people's private electronic memory.

We don't snoop on you, but we'll help you fix your account if you mess it up, and we'll get your access back if you forget your password (a friend of mine lost her entire email history when she forgot her password while using one of the heavy encryption services... oops. Security is about availability and integrity as well).

Our support team is on your side, because we only have one paymaster, and that's our customer.

<comment><USER3> Can you please consider improving the notes function of your product? I really want to have better fastmail integration in my life and not having to rely on a third party app for something as simple as notes would help a lot.

</comment></comment><comment><USER4> For all their policies, they're still subject to Australia's "NSL" equivalent that requires they disclose data to law enforcement without notifying you, and in the case of certain agencies, without a warrant.

Their servers are also located in the US, so they're accessible to three- letter agencies as well.

I recently switched to a German service. Data can still be silently disclosed but only if there's imminent danger or a judge issues a warrant. Of course the service is covered by GDPR and European regulators as well.

<comment><USER5> Who's this German provider and how do they compare in terms of pricing/features/UX to Fastmail?

<comment><USER4> I use mailbox.org but there's a list of others here: [https://thatoneprivacysite.net/email-comparison/#simple- emai...](https://thatoneprivacysite.net/email-comparison/#simple-email- comparison)

For me mailbox.org ended up being slightly cheaper.

In terms of features and UX I've found them comparable.

</comment></comment></comment><comment><USER6> Fastmail has a fair Australian presence; my limited understanding is that Australian law forbids secure-by-design encryption pipelines - so someone in Fastmail can read your email.

Whether or not that person works in support is an interesting but somewhat minor detail. It would be advisable not to use an Australian provider for your data if that is important to you.

<comment><USER4> > my limited understanding is that Australian law forbids secure-by-design > encryption pipelines

This understanding is wrong. Secure encryption is perfectly legal, tech media simply likes to overreact to laws without actually reading them.

The underlying law that lead to this widespread misconception requires Australian companies to assist law enforcement in acquiring communications but only when it can be done in such a way that nobody else is affected [0].

The example I usually use to illustrate what this means is:

\- The law could potentially compel WhatsApp to add code to their application that checks for a particular hard-coded user ID (i.e. new IDs have to be pushed through the app signing and update process) and when the user with that ID sends or receives a message, a plaintext copy is sent to law enforcement.

\- The law could _not_ compel WhatsApp to add a law enforcement key to every message or to otherwise weaken their encryption or security in anyway.

[0]: [http://classic.austlii.edu.au/au/legis/cth/consol_act/ta1997...](http://classic.austlii.edu.au/au/legis/cth/consol_act/ta1997214/s317zg.html)

<comment><USER6> That doesn't sound secure. What that is describing is that third parties can easily intercept my data. It isn't a huge deal because email is by nature quite insecure; but if I cared about other people reading my emails the law is a bit of a problem. At some point these companies will probably leak data onto the public internet (if the Panama papers can leak, anything can).

Secure by design includes ideas like the pipe forgetting what it transmitted after it finishes transmitting it.

<comment><USER4> It isn't secure and I wasn't saying it was secure. What I was saying is that the law gives you no less technical protection than you had before the law.

Importantly, the law doesn't compel you to have any interception capabilities. If you publish open-source code with verified and reproducible builds, the government can't really ask you to do anything, as doing so would either alert the people they're targeting or compromise the security of people unrelated to the investigation.

And I don't think this is any different to anywhere else. The FBI for example has been able to gain access to encryption keys in the past so I see no reason why signing keys would be any different.

</comment></comment></comment></comment><comment><USER7> It's obvious that someone who has to process your stuff in plain, unencrypted form (e.g. for spam filtering) can also access it when debugging etc.

Apparently they have strict policies in place to first ask users for consent first whenever they need to, seems good to me (happy customer of pobox since 1997 / fastmail since 2013).

</comment><comment><USER8> To me, Fastmail is the option if you want inexpensive, reliable email where there will be ZERO reading of your email by bots to build a marketing profile of you to be sold to whomever wants to buy it. Anyone presenting a legitimate warrant is going to get access to your content and I'm not trying to hide from those people.

</comment><comment><USER9> Any data that leaves your own device unencrypted can be read by other people. Is that newsworthy?

</comment><comment><AUTHOR> Support asked me to authorize their access by replying "OK" to an email of them. I asked to know more about this and they said that only trained engineer will access my data, and that they would wait for me to reply OK to their email before to do so...

<comment><USER10> So, the team is being pretty transparent and explicitly wait for your approval. So, I guess it's a good point, right?

<comment><USER11> I think the point is that the permission management is manual, not systematical.

<comment><AUTHOR> At least it'd be good to have an automated email when someone from support access your data with what data was accessed, when and by whom and for what purpose (i.e. related to your support request).</comment></comment></comment></comment>


What do people honestly think of chat bots like this? I honestly hate them - <AUTHOR> https://levelone.support/ <comment><USER2> The idea of having a chatbot as a service strikes me as what would happen if you had matrix of trendy ideas in both the rows and columns and someone must have thought "oh, chatbot... As a service? Looks like it hasn't been done before" And seeing the perceived lack in the market was enough to create it without considering if it was even worth creating.

I haven't used this service but I have a feeling this could easily be executed poorly.</comment>


Show HN: Rasterfarian – convert low res photos to HD - <AUTHOR> http://www.rasterfarian.co

<comment><USER2> It might be useful to have some demo images?

<comment><AUTHOR> Thanks for the tip - added some for now :) (You might have to close your browser to see the update)

</comment></comment><comment><AUTHOR> Thanks for your comments and suggestions - I do welcome any more you may have!

</comment><comment><USER3> uploaded an image and got a INTERNAL SERVER ERROR.

<comment><AUTHOR> It may have been poorly timed with me updating the index page, sorry! (See DanBC's suggestion)

</comment></comment><comment><USER4> Nice, Graeham!</comment>


Free MIT Online Class teaches CS fundamentals using Python - <AUTHOR> http://ocw.mit.edu/courses/electrical-engineering-and-computer-science/6-00sc-introduction-to-computer-science-and-programming-spring-2011/

<comment><USER2> Python is such a better language for teaching programming and CS fundamentals than Java or C++.

There is of course a case to make for teach C , ASM or LISP first.

Trying to teach something like OO best practices will be lost on students if they haven't done enough programming to understand code complexity and why OO might be a useful paradigm.

Java is especially bad because you need to use the static keyword as well and the System.out object just to get "hello world" working

<comment><USER3> While it might be unnecessarily punishing, Forth could be an interesting introductory language. I think it says something very positive about a language when the first thing[1] you learn to do isn't how to write an expression, make a loop or describe a conditional branch- it's how to define a procedure and break a task down into parts.

[1]<http://www.forth.com/starting-forth/sf1/sf1.html>

</comment></comment><comment><USER4> Nice to see Shaw, Zed A. 'Learn Python the Hard Way' in the recommended textbooks :)

</comment><comment><USER5> I've been following this in my spare time for the last month. I've found it really useful. As a sysadmin who doesn't really do any _proper_ programming day to day and ends up learning just enough to scrape by in a few languages, I've found it really beneficial to go back to basics and learn to _think_ like a proper computer scientist.

</comment><comment><USER6> Dear HN, what is the conventional wisdom here on the merits of this course vs. other Python methods of learning, tutorials, classes, &c?

<comment><USER2> I don't know about conventional wisdom but I can give you my opinion.

Disclaimer: I have not taken this course, neither am I a python Wizard.

Their stated goal:

 _"It aims to provide students with an understanding of the role computation can play in solving problems.

It also aims to help students, regardless of their major, to feel justifiably confident of their ability to write small programs that allow them to accomplish useful goals."_

The point here is that teaching python is _not_ the primary goal so if you are already a competent programmer you may find it more efficient to pick up a more reference style book.

However, I can imagine this course explaining principles such as turing machines, possibly some data structures and computational logic.

Thus I can imagine it might be useful to people who are not going to be programmers but need an appreciation for the type of work that a programmers might do and what is possible with a computer. So maybe a business person or a designer.

It might also be useful for self taught programmers who want an introduction to the more rigorous aspects of CS and a more formal way of thinking about their programs.

<comment><USER7> I haven't taken the class, but have helped many friends through the course if they needed it.

The class is more of an introduction to programming using Python than a class about learning Python the language. They learned some things like sorting, searching, testing, basic hash tables, etc. However, the primary reasons the course exists are to see let students explore Computer Science or because their major requires that they take either 6.00 (This course) or 1.00 (Same type of course, but in Java.)

If you want to learn Python and you're an experienced programmer, this class will take you maybe a night or two to breeze through. I would recommend taking other courses on OCW instead though with a more specific focus. If you want basic-intermediate algorithms, take 6.006. If you want low-level, 6.004 is a great introduction. (If you want advanced algorithms, buy CLRS and take 6.046).

tl;dr: 6.00 is more for people that have never programmed anything before, not to learn Python.

</comment></comment></comment><comment><USER8> New update to a great course that many (myself included) have used to get started.

<comment><USER6> New update? I've seen this posted here before, sure enough. What part of the course has been updated?

<comment><USER8> Looks like it is a whole new term rather than a pure update. The original was with Prof Grimson and Guttag from Fall '08, this one is just Prof Guttag from Spring '11. The biggest change is the addition of OCW Scholar (which means the course is designed with more of an online flow -- for 'independent learners').

</comment></comment></comment><comment><USER9> This isn't the famous SICW class?

<comment><USER10> No, this is 6.00, which sounds like it is aimed at non-majors. My 11 year old son wanted to go through it with me, and so far the first lecture was good for him. 6.001 is the SICP course.

</comment></comment><comment><USER11> It will be a dream come true if Waterloo taught CS with Python.

<comment><USER12> While Python is my language of choice, I'm happy Waterloo starts off with Racket (Scheme/Lisp family language). Very little syntax to learn and great for recursion. I'm not really qualified to comment whats best, I just know I enjoyed it.</comment></comment>


"TechStars NYC killed it today with its first ever Demo Day in New York City." - <AUTHOR> http://techcrunch.com/2011/04/14/nyc-techstars-nestio-thinknear/

<comment><USER2> the most amazing thing about all these companies is the level of market traction, almost all of it achieved in the last few months.

vieforit-- fashion deals site has the top 25 premier labels signed up and selling.

red rover-- corporate q&a site has over a million $s in revenue scheduled for 2011

immersive-- video display site has LOIs with manufacturers of 20% of all public display screens in the US.

thinknear-- has about 10,000 stores signed up as of today

not to mention the hackers and engineering chops across all of them

</comment><comment><AUTHOR> Photos: [http://www.flickr.com/photos/bouldair/sets/72157626498695232...](http://www.flickr.com/photos/bouldair/sets/72157626498695232/detail/)</comment>


Comcast Takes on Google with 2Gbps Internet Service - <AUTHOR> http://www.pcmag.com/article2/0,2817,2479953,00.asp

<comment><USER2> Putting aside the Comcast hate in this thread, this is great. This is competition at work. Comcast isn't going to force you to buy, and they're going to lower their current prices for 500 Mbps customers and launch 2 Gbps service that will cost somewhere between $70 and $400.

Call me crazy, but I wouldn't want the other ISPs to surrender. Google can't cover the whole country in reasonable time, and what's to say their service won't devolve if they were Comcast's size? I'd much rather see the market forcing improvement.

I've done a lot of work in the internet industry, and I feel like the execs are FINALLY waking up to the reality of customer demand. I've been on conference calls with C-level execs at major telecommunication companies who are still banking on their advantage: the landline. Yeah, seriously.

</comment><comment><USER3> I wonder how they're going to handle this with only 1GB Ethernet interfaces being the standard. Will they just have multiple ports on the bridge/router device? Built-in 802.11ac?

</comment><comment><USER4> With 0.00005% the customer satisfaction.

</comment><comment><USER5> with a download cap of 1GB :)

</comment><comment><USER6> For 6x the price.</comment>


Show HN: Messaging App - <AUTHOR> https://www.ironnotice.com <comment><USER2> How did this reach this high on HN? Also source?

<comment><AUTHOR> I do not know. What source?

<comment><USER3> code

<comment><AUTHOR> Here is the client source code: [https://github.com/ghbutton/iron- client](https://github.com/ghbutton/iron-client)

</comment></comment></comment></comment><comment><AUTHOR> I made a little desktop end to end encrypted messaging app

<comment><USER4> end to end without self hosted open source servers have (among others) a tradeoff: either opaque server you can't trust at all, or no offline messages. Which one you decided on?

<comment><AUTHOR> I was thinking of making the client code open source (eventually) so that users can know that their privacy is respected

<comment><USER4> So you choose opaque server. At least do not hide the offline validation as deep as whatsapp and others do.

also work with linux/android distros do distribute the built from source client. otherwise, it's just more of the same

</comment></comment></comment></comment><comment><USER5> I wish you luck on your app!

<comment><AUTHOR> Thanks!</comment></comment>


Samoa Ends Measles State of Emergency as Infection Rate Slows - <AUTHOR> https://www.aljazeera.com/news/2019/12/samoa-ends-measles-state-emergency-infection-rate-slows-191229021559134.html <comment><AUTHOR> "A mass vaccination drive covering 95 percent of population brings deadly disease under control."</comment>


Microsoft results offer hope to tech sector - <AUTHOR> http://www.ft.com/cms/s/0/4bceaa84-a145-11dd-82fd-000077b07658.html

<comment><USER2> Standard Oil also did pretty well during the Panic of 1873.</comment>


The Cost of Not Getting Tested for Coronavirus: A $10K ER Bill - <AUTHOR> https://thecity.nyc/2020/03/the-cost-of-not-getting-tested-for-coronavirus-a-10k-bill.html <comment><USER3> We decided (slash "made the mistake") of going to the emergency room last summer. Spent less than two hours in an exam room before being dismissed with no conclusion and referral to another doctor. Got a $9500 bill about six months later and have been billed a 10% copay on that (insurance paid $5500 already at their negotiated rate). Still fighting it as absolutely absurd, but there's really no hope. This country is fucked. It's an embarrassment.

<comment><USER4> I paid something like $800 for one crutch when I sprained my ankle once. Think another $300 for ibuprofen. Now I know why there's a crutch market on craigslist/thrift stores. Not sure what my insurance paid for xrays, etc, but my tab was something like $1100 for that ER rendezvous. Thought I broke my leg.

I had a laparoscopic surgery a few years ago that was $35k.

<comment><USER5> to be fair, you paid a doctor to administer you a crutch and ibuprofen, I'm certain that's not the raw material cost.

<comment><USER6> I wish that was the case. If you sort the line items by cost, I would be surprised if labor was on top. Maybe for surgeries, but I doubt that.

My insurance got billed 6k for a chest ultra-sound. They paid 4k. Hospital still wanted around 2k, had to negotiate and pay a little over 1k at the end.

The line item for physician cost (billed separately) had 2 digits.

<comment><USER5> >If you sort the line items by cost..

Do you really think current health care is giving accurate line items on your bill?

<comment><USER7> Wouldn't a bill with inaccurate line items amount to a form of fraud?

</comment></comment></comment></comment></comment></comment><comment><USER8> The statement from the hospital management boggles my mind: "In addition, there are different parts to a patient bill. One part is what the hospital charges the insurance company, one part is what the insurance company eventually pays [...]"

I can't think of any other business transaction where someone just puts a giant number on a bill and then is happy if someone pays ~25% of it. Such companies would be shunned by their customers and they'd go bankrupt. Is there any economic theory which explains how such odd of an system can emerge/survive?

<comment><USER9> Nothing about hospital billing would fly anywhere else. Bills just showing up after the fact with little ability to verify their accuracy, _constant_ errors one can catch anyway (so how many are missed?), bills showing up months later from a half-dozen different sources when you only had one apparent "vendor", and so on.

I bet we received between 100 and 200 pieces of mail for each of our kids' births, including maternal care before the births. Probably averaged 40-60 hours dealing with billing and billing problems with each one, maybe more. And ours were all totally normal and about as easy as it gets, and we had insurance. I think we ended up missing some tiny bill we could easily have paid in each one (oh, yeah, they also like to give you very little time to pay) and had them go to collections.

<comment><USER10> I found a bill with a mistake on it, as one of my kids was charged twice for a single procedure. I called to get it fixed, but instead of dealing with it they just immediately sent it to collections.

<comment><USER9> My experience has been that no one at the insurers nor at medical providers' billing departments give a shit until state regulators and/or legislators' offices get involved. Which means yet more time on the phone.

The amount of time lost dealing with this system of ours is incredible. All else being equal it would be a win just to eliminate that, and there's no reason to suppose that is the only improvement we could achieve.

</comment></comment></comment></comment><comment><USER11> Side note: if you suspect a COVID-19 infection, DO NOT GO TO THE ER. Contact a physician by phone, get instructions. By going to the ER you put a lot of people at risk.

<comment><USER12> At some point, the people who suspect COVID-19 infection are going to be people who have full-on pneumonia. They would need to go to ER under normal circumstance but indeed, that will have a bad result.

Basically, we desperately need a special COVID-19 program, not simply a person's regular physician giving instructions. How many physicians are going to be getting calls soon and how much time does that take important activity on their part? Etc.

Note that Korea has ER wards set-up with pre-entry tents allowing COVID patients to be routed elsewhere. Some multi-track system like this is going to be necessary or more desirable than Italy, which has shut down the part of its health care system not treating COVID patients and is still mostly watching them die.

<comment><USER11> > Some multi-track system like this is going to be necessary or more desirable > than Italy, which has shut down the part of its health care system not > treating COVID patients and is still mostly watching them die.

Please don't spread disinformation, this absolutely not what is happening in Italy.

ERs are working, hospitals are working.

Planned and elective procedures have been delayed, to spare personnel and rooms and to avoid creating new emergency cases in case the procedure goes wrong.

Italy has less than 7000 hospitalized COVID-19 patients. Dealing with those is not a problem. Even the 1000 people in ICU are not a problem themselves, the 600 in Lombardy are. Lombardy had around 900 ICU beds before the crisis (they now have more but the extra ones are makeshift); this means that 2/3rds of the bed are needed for COVID-19 patients only, which is obviously a huge problem. In Bergamo, the city with the worst situation, some people cannot be tubed because of lack of equipment will get will get a NIV instead, which is very very bad, but it's not "wathich people die".

BTW, Italy has enforced the dual track system for suspect COVID-19 cases since at least two weeks ago.

<comment><USER12> References? I'd love to believe this is the case but I haven't seen any mainstream news to this effect and I have indeed seen desperate shared tweet.

I mean, I'm happy if this is true but if you want to reassure people, give a reference.

Edit:

 _ERs are working, hospitals are working._

Press I read says: ER isn't working for non-COVID cases and isn't able to deal with a substantial number of COVID cases.

The term would be overwhelmed. And I know Italian hospitals are better than a lot of American hospitals, which certainly couldn't be called "top notch".

<comment><USER11> My direct source is Italian newspapers and personal conversation with ER doctors.

You can use google translate to read this local newspaper from Bergamo that quotes the Lombardy ministry of health about how this Monday they closed day hospitals (clinics? not sure how it translates) and scheduled surgeries are reduced to a minimum:

[https://www.ecodibergamo.it/stories/bergamo-citta/gallera- st...](https://www.ecodibergamo.it/stories/bergamo-citta/gallera-stop- attivita-ambulatori-da-lunediterapia-intensiva-corsa-contro-il-t_1343804_11/)

Don't get me wrong - the situation is bad, and it will get much worse. We can probably help Bergamo by shifting people around, if we reverse the trend and the rest of the country stays in a better situation, but if left unmanaged the epidemic would definitely bring the healthcare system to its knees. But we're not there yet and hopefully we'll be able to avoid it.

And again, because this is very important: COVID patients do not go through ER. Please tell everyone around you that if they suspect COVID they must NOT GO TO THE ER. In the beginning of the epidemic, before this information was understood by people, infections in the ER have been a major factor of the virus spread.

</comment></comment></comment></comment></comment><comment><USER13> As a Canadian who has also lived in America, I am consistently mortified by the costs of health care in the states.

Are they intentionally designed to force the lower class into even more poverty (I've seen $50 being charged for a pill of Advil - first hand) - or is it just an unintended side effect?

I find it harder to believe it's accidental than intentional.

EDIT: Due to jiveturkey's pathetic and wholly inaccurate defense of this system, and my inability to post in this thread further, I need to specify I was changed $740 to see the doctor and identify the issue. The pill _itself_ cost $50. Please don't defend this pathetic slavery of the lower class, guys, unless you're a part of it. I've actually got a photograph of this bill somewhere on my backup drive I'd love to share.

EDIT 2: And before any of you say this isn't intentional, please look up Martin Shkreli. The only difference between him and the other guys at the top of the industry is that he got caught.

Get real, guys. Please. Most of the comments here are beyond sad - I'm glad this has so many upvotes from people who silently disagree.

<comment> munk-a They are not - the effect these prices have on the poor is an unintended[1] consequence of the true aim. Extracting the most money possible from insurance payors - honestly, if hospitals could bill "You owe us 50$ or as much of that that your insurance would cover" then they would. Nobody actively wants to impoverish the poor (except for a small number of utterly terrible people) but payors force cost pass on to their subscribers as a way to keep the costs from getting too crazy and and the uninsured get hit by the full bill that providers want to extract out of payors simply because it's impossible for them to under bill without getting hit by lawsuits.

That paragraph was an attempt to be really fairly voiced so just to follow up - this system is utterly rotten and terrible, the US has one of the worst health care systems in the world when it comes to the non-super rich - <USER2> even for them there are better options - and it needs to be fixed.

1\. Edit note: Originally I used "unavoidable" here which was a poor word choice that's been pointed out below.

<comment><USER14> Also good to point out - payors actually benefit from crazy costs. Insurance companies had their profitability capped as a percentage of premiums collected[1][2]. The easiest path to profit growth is just to let claims balloon, then use that to justify premium increases.

[1] Technically it's a cap on all non-medical spending, rather than profit margin specifically. But in effect it's a cap on profits, as there's only so much overhead you can cut.

[2] [https://www.aeaweb.org/research/regulating-health- insurers-a...](https://www.aeaweb.org/research/regulating-health-insurers-aca- medical-loss-ratio)

</comment></comment></comment><comment><USER15> Definitely need to start cracking down on predatory hospital billing. 10K billed just for stepping into the ER Room without even getting tested is absolutely insane. AT point do we decide this is criminal and start taking actions against these guys? Normally, I would never be in favor of price ceilings but this is one industry that desperatly needs it.

<comment><USER16> I think once the dust has settled from COVID-19 the entire health system in America will be totally changed.

<comment><AUTHOR> I remember studying political science as an undergrad two decades ago. My professors all said the same thing about the Electoral College: "it's a relic that has long since stopped serving a practical purpose, but people live with it because it never rocks the boat. If there's ever an election where the winner of the popular vote doesn't actually win because they lost in the Electoral College, there will be a huge mass movement to finally get rid of it."

Since then we've had two elections in twenty years where a candidate who lost the popular vote "won" thanks to the Electoral College. And the Electoral College is still there.

In politics, never underestimate the power of inertia.

<comment><USER17> It's not about inertia. Look at which party benefits from the electoral college, and then recognize their attempts at voter disenfranchisement.

<comment><AUTHOR> Indeed, this was a key misconception my professors and I all shared: we thought there was a broad consensus in American society that democracy is a good thing. It turns out there are a lot of Americans, disproportionately gathered on one side of the ideological spectrum, who care less about democracy than they do about their team winning.

</comment></comment></comment></comment></comment><comment><USER12> Wow, this brings home what a huge crisis this is for US health care system. It's not just the huge costs or huge administrative overhead as such. It's that the entire system is built as "we design a giant filter-rationing- marketizing system to dole out services and _you_ pay for both the service and the rationing process". This stuff can't work for the Coronavirus at all. Testing needs to free and fast, not even "free eventually but there's bureaucracy first". Who knows when or if this paradigm will be abandoned but if it isn't, suffering will be tremendous.

But either way, the risks discrediting the filter-ration paradigm. If X can be provided for free to everyone, the question of why can't you will loom that much larger.

</comment><comment> munk-a Lets not forget that the US could dodge a lot of these issues (and increase the chances of a good outcome) by simply putting out a few tens of millions for tests and distributing them to providers free-of-charge with an agreement that there be no administration fee.

That is, honestly, sorta what a government should do in a crisis, just eat the cost to make sure everyone is safe - instead the government is "letting the market decide" and continues to dump millions times the cost of resolving this crisis into boondoggle never-gonna-work F-35 fighter jets.

</comment><comment><USER18> The US healthcare system is best described as a pack of wolves negotiating about whose going to eat the sheep.

<comment> munk-a I think that's close to accurate, but a better description would be "A pack of wolves fighting over who is going to eat the sheep".

The different market players here, PBMs, Payors, Manufacturers, Providers, Special Interest Groups, Advisory Boards and others - all are trying to bankrupt one another much harder than they're trying to bankrupt customers because customers have nearly no money to take - most of the inflow into this market isn't coming from the consumers but from the employers of the consumers (that are paying truly staggering amounts of money) and a lot of the damage you see to customers ends up being, essentially, collateral damage from one market player trying to stick it to another market player.

</comment></comment><comment><USER19> Just yesterday I was reading an interview with the CEO of a German company which produces coronavirus tests about how they charge 2.5EUR for a single testing kit and that reasonable cost for processing it should be around 10EUR. Where does the 1000x multiplier come from?

<comment><USER20> Huh? She wasn't tested. Whatever the ER charges, outrageous or not, why would you assume there's any correlation at all to the cost of a test that wasn't administered?

</comment></comment><comment><USER21> This is unfortunately why the US is going to fail miserably at containing SARS-CoV-2.

<comment><USER22> The reason we will fail to contain it is because we don't have any test kits. So we don't know the true rates of infection.

Policy: ignorance is bliss!

It looks better to have lower numbers.

<comment><USER21> Trump usually likes higher numbers

</comment></comment></comment><comment><USER23> The American healthcare system is the main reason I'd not want to move there.

<comment><USER10> I live in the US, and the healthcare system is the primary reason I want to move to another country.

</comment></comment><comment><USER24> The US, judging from Italy, is about 4 weeks away from a complete collapse of its healthcare system due to corona virus.

With no serious attempts at mitigation or contact tracing or testing, that thing is going to spread like wildfire.

</comment><comment><USER25> Is there anyone doing work on analyzing current legislation and providing alternate wording to fix the issue?

<comment><USER26> [https://www.congress.gov/bill/116th-congress/senate- bill/112...](https://www.congress.gov/bill/116th-congress/senate- bill/1129/text)

<comment><USER25> Sorry, that's just an impermeable wall of text to me. I'd love to know from someone who groks this, the specific wording in the bill that would address the ER costs issue, and where the current legislation fails.

Basically I'm looking for the bug fix, not the entire source code.. :)

</comment></comment></comment><comment><USER27> Serious question, why can't individual states rollout single payer healthcare ?

</comment><comment><USER28> Nobody should worry about Covid in the USA, 1) Trumps dead Uncle went to MIT and 2) we have his hunches to keep us safe.

Further, as long as we don't test in mass, our case numbers will remain very low.

<comment> munk-a It is depressing that the hyperbole comment is just a list of easily confirmable statements by the administration.

</comment></comment><comment><USER29> This story is total fake news. The patient is a teacher with a Cadillac health insurance plan. She paid $75 co-pay. The $10,000 bill is an illusion printed by the insurance company to make her think that her insurance is actually valuable. No one was paid $10,000. The hospital was paid a secret negotiated rate much much much much lower than $10,000.

<comment> munk-a The provider was paid 3,000 by the payor - that's how insurance billing works. It absolutely is a rats nest when it comes to finding out pricing information but the number on the bill is what ended up changing hands (less, possibly, any amount not covered and defaulted on by the patient).

I believe you're thinking of the provider's chargemaster and the pricing discrepancies there - this procedure was billable as 10,000 to a patient without insurance with the 7,000 discount being the payor's preferred rate - that 10k is the BS number that (mostly[1]) no one ever pays, while this 3k is the actual amount changing hands - for the patient the out of pocket cost is the most visible portion, but that bill was fully paid.

1\. Mostly everyone except for the uninsured or out of network - those folks will get stuck with that BS price 7k price, which is there since payors always want to feel like they're paying discount prices.

(edit - corrected numbers to be in line with the actual bill)

<comment><USER30> Insurance _never_ pays as much as they bill. This is one of the reasons to have it in the first place: each insurance company has negotiated rates with the hospitals. Even if you have high deductible, you'll still be getting negotiated rates, not the bullshit they (try to) charge people with no insurance at all. IMO, this is one thing that should be made totally illegal, no matter where one lands on the political spectrum: cash customers should be "favored", meaning cash price must match or be lower than the lowest insurance negotiated rate for each procedure. Anything else is just stupid and unfair. That way if the insurance pays five cents for the paper cup the pills come in, you can't charge fucking 13 dollars for the same thing if I pay cash.

<comment> munk-a I agree and find it utterly outrageous. I'm lucky enough to have avoided any hospitalizations in my adult life, but I am _quite_ familiar with this BS on the pharmaceutical side, in another comment on this article[1] I broke down that "preferred partner" price difference as I experienced it personally and it is insane that these pricing differences are allowed to continue. Also, bear in mind it's not just patients paying in cash - all these rules also apply to anyone unlucky enough to be treated out of network, even if it's just because they were brought to the wrong hospital while unconscious.

1\. [https://news.ycombinator.com/item?id=22550564](https://news.ycombinator.com/item?id=22550564)</comment></comment></comment></comment>


Apply for Rails job by making a battleship game that beats the server - <AUTHOR> http://battle.platform45.com/ <comment><USER2> I think this is a really good idea. Applicants need to write a Rails app that interacts with an API, and they need to write tests and everything. They also need to beat the server! which would indicate how smart they are.</comment>


Ask HN: Found someone building my SaaS idea, does that mean idea is validated? - <AUTHOR>

I'm about to start development on a new SaaS idea. The 'market' is not new, there are already some products out there - but they are crap.
I was planning on doing a landing page, and 'testing' the idea to confirm there is a need for a newer/better product.
I just found a competitor who is doing exactly what I'm planning on. They have a cool landing page, and an open beta.
Does this validate my idea? Should I just jump in and build the MVP product?
I am aware that it might be the blind leading the blind if they did not 'test' the idea themselves - but given the market already exists - I'm thinking it should be reasonably safe?
Thoughts? <comment><USER3> Is it an idea or something you truly believe in? Is this something that is limited based on when you live and being able to talk to your first clients? I had to move a thousand miles to get where i needed to be.

Can you get into the beta? If so check it out and see where you think they are lacking. Talk to customers before your MVP.. don't do what I did and sink several hundred hours into your MVP before finding out what truly matters to someone that would purchase your product.

Please also remember that just because they are showing a less feature complete or less crappy product compared to your vision doesn't mean that they aren't one commit away from meeting feature parity with you 3 months from now in your mvp .

If this post comes across as negative.. please don't think I'm down on your idea.. please try to consider things from all angles except UI and comparing features.

<comment><AUTHOR> great advise - <USER2>

</comment></comment><comment><USER4> How do you know yet what your MVP needs to be? What makes your implementation unique?

You still need to do customer development. If you simply jump in following the leader, you will always be playing catch-up. Having a close relationship with your customers, gives you insight into where the market is heading.

</comment><comment><USER5> "The 'market' is not new, there are already some products out there - but they are crap."

It doesn't matter if they are crap if there's no demand for the service.

"Does this validate my idea? Should I just jump in and build the MVP product?"

No, there are lots of failed to-do apps, does that mean u should build one too?

Everything is secondary if you have a good understanding of your market and the problems your potential customers face.

</comment><comment><USER6> How much domain knowledge do you have in your problem space?

If none then you'd better align yourself with people who do - key 'early adopter' customers, partners, advisors.

Otherwise, you won't know what people want/need/desire.

<comment><USER6> It's really about the broader industry rather than your product idea.

Can you see yourself researching opportunities in an industry for a while, and not being particularly emotional about any specific product idea?

If yes, you can very quickly and cheaply test out any idea for a product in your given industry with PPC, and you can start an SEO blog using Wordpress (I suggest Hostmonster) to tie together your PPC data and analytics in a giant data-driven feedback loop. This research-driven marketing approach will enable you to test out any product idea, and not lose ground if one doesn't fly. More specifically, if you have PPC/SEO keyword and traffic data that's tied to conversions you can almost instantly switch to a different product idea and still maintain marketing momentum.

</comment></comment><comment><USER7> I'd do a bit of work promoting your landing page and see if you get any interest.

If you think you can beat this competitor then go for it - or if you think the market is large enough to support both of you and some others.

<comment><AUTHOR> The market should be large enough for both of us - but obviously time will tell...

<comment><USER8> Should be? Don't guess, figure it out for sure.

</comment></comment></comment><comment><USER9> No. The idea is validated once you get _enough_ paying customers. Good luck.

<comment><AUTHOR> Yeah - I meant "validated" in terms of taking the project to the next level (i.e. turning the idea into a MVP), not "validated" in terms of guaranteed to bring in lots of cash.</comment></comment>


Why is installing programs in OS X sometimes unfriendly to newbies? - <AUTHOR>

I often see new OS X users struggle with a simple task such as installing an application. Why doesn't Apple just make it simpler (or at least set some guidelines for 3rd party devs) to use an OS that's supposed to be the most user friendly OS there is?
Confusion #1: When they download a regular DMG file, and Finder.app pops up with the application that's supposed to be dragged to Applications. However, Applications is nowhere to be found, and clicking on "Finder" again does nothing.
Confusion #2: An application is downloaded, he/she clicks on the file since the Downloads icon was bouncing. But that this point the actual Finder window sometimes pops up in the background, behind the browser. A lot of newbies just sit around waiting for minutes, expecting something to show up. <comment><USER2> Both relate to problems with Finder that go all the way back to the beginning of OS X. I suppose people used to OS X often become blind to them.

#1: Yeah, you'd think a visible sidebar with Applications visible would make sense. I've seen some of these that have an alias (shortcut) for Applications displayed in the folder, though. The non-obvious workaround I use is to press Command-N to get a new Finder window with a sidebar.

#2: Again, Finder. One possibility to recommend--have a Downloads window open in your browser. Then, even if the Downloads window for Finder hides itself, a visible connection can be made to the new file. Double-click in the Downloads window or, as I prefer, right-click=>Show in Finder.

I ignore the bounce from Downloads on the dock, and just treat it as a visual indicator of download completion, not an inducement to click like a normal bounce.

</comment><comment><USER3> Because they're supposed to be using the app store, which is very easy to use.</comment>


Think You Know How To Study? Think Again - <AUTHOR> http://www.npr.org/templates/story/story.php?storyId=130728588&ps=cprs <comment><USER2> As a professional student, I will save you all some time. The secret of studying is encompassed in three programs:

* Anki[1] (spaced repetition[2])

* SelfControl[3] (avoid procrastination, block websites)

* Pink Noise[4] (block noise to study anywhere, anytime)

[1]: <http://ichi2.net/anki/>

[2]: <http://en.wikipedia.org/wiki/Spaced_repetition>

[3]: <http://visitsteve.com/work/selfcontrol/>

[4]: <http://simplynoise.com/>

<comment><USER3> Would love to get your thoughts on Quizlet <http://quizlet.com/>

<comment><USER4> No computer science in your default subjects on the right? >=p For shame!

Anyway, here's a review from the perspective of someone who currently uses Anki off and on as his study aid du jour.

Your samples ("Browse by Subject") look like they're targeted at high-school level education; that was kind of a turn-off. (That is, I was expecting this section to give me an incentive to switch, but I already know this stuff pretty well - I was hoping to see higher level physics and chemistry stuff.)

I was worried that I wouldn't be able to insert images, but I found that.

Add LaTeX rendering and I would almost be sold.

For me, the biggest draw for Anki is that it exploits SRS (Piotr Wozniak's forgetting curve, etc).

If Quizlet did that (and showed me how it did it) and maybe e-mailed me when it was time to review cards (or maybe a digest of how many cards I need to study today) that would be enough to get me to switch over, and to recommend it to friends over Anki.

<comment><USER3> Point taken on the "default subjects" on the homepage - they were just meant to show off some of the most common stuff we have, but with 3 millions flashcard sets it's not easy to show it all :)

LaTeX, SRS, and study reminders are all three on our ideas list. We're making a big development push on audio first, and then are going to look more into these.

Our "Learn Mode" keeps track of what you know and what you don't - but only in the short term. We'd love to have better ways to help you remember things long-term.

</comment></comment></comment></comment><comment><USER5> I think the NYT article (linked to in the NPR one) has a better, less metaphor-rife explanation of the current research.

[http://www.nytimes.com/2010/09/07/health/views/07mind.html?_...](http://www.nytimes.com/2010/09/07/health/views/07mind.html?_r=1&pagewanted=all)

</comment><comment><USER6> _Doing practice quizzes can help you retrieve information on test day. "Tests have a very bad rap as a measurement tool," Carey says. But psychologists have found self-tests slow down the forgetting of material you've studied. "If you study something once, and then you test yourself on it," Carey says, "you do better than if you study it two times over."_

Makes sense. You get the feedback of feeling good when you get answers right, and you learn from mistakes when you get something wrong (i.e. the memory of thinking about your wrong answer and the right answer 'sticks' better in your mind).

</comment><comment><USER7> These are nice tips. I employ some of them at times, such as testing yourself and mixing it up, but the other ones I haven't. I tend to study either in my room at my house or the same desk at the library. Maybe I should try to mix it up sometimes. And the spacing it out thing...ha. I procrastinate waaay to much for that. Maybe I should stop that.

</comment><comment><USER8> They assume that the purpose of study is to pass tests.

<comment><USER9> It's not so much an assumption on their part as a realization thats what we've turned the education system into, at least in America.

In primary, secondary and even advanced schooling, there is a heavy focus on the students doing well on the (section/chapter/book) test just so they can drop it all and cram for the next one.

Sure, there is some incremental build up of knowledge or they wouldn't be getting anywhere. However, there is little focus on cumulative review and testing.

<comment><USER10> >thats what we've turned the education system into, at least in America

This is in no part helped by NCLB testing. The school stopped normal classes for a week to spend time teaching us how to take tests so that the school could perform well.

Who can be surprised that the last thing people are actually learning in schools is how to best prepare for tests?

</comment></comment></comment><comment><USER11> Well, it looks like some students will be getting a surprise test tomorrow.</comment>


Teaching People to Trade Stocks Is Like Starting Them on Heroin – Munger - <AUTHOR> https://www.evidenceinvestor.com/teaching-people-to-trade-stocks-is-like-starting-them-on-heroin-munger/ <comment><USER2> Well that is a click baity title. What he really meant was that _encouraging_ people to trade stocks is a bad idea period (he is a big proponent of index funds).

I can't say I disagree with that, not that I would categorically lump all financial managers into the 'useless' category either.

But it is important to note that he uses 'trading' in the sense of actively taking and releasing positions in different stocks in order to capture their short term change in value. Not 'investing' which is buying and holding equity (stocks) in company that are growing or otherwise generating wealth (and ideally paying a dividend).

<comment><USER3> A follow-up question is if Robinhood (by massively reducing trading costs/friction) is socially positive or not. Their career pitch is that they democratize America's financial system ([https://careers.robinhood.com/](https://careers.robinhood.com/)), but looking at how the reduced friction just leads to Average Joe losing more money, you could credibly view this as a type of destructive "excessive democracy".

<comment><USER4> They are increasing access to markets for the average person. They're also encouraging uninformed investment decision-making by doing things like sending push notifications when big name stocks swing way up or down, earning money by selling users' trading data to the highest bidder (increasing the overall fraction of "national product" that ends up in the pockets of financiers as the purchasers of that data make fast moves on that info) , plus that whole debacle with their "checking & savings" product.

<comment><USER5> What do you mean by "users' trading data"? If different from the trades themselves?

<comment><USER4> I just meant the transaction history.

</comment></comment></comment></comment></comment><comment><USER6> People who fail to read and educate themselves will listen to snake oils salesman pitches and trade stocks like a junkie on heroin. I spent years learning industries, learning how to read quarterly report, to identify signs of fraud, and pay attention to the news every single day.

Like anything you do you have to be committed and determined to be successful. It's not a dark secret that there are no short cuts in life. This article assumes we are all much dumber than I prefer to believe we are. We being people who have money to trade stocks and suffer from big losses.

I learned how to trade stocks by reading books about value investing and accounting practices. Very simple stuff that like anything worth learning takes a bit of time and effort. I don't get the upvotes on this article.

<comment><USER7> Given all your preparation and work, do you think you're able to beat the market on a risk-adjusted basis? What marginal edge do you have over professional institutions + quant funds, who are also reading reports and paying attention to the news? (to say the least)

<comment><USER8> > do you think you're able to beat the market on a risk-adjusted basis?

I don't think anyone is going to beat the market doing their due diligence. It's more about making sound investments instead of treating investing like gambling at a casino or rooting for a particular sports team.

<comment><USER9> If that is the case, why not just buy the entire US stock market through something like FZROX, SWTSX, or VTSAX? That feels like a sound investment to me.

</comment></comment></comment></comment><comment><USER10> I think that companies like Robinhood gamifying highly risky trading strategies are super irresponsible. There should definitely be a higher burden to educate end users, and to more tightly limit crazy shit like leveraged positions.

<comment><USER11> Robinhood sells shares in a bunch of ETFs as well as individual stocks. Their selection isn't as good as a Fidelity or a Vanguard but the value proposition is the lack of transaction fees. There's nothing inherently irresponsible about Robinhood (except maybe how easy it is to get a margin account). It allows individuals to make the same mistakes as any of the larger investment banks.

<comment><USER10> You can absolutely get lower risk investments through Robinhood, but they actively market things like margin trading under the "Robinhood Gold" banner. I don't think most investment banks would let you do things that risky, and you'd still have an advisor in the middle.

You can always lose money while investing, it's just Robinhood makes it feel like you're losing at Candy Crush while you're doing it. Certain financial transactions shouldn't be as frictionless as Robinhood makes them, and I can't help but feel that their platform is irresponsibly built. Their "Checking and Savings" debacle show how fast and loose they play with regulations and educating consumers.

</comment></comment></comment><comment><USER12> Super wise gentleman, thoughtful speaker, inspirational story... not always right though... Trading stocks, or active investment is important for the ecosystem, and having people learn hard lessons like not to gamble with money they can't afford to lose is equally valuable. Free Markets depend on willing participants, and progressively greater efficiencies (including in investment)

Epsilon Theory has a couple of notes regarding Berkshire => e.g. \- [https://twitter.com/EpsilonTheory/status/1098596558495453187](https://twitter.com/EpsilonTheory/status/1098596558495453187) \- [thread] [https://twitter.com/EpsilonTheory/status/1096360266416209920](https://twitter.com/EpsilonTheory/status/1096360266416209920)

<comment><USER13> >Trading stocks, or active investment is important for the ecosystem, and having people learn hard lessons like not to gamble with money they can't afford to lose is equally valuable. Free Markets depend on willing participants, and progressively greater efficiencies

How do ignorant investors making senseless trades and learning "hard lessons" improve market efficiency?

</comment></comment><comment><USER14> I work in HFT. He is completely correct

I always laugh when people say Robinhood is a good thing for society. Their zero fees, cool app, and gamification of trading is simply ushering fools into a casino

<comment><USER7> Cool. What's the best way to minimize transactional costs when buying ETFs (as a buy-and-hold strategy)? E.g. Should I only purchase marketable round lots? Can I do any better than Fidelity/Interactive Brokers for price improvement? Any tips to make my trades as efficient as possible? Or would you avoid ETFs altogether and just purchase mutual funds directly from Vanguard, without any transactional costs? Thanks!

<comment><USER14> You are pretty much already there

For the majority of people, I would recommend just buying Vanguard funds

If you really want to trade anything else, IB is the way to go

<comment><USER7> Gotcha, thanks! As for lot size, I know I mentioned round lots, but I typically trade odd lots out of convenience. What does this cost me in practice? Am I missing out on any investor protections that only apply to round lots?

</comment></comment></comment></comment><comment> dont-trd-charts It's common for a programmer to want to write an algorithm that tries to beat the market. For better or worse, that's what motivated me to want to learn how to code.

The wisdom of driving people away from trading does make sense however

<comment><USER15> Instead of writing code to beat the market, they are better off writing code to create valuable datasets they can then _sell_ to wall street. Or applications to help Wall street analyze huge datasets, sentiment or news feeds.

Selling shovels, so to speak.

<comment><USER9> Those same programmers would be better off just following Munger's advice and putting money into index funds. Doesn't require writing any code; all it takes is a few minutes to place an order.

I'm not exactly sure why the general sentiment here on HN discourages index funds. It's pretty jarring coming from /r/personalfinance and Bogleheads.

<comment><USER15> There's nothing wrong with index funds, and I think most people should dump the majority of their money into them as well.

However, for those people who feel the obsessive need to game the system, and make money faster, I would suggest not trading, but rather developing tools and gathering data to sell to Wall Street.

</comment></comment></comment></comment><comment><USER16> > _"Never underestimate a man who overestimates himself."_

Good life advice, especially for dealing with people who have a tendency to boast of their accomplishments.

<comment><USER17> I totally agree. Also important to note that "always overestimate yourself" and "bank on people who overestimate themselves" are _not_ solid corrolaries.

The boastful are high variance, even taking your own judgement into account. And where there are power-law outcomes, exposing yourself to the wrong kind of tail risk can be fatal.

</comment></comment><comment><USER18> I feel like there's a lot of misinformation in this thread, not about the article necessarily, but markets and trading in general.

Stocks are kind of the "beginner's" asset. They're fairly easy to understand conceptually. "Trading" them is even easier. However, trading them in isolation for a profit _consistently_ is very difficult or just a product of luck. I don't know anyone who does it and wasn't burned eventually.

The thing to remember is, people doing funds or "trading" professionally aren't just buying and selling FANG stocks all day. They're balancing these trades with futures and options or options on futures and other alternative assets. They're hedging their positions and setting themselves up so that their probability of coming out ahead is much greater than you're standard "it either goes up or down" stock movement.

A simple example is the "wheel" strategy in options. A short put at a .30 delta on the underlying, assuming 1 stddev movements gives about a 70% chance of collecting the premium without assignment (of course this isn't perfectly true, it's an approximation). This is already better than buying the stock, which under the same methodology, would have a 50% chance of profit (either going up or down from the purchase price). When assigned, turn around and open a short call against the assigned shares at a similar delta and repeat. In the flat market we've seen the last year or so, this is reasonably profitable and very low effort.

Edit: The reason the "buy and hold an index forever" strategy is recommended is because it's the lowest effort, highest probability of profit strategy one can probably take. I agree with it entirely for 99.9% of people. But that's not to say there isn't other opportunity out there if you're willing to learn about it.

Source: spent a few years at the Chicago Mercantile Exchange working on these sorts of things exchange side and now trade regularly on my own.

<comment><USER19> Picking up those pennies in front of a bulldozer... Agreed, you can structure trades to greatly improve your risk/return. There are whole other levels of investing like selecting how to interact with capital structures or even the market microstructure of how the trades work.

<comment><USER20> No this is actually a good strategy if you want small gains of 20%~ per year. The idea is you are long on the stock but you run the wheel against it so you make money without the downside risk, since you are planning to bag hold it. A lot of people who don't trade don't understand there are lots of ways to make money in the market.

Edit: I posted in my history a way to automate something like this.

</comment></comment></comment><comment><USER21> It's interesting to read how Buffett and Munger made their money. They definitely didn't make it by investing in index funds.

What Munger is really encouraging in his talks is intelligent allocation of money, knowing the boundaries of your knowledge, educating yourself, and recognizing basic human psychological shortcomings (like mistaking speculating for investing).

</comment><comment><USER22> What exactly is the analogy being drawn here?

<comment><USER23> The more appropriate analogy is that trading stocks is like gambling. And it's not even analogy. Unless you _really_ know what you're doing, trading stocks _is_ gambling, just with less house edge.

<comment><USER24> I think what your talking about is speculating vs investing - the term Benjamin Garnham uses.

<comment><USER25> Exactly. Few people get the difference.

Speculative trading is not investing.

Professional trading, esp with leverage, is extraordinarily difficult to gain the required mentality, discipline, knowledge, and skills be consistently profitable. The common saying is that 90% fail, I believe it's higher, perhaps much higher. Learning trading was the most difficult thing I've done in my life. It's hard in a way most people don't grasp.

</comment></comment></comment></comment><comment><USER26> This obsession with index funds is getting a little out of hand. Sure for many people buying an index might be a good idea. I myself recommend that many people buy an S&P 500 index. But to criticize all active managers is a little wrong. For one, Warren Buffet and Charlie Munger are active managers themselves, you do not see them buying an index fund.

Lets think about what happens when you buy the S&P 500 index. This is usually the most recommended index, and the one I recommend too. You basically give your money to own stocks of the 500 biggest publicly listed companies in the US. If a company is big enough and it gets their stock listed on the major markets it usually gets included in the S&P 500. (There are some exceptions but generally this is the way it works). Does that make these companies good investments? Not necessarily. There is a way to get big without being especially good at what you do (through mergers). It is possible that certain companies were very good investments before, had their stock appreciate, got into the S&P 500, had a change of management or experienced a change of end markets, and became bad investments. This is what happened to GE, for example.

The theory of indexing says that, yes there will be some companies in the S&P 500 that are not very good, but others will be excellent and it will all even itself out and you will make money in general as the economy grows. But that will only work if there are no secondary effects. If putting all money in indexes becomes the usual course of action for institutions as well as individuals then it would be very easy to exploit this. A company just needs to get large enough to get send to the S&P 500 (again this can be done with mergers and without necessarily being very successful or profitable) and then they get a bunch free money send their way by way of indexing. And if you get a bunch of badly run companies merging together to get into the index, indexing will certainly become a rather money losing proposition.

The reason why indexing tends to work and it has worked so far, is that indexers are kind of free riding on active investors. Active investors buy and sell stocks and they thus cause the price to move up and down. The price of the most wanted companies moves up and they get put into the top indexes, where the free riding index investors buy their shares. The active investors do not mind because they were first into the shares, and the free riders just increase the value of their holdings. The free riders do not mind because the active investors in a way pick stocks for them.

This all works fine but the whole system relies on there being enough active investors to free ride upon. And if this whole buying indexes trend goes out of hand there might not be.

Buffet and Munger have some good cause to criticize active managers. Many of them have not been very good at all. Money management is one of those professions where it is not easy to determine ahead of time where someone is good or bad at it. Even excellent money managers can have a couple of bad years and terrible money managers can get lucky once or twice. Thus, you have to wait several years to see whether someone is actually good at managing money and during that time they actually have to have money to manage. So to even test whether someone is a good money manager requires taking on a lot of risk. And because being a money manager can be so very lucrative and glamorous and because it is so hard to distinguish the good ones from the bad ones the whole field attracts a lot of smooth operators that know how to ape the look and talk of a person the public would expect to be a successful money manager but they do not know how to do it.

This is a problem with many other professions that are glamorous but where it is hard to initially tell the good from the bad. These include TV/Movie director, TV/Movie writer, politician, newspaper column writer, artist etc.

That being said there are money managers that are undoubtedly very good. Buffet and Munger are themselves a couple of examples. There are many others. Perhaps there aren't enough of them. Perhaps we as an economy are having a problem of not being able to train and recognize able money managers. That may be the case, but that does not mean we should abandon the concept of an active investor. The world actually needs active investors, money managers and asset alocators in general. The dream of simple, cheap and easy passive investing cannot work without them.

</comment><comment><USER27> I really like to listen to Munger, Buffett, Dalio and recordings of Jack Bogle.

These guys have won the game, they are trying to teach others how to do it. We have much to gain, just by listening.

<comment><USER28> Non facetious question, did they make their money doing what they're suggesting (passive investing), or do they have the knowledge that for most people passive is the best answer?

I guess I answered myself (the second)

</comment></comment><comment><USER29> Since I know how to trade stocks, but find that activity massively unpleasant, I guess I can assume that I wouldn't like heroin either?

<comment><USER8> I don't think anyone goes into heroin liking to put questionable needles into their body, but that's what they usually end up doing.

</comment></comment><comment> throwaway-1283 More like trading options

</comment><comment> cde-v It is addictive like any other sort of gambling/speculation.

</comment><comment><USER30> What about equity to employees? founders?

</comment><comment><USER31> and r/wsb is like the flophouse I guess?

</comment><comment><USER32> I heard that if you give opiates to patients at a hospital they don't get addicted because it is in a controlled environment where the patient is not seeking out those drugs for pleasure. If someone is getting heroin off the streets, the are looking to fill a void and it's perfect for that ( not perfect for your health or lifestyle obviously ). Obviously if people are looking to stocks as a gambler does, it can be like an addiction. Whereas if people are looking to trade stocks as a principled investor, this analogy does not apply.

<comment><USER33> > I heard that if you give opiates to patients at a hospital they don't get > addicted because it is in a controlled environment where the patient is not > seeking out those drugs for pleasure.

I am not sure if this is sarcasm, and I don't think it is, but just want to mention that I can't always tell on the Internet.

In-hospital opiate use can be important. But, there is good reason to believe that people using opiates appropriately for pain can still ultimately develop dependence and may develop addiction. Opiates have an important role right now, but the "fifth vital sign" is one of the things that presumably got us into big trouble with the current opiate crisis. We should tread lightly.

I know this is slightly off-topic, but if since the whole topic is reasoning by analogy, it seems worth a brief mention.</comment></comment>