'Five Eyes' Nations Quietly Demand Government Access to Encrypted Data - <AUTHOR> https://www.nytimes.com/2018/09/04/us/politics/government-access-encrypted-data.html <comment><USER2> Of course they are going to ask, and legislators will weigh the political cost/benefit to it.

My impression from the previous crypto wars and the skirmishes that have followed is, as technologists, we take a very tactical view of technology, and underestimate the intentions of people who understand power and politics the way we understand information systems.

The way we see the security of a system, they see the sovereignty of a state. Just as incompleteness in our code can yield system level compromises, incompleteness in their ability to apply their rules to their territories and domains also yields compromises that makes the whole system untrustworthy.

I don't agree with what I perceive as their Hobbes-ean need for total control, where I think the localized, depth first absolute authority of a state becomes malignant when it is applied breadth first and in totality to all aspects of life, but you can sympathize with the urge without agreeing with it.

They should be mindful that post-Snowden, no matter how large the field we live in, people have seen the walls and bars at the perimeter, and that broad perception is likely a greater source of instability than any gaps in the ability of the state to enforce them.

Viewed this way, the 5Eyes statement seems unwise.

<comment><USER3> The apparently Hobbesian view that you have over FVEY's desire to decrypt data is misguided. Most people that work in politics or intelligence in liberal states aren't in it for the power. They are either curious, desire a life of excitement, or want to bring positive change to society.

They want to decrypt data because they want to protect people from threats. I'm not saying we should allow them to, but ascribing malintent is misguided.

Edit:

Before the reflexive downvotes ask yourself: Who is asking for the ability to decrypt? These people are making half or less what they could make in the private sector.

<comment><USER4> My perspective is that it's all ass-covering. When the next terrorist attack comes, they want to be able to say that they did everything they could to prevent it.

<comment><USER5> If ass-covering is the goal, then the plan there is to loudly ask for information while quietly ensuring that they won't get it, then when the next attack occurs they'll have an easy scapegoat.

If they actually get the information then the next attack will make them look worse.

</comment></comment></comment></comment><comment><USER6> Ultimately these governments can break security at any level. It's not just the encryption or the apps — if they require the OS manufacturers to cooperate with them, they can record all user input and output. Likewise hardware manufacturers.

It's not just phones or computers, either — The UK was well known for having high CCTV density well before the proliferation of low-cost digital cameras; By my estimate is now well within government spending limits to put _all_ movement under surveillance by putting cameras on every corner which combine ANPR and facial recognition to cover pedestrians and cyclists as well as motorists; and laser diodes are so cheap every window, never mind person, can be surveilled with laser microscopes.

This is also cheap enough for criminals to do it. I recently got (fake) scam blackmail emails demanding bitcoin under the threat that they had used my webcam to record me watching porn (duct tape over my webcam says they didn't), but imagine a local crime gang doing that with a drone pointing at your window.

We have to change a lot of stuff in out society very quickly to keep us all safe. We need a world where none of us _need_ secrets, because very soon we won't have the ability to keep them. We also need the ability to survive _ourselves_ breaking the law, because the law was created with the (at the time reasonable) belief that only important violations would be brought to the attention of the authorities, because most of us can't get through the day without violating several [1], and because even though current state-of-the- art A.I. can't automatically enforce all those laws, we should assume that is coming.

But not just what, also how fast it changes and how slow we react: How long ago was it demonstrated that keys can be duplicated from a single image taken by a telephoto lens? And how many keys have been made safe against it since? The only thing keeping us safe is that even the bad actors aren't keeping up with the tech. That isn't good, because it means that whoever does use it will look, what's the phrase, "indistinguishable from magic".

[1] [https://mises.org/library/decriminalize-average- man](https://mises.org/library/decriminalize-average-man)

<comment><USER7> The UK already has very serious ANPR coverage. I haven't been on a motorway without it in the last few years —many A roads too— but it goes much deeper than that. I'm in the middle of nowhere and a dinky little B-road near me has a 4×2 grid of ANPR cameras monitoring traffic on both directions.

Most interestingly are the justifications for these things. Widespread ANPR means it's easy to find people who are driving their cars without MOT, VED and insurance. People without those are liabilities to us all, so we don't want them on the road, right?

It's just a happy coincidence that the security services also get to monitor more and more movement in the country.

I wish they'd fund health and social care with as much enthusiasm.

<comment><USER8> Every petrol (gas) station has ANPR; which makes sense, you can't get too far before you have to fill up.

<comment><USER9> If you're on the run, you've probably changed your number plate. If you're just an opposition politician being monitored, then where you buy petrol probably doesn't reveal very much about your activities. And you're probably using a card to pay for the petrol anyway.

<comment><USER10> Sure; but it raises the bar for criminals. Ie, it makes being an effective criminal require more knowledge and more work. And that makes a huge difference in practice. How many criminals actually have good enough opsec to change the license plates on their car? I bet it's well under 20%. And I know that an 80% solution kills me as an engineer, but I bet law enforcement sees an 80% solution as a massive win.

Us technologists should know how much this stuff matters from the huge effect good design has on product adoption. (Or dark patterns on user behaviour). This is the same effect in action - changing defaults changes the behaviour of the majority.

Another example: People say that "if you make guns illegal only criminals will have guns". Yet here in Australia very few crimes are committed using firearms. This is the same effect in action. (I'm not arguing for gun control - just that these laws have an effect)

And with that in mind, I think the reason why we're finally seeing a big push from the 5 eyes is because finally, _finally_ one of the big chat platforms (WhatsApp) has rolled out end to end encryption. That lowered the bar far enough that privacy from the government is becoming the default.

One implication of this way of thinking is that it changes where the battle lines are. To win, the government doesn't need to make end to end encryption impossible. They just need to make end to end encryption a bit difficult and non-obvious. Doing that will probably push the % of criminals who use proper encryption back into single digit percentages. After all, if you can research and understand the implications of application and messaging security, you can probably make a better living working at an IT desk somewhere than you can from stealing cars. Law enforcement would probably see that as a huge win, even if all us techies can keep sideloading Signal or whatever.

Personally I don't consider that good enough - I want a society where everyone has privacy. Not just those who have opted in to it.

<comment><USER6> > After all, if you can research and understand the implications of > application and messaging security, you can probably make a better living > working at an IT desk somewhere than you can from stealing cars

I doubt that. I think the main thing keeping cars safe from the 1% or so who don't care about the law or ethics of theft is that it's almost impossible to get away with it. Those with the relevant skill and the willingness to be criminals probably just take an easier approach, like card skimming.

This belief is based on how much second hand cars are worth and therefore how few cars a thief would need to steal each month for a very big salary.

<comment><USER9> I think you can get away with it, if you know what you're doing, but a stolen car is worth a lot less than the same car sold second-hand legitimately. Probably you either have to sell it to someone who knows it's stolen, knows not to take it anywhere near a legitimate service centre, and is prepared to forfeit it if stopped by the police, or you break it up and sell the parts, or you have a way of smuggling it out of the country to somewhere where they don't care about where cars came from.

<comment><USER10> Right; and this was my point in the first place. The police don't have to make it _impossible_ to get away with stealing a car. They just need to make it difficult and awkward. Thats still enough to massively disincentivized car theft - which in turn has resulted in far fewer cars being stolen.

Likewise if they ban end-to-end encrypted chat apps from the app stores, I bet that would decimate the number of people who used them. Even if anyone _could_ just get an android phone and sideload signal, in practice adoption would still fall low enough to make law enforcement happy. Even amongst criminals.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> It feels weird to read stuff like this, really.

What they want is to be able to wiretap people, without them knowing. Because if encryption is what's bothering them, you can get a warrant, seize the phone and/or computer, and make the owner unlock it / give you the keys, by law.

It is perfectly logical and lawful. However, if unwarranted (in the sense of without a warrant) wiretapping is involved, then yes, encryption "hinders the law enforcement". Except it doesn't. Because as mentioned earlier, just get a warrant, and make the owner unlock / give you the key, by law.

It doesn't hinder the law enforcement, it hinders the intelligence agencies work and makes it less invisible. And I kind of think that's a good thing too.

<comment><USER12> > […] make the owner unlock / give you the key, by law.

That only works if you can threaten to put the owner into jail for not complying. If you're trying to spy on communication between two people outside your jurisdiction, you're out of luck.

(that doesn't mean I support the US governments attempt to undermine secure communication)

<comment><USER13> Refusing to provide your passwords is itself a crime in the UK, not to mention obstructing an investigation and god knows what else they decide to stick you with for trying to have some privacy. I believe the idea is to threaten you with more jail time than you would receive for the crime you possibly committed.

<comment><USER12> > […] a crime in the UK

I don't think somebody living outside of UK cares. The threat only wors if that person lives in UK jurisdiction. Not everybody does.

<comment><USER14> It seems to work in the US. There's a man in Philadelphia, who's been jailed for years. He's charged with contempt of court. because he claims to have forgotten the FDE key for his macOS box. Which investigators believe is loaded with child porn. And so he periodically sees the judge, who extends his sentence for contempt. There's apparently no limit under current US law.

</comment></comment></comment></comment></comment><comment><USER15> Let's not kid ourselves. Surveillance moves like this are about control, not security, and especially not about national security. If anything, moves like this actually weaken national security by forcing bad standards and backdoors on people.

The 1946 USUK act that officially created the five-eyes in the first place post-Atlantic treaty needs to be completely re-evaluated and potentially scrapped.

</comment><comment><USER14> As I see it, any system that can be compromised to pwn malefactors - even the most conceivably horrible terrorists and criminals - cannot be trusted. And notwithstanding all the slander and conspiracy theory, Tor is perhaps the only working example of a compromise-resistant system. Unless it actually is backdoored, anyway.

Obviously, the Five Eyes don't see it that way. But I gotta wonder how commonly Tor is used among TLAs, and how the debate goes, if it is. Because this would destroy Tor. Unless operators were totally anonymous, and relays only stayed up until targeted.

<comment><USER16> I thought it was decided that tor was already compromised, because the five eyes intelligence apparatus already controls more than 50% of the exit nodes, giving them almost complete insight into where all the traffic originates?

<comment><USER17> They rely on Tor themselves, they have a strong incentive to disclose/patch any major flaws in the protocol. They might exploit smaller flaws for a single operation, but they probably have more to earn from a healthy Tor network.

<comment><USER14> That's the dogma. But do we really know that?

<comment><USER17> We as in the public can probably never be 100% sure of that, but looking at where the project started, and the current state of anonymous networks there is no real alternative. They are definitely using Tor to make attribution harder when running operations, there are no real alternatives. They benefit from Tor being open and used by everyone else, it is much easier for them to hide in the noise of all other traffic then.

<comment><USER14> Yes, I do agree. However, some say that's just the cover story, and that Tor overall is a honeypot. Or at least, that Tor is a honeypot for all users _except_ US government operatives. There's no way to be sure, right?

As far as alternatives go, maybe they have something like Tor (onion routing) or I2P (mix networking) that user covert channels. It could even be running on government-controlled Tor relays. Or maybe installed as hidden malware.

That seems unlikely, of course. But remember when allegations about ENIGMA were totally conspiracy theory.

<comment><USER18> If Tor is just a honeypot, then when does it pay off? There are tons of illegal activities going over Tor right now, including truly awful stuff like terrorist attack plotting and recent pictures of child abuse. If Tor is surveillable, why isn't that surveillance being used to catch and prosecute those people? What are they waiting for?

I will say (while acknowledging that I can't prove this) that I have friends who work in national defense and law enforcement, for whom Tor is an impediment. I've never heard them talk about a magic decrypt button; quite the opposite. So if Tor can be decrypted, it is a capability that is closely held and rarely used.

<comment><USER14> There _is_ lots of horrible stuff on Tor .onion sites, yes. But there was a lot more of it a few years ago. Given general technical cluelessness, even among assholes, much of it was hosted by a few services. Such as Freedom Hosting. But it and some newer ones were compromised, run for a while as honeypots, and then taken down. There aren't really that many independent .onion sites with technically competent operators. Some of the hard-core child porn sites, perhaps, and some of the persistent dark markets. But who knows which of _them_ are honeypots? I mean, PlayPen ran as a honeypot for months, with no interruption in the sharing of child porn, plus infecting users with phone-home malware.

It's not that there's a "magic decrypt button" for Tor. However, it's very likely that the NSA and GHCQ, at least, have some capability to identify Tor .onion sites and users. But they arguably don't want to reveal capabilities, and so are very careful about disclosing information. To some extent, that happens under programs like the DEA's SOPA. But on the other hand, recall that the NSA was cagey about revealing intercepts that could have prevented the 9/11 attacks. Or that charges against the Weathermen were dropped in 1973, after the (then unnamed) NSA got squirrelly about its intercepts being introduced as evidence.

Overall, I'm relatively confident that Tor isn't fundamentally backdoored. But there's no way to know what's going on with any .onion sites that you access. They could be FBI honeypots. Or Russian honeypots. Or independent criminal honeypots. You gotta treat them all as radioactive. As sources of malware and worse. That means at least using Whonix, running on a Linux host machine. And better yet, a dedicated host, used only for Tor and other iffy stuff.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Surely the final solution to this problem is a community-based one - one that decentralises the tech giants?

I'm still struggling to figure out why a cohesive, widespread, community- driven solution hasn't emerged yet. Anybody have any ideas as to why?

<comment><USER20> Technologically, it's end to end encryption, with forward secrecy. Done. We have lots of commercial and non commercial products that do this, from PGP to Signal. Even WhatsApp does it.

Eventually, the elderly, uninformed US government is going to pass a law requiring a back door. And two things will happen:

\- someone nefarious will get the private key, and do something nefarious with it. (Hopefully no one will die)

\- offshore private messaging will become a thing.

There's a market for bith insecure-but-endorsed and secure-but-illegal, to be sure. And the 5 eyes will probably fight for decades to squash private messaging.

For a worst case scenario, see the war on drugs for an example of how this could go.

<comment><USER21> > Eventually, the elderly, uninformed US government is going to pass a law > requiring a back door.

Eventually, the elederly, uninformed governments are going to die off, to be replaced with younger governments. Still uninformed, but hopefully less tyrannical.

> offshore private messaging will become a thing.

This won't have to happen. Just because the law says there has to be a backdoor doesn't mean open source software developers will comply. Develop your software anonymously, release it anonymously, and run it wherever you want. It doesn't need to be a service provided by a company in a foreign land, it can just be software you run on your own computer.

<comment><USER22> > Still uninformed, but hopefully less tyrannical.

I don't think this is a reasonable thing to just hope for. Historically, governments have always had tyrannical streaks and I don't think it makes much sense to simply assert that "this time it'll be different". It probably won't.

<comment><USER21> I think policy just lags social acceptance.

It never used to be legal to be homosexual, for example, then it became socially acceptable, and then a generation of politicians had to die off, and then it became legal.

</comment></comment></comment></comment></comment><comment><USER23> I think this is quite similar to ad-blocking. If ads would have stayed small instead of becoming assholes, nobody would have adblockers. And if the intelligence agencys wouldn't spy on anyone but only with a court-order, encryption wouldn't be that interesting as well.

<comment><USER14> Not really. Before the 80s brought ubiquitous personal computers, and academic cryptography became a thing, the NSA and its friends had pretty much a monopoly on strong encryption. That is, encryption was implemented by dedicated hardware. There weren't that many manufacturers, and they were under intense pressure to only sell strong encryption to the NSA and friends, and sell backdoored stuff to everyone else.

So anyway, we went through this in the 90s (the Clipper Chip). That died down, in part because terrorists and criminals weren't really using much encryption. But now we have iPhones with strong encryption, and TLAs and LEOs are seriously freaked.

</comment></comment><comment><USER24> This seems like a pretty empty threat. The government already has the authority to demand lawful access. "Lawful" includes a warrant. If the government wants to show up with a warrant, I expect companies to aid the government in gaining access to legally-relevant data. If they want help in a broad-spectrum fishing expedition, the US at least has no clear affirmative authority and a small pile of legal precedent based upon the Fourth Amendment that says they in fact lack that authority.

The fact they had the technological capability previously to act without Constitutional authority is irrelevant. Show up with a warrant or go pound sand.

<comment><USER25> Whether they get a warrant or not is orthogonal to the question of whether they ultimately succeed in breaking security for virtually everyone and everything.

In other words this notion of "get a warrant or pound sand" ignores that even with a robust legal warrant-requiring regime, they still would need to require back doors (key escrow, effectively the same thing) that would screw up security royally in order to get what they want.

</comment></comment><comment><USER26> Simply put, actions like this reaffirm that encryption works. Use it.

</comment><comment><USER27> I would refer people to these two posts about this subject:

[https://www.schneier.com/blog/archives/2018/09/five- eyes_int...](https://www.schneier.com/blog/archives/2018/09/five- eyes_intel.html)

[https://boingboing.net/2018/09/04/illegal- math.html](https://boingboing.net/2018/09/04/illegal-math.html)

Basically, crypto backdoors are a very bad idea.

</comment><comment><USER28> Maybe this is a stupid question, but if the tech industry claims that you can't make a backdoor safe, how do they keep safe their update mechanisms? Aren't they basically backdoors-by-design?

<comment><USER29> In a sense they are, but they send the same updates to everyone whereas a backdoor needs to allow malicious actions to be taken against specific targets only. If vendors are forced to abuse updates in this way then users are going to demand a certificate transparency-like system to stop the abuse.

<comment><USER30> > they send the same updates to everyone

Google's staggered updates to Chrome are updates sent to specific targeted users. The iOS App Store (and Google Play store, I believe) has an opt-in beta program that also sends betas to specific targeted users.

> If vendors are forced to abuse updates in this way then users are going to > demand a certificate transparency-like system to stop the abuse.

But yes, leveraging users' trust in the update system is a risk that needs to be factored into the debate.

<comment><USER29> Right, I'm not suggesting that it's even remotely possible for millions of systems to be updated at the same instant, just that outside of some special circumstances like beta channels (yes Google Play supports this) the huge numbers of devices are offered the same updates.

If trust is lost in the update mechanisms then something will be done to restore it. That would likely be large developers like Apple, Microsoft and Google deploying a technical solution to prevent themselves from sending different updates to different devices without loudly warning the user and automatically reporting the attack to the world. That would please users and reduce compliance costs. Really, the major operating systems should just do it now to prevent this from becoming a problem in the first place.

</comment></comment></comment></comment><comment><USER31> > part of an escalating war between government officials and Silicon Valley > over access to people's private data

Who is missing from that competition?

I'm purposely misconstruing the meaning, but it makes an ironic point. Remember that most of these tech companies make money by collecting and using the same data they claim to protect, and some provide it to the government.

</comment><comment><USER32> Legislators don't seem to understand that backdoored crypto is bad crypto.

If I write a chat app that uses strong encryption, with the keys stored on each user's device, there are no legal grounds for me to modify any part of my app if the government wants access.

</comment><comment><USER33> It's likely the 'Five Eyes' already have access to all or most data from the level of telecom equipment. This is probably why they banned Huawei and ZTE.

</comment><comment><USER34> What can we do about it?

</comment><comment><USER35> Previous discussion: [https://news.ycombinator.com/item?id=17898498](https://news.ycombinator.com/item?id=17898498)

<comment><USER36> Yes. Normally we'd mark this one as a dupe of that one, but it seems to be taking this story a while to ripple through the system as people become aware that that document was published and try to figure out what it means. Since the NYT article does contain some new information as well as more background, we'll leave it up.

</comment></comment><comment><USER37> Fascism.

<comment><USER36> Please don't post like this. Even if you're right, an unsubstantive single- word comment is not the thing to post—and certainly not that word, which leads to the nether regions of the internet barrel.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment><comment><USER38> As an aside, I recently came across the argument that programs like Five Eyes were designed because of mass infiltration of immigrants/others who are not designed for Western ideas/government and that it's the price that people pay for relegation of their freedoms. So I might have been living under a rock but this argument is on the alt-right for what it's worth but I'm not entirely sure how to process it. In the sense that there's far too much irony and the lack of a unified framework of laws that work towards humanity maybe? (Sorry for the incoherent thought but I had to get this off my chest)

<comment><USER39> That doesn't really make sense to me. Five eyes, and intelligence agencies, collect information that has nothing to do with people in their countries. For example the US tapping Merkel's phone or bugging the Copenhagen climate talks. It is done to gain diplomatic, military and economic advantage. You can sample them on Wikileaks.

<comment><USER38> Isn't PRISM and other related programs part of Five eyes? I guess my point was more that as the US moves away from it's War on Terror the next natural target is on ideology

<comment><USER40> Not really since that target probably doesn't support the selling of more guns to the USA agencies.</comment></comment></comment></comment>


Don't Expect People to be Rational - <AUTHOR> http://bennesvig.com/post/6578192967/incentives-vs-rational

<comment><USER2> The rational thing would be, if they were lazy, to ignore this sign. This sign is almost completely unenforceable. If the chute is clogged with garbage I'll be fined? Do you have a video camera watching me put garbage in the chute? If not it's impossible to determine who left which garbage bag and/or who clogged the chute*1.

Not to mention the problem where in I'm a good resident... I've brought my garbage down, but someone else has clogged the chute and suddenly it becomes my job to either A) unclog the chute [managements job]; B) take my trash back upstairs; c) leave it and suffer a 50$ penalty

Frankly, this is a bad policy and the people writing the sign have shown themselves to not be very rational.

<comment> loup-vaillant The guy who put up the sign correctly assumed that the lazy people he targeted would (irrationally) react by paying more attention. Which was the desired effect. Recognizing (and exploiting) irrationality in others may be a bit mean, but its definitely not irrational by itself.

Now, there may be a simpler explanation: people see the angry note, think "Oops, someone cares about this crap", and change their behaviour just to be nice. Or maybe they just didn't really know how they were supposed to handle the trash, and the note made them less ignorant.

Personally, I suspect all three effects played a part.

</comment></comment><comment><USER3> I don't think 'rational' is the right word. Responding to incentives, in this case a monetary disincentive, _is_ rationality. The tenants are either lazy, care little about the appearance, don't put much thought to the issue, don't know they're doing something wrong, or don't care because there is no disincentive to anonymous trash-leaving (especially because other tenants are doing it).

So maybe a better title would be "don't expect people to think just the same as you."

<comment><USER4> Rationality can only be meaningfully defined as an optimizing behavior over ones preferences. If these are to not do any extra work unless fined the neighbors were plenty rational before.

The author is yearning for morally decent people. I guess Kant would have called this rational but as an economist I am forever doomed to accept peoples immoral behavior as the expression of their immoral preferences.

</comment></comment><comment><USER5> I agree with the title, but not the article. People _are_ irrational. But this is an example of laziness, not irrationality.

</comment><comment><USER6> If they leave trash on the floor, they'll be charged $50. So they don't leave trash on the floor.

This sounds pretty rational to me.

If you'd like to see actual examples of people being fundamentally irrational, go watch one of Dan Ariely's presentations on the poor choices humans make over at TED.</comment>


Show HN: Animation Creator Using Emoji and Simple English - <AUTHOR> https://framd.cc/watch?v=5efb0e57edbeeb0007617386 <comment><USER2> Would be nice to be able to loop some of these, because the full effect can be hard to see in just one go-round.

Like this one: [https://framd.cc/watch?v=5efe03cdafd1f90008369688](https://framd.cc/watch?v=5efe03cdafd1f90008369688)</comment>


Google is down - <AUTHOR> https://www.google.com/search?ei=-P7ZW_aVIY_L0PEPq8CNoAE&q=wat+is&oq=wat <comment><USER2> Incredible that I've used Google all my life and it's taken until today for me to see an outage. A testament to the SREs at Google.

If anyone hasn't see the Google SRE book, I highly recommend it. [https://landing.google.com/sre/books/](https://landing.google.com/sre/books/)

</comment><comment><USER3> Seems to be back up.

I can't remember the last time it went down but I hope they're transparent about what happened. I'm sure we could all learn something about how to manage large globally distributed search engines of our own...

<comment><USER4> People always say this, but how many HN readers are really running anything even close to the scale of google.com? And how many should worry about completely different things..

</comment></comment><comment><USER5> It's back up. It was down for about a minute here. Impressively quick fix.

<comment><USER6> It was down for about 3 minutes for me. Just long enough to change my default search engine to DuckDuckGo.

</comment></comment><comment><USER7> Tried to google "is google down"... oops.

<comment><USER8> I did too, and it said "No" but only returned one page of results (mostly books).

</comment></comment><comment><USER9> Works on my machine

</comment><comment><USER10> what does the phrase "google is down" even mean in this world?

I mean its the largest and most well spread internet service company in the world. "google" isn't just one service is a massive collection of services.

which part is down, in which area at which time and in which circumstance...?

It just seems like such an absurd phrase in this day and age.

</comment><comment><USER11> It's up for me.

</comment><comment><USER12> Working fine for me.</comment>


Bitbucket Joins Atlassian - <AUTHOR> http://blog.bitbucket.org/2010/09/29/bitbucket-joins-atlassian/

<comment><USER2> Wow, this is awesome (I hope!) news for Jesper and the rest of the bitbucket team. I hope Atlassian treats them well - it should be interesting to see what they do with things.

<comment><USER3> Integration with Atlassian's tools should be very exciting. For a while now, I've been thinking that Atlassian should try a code hosting service and integrate their code review, code coverage and source exploration tools. Hopefully it works out as well as I imagined it would.

I also want to point out Atlassian likes both Mercurial and Git:

[http://www.atlassian.com/summit/2010/presentations/developme...](http://www.atlassian.com/summit/2010/presentations/development- speed/dvcs-systems-in-the-enterprise-git-mercurial.jsp)

Disclaimer: I'll be working for Atlassian next year (and now I'm hoping to work on Bitbucket sometime).

<comment><USER4> hear hear! For what is worth, I don't understand why they don't integrate with existing projects as a premium service. Not only bitbucket but github, patch- tag etc.

</comment></comment></comment><comment><USER5> I don't have too much of a preference between Git and Mercurial, but the lack of even a single free private repository on Githib makes BitBucket a more favorable option for my numerous casual projects.

<comment><USER6> Numerous casual projects?

Host them yourself by tunneling git over ssh. It's easier than you think.

I just made a tool to help streamline the process. <http://grit.hackyhack.net>

<comment><USER7> That helps with the code hosting, but what about a wiki? Bug Tracker? Communicating with other devs? A bitbucket or github repo helps with all of these things too.

<comment><USER6> Absolutely. But for most casual projects, YAGNI.

<comment><USER7> You'd have to be pretty casual not to want a bug tracker - even for completely internal, non-public facing, one dev projects they're invaluable for keeping things straight, tracking todos, etc.

That said, I think there's definitely a use case for some sort of bug tracker/wiki which can be embedded in a repository, a'la Fossil. Perhaps flat files rather than SQLite though, so you can track changes in your repository. Not sure how you'd get changes in though, other than via a pull request.

<comment><USER8> <http://ditz.rubyforge.org/>

<comment><USER7> Cool project. That's pretty much what I had in mind, except maybe some sort of lightweight wiki, too.

<comment><USER9> <http://pages.github.com/>

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Interesting, unlimited repositories and disk space. I wonder if GitHub will attempt to compete with that, their plans have only gotten worse lately.

<comment><USER11> Number of repositories and disk space is not the reason I use GitHub.

<comment><USER12> It was a large reason I didn't choose GitHub. Who wants to manage and prune their minor projects to fit into arbitrary limits?

<comment><USER10> This. We routinely have to decide which old repositories we can delete when we want to make a new one, and it's getting old. We don't want to pay $25 more a month just for a few more repositories.

</comment></comment></comment></comment><comment><USER13> And here I was all set to migrate my projects to Github tonight. I think I'll stick around a bit longer and see what Atlassian can do to improve BitBucket.

On a side note, I paid my monthly subscription fee just a few days ago, but now everyone is on the same (basic, free) plan. Is that money just out the window?

<comment><USER14> This was the email I got from Bitbucket:

"Because accounts with 5 or fewer users are free, we will be canceling your subscription and moving you to the free plan (you will be notified by PayPal that your Bitbucket account has been canceled)."

Not sure if that means you'll get your money back, though.

<comment><USER15> You won't, why should you? apart the fact that it probably costs them money to send them back, I for example am just happy that i don't have to pay from now on. Since I have only 2 private collaborators.

</comment></comment></comment><comment><USER16> Unlimited _private_ repos for free? That is mighty impressive, and stacks up very well against github (especially since I prefer hg over git).

<comment><USER17> <http://codebasehq.com> also offers unlimited private repos (hg, git, and svn), but not for free. They have total size restrictions as well.

<comment><USER18> I don't think it's really necessary to downvote a comment just because it mentions a paid service.

Some users over at the reddit discussion ([http://www.reddit.com/r/programming/comments/dka7n/bitbucket...](http://www.reddit.com/r/programming/comments/dka7n/bitbucket_now_has_unlimited_public_and_private/)) spoke well of the 6USD/month at <http://repositoryhosting.com/>

Also, clicky for the free SVN at assembla: <http://offers.assembla.com/free- subversion-hosting/>

<comment><USER19> There's <http://xp-dev.com/> as well that has unlimited repositories and users, only pay for the space that you use

(disclaimer: own and run xp-dev.com)

</comment></comment></comment></comment><comment><USER20> This is not totally unlike the combination of fogbugz and kiln. I wonder if this means anything to Fog Creek, and if any of them will comment on it.

<comment><USER21> [I was a co-founder and am a primary developer of Kiln.]

Speaking purely for myself, I don't view Bitbucket as a competitor, to be honest. It's a great tool, but serves a very different purpose.

When it comes to social code, Bitbucket's great. It's Mercurial's equivalent to GitHub, and it fills that role awesomely. I have an account on there where I post stuff I want to be public, including some open-source parts of Kiln's source code, such as our new kbfiles extension.

Kiln, on the other hand, is really focused a lot more on making DVCS a really great experience for companies. A lot of the stuff that makes GitHub and Bitbucket great--the whole social experience--kind of gets in the way of just getting stuff done in a corporate environment. You still want the ability to have personal repos and branches and everything, but you also want really tight integration with bug tracking, really easy ways to follow everything going on with a project in the forms of activity feeds and comprehensive search, APIs to manage everything, a really solid code discussion system so that your developers can talk about code and make sure it's really great before it gets integrated, the ability to quickly answer questions like, "What bugs were open in this point release?" and "Have I contacted customers affected by this to let them know it's fixed?" Kiln and FogBugz together provide those things right now.

I'm sure Bitbucket and Jira _could_ provide that functionality eventually, but it's not what they do right now. And I think that's fine: we _need_ a service that provides really great social tools, and Bitbucket's that. And we _need_ a DVCS hosting solution that's awesome for companies, and Kiln's that. Given that something like 90% of developers still use centralized SCMs, there's piles and piles of room for both of us to coexist peacefully.

</comment></comment><comment><USER22> Too bad, hg and bb are great, but Atlassian makes abominable tools.

On the upside, my account is now cheaper (free).

<comment><USER23> Like what?

(Disclaimer: I used to work for Atlassian)

<comment><USER24> I'm a fan of Confluence and JIRA from a user perspective, but oh man, they are terrible products to install and administer.

For instance, we're an Atlassian shop through and through; we also use Fisheye, Crucible and Bamboo. As such, we wanted to tie all of these apps up to Atlassian's SSO solution (Crowd). Take a look at the integration guide for JIRA¹. The process can require finding missing JARs, editing Java property files, commenting and uncommenting forests of XML, and then you're still subject to a bunch of arbitrary restrictions around group membership (super fun when paired with AD). The whole thing feels like an afterthought that was never given the respect of a proper _feature_.

I personally get the impression that Atlassian's product codebases are pretty fragmented as a result of their grow-via-acquisitions strategy. On the front end, the products are good looking and usable. On the back end, things are a mess. Still, it's my job to run the mess, so I'll keep slogging.

¹ [http://confluence.atlassian.com/display/CROWD/Integrating+Cr...](http://confluence.atlassian.com/display/CROWD/Integrating+Crowd+with+Atlassian+JIRA)

<comment><USER25> Yup, the JIRA-Crowd integration experience sucks. It'll be fixed in JIRA 4.3 and Confluence 3.5.

What group membership restrictions do you mean?

(edit: I'm the Product Manager responsible for Crowd).

<comment><USER26> Crowd never should have happened.

For 3 (or was it 4 or 5?) years, jira users have voted for an enhancement to drive jira groups out of LDAP. The reward for this loyalty? Crowd: a whole new product, with a separate, spendy license. Bizarrely, Confluence is capable of doing this LDAP integration without Crowd. But rather than port that over to Jira and make some users happy, Atlassian decided to take another bite out of their wallets instead.

I actually bought Crowd, out of desperation to solve the problem, but dropped it after a year. Trivially obvious features weren't implemented. It ended up being easier to just script what we needed ourselves.

And don't even get me started on how painful it is to upgrade Atlassian products. _shudder_

<comment><USER25> Crowd's LDAP code will hit JIRA trunk the day after 4.2 branches for release. So, good LDAP is coming for both JIRA and Confluence.

Yes, it's years later than it should have, but we are finally getting our house in order on that front.

In the next month or so, we'll also be starting to work on a better installation/upgrade experience for JIRA and Confluence. Would you be interested in chatting about what drives you nuts in the upgrade process? I want to make sure we sort out as many of the problems as possible. firstname.lastname@example.com if you have the time.

<comment><USER27> I can't speak for leftcoaster, but what drives me crazy about the upgrade process is this: [http://confluence.atlassian.com/display/JIRA041/Upgrading+JI...](http://confluence.atlassian.com/display/JIRA041/Upgrading+JIRA)

I'm just upgrading from 4.0 to 4.1, I shouldn't need to create a new installation, a whole new database, re-download, install, and configure every plugin I use, disable e-mail access, etc...

I want to be able to run an upgrade script, or drop in a new war and when it starts up it asks if I want to upgrade things. Or an inline upgrade. Look at Wordpress, Gallery, MS Office, any OS, etc... for examples.

My startup uses Crowd, Jira, and Confluence. However, due to the complexity and risk (we've had issues crop up in the past) of upgrading, we tend to run several versions behind, waiting until there's some "must have" new feature or improvement.

And while we do use Crowd (and while I generally really like Atlassian products) the Crowd LDAP support is really lacking, and the complexity of hooking Jira/Confluence into Crowd is a pain (no write support for Fedora 389?). It should be a simple flag, maybe even changable from the admin. Not a bunch of hacking in .properties, .xml, and libs.

<comment><USER25> Upgrade points noted.

JIRA 4.3 and Confluence 3.5 will make it much easier to connect to Crowd. No editing of files required.

We don't have write support for the Posix schema scheduled for Crowd, I'm afraid, so no promises on that front.

<comment><USER27> I think the only reason we're using Crowd now is to map LDAP groups into Jira.

<comment><USER28> We've had Crowd deployed for two years to handle web app auth. Configuration, deployment were a bit painful.

We're pulling it out and writing our own - seems to be the only way to get necessary features such as delegated administration which have been on the Crowd roadmap for years now.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> _All accounts now have unlimited private and public repositories and we've removed disk-space restrictions! Your new plan is completely free, forever._

Made my day!

I hope this cooperation will result in a more dynamic progress of BB.

</comment><comment><USER23> Mmmm... Unlimited private repositories. Is this enough for me to move to hg from git?!?!?!

<comment><USER30> Seriously, 6usd/month gets you an unlimited repositories(up to 2 GB) git/hg/svn on RepositoryHosting.com .

<comment><USER10> It's Trac though, nothing compared to BitBucket.

</comment></comment></comment><comment><USER31> I used to be a Bitbucket customer but moved to repositoryhosting.com a few months ago. This is great news as I will likely return to Bitbucket. I stopped using the service this year because I needed many small repos (<15mb) and didn't want to pay upwards of $20-30 per month. Repositoryhosting.com offers unlimited repositories for $6 flat per month. If you require additional space you pay for that.

I really don't get the pricing plans for companies like Bitbucket and Github. $5-10 per month for personal projects is fine but up past that? Do these companies think for single user accounts all these repositories are active at once? How much more does it cost Github to store an additional repository for me (not to even mention gists which are stored as repos) because they are charging $1 per month to backup a few mbs. I would love to know the average repo size.

<comment><USER32> Look at it from a different angle - how many customers out there require code repositories? Now, let's say you want to have a 20-30 employee company, with a likely $3 million salary overhead and $10-15 Million dollar exit in 5-7 years.

How much do you have to charge per customer to hit that target? Remember, you have to cover Salary + Hosting/Hardware Overhead.

The most likely response would be "Why would someone expect to make that kind of money off of hosting repositories?"

My answer would be "Why would you expect a First Class Entrepreneur / Founding Team to commit their time to a endeavor that didn't have that class of pay out?"

</comment></comment><comment><USER33> I will keep my private account at github. Its my way of saying thanks for their free open source hosting.

</comment><comment><USER34> Congrats BitBucket folks. My $0.02... I wonder if GitHub have had any offers to be bought out? It seems like they would, and they are continuously growing in personnel, so they can't be doing too badly. I'm also surprised that they said Atlassian will offer private repos for free forever. Forever seems like a pretty big promise, IMO.

</comment><comment><USER35> I prefer mercurial over git, but being on bitbucket is starting to feel like being on Orkut when everyone else is on Facebook. Even with this announcement I'll probably start all new personal projects on github for the better visibility and collaboration with the hacker community.

<comment><USER15> Yeah well... thanks to people like you bitbucket will struggle to gain bigger community. Why not start projects on bitbucket, and then if it will not work out, move to github? I DID get help from other people and commited my patches to some projects on bitbucket(also did on git). It's not like you wont get help on bb - its just a tool in the end.

</comment></comment><comment><USER36> One amusing thing only tangentially related to this - the unofficial mercurial plugin for Jira has been broken (in Windows) for months. We've been considering buying FishEye just to get decent hg integration!

</comment><comment><USER15> One thing i'm hoping for are better community building tools on bitbucket for projects to promote themselves. This is the only part missing to get a bigger community

</comment><comment><USER37> I am not a fan of Atlassian tools. But I like Bitbucket a lot. So my only hope it that the graft improves the host.

<comment><USER38> Indeed. We won't be seeing any graft vs. host, at the very least.

</comment></comment><comment><USER39> I hope my company doesn't switch from git to mercurial now since we use atlassian for jira and confluence :/</comment>


What Is a Computational Essay? - <AUTHOR> http://blog.stephenwolfram.com/2017/11/what-is-a-computational-essay/ <comment><USER2> Literate programing is used to tangle text and code. You tangle the document and the code blocks are pulled out to create a working program. But Orgmode's Babel, iPython and Wolfram's Computational Essays are literate computing, with code being executed in the document. Howard Abrams has extended the concept to create literate devops ([https://www.youtube.com/watch?v=dljNabciEGg](https://www.youtube.com/watch?v=dljNabciEGg)) using orgmode babel where the code in the document is used to configure software running on local or remote servers.

I use Babel as part of my daily workflow. Very cool stuff.

</comment><comment><USER3> If I remember correctly, Mathematica started the notion of having a notebook interface when working with code, Theodore Gray even has the patent for this [0]. Even though the post reads like a longform ad for Mathematica and the Wolfram language, I do agree the notion of code written to present an idea/solution as a story. Sadly, with Jupyter notebooks being free/open source and compatible with other language kernels, there seems to be a decline in the mindshare for Mathematica and its notebook interface among researchers.

[0] Patent US 8407580 B2 - Method and system for presenting input expressions and evaluations of the input expressions on a workspace of a computational system ([https://www.google.com/patents/US8407580](https://www.google.com/patents/US8407580))

<comment><USER4> Mathematica is a great prototyping language for people who know mathematics. It is the equivalent of Microsoft Excel. The problem is when you want to do something beyond that you will probably rewrite it in something else. And that something else is increasingly being Python.

I do like the term "computational essay". It describes a way of presenting information. While "notebook" feels more to me a set of calculations that may or may not be commented and don't have a set structure.

It would be neat if we had a standard notebook notation or system that would subsume all of these competing standards. Unfortunately it would probably end up like this [https://xkcd.com/927/](https://xkcd.com/927/)

<comment><USER5> >The problem is when you want to do something beyond that you will probably rewrite it in something else. And that something else is increasingly being Python.

You aren't going to use your Python code in your Jupyter notebook in production, are you? Jupyter is for exploration and exposition. You're going to have to rewrite it anyway.

<comment><USER4> I didn't say that you would translate a Mathematica workbook into an iPython notebook.

</comment></comment></comment></comment><comment><USER6> Several posters mention Jupyter, but there also literate programming by Knuth from 1984.

<comment><USER7> Literate programming really feels very different than this, at least in the examples that are easily found online. Literate programming reads far more like 'better commenting' (and strikes me as a massive pain to write) and less like a type of long-form writing.

<comment><USER8> Literate programming, as Knuth presented it was that the literate/comment part was the primary document, and the executable code was just a minor detail for the benefit of the stupid computer that can't read English and only cares about arithmetic not meaning.

</comment></comment></comment><comment><USER9> Pretty much like Jupyter notebooks. It's a great way to present research, especially statistical stuff. It's pretty much impossible to verify any statement about a large dataset without having it to hand and ready to calculate. Even having the data printed in an appendix is going to be discouraging verification.

Plus the stories you can tell with this sort of thing are much more vivid. If someone has a question about some part of the data, they can ask the computer instead of the author. For a lot of queries.

<comment><USER10> AFAICT the idea originated with Mathematica and Jupyter/IPython was "pretty much like Mathematica".

<comment><USER11> The article even has an image of the interface from 1988.

> And with the release of Mathematica 1.0 in 1988 came another critical > element: the invention of Wolfram Notebooks. Notebooks arrived in a form at > least superficially very similar to the way they are today (and already in > many ways more sophisticated than the imitations that started appearing 25+ > years later!): collections of cells arranged into groups, and capable of > containing text, executable code, graphics, etc.

<comment><USER12> Wolfram really is a terrible liar (also very, very smart). He knows damn well that Maple had notebooks in the mid-1990s, because it was one of Mathematica's main commercial rivals, so "started appearing 25+ years later" is nothing other than a lie.

<comment><USER5> He's not lying. He's referring specifically to Jupyter. Read it again.

That is, consider it as a reference to the _specific_ imitations that started appearing 25+ years later.

I mean, this was obvious to me, but I'm not sure if it's because you're trying to be particularly uncharitable to him for some reason.

<comment><USER12> I considered that interpretation before writing and I found it impossible to read that way. For a start, "imitations" is plural, so no, it doesn't just refer to Jupyter. And "started" certainly implies that other imitations hadn't appeared before that.

While I'm at it: he _deserves_ an uncharitable reading, because he's having a dig at Jupyter (which may be an imitation of Mathematica notebooks) and neglecting to mention any influence of previous work on Mathematica notebooks, such as Knuth's literate programming.

</comment></comment></comment></comment></comment></comment><comment><USER13> Calling these things "computational essays" is a little like calling essays written on paper "ink essays". Computation is just the means. Human understanding is the goal.

I prefer Bret Victor's "explorable explanations" ([http://worrydream.com/#!/ExplorableExplanations](http://worrydream.com/#!/ExplorableExplanations)) because it captures the essence of what this new media is being used for, while also being more general than Wolfram's conception.

<comment><USER10> Eh, more like "writing essays". It's an essay in which the medium is computation, not just words. It's a bit whimsical but not that bad.

</comment></comment><comment><USER14> there's a good R/Jupyter blog discussing the same concept but without as much SW snark that HN comments always seem to have:

[https://blog.ouseful.info/2017/11/15/programming-meh-lets- te...](https://blog.ouseful.info/2017/11/15/programming-meh-lets-teach-how-to- write-computational-essays-instead/)

</comment><comment><USER15> Looks like a modernisation of the systems ala Framework IV etc of the late 80's and early 90's.

</comment><comment><USER16> This is like Jupyter Notebooks for Mathematica.

<comment><USER17> Mathematica definitely predates iPython.</comment></comment>


Ask HN: What's your main browser now? - <AUTHOR>

Firefox has added a lot of awesome developer tools lately and seems to be responding to the developer community in a great way. Has that made you switch to or continue using Firefox? Or is chrome your browser of choice? Maybe even safari or IE? <comment><USER2> I don't have a 'main' browser. I use Firefox as my development browser, Chrome for office apps, and Safari for general reading. It's not paranoia, it just lets me keep things separate in a very easy way.

</comment><comment><USER3> I really like Safari's Reader and that feature alone keeps me on Safari. Readability and other similar plugins on Chrome are nice, but I don't find them as well done as Reader.

</comment><comment><USER4> Chrome on laptop and phone. Mobile Safari and desktop FF are the occasional fallbacks. I'm no longer a dev, otherwise my answers would be different.

</comment><comment><USER5> Safari for most needs, with Chrome as a great secondary browser. IE and Firefox for testing.</comment>


Reenix: Implementing a Unix-Like Operating System in Rust [pdf] - <AUTHOR> http://scialex.github.io/reenix.pdf <comment><USER2> "The only problem is that rust was built with the idea that it will be used with a malloc style memory allocator. This kind of allocator is rather hard to implement using slab allocators since malloc must be able to allocate buffers of any size."

...

"About the only somewhat difficult challenge was that I was unable to find any clean way to switch between different virtual terminals. I ended up having to just update a pointer so that the interrupt subsystem could know which TTY to send input to." (discouraged in rust).

It's a good exercise to try to take a language with promise and use it for a systems task to understand what's possible. But sometimes some languages need to be systems languages, and others need to be application languages, because there are different assumptions and default cases we want to make easy/possible for developers.

<comment><USER3> Well TTYs are apparently they own kind of hell.

We are talking about a system that can trace a lineage back to the Morse telegraph...

<comment><USER2> With bits like schedulers and device drivers in an interrupt-based system a lot of ideas we'd like to about runtime state as modeled by your language of choice (the stack, lexical scope, memory, thread context, reference counts) become exposed and the implementation details have to be known, or you have to be comfortable tuning/self-restricting use of features around such a tricky, dragons-be-here scenario.

This isn't a problem specific to TTYs, but indeed they are their own special little hell no matter how you choose to tackle them.

</comment></comment></comment><comment><USER4> So basically TUNIS [http://en.wikipedia.org/wiki/TUNIS](http://en.wikipedia.org/wiki/TUNIS) for the Rust era and language.

It makes sense. Some of the best Unix implementation work I've seen (e.g. the DG/UX reimplementation of SVR4 UNIX for multiprocessors, large storage farms, and manageability) came from the "let's consider refactoring everything" that comes with a clean-sheet design.

</comment><comment><USER5> "This boot-loader, unfortunately, did not support loading any kernel images larger than 4 megabytes. This turned into a problem very quickly as it turns out that rustc is far less adept than gcc at creating succinct output. In fact, I was hitting this problem so early I was barely able to make a "Hello World" before having to stop working on rust code."

This really caught me. I have not played around with rust that much but having the executable be over 4MB, with such a small program such as just a Hello World is kind of nuts. I know that they still have lot of compiler optimization, but I just thought that was a very interesting portion of the read.

<comment><USER6> The actual kernel binary was smaller but the loader s limit was based on the amount of memory the kernel laid out in memory takes, including anonymous sections.

Also turning on optimizations in rust and the linker helped a lot but were not enough in the end.

<comment><USER7> I guess you are the author of linked paper. Well done.

I wonder if you have any opinions on how useful higher-kinded types (HKTs), one of the most requested features for Rust, would have been in implementing this OS. For example the absence of HKTs means that Rust can't have smooth and general handling of monads that is comparable to Haskell's. Would Haskell- style monads or Arrows have been helpful?

<comment><USER6> Thanks.

I believe HKT would have been useful but am not really sure how much HKT would have helped me overall. They would likely have been most useful (if at all) in the VFS/S5FS/VM stages that I was unable to fully get to.

Honestly, I have not used haskell enough to definitively say whether monads/arrows would have been useful.

<comment><USER7> I guess the only way to find out is to await the emergence of low-level languages with HKTs and then run suitable experiments.

</comment></comment></comment></comment></comment><comment><USER8> PDFs discussing topics like that used to look much more bleak. The code listings here look better than most of what I've seen before. Even the (dis)assembly has some syntax highlighting. This content deserves to be that nicely presented, I love it.

</comment><comment><USER9> I wonder how this compares with the benefits of writing a kernel in a high level language as seen in the Singularity project.

[http://research.microsoft.com/pubs/52716/tr-2005-135.pdf](http://research.microsoft.com/pubs/52716/tr-2005-135.pdf)

[http://research.microsoft.com/en- us/projects/singularity/](http://research.microsoft.com/en- us/projects/singularity/)

</comment><comment><USER10> I think it would be cool to study defect rates of a serious kernel implementation vs historic rates in linux and others.</comment>


Hiding The Lockheed Plant During WW2 - <AUTHOR> http://stories-etc.com/hidden.htm

<comment><USER2> If you're interested in such things, I highly recommend R. Stanley's "To Fool a Glass Eye," which covers a wide variety of camouflage strategies.</comment>


A Government Guide to Keeping Insulin Unaffordable - <AUTHOR> https://fee.org/articles/a-government-guide-to-keeping-insulin-unaffordable-3-easy-steps-on-how-to-hogtie-a-market/ <comment><USER3> As a type-1 diabetic and user of Lilly and Novo Nordisk insulins, this article is spot on. People are literally dying in some cases due to this dysfunction.

One thing that is not mentioned is that the dynamics of prescription-writing in the first place is anti-competitive in terms of price. Fiasp and Humalog are equivalent fast acting insulins from Novo-Nordisk and Lilly - <USER2> will only happen when patients can decide which one to take instead of their doctors, who are not sensitive to small price differences (and in most cases are not themselves taking the drug).

<comment><USER4> > s a type-1 diabetic and user of Lilly and Novo Nordisk insulins, this > article is spot on. People are literally dying in some cases due to this > dysfunction

How many people would be dying if there wasn't the same level of incentives to research these drugs in the first place?

Diabetes is a common health problem around the world. Nothing stopped say a non-profit or government from beating Lilly and Novo Nordisk to the punch developing these drugs. But profit seeking corporations are simply better at innovation than governments and non-profits.

<comment><USER5> The basic science behind insulin-the-drug wasn't innovated by profit seeking corporations. Applying that basic science to make a usable drug wasn't innovated by profit seeking corporations either. A cursory glance at the wikipedia page for insulin tells me the innovation was done be german, american, and canadian scientists at public universities, starting in the 1880s and not developing into a usable drug until the 1920s.

I don't think a profit seeking corporation would've done that.

<comment><USER4> If the basic science was the hard part, why did it take 40 years to go from basic science to "usable drug?"

<comment><USER6> Remember this was before the era of Facebook, even email and fedex now that I think of it, and they might have also been fighting the world war.

</comment></comment></comment></comment></comment><comment><USER7> > Even though insulin treatment itself can't be patented, improvements in > delivery mechanisms can be. These incremental improvements, no matter how > small, can be used to extend the 20-year patent on a drug, a process called > "patent evergreening."

I'm confused - wouldn't the new patent only cover the improved method, and the patent on the original, un-improved version would still expire?

<comment><USER4> "Evergreening" is a term made up by journalists that has no basis in patent law, and is also actively misleading.

The real issue is that nobody has an incentive to prescribe the older, less good but still acceptable drug. (In the case of insulin, note, it's not only the delivery mechanisms that have improved, but the insulin itself.) the insurance company, in particular, under the ACA, have no incentive to cut costs to improve profits.

<comment><USER8> Or, in the case of albuterol inhalers, the companies can actively lobby to prevent the older version from being distributed anymore.

Evergreening is absolutely a thing, and absolutely planned and executed by the companies that profit from it.

<comment><USER9> The older albuterol inhalers are no longer sold because they used CFCs as a propellant. CFC usage was banned internationally by the Montreal protocol in 1987. The propellant could not be immediately replaced due to strict FDA safety guarantees so they carved out a temporary exemption for medical usage. Research and development was done to find a replacement (HFAs) and that work is now being paid for by the patents granted from that process (more expensive inhalers). Whether this was a valid trade-off is a separate discussion but company lobbying is not the reason why they are no longer distributed.

[https://www.fda.gov/drugs/questions-answers/transition- cfc-p...](https://www.fda.gov/drugs/questions-answers/transition-cfc- propelled-albuterol-inhalers-hfa-propelled-albuterol-inhalers-questions-and- answers)

</comment></comment></comment></comment><comment><AUTHOR> By the way, you can do business without IP...

I recommend the following book: Against Intellectual Property by Stephan Kinsella.

[https://mises.org/library/against-intellectual- property-0](https://mises.org/library/against-intellectual-property-0)

</comment><comment><USER10> If campaign contributions are called free speech and legislators are happy making laws blatantly favoring contributors, you're going to have a pretty tight loop.

</comment><comment><USER11> How big is the insulin market? It sounds fairly big considering how many people have diabetes. So where are the Mexican cartels or similar black market organizations when you need them? If we're going to wait for the government, or worse, the industry itself to fix this problem it'll never be fixed. What we need is a proper black market. Is insulin available on the dark web drug markets? If not someone should make it available and cash in while still providing massive savings. That's how you solve a problem like this when your fucking government has stopped working like the US government has.

<comment><AUTHOR> Proper black market is exactly a part of the industry that the state fights.

One of the things I always wanted was to create a black market for electronics in my home country (Brazil) because taxation here is really high.

You should also know that the government with its patents system is the root cause of this price spike.

I wish black market organizations doing legit and good stuff (like selling medicine that is pricey due to state granted monopolies) was the norm and I hope someday it will be. However, we are not there yet.

</comment></comment><comment><USER12> Obligatory link to essay explaining the issues in pedagogical detail. Section II is on insulin:

[https://slatestarcodex.com/2019/04/30/buspirone-shortage- in-...](https://slatestarcodex.com/2019/04/30/buspirone-shortage-in- healthcaristan-ssr/)

</comment><comment><USER13> It's unaffordable because there is a monopoly on Insulin. Why is there a monopoly? Because it takes decades of work and close to a billion dollars to get a new drug through FDA approval.

We need to work on bringing these costs down, so more companies can actually compete. Government regulation schemes will only reduce the amount of companies willing to go through the process and give us less choice in the end.

<comment><USER14> There isn't a monopoly. It doesn't take decades to get a generic on the market. Insulin is available in wallmart for 25$ per vial.

There is a definite problem in the US with drug pricing, and middlemen gauging the market, but it's a straw man to claim new insulin products don't bring any change. If you ask the patients there's a world of difference between the cheap genetics and the main brand products, which is why they want the newer products and not the generics. But of cause patients also want the newer products at the same price as the generics which will never happen, even if the government fixes the drug pricing market.

<comment><USER13> If the generics are $25, then I don't see a problem. It's cheaply available and this article is wrong.

<comment><USER15> Most people will not be healthy with the generic insulin. There are wide verieties of treatment methods for vastly different people and medicine has come a long way. This "generic" human insulin replacement is a 40 year setback in treatment and will likely cause more secondary costs due to bad treatment.

<comment><USER16> Do you have some more information about this? It's interesting to me and I'd like to learn more.</comment></comment></comment></comment></comment>


Ask HN: Does anyone know of am open source flash mp3 player? - <AUTHOR>

I'm thinking of something like flowplayer, but for mp3s. I want to be able to stream mp3 files to a client in a browser. Has anyone used anything like this? <comment><USER2> JW FLV Player at <http://www.jeroenwijering.com/?item=jw_media_player>

Prominent websites that utilizes the JW FLV Player for streaming mp3's, HypeMachine (hypem.com).</comment>


NYT science reporter John Markoff: We shouldn't worry about robots attacking us - <AUTHOR> http://www.geekwire.com/2015/nyt-science-reporter-john-markoff-we-shouldnt-worry-about-robots-attacking-us/

<comment><USER2> Anyone who has encountered a bug should know that software can have emergent behaviors. And when you consider the possible emergent behaviors of armed robots using distributed AI and real-time data...well, the guy who wrote this article is an idiot. They should fire him from the NYT and find somebody who understands the complexity of this topic.

</comment><comment><USER3> John Markoff's book, *Machines of Loving Grace", is a must read for anyone interested in the future (and who isn't).

</comment><comment><USER4> quote "..as a species have a propensity to anthropomorphize almost anything we interact with" this. And a part from this, bugs. I mean, bugs are there even if you use nasa best practices for safety-critical software</comment>