Pwned Passwords in Practice: Real World Examples of Blocking the Worst Passwords - <AUTHOR> https://www.troyhunt.com/pwned-passwords-in-practice-real-world-examples-of-blocking-the-worst-passwords/ <comment><USER2> I'm a huge fan of Troy Hunt and HIBP, but reading this I assumed it was basically an advertisement to get people to sign up for the Pwned Passwords API -- I admit I didn't make it down to the "And Finally..." section where he explains that it's free because there were a bunch of pictures at the bottom and I stopped reading.

But reading through the API docs [0] it shows that API has no rate limit. Impressive.

[0] [https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByP...](https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByPassword)

<comment><USER3> Even if he's not charging for the service, I am pretty sure he's getting more consultancy work from these "PR" (notice the quotes) posts. Even the timing on which he releases them makes sense in a way to prevent people from getting too tired of this service.

Not saying is a bad thing but don't assume something is for pure altruism because not many things are.

<comment><USER4> Have you ever been paid to do work that you really want to happen? Been paid to improve the world in a small, but significant way? It's a lovely feeling.

<comment><USER5> But what is the value-add of this service?

Complex passwords are quite useful if the server gets hacked and someone walks away with the (salted) password hashes. Against brute-forcing passwords at the login screen of an application they don't add much value, other than making it the user quite hard to remember what the password for this particular site could be...

Theoretically, if you block a user ID after say 5 or so invalid logins, almost any bad password from the Have I been P0wned list will prevent you from being hacked. The chance that you pick exactly that password from the 1-million or so list is quite minimal.

So with that in mind, wouldn't this service be something for website owners that don't know how to properly secure the information they control?

<comment><USER6> Because chances are, if you are using a password that is in the list, it's because either it's an exceedingly common password (and you really shouldn't be using it) or you've used it before multiple times and are probably the reason it is in the list (because it was breached on another site).

From experience, most attacks we see now are credential stuffing attacks rather than pure brute force attacks using something like Sentry MBA, with a huge number of IP addresses (the last attack we saw was using over 6 million IP addresses). So throttling sign in attempts at the IP level is almost useless as is throttling at the email level, as the attacker can attempt at least 6 million known email/password combinations to see if those accounts exist on your site.

The only real defence against that is all your users using 2 factor, or creating a psuedo 2nd factor (email them if the attempt is from an unrecognised IP).

Edit: Of course the other helpful defence is to ensure your users aren't reusing passwords, which is where Pwned Passwords comes in.

<comment><USER7> I can attest to this. Credential stuffing was the number 1 reason we decided to add the pwnedpassword validation to our signup flows. We were seeing thousands of IP addresses and hundreds of thousands of requests over a few days. Rate limiting slows it down but doesn't help all that much. Rate limiting on a specific username will prevent brute forcing but exposes you to DOS. Rate limiting by IP becomes less effective when thousands are involved and most requests end up succeeding.

Disclaimer: work for Kogan who is mentioned in TFA.

<comment><USER8> > Rate limiting by IP becomes less effective when thousands are involved and > most requests end up succeeding.

What do you mean by "end up succeeding"? Most requests successfully authenticated? On the first try? Second try? Tenth try? Hundredth try?

(I'm not trying to doubt the utility of pwnedpassword validation; just hoping you can help me understand the threat you're facing and why IP rate limiting didn't help much. Thanks.)

<comment><USER6> Perhaps an example will help.

Lets say you have IP throttling/rate limiting. And you have it set to an extremely conservative limit - 1 sign in attempt every hour. This is great for the brute force threat - 24 passwords a day can be attempted by 1 IP. Infeasible for any brute forcing.

But now lets say the attacker has access to a botnet with 6 million unique IP addresses (not theoretical - see my comment above).

Now for each of those 6 million IPs they can try 24 passwords a day - i.e. 144 million attempts a day without ever triggering the throttle.

Bear in mind also that they aren't just trying random passwords for an account - they have a compiled/combined breach list of known account/password combinations from other breaches. So they can attempt 144 million known combinations a day. Without hitting any throttles (this is what the parent above means by "end up succeding").

What percentage of your users reuse passwords and have been exposed to at least one breach? I would suggest it's quite a high value. How long do you think it will take a credential stuffing attack to identify those accounts on your site when they can try 100's of millions of combinations a day?

This is the threat vector.

<comment><USER9> ISTM the next step would be to rate limit for a given account without regard to IP. Sure that's a potential DOS, but we can wait until that's actually a problem before worrying about it.

<comment><USER6> They aren't trying the same account multiple times. Well they may be conincidentally (if the user uses a unique password per site and has been breached from multiple sites so appears in the breach list multiple times with different passwords) but not that frequently. What they are looking for is the intersection of users who reuse passwords and have been exposed by a breach and those users who have created an account on your site reusing the same password. Which is perhaps not surprisingly a relatively large percentage of your users.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I wrote this small python function to check if a password is part of a breach by transmitting only the first 5 digits of it's hash: [https://gist.github.com/mcdallas/d94ecd8b34a6bf57a162a7af0ce...](https://gist.github.com/mcdallas/d94ecd8b34a6bf57a162a7af0ce2a664)

<comment><USER2> FYI: "Due to the massive popularity of the range search over searching by complete password hash, the significantly improved performance and the enhanced privacy controls, searching by hash will be discontinued on 1 June 2018."

Shown in API docs under "Pwned Passwords overview" and links to here: [https://www.troyhunt.com/enhancing-pwned-passwords- privacy-b...](https://www.troyhunt.com/enhancing-pwned-passwords-privacy-by- exclusively-supporting-anonymity/)

<comment><USER10> I think what he means is that searching by full hash will be removed in favour of using the /range endpoint (the one I am using)

</comment></comment></comment><comment><USER11> Would be nice if they made a bloom filter for anyone to use. On second thought, you can do that yourself based on the SHA-1 hashes of passwords they offer for download.

Edit: On third thought, a bloom filter for 502M entries and a false positive rate of 0.1% ends up as a 800MiB large filter. Binary-searching the whole dump is surely faster.

<comment><USER12> > a bloom filter for 502M entries and a false positive rate of 0.1% ends up as > a 800MiB large filter

With that sort of FP rate it's not really much use beyond filtering API calls. I'd suggest 2GB[1] as a more sensible minimum. A compressed filter can get this down somewhat.

> Binary-searching the whole dump is surely faster.

Not really. log2(500M) is ~29, k for a suitably sized bloom filter's only 23. Interpolation search can get you a result in more like 10 seeks, but a bucketed bloom filter can get your lookup down to a single read.

Having spent a fair bit of time faffing about with this stuff I ended up settling[2][3] on Golomb compressed sets[4], which can get the full list with a 1-in-10 million FP rate into 1.5GB.

[1]: [https://hur.st/bloomfilter/?n=500M&p=1.0E-7](https://hur.st/bloomfilter/?n=500M&p=1.0E-7) [2]: [https://github.com/Freaky/gcstool](https://github.com/Freaky/gcstool) [3]: [https://github.com/Freaky/ruby-gcs](https://github.com/Freaky/ruby-gcs) [4]: [http://giovanni.bajo.it/post/47119962313/golomb-coded- sets-s...](http://giovanni.bajo.it/post/47119962313/golomb-coded-sets-smaller- than-bloom-filters)

<comment><USER11> Oh right, I was wrongly thinking you'd have to memcmp the whole size of the filter. It's simply too warm today for thinking. Did you look into Cuckoo filters as well?

<comment><USER12> > Oh right, I was wrongly thinking you'd have to memcmp the whole size of the > filter.

Yeah, it's just k single-bit lookups - ideally you do something to get them into clusters, like dividing the database into sub-filters, so you're doing random lookups into, say, a 32KB chunk instead of a whole 2GB filter.

> Did you look into Cuckoo filters as well?

Cuckoo filters look like an interesting alternative and looking at them more closely is on the to-do. I don't think they'd have any significant space savings, though - they're similarly about 75% the size of the equivalent bloom filter. Maybe they'd be faster for lookups?

I'd also be interested in playing with matrix filters[1], which supposedly get close to the theoretical limits for these sorts of structures. Implementing them seems rather more involved, sadly - particularly given the only reference I can find is a fairly inscrutable CS paper. Show us the code damnit.

[1]: [https://arxiv.org/abs/0804.1845](https://arxiv.org/abs/0804.1845)

</comment></comment></comment></comment><comment><USER13> I'm trying to figure out if I need to do this if I'm requiring minimum sixteen characters... after searching the docs and several of the blog posts, I can't ascertain if the corpus contains any passwords/phrases >= 16 characters. I don't want to be running this check on every passphrase create/modify if the corpus contains none or very very few passes length 16 or greater. Does anyone have any insight into the contents? Or, a way to query only the portion of the corpus that has 16 or greater?

<comment><USER14> I just tried 'passwordpassword' and it was there. You can download the whole dataset at the bottom of this page

[https://haveibeenpwned.com/Passwords](https://haveibeenpwned.com/Passwords)

Its a losing battle trying to add byzantine rules to prevent users doing things like using their normal password * 2, so its probably a reasonable check to add.

<comment><USER13> Aha, I tried a few obvious 16s but not that one... thank you! I guess we'll add it in. The last few dumps (other sources) I reviewed contained nothing over 15 characters, but I'm imagining they will start creeping in as more folks demand longer phrases.

Still, I'd bet the vast majority of the bad passes are <16, seems a heck of a waste of energy and bandwidth to check my user's passphrases against (guesstimating) 0.05% of the corpus.

</comment></comment></comment><comment><USER15> Soliciting people to enter their passwords seems like a bad approach both because it's risky and because it helps train people to do risky things - better would be a service that attempts to crack passwords and if it succeeds, disables the account until a new password is set. Seems like a service that everybody should use, if it existed. Much better than arbitrary rules about "good" password character sets.

<comment><USER16> There's no one specific way to crack a password. It all depends on the implementation. The most basic case is just storing the password in plaintext, and plenty of companies are more than happy to do that. Passwords don't exist as some separate entity, they're attached to a system. So cracking an Adobe password might be easy, but cracking a Dropbox password incredinly hard.

<comment><USER15> I suppose. I was thinking of just hashing all known passwords and plausible passwords and locking any accounts that matched.

</comment></comment></comment><comment><USER17> The only thing I had a hard time understanding-

OP really cares about his privacy/security/password, but then he uses a secondary system to store it?

Is this the best way to do this? Break into the secondary system and everything is available. Keyloggers, eyes, stolen computers, all have the possibility of everything available.

I considered other solutions like written + put in a lock box in a bank, but thats really inaccessable.

<comment><USER18> It is the best way to do it for the average user.

Modern password management services are incredibly secure, with client-side encryption of your secrets, among other protective mechanisms (to guard against keyloggers, stolen computers, ...)

There is still a risk, because you're trusting third-party software (which in some cases is closed-source – including 1Password), but for most people that is a much lower risk profile than if they were managing passwords themselves.

For specifics on 1password's security, check out [https://1password.com/security/](https://1password.com/security/)

<comment><USER19> > Modern password management services are incredibly secure

There lots of password managers that have had gaping vulnerabilities. From memory I'm sure I've seen LastPass vulnerabilities top HN just a while ago... yeah probably this one: [https://www.bankinfosecurity.com/lastpass-patches- password-m...](https://www.bankinfosecurity.com/lastpass-patches-password- manager-vulnerability-a-9299)

</comment></comment></comment><comment><USER20> Great in theory, I don't think it will play out good because of the average computer user. Ask any help desk employee.

<comment><USER21> Word. Password security should be proportional to chance of a dictionary attack * risk of a successful attack. Mozilla want a 12 character passwords to file a bug report when they really should publish an email address an anonymous html form and say please.

<comment><USER22> I know what you are feeling, but there's a balance to making bug filing easy. For a large visible project, make it easy and the statistical noise drowns everything out.

</comment></comment></comment><comment><USER23> _they gave people the ability to check any individual password against the online Pwned Passwords service_

What could possibly go wrong?

This works by locally hashing your password, then sending only the first 5 hex characters of the hash to the server. The server sends back all matching hashes of bad passwords it has on file. Typically this returns a few hundred hits. The local client (probably some piece of Javascript) checks the hits against the password hashes returned. If there's a match, the password is in the database of bad passwords. This supposedly protects the password if communications with the checker are intercepted.

But does it? If an attacker can see those first 5 hex characters, they too can get the list of hashes of matching passwords. There are only a few hundred of them, and they're hashes, not the actual passwords. One of those is the hash of the user's password. Now they know what hashes to try.

An attacker presumably has a big database of likely passwords to try. So they can create a database of hashes locally. The hashing algorithm is known to the client, after all. So now they have a few hundred passwords to try for a break-in. Try those over the next few days, and they're in.

Is it really that bad, or am I misunderstanding something here?

<comment><USER24> The point of a secure password is that it _won't_ be in the list of hashes by the server. The service should prevent the user from using any of the passwords that are matched by the password database.

</comment></comment><comment><USER19> The Okta chrome extension mentioned in the article seems very cool and useful.

But how do we trust the Okta chrome extension not to post all credentials to the developer? Even if its doing nothing shady now, in some future update?

<comment><USER25> With that security model, how do you trust any extension at all?

At least with this one, you can audit the source code and build it for yourself[0]

0: [https://github.com/OktaSecurityLabs/passprotect- chrome](https://github.com/OktaSecurityLabs/passprotect-chrome)

<comment><USER19> I once made a webpage where HNers drag-dropped their entire iphone backups. It got me thinking. [http://markolson.github.io/js-sqlite-map- thing/](http://markolson.github.io/js-sqlite-map-thing/)

<comment><USER26> Whenever there are tools like this I usually just visit the site then unplug my ethernet/disconnect from WiFi. If it's actually client side JS it will work.

I'm pretty sure this is safe, but if there's a way to defer sending an HTTP request to after the page being closed...

<comment><USER27> If you do it from a private browsing window, maybe that would be fine. Maybe. (Otherwise the page could exfiltrate information via localstorage or something.)

</comment></comment></comment></comment></comment><comment><USER28> Stupid question here. But shouldn't websites/apps simply lock the account for 5 minutes after 3 bad password attempts? -- basically ending the usefulness of bad password lists, etc etc. Do sites actually let you run limitless password attempts -- thus really find these password lists important? If your password was "foofoo", and there was a password lock after 3 attempts I don't see how you would crack it with a password file (in this lifetime).

<comment><USER29> I've tried that once in a site and it was a maintenance nightmare. Users kept bombarding me with emails asking to unlock their accounts. Turns out 99 times out of 100 that a username/password combo has been mistyped it's from users jerking around or not remembering the password, rather from hackers trying to brute force their entrance.

Now imagine having a site with a few million accounts and 0,1% of them mistyping the password every now and then.

<comment><USER30> Sounds like a case of not handling the UX of the feature properly. What you can do is either allow them to unlock the account via email, or have a time- based unlock, or both. We do 72 hours or unlock it via email.

</comment></comment></comment><comment><USER31> reminder: never enter your email on one of those 'have i been pwned databases' . Find a way to download the database offline and then check it.

<comment><USER32> Not sure why this was voted down. By entering your email, you are providing lots of valuable data to a potential attacker: that you are active, your IP address and environment, all of which can help unlock your account on whatever service was compromised.

<comment><USER33> Who could possibly get this info on [https://haveibeenpwned.com](https://haveibeenpwned.com) ? Troy? I bet he doesn't even keep logs. Anyone listening to your HTTPS connections? Then you have some more serious issues.

No seriously, Troy's site is awesome, and spreading FUD is not doing them any service.

<comment><USER7> It's good advice _in general_ for most folks. For those that know of Troy and this particular site it's fine, but the general recommendation still stands.</comment></comment></comment></comment>


Appalachian Miners Are Learning to Code - <AUTHOR> http://www.bloomberg.com/news/articles/2016-02-03/from-coal-to-coding-appalachian-miners-getting-a-fresh-start <comment><USER2> _I want to believe..._ But I suspect this will not be a winning approach for most displaced coal miners.

What's interesting to me is that we have many reasonably well-paid trade skills in America: plumbers, carpenters, masons, electricians, landscapers, arborists, mechanics, etc.

Last year I paid $2,000 for a new lawn and another $1,500 to have a dying tree removed. Both took a few hours for two people to complete. It wouldn't surprise me if these guys are making more money than your average programmer. I think we should try and promote these good jobs to both young people in depressed areas, but also to adults looking for a new trade. Not everyone needs to work in a cubical...

<comment><USER3> In depressed areas, you don't have many people with money to spend on home improvement.

<comment> rm_-rf_slash Home appliances and cars still break and need regular maintenance.

<comment><USER4> And that maintenance is minimized, avoided and cheapened out on as much as possible. You know all those stories of poor people being ticketed for burned out headlights and similar car problems?

I don't know anyone in the tech industry who ever have a burned out headlight on their 2 years old leased car. Maybe it's because they can afford to have it fixed and maybe it's cause they don't own, let alone drive, a junker in the first place.

Since I get downvoted a lot, perhaps a clarification in order: My point is when 2/3 of the high paying jobs in a locale get yanked, the service industry folks that depend on people having income they can use are the first to get screwed. Coal mining is high-paying (compared to median pay, it'd be shit by SF standards...)

</comment></comment></comment></comment><comment><USER5> I think you'd be hard pressed to find a higher per-capita concentration of non-coding 'hackers' than in Appalachia- making do and making things do what they're not supposed to are pretty much the defining regional characteristic. Of course that doesn't necessarily mean they'll be great developers/ software engineers.

<comment><USER6> Gotta love that old scotch-irish nature!

[https://en.wikipedia.org/wiki/Scotch- Irish_Americans](https://en.wikipedia.org/wiki/Scotch-Irish_Americans)

</comment></comment><comment><USER7> Curious what you guys think, I always thought coding is like scribing in the 13th century where a large percentage of population is illiterate and scribers are relegated to imperial quarters to take note of the empire's history and accounting.

However, better education system (programs to teach kids and adults coding) and improved accessibility of writing process from carving on stone tablets to ink on paper (better toolchains and the ubiquity of smartphones and computers) led to mass literacy rates.

Scribers (CRUD web apps written using CGI/Java 1.5) are therefore commoditized and become from emperor's scribes to Bartleby the clerk (CRUD using Rails and Node).

Thus writing becomes less a lucrative profession to literature where you have 1% rockstars authors who rely on marketing and a huge popular following to generate hits (e.g., startup's that rely on the charisma of the "founder myth" to raise money, but have the lifecycle of a reality TV show and the whims of the consumer taste; Friendster to Myspace to Facebook ("Zuckerburg") to Snapchat; Napster to iTunes to Spotify to Tidal ("Jay-Z")).

Now suppose you are the 99% Bartleby the scrivener, what are you to do, other than to say, "I prefer not to..."?

</comment><comment><USER8> Hello HN.. Atlantan here. Frankly I find this armchair speculation from the west coast a bit comical. Coding as a trade is a thing at this point. Look at the coding bootcamps that function basically as an apprenticeship/trade school. Where does the target audience factor into it? In terms of capital, a) money is everywhere - that's why they call it money and b) the southeast is home to at least three top 20 banks and Atlanta is a huge payments processing hub.

You should visit.

</comment><comment><USER9> I'd love to see some of the enthusiasm for science and technology that's prevalent along the west coast spread to the south. I always find it interesting when I read an article about San Francisco locals becoming "annoyed" with the huge number of tech workers taking over the city. Where I live (Knoxville), I find that most people are relatively uninterested in discussing technology.

But I think that's changing. Chattanooga was the first city in the US to offer gigabit internet to its residents, and the city is working hard to incentivize tech companies to locate there — for a startup, high-quality internet and cheap office space are hard to pass up. Also, a lot of the region's natural beauty is attractive to programmers who are able to work remotely. Consider a city like Asheville — hardly any tech there, but there is a great little food scene and the city is surrounded by beautiful mountains. Research Triangle Park in Raleigh-Durham has a fair number of tech companies, but that region is still a little too vanilla/corporate/suburban for my liking. I think that's changing as well though.

The biggest problem is that people are always going to locate where there peers are and where the resources are located, and Appalachia currently has very few tech resources. I read recently that 25% of all the world's venture capital is located in the Bay Area. Like-minded people tend to congregate near each other to share and debate ideas. After SF/SV, the biggest tech cities in the US are New York, LA, Seattle, Boston, and Austin. The southern United States still has a long way to go before they acquire a critical mass of people who are interested in technology, and it's difficult to build momentum. I was speaking to my uncle (who has worked at Georgia's department of economic development), and he said that one of the big problems for technological development in Georgia is that companies that are founded there tend to move to California once they become successful. The question is: how do you make it attractive for them to instead stay in Atlanta?

<comment><USER10> I think one of the 'problems' in viewing the South as a homogeneous whole is that it is so huge and so sparsely populated. Austin, Dallas, and Atlanta (and to an extent, Houston) are pretty tech-y, but they are all so far apart, unlike the Eastern Seaboard, SF-SV, SoCal, or Portland-Seattle. Mid-west has Raleigh-RTP-type pockets of science/tech in Minneapolis and Chicago, otherwise expanse is a problem in Dakotas, Iowa, etc. too. This expanse should be less and less of a problem as telecommuting becomes more prevalent. But geography is still a pretty big challenge to overcome.

<comment><USER11> The South isn't really sparsely populated by US standards. Here's a choropleth map of 2010 population density by county: [http://ecpmlangues.u-strasbg.fr/civilization/geography/maps/...](http://ecpmlangues.u-strasbg.fr/civilization/geography/maps/US%20Population%20density,%202010.png)

<comment><USER10> Good point, there are two notable contiguous bands: Atlanta-Greenville- Charlotte-RTP and Florida Atlantic coast. A couple of things to add: in the south, distance between dense counties is large elsewhere- not too many contiguous regions/clusters. Then, there's also the question: is density _sufficient_ to create a tech hub? Density is surely a factor, but far from sufficient.

Edit: I feel compelled to add this image from Wikipedia: [https://upload.wikimedia.org/wikipedia/commons/5/51/MapofEme...](https://upload.wikimedia.org/wikipedia/commons/5/51/MapofEmergingUSMegaregions.png)

<comment><USER12> The map is slightly deceptive when it comes to Virginia; here the cities are independent of the counties that often completely surround them, and so "city or county" is an equivalent-level government. So you see all the darkest-red dots running up the western part of Virginia? If the population in those cities were shared with the surrounding county and the density recalculated, you'd get a lot more of the middle-reds you see in western NC and SC.

So the "Atlanta-Greenville-Charlotte-RTP" band that you see really continues all the way up to DC (where it becomes even denser and turns in to the Northeast Corridor Metroplex).

</comment></comment></comment></comment></comment><comment><USER13> previous HN discussion: [https://news.ycombinator.com/item?id=10592754](https://news.ycombinator.com/item?id=10592754)

</comment><comment><USER14> I know plenty of people that are long-term unemployed. With some the idea of talking about work is deeply upsetting, they just cannot bounce back, pick themselves up, learn a new skill and get set into a new career. To them I should be an example of how it is done - I had to change career a few years ago, and despite being long in the tooth with no formal university education in things like OOP, I was able to learn enough to get a programming gig and move on from there.

I do e-commerce for my sins and I am fortunate enough to always get work. Last time I had to pick up the phone I had 12 interviews lined up by tea time with a couple of those being of the 'start Monday' variety. From this perspective I am aware that, for what I do, there are more jobs than candidates.

Sometimes I watch the news and see some story about unemployment, particularly among the younger entrants into the job market. Normally you have some talking heads in the news article where the government gets blamed for individual circumstances of despair and no opportunity. I then feel bemused, and wonder why the world of work is how it is with companies like my current employers unable to find me a front-end dev for love or money. Sure we would take zero experience for the right candidate, although a few years of experience would be far preferable. I truly doubt we would have more candidates even if there were a million out of work coal miners in a five mile radius, that is what I find odd about this article is that there were '1000 applicants'.

For all of my out-of-work friends I do try and find them some work, even if they are not able to enter the job market properly. I can conjure up some translation work (for those that have a different mother tongue) or some customer service work (that requires no pre-requisite skills). I also offer to train them up in everything I know.

But do these opportunities, even the easiest, baby-step stepping stones get followed up on? No!!! Never!!!

Those of us in the world of work, able to get up in the mornings and able to wear clean clothes doing as we are told working for the man at some desk all day with a convenient pay check just do not 'get it' when it comes to understanding the long term unemployed. To us it seems obvious - learn a new skill, get some experience, put together a portfolio, move to a new area, but many, many people are fundamentally depressed and excluded from the job market. Our advice and gentle nudges falls on deaf ears. We don't understand them and they don't understand us. Articles like this one and every news article ever written on unemployment just has this naive view of things and never touches on the issues of self esteem and confidence that haunt many job seekers.

</comment><comment><USER15> Awesome. There are a ton of problems that could use software. These guys are used to working for it, and I suspect do not need the problem to be sexy to be worth doing.

On a more basic level, I really value people and when we can open doors for them, the world gets a little better. Worth it. Not all of them will take the steps, nor will all of them enjoy success.

It's not about that. It is all about the ones that do, and the number of doors we have for people to attempt to walk through and improve.

</comment><comment><USER16> Sounds like a great idea for a movie, perhaps October.py ?

</comment><comment><USER17> I'm seeing a few people claiming this proves we're in a bubble. That we've reached peak computer science. Why?

Maybe I'm being touchy due to my location[1] but that sounds rather arrogant. This seems to be a more comprehensive training program than 6 week "hacker" schools so many are fond of. The workers were even paid while being trained. Is it because they're hillbillies?

[1] I live in southeastern Kentucky.

</comment><comment><USER18> Between writing web apps in Java and working in a coal mine, I'd be in doubt for a moment. After that, I'd probably take the mine.

<comment><USER19> Have you ever been inside a mine?

<comment><USER18> No, but, in any case, it was a joke. I would prefer writing Java code to working in a coal mine.

Now, with PHP...

</comment></comment></comment><comment><USER20> Signs of a bubble about to collapse

<comment><USER4> There's a lot of unsexy dev work out there. Not the kind of change the world startup HN is all about but the kind that made the website for your caterer or hairdresser or an "e-commerce" website for some small business.

<comment><USER21> Isn't this kind of thing fixable by configuration or installing plugins ?

</comment></comment></comment><comment><USER22> From black lung to carpal tunnels.....

</comment><comment><USER23> once I rented a UHaul and it took the young kid like 5 minutes to type my name. He was hunting and pecking. I don't consider programming completely dependent on how fast people can type, but less than 10 words a minute is not employable. For professions that are completely removed from desks I think learning these skills at an adult age would be very challenging...

<comment><USER24> "I think learning these skills at an adult age would be very challenging"

Anything to backup your thinking? I've seen adult hunt and peckers go to 20-30 wpm in a week or two of using no letter keyboards. That's plenty fast for coding.

</comment></comment><comment><USER25> If we're not at peak computer science already, we're very close to it. Stories like this almost seem like satire at this point. It will be interesting to see how the companies backing this "learn to code" push fare in the coming months with all the financial turmoil that's brewing.

<comment><USER26> >If we're not at peak computer science already, we're very close to it.

Is there a 'peak' reading/writing ability? Just because the majority can write doesn't mean they can pump out award winning novels. On top of that, these miners are learning to code, which is to computer science like grammar is to linguistics.

<comment><USER25> Peak in terms of adoption. Sure they're not experts and are only learning fundamental skills, but it's a bizarre phenomenon nonetheless.

>Is there a 'peak' reading/writing ability?

Arguments like this don't make any sense. Computer science is no more of an essential skill because we use computers than cellular biology is because we're all made of cells. Why aren't we all learning cellular biology? The miners should be learning about how their body works.

<comment><USER26> First, they are not learning comp science. The article states they are learning to code HTML/PHP/JS.

Second, we do all learn biology....that's fairly standard high school and college curriculum.

Third, I would argue that basic comp science knowledge is becoming essential to professional success just like communication skills are. Individuals who understand systems and communicate in functional and technical domains are in high demand.

<comment><USER27> I suppose that makes sense.

Also we all drive cars and use machinery, so we should all learn the principles of mechanical engineering while we're at it. And all of our lives are heavily influenced by the weather, so everyone should learn meteorology. We also all live in homes, so high schools should provide mandatory construction classes.

<comment><USER28> _A human being should be able to change a diaper, plan an invasion, butcher a hog, conn a ship, design a building, write a sonnet, balance accounts, build a wall, set a bone, comfort the dying, take orders, give orders, cooperate, act alone, solve equations, analyze a new problem, pitch manure, program a computer, cook a tasty meal, fight efficiently, die gallantly. Specialization is for insects._

Robert A. Heinlein, Time Enough For Love

<comment><USER29> Insects are some of the most successful creatures on the face of the planet.</comment></comment></comment></comment></comment></comment></comment>


'Calexit': Yes California movement opens 'embassy' in Moscow - <AUTHOR> https://www.rt.com/usa/370698-calexit-california-embassy-moscow/ <comment><USER2> How is this clickbait appropriate for hacker news?</comment>


Boston Dynamics: the New SpotMini [video] - <AUTHOR> https://www.youtube.com/watch?v=kgaO45SyaO4 <comment><USER2> This seems to be missing the creepy tentacle head or whatever the appendage was on top of the previous version, so it's not clear what it would be useful for besides trotting around the yard looking like a dog. It might be good for surveillance, though I bet I could buy a _lot_ of security cameras for less money.

<comment><USER3> Right, but how many of those cameras could quietly travel in difficult terrain ahead of troops?

</comment></comment><comment><USER4> Their videos never cease to terrify me. Compare their robots to AIBO, QRIO and ASIMO. Boston Dynamics machines always look like they've popped out of our worst nightmares. Even this latest, somewhat-less-evil looking one.

</comment><comment><USER5> Pretty sure I read about this robot already in 'Farenheit 451'

</comment><comment><USER6> Science has gone too far.

<comment><USER7> I am sure somebody said that about photography, when it was first demoed to the public.</comment></comment>


DoorBot – Not Ready for Prime Time - <AUTHOR> http://www.notthewizard.com/2014/01/17/doorbot-not-ready-for-prime-time/

<comment><USER2> You should sell it on eBay...</comment>


Oracle Buys AddThis - <AUTHOR> https://www.oracle.com/corporate/acquisitions/addthis/index.html <comment> mako-taco We're proud to soon be joining the #OracleDataCloud! Learn more: [http://www.oracle.com/addthis](http://www.oracle.com/addthis)</comment>


Why America's obsession with STEM education is dangerous - <AUTHOR> http://www.washingtonpost.com/opinions/why-stem-wont-make-us-successful/2015/03/26/5f4604f2-d2a5-11e4-ab77-9646eea6a4c7_story.html

<comment><USER2> Duplicate: [https://news.ycombinator.com/item?id=9285423](https://news.ycombinator.com/item?id=9285423)

That has extensive ongoing comments.</comment>


Nostalgia and fun with calculators - <AUTHOR> http://ludditus.com/2019/02/10/nostalgia-fun-with-calculators/ <comment><USER2> > Truth be told, nobody makes hardware the way they used to in the 70s and the > 80s.

> Simply put, CASIO is the king, and fx-991EX, whatever you call it, is the > mother of all calculators, both in build quality and features

Let me introduce to you the DM-42, the ultimate calculator

[https://www.swissmicros.com/dm42.php](https://www.swissmicros.com/dm42.php)

Precision? 34 decimal digits

Build quality? Steel case for starters

Keypad? Harks back to those classic HPs in feel

Screen? High-res, high contrast

Performance? 24 MHz ARM core

And best of all? Fully free firmware that you can verify and modify to your hearts content.

<comment><USER3> This looks like a prototype? It doesn't look like they're selling this.

<comment><USER2> They have been shipping DM42 for over a year now: [https://www.swissmicros.com/order.php](https://www.swissmicros.com/order.php)

</comment></comment></comment><comment><USER4> I have a CASIO CFX-9850 GB PLUS with 64 KB memory, and it's been the most useful gadget for spreadsheet-style graphics and data analysis. Since it has a 3 color display, it's very easy to visualize lots of different datasets.

As far as I know, they don't make them anymore, which is a shame. They were great. Slow BASIC, but the BASIC was amazing and easy to use.

<comment><USER5> They only make the monochrome fx-9860GII and fx-9750GII.

<comment><USER4> That's a bummer. The color display was finicky but it really did help convey information effectively to a suspicious lab TA.

</comment></comment></comment><comment><USER6> I just tried the ln(x²) integration example on my ancient TI-68 (built in Feb 1991) - unfortunately the accuracy depends on judicious choice of numerical integration intervals (it uses Simpson's rule). It seemed to give best results with about 25 intervals, taking about 7 seconds to come up with 717.7575466854 (more intervals result in overshooting the correct answer).

</comment><comment><USER7> > just so they can wear one or another depending on their mood and apparel. Is > there anyone doing the same with pocket or handheld calculators?

Yes. And the old organizers. Gulp

</comment><comment><USER8> I stick to my HP-50G (which is pretty much the best all-around calculator ever made) and intend to eventually maintain the iOS emulator myself, as it seems there is so little interest.

I do not understand why people do not use calculators, if you are in any engineering profession, it makes life so much easier. No, wolfram alpha, google, siri, python or bc are not the same thing at all.

<comment><USER9> >No, wolfram alpha, google, siri, python or bc are not the same thing at all.

Why not? A combination of the plain old Windows calculator (scientific and programmer modes) and DDG/Google for unit conversions has worked well for me for years, and doesn't require that I move my fingers off the keyboard.

<comment><USER8> Because you can't use these tools on many occasions, they don't always do exactly what you want, and accessing them is slower than using a calculator. The devil is in the details. Such as being able to quickly switch to engineering notation to display values applicable in electronics.

Also, I often want to do a series of calculations, for which an RPN calculator with a stack (you can see the top 7 levels) is uniquely suited.

As another example, unit conversions (basically, convert between every unit known to man) is something I use every day. It takes about 6 keystrokes to convert from anything to pretty much anything on a HP-50G.

</comment></comment></comment><comment><USER10> 8008135

<comment><USER11> SEIBOOB?

<comment><USER10> Gimme a break, it's been decades :P

</comment></comment></comment><comment><USER12> i was expecting to see 8008

</comment><comment><USER13> This article reminded me of this classic:

[https://i.imgur.com/fYuWMTq.jpg](https://i.imgur.com/fYuWMTq.jpg)

</comment><comment><USER3> > The EU General Data Protection Regulation (GDPR) requires me to put this > shit here. I don't use cookies (at least, not knowingly!), except for > myself, when I must log in to write posts and deal with the comments. If > WordPress or one of its plugins uses cookies for whatever reason, I don't > give a dead rat's ass on them, and I don't feel responsible. And now, for > the bureaucrats in Brussels and Strasbourg, the following nonsense: This > site is (probably) using cookies for some reason unknown to me (most likely > to give you the best experience etc). You can find out more about which > cookies are used or switch them off in settings.

I'm sorry, but you don't get to deny responsibility of what goes on your website, and I find it frankly concerning that you are unaware of what is using cookies (it's StatCounter, just FYI).

On topic, I don't think the author of this article understands how the calculator he's using work; the calculators (at least the Casio one; I have the 115 ES Plus and I think it's functionally identical to the 991 ES Plus) are actually just computing the integrals numerically and then converting to fractions because the error in result was smaller than the the threshold needed to convert it to a fraction. There is no "smarts" (i.e. a CAS) involved.

<comment><USER14> It's very sad that enthusiasts running a wordpress blog to share their interests with the world now have to hire lawyers and tech experts to evaluate their sites and determine to what extent all their plugins are legally compliant or face comments assaulting them, and their comments responding stricken.

The result is that interesting and useful information being shared by amateurs is systematically being targeted and banned from the internet. Soon everything will be corporate views only thanks to these laws and their intolerant fundamentalist advocates, both which are intentionally destroying vast parts of human culture and knowledge. For this reason, these laws, and their advocates both, are extremely evil entities.

<comment><USER3> > For this reason, these laws, and their advocates both, are extremely evil > entities.

That's some nice alliteration you've got there, but I'm still of the opinion that you are responsible for what goes on your website. I run a blog just like the author does, but I unlike him I am not flippant about legislation designed to protect my readers' privacy. Since it's my website, I can ensure that I don't run cookies at all, which means I don't have to hire "lawyers and tech experts". And finally, I'm pretty sure the comment was automatically flagged due to its tone and the fact that the account was new.</comment></comment></comment>


Why Drugs That Work in Mice Don't Work in Humans - <AUTHOR> https://thelri.org/blog-and-news/why-drugs-that-work-in-mice-dont-work-in-humans/ <comment><USER2> _" Only 14% of drugs that are tested on humans succeed in demonstrating effectiveness[1], and all of these are drugs that have been found efficacious in animals, so successful animal studies are very far from a guarantee by themselves."_

Regardless of the reason, this seems fine/workable. Animal studies are a step in the funnel. I assume the step from petri dish to mouse is similar.

I wonder how many false _negatives_ get produced. Drugs which would have worked on humans, but don't on mice, for similar reasons.

<comment><USER3> 14% is bad when you consider that the NEXT step after preclinical experiments is basically clinical trials (and Phase I is not to test efficacy ) which effectively costs several hundred millions of dollars or more.

And the pharmas would just add the cost of 86% failed trials to the other meds that do pass, so they effectively pass the cost of their bad decisions to us.

I worked in a lab that studies antibody therapeutics for almost a decade and can go on a tirade of all the shitty decisions companies seem to make in candidate identification, but fundamentally I really believe that this number won't be this low if the people making the decisions in pharma companies know what they're doing but then the CEO of gsk used to sell lipsticks so who am I to talk right?

<comment><USER4> I've always assumed that the reason for the low rate of success at that stage was just a result of things that work on rats not working on humans. Your post is suggesting that there is some evidence available before testing on people that would help increase this rate but gets ignored. I haven't seen anyone express this view before and would like to learn more about it. Would you please elaborate on what kind of information isn't being used for decision making but should be?

<comment><USER5> I am not the parent, but I worked at a few biotech startups.

My impression is that you are _mostly_ correct (a lot of animal models for disease don't accurately reflect the analogous state in humans).

However, I was privy to a situation similar to that described by the person to whom you replied.

* A start-up that I worked at developed a "candidate drug" to treat a condition (I don't want to get too detailed).

* The drug was good at ameliorating the disease in our simple models, but we also had a strong suspicion that the drug would be toxic in humans, higher animals.

* A decision was made that we would determine if the drug was toxic in three different species of large animal (I think we chose some type of monkey, dogs and I don't remember).

* Our "go/no-go" decision was: If the drug was NON-toxic in at least 2 of the 3 animal species, we would move to clinical (human) trials.

* 6 months later, we got the results: drug was NON-toxic in 1 of the 3 species.

* This looks like "no-go", right?

* Wrong. Board of directors put pressure on the CEO and senior management ("We put 8 figures of our hard-earned $ into round B and you promised us clinical trials over a year ago.").

* CEO folded like an accordion and got everyone to agree that we should proceed w/ Phase I trials (small n of humans tested, primarily to determine toxicity and maximum tolerated dose) despite the results of the animal studies.

* Phase 1 trial starts. Everyone gets sick (maybe 10 patients) after about 5 days of taking the drug. Trial is halted.

* We go back to square 1.

CEO should have never folded under the pressure because it was a waste of money, time, and it put people at risk.

I've only seen this once (going to trial with a risky drug), so I think it is a rare event.

edit2: Ironically, this is an example of a situation where the animal-studies CORRECTLY predicted what would happen in humans.

<comment><USER6> Imagine a similar situation but where people died: Who's corporately responsible for that decision? The company, or the individual directors? How about the NEDs?

<comment><USER5> > Imagine a similar situation but where people died: Who's corporately > responsible for that decision?

No idea. Thankfully, all patients stopped the drug and the toxicity went away.

I remember having a company-wide meeting where they showed us a result from the Phase I trial. It was a graph of time on the x-axis and the concentration of an important molecule in each patient's bloodstream on the y-axis. Every patient had the concentration of that molecule drop to dangerously low levels after about 5 days on the drug, and I'm thinking, "Is this a surprise to anyone here?"

</comment></comment></comment></comment></comment></comment><comment><USER7> Model animals are used in researches mostly due to two reasons: cost, which is always a big hurdle for academic studies; and reproduction, especially for inbred mice. The use of inbred mice often is because the behavior and activity of the mice is well-characterized, high availability, and genetically more consistent. However, the second part nowadays is often challenged and they are not that consistently genetically as researches show. For drug development, the very first step is to create an animal model, however, this one also is difficult, since more often than not one cannot generate animal model replicates all symptoms, this could mean a model without the actual cause. I think this is also a reason why genetic studies of diseases nowadays is still a hot field, from there one can make an animal model and test whether that gene is the real cause in more confidence.

<comment><USER8> For those that are interested, the Animal Welfare Act of 1966 (an the many amendments to it) specifically spell out the animals that can be used for research and testing. There aren't that many of them, hence why rats and mice are so popular, as they are some of the few animals that can be used for testing. The AWA is structured such that all animals are covered by default, and only a few species are specifically excepted. It's an expansive law that also covers herding, meat processing, cosmetics, hunting, etc.

In general, the AWA is very restrictive in terms of animal testing for scientific research. Getting exceptions to use an animal for research is very intensive and highly regulated, taking years to get the approval. Getting approval for studies that may involve studying intentional pain, harm, etc to an animal can take up to a decade for approval, and with much study and research on other possible methods. Internal Review Boards (IRBs) are required to include local lay people, clergy, other non-scientists, etc in order to approve a study. Vivariums are also highly regulated and frequently inspected.

The US, at least nowadays, takes the welfare of animals extremely seriously with stiff fines and real consequences for breaches and lapses in protocol.

[https://www.aphis.usda.gov/animal_welfare/downloads/AC_BlueB...](https://www.aphis.usda.gov/animal_welfare/downloads/AC_BlueBook_AWA_FINAL_2017_508comp.pdf)

[https://en.wikipedia.org/wiki/Animal_Welfare_Act_of_1966](https://en.wikipedia.org/wiki/Animal_Welfare_Act_of_1966)

<comment><USER9> While I agree that animal research is well-regulated in the US, many of the details in your comment aren't quite right.

The Animal Welfare Act specifies the minimum standards of care for research and exhibition of _most_ species of mammals. Birds, rats, and mice aren't covered by the AWA, nor are "cold-blooded" animals. These are covered by other regulations from the Office of Laboratory Animal Welfare (OLAW; for federally- funded projects) or AAALAC (private funding). Farm animals are also not included, unless they are being exhibited or used for research.

The AWA requires research institutes to form an Institutional Animal Care and Use Committee (IACUCs), which includes scientists as well as clergy and members of the community. This is usually different from the Institutional Review Board (IRB), which regulates research involving human subjects. The idea is admittedly similar though.

The AWA does not limit the species involved in research. In theory, you could propose to set up a grizzly bear colony or something and the University of California has (had?) a hyena colony for a while. The IACUC is responsible for making sure that animals receive the care required by the AWA, OLAW, and other standards, so they might turn you down if suitable resources are not available or other, more humane approaches could be used (e.g., use a species that is less affected by captivity).

<comment><USER8> Thank you for the clarifications!

</comment></comment></comment></comment><comment><USER10> Except for maybe the last paragraph, this is not new information to basically anyone performing studies. The problem is we don't have any ethically and scientifically better alternatives.

<comment><USER11> There is an alternate. To wake up from the ignorant direction the so called studies are taking the human kind to. And stop calling it science. Dr. B.M. Hedge suggested long ago that all the studies done on animals or humans are wrong and inefficient in so many fronts. His words - According to ayurveda, human body can be classified into around 200 types based on the K/P/H balance of a body. A medicine that works for one may be totally neutral for another. So, you read a paper that claims it got awesome results on a random blindfold study, the question Dr. Hedge asks is what type of the 200 human body types is it efficient? Apparently there is a body type that gives neutral or negative results (ignoring side effects). Talk about working it on animals first! (-ve downvotes welcome)

<comment><USER12> Here's a nice smackdown which I don't have the time or knowledge to offer myself:

"He abandons [Dr. B.M. Hegde] all rational thinking and embraces fantastical belief systems. The sad thing is I personally know many people delaying cancer treatment being swayed by his speeches and ending up with incurable metastasis later."

[https://www.quora.com/Do-you-agree-with-the-controversial- vi...](https://www.quora.com/Do-you-agree-with-the-controversial-views-of-Dr- B-M-Hegde-when-it-comes-to-medicine-and-doctors)

<comment><USER11> Understood. May be the modern world needs another wim hof to become a subject to the existing science - validity though current limited existing medical tools to prove/validate that humans can get access to autonomous nervous system and heal themselves (which was thought to be impossible in modern days). The approach Dr. hedge took is not registering with the rest of the world according to the comments above. May be he should have proven his claims subjecting to the existing methods just to give that level of confidence who trusts it like wim hof did.

<comment><USER13> It's not about giving confidence to people, the existing methods are part of the fundamental idea of the scientific method. Dr. Hegde's claim of body types doesn't really mean anything until there's evidence to back it up. And modern medical trials are crafted and investigated with a wide variety of statistical tools to determine the exact impact of a treatment method. Only if his claims can stand up to this rigorous scrutiny can they be accepted the way existing models are. The rest of the world will then sit up and take notice, exactly because only then will there be something for them to take notice of.

An appeal to the ancient wisdom of Ayurveda doesn't really stand on it's own until it's backed by solid peer reviewed science. It's really not that hard, a well designed set of trials proving your point will have the entire world at your feet. Modern science is extremely receptive of new ideas that way.

<comment><USER11> Agree. Unfortunately, this is never going to happen. The few still practicing Ayurveda properly come from a background where they learned it from their ancestors within their family and practicing it for free and never allow commercialization of their knowledge. But they can gladly share the knowledge to people who want to learn. Food, Education and Medicine/health are the 3 things the practitioners in Indian culture believes to keep free. A few decades ago, you want to gain education, you seek a guru and become a disciple and he teaches for free. You got a health issue, you go to a doctor and he treats you for free. Same with food, every town/village used to have centers where food is served free to anyone. Although it's all gone decades ago, there are still practitioners who treat patients for free and only take donations and not fee. Sounds, funny but It's easy to understand the underlying wisdom, how many studies today are funded by people with commercial interests? Research on egg is funded by Meat industry, Research on milk is funded by Diary industry etc. How is that turning out for everyone?

<comment><USER14> In fact, most studies are funded either by governments or via donations from the public. _Some_ public studies are _partially_ funded by industry, but with a big caveat: industry has _no say_ on how the studies are conducted, or even what is being studied: industry contributions to public research are not bound to research outcomes. And all this information is readily available, since publicly funded research institutes publish their funding sources.

It's true that industry is funding _some_ (publicly published) research directly, and that _some_ research publications fail to disclose their funding source and other conflicts of interest. But for the vast majority of biomedical research, especially fundamental research, this simply isn't the case.

And it requires a complete suspension of one's critical thinking capacities to imagine that some vast, weird conspiracy encompasses all of public research, to suppress the "truth" that Ayurveda works, contradicting everything we know from modern medicine as well as basic physics and chemistry. And all that just to make a few pharmaceutical company bosses rich? Why would I, lowly researcher on a sub-par salary, contribute to such a conspiracy? It's completely irrational.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> What about drugs that work in humans, but not in mice? Could you ever get them into trials without animal data?

<comment><USER16> This is more worrying, how many medications did we miss because they don't work in mice ? Do we humans only get medications that work in both humans and at least one other species ?

<comment><USER17> The same number we missed because, as it turns out, killing people with unknown medications is a bad thing.

</comment></comment></comment><comment><USER18> My go-to example is Vitamin C: it's an essential nutrient for humans, but mice, like most other animals, are capable of simply producing it. That's usually a good starting point for the "they're really different" conversation.

<comment><USER19> For the curious: [https://en.wikipedia.org/wiki/L-gulonolactone_oxidase#Conseq...](https://en.wikipedia.org/wiki/L-gulonolactone_oxidase#Consequences_of_loss)

I couldn't really make sense of the two proposed theories, other than one suggested perhaps it was an advantageous adaption in the presence of malaria.

</comment></comment><comment><USER20> I wonder if it's possible to use machine learning to speed up this process. Rather than doing computational biology, can we use a hybrid system? For instance, can we test this on mice and then feed some sort of parameter into a model to see the probability it working on humans rather than testing it directly on humans. I'm sure this won't be a perfect model but I wonder if it can raise the 14% to 20% while using less resources.

<comment><USER21> ML (or anything really) that could predict which molecules would work in humans without testing them in humans would probably be on of the most important advances in medicine ever, and would massively lower drug costs and open up new areas for drug research

Phase 2 failure -- ie stuff failing in humans after working in mice -- is the biggest cost driver in drug dev. You spend $50-100M+ to get there and 35% of things fail. If you could eliminate you'd cut a massive chunk of the cost and risk of drug dev

However I don't think ML is the thing to study if you want to create ML to predict whether drugs will work in people. There is not enough data about how the human body works to develop a good model. Better to work in biology to develop good models of disease, or in developing tools to better measure the molecular biology of the living human body. It's unclear if predicting drug effectiveness with ML will be possible in our generation

For more near term applications of ML in drug discovery and development see here: [https://www.getrevue.co/profile/nathanbenaich/issues/6-impac...](https://www.getrevue.co/profile/nathanbenaich/issues/6-impactful- applications-of-ai-to-the-life-sciences-new-essay-150757)

</comment></comment><comment><USER22> I'm not arguing for pigs over mice but I ask since transgenic pigs are often said to be future potentially viable transplant sources would not trials in pigs be a better model?

(Ethical nightmares)

<comment><USER23> We are closer related to rodents than to pigs. Whether this is an argument for one thing or for another or for nothing at all, I really have no idea.

<comment><USER14> This isn't quite true. The issue is that rodents evolve a lot quicker due to effective population size and generation time. As a consequence, the genetic divergence between rodents and humans is in fact greater than that between humans and pigs (see e.g. [https://europepmc.org/abstract/pmc/pmc1142312](https://europepmc.org/abstract/pmc/pmc1142312)), even though pigs branched off earlier than rodents.

<comment><USER23> Had a vague that something like that might be in play. I obviously have some reading up to do. My assumption was, that our branch would, until quite recently, have been rapid breeders too. And the pigs' one as well.

</comment></comment></comment></comment><comment><USER24> How many of these drugs actually do work in mice? Every study that comes out on the topic shows at least 50% and often closer to 90% of preclinical research does not replicate or even is not replicable in principle.

<comment><USER25> Research and drug development are pretty different leagues. A research paper might be 3 researchers with 20 mice. When your looking at preclinical trials it's more like 300 people and 5000 mice per trial and god knows how many trials before something goes through.

The reproducibility crisis is happening in academia. There isn't that much room for uncertainty when it comes to industrial drug development. You won't find drugs making it all the way to market only for "another group" to be incapable of reproducing the effect.

<comment><USER24> > "When your looking at preclinical trials it's more like 300 people and 5000 > mice per trial and god knows how many trials before something goes through."

This is sampling to a foregone conclusion. It is guaranteed to yield unreproducible effects.

> "You won't find drugs making it all the way to market only for "another > group" to be incapable of reproducing the effect."

I doubt this from the description above.

</comment></comment></comment><comment><USER26> While mice are not humans (who would have known), we could do a lot better by moving away from using inbred mice.

More positively we could make a lot more use of domestic pets in research. If we started to treat more pets as research subjects we could really do a lot of great research.

<comment><USER27> Good luck getting people to allow their pets being used for research!

<comment><USER26> People are really keen to allow their pets to be used in research as long as they understand the importance. Pets are a massive resource that is just being wasted.

<comment><USER28> My cats are certainly not being wasted. Who else would step across my keyboard when I'm typing?

<comment><USER26> You should consider yourself lucky to be able to use your cat's keyboard while she is taking her afternoon stroll.

</comment></comment></comment></comment></comment><comment><USER29> This all makes sense! I've heard there is a similar effect for single cell research, where a lot of the study of human cells says that they are full of support structures and making all kinds of chemical signals that actually are a stress response to being placed on a piece of glass rather than floating in liquid. Kudos to these researchers for making an honest attempt to get it right.

</comment><comment><USER30> I wonder if a similar proportion of drugs that work in Humans wouldn't work in mice. Are we missing out on a ton of potential?

</comment><comment><USER31> I'm not sure how common the practice is, but I've been told (by a trusted source) that if a med study doesn't get the desired results they just get a new set of mice and try again.

That is, results can vary based on the mice used for reasons not understood (but gut bacteria perhaps).

<comment><USER32> I work in pre-clinical pharma research, and this isn't really true in my experience, but there are a couple caveats. At least in my experience, we wouldn't run the same study again, but we might change the model. There are a few models that all point to a similar indication, so we might try both. If a treatment works in one but not the other, it's definitely seen as less strong evidence of efficacy, unless there's some very compelling mechanistic reason. That's not quite as crazy as it sounds, though, because translation from mouse to human is already poorly understood, so it can be hard to know which model will suggest positive effects in clinical trials.

<comment><USER33> I'm interested in how compounds are chosen for medical research. Do you just start with a wide range of compounds which you are able to make and fire them at a range of different potential medical issues? That seems staggeringly unlikely to find something useful.

I know some drugs are extracted by isolating a compound from a traditional remedy. That obviously makes sense.

<comment><USER34> This is a huge field of research and development, with a number of different approaches.

Almost always, though, you are starting with a particular medical problem in mind, so the first step is to develop some kind of assay for detecting compounds which might be useful in treating it. Ideally, this would be a simple biochemical reaction, but it might be something involving cell culture.

For example, if you wanted to find new painkillers, you might look for chemicals inhibiting cyclooxygenase (as ibuprofen does). You can buy kits for doing that assay commercially [1], where you prepare a solution of the enzyme, add your test chemical, then add a substrate which emits light when the cyclooxygenase breaks it down, and measure the intensity of light produced.

If you wanted to find new anti-cancer drugs, you might look for drugs which cause proliferating cells to get stuck in the metaphase step of the cell cycle (as paclitaxel does). You would plate out some rapidly proliferating cells, add your test chemical, wait twelve hours, then fix them, stain them with a DNA-specific dye, and use a microscope to count the number of cells in metaphase (which is quite distinctive [2]). This is a lot more tedious than the cyclooxygenase assay, but we have robots that can handle liquids and plates of cells, and operate microscopes, and process images, so it can be highly automated, at a cost.

Then you take your assay and go hunting for molecules.

One approach is indeed just to start with a wide range of compounds. You can get libraries of small molecules [3] [4], so you give them to your robots (or graduate students), and put them all through your assay to find which ones work.

You can also start with mixtures of compounds, perhaps obtained from natural sources. For example, you could go and collect twenty species of fungus or sea sponge, grind them up, and put the extracts of each through your assay. If anything works, you then fractionate the extract somehow (eg by chromatography), and put each fraction through your assay. You pick fractions which work, fractionate them further, assay the sub-fractions, and repeat until you have got a pure substance with some activity, which you then characterise. Here, you can knowledge of ecology and biology to pick likely species - for instance, fungi are a good source of antibiotics, because they have to make antibiotics to defend themselves in their natural habitat.

Or you could start with some knowledge of the structure and function of the target (from X-ray crystallography, NMR, and good old fashioned biochemistry), and try to rationally design a molecule which will bind to and inhibit it. Computer simulations are useful here. Combinatorial methods let you design hundreds of molecules which might work, and then put them all through the assay.

Or you could hope that an antibody will do the job, and inject your target protein into some mice, wait for them to make an immune reaction to it, then collect their blood, extract B-lymphocytes, culture them in bulk, purify antibodies from the culture, then assay the antibodies. If something works, split the lymphocytes into single-cell clones, and assay each clone's antibodies one by one.

I don't work in this field, so my knowledge of these techniques is from undergraduate study, and one relative who grinds up sponges. It's possible some of the approaches i mention are obsolete, or were only ever speculative.

[1] [https://www.abcam.com/cyclooxygenase-cox-activity-assay- kit-...](https://www.abcam.com/cyclooxygenase-cox-activity-assay-kit- luminometric-ab139432.html)

[2] [https://www.le.ac.uk/bl/phh4/roottip.htm](https://www.le.ac.uk/bl/phh4/roottip.htm)

[3] [https://www.tdi.ox.ac.uk/small-compound- libraries](https://www.tdi.ox.ac.uk/small-compound-libraries)

[4] [https://wiki.nci.nih.gov/display/NCIDTPdata/Compound+Sets](https://wiki.nci.nih.gov/display/NCIDTPdata/Compound+Sets)

<comment><USER33> Thanks, that was exactly the answer I was looking for but couldn't quite figure out how to formulate the question so that Google would provide a useful answer!

</comment></comment></comment></comment></comment><comment><USER35> Any mice trial should use 4 different breeds: one of the academic hallmark (black6 or balb/c) for publication purpose, one that represent your model (or so you think) because that's the logical thing to do, and a truly wild type one (captured in the wild) to capture the noise.

Even this bias longevity piece needs to do that. This 4 breeds will all have different immune system, cognitive behavior and lifestyles, which are all central to aging.

<comment><USER14> The issue with that approach is that you'd multiply the number of sacrificed animals by 3 (or 4, did you forget a breed?), for limited gains in insight. Your approach would be a lot more defensible if it didn't involve killing vastly more animals, and a fairly large increase in research cost. These things are always a balance, and there's no evidence that always using your approach would be worth it.

<comment><USER36> I agree "any mice trial" is too strong a statement, and also 4 groups is kind of infeasible. But I do think there is not enough research on how these particular inbred mouse strains might bias research. Even the same strain sourced from different companies have produced different results, due to microbiome differences [1]. It's possible that we are way "overfitting" to these particular academic mice

[1] [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5870873/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5870873/)

</comment></comment></comment><comment><USER37> Human !== Mice

We can even argue that Human !== Human due to a million variables that differentiates them at microcellular level.

</comment><comment><USER38> Is the converse true? Are there drugs that would only work in humans but not any animal models?

</comment><comment><USER39> Short answer: Humans are not mice

</comment><comment><USER40> Fascinating and very timely for me. I was privileged to sit through a talk by the head of cancer immunotherapy at our institution where he was explaining the past, present and future journey of cancer immunotherapy research and this exact topic of mouse model applicability to human subjects came up. His TLDR on this was that differences are likely due to - 1\. Controlled lines of mice bred specifically to minimize confounding during pre-clinical studies 2\. Immune response activation pathways differing from "in the wild" situations for actual subjects 3\. The immense diversity of gut microbiota, their temporal and inherited gene signatures and impacts on drug metabolism which are incredibly hard to control for in experiments

Very nice to see an approachable post out there outlining a lot of these issues.

</comment><comment><USER41> Because mice aren't humans.

</comment><comment><USER42> Because we are not mice.

<comment><USER43> Actually; we're 75% mice, genetically speaking.</comment></comment>


Overstock's Radical Plan to Reinvent the Stock Market With Bitcoin - <AUTHOR> http://www.wired.com/2014/07/overstock-and-cryptocurrency/

<comment><USER2> Counterparty is the best tool to facilitate this process.</comment>


Foursquare, Facebook, Founders, and Passion - <AUTHOR> http://blog.jayteebee.org/2011/03/foursquare-facebook-founders-and.html

<comment><USER2> A mistake that first time entrepreneurs often make is to try and identify their startup by researching gaps in various hot markets, or they try to identify something that sucks and improve it. These are both good starting points on their own, however there needs to be an additional qualifier: Is the founder passionate about the problem and the larger market area they're entering in? Are they excited to work within this market for the next 5+ years and are they naturally going to spend all their free time thinking about the problem?

I know that I've made the mistake multiple times before of stumbling upon a good idea, getting started on it, only to have it turn into more of a side project than a business. Passion around the market and problem area is something that I wouldn't participate in a business without going forward.

<comment><USER3> Market interest fades, passion never dies.

</comment></comment><comment><USER4> Great post. However, I have a question to ask - say, you're passionate about painting. Given the number of people in this world who can actually paint well are so few, your odds of succeeding are pretty good. But what if you're passionate about say, blogging? Given that everyone in this world and his mom has a blog today, what are your chances of even getting noticed? Could that be a reason why some people don't care about what they are passionate about and instead choose to pick "hot ideas" or "unsolved problems"?

<comment><USER5> Well some people are passionate about starting companies and leading people. So they sometimes dont care about the exact area. And in those cases they want an idea which can lead to hiring a team either by bootstrapping or through angel investment - a lot of timees this requires a "hot" idea...

</comment></comment><comment><USER6> I think another good example of this is pg with YC. I don't know of anyone else who has thought as much about starting companies and has such a passion for it.

<comment><USER7> On the other hand, how passionate was pg about viaweb?</comment></comment>


Patent troll asks judge for gag order to silence opponent - <AUTHOR> http://arstechnica.com/tech-policy/2013/10/patent-troll-asks-judge-for-gag-order-to-shut-up-findthebest/

<comment><USER2> I get the impression that one of the biggest threats to a patent troll is publicity.</comment>


Bitcoin should not be seen as a currency, warns Ernst & Young - <AUTHOR> http://www.theguardian.com/technology/2013/dec/11/ernst-young-warn-bitcoin-payment-problems?CMP=twt_gu

<comment><USER2> i like hearing a large accounting firm say this. i feel a lot of the troubles bitcoin has had is due to having the term 'coin' in its name, which implies it is a currency.</comment>


Paul Irish: Things To Do When IE9 Beta Comes Out - <AUTHOR> http://gist.github.com/576335

<comment><USER2> Immediately go about my business as usual and not download it.</comment>


The iPhone App Economy - <AUTHOR> http://www.guardian.co.uk/technology/2009/jul/29/iphone-apps <comment><USER2> didn't someone on HN create a similar app for NYC?</comment>


Tesla bricked battery story may have a short circuit - <AUTHOR> http://www.autoblog.com/2012/02/23/tesla-bricked-battery-story-may-have-a-short-circuit/

<comment><USER2> Why did this article start with a political attack? Are we seriously reduced to not being able to discuss a engineering problem without invoking politics?</comment>


[pysqlite] Connection deadlock because of file lock - <AUTHOR> http://itsystementwicklung.de/pipermail/list-pysqlite/2009-April/000380.html

<comment><USER2> This behavior also caught me at the C API. I was expecting sqlite to block on contention and continue when available but it just gives up. I resorted to wrapping my sqlite use in a rwlock of my own, but that is a less than general solution.

<comment><USER3> sqlite also provides sqlite3_busy_timeout() and sqlite3_busy_handler() to customize its contention handling behavior.

<http://www.sqlite.org/c3ref/busy_timeout.html> <http://www.sqlite.org/c3ref/busy_handler.html></comment></comment>


Hacker News + Reddit + Digg = Sumews (All 3's top 20 links on one page) - <AUTHOR> http://sumews.com/ Just for fun I made something simple and clean to show the top 20 links from Hacker News, Reddit, and Digg. Thinking about adding a login feature that will allow you to save your favorites.<p>The name is a made up word combining Sum and News. I dunno, I suck with names... <comment><USER2> Why not combine them into a single list?

All three sites use point systems; HN and Digg's range are almost identical, just need to equalize them to Reddit's.

<comment><AUTHOR> This could be cool, but I'm wondering how many people would want them separate vs. together?

</comment></comment><comment><USER3> Reddit appears at the bottom, below HN and Digg, when I've got it maximized at 1024x768. That's going to get obnoxious fast.

<comment><AUTHOR> I think I've taken care of this by making the sections fixed widths. Thanks again for the feedback.</comment></comment>