They're specifically not using the term "virus" pejoratively, but rather distinguishing the social mechanism LLMs seem to have from something as simple as a "meme".
I'm actually not too sure about that, I guess if you dig into it, language is a "meme" on some level. And every language you are "thinking" in tends to frame the world a little differently.
All memes are viruses but not all viruses are memes?
> “About 60% of the calories in Americans’ diets are from ultra-processed foods,” says Schmidt, who spoke at a UC Berkeley event in May. “In the mid-’80s, when we see ultra-processed foods starting to scale up in the American food supply, we also see obesity starting to really rise. That is the moment when some of the largest food companies are owned by tobacco companies.”
A reminder here that while there's an important directional claim behind stuff like this, "ultra-processed food" is an extremely silly category that does violence to the argument.
UPFs include:
* Whole wheat bread (most supermarket bread is stabilized, which you might not like aesthetically, but it isn't doing anything to your health)
* Almost all yogurt products, flavored or otherwise
* Literally all baby formula
* Any kind of plant-based meat replacement
* Many supermarket hummus brands (again: stabilizers and emulsifiers)
You get to "ultra-processed" simply by making things shelf-stable, and shelf-stability isn't an actual health problem (kind of the opposite).
You get to problematic through hyperpalatability, which is another, different target of modern food engineering. Hyperpalatable foods are almost always UPFs, but the other direction doesn't hold at all.
> most supermarket bread is stabilized, which you might not like aesthetically, but it isn't doing anything to your health
That's a large assertion to make without evidence. Personally, I'm suspicious of all antimicrobial agents' effects on gut microbiota and the knock-on effects on health.
I mean, he's not presenting the evidence here in a hacker news comment, but that doesn't mean the evidence doesn't exist. There are a bunch of different categories of stabilizers, and only some of them have antimicrobial properties -- most are about maintaining moisture and loaf volume over time.
There are three substances that are predominantly used to inhibit mold growth, though: calcium propionate, potassium sorbate, and sodium benzoate.
The first two are extremely well understood and considered safe globally. The third is still considered safe, but might have some interactions with vitamin C that lead to benzene formation to the tune of several parts per billion. The FDA considers this safe, and has for some time.
You said dislike. I said suspicious. One's an opinion, the other an invitation for science.
> vinegar, salt, and any fermented foods that suppress microbial agents?
In the gut microbiota broad system sequencing experiments I've consumed reports from, even altering diet from one primary food source to another can result in complete restructuring of the gut ecosystem as quickly as within 24 hours. And switching back to the original food source didn't return to an identical gut ecosystem. Many studies show direct connections between gut microbiota and specific and broad health impacts.
So I think suspicious is right. There is much yet to be learned.
"Ultra-Processed Food" is a phrase. It is not a thing. If you want to use it for its media traction, and "nobody knows what it is," define it before you use it.
Instead, everybody has gone for "it is so mysterious," then goes on to cite a bunch of studies about "ultra-processed foods," treating it as a category that categorical statements can be made about.
Name the chemicals, name the processes. They don't because these chemicals and processes are endorsed by massive conglomerates who can pull advertising and lobbying money. When you're vague as hell about everything, it's a case-by-case basis that only affects people who can't bribe as well as others.
And about the people talking about sugars, salt and fats crammed into everything, I'm convinced they never cook. That's taste, and you can pour it in yourself just as well as a corporation. The reason people love it is because it tastes good. Salt isn't even bad for you, it's in fact very, very good for you because it makes micronutrient-rich foods palatable.
Arguing that standard manufactured foods and foods marketed to children are too rich is a different argument, and most importantly for this conversation has nothing to do with the ultraprocessed foods question. Massive food companies are perfectly happy to remove all the fats and sugars from your food and replace them with some weird alcohol sugar or a new form of teflon they just invented a week ago, and to charge you a premium for the privilege of eating it. They literally did that throughout the 80s and 90s.
The narrative intentionally confusing what the above refers to as "hyperpalatability" (a term which is as good as any) with "ultra-processed" (a propaganda term) is a gift to the food industry. It in fact even favors monopolies who can afford to put in the bizarre chemical constructions they'll use as alternatives, and to pay regulators to look the other way.
"Ultra-processed foods" is a phrase meant for advertising - even the prefix "ultra-" reminds me of a cigarette ad, describing the filter. The filter was a device which ostensibly makes cigarettes healthier, but instead allows you to smoke far more than you would otherwise, and leads to worse health outcomes. Isn't smoking bad? Smoke our ultra-filtered cigarettes and breathe easy!
The featured article/podcast has the person presenting define "ultra-processed foods" as industrial hyper-palatable foods.
However, it focuses more about how the foods were marketed, and in particular, that the same marketing playbook developed by tobacco companies to market Marlboro and Camel cigarettes was then used to sell Kool-Aid and Miller beer.
Basically, the execs at Phillip Morris and R. J. Reynolds realized that beer, Kool-Aid/sugar drinks, Oreos and cigarettes were more or less all the same type of products - affordable, habit-forming small luxury goods people enjoyed putting in their mouths, and applied the expertise they'd developed on one type of this market (cigarettes) to the rest of it.
Thanks for articulating this. I've had a problem over the past 20 years with terms like "screen time" and "ultra-processed foods" because there's a kernel of something that really matters somewhere in the argument, but the use of overly broad terms sort of kills things. I appreciate you calling out the nuance, and I agree with you that hyperpalatability is the main issue -- like applying the principles of TikTok to food.
Hyperpalatability is a different issue. The main issue is that our foods are chemical factories. Turning it into a "food is too good" problem is just a trick to blame the consumer for not being mature enough to forgo pleasure.
Food being good is not a crisis. Xylitol giving people heart attacks might be. Ingredients concocted in a lab never being studied at all until someone sues is a problem. Shifting the argument to "cheeseburgers are bad because they're good" is a really obvious distraction.
There is literally no profit in making foods "hyperpalatable." Food companies would be just as happy selling you food that tastes like shit. If anything, in actuality commercial food has become worse and less palatable over time due to substitutions of cheaper ingredients. The argument is being shifted from an important one about power to a dumb moral panic. The people who love this are orthorexics who love telling people how their health is their own fault because they are self-indulgent. There is nothing more self-indulgent and self-praising than this discourse.
This is like the Mexican coke argument all over again. Everybody wants there to be an industrial bogeyman to blame for American nutritional health problems. Wouldn't it be awesome if we could fix problems for people simply by replacing industrial corn syrup with wholesome cane sugar?
Of course, there is literally no difference healthwise between the two products. But that's hard to hear. It means you have to accept that sweetened soft drinks are just bad for you, full stop, and you have to treat them the same way you'd treat alcohol (I said, as an enthusiastic social drinker).
So it goes with UPFs writ large. Wouldn't it be great if we could just make our foods wholesome and pure and not "chemical factories"? In fact: it would make essentially no difference to our health; in fact it would be a health problem if it led people to believe that bakery outputs were healthful and stabilized unsweetened skyr was dangerous.
The entire problem here is that we've gotten incredibly good at engineering food for hyperpalatability, which leads people to make truly bad choices about what to eat habitually. You could reasonably regulate that practice! But you'd want to find a way to do it without doing Mercola science and taking healthful, affordable shelf-stable products off the shelves for no reason.
Your "no profit in hyperpalatable foods" thing, I don't get at all. Maybe if you tried to explain it again. Sounds like the opposite of the truth.
Shelf-stable hummus and Doritos can both be "ultra-processed", but that doesn't tell you much about why one might encourage overconsumption. Hyperpalatability seems much closer to the actual claim the article is trying to make.
I think it literally is the claim the article is trying to make, but "UPF" is the on-trend term, despite the fact that most UPFs aren't engineered for hyperpalatability. It's a problem!
Nobody seems to have noticed the "product" next to "yogurt":
>> * Almost all yogurt products, flavored or otherwise
If we weren't on HN I'd say that's a subtle engagement hack calculated to generate maximum confusion and irate debate in the comments below. But we're on HN and good faith etc.
So, yes, "yogurt products" are all going to be ultra-processed not least because they will have to destroy the gel matrix of yogurt to incorporate whatever other ingredients they must like fruit juice or sugar, stabilisers, emulsifiers etc. Actually I guess they must include the stabilisers and emulsifiers because they mix in flavours and therefore destroy the yogurt gel matrix, which would otherwise result in an unpleasant gloopy mess.
Speaking of course in all this from the privilege of a summer in Greece where I've start every morning since June with a tub of 150g of fresh (not strained) goat's milk yogurt with the skin on and with a (European) teaspoonfull of honey.
Not healthy, you understand. Not with all the saturated fats and sugars. But, boy, is it palatable.
That's the point. The ultra-processing of shelf-stable unsweetened yogurt food products has nothing to do with engineering it for palatability. And yet they're UPFs, and you could easily ship a highly sweetened dessert yogurt product that would be far less healthy without tripping a UPF standard.
It sort of illustrates the uselessness of the terms. Yogurt is made by sterilizing (likely homogenized) milk and introducing microorganisms that carry out some desired chemical reactions. They produce lactic acid, which is a stabilizer.
Everyone apparently knows that those are good things, so they don't count.
No. And the way you're wrong about this is important. Any plain whole milk yogurt thickened or stabilized with starches or pectin is a UPF; Kroger's Plain Whole Milk, for instance, is a UPF and it isn't sweetened.
(For what it's worth, I really dislike yogurt and would not in 1000 years consume a sweetened yogurt product, though I do work skyr into every other meal these days for protein-maxxing reasons).
Yeah, this is totally true. A Greek yogurt is considered minimally processed, not ultra processed. The problem is, far and away, the majority of yogurt sold is fruit-flavored yogurt, which is considered ultra-processed. Icelandic yogurt and Greek yogurt are premium niche yogurts.
I guess all I'm saying is that for the majority of people eating yogurt, it's an ultra-processed food.
With the exception, maybe, of whole wheat bread (it seems they sometimes add extra wheat gluten, technically an additive but yes, silly), these all seem right to me? Especially meat replacements, they're often incredibly highly processed.
Yoghurt is one you seem to be mistaken on. Yoghurt can be considered group 1, it just often contains thickeners, sweeteners, flavourings, etc. Especially if low-fat.
You're right of course that hyperpalatability is a bigger problem. And you don't have to agree that UPFs are something you need to avoid. But I don't think that makes it a silly category.
It’s a silly category to relate to health because, for example, meat replacements are UPF but are also typically much healthier than meat. Obviously that’s not always true, but most of the time it is. Basically all Americans can benefit from eating less meat, especially red meat.
Ultra-processing is not just used to make more calorie-dense palatable food. It’s also used to make less calorie-dense food and enrich food with vitamins and macros you need for healthy living, like fiber.
I mean, compare the ultra-processed high fiber tortillas to the natural tortillas. The high fiber ones have less calories, less carbs, are more satiating, and are overall healthier. They also taste worse, I.e. are less palatable.
Ultra-processing and palatability are really orthogonal IMO. You can use processing to make palatable food, but you don’t have to. Look at traditional fast food - burgers, fries, fried chicken. You can trivially make any of that with no processing. It’s still unhealthy and ultra palatable. Cutting up a chicken at home and deep-frying it doesn’t magically make it healthy.
Or go one step further, and look at the frying itself. We have access to processed refined oils. But if you don’t use them and go the old fashioned way, with lard frying, is it healthier or less palatable?
No, actually, it’s tastier and much less healthy. You get 10x the saturated fat and way more calories.
And I’ll get ahead of the anti-science anti-seed-oil people who just read that. We know, for a fact, that eating more saturated fat increases your risk of heart disease and cancer. Just because something is naturally or minimally processed does not make it healthy, health is much more complex than that.
> You get to problematic through hyperpalatability, which is another, different target of modern food engineering
I don't think even that is problematic by itself. You need to apply hyper palatable techniques to high calorie nutrient poor food for it to be a problem.
Getting people addicted to something that's mostly protein or fiber or water packed with important micro nutrients would not be a bad thing at all. That's not what the food companies are doing (because empty calories are cheaper) but it's a perfectly good strategy we need more of.
every once in a while i wonder why miracle berries can't be leveraged at scale to make ultranutritious food taste great. but it always feels like a thought with an obvious answer i am too stupid to deduce.
> You get to "ultra-processed" simply by making things shelf-stable, and shelf-stability isn't an actual health problem (kind of the opposite).
I would point out that many whole foods are generally shelf-stable (over at least weeks, if not months) without requiring the introduction of chemical stabilizers that don't otherwise "belong."
Chemical stabilizers are generally needed for shelf stability in ultra-processed foods, because of one of the other defining characteristics of ultra-processed foods: their matrix has been disrupted (or constructed anew) such that the food is now highly labile (biochemical term: "labile organic matter"), i.e. very easy to break down into nutrients. Which applies not only to you breaking such foods down in your gut, but also to bacteria and fungi breaking these foods down on the shelf.
And as it so happens, because these foods are labile, any such nutrients that do come from breaking down the food, come very quickly. Labile carbohydrates are high-glycemic-index insulin-spiking carbohydrates. Labile fats are atherosclerosis-inducing fats. Etc.
Your body evolved to process (metabolize, remove from circulation, etc.) metabolic inputs in an environment where most available foods were the opposite of labile (a.k.a. recalcitrant organic matter). So most meals would give a slow/gentle level of metabolic throughput; with rare spikes of higher throughput from the rare natural labile food, and then plenty of low-throughput time to recover from such events. Your body didn't evolve to be able to deal with getting high-throughput metabolic input spikes from every meal.
And this is why the the presence of chemical stabilizers in a food is actually a very helpful criterion in the definition of "ultra-processed food"! The necessity of stabilization tells you that the food is likely labile (as otherwise, why would they have needed to stabilize it?) — and therefore is unhealthy to be consumed on a continuous basis. (Unless it's milk and you're a baby.)
But note that the stabilizer isn't itself the problem. Bread is ultra-processed even without a stabilizer, because bread is a labile food with weak matrix integrity. The bread you bake at home is ultra-processed; you're the one who ultra-processed it!
The "rules" for UPFs don't assert home-baked bread as a UPF, but that's because the point of the UPF designation is to label commercial foods, and more specifically, to draw a hard-line boundary based on objectively-measurable characteristics that industry players can't argue with or lie about. And lability / matrix integrity, while quantifiable, isn't something with a clear objective way to reduce it to a single number†; so any definition of UPF based on lability would result in endless arguments/pushback from industry players insisting the FDA is "calculating it wrong."
But in your own personal life, the definition of "ultra-processed" you should be carrying around in your head and evaluating foods by, should be one that includes lability.
† (Instead, lability is a high-dimensional measurement of how efficiently any single digestive enzyme, and/or any specific combination of enzymes, and/or any enzyme paired with a cofactor [e.g. a bile salt], will break apart the given food's matrix to release bio-accessible nutrients.)
> The necessity of stabilization tells you that the food is likely labile (as otherwise, why would they have needed to stabilize it?) — and therefore is unhealthy to be consumed on a continuous basis. (Unless it's milk and you're a baby.)
You're completely lost me here. You're asserting that because food goes bad, it shouldn't be consumed on a regular basis. That just doesn't track, even a little bit.
Maybe your assertion hinges on the definition of "continuous basis"? I don't know what that means, but, taking it face value, it sounds like nothing should be consumed on a continuous basis other than air.
> The bread you bake at home is ultra-processed; you're the one who ultra-processed it!
This doesn't track either. The common Nova classification for ultra processing leans heavily on the kinds of processes that happen in factories. It's the flour itself that makes bread ultra-processed, since the flour is ultra-processed. When I realized that the four-ingredient bread I make at home for my family is considered ultra-processed, I started paying a lot less attention to the entire discussion.
> The common Nova classification for ultra processing leans heavily on the kinds of processes that happen in factories. [...] I started paying a lot less attention to the entire discussion.
Yes, and that's my point: the Nova UPF label is silly, but you shouldn't let a bad definition get in the way of a good conceptual tool.
"Ultra-processed as any lay person would intuitively understand the concept from the name and a series of examples", and "Ultra-Processed Food as defined by the Nova classification", are two distinct — but not conflicting — concepts. Even if you don't care about the UPF label as Nova defines it, you should still care about whether or not things are "lower-case-u ultra-processed." The Nova definition might be silly, but the concept itself isn't.
If you prefer, I could use a different term, like "highly-processed" or "hyper-processed" here, to distinguish what I'm talking about from the Nova label. But personally, I think it makes sense to actually continue to use the term "ultra-processed", and to just think of Nova as defining the term in a way that overlaps with a useful definition, but which both includes and excludes things that a more-useful and intuitive definition of the term wouldn't. After all, all of Nova's other definitions on the same "spectrum" (unprocessed/minimally-processed, processed ingredients, and processed foods) are perfectly good and useful ones. It makes sense to take that series-of-terms and then extrapolate what moving further in the same direction would take you. And where it lands you is a place that is close to, but not equivalent to, Nova's definition of UPF. Which is the place I'm calling "lower-case-u ultra-processed."
I think it's worth thinking this way, rather than ignoring the Nova classifications altogether, because 1. you still get useful information from knowing that a food is in one of the other Nova categories; and 2. a food being a Nova-labelled UPF still tells you something; and that something may, in combination with what else you know about the food, be enough to tell you that the food is in fact a "lower-case-u ultra-processed" food.
> You're asserting that because food goes bad, it shouldn't be consumed on a regular basis. That just doesn't track, even a little bit.
Because food goes bad quickly, yes. (Or more narrowly, "goes bad quickly for the kind of food it is." But I do think it generalizes across foods, if you're careful about how you compare your apples to your oranges. ;)
Also, it's not a direct correlation. Lability (or its inverse, recalcitrance) is the denominator; but nutrient "load" is the numerator. A thing can be highly nutritively bio-accessible and be fine, if it's not nutrient-dense in the first place. Cucumber is liable but nutrient-sparse, so its high bio-accessibility does nothing to you.
But given two foods with the same density of a given nutrient, the easier your gut and/or bacteria breaks them down (and/or the more they've already been broken down), the more you should avoid them / more rarely you should consume them.
This is the generalization of the logic of "eat oranges, not orange juice", but taken past the trivial point of "because orange juice contains far more oranges than you'd normally eat" to the more interesting point of "even if you drank only the amount of orange juice that was in one orange, it'd still be worse for you than eating one orange, because no amount of chewing is going to break the orange down as thoroughly as a blender or juicer will, and so no orange will ever be digested and absorbed as quickly as orange juice will."
I would note that while many foods go bad (and this can give you a weak intuition about lability), ultra-processed foods would go bad really quickly if not for the chemical stabilizers in them, because all the processing has made them more labile than any whole food has ever naturally been. The ultra-processed versions of these foods would, if not for their stabilizers, go bad far more quickly than the "regular amount of processed" equivalents would.
If you could make Wonderbread with all the same steps the factories do, but just skip the part where they mix in stabilizers, the resulting product would never even make it from the factory to store shelves before going bad; let alone have a useful shelf lifetime. And my point is that knowing that can tell you something very important about the structure of Wonderbread, and about what it will do inside your gut.
I wore a glucose monitor for a few months and tested my blood sugar response to different foods. The worst spike I ever got was American Chinese food: rice+sugary sauce. Brown rice vs white rice makes no difference.
Ice cream didn’t make much of a spike - all that fat. Waffle with maple syrup and peanut butter is completely different profile than waffle without peanut butter.
Most important thing for my blood sugar was portion size. Eat a lot, get a big spike.
Frustrating to me that people argue so much about “processed” vs “unprocessed” food. The real issue I believe is portion sizes.
A boiled or fried egg is processed, but not ultra-processed. (The ovalbumin matrix in egg is denatured but not destroyed by just heating it up. Just like the protein matrix in a steak is denatured-but-not-destroyed by just heating it up.) It's still a whole food, per se.
But scrambled eggs, or an omelette, are closer to being ultra-processed; simply because you've mechanically emulsified the egg together, and in the process, have broken down that matrix. (Same reason that ground beef is ultra-processed.)
At that point, very small further additions can push what you might still think of as "just cooked eggs" into being ultra-processed. For example, just adding a sufficient amount of salt while cooking scrambled eggs could produce an ultra-processed result, since the disrupted matrix allows the salt to get in and break down cells and tissues, and then cooking those lysed cells and chemically-denatured tissues results in higher resulting lability / bio-accessibility of nutrients than cooking would have on its own.
But also, on a separate point: raw egg, like milk, is already one of those rare naturally-labile foods. (That's why developing embryos can make use of the nutrients therein. It's also why salmonella loves raw eggs.) Raw egg is not necessarily especially easily digested by humans (none of our gut enzymes are particularly good at taking apart a non-denatured ovalbumin matrix), but many species have evolved into obligate ovivory for a reason.
The Nova classification is generally how people interpret this stuff. Generally speaking ultra processing isn't something you do in your own kitchen: https://en.wikipedia.org/wiki/Nova_classification
> Generally speaking ultra processing isn't something you do in your own kitchen
I don't think that's a useful distinction. Many people make pasta noodles or sausage in their own kitchens, for example, and both of those are ultra-processed by every definition.
Also, IMHO, it's a mistake to think of UPFs as only finished food products you get from the grocery store or from restaurants. Many ingredients people use in what they would very much insist is "home cooking", are themselves UPFs, and so cause the resulting "home-cooked" food to be a UPF.
The FDA's recent categorization of sandwiches as generally being UPFs, for example, is due in part to people using UPF breads like Wonderbread for sandwiches; and in part due to people using reconstituted/preserved deli meats in sandwiches; but it's also due to even people who think they're being healthy, smearing a UPF "sandwich spread" onto their sandwich bread at the end. (A grilled cheese grilled in butter is a highly-processed food. A grilled cheese grilled in mayo is a UPF, because shelf-stable grocery-store mayo is a UPF.)
Yes and pretty much all baby formula is bad. Vegetable oil is often the #1 ingredient and is not even close to having the same density as breast milk. It can be life saving, but it’s not an example of UPF being generally good.
Also supermarket whole wheat bread is very different than real bread if you look at the ingredients. It’s more like bread adjacent.
my wife describes ultra processed food as food that is basically pre digested for you before you eat it, which seems like a pretty good definition to me
I think that it's also literally all plant-based meat replacers (meaning products intended to mimic meat, rather than just replacing meat with plants).
Maybe true as long as you make it the same way at home as the ultra processed version from the store. But you usually can't since you don't have the machinery.
Homemade wheat bread made of just wheat/water/salt is an entirely different thing from most "whole wheat bread" in the food industry.
That's the point. Homemade white bread and store bought have the same nutritional profile. They're both hyper-palatable. The super fine milling of the flour and removal of the bran makes it super tasty and enables the body to convert it into glucose super quick.
A whole-grain bread made with stone milled flour is going to be far healthier for you than steel ground white bread even if the brown bread is technically UPF and the white bread is home made.
The true "natural" alternative would be a cracked-wheat porridge. That's about as far as you can get from hyper-palatable.
> The super fine milling of the flour and removal of the bran makes it super tasty
I disagree on this. Speaking only about homemade, white bread is tasteless and wheat bran and germ adds taste.
White bread pretty much tastes exactly like the sugar you pour into it, and wheat is the sort of mix of sour and sweet that makes an addictive taste - why Kool-Aid and soda are largely citric acid(sour) + sugar(sweet) + [random other stuff]. You can drink a larger volume of sugar in a shorter time through drinking Kool-Aid than you can eat in marshmallows.
Wheat bread as some sort of health food is a scam, though. You get a few more micronutrients, but the problem is that its a ton of carbs. Brown foods being associated with health was just some weird advertising heuristic that got hammered into us our entire lives.
Wheat bread simply tastes better. All of the seeds and gritty parts that they add to some of them are honestly just more marketing to people who think that things that are more difficult to eat are intrinsically better for you. There are plenty of other places to get your fiber than your bread.
It tastes better to you. Good for you. White bread continues to exist as a category because it's hyperpalatable; in fact, it's one of the canonical HPFs.
It is processed but not ultra-processed. You can look into this by a simple search: “is flour ultra processed” and I got a number of results explaining the difference.
Yeah I get that. But having been both it doesn’t advocate for better treatment for any of them.
Also as far as I’m aware the pay for programmers in the US has always been an isolated thing with the rest of the world ranging from normal to “literal sweatshop”.
So, from your comment and your reply, are you just happy that more people are being treated poorly?
That makes no sense. You seem to understand that he was being snarky, so why do you not understand that that snark and desire to see “others” brought down to a lower level just because some were already there doesn’t help anyone? Actually, that division does help people, those people that are putting people there in the first place.
Let’s be clear: for context I’ve been out of the programming game for more than 10 years at this point. I have my own business that I’m set to sell soon and then retire to something more entrepreneurial. But I still don’t desire to see my younger employees suffer any more than the tradesmen I used to work with.
Haha, it seems childish but if you’d like to go that route I’ll just point you to the original posters reply:
>It's exposing the hypocrisy of privileged groups suddenly being treated like regular people, when they did NOTHING for decades to help others or even to protect themselves ("f* you, got mine", rockstar programmer, 10x programmer, talents everywhere, etc mentality). No unions, no collective bargaining, sheer individual greed.
So, I guess since you’re taking that position, Thomas: are you just pro pain for an increasing number of workers or can we agree that adding more people to the pool of mistreated labor isn’t beneficial for anyone?
Personally I’m going to continue advocating for better rights for both.
What a weirdly hostile and offensive response. I'm always struck by people who think they can namedrop my employers to shut down an argument, like we're just going to believe and profess whatever keeps people on message boards from being mean about the company.
But, no, I feel like throughout this thread I've been pretty consistently putting a question to you (what exactly do you mean by "pain" or mistreatment, given the original comment described other professionals having norms developers seem now to be recoiling from).
Nah it’s relevant, because if you hold these views to the point that you’re willing to avoid answering the question then obviously your world view is warped in what even you would consider a negative direction and therefor it’s important that others get a chance to be steered away from a potentially negative experience.
And to be fair, I don’t know what you expect when you advertise your place of work and then insensitively play games with serious subject matter on public message boards. I think the kids call that a self own.
But I agree, you don’t seem willing to put in writing what you’ve conveyed so this isn’t a growth experience for anyone.
Wait, I must be misunderstanding you, because if you're resolving off Quad9, they can definitely poison your DNSSEC-signed records. Between a stub resolver and a recursor DNSSEC collapses down to a single "yes it was signed" bit in the header.
To protect yourself from an upstream resolver using DNSSEC, you need to be doing something akin to a full recursive lookup yourself. This is a flaw in the DNSSEC design and a reason why DoH took off instead.
I don't know the details but knot-resolver asks for DS records of the domain being looked up when forwarding to avoid needing to do a full recursive lookup to validate DNSSEC. As I recall from what I've read this works almost everywhere, including Quad9, but not Google DNS due to a bug that they claim to have identified three years ago but haven't fixed. But as I understand it this is not how recursive resolvers validate so it is extra data that the forwarding server needs to request and cache.
> To protect yourself from an upstream resolver using DNSSEC, you need to be doing something akin to a full recursive lookup yourself. This is a flaw in the DNSSEC design and a reason why DoH took off instead.
What? I don't see how you can call that a flaw in DNSSEC when DoH is no better in this regard; it doesn't even attempt to protect against a malicious recursive resolver. The only way to do that is to validate DNSSEC on the client.
DNSSEC and DoH provide different security services. But to get the benefit of DNSSEC, you need to resolve recursively. DoH works for stub resolvers. That's all I'm saying.
That's a weirdly confident prediction. Why do you think 309 isn't going to fall in our lifetimes?
"SHA2 will never be broken in our lifetimes" is something I've heard JP Aumasson say many times, but that's based on the fact that there's no line of sight anywhere to techniques that could break it. But you can't say that about 1024 bit RSA.
Everyone wants to argue crypto when my point was precisely the opposite (to wit: "Two decades after the factoring freakout, RSA is fine, go figure"), but whatever. I'll retract that when they break it. But the pace has been slowing down, not speeding up. Getting from RSA-250 to -260 was six years. That's not going to get us there before I kick it, at least.
If you want to pin me down on something slightly more formal: DRAM density scaling kinda stopped a few years back, systems aren't getting any bigger (much to Sam Altman's public dismay), and there is a superlinear matrix size requirement in factorization techniques that AFAIK no one knows how to fix. We can get the cycles to do it, but not the space.
Probably. Maybe not! But even so, it will remain cheaper to steal my secrets with the proverbial $5 wrench. RSA? It was fine.
The last few jumps between 2x0 were 3 years, 2 years, 1 year, 1 year, and 6 years.
I don't think you can extrapolate that into "slowing down". It wouldn't even be surprising if the next five jumps averaged 2 years each and RSA-1024 was cracked in a decade.
I'm sure RAM is an issue but I don't expect it to be a hard wall.
honestly I wouldn't be shocked if 2048 bit rsa gets factored in our lifetime. GNFS doesn't have the feel of an optimal algorithm. dropping to L(1/4) would bring 1500 bits into reach, and it seems plausible still that factoring is polynomial.
If the vulnerability is already being exploited in the wild --- as in, it's a vector people already know about and are tracking --- it's possibly not worth much at all. Vulnerability valuations depend heavily on the lifespan of the vulnerability; payments on black market are tranched (explicitly or less explicitly, as with "maintenance payments") based on whether they're patched.
Further: a vulnerability is probably not worth that much either, even if it's a hypercapable vulnerability, because the grey market buys full enablement kits, not vulnerability information. People making 6 figures on vulnerabilities are selling fully enabled full chain exploit systems, not just intelligence about a sandbox escape.
Isn’t the implication that the vulnerability had already been found and exploited instead of reported to Google, because its value to Google was so low? Whoever found it originally had more incentive to sell it on the grey/black market. Or is the incentive structure truly different for vulnerabilities discovered to be already in the wild?
Sometimes, yes. But usually, as a security researcher, you usually sold to brokers. The brokers made the vulnerability into a reliable exploit. That is whst they then sold to agencies. For a markup of course. The industry was in a tough spot already the past years. Now AI is shaking it up even more.
This "only" escapes the JavaScript sandbox. You still need to chain it with an escape for the process sandbox. So it's not just the boring stuff of turning a predictable crash into arbitrary execution, but also finding a second RCE vulnerability to chain this with
> Spacing around an em dash varies. Most newspapers insert a space before and after the dash, and many popular magazines do the same, but most books and journals omit spacing, closing whatever comes before and after the em dash right up next to it.
Before the LLMs made the emdash the tool of the electronic oppressor I used it often enough and other people did too.
I hate that it's basically become the little hitler moustache of punctuation. There was at least one guy who was really enjoying his tiny little moustache until he couldn't anymore. That is the emdash for me.
The value of future reports should also be a component though. By paying a low amount you discourage ethical bug bounty hackers from bothering to look for more exploits. If I think I'm only getting $1000 for a Chrome issue versus $100,000 for an Acme Co issue, I'll be spending my time looking for Acme Co issues.
Bug bounties are as much a way of attracting talent to even try to exploit your system as they are about the exploits themselves. If you lowball the bounties the talent goes elsewhere.
How do you figure? The value of the report is, ethics aside, the same as the value of exploiting it. Doesn’t matter if I can conceive of it, it matters if I can exploit it.
Supply and demand has to be considered. The more parties aware of the vulnerability, the more attractive sellers (reporters) have to make their ask to the buyer (defender).
Not following that. The report is the upstream resource the exploit needs. The value of iron ore is definitely not the value of the steel made with it. Or maybe I misunderstood your view?
That's really informative but maybe a little overly capitalist-brained.
We shouldn't look to the black market as cost discovery for these vulnerabilities, most non-criminal researchers are not putting up an ask order and letting the black market compete with Google.
Ah the classic programmer mistake when encountering the legal system of thinking ‘but surely this act, in and of itself, could not be considered illegal?’ When what the law criminalizes are not mere acts but actions carried out with intent and knowledge in a context.
‘Officer, you can’t arrest me for carrying a gold bar!’
‘I can if you are carrying it out of the Federal Reserve vault without permission’
Similarly:
‘Surely selling someone the knowledge that a piece of software can be hacked isn’t illegal?’
‘It is if you know or suspect that that person’s intention is to use that knowledge to commit crimes’
This would make you a ‘coconspirator’ or possibly an ‘accessory before the fact’ in any crimes they committed.
That's one of the points, yes, but the black market doesn't dictate the value of the exploit to Google.
A hardline bargaining position with Google would be more like "pay me what I want, or else I'll give it to all takers on the black market for maximum damage". That would be unethical and probably illegal to boot but it's a better definition of value than "1$ greater than max bid".
The value to Google - sure. But the market value of the exploit itself - the black market I think is a factor in that regardless of what Google offers.
The value of something is dictated by what _the market_ offers, and just because Google throws a lowball price because _they_ don't value it doesn't necessarily mean that the value of the exploit itself is as low as they dictate.
There will always be someone who would screw Google just for the love of the game, and if they got a better price from elsewhere, I don't see why _morality_ would really play that big of a role. It all comes down to incentives, and if Google doesn't incentivize doing the good thing enough, then someone _will_ incentivize them to do the bad thing just a bit more.
Markets are fundamental things and exist regardless of any kind of moral "should". Otherwise we wouldn't have people buying hard drugs or trafficing women.
Well there's cases of diets which came to prominence and caused issues,.from the obesity epidemic of modern west to the pellagra-riddled European countries consuming maize.
It is conceivable that social/natural changes might bring to dietary changes whose damage at scale is only visible on hindsight.
They do, but it does not take much for economic pressure to make one seemingly small change with wide ramifications e.g. a plant or two which are not economically viable, get substituted, and turn out to be critical, then leading to chronic deficiencies (iirc the British navy got scurvy back after they switched from lemons to cheaper limes, or maybe between two kinds of limes and one had significantly lower levels of vit c).
It could also be interactions between the cultural diets and new products historically unavailable to that culture, which are either improperly processed (maize caused a lot of pellagra in europe) or has problematic interactions with components of the cultural diet (I don’t have an example for that, but grapefruit is famous for its medical interactions so nutritional interactions don’t seem impossible).
I don’t think it should be the first thread of investigation but it certainly should not be dismissed out of hand if nothing else bears fruit. That is how you get scurvy.
FTA: “Fischer and her collaborators combed through the medical records of patients who had received emergency dialysis between 2012 and 2015 at any Harris Health hospital. Out of the 346 cases of kidney failure in uninsured or undocumented patients, 17 percent had no readily identifiable cause. That percentage was staggering to the researchers. It suggested that thousands of emergency-dialysis visits in Texas annually may be attributable to CKDu“
⇒ it seems (part of) the reason we suddenly started seeing this is that we recently started looking for it.
Hispanic laborers aren't eating at whole foods, there are markets and foods that cater to them. I definitely hit those up back in the day when doing pipefitting work, too.
buncha glyphosate in batches of corn and masa could absolutely hit that big and mess up kidneys that much
No, we wouldn't, you're right. We'd just replace LetsEncrypt and the ISRG with the security track records and policy integrity of the major DNS providers, many of which are state-controlled, and the largest of which are too important to revoke.
Really hard to understand why that hasn't happened yet!
You can chose under which registry you can register your domain. You cannot choose which (in many cases also state controlled) web PKI certificate authority can sign certificates for your domain name. And Web PKI revocation is a joke that many clients don't check at all and others do using privacy-hostile mechanisms.
But sure, keep spreading FUD like you always do on this topic.
For the last 2 years, I've tracked the Tranco Top 1000 sites, continuously checking DNS to see if any major sites have turned on DNSSEC (6% of the Top 100 do --- many of them government sites). Over those last 2 years, a total of 8 sites in the Tranco list have enabled it. It happens so rarely I could reasonably call them on the phone and share my misinformation about how moribund DNSSEC is to them directly.
Nobody's denying this, but the interesting story about GLP-1s is that after you control for fat loss (for instance, by taking cohorts of patients that aren't losing weight) you still get evidence of these off-target effects.
reply