Visualize data instantly with machine learning in Google Sheets - <AUTHOR> https://www.blog.google/products/g-suite/visualize-data-instantly-machine-learning-google-sheets/ <comment><USER2> When I worked for SAP back in 2007 (I was a fresh grad at the time), I was working in the business intelligence (reporting, analytics, and data warehousing) group and noticed how cumbersome it was for organizations to simply create and view reports (we're talking millions of dollars). I once said to my boss "you realize that in the future we'll simply just write 'show me a line graph for sales in the northeast'".

And so here we are now.

<comment><USER3> I'm currently evaluating BI vendors for my company and just about every major contender has this functionality or is developing it. Read the Gartner report from 2017 and they basically just come out and say that this will be the new standard in BI.

The much harder problem is data management and preparation. Anyone with half a brain and a decent visualization tool can create basic graphs - but that doesn't mean they should, especially if the organization doesn't have good data management processes in place.

Issues like data governance, data prep, and data modelling are the major pain points for me. And honestly, developing a useful BI solution is more about culture change than it is technology. If a company has poor data governance, it doesn't matter how whiz-bang their technology is, they're still not going to get useful insight from their numbers.

<comment><USER4> And data management / preparation is where major mistakes are made - get a join wrong and you may easily be missing data or double counting something just obscure enough to go unnoticed like "ancillary sales".

There is something potentially harmful, or perhaps that needs addressing, about end-user tools growing in expressive power. A good friend who does statistical genetics work once told me "but I don't want every user running their own regressions and drawing nonsensical conclusions from badly prepared data!"

<comment><USER5> Yep. Wake me when an AI can tell me "hey, that monthly trending conversion report you asked me to pull...yeah, you're missing two days worth of data when tracking broke, so it will just make your numbers look lower when rolled-up monthly and be hard to notice."

BTW, that is also the reason I not only set alerts, but review data at a daily level when pulling any rolled-up reports of significance.

<comment><USER6> Why can't AI tell you you're missing data?

<comment><USER7> For most use cases, you don't even need AI. Once you reach a certain scale, there are certainly ML-based solutions available: [https://medium.com/netflix- techblog/rad-outlier-detection-on...](https://medium.com/netflix-techblog/rad- outlier-detection-on-big-data-d6b0494371cc)

</comment></comment></comment></comment></comment></comment><comment><USER8> I played around with this the other day. I have a spreadsheet with a bunch of columns. It wasn't immediately obvious how to use the explore feature intuitively. It graphed data but not really the ones I wanted. I was also hampered by it using only about 200 pixels on the right side of the screen.

I started typing in a question but it couldn't guess what I was interested in. YMMV. Perhaps with a fairly simple spreadsheet you can intuit things? Back 10 years ago I built a google spreadsheet competitor called Numbler (well, I didn't know if was a competitor, google sheets came out a couple of months later). But one of the things I learned is that people use spreadsheets for just about everything, and it can be in the wierdest format.

<comment><USER9> "people use spreadsheets for just about everything"

That is so true. I used to do consulting for small businesses and was amazed at how non-programmers used Excel to solve so many problems outside of finance and accounting. The CRM/HR solutions were very common and interesting (e.g. Lead/prospect management, sales, timesheets, vacation schedules, etc.).

</comment></comment><comment><USER10> Can we talk about getting data into Google Sheets? Is there a standard way to build a pipe from, say, a reporting database to dump aggregates into Google Sheets?

I built a private Add-on for my company that surfaces specific aggregates as Sheets functions (i.e. getSalesByDay(...)) and I have found so many bugs with that whole ecosystem. Deploys are completely manual and require copy-paste, you can't reliably tell what version is being invoked in a sheet, invisible cell-level caching that caches error state, concurrency limits that are too low and impossible to work around, and more. It all kinda sorta works but Google doesn't make it easy.

<comment><USER11> Yes, so much this. I've encountered this same issue.

For our non-technical employees I write an endpoint that gives them a CSV with the most current info (often with a super simple front-end that they can use to query for specific date ranges or with filters). They download this CSV and upload it into their sheet manually to update the underlying data when they need new info.

It would be so great if you could just say "here's a URL; keep my data fresh from this source" and it would automatically do it.

<comment><USER12> Does the IMPORTDATA function work for that?

<comment><USER13> It does. I use heroku dataclips to get data out of a database and import it into google sheets using importdata. It's really simple and for my use case incredibly useful.

</comment></comment></comment></comment><comment><USER14> Cool stuff - someone else mentioned Thoughtspot - that was my initial thought as well. Very similar idea.

I wish that Google would take the same sort of "embed" idea further in G-Suite. I find it amazing that I can't (as far I know) reference slides from another deck in Google Slides. The use case would be putting together a series of "core" slides that are updated across your organization as they change. Given the web nature of G-Suite, this, to me, would seem like a no brainer.

Also, inserting charts from Google Sheets into Google Presentations looks pretty terrible. I often revert to Excel because the charting is fair superior imho (though just as challenging to wrangle).

</comment><comment><USER15> They are solving a problem that doesn't really exist, the challenge is not the last step of a data report, it's the steps involved in the beginning, getting good data in, formatting, joining multiple sources, automation, dealing with junk data, procedures,etc.

I don't understand the example, what's the difference between typing "Show me a line graph" and clicking a button in excel that does the same thing.

<comment><USER16> Did you try it? Yes, getting good data is a challenge but that's not one they can solve in Sheets. Making a graph is also not always one button, unless you have very simple data.

I found it immediately useful. They've solved some UX and discovery issues around creating charts. And it's not _just_ charts... they're answering questions and identifying trends within the data. e.g. I threw some pretty basic data at this and it told me "Flights" contains a yearly cycle: "Flights" increases until May 1, decreases until October 1, and increases until December 1.

That's pretty handy. YMMV, but this is awesome.

<comment><USER17> Tableau did some research in this area, and found NLP queries were much faster:

[https://pasteboard.co/dPeoSHM1s.png](https://pasteboard.co/dPeoSHM1s.png)

</comment></comment></comment><comment><USER18> Mandatory shameless plug - Google Sheets integrates with Google BigQuery.

You can:

\- Query data in Google Sheets from BigQuery

\- Create virtual views in BigQuery that are powered by Google Sheets

\- One-click export data from BigQuery to Google Sheets (< 20k rows or so)

\- Using AppScript, build dashboards and reports in Sheets that query BigQuery for results.

(work at G)

<comment><USER19> I tried to rely on your first bullet point and randomly end up with BigQuery surpassing some API treshold towards Drive (paying customer). Have to carefully manage doing copy-queries over to BQ, which is a pain, but better than nothing I guess.

<comment><USER18> Thanks for the feedback! I'd love to get more detail on your experiences so that we can iterate and improve and would be eternally thankful if you emailed me.

</comment></comment></comment><comment><USER20> Oh, wow. I love where this is headed. Spreadsheets are one of the most abused products in a normal business--used for _everything_ , and then some poor excel jockey ends up being forced to create a semblance of order from the chaos.

<comment><USER21> Someone needs to create Spreadsheets Anonymous and share the crazy stuff people do in Excel, the best one I've seen is a full GUI wizard (back, next etc.) in VBA.

<comment><USER22> I once worked at a large company (70K employees) in which the check request software (that is, if you needed to pay a vendor with a written check) was written in VBA embedded in Excel, using Outlook (the client, not Exchange) as Workflow.

You opened the "spreadsheet", which hid Excel itself and showed a form. You filled it out, clicked Send and it used your local Outlook client to email a copy of itself to your boss, who then opened it and was presented with another form for approval, etc, up through finance and finally to the person who wrote the check.

It was amazingly ugly and fragile, and of course, there was no way for anyone to see the state of the system (because the 'state' was distributed among the entire workforce's Exchange inboxes!).

Want to know the status of your check request? No problem, simply call everyone who might have been in the approval chain and ask them to search their inboxes. Hope you find the most current person!

(updated to correct the name of the software)

<comment><USER23> God, I work in an environment like that. We are a non-profit, and our primary CRM is The Raiser's Edge. However, data is never manipulated within The Raiser's Edge. Instead every process involves exporting data from The Raiser's Edge, manipulating it with an MS Office application, and then re-importing it.

When I started, almost every process was based around Access, using queries made using the query builder. With some basic scripting I managed to cut a couple of man-months of work down into about an hour or two of work a month. The entire thing is more fragile than a stack of cards though.

At this point I could literally write a 200 page dissertation on all of the reasons why this is a bad idea. But it works, and it is cheap. So there you go.

</comment></comment></comment></comment><comment><USER24> Well charts is a good addon but just wanted to understand how they are able to do this ... i mean Machine Learning part , for example if somebody asks "Show me sales of X product in last year" , from machine learning perspective how this gets interpreted in actual SQL query ..

<comment><USER25> I wonder if it's actually machine learning or if they just implemented a query language that tries to guess what you mean.

The definition of machine learning that I use is: an algorithm which improves its performance through experience.

So, if charts doesn't get better the more you use it, it's not machine learning.

<comment><USER26> If I had to guess I'd say the machine learning part is analyzing a sentence ("Show me a line graph for x, y, and z") and determining what exactly they want to see.

</comment></comment></comment><comment><USER27> Kind of goes in the direction of what Thoughtspot ([https://www.thoughtspot.com/](https://www.thoughtspot.com/)) is doing ([https://www.youtube.com/watch?v=D-y_EjFsDuk](https://www.youtube.com/watch?v=D-y_EjFsDuk))

<comment><USER28> Looks like a good idea. But, where does it get its data from?

Does it perform NLP on company documents?

<comment><USER27> Honestly I don't know, I do not work for Thoughtspot.

My assumption is that it works on metadata coming from a relational schema with a rule parser on top.

Honestly I don't see how it would work well enough if it was based on NLP of unstructured data.

</comment></comment></comment><comment><USER29> This is very neat.

But the best, still-mostly-hidden feature I've found recently is App Scripting and especially the ability to do a UrlFetch.

I use it as an "API Runner" to run various batch jobs against APIs.

[https://developers.google.com/apps-script/reference/url- fetc...](https://developers.google.com/apps-script/reference/url-fetch/url- fetch-app)

</comment><comment><USER30> I'm wondering how Microsoft is responding to this. Do they expect their current Excel dominance to continue despite competitors constantly catching up to feature parity and even extra goodies, like this one?

<comment><USER3> Actually, this has been available in Power BI for a while. I just went to a meetup last night and saw it in action.

It's fairly trivial to get this to work with well-formatted data.

I'm currently evaluating BI solutions for my company and just about every single one has something like this.

</comment></comment><comment><USER31> I wonder if we will see more software including query based input like their charts, and what sort of speed improvement we could see? At first I was not excited to type something where I could click a couple buttons, but then I recognized the other enhancements such as applying a filter right away.

I'm not convinced it's better just because it has machine learning on the back end, but if excel would learn how I want my graphs made from how I manually adjust the graphs (adding axis labels and a title, color preferences, never a 3d bar or pie chart), that'd be a nice enhancement. I'm sure there's a setting, but I haven't searched for it.

</comment><comment><USER32> I thought Explore in google sheets has had this feature for awhile? I remember it suggesting visualizations in sheets a few months ago.

<comment><USER33> I've been using it for a while, too. I'm guessing it's been available in Enterprise/g suite, but is now rolling out to all users.

<comment><USER32> From my experience the public versions of g suite run a more bleeding edge version and they introduce stabilized features into g suite.

</comment></comment></comment><comment><USER34> This is similar to statsbot.co 's Slack bot

You would message the bot something like "sessions for this month", and it would send back a graph.

wonder if you could make a similar bot with google sheets if they provide an api

[https://statsbot.co/slack](https://statsbot.co/slack) [https://medium.com/slack-developer-blog/bots-you-can- count-o...](https://medium.com/slack-developer-blog/bots-you-can-count-on- meet-the-developers-behind-statsbot-1ddb2961ead0)

</comment><comment><USER35> There's a lot of basic stuff like column titles, moving columns about, filtering, search that I found had a quite a learning curve with sheets. I built and use this instead. Bell+Cat [https://bellpluscat.com](https://bellpluscat.com)

<comment><USER36> I love your "Made with and  on the 3rd rock from the sun." tag.

<comment><USER35> Thanks, its a little sad how I survive on taco's and coffee :)

</comment></comment></comment><comment><USER37> does anyone know how this kind of stuff gets built ? I'm considering a spreadsheet-y internal admin dashboard for my startup. I was looking at [https://github.com/JoshData/jot](https://github.com/JoshData/jot) to be able to sync stuff on the client side to the server.

has anyone worked on something like this ? the big challenge is synchronization - between server and multiple clients - while being able to offload a lot of computations on to the client.

I wonder how is the security built ? if i maliciously change the formulas in my browser.. will the backend datastore still accept the data ?

<comment><USER38> The big challenge is implementing the spreadsheet UI.

<comment><USER39> There's a React component for that. React-datasheet or something like that.

<comment><USER38> I know there's a React component. There are many. They don't come even closer to the functionalities of an actual Excel-like spreadsheet.

Implementing 70% of the most basic of all functionality of Excel is easy. Implementing 90% is insanely difficulty.

I would say Handsontable reaches the mark of 78%.

I've tried twice, one with React + Mori[0] and one in Cyclejs[1]. In the first I may have reached 82%, in the second probably 85%. But in both cases the latest features I added started to conflict with the oldest ones and I abandoned everything.

[0]: [https://github.com/fiatjaf/react- microspreadsheet](https://github.com/fiatjaf/react-microspreadsheet) [1]: [http://sheets.alhur.es/](http://sheets.alhur.es/)

</comment></comment></comment></comment><comment><USER40> This sort of thing it's easy to get to 80% but good luck getting that last 20% without formalisms. Might be useful for getting a quick feel for a data set to confirm some intuitions, but not really useful beyond that.

</comment><comment><USER5> Is there any way yet to sort values in a pivot table? Kind of ridiculous that we still need to resort to the query function...

</comment><comment><USER41> The next major of Tableau should be implementing NLP in similar fashion.

</comment><comment><USER42> Wow amazing, when will this be available as a javascript library?

</comment><comment><USER43> still no tables. How hard is it?

</comment><comment><USER44> 404 for me on the link.

</comment><comment><USER45> how many corporate secretes will be leaked into this?

<comment><USER46> Leaked into what? If you are using Google Spreadsheets your "secrets" are already on Google servers and are "leaked" long time ago.

<comment><USER47> While technically true, this is the first time I'm actually thinking "maybe I'll start using Sheets". I hate Google and giving my data away, but lately I often feel that I'm missing pleasure of easy use by avoiding all these hateful botnets. So, eh, maybe I just die before it gets actually massively harmful, and then fuck it.

We need open source implementations for stuff like that.

<comment><USER46> We have open source implementations for nearly everything that is provided commercially. The problem is that no company wants to use said implementations.</comment></comment></comment></comment>


Automate emotional labor in Gmail messages - <AUTHOR> http://emotional-labor.email/ <comment><USER2> Reminds me of the book "Avogadro Corp: The Singularity is Closer than it Appears" [0], in which (spoiler alert):

\- a-company-that-is-totally-not-Google is developing a tool for an-email- service-that-is-totally-not-Gmail, which can rewrite emails with the goal of maximizing the chance of a desired outcome happening (automatically added mentions of family when requesting time off from a boss who prioritizes family, etc)

\- the project is in danger of being canceled, so a developer changes the code to prioritize rewriting internal company emails with the goal of maximizing the survival of the project

\- you can guess what happens next :)

[0] [http://avogadrocorp.com/](http://avogadrocorp.com/)

</comment><comment><USER3> I would love to see an opposite too where all the fluff is removed and only hard data remains. If nothing remains you get a kitten gif instead.

</comment><comment><USER4> Yikes, the example just added a bunch of exclamation points and the word "lovey" for the most part. Flip this on to immediately alienate someone who thought they knew your writing style.

Novel concept, but I think this is one of those things that's more a showpiece than something you'd actually want to use.

</comment><comment><USER5> I wish the after part of the gif showed a bit longer. Or a side-by-side with the before would be nice.

</comment><comment><USER6> The 'before' text looks emotionally labored as it is!

</comment><comment><USER7> Surely this is tongue in cheek. It substitutes "that's lovely" and "lol" for "work" in different places, producing nonsense.</comment>


Curry spice turmeric boosts memory by nearly 30%, eases depression, study finds - <AUTHOR> https://ac.els-cdn.com/S1064748117305110/1-s2.0-S1064748117305110-main.pdf?_tid=55b0e2e0-013c-11e8-b35b-00000aab0f01&acdnat=1516822117_7ded3d2cd7f5c27fedf6a8992e549857 <comment><USER2> From the Wikipedia page on Curcumin (section Research):

      In vitro, curcumin exhibits numerous interference properties which may lead to
      misinterpretation of results.[3][6][20] Although curcumin has been assessed in
      numerous laboratory and clinical studies, it has no medical uses established by
      well-designed clinical research.[21] According to a 2017 review of over 120
      studies, curcumin has not been successful in any clinical trial, leading the
      authors to conclude that "curcumin is an unstable, reactive, non-bioavailable
      compound and, therefore, a highly improbable lead".[3]

The study claims to have studied a bioavailable forom of curcumin, Theracumin® but it uses a very restricted interpretation of "bioavailability":

      The use of adjuvants that block curcumin metabolism, or nanoparticles, liposomes,
      phospholipid complexes, and other strategies have improved its bioavailability somewhat,
      but only as defined as increased curcumin blood levels8,64–66 with minimum effects on
      curcumin availability to the brain.

The study also notes its sample was small:

      The relatively small sample size in this study warrants caution in interpreting
      our results and limits their generalizability.

It just doesn't sound like their results are going to stand the test of time.

<comment><USER3> None of your criticisms from wikipedia pertain to this publication. The paragraph is essentially making the argument that a randomized, double blind (DB), placebo controlled (PC) clinical trial (RCT) is unlikely to show that curcurmin is effective. yet, the published article is exactly that, and shows a statistically measurable impact on a clinically meaningful endpoint: a direct refutation of the paragraph.

the fact the "interference properties" and being an "unstable, reactive, non- bioavailable compound" is subsumed by the study design.

      claims to have studied a bioavailable form of curcumin

This is not really relevant to the claim or conclusions. could it be that the bioavailability matters? maybe. could it be that curcurmin is a trick molecule to study? yes. but come what may, this is direct evidence (not proof) of a cause-effect relationship between this treatment and the outcome.

the only thing this effects is the chance that other forms of curcurmin will be comparable (and it might have consequences for regulatory status by the FDA).

      The study also notes its sample was small

This is a very weak criticism when the study is _positive_ (i.e. shows an effect). when the sample size (and statistical power) of the study is small, you need a BIG EFFECT SIZE to be positive. The fact that the trial was positive actually means that it's more likely to be clinically important, because a big effect size means it protects memory in a dramatic way. This is like penicillin: in the pre-antibiotic era, how many cases of pneumonia do you need to treat in order to be satisfied that penicillin is effective? Not bloody many, because the effect size is so dramatic. Likewise for parachutes. few are the therapies that fall into this category, but when you have an inkling that one does following a DB, PC, RCT, you better pay attention.

So does it need to be replicated? definitely. does the sponsorship matter? definitely; they could have cheated in some way. until then does it make sense to prescribe this to seniors, or encourage them to increase curcurmin in their diet? quite possibly, given the presumably low rate of adverse effects.

Bottom line: this study is not the end-all be-all of curcurmin and memory, but there is legitimate early evidence that the emperor has clothes.

edits: mainly spelling, formatting

<comment><USER4> When a small sample size produces a big effect, it does not mean you can be more confident in the effect!

All things equal, you'd expect confidence intervals / credible regions to be very large.

Another way to say this, is that since the measurement error is large, you expect spurious findings that result from something like p-hacking to be large (they have to be to be significant).

<comment><USER5> What annoys me as a someone not trained in statistics is that these discussions are always abstract in-principle arguments about what proper statistics should be like.

Meanwhile, we have a _real paper_ with _real p-values_ , why not discuss the validity of that?

> _SRT Consistent Long-Term Retrieval improved with curcumin (ES = 0.63, p = > 0.002) but not with placebo (ES = 0.06, p = 0.8; between-group: ES = 0.68, p > = 0.05). Curcumin also improved SRT Total (ES = 0.53, p = 0.002), visual > memory (BVMT-R Recall: ES = 0.50, p = 0.01; BVMT-R Delay: ES = 0.51, p = > 0.006), and attention (ES = 0.96, p < 0.0001) compared with placebo (ES = > 0.28, p = 0.1; between-group: ES = 0.67, p = 0.04). FDDNP binding decreased > significantly in the amygdala with curcumin (ES = −0.41, p = 0.04) compared > with placebo (ES = 0.08, p = 0.6; between-group: ES = 0.48, p = 0.07). In > the hypothalamus, FDDNP binding did not change with curcumin (ES = −0.30, p > = 0.2), but increased with placebo (ES = 0.26, p = 0.05; between-group: ES = > 0.55, p = 0.02)._

I can see that there are a lot of p-values around 0.05, but that the supposed improvements have much lower p-values:

        (ES = 0.63, p = 0.002)  SRT Consistent Long-Term Retrieval
        (ES = 0.53, p = 0.002)  SRT Total
        (ES = 0.50, p = 0.01)   BVMT-R Recall
        (ES = 0.51, p = 0.006)  BVMT-R Delay
        (ES = 0.96, p < 0.0001) attention

What does this imply? Is it a good sign, or does it actually make it more fishy? pythonslange's comment[0] seems to suggest the latter, claiming that none of the other pre-registered tests are mentioned, without any explanation why.

(eyeing that "attention" one, if this _does_ hold up under scrutiny, could I expect tumeric-based ADD medication somewhere in the future, without all the nasty side-effects of my current amphetamine-based options?)

[0] [https://news.ycombinator.com/item?id=16229693](https://news.ycombinator.com/item?id=16229693)

<comment><USER4> I agree with the other commenter, and Gelman's blog is a good place to start. There are very clear, concrete statistical arguments, but they are difficult to summarize in the comments section of HN.

The gist is like this. Imagine that someone had people play 20 different slot machines. Then they went into a private room and looked at the results for each machine. After, they come out with the results of 5 of the machines and say, "look, our slot machines pay out at a higher than chance level!".

Do you believe them? I hope not. If only 4 machines had done well, maybe they would have shown only 4, or 3, etc.. They've effectively stacked the deck.

On the other hand, suppose someone said they were running an honest experiment with 20 slot machines. How many machines would you expect them to report on?

<comment><USER5> I can follow your analogy, but it doesn't quite add up.

The researchers took a group of people and submitted each of them to an _" extensive neuropsychologist test battery"_.

That's not just testing 20 different slot machines, that's testing 20 different _designs_ of slot machines.

(Also, each person does each test on their own, which is the equivalent of having them not only play twenty different models, but a unique production per person unit per model)

In that light, the claim that _all_ slot machines have a high pay-out chance is obviously suspicious, but would coming back and saying "these five _designs_ have a higher than chance level of winning!" be an incorrect conclusion?

If each slot machine types is unique, no. But if one slot machine design is known to have a flaw, and if it shares this flaw with another design, and if that other design does not show the same increased performance, then things get really suspicious.

So the question becomes: do we know how strongly correlated the results of these tests typically are? If that is a lot (which I would expect to be true with at least some of these tests), the absence of the other tests is suspicious. If it is low, it might be less of an issue.

<comment><USER4> You hit on a lot of important points. The key here is that they are making a claim about memory, a psychological construct, that is being represented by some of their measures (batteries). But their batteries also purport to measure other psychological constructs, too.

To connect this with the slot machine analogy, it might be like if groups of slot machines had different colors, and they chose the color that yielded the best results.

> but would coming back and saying "these five designs have a higher than > chance level of winning!" be an incorrect conclusion?

It would be if you didn't take into account that you analyzed 20 machines in your analysis .

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> >Because curcumin's anti-inflammatory properties may protect the brain from neurodegeneration

My very first question was: Please provide a possible physiological pathway for this. I'm so glad it was answered in the very first sentence. So many of these "Superfood does X" studies are just trials with 10 people over a month, with no explanation as to __how__ it could possibly happen. It significantly increases the skepticism I have whenever something like this comes up

I also did not know Turmeric had anti-inflammatory properties. I guess I have reading to do.

Also interesting that they used (what seems to be) a name brand supplement instead of Turmeric

<comment><USER3> I am a neurologist. this is actually the exact opposite of what you _should_ care about, which is "does it work to treat ___"

In this trial, and 99% of other trials, there is no mechanism provided by the study, only a measurement of causality (which is the same thing as effectiveness).

The authors may think they know based on other, prior, basic science research (as they are postulating here), but it does not affect the conclusions of the trial ( whether they do or don't (or even if they are wrong).

Obviously it's intellectually satisfying to understand WHY, but it's not as important as "is it true?"

<comment><USER7> Obviously you don't understand HN.. everyone here is a "very smart software engineer" and knows far better than a simpleton like you with your decades of medical training and experience.

<comment><USER8> The neurologist wants what's best for his patients today, which is to know whether a treatment is likely to work or not.

Others may value the mechanism more for very legitimate reasons. For instance, if you underatand the mechanism it leads to further research that could utilize a related mechanism or perhaps see potential side effects that would otherwise be hard to identify.

You really need both. "Is it true?" is a great starting place and oofers some treatments, but discovering the mechanism gives potentially a whole new class of treatments.

<comment><USER3> completely true.

the problem is that efficacy studies (like I want) are not that exciting to report. as a result, the lay press reports only mechanism studies (because their readers like to be "wowed" and think about things, like the poster I originally replied to).

that wouldn't matter at all, but we all get sick. and when a person gets sick with this mentality that they need to understand the mechanism, then they start overthinking the treatments that are available today, drawing all kinds of spurious conclusions, and making medical decisions that are unjustified at best and harmful at worst. and in my experience, the smarter the patient is, the more willing (and insistent) they are to take this approach (witness Steve Jobs). This is absolutely not the patient being "dumb" or stubborn: it's completely understandable given how they understand science. But it hurts them, which no physician likes to see.

let's note how incredible it is that we are having this conversation in the setting of some incredibly expert scientists (albeit in other fields). it really shows how hard science can be to understand sometimes.

</comment></comment></comment></comment></comment><comment><USER9> Small study, probably not preregistered (didn't find anything about it in the description). Likely Publication Bias or p-hacking. I'm starting to get interested when it's been independently replicated.

<comment><USER10> > Small study

Almost entirely irrelevant, provided it's properly powered--and based on the effect size and p-values, it is. Furthermore, for an 18 month trial, 40 people is larger than most.

> probably not preregistered

I mean, true, and we should definitely promote pre-reg, but, 1. so few are preregistered that I'm not sure it's prudent to disregard a study based on this and 2. it's an academic study, neither a clinical trial nor a public- health decree--not a typical study type that necessitates pre-registration.

> Likely Publication Bias or p-hacking.

What? You're arrived at this conclusion based on... the fact that it's "small" and you couldn't find preregistration about it?

> I'm starting to get interested when it's been independently replicated.

Yeah, if only there were another trial that showed a positive cognitive effect of bioavailable curcumin... [https://www.ncbi.nlm.nih.gov/pubmed/25277322](https://www.ncbi.nlm.nih.gov/pubmed/25277322)

I mean, the title of this post is by far the most wrong thing about this article, as...

1\. it's not turmeric, it's curcumin, which is about 2% of turmeric by mass (so, you'd need to eat ~4.5g turmeric daily to match study doses).

2\. curcumin doesn't even have any reasonable bioavilability by itself, so they're using a bioavailable analogue.

<comment><USER11> What prevents researchers from running studies like these on the order of thousands of individuals, as opposed to 40 or 100?

<comment><USER10> A lot of things that basically boil down to budget, optimization and space available. If you have a drug that you believe you can show a strong effect with the effect group at ~15 people, maybe you run the trial with 40 (15 e.g., 15 control, plus wiggle room for drop-outs over the 18-month course and extra certainty).

Check the last few paragraphs--"The authors thank Shayna Greenberg, Dev Darshan Khalsa, and Anya Rosensteel for help in recruitment, data management, and study coordination; John Williams, University of California, Los Angeles, Nuclear Medicine Clinic, for performing the PET scans; and Vladimir Kepe, Cleveland Clinic, for developing the FDDNP-PET analysis procedures for proteinopathies in patients with neurodegenerative diseases." Add all that to the effort involved in the actual chemical extraction of the bioavailable curcumin analogue and it just doesn't make sense to add any more people than you need.

<comment><USER11> For the recruitment, data management, and study coordination piece, sounds like a great area to optimize with software. I'm sure big pharma will also happily shell out for something to help them manage their own clinical trials. Academia PIs can then get the same stuff at a lower rate.

Edit: Heck, you can even lease top grade medical space in all major metro areas and offer it as part of the package in a WeWork style arrangement. I'm sure they are tons of nuances to rolling something like this out, but it sounds like it can cut costs substantially.

</comment></comment></comment></comment></comment><comment><USER12> Personal anecdote: was born and brought up in south India and my grandma used to make me drink turmeric + ground black pepper milk every night. It was a standard practice to serve it with black pepper, even though I'm sure they didn't really know about bioavailability. Kids were forced to drink it when they have the flu.

Used to hate it as a kid, but of late I've been looking to replace one coffee/tea with turmeric milk.

<comment><USER13> Just curious: what's the amount of each ingredient that goes in one drink?

<comment><USER12> 200ml of hot (not boiling) milk

1 tsp of ground turmeric powder

A pinch or two ground black pepper

If you're not used to turmeric, I'd suggest starting with half tsp as it's got quite a strong flavour (especially when not cooked with other spices)

<comment><USER14> > 200ml of hot (not boiling) milk

If you're lactose intolerant, you can do this with yoghurt with a little water & salt instead.

Since this usually happens when I do have a cold, my laziness translates into a coffee cup of yoghurt + water + 1 minute in a microwave to zap all the bacteria out of it.

<comment><USER15> There is a school of thought that the worst thing to consume in case of a cold is dairy.

<comment><USER16> I think that's an old wives' tale. There's probably a better article somewhere, but I found this one: [http://www.bbc.com/future/story/20170421-should-you-avoid- ic...](http://www.bbc.com/future/story/20170421-should-you-avoid-ice-cream- when-you-have-a-cold)

<comment><USER17> Turmeric is an Indian old wives' tale apparently.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> Fun fact - tumeric was the trigger for India creating a patent fighting engine around Indian traditional medicine (Ayurveda and unaani) including a gene bank and international legal force around biopiracy.

We now have something called Traditional Knowledge Digital Library (TKDL) - [http://www.tkdl.res.in/tkdl/langdefault/common/Home.asp?GL=E...](http://www.tkdl.res.in/tkdl/langdefault/common/Home.asp?GL=Eng)

[http://www.mondaq.com/india/x/586384/Patent/Traditional+Know...](http://www.mondaq.com/india/x/586384/Patent/Traditional+Knowledge+And+Patent+Issues+An+Overview+Of+Turmeric+Basmati+Neem+Cases)

</comment><comment><USER19> For those commenting on bioavailability, black pepper supposedly makes it more bioavailable:

[https://examine.com/supplements/curcumin/](https://examine.com/supplements/curcumin/)

It's an interesting result, but they do note that the subpopulation is somewhat self-selected: "Only approximately 15% of the screened volunteers were included in the study, and our recruitment method yielded a sample of motivated, educated, physically healthy subjects concerned about age-related memory problems. The sample, therefore, was not representative of the general population. "

<comment><USER20> Black pepper increases bioavailability of _everything_ by inhibiting your cytochrome p450 enzymes, which increases your vulnerability to toxins.

<comment><USER21> There's a difference between bioavailability and half life. Metabolic enzyme inhibition increases half life due to decreased hepatic metabolism of certain drugs. Bioavailability is how much of a drug your body absorbs from the initial dose.

Also, black pepper inhibits CYP3A4, not 450.

<comment><USER20> Interestingly, it seems that curcuminoids themselves also inhibit p450, with less specificity.

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2574793/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2574793/)

And p450 exists in the brain, which may relate to the OP suggestion that turmeric boosts memory, but doesn't give me confidence that it boosts it in a way that is absent of tradeoffs.

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3223320/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3223320/)

</comment></comment></comment></comment><comment><USER22> Note: this was a relatively small sample (40 total, split in half for placebo/not), who were elderly people who already have "mild" memory problems, and given a concentrated turmeric derivative rather than just sprinkling it over food.

In summary: very cool, and I'd offer these curcumin supplements to anyone 50+ but sprinkling turmeric on your breakfast cereal ain't going to do much for high schoolers.

<comment><USER23> Actually the age range was 51-84, so middle plus old age, not all "elderly". Normal people flourish and are in their prime around 50.

Volunteers had "objective cognitive performance scores and clinical histories consistent with _normal aging_ or MCI (i.e., mild neurocognitive disorder) and inconsistent with dementia (i.e., major neurocognitive disorder)." [emphasis added]

<comment><USER24> > Normal people flourish and are in their prime around 50

How do you mean? I don't think most people in their 50s would describe themselves as being "in their prime".

For example, ELO ratings of Chess players tend to decline in their 30s[1]. For NBA players, their "prime" is typically the late 20s, with performance declining in their 30s.

1\. [https://www.chess.com/blog/LionChessLtd/age-vs-elo---your- ba...](https://www.chess.com/blog/LionChessLtd/age-vs-elo---your-battle- against-time)

<comment><USER23> Note that I wrote _around_ 50, not _after_ 50\. Middle age is usually defined as the 40 to 60 range (or more recently held to be slightly later, 45-65). That is the period when people flourish. That is certainly not when people are "elderly." Interestingly the Ancient Greeks used to report the time when one _flourished_ rather than their date of birth.

Neither extreme athletic performance nor ELO rating are measures of normal flourishing (I'm surprised one would bring up such abnormal elements; the lives of NBA players and elite chess players deviate very far from that of a normal human). I wonder how the kind of argument you offer, and that of the sibling "olympus" comment, feeds into reported ageism in SV and related tech companies.

<comment><USER24> Are you equating "flourishing" with "being in your prime"? Because I don't consider those to be the same.

Being in your prime is about peak potential. And sure, the age at which you have peak potential varies by activity. My early 20s is when I have the _opportunity_ to be the best sprinter I'll ever be. That's my prime. But say I first take up sprinting in my late 30s, and put in my best sprint time at the age of 40. I might be "flourishing" at that point, but in no way does it mean I'm in my prime at age 40. The 20 year old version of myself, with the similar conditions and preparation, is simply physically capable of sprinting faster.

Certainly, there are activities where your peak potential is greatest in middle age. I'm not disputing that (however, I'm highly skeptical that memory and physical ability are in their prime past age 40).

> I'm surprised one would bring up such abnormal elements; the lives of NBA > players and elite chess players deviate very far from that of a normal human

I mean, where can I get performance statistics for "normal people"? If we're talking about maximizing potential, why not look at the ones putting in the most effort toward that goal?

Also, the linked ELO ratings were for 179,221 "registered FIDE players". They weren't just the top-100 or even top-1000 players. Yes, this is biased toward people who play chess - but where else can you get the data?

I'm curious what you think a "normal human" is? Do you think any of those 179,221 chess players are "abnormal"?

<comment><USER23> To be in one's prime means to be productive, rational, social, and in good health. Not _past one 's prime_, not "elderly" \-- which is the particular term I was responding to.

I don't understand your (and others') focus on peak extreme-athletic performance, or peak chess-playing ranking. Why is it problematic to assert that people in their middle age are normally healthy, fully functional, flourishing human beings?

</comment></comment></comment></comment></comment></comment><comment><USER25> There are side effects to be aware of taking curcumin together with other medications:

"Medications for diabetes (Antidiabetes drugs) Interaction Rating: Moderate Be cautious with this combination. Talk with your health provider. Turmeric might decrease blood sugar in people with type 2 diabetes. Diabetes medications are also used to lower blood sugar. Taking turmeric along with diabetes medications might cause your blood sugar to go too low. Monitor your blood sugar closely. The dose of your diabetes medication might need to be changed.

Some medications used for diabetes include glimepiride (Amaryl), glyburide (DiaBeta, Glynase PresTab, Micronase), insulin, pioglitazone (Actos), rosiglitazone (Avandia), chlorpropamide (Diabinese), glipizide (Glucotrol), tolbutamide (Orinase), and others."

Turmeric might slow blood clotting. Taking turmeric along with medications that also slow clotting might increase the chances of bruising and bleeding.

Medications changed by the liver (Cytochrome P450 3A4 (CYP3A4) substrates) Interaction Rating: Moderate Be cautious with this combination. Talk with your health provider. Some medications are changed and broken down by the liver. Turmeric might decrease how quickly the liver breaks down some medications. Taking turmeric along with some medications that are broken down by the liver can increase the effects and side effects of some medications. Before taking turmeric talk to your healthcare provider if you take any medications that are changed by the liver.

Some medications that are changed by the liver include some calcium channel blockers (diltiazem, nicardipine, verapamil), chemotherapeutic agents (etoposide, paclitaxel, vinblastine, vincristine, vindesine), antifungals (ketoconazole, itraconazole), glucocorticoids, alfentanil (Alfenta), cisapride (Propulsid), fentanyl (Sublimaze), lidocaine (Xylocaine), losartan (Cozaar), fexofenadine (Allegra), midazolam (Versed), and others."

[https://www.rxlist.com/turmeric/supplements.htm#Interactions](https://www.rxlist.com/turmeric/supplements.htm#Interactions)

</comment><comment><USER26> Turmeric has been used in India since ancient times. There are many references to it in Ayurveda - the Indian/Hindu medical sciences. Ayurveda believes in using food as medicine to non only prevent a large majority of human diseases, but also to cure several of them — all with almost zero side effects. Turmeric is just one such extremely powerful & healthy food item that Western science seems to be playing catch up on. Many others like black pepper, honey, asafoetida (hing), coconut oil, copper utensils, cloves, cardamom, mustard seeds, neem (gold), milk, clarified butter (ghee). So, expect more things to come out from the research of Western labs, knowledge that is common to most grandmothers in India for ages. But the other aspect is that we are slowly losing all that because Indians try to mimic the West in almost everything they do & nowadays do not trust our own sciences like Ayurveda etc, even at the risk of debilitating side effects.

Side fact: An American company tried to patent turmeric & almost got away with it. This had to be fought by the Indian government to prevent (or nullify) the patent application.

<comment><USER27> >There are many references to it in Ayurveda - the Indian/Hindu medical sciences. Ayurveda believes in using food as medicine to non only prevent a large majority of human diseases, but also to cure several of them — all with almost zero side effects.

Homeopathy also has zero side effects (apart from having zero effects). There is no medical wisdom in any of the old texts (from any culture) that are relevant in 2018. The vast majority is pseudo-scientific nonsense that should be rejected.

>Turmeric is just one such extremely powerful & healthy food item that Western science seems to be playing catch up on. Many others like black pepper, honey, asafoetida (hing), coconut oil, copper utensils, cloves, cardamom, mustard seeds, neem (gold), milk, clarified butter (ghee).

All of those are known to the entire world, both their exaggerated benefits and their limitations. Sorry to burst your bubble.

>But the other aspect is that we are slowly losing all that because Indians try to mimic the West in almost everything they do &

You are severely confused. Do you take coconut oil when you get cancer? Or do you take Turmeric? If you get liver disease do you use copper vessels? Nobody cares where the idea originated. When it comes to their health, people will go where there are results.

> nowadays do not trust our own sciences like Ayurveda etc, even at the risk > of debilitating side effects.

That doesn't explain the success of pseudo-scientific products marketed under the "Patanjali" brand.

Also, there is no such thing as "Western science". Its a global science and people from around the world are contributing to it. Go into any research lab in the "west". You'll find a large portion of people there belonging to chinese and south asian heritage apart from the local ethnic majority.

<comment><USER28> > There is no medical wisdom in any of the old texts (from any culture) that > are relevant in 2018.

Seriously? We can do better than that - if you're going to make a statement that extreme, you'll need to provide sources to back it up.

<comment><USER27> The more extreme statement is that those texts have any value. Lets start with that first.

<comment><USER28> You're making some very, very broad, blanket statements about vast swaths of human experience and recorded wisdom (hint: that usually doesn't work out so well - nuance is our friend!).

But, to play along, in attempt to affirm or deny this - let's start with what you mean by "those texts". Which texts, specifically, are you referring to, when you say that they contain absolutely zero applicable content to the care of modern humans? (Where I'm paraphrasing your statement: "There is no medical wisdom in any of the old texts (from any culture) that are relevant in 2018").

edit:

you know what? I'll help you out with a single counterexample to your statement, so that we can move on:

[http://www.bbc.com/news/blogs-china- blog-34451386](http://www.bbc.com/news/blogs-china-blog-34451386)

[https://en.wikipedia.org/wiki/Tu_Youyou#Malaria](https://en.wikipedia.org/wiki/Tu_Youyou#Malaria)

To summarize, the plant Artemesia Annua was recorded approximately 2500 years ago in traditional Chinese medical herbal texts as being an effective treatment for the disease known as malaria. The 2015 Nobel Prize in Medicine and Physiology was awarded to the chemist who used this specific information from these texts to aid in the discovery of a compound that is now the defacto treatment for this disease.

There's plenty more examples like this; I will end my confrontation of your current system of beliefs here. The rest of this form of work is completely up to you!

<comment><USER27> >You're making some very, very broad, blanket statements about vast swaths of human experience and recorded wisdom (hint: that usually doesn't work out so well - nuance is our friend!).

I don't know about you, but when I read about applying dung into my wounds, I kinda lose interest in the remaining 4000 pages, and also happily forgo the 'ward off evil spirits' bonus that it brings.

>Which texts, specifically, are you referring to, when you say that they contain absolutely zero applicable content to the care of modern humans? (Where I'm paraphrasing your statement: "There is no medical wisdom in any of the old texts (from any culture) that are relevant in 2018").

Your paraphrasing is out of context. I am speaking about medical knowledge. Our knowledge has improved, but our flaws still remain. In other non-medical contexts, a lot of things would still apply.

Back to your counter point.

>the plant Artemesia Annua was recorded approximately 2500 years ago in traditional Chinese medical herbal texts as being an effective treatment for the disease known as malaria. The 2015 Nobel Prize in Medicine and Physiology was awarded to the chemist who used this specific information from these texts to aid in the discovery of a compound that is now the defacto treatment for this disease.

While that maybe be what is being reported it is not even close to the truth. The texts don't say "here's how to treat malaria". They don't even know what malaria actually is or how it works or anything about it. Traditional medicine applied a 'throw shit to the wall' approach (common in ancient times) to treat fevers using hundreds of different herbs. None of these actually worked, because there was no knowledge of what was causing those fevers (parasite/virus/disease etc). This is also why we don't treat malaria by giving someone a cup of herbal tea - it doesn't work.

What was a world record for a marathon a hundred years ago is barely the qualifying time for the Boston marathon in 2018. So yeah, The Chinese, Egyptians, Indians, etc all had their own world records. Its time to let them go. I prefer to take my medical science from the time when we know the most about the human body, not when we knew the least. You can make your own choice.

<comment><USER29> Knowledge is everywhere, science doesn't tell you to be narrow minded. If you deny human kind's past experiences, you would just end up reinventing the wheel. It is always hard to find the reason behind anything as it requires us to find the pattern first. Call it symptoms in medical science. Human kind has been doing it since its inception. Ancient texts are just there to help you out. Remember that there were no technological advancements as of today, still our ancestors had found reasons and solutions (cures in medical science) to many problems. You do not need to really trust anything, but what I am saying is that you cannot also simply deny it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> The wikipedia for curcumin suggests that it is not bioavailable. The results of this study are attributed to the supplement Theracurmin, which is a bioavailable form of curcumin. So maybe don't bother increasing your turmeric intake based on this study.

Lots of people won't realize that though, and by the time this research gets through the news cycle people will be buying turmeric in bulk. Good time to buy stocks in turmeric producers?

<comment><USER31> There isn't very much curcumin in turmeric. About 2% by weight. It would take 4.5grams of dried turmeric to get the same dose from the study. Admittedly it doesn't talk about bioavailability of turmeric powder.

<comment><USER32> Sorry to leave two comments in the same thread, but while I'm here... A tablespoon of turmeric weighs about 8 grams, so I don't see why 4.5 would be an unrealistic amount to consume per day.

Coffee is only about 1.8% caffeine by weight, but it gets the job done.

<comment><USER33> Nobody eats a tablespoon of turmeric! We usually use 1/4 teaspoon for a 4 person meal. Source: I'm Indian.

</comment></comment></comment></comment><comment><USER34> So is this outdated now?

> The review goes into four examples for which details are available, all of > them complete wipeouts, and those would seem to serve as good proxies for > the rest given that no curcumin trial has ever reported any convincing > positive results.

[http://blogs.sciencemag.org/pipeline/archives/2017/01/12/cur...](http://blogs.sciencemag.org/pipeline/archives/2017/01/12/curcumin- will-waste-your-time)

<comment><USER35> Looks like the original paper was published in Oct 2017; that critique is dated Jan 2017

<comment><USER36> there are a lot of papers on curcumin

</comment></comment></comment><comment><USER37> For every turmeric study claiming health benefits, I can also find a study finding none. It's one of the most controversial subject. Read several papers at least before deciding anything. It's even less clear when you try to evaluate curcumin vs turmeric.

<comment><USER17> >For every turmeric study claiming health benefits, I can also find a study finding none.

Which is why this should be filed under P for _publication bias_. If there are enough studies with 40 people, some of them will show positive results.

</comment></comment><comment><USER38> Did no one read the last bit on the people who did the research? there seems to a clear conflict of interest in this paper. " Dr. Small also reports having served as an advisor to and/or having received lecture fees from Allergan, Argentum, Axovant, Cogniciti, Forum Pharma- ceuticals, Herbalife, Janssen, Lundbeck, Lilly, Novartis, Otsuka, and Pfizer. Dr. Heber reports receiving consult- ing fees from Herbalife, and the McCormick Science Institute.The manufacturer of Theracurmin, Theravalues Corpora-tion, provided the Theracurmin and placebo for the trial,funds for laboratory testing of blood curcumin levels, and funds for Dr. Small's travel to the 2017 Alzheimer's As- sociation International Conference for presentation of the findings"

</comment><comment><USER39> I'm wary about where I source my turmeric from, because of Lead Chromate contamination: [https://www.bu.edu/sph/2017/04/04/high-levels-of-lead- detect...](https://www.bu.edu/sph/2017/04/04/high-levels-of-lead-detected-in- turmeric-purchased-from-boston-stores/)

<comment><USER40> Have any suggestions on the best sources to avoid this type of contamination?

<comment><USER41> Buy organic turmeric or grow your own. It's crazy that some Asian growers add lead on purpose - [https://www.naturalstacks.com/blogs/news/is-your-turmeric- co...](https://www.naturalstacks.com/blogs/news/is-your-turmeric-contaminated- with-lead)

</comment></comment></comment><comment><USER42> 30 total people with 15 on placebo seems like a very small sample size to me but a great study to maybe get funding for a bigger one for sure.

<comment><USER43> Everyone without statistical training thinks sample sizes are too small, but rest assured these studies are usually planned very deliberately. Power calculations are usually done in advance to determine the necessary sample sizes needed to demonstrate the magnitudes of different hypothesized effects according to a desired confidence level.

<comment><USER44> In this day and age one cannot "rest assured" about the quality of statistical practice in science. For example: [http://retractionwatch.com/2016/03/16/evidence-based- medicin...](http://retractionwatch.com/2016/03/16/evidence-based-medicine-has- been-hijacked-a-confession-from-john-ioannidis/)

</comment></comment></comment><comment><USER45> Don't know about the study-- it seems interesting but like more research is needed-- but I do know that if you throw a little turmeric on your broccoli or cauliflower or whatever, before you roast, the veggies come out extra delicious. My kids will even eat them without complaining. ;-)

<comment><USER46> Yeah, it's just a good, mild spice that turns food a beautiful golden color from rice to lentils. Health benefits would be a cool bonus but the vegetables you put them on are more obviously healthy anyways.

</comment></comment><comment><USER47> And in late breaking news, sales of bleach and clothes whitener are up worldwide as turmeric is discovered to be a potent yellow dye for clothes...

<comment><USER48> Hah, yes, its power to stain anything it touches requires no controversial studies to demonstrate.

<comment><USER47> ...small children, "lets cook", spice jar with stuck lid...

</comment></comment></comment><comment><USER49> I'm surprised no one has mentioned here that there's been research on using Turmeric as an antidepressant. It's known to increase BDNF in the brain, the same protein generated during aerobic exercise. BDNF is one of the reasons exercise is so beneficial for mental health.

"Antidepressant-like effects of curcumin in WKY rat model of depression is associated with an increase in hippocampal BDNF" ([https://www.sciencedirect.com/science/article/pii/S016643281...](https://www.sciencedirect.com/science/article/pii/S0166432812006997))

"Effects of curcumin on brain-derived neurotrophic factor levels and oxidative damage in obesity and diabetes" ([http://www.nrcresearchpress.com/doi/10.1139/apnm-2013-0133](http://www.nrcresearchpress.com/doi/10.1139/apnm-2013-0133))

</comment><comment><USER50> I also heard turmeric is an antibiotic.

Here is at least one study I found on it:

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4374920/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4374920/)

So I wonder if helps because it alters the bacterial flora in the body.

<comment><USER51> Taking general-purpose antibiotics is usually not a great thing for your gut, since it doesn't discriminate.

Now, if it more selectively nuked some nastier things, I could buy that.

</comment></comment><comment><USER52> Glanced at the study. The supplement appeared to be 90mg of curcumin, taken twice daily.

A quick google search says there are about 15 mg per tablespoon. That would mean you'd need to eat about 6 tbsp of turmeric to get a comparable amount. Probably even more so, since I don't think turmeric is pure curcumin. For reference, the average curry or other dish using turmeric in my household takes about 1 tbsp, so at a glance I would consider it impractical to get that much naturally through your food.

My next curiosity would be whether a smaller amount _can_ show similar benefit, or whether it needs to be at a level only available in a supplement.

<comment><USER53> I think your numbers might be off. From [https://www.livestrong.com/article/543411-how-much- curcumin-...](https://www.livestrong.com/article/543411-how-much-curcumin-is- there-in-powdered-turmeric/) :

"Turmeric contains approximately 2 percent curcumin by weight, so a tablespoon of turmeric, which weighs 6.8 grams, contains about 0.136 gram curcumin, or 136 milligrams."

So that means the study quantity was equivalent to about two teaspoons a day.

</comment></comment><comment><USER54> I'm very surprised to not see any Dune comments in this thread.

<comment><USER55> There are if you interpret "bioavailability" as "THE SPICE MUST FLOW."

</comment></comment><comment><USER56> So, just as a sanity check, would we expect to see 30% less depression in country sized populations where turmeric consumption is common - for example is India less depressed than, say, USA. And how on earth do we control for it?

<comment><USER57> No. For 3 Reasons.

1\. The 30% number was for memory, not depression.

2\. Also it says that it may "ease" depression, not eliminate it. So you would still have the roughly the same numbers of depressed people, but they may rate their depression slightly lower.

3\. The definition of depression might be slightly different in a different country, so even a basic sanity check is still going to need to look at individual subjects and evaluate depression levels before and after turmeric treatment.

</comment></comment><comment><USER58> It's well known that turmeric is a powerful anti-histamine. Interrupting inflammation will make you feel better; but whether you're doing yourself good or harm in the long run is a very different matter. The body's responses aren't always wrong. [https://www.ncbi.nlm.nih.gov/pubmed/?term=turmeric+histamine](https://www.ncbi.nlm.nih.gov/pubmed/?term=turmeric+histamine)

</comment><comment><USER59> If this is real, we Indians have the best memory on the planet and the lowest depression in the world.

With the UK a close second after the appropriated all out "curry" recipes.

Colour me skeptical.

<comment><USER60> > Colour me skeptical.

Can also be arranged, as long as the colour of sceptical is an off-orange shade.

</comment></comment><comment><USER61> If your interested in 'food as medicine', Watercress is very interesting, "This is the first study to report an effect of vegetable consumption on metabolism of a lung carcinogen in humans."

[http://cebp.aacrjournals.org/content/4/8/877.short](http://cebp.aacrjournals.org/content/4/8/877.short)

Seems it inhibits CYP2E1, here's a long list of the interactions between drugs and the genes CYP2D6 and CYP3A4 [https://liferaftgroup.org/long-list-of- inhibitors-and-induce...](https://liferaftgroup.org/long-list-of-inhibitors- and-inducers-of-cyp3a4-and-cyp2d6/)

[edit] Pharma-Nutrition is the buzzword for this, one only needs to look at the acquisitions of nutritional science assets by big pharma. The book is a bit expensive but there is some previews;

[https://www.amazon.co.uk/gp/product/331906150X/ref=oh_aui_se...](https://www.amazon.co.uk/gp/product/331906150X/ref=oh_aui_search_detailpage?ie=UTF8&psc=1)

</comment><comment><USER62> I forgot to mention, Turmeric is a natural antiseptic. Can be applied to small cut wounds and protects from infection. [https://www.ncbi.nlm.nih.gov/books/NBK92752/](https://www.ncbi.nlm.nih.gov/books/NBK92752/)

</comment><comment><USER63> Couple questions...

I've read that Bromelain (from Pineapples) can help with sinus inflammation. Is there any indication about Turmeric helping with sinus inflammation?

Silly question...is "inflammation" one thing? As in do brain inflammation and sinus inflammation go together?

Finally, any resources on reducing inflammation generally?

<comment><USER64> Reducing inflammation is surprisingly easy, which is why most people just don't do it (they want an expensive magic pill instead of just using methods that actually work).

First, remove the largest inflammatory things from your diet: no grains, no refined sugars, no processed meat, no dairy (unless it is truly fermented, such as hard cheeses and true greek yogurt), and no legumes.

Second, walk about 2 miles a day (at least 5000 steps), and frequently (preferably every two days, but not everyone can do it this frequently) do lifting, preferring higher weight over higher reps.

Third, sleep properly. Enforce a proper sleep schedule as if it's the last thing you do, even if you have to wear sleep masks and avoid bright and/or blue artificial light like the plague.

Fourth, after the first one, still make sure you're getting the proper nutrition (focus on your minerals, you never get enough), and you may still have to supplement with a good vitamin. NOW Adam softgels is the least expensive one I know of that isn't garbage, and is a good base to build a supplement program around (if you choose to do that).

<comment><USER65> Not only is there strong anecdotal evidence for legume consumption being healthy given the prevalence of legumes in blue zone diets, there is also a mountain of scientific evidence indicating the short chain fatty acids produced by fermentation of legume polysaccharides provides a large number of health benefits. Additionally, low fat non-greek yogurt consumption has been linked to a variety of positive health outcomes. Finally, moderate grain consumption is alright assuming you're physically active and the grains are unrefined. If you spend more time studying the scientific literature you will see that the paleo diet is mostly trendy bullshit.

In terms of training, high repetition weight training is absolutely beneficial, while being much easier to recover from than lower rep weight training. While it shouldn't make up the majority of your training, it is worth making a significant portion of your total training volume.

<comment><USER64> Notice you say _fermented_ legumes. There may be a place for them, but the jury is still out on that.

Low fat yogurt often contains sugar for flavoring (out of necessity due to removing both it's natural flavoring, and as a byproduct, a lot of it's nutritional value), so that's out altogether. In addition, scaremongering fat has no scientific basis, and is generally frowned upon by anyone that is actually following science-based diets. On top of that, the greeking process, which strains it to remove excess whey, also removes the remaining lactose and other compounds that tend to trigger inflammation in some people.

In other words, non-greek and/or low fat yogurt is a uniquely American fuckup of an otherwise healthy food.

As for high rep/low weight, "no". You shouldn't do it instead of low rep/height weight, but if you do decide to do it, you should do it _in combination_. One of the best ways to combine both is drop weight sets to maximize both time and effort in the gym.

<comment><USER65> Legumes are automatically fermented by the bacteria in your gut, that's why they make you gassy. There's a ton of science on short chain fatty production by gut biota having beneficial health effects. I'd go so far as to say high fermentable fiber intake is the most important aspect of a healthy diet.

Greek yogurt is marginally better than non-strained yogurt, but you can make regular yogurt at home for a few dollars a gallon while greek yogurt is pricey.

You demonize sugar, but it is only a problem for sedentary people who overeat. The problem is that monosaccharides are reactive molecules, and they can participate in harmful chemical reactions if floating free in the blood. If (liver) glycogen is depleted then those monosaccharides are polymerized into glycogen before they can enter circulation, and they are essentially harmless. If you're active don't eat too much moderate amounts of sugar are fine.

As for your "no" comment regarding my training advice, I'm 220lbs and ripped at 6ft. tall. I've deadlifted 600lbs for reps at nearly 40 years old. All of this without drugs. What have you accomplished?

</comment></comment></comment></comment></comment><comment><USER66> "What I've learned" just did a video on tumeric for hangovers. Summary: mix it with pepper and fat for best results. [https://youtu.be/Ij_aJI5O9Rs](https://youtu.be/Ij_aJI5O9Rs)

Tumeric may also help with ulcerative colitis. Here's a summary of the studies: [https://youtu.be/teJ9QHCdN2Q](https://youtu.be/teJ9QHCdN2Q)

Avoid tumeric if you are taking blood thinners.

</comment><comment><USER67> What happens to the bioavailability of turmeric when you put it in your food for cooking purposes? I know turmeric is a common ingredient in Indian foods.

</comment><comment><USER68> My dad drinks a cup of turmeric tea every night. Its seems like people have always known it was good for you but its good this study proves it.

</comment><comment><USER69> For those who want to try the turmeric directly and without preparing curry, you can take it this way. This is a traditional recipe for cold/flu but can be generally taken everyday. Mix a half teaspoon full of turmeric with little bit of black pepper powder (varies based on how much you can tolerate) in a glass of milk with either a spoon of sugar or honey.

</comment><comment><USER64> Even more fun: "Vanillin Affects Amyloid Aggregation and Non-Enzymatic Glycation in Human Insulin" [https://www.nature.com/articles/s41598-017-15503-5](https://www.nature.com/articles/s41598-017-15503-5)

Vanillin is a metabolite of curcumin, which is the medicinal chemical of note in turmeric.

</comment><comment><USER70> As an athlete (and former competitive snowboarder) I find turmeric tea to be a more powerful pain reliever for my knees, which have little cartledge left, than Advil. I make my tea with fresh turmeric, black pepper, honey and a bit of cream. This recipie seems to work wonders for joint pain however it doesn't seem to have improved my forgetfulness.

</comment><comment><USER71> Here is another research published recently by BMJ about benefits of curcumin for cancer (myeloma) patients:

Long-term stabilisation of myeloma with curcumin [http://casereports.bmj.com/content/2017/bcr-2016-218148.long](http://casereports.bmj.com/content/2017/bcr-2016-218148.long)

</comment><comment><USER72> There are many benefits to turmeric. I've been using it in a lot of things for a while now

[https://www.healthline.com/nutrition/top-10-evidence- based-h...](https://www.healthline.com/nutrition/top-10-evidence-based-health- benefits-of-turmeric)

</comment><comment><USER73> I had heard of the positive effects of tumeric/curcumin but this is just on another level.

</comment><comment><USER74> I was not expecting to be linked to what appears to be properly conducted science based trial. As others have noted the sample size was small at 40 people which just leads me to looking forward to a larger scale controlled study.

</comment><comment><USER75> It is a great spice to use in your cooking. But use only a pinch, it is very potent.

<comment><USER76> It also seems to stain chopping boards.

<comment><USER75> Yes, it can stain skin as well. Actually, you can apply it to the skin (via a recipe) to make it vibrant. This is common practice in India. I usually get turmeric powder (unadulterated) instead of raw.

<comment><USER76> And kitchenware for a couple of wash cycles too, I've found.

Only reason I've used the root is when I'm out of ginger. Not perfect substitute, but, meh, kind of okay.

</comment></comment></comment></comment><comment><USER77> Is the interesting thing that turmeric has anti-inflammatory properties or that reducing inflammation eases depression and boosts memory? There are many ways to reduce bodily inflammation...fasting and keto come to mind.

</comment><comment><USER78> Indians will die of heart attacks and cancer before they become old enough to get alzheimers or other mental issues. Before you downvote me to oblivion, many indian and non-indian dr.s friends have told me this.

<comment><USER79> As others have pointed out, there is hardly enough bioavailable curcumin is regular turmeric powder. This study used a supplement called theracurmin which is a specially crafted form of high bioavailability theracurmin.

<comment><USER78> what if you put it on almost everything?

</comment></comment></comment><comment> dnt404-1 Turmeric is a base spice used in many dishes from South Asian Indian subcontinent. It is good news if this has positive benefits. Maybe country comparative research can provide more evidence.

</comment><comment><USER80> Just some quick questions regarding the volunteer flow chart in the paper (sorry for those of you behind a subscription paywall). What do the authors mean when a patient was excluded for an abnormal MRI? Why were only 30/40 of the remaining participants' PET scan data analyzed? Was it due to sufficient power?

Some other random questions

The authors used a "t test" for continuous measures of data. What kind of t-test though? Since these are repeated measures over time, I have been told a dependent t-test is needed. Is that what was used? PROC MIXED in SAS has a parameter for "repeated" measures, so I would assume so but it's really not clear.

Very interesting paper, and I will hopefully be reading it in full shortly.

</comment><comment><USER81> Anti-inflammatories are in the news lots now. Low-dose aspirin, intermittent fasting, turmeric. Why are we chronically inflamed?

<comment><USER82> Pollution.

<comment><USER83> Currently there are a studies [1] suggesting Alzheimer's is an inflammatory disease where a bunch of different particles like micro-plastics, heavy metals, microfibers, etc accumulate in the brain causing a brain immune response (amyloid beta and tau) that is more dysregulated in people with certain genetic backgrounds.

Honestly I think this hypothesis makes the most sense - especially if you look at Alzheimer's global and local distribution patterns. Locally people near freeways get Alzhiemer's at way higher rates [2] (I've seen interesting maps of this before but can't find any ATM).

Think about all the particulate matter (incomplete combustion products, rust particles, little pieces of tire) you are breathing in near freeways.

Globally industrial countries have the highest rates of dementia, and the lowest rates are in Africa, India, and South Asia [3]. These places have less industry, less traffic, less plastic (I mean, they are catching up fast, but historically if you're looking at patterns), etc.

[3] also mentions a correlation between meat eating and dementia. I don't necessarily think this is due to the "any meat is bad for you" FUD instead it's most likely due to two factors

\- plants have greater anti-inflammatory properties

\- any type of fat will accumulate loads of particles and plants don't have fat

tl;dr nutrition is complicated and there is a lot of FUD

\- [1] [https://newsroom.ucla.edu/releases/alzheimers-disease- consis...](https://newsroom.ucla.edu/releases/alzheimers-disease-consists-of- three-distinct-subtypes-according-to-ucla-study)

\- [2] [http://www.latimes.com/science/sciencenow/la-sci-sn-air- poll...](http://www.latimes.com/science/sciencenow/la-sci-sn-air-pollution- alzheimers-20170131-story.html)

\- [3] [https://nutritionfacts.org/2015/11/12/where-are-the- lowest-r...](https://nutritionfacts.org/2015/11/12/where-are-the-lowest-rates- of-alzheimers-in-the-world/)

</comment></comment></comment><comment><USER84> In Japan they have been drinking turmeric tea for ages. This is an easy option for you if you'd like to try it out.

</comment><comment><USER85> What doseage though? I've read that it does have a lot of good properties but you'd have to eat pounds of it

</comment><comment><USER86> So do you have to eat a pound of it? A lot of studies now a days shows significant effects only in significant amounts

</comment><comment><USER87> I see turmeric root in grocery store. How would this compare to say a powdered turmeric?

</comment><comment><USER88> I'll add it to my kael, coconut oil, avacado smoothie.

<comment><USER15> If you're going to overtly retro/exotico-stylize then why not go the whole hog with _kæl_? :)

</comment></comment><comment><USER89> Anecdotal but my grandfather with severe rheumatoid arthritis takes two glasses of of water with tumeric every day and has said he notices significant benefits.

</comment><comment><USER90> turmeric can be expensive, I bought a few bottles last year, I should investigate how to grow some home.

<comment><USER91> Fresh turmeric root cost dollars, find a local asian grocery store and make your own. It's great as a tea.

<comment><USER90> I'm on tetley green tea these days, it's lovely. Thanks for the tip.

</comment></comment></comment><comment><USER92> I've just added some turmeric on my 256 Gb SSD and its memory increased to 332 Gb. It works.

</comment><comment><USER93> It's also delicious

</comment><comment><USER94> Eating and living healthy is critical to a long life. Most studies show that balanced eating is more important to your health than exercise so it is no wonder mother nature provides so many natural remedies for so many ailments. Setting smart health goals is one thing, [https://latechnews.org/setting- smart-health-goals/](https://latechnews.org/setting-smart-health-goals/) but improving your mental health through natural remedies is always preferred in the holistic approach.

</comment><comment><USER95> also look at other types of nootropics [https://en.wikipedia.org/wiki/Nootropic](https://en.wikipedia.org/wiki/Nootropic)</comment>


New open source Disqus alternative: Debiki Embedded Comments - <AUTHOR>

Hi,
I've built an embedded comments discussion system:

  http://www.debiki.com/embedded-comments
 It's open source so you can install it on your own servers. It's available as a service too, in case you don't want to host it yourself.
It's a bit different from Disqus and LiveFyre:
 - It has Wiki-like features
 - It uses a novel 2D layout that hopefully contributes to a more varied discussion
 - It has some features intended to save people's time
Would you like to use it? What should I change and improve? (I could make the 2D layout optional for example.) What do you think about the overall concept? Feedback very welcome.
Best regards,<AUTHOR> <comment><USER2> This is interesting, and I am glad to see people trying out various ideas.

That said, I don't think the 2D scrolling is for me. It is too easy to get lost on the page. I can see where this would work for tablets, but for laptop/desktop with a mouse/trackpad it feels like too much work.

Still, I've bookmarked your site because I'm interested in this space (Disqus competitors).

Good luck!

Also,

</comment><comment><USER3> Ben from Livefyre here. I think this is pretty darn awesome.

Most of you probably tend to see our Comments product around the web, but my job is to use our real-time CMS web services to make other embedded webapps. If I do my job right, there's no reason someone couldn't use their free Livefyre Community site to power a real-time Debiki embedded app.

Check out what we've done with other apps built on the platform: [http://apps.livefyre.com](http://apps.livefyre.com)

And the JavaScript SDK we write to power them all: [https://github.com/Livefyre/streamhub- sdk](https://github.com/Livefyre/streamhub-sdk)

Would any of you with alternative visions for the UX of comments or annotations find it interesting to be able to build the client however you want (or use an open source one) but delegate server traffic, storage, and real-time pubsub to a free backend as a service?

<comment><AUTHOR> Hi Ben,

Would it be possible to use some LiveFyre API to write a script that migrates comments from Debiki to LiveFyre? So that it would be possible to shut down one's account at Debiki and migrate comments to LiveFyre instead.

If so, is [https://github.com/Livefyre/streamhub- sdk](https://github.com/Livefyre/streamhub-sdk) the API to use?

</comment></comment><comment><USER4> Love the concept. I've thought about comments a lot, and considered this sort of design. in execution, though, it's hard to get used to.

Still feel like Slashdot might have had the best comment system yet.

</comment><comment><USER5> Interesting timing, as I came up with my own implementation last week:

Code: [https://github.com/skx/e-comments/](https://github.com/skx/e-comments/)

Demo: [http://www.steve.org.uk/Software/e-comments/demo.html](http://www.steve.org.uk/Software/e-comments/demo.html)

This was built for my server-optimizing site, [http://tweaked.io/](http://tweaked.io/) which is still in its infancy.

<comment><AUTHOR> Nice! I had a look at the demo. What motivated you to write it? What features does it offer that Isso and Juvia does not?

(I noticed you listed some features, but I don't know which of them, if any, are also provided by Isso and Juvia.)

</comment></comment><comment><USER6> This is pretty cool. Is there currently a way to permalink directly to a specific section of the thread on the horizontal?

<comment><AUTHOR> Not right now, but I've been thinking about adding this.

(When using Debiki in non-embedded mode, it's already possible, by appending a `#post-12345` hash to the URL, e.g.: [http://example.com/forum/topic#post-12345](http://example.com/forum/topic#post-12345) )

</comment></comment><comment><USER7> Thanks for creating this, will be testing this soon.</comment>


A guide to preventing SQL injection - <AUTHOR> http://bobby-tables.com/

<comment><USER2> Both the guide and the strip are inaccurate. Parameterized SQL statements are also vulnerable to injection: you can't parameterize identifiers, only values. So any dynamic column references, dynamic sort orders, or dynamic limit statements remain injectable.

To see why this matters, consider every data table view ever implemented in any web app: table columns are selectable with checkboxes, you can click the columns to change sort order, and the data is paginated.

You should obviously be using parameterized queries. They are clearly more secure than concatenated SQL queries. But they aren't a magic totem against injection, and we have much better resources for developers than XKCD. Start with (yes really) Microsoft:

<http://msdn.microsoft.com/en-us/library/ms161953.aspx>

<comment><USER3> Do people really use variables based on raw userdata to select table/columns? Seems like an incredibly rare case, and bad design. I've never seen/used it.

Parameterized queries _are_ a magic totem against injection, unless you mix them with concatenation of unclean userdata. Which would be silly.

<comment><USER2> Of course they do. Sort columns send "ASC" and "DESC", pagination limits and offsets are sent in offset= parameters, etc. How else do you think people do it, other than the most obvious way?

Don't make the problem even worse than it is by trying to downplay it just because _you_ know what you're doing.

<comment><USER3> OK you got me on those 2 cases. For sort order:

$sort_order=="ASC"?"ASC":"DESC"

For offsets and limits convert/parse it to a number first and ensure it's within sane bounds.

You're right though. Parameterization isn't a magic bullet that allows you to forget about all other unclean data _if_ you're using other unclean data in an SQL query.

Surely _we_ all know this though? :/

<comment><USER2> My advice is, pass page= as your pagination and pass 1/0 in for ASC or DESC. If you have selectable columns, number them in the parameters, don't name them.

Point being, when you compose the query, you should never be inserting text from parameters; you should be converting parameters into known-good values.

</comment></comment></comment></comment></comment><comment> brown9-2 I think it might be a bit more helpful to explain to people _why_ or _how_ parameterized queries are better than "doing it yourself" for this sort of thing.

<comment><USER4> I'll take a stab at it.

If you think you are good enough to write code resistant to SQL attacks, you are wrong. If you think the best coder in your company is good enough to write code resistant to SQL attacks, you are wrong. Now realize that it is neither you nor the best coder in your company that you have to worry about, but the performance of the worst guy employed by the team in Bangalore on his first day back at work after his mother's funeral.

All code by necessity has a weakest link. The best you can do is make sure it is the library you are using.

(Incidentally, this also describes manual memory allocation.)

<comment><USER2> Sigh.

You're still "doing it yourself" even if you use parameterized statements.

My take on this article has changed in the past hour; before I thought it was cute but inaccurate, but its state is transitioning to "actively evil".

The reality is that companies that have a lot of SQL but never have SQLI vulns do _all of the following_ :

* Use an ORM like Hibernate (or AR or Django) for "front-line" database queries

* Standardize on parameterized statements for the complex stuff

* Design and implement a "house style" for query builders and "modular" SQL statements

* Factor as much as possible into stored procedures in the database

* Run databases in least-privilege mode, so that code that only needs read access to a few tables can "revoke" the unneeded privileges

* Sweep their codebases for SQL statements and audit them with a team signoff

By "do all of the following", I mean "A-L-L of the following". The ones that don't are the ones that tell us "there's no way you're going to find SQLI in your audit; you'd get fired for having concatenated SQL here", and then lose their entire database in the first week.

I don't mean to sound obnoxious. I just hate the idea of people walking around thinking their code is safe because they switched to ? instead of "'" + x + "'".

<comment><USER5> Edit: errr, nevermind. I read your posts further down.

Well to be fair, the article isn't claiming that parameterized queries will make all your DB transactions secure, just that they will prevent injection attacks. Which is true isn't it?

Unless you have dynamic code generation in your sql, parameterized queries make injection attacks impossible, don't they?

<comment><USER2> No, statictype. It isn't true.

</comment></comment></comment></comment></comment><comment><USER6> So why can't I use mysql_real_escape_string? Let's assume that I have to use PHP and there's no way in hell this app is ever going to need to be ported to a different db. (Or wrap it in a "quote" method.)

Edit: Instead of a downmod, how about an answer?

<comment><USER7> I think, escaping the input from the user in some way is a way which might work, but basically does not address the core issue of sql-injection attacks, pretty much like putting transparent tape over a crack in a window. It sort of works against most known cracks, but there might (and in security-terms, that means: there will) be a crack which cannot be taped well.

But, analogies are no good, let's get to the core of this.

Executing an sql-statement basically means that the server parses, optimizes and executes the statement. Whenever you type something like

      "Select name from dogs where tag=" + mysql_real_escape_string($user_tag)

you assume: the server will parse this query as a select-statement, with the field 'name' selected, whereas the table to examine is 'dogs' and there is some predicate on the tag, and some properly secured value goes into the predicate.

If an injection attack is successful, the assumption that the parsed SQL- statement and the SQL-statement in the code match fails, because a successful SQL-injection infiltrates the actual structure of an SQL-statement and modifies it pretty much arbitrarily.

Now, it is true that it might be possible to escape all known possible user inputs (which might be possible, as SQL should not be turing complete, but I am not sure about the newest standards), so the user input cannot infiltrate the structure of the SQL-Query, because in the user input, no control characters are working. But this is, as I said, mostly like saying: Well, there is a hedgedog on your chair, so use a pillow before you sit down or it might hurt both of you. It does not address the core of the problem.

The core of the problem is: you are doing two things at once. You are transmitting the actual (static) query you want to execute -- the structure of the query -- and the actual values in a single go. The real way -- parametrized queries -- first transmit the structure and after this, they transmit the value. Thus, it is guaranteed that the parsed structure in the database will be exactly the structure you specified in your code, and thus, an attacker cannot modify the structure of your query by inserting values into the structure, because at this point, it is clear that the values are values, and not actual structure code. And this is the reason, why parametrized queries are better than assuming that a certain function (or multiple functions, who knows) can handle ALL possible injection attacks any hacker (or cracker :/) genius might ever think of. Transferring the structure first and the values separately is like picking the hedgehog up, sitting down and having a happy hedgehog sitting on your lap ;)

Note that I am aware of the problem that this just guarantees that the _structure_ of the query is transmitted properly. If the _structure_ of your query allows arbitrary _behaviour_ of your query via appropiate values ('if param1 == "admin" then eval param2' sort of rings), then attacks are possible again. However, these attacks are different from the sql structure injections, because these attacks do not aim to modify the structure of your query, but they rather aim to abuse the behaviour of your query. If you like to think in analogies, a structure injection would be like patching the linux kerlen somehow to get a backdoor going, while a value attack against a query with dynamic behaviour is more like replacing the 0-page with arbitray code doing nasty things.

Also note that not using parametrized queries with dynamic behaviour opens up _two_ attack vectors: Attacking the structure of your query (bobby tables) and abusing the behaviour of your queries.

And also note, that securing a single query (or, all queries in your application) is also no substitute for actually securing your database server, because overall, your data is the goal of an attacker. The data is the money, not the application. Thus, your application is just another attack vector against your actual data base and your actual data, and your application consists of more or less attack vectors (which might be injection attacks, behaviour attacks, attacks via session hijacking, ...). Thus, you might use good queries, but if every user has weak passwords and also maximum privileges in the database, an attacker will ignore the application and probably try to attack the database directly.

Sorry for the wall of text, I just wanted to answer this and did not have that much time to make it shorter, HTH, Tetha

</comment></comment><comment><USER8> Also remember that parameterized queries are likely to be faster. They play better with the optimizer cache.

</comment><comment><USER9> Hate to sound pedantic, but the Java example is a little off. java.sql.PreparedStatements have their parameters start at index 1, not 0. So the first "?" is parameter 1 and the second is parameter 2.

It's one of the few places in Java where indexing starts at 1 instead of 0.

<comment><USER7> ... which probably is the reason he got it wrong. Consistency is a blessing.

</comment></comment><comment><USER10> This is similiar to the advice to NOT write your own encryption code: Odds are, somebody already wrote it 10 times better than you could.

</comment><comment><USER11> Why did they not include PHP?

</comment><comment><USER12> Someday every xkcd strip will have its own website.

      (that wouldn't be so bad actually)

<comment><USER13> So if you want comic-strip security, just go to this site. Perfect.

<comment><USER13> Why the downvotes? It's a superficial glance at SQL injection fixes with little explanation or education. Just like you can't put a novel in a comic- strip, you can't explain SQL injection security with a single block of code.

</comment></comment></comment><comment><USER14> I was expecting some kind of PHP bullshit about replacing quotes.

The article turned out to be actually good. Cheers.</comment>