AI Beats Four Top Poker Players - <AUTHOR> http://www.bbc.co.uk/news/technology-38812530 <comment><USER2> Anyone that's interested in reading a more detailed account of the experiment can do so here:

[http://www.pokerlistings.com/libratus-poker-ai-smokes- humans...](http://www.pokerlistings.com/libratus-poker-ai-smokes-humans- for-1-76m-is-this-the-end-42839)

The above article spells out some of the details of the competition. The winrate (14.72bb/100) that the AI achieved over the 120k hand sample is almost certainly not due to luck. It is a huge winrate that most pros have to employ strong game selection techniques to achieve (only play against bad players).

Here's a layman's explanation of how a poker AI can be trained: [http://www.pokersnowie.com/about/technology- training.html](http://www.pokersnowie.com/about/technology-training.html)

And some details about the weaknesses resulting from how they've abstracted the game: [http://www.pokersnowie.com/about/weaknesses.html](http://www.pokersnowie.com/about/weaknesses.html)

<comment><USER3> That's pretty impressive, the win rate and amount of hands played. It's certainly not a fluke. At the same time, these 4 pros, I've never heard of them. This AI and organizers should focus on HU specialists. Perhaps even invite players like Negreanu, Ivey, and more recent online pros who've made a fortune. Just don't let Hellmuth to play this machine, it would be a disaster.

<comment><USER4> These pros are considered to be top 20 HU online specialists, they would destroy Negreanu and Ivey over the long run at this particular variant (which they have played millions of hands at).

<comment><USER5> Back when I played poker (up to ~2010), Negreanu was mostly a celebrity, as well as a pretty good blog writer. He was no match for the best pro players, but perhaps he has dramatically improved.

Ivey was pretty good at managing his image, too.

<comment><USER6> Say that all you want, those guys play(ed? I'm out of the loop) in the big game, and...whoever you're thinking of, basically--didn't.

<comment><USER7> Conversely, not many of the celebrity players have had much success playing online. Ivey did have some good years but even he has been struggling for the past few years.

Almost all pros who have had success both online and live agree that live games a ridiculously soft compared to online games. The reason more online pros don't play live is because you have to live in Las Vegas or Macau to play a the highest stakes, or you have to be invited. Also, the big live games are usually mixed games that don't afford a huge edge to online pros who specialise in a few games.

<comment><USER6> I don't dispute any of that, I simply dispute whether or not Negreanu is a "top pro," or whether he would be a match for "the top pros."

He is a top pro. Not in HU cash. He couldn't hang with these guys at HU cash, at least not with his current skill in the discipline. But hey, poker is not that narrow of a term. It includes all kinds of disciplines, live and online, horse and stud and hold 'em, the list goes on.

Those same "top pros" who Negreanu wouldn't play HU Cash wouldn't sit in the big game with him.

Arguably bankroll management is the most important skill of a top poker professional, and that's maybe what big-game players are best at.

Also, a small caveat to all of your comment is that live games are soft compared to online games _of the same limit._ There is no online equivalent of the big game, or at least there wasn't when black friday hit and knocked me out of the professional poker scene.

<comment><USER7> There is no question that Daniel Negreanu is a very good tournament player, possibly one of the best. I don't think there is any evidence that he is anywhere near the top when it comes to cash games of any popular variety.

And while bankroll management is certainly an important and required skill to endure as a professional poker player at any level, it is by no means what differentiates high-stakes pros from pros at the lower levels. There are lots of small stakes and mid stakes players who practice sensible bankroll management, but who will never acquire the skill necessary to make it at the highest levels. If you want to get a sense of how much skill goes into playing poker at the highest level, you should watch some of Phil Galfond's strategy videos on YouTube (see for instance [1]). Poker strategy has come a _long_ way since Super System[2] and The Theory of Poker[3]. Even players who were considered very good just five years ago, can no longer compete at the highest levels.

[1] [https://www.youtube.com/watch?v=khdoSFCQ9iA](https://www.youtube.com/watch?v=khdoSFCQ9iA) [2] [https://en.wikipedia.org/wiki/Super/System](https://en.wikipedia.org/wiki/Super/System) [3] [http://www.twoplustwo.com/books/poker/theory-of- poker/](http://www.twoplustwo.com/books/poker/theory-of-poker/)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Andrew Ng posted a comment about this on facebook: "I'm thrilled about Libratus' Poker triumph--this is a huge step for AI. Othello/Checkers/Chess/Go were theoretically solvable with minimax tree search and sheer computation; but poker, which requires bluffing, needs sophisticated modeling of your opponents and new algorithmic principles. CMU's Tuomas Sandholm has also (in a private email) promised to publish their algorithms, which I look forward to. Congrats CMU!!!" [https://www.facebook.com/andrew.ng.96/posts/1260889373966967](https://www.facebook.com/andrew.ng.96/posts/1260889373966967)

<comment><USER9> I'm surprised that Andrew Ng made this claim. The strategy that was built for Libratus' predecessor did not do sophisticated modeling of the opponents, or use new algorithmic principles.

Poker is solved using a very large game tree, just as with the other games. The structure of the tree is modified to support the notion of hidden state, but beyond that it is essentially the same as the other games. The structure for representing hidden nodes was developed in the 1950s by Von Neumann. Most of the algorithmic innovations related to how to update the game tree.

My guess is that the primary innovation for the Libratus strategy was that of scale.

<comment><USER10> This was my thought too. Poker is quite "solvable" meaning, whenever you're confronted with a decisions -- there is always a "correct" answer which does not have to depend on the other players' behavior or style. And you can find that answer by simulation, or game trees, and other methods.

It's also important to keep in mind that the best AI can still lose, and the worst AI can still win (and everything in between). Poker involves randomness, obviously whereas chess/go/etc does not.

<comment><USER11> That depends on what you mean by "correct". Sure, you could theoretically find Nash equilibrium of poker and by playing the equilibrium strategy, you can ensure you won't lose. But that does not mean this is the best strategy to use at a given table against the given opponents, who (being imperfect humans) almost certainly do not play the equilibrium strategy themselves. And, by playing a proper nonequilibrium strategy, suited to the specific players, you can win more.

<comment><USER9> The usual way these games are solved is to create an "abstract" game which is tractable, find the Nash equilibrium, and map state in the real game back to the "abstract" game. In the limit, the solutions for a well designed "abstract" game will converge to that of the real game.

<comment><USER11> You are explaining how current algorithms try to find the (approximate) Nash equilibrium (and those algorithms are far from perfect; as noted in the recent DeepStack paper, current abstraction-based programs are beatable by over 3000 mbb/g, which is four times as large as simply folding each game). But my point is that even the (exact) equilibrium strategy would not necessarily be the best strategy against given non-equilibrium-playing players.

<comment><USER9> Yes, you are correct on every point. Opponent modeling and exploitation is significantly more difficult than coming up with a Nash equilibrium to an abstract game.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> it won't be long before we hearing more headlines like:

"AI beats top 10 hedge fund managers"

to

"AI run hedge fund blows up due to black swan event"

regardless it's an incredible feat. It really casts questions into what our edge as humans are which is slowly disappearing and we didn't even need to put a brain in a jar and hook it up to a computer....it's deep learning reinforced algorithms that is appearing to outlearn, outthink the best of humans.

I just can't emphasize what a monumental period in history we are at. Humans are producing specialized algorithms that learn and hold information about the deep web of relationships between myriads of parameters to produce superior performance than humans.

It's almost like we've uncovered ways to automate our intelligence very much like we've been automating human and animal labor in the past couple centuries.

So the question is, how does an average joe hacker like me exploit and leverage this wonderful thing called deep learning? I'm not interested in reading PHD papers with advanced calculus.

I want to have a map of what AI, ML, DL, NN methodologies to use and when and who to hire based on that. This is no time to be a luddite and don't count on basic income from appeasing the masses anytime soon. Much like people took the most hit in the early rise of industrial revolution, our generation and immediate generation will be hit the hardest.

<comment><USER13> > "AI run hedge fund blows up due to black swan event"

Knight Capital, 2012:

[https://www.bloomberg.com/news/articles/2012-08-02/knight- sh...](https://www.bloomberg.com/news/articles/2012-08-02/knight-shows-how-to- lose-440-million-in-30-minutes)

<comment><USER14> I believe the poster meant a machine-learning system blowing up (catastrophic trading loss) due to a black swan event that the system wasn't trained to deal with.

Knight's blow-up was a process/sysops failure, not due to their strategies going wonky.

[As a side note I believe their core strategies were human-analyst designed, not ML based, but I could be wrong.]

<comment><USER15> Wouldn't process & sysops failures count as blackswan events if the AI or ML algorithms weren't trained to deal with those types of hiccups?

</comment></comment></comment></comment><comment><USER16> I suspect Libratus' overbet frequency is overfit to this particular reduced- variance game format. In a normal game, the opponent doesn't take chips off the table after winning a hand and might stand up at any moment.

It's hard to know how much that affected the strategy, but in the Reddit thread, the human players said the overbet frequency was what they were most surprised by.

<comment><USER17> Maybe overbetting is better EV and humans just don't know it yet. It will be interesting to see if this changes the game at the higher stakes Heads Up tables

<comment><USER16> Yes, but expected value isn't everything. A good investor considers the ratio of expected return to variance of return. In a normal game, the variance on an overbet is enormous and therefore the denominator of its Sharpe ratio [0] is large and drives the value (or should I say "score" so as not to get confused with "expected value"?) of that action down.

You'd happily go all-in pre-flop AA vs KK. On the other hand if you got 4-bet pre-flop by a 22 and you're holding AK, you might ask, "Check it down?" This is assuming the opponent really likes small pocket pairs and will call an all- in, etc.

[0] [https://en.wikipedia.org/wiki/Sharpe_ratio](https://en.wikipedia.org/wiki/Sharpe_ratio)

<comment><USER17> > you might ask, "Check it down?"

In a heads up game? Really? "Check it down?" ???

<comment><USER16> The example applies more to a ring game, where you might be going after a particular fish and don't want to get involved with a better player. Still, I think it illustrates the principle of trying to keep the variance down.

Also, if you're first to act on the next round, it might be worth asking, even if you don't think they'll agree.

<comment><USER17> That's collusion and it's not cool. No top pro would ever seriously ask to 'check it down'

Kelly's criterion and the sharpe ratio is not relevant for the format played in these human-AI heads up games. They play with an unlimited bankroll.

<comment><USER16> I'm not talking about a tournament. And yes, it could indicate collusion. But most of the time, it's just a friendly low- or mid-stakes game and the players are tired of thinking.

My point exactly about the unlimited bankroll. The experimenters may not have realized that an unlimited bankroll would significantly affect the strategy.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> Reddit AMA from the live match:

[https://www.reddit.com/r/IAmA/comments/5qi3i9/we_are_profess...](https://www.reddit.com/r/IAmA/comments/5qi3i9/we_are_professional_poker_players_currently/)

</comment><comment><USER19> "Each night after the play ended, the Pittsburgh Supercomputing Centre added computations to sharpen the AI's strategy."

This sounds more like an "advanced chess" setup, where a human teams up with an AI to play. The title of the article should really be "amateur poker players + AI defeat professional poker players". The real test would be if the AI self-corrected over the length of the tournament, without human intervention.

<comment><USER20> "He added that the professionals had been sharing notes and tips in an effort to find weaknesses in the AI's game-play."

This doesn't sound like they had the goal of conducting a fully controlled experiment here, but it's still interesting none the less.

<comment><USER21> Especially given that the professionals were live streaming and kibitzing with chatters on Twitch during the event.

</comment></comment></comment><comment><USER22> Once this is out, it's going to be have a big impact on online poker games.

They way things are going with AI. You have a good algorithm, you can get rich very quickly by being a one man business with hardware rented in AWS.

Libratus AI player is modelling it's human counterparts and predicting how they think to outsmart them.

When Google started, they got the page rank algorithm and distributed algorithms good enough to run on shitty unreliable cheap computers. They are well on the way to become the world's largest company overtaking Apple someday.

Their ad algorithms already know that I am applying for a house loan and are blasting me with ads every fucking page I visit on the Internet.

I can totally see Google and Facebook personalizing ads per person and taking advantage of the person's vulnerablaties. Like psychologically modelling them to make them click ads and buy random shit. I can see the start of ultimate God algorithms for marketing.

The ability for AI to create drug like experiences for us that we can't stop craving.

<comment><USER23> Not if you have uBlock ([http://ublock.org/](http://ublock.org/)) installed.

</comment></comment><comment><USER24> Do a search for "long term" in online poker and you'll find that the suggestion for players to determine their level of play based on that "long term" is something like one million hands. That's running 4 tables for full days of poker over a long period of time. For sure it's playing more than 4 players.

The probability space of poker is such that 4 competitors isn't going to tell you much.

And defining "top" is difficult because "top" may be more celebrity than anything. Everyone has their different objectives. If you are "top" then you sure as ____didn 't get there by building a case history against AI poker bots. Give these guys a chance to adjust, and give them a chance to figure out why the effort to adjust might be worth bothering with.

<comment><USER25> From the article:

> A poker-playing AI has beaten four human players in a marathon match lasting > 20 days.

20 days seems like plenty of time. No ?

<comment><USER6> No, the number of hands is relevant here, not the number of days played.

<comment><USER17> They won 14.7 big blinds per 100 hands, playing 120k hands. That's a pretty good win rate and a decent sample size but I don't know how to calculate the p value

</comment></comment></comment></comment><comment><USER26> Can someone clarify why exactly is this being presented as more impressive than beating Chess masters or even Go masters?

People talk a lot about number of states in poker, but the hand and visible cards can be easily (to a statitician) reduced to a scalar "probability of having the best hand".

At least in terms of crunching the possibility tree this should be a far less computationally intensive challenge.

<comment><USER27> What struck me looking at the AlphaGo papers was how human its algorithms were - it was basically doing what a highly orthadox human player would do (pick some moves that look interesting, read as deeply as possible) and then scaling up with a completely inhuman thoroughness and accuracy.

At this stage, AI wins in competitive games simply will not impress me. From here it may simply be a tour of force showing the breadth of fields AI can dominate in.

After that enthusiastic agreement; poker wins are evidence for the laypeople of something I suspect most people in AI research or game theory already know - a human bluffing isn't a magic advantage in a fair game. The AI can outperform on fundamentals.

</comment></comment><comment><USER28> Did I read the article incorrectly, or did it say that the bots creators were feeding it additional data each night before the next day's tournament? If so that defeats the entire purpose, doesn't it?

<comment><USER29> in what way would that defeat the purpose? the players can also review their days play during the night

<comment><USER28> Yeah... I guess I was just expecting the AI to be more self-learning and self- tuning...

<comment><USER30> It built most of its decision model by playing itself over "trillions of hands", according to Prof. Sandholm. You could almost think of the nightly reviews as a similar process to a human sleeping: we benefit from memory consolidation, pruning, time to reflect, etc. I don't see giving the computer 12 hours a night to do something close to reflection and self-analysis as "cheating," or even very different from what its opponents did over Mexican food each night.

<comment><USER31> The four humans were even "colluding" too.

</comment></comment></comment></comment></comment><comment><USER32> This article [http://spectrum.ieee.org/automaton/robotics/artificial- intel...](http://spectrum.ieee.org/automaton/robotics/artificial- intelligence/ai-learns-from-mistakes-to-defeat-human-poker-players) says 120000 hands were played over the course of more than two weeks. How much of a factor was sheer boredom?

<comment><USER21> It was a factor for sure, especially as the AI would tank (stop and think) quite a bit at predictable spots and so the "Pros" would occasionally use strategies to try to knock out the AI before it would get to that point (they were shooting for a targeted number of hands, so maximizing the hands per hour is to the Pro's benefit). That said, they still had both money and pride on the line, and at least one Pro insisted that he was genuinely doing everything he could to try to win, despite the boredom and desire to be done with it.

</comment></comment><comment><USER33> Is 6-handed a significantly harder game or is it just (from the computer's point of view) just like playing 5 single games of heads-up?

<comment><USER34> I would argue that it is significantly harder. In heads up, you can call a bet and see the flop and go from there. In a full table, calling early means you may have to fold to a raise. There is also a much more complicated analysis of the possibility that you are beat. Lots of times I may be in a hand and think I have the original raiser beat but when two other people call before me, the odds are much less that I have all of them beat.

I still think the hardest part of poker is the grind. The computer doesn't get bored or tired and play hands it doesn't have a reason too just because they are stuck in a dead streak. Taking a mostly conservative style, you'd expect the computer to out perform over time.

It would be curious to know what percentage of the time the players bluffed the AI successfully and vice versa.

</comment></comment><comment><USER35> Hmm, why is it surprising that AI is good at poker? The way I see the game is that a bad poker player will just hold a model of his hand in mind. A slightly better one will also hold a model of his opponent's hand. Even better one will also model his opponent's model of himself... and so on recursively. And who's really good at recursion? Computers.

<comment><USER29> People have been trying and failing to do so for decades, the state space of the underlying incomplete information game is absolutely massive.

</comment></comment><comment><USER36> Put it against Negreanu.

"Oh you have AJ don't you?"

<comment><USER37> Negreanu wouldn't sit HU against the 4 players who played the bot.

<comment><USER16> Depending on the stakes, of course.

</comment></comment></comment><comment><USER38> The University of Alberta bot has been beating top pros at limit hold'em for over 10 years.

no-limit and tournament play were deliberately placed outside the scope of their poker-bot projects--at least during the period of time i was following it which was approx. 2004 - 2010.

anyone know if the CMU team trained their rig on these variants?

</comment><comment><USER39> EDIT: Read below, I am wrong. I clearly didn't know what I was talking about.

This is a great achievement in AI, don't get me wrong, but the headline should read, "AI beats the best four poker players we could find who were willing to play for a mere $200K".

All the actual best players play for millions and have a reputation to uphold. They would never agree to do this.

They four guys they got are pretty good, and could certainly destroy me, but they aren't the best of the best.

I'd love to see the bot play in the World Series of Poker for a few million.

<comment><USER40> >All the actual best players play for millions and have a reputation to uphold.

All these players are high stakes players. I think you're underestimating the fun factor. As for reputation. For a poker player having a reputation as being beatable is a profitable thing to have.

>but they aren't the best of the best.

Who do you think is? Like how many people do you think rank above this group at HUNL?

<comment><USER39> Anybody here? [http://pokerdb.thehendonmob.com/rankings/](http://pokerdb.thehendonmob.com/rankings/)

Or any of these people: [https://en.wikipedia.org/wiki/List_of_World_Series_of_Poker_...](https://en.wikipedia.org/wiki/List_of_World_Series_of_Poker_Main_Event_champions)

<comment><USER41> I like your posts, but you're misinformed on this topic. The pros selected are among the best HUNL players in the world right now. Offering the top winners in a separate variant not only misinterprets how different the games are but also falsely equivocates being the best with making the most money.

If someone asked you who the best mobile app developers were in the world, your list should comprise solely of mobile app developers.

<comment><USER39> You make a fair point. I clearly didn't know what I was talking about. I edited my original post to reflect that.

<comment><USER41> No worries, thanks for taking the time to listen. Have a great day

</comment></comment></comment></comment></comment></comment><comment><USER42> Does anyone know the technical details of how to train and AI bot for a game like poker?

I imagine it's just reinforcement learning where the inputs are the actions of the individual players (hold/fold/raise, timing etc) and the statistical probabilities in terms of expected cards. Train a neural net to predict probability of the opponent's hands and act accordingly.

Is it just that the professionals all act similarly enough that the bot can learn based on other players?

<comment><USER2> I'm sure the actual process differs from research group to research group. Here's how one commercially available AI training system claims to work.

[http://www.pokersnowie.com/about/technology- training.html](http://www.pokersnowie.com/about/technology-training.html)

And they go into some of the problems that stem from how they've abstracted the game here:

[http://www.pokersnowie.com/about/weaknesses.html](http://www.pokersnowie.com/about/weaknesses.html)

</comment></comment><comment><USER43> Sounds like the end of online poker is very near. This version required a supercomputer and took a long time to decide its actions but those type of things tend to be quickly improved given enough motivation.

Even if poker sites could somehow perfectly detect automated players(which they can't of course), highly skilled poker is profitable enough that some people would be willing to manually execute the actions themselves as directed by the AI.

<comment><USER44> Not really. 1v1 is just a small part of poker. Ring games are a whole different beast.

<comment><USER43> They are more complex for sure but not fundamentally different. I'm amazed the AI managed to win but now that it's happened it's bound to proliferate quickly because there's so much money on the line.

</comment></comment></comment><comment><USER45> This article is related to no-limit heads-up, which requires a very different style of play than no-limit full ring. Full ring would be significantly more difficult to beat by AI. So the title leaves out some very important information. I am not surprised they beat heads-up; I would have expected it sooner.

</comment><comment><USER46> There is a game humans can still beat machines at with ease, Diplomacy(1). When a machine wins a Diplomacy tournament I know we are finished as anything except pets.

1\. [https://en.wikipedia.org/wiki/Diplomacy_(game)](https://en.wikipedia.org/wiki/Diplomacy_\(game\))

<comment><USER47> I'm yet to see a game of Diplomacy every actually end, so that makes it difficult. The only reason this game is difficult for AI is the social interaction required to play the game. If the computer was given a means of making offers and private communication with other players, it would be much like any other game. Rules, game state, probability, goal state, etc.

</comment></comment><comment><USER48> I'd really be interested in whether intentionally showing your cards instead of mucking them was taken into account by the AI. (e.g. showing your poor hand after a successful bluff)

<comment><USER16> It was not.

</comment></comment><comment><USER49> Does the computer-ness of the AI give it advantage in poker w.r.t. counting cards, at which humans are imperfect? Or are humans perfect enough these days?

<comment><USER50> There's no counting cards in poker. 52 card shuffled deck each time.

<comment><USER51> It's not "counting cards," but to be minimally successful at certain variants like seven card stud, I'd argue one must[0] remember cards that have been folded in the current hand.

But certainly in all HE variants (that I'm aware of), counting and remembering is unnecessary.

[0] It's necessary, but not sufficient.

</comment></comment></comment><comment><USER52> Could someone explain how Poker is more challenging that games like Go? Please eli5.

<comment><USER7> I'm not qualified to give a comprehensive answer, but I would have to imagine that it partly has to do with the fact that poker is a game of partial information. In Go or Chess the current state of the game is known. In poker, you don't know what cards your opponent hold, so you have to assign probabilities based on previous actions, and simulate many different scenarios.

Another part has to do with the fact that both you and your opponent have surprisingly many legal "moves" at each turn. because not only must you decide to fold, call or bet, but if you bet, you also have to decide _how much_.

</comment></comment><comment><USER53> Does anyone have link to papers about the technology behind Libratus?

<comment><USER29> the endgame solver used is described in [http://www.cs.cmu.edu/~noamb/papers/17-AAAI- Refinement.pdf](http://www.cs.cmu.edu/~noamb/papers/17-AAAI-Refinement.pdf)

the first authors twitter account [https://twitter.com/polynoamial/](https://twitter.com/polynoamial/)

</comment></comment><comment><USER48> Unfortunately this fails to impress me, merely because you could theoretically build a terrible AI and still win.

<comment><USER54> Just showing your ignorance. That margin of victory over that many hands isn't luck or coincidence. The pros were absolutely dominated.

<comment><USER48> I disagree and it's not ignorance on my part. Due to the nature of the poker and heavily weighted component of luck, a terrible AI can theoretically win.

I am sure the AI they built is a mighty and spectacular achievement, but poker is about the only game I know where the worst player can easily beat the best player. Prove me wrong and I'll happily accept your insult of "ignorance"

 _edit_ I should have been more clear, as I am extremely impressed with the AI's results of hands over time. I am referring to the context of a standard tournament where the loser is eliminated after losing their chips.

<comment><USER40> In these contests they typically play each hand twice with the sides reversed to remove the luck factor.

So the deck for hand 1000 might be the same as hand 113853 but they swap who is the button.

</comment></comment></comment></comment><comment><USER55> Surely nobody is surprised? Perfect knowledge of probabilities, no emotion and immune to bluffing.

<comment><USER56> > immune to bluffing

There's no such thing.

An algorithm playing straight hand value based on probabilities is more susceptible to bluffing, not less. And this is no limit, where a single hand can swing all the chips.

Any poker AI that isn't a loser is going to have some pretty sophisticated modeling of the opponent.

<comment><USER57> Having a poker AI that plays deterministic strategies is an obviously terrible idea, for the precise reason you mention.

It makes much more sense for the strategy space to be the set of probability distributions over game moves (i.e. mixed strategies).

I _think_ that the optimal mixed strategy for each hand is immune to bluffing (over many hands it will have larger expected winnings against a bluffer). If that wasn't the case, there would exist no Bayes-Nash equilibrium for the game, contradicting Nash's theorem.

<comment><USER56> I was just making an informal remark, but reading your comment:

> I think that the optimal mixed strategy for each hand is immune to bluffing > (over many hands it will have larger expected winnings against a bluffer). > If that wasn't the case, there would exist no Bayes-Nash equilibrium for the > game, contradicting Nash's theorem.

I believe that's true. I know for sure that heads up limit hold'em has been solved. That said, I think this context is similar to the iterated prisoners dilemma contest. There's certain to be an equilibrium, but what's interesting isn't the perfect strategy in a min/max sense, but rather a slightly suboptimal strategy that can detect and exploit suboptimal behavior in other players. It sounds like you know this area well, perhaps you can shed some light if I'm on the right hunch?

<comment><USER57> Yeah I think you're right. just playing an equilibrium is suboptimal in the sense that it doesn't extract maximal value from the opponent. You want to be playing a best response to the opponent's strategy.

That's what you see online poker players do. They model their opponents (in the sense of labeling them as fun player, too tight, too loose, etc), then try to predict their hands based on their moves. Otherwise I guess they would be losing money: poker is zero sum by its nature, and the casino's cut on top of that makes it negative sum!</comment></comment></comment></comment></comment>


"Infinitely Rich" Mathematician Richard Guy Turns 100 - <AUTHOR> http://nautil.us/blog/an-infinitely-rich-mathematician-turns-100 <comment><USER2> This is a lovely article about the man I know. I've had dinner with Richard several times, meeting him sporadically, and he always seems interested and interesting. A charming man. One of my most treasured possessions is an early copy of "Winning Ways" signed by all three authors.

I wish Richard a very happy birthday, and many more to come.

</comment><comment><USER3> Can anyone lend some background to the story that opens the article and gives it its title?

> [Erdős] said, "Guy, veel you have a coffee?" It cost a dollar, a small > fortune to a professor of mathematics at the hinterland University of > Calgary who was not much of a coffee drinker …. When they sat with their > coffee, [Erdős] said, "Guy, you are eenfeeneeteley reech; lend me 100 > dollars."

> "I was amazed," recounted Guy. "Not so much at the request but rather at my > ability to satisfy it. Once again, Erdős knew me better than I know myself. > Ever since then, I've realized that I'm infinitely rich: Not just in the > material sense that I have everything I need, but infinitely rich in spirit > in having mathematics and having known Erdős."

I don't mean to interpret this too literally, but I don't understand. How can it be that someone has to check his budget for a dollar cup of coffee, but is infinitely rich, in (as he himself says) not just, but at least, the literal sense of having $100 to spare?

(I know that the _point_ is the richness of knowing Erdős, a privilege I missed—my Erdős number is and will probably remain 3—but the non-metaphorical part of the story doesn't make any sense to me. Also, it avoids the question of whether Guy made the loan!)

<comment><USER4> If you take 100 from Infinity it still remains Infinity. So I take the Erdős comment as meaning if you give me $100 your financial situation will not change. Which probably was true.

</comment></comment><comment><USER5> "so Erdős—who sustained himself with espresso and other stimulants"

Paul Hoffman's biography has Erdős on "10 to 20 milligrams of Benzedrine or Ritalin"

so yea the coffee, it was the coffee.

<comment><USER6> He was quoted as saying going without amphetamines for a month set back mathematics a month.

<comment><USER7> Which he did to win a bet on whether he could go without stimulants for a month.

<comment><USER8> I read that he complained bitterly the whole time and proclaimed that the bet had cost Mathematics immeasurably. I wonder how true that is.

<comment><USER9> The complaining part is probably true—amphetamine withdrawal will make you extremely irritable, and moreover he probably felt like he was being held back from his full potential.

<comment><USER8> Probably. He seems like an endlessly fascinating character to me. He's almost tragic in a sense, but I also can't help but thinking that he probably felt more fulfilled than most people.

</comment></comment></comment></comment></comment></comment><comment><USER10> Culturally we're doing everything we can to destroy the "Great Man" narrative. When I read stories like this I think it's a mistake. Richard Guy had his life changed by someone he looked up to and wanted to emulate.

We need to remember that whenever we knock people down and say they their achievements are not due to them. Fame has positive social effects.

</comment><comment><USER11> _" A lifelong mountain climber and environmentalist, he spent his centenary day hiking at (not up) Mount Assiniboine"_

I didn't even think that was possible. The guy's an inspiration.

<comment><USER12> I don't think I get it. What is the difference between 'at' and 'up' in this context?

<comment><USER13> Maybe going on trails on/around the mountain as opposed to heading to the top?

</comment></comment></comment><comment><USER14> For an article appearing to praise an old man for being active in his old age, there is a distinct lack of _pictures_ of the man himself while _being_ old, only a picture of him when he was _young_.

</comment><comment><USER15> There's a touching write up of him and his wife - [http://www.alpineclubofcanada.ca/wp- content/uploads/2015/07/...](http://www.alpineclubofcanada.ca/wp- content/uploads/2015/07/SS14-Guy.pdf)

</comment><comment><USER16> What a pleasurable read. It's no shocker that a man so well versed in such a variety of interests (teaching, the english language, mathematics, thinking) has such an outsized impact on his field of choice. I find that the best and the brightest tend to be such people and I aspire to attain such a wonderful status whether at a more local or in this case global level.

Here's to a 100 more Richard! You sound like a pleasure to be around.

</comment><comment><USER17> > Richard Guy teaching calculus in Delhi

I couldn't find any other Delhi connection on Google...

<comment><USER18> He was a teacher at IIT Delhi teaching metro-logy and mathematics and also wrote a book while there.</comment></comment>


IBM Ad for SAGE, A Massive Cold War Air Defense System (1960) - <AUTHOR> http://laughingsquid.com/ibm-ad-for-sage-a-massive-cold-war-air-defense-system-1960/

<comment><USER2> They have a nice exhibit on this at the Computer History Museum in Mountain View, complete with actual old consoles and all. I highly recommend checking it out, had never heard of it before seeing it last year.

</comment><comment><USER3> I particularly like the fire button being one of a gigantic bank of identical buttons. Of course pressing it by mistake would be "user error".

</comment><comment><USER4> The light-gun user interface is interesting.

<comment><USER5> especially since it looked like a vector (rather than raster) display. so how did it work?

[edit: yup, vector - <https://en.wikipedia.org/wiki/Vector_graphics#Applications>]

i guess when they used the device they must trigger some kind of raster scan. that would explain why they had to hold it in place.

<comment><USER6> I don't know how the light gun worked, but the vector display used was pretty unusual. The 'Typotron' (a.k.a. 'Charactron') could display 25,000 characters per second. It didn't draw them in the usual fashion of a vector display. Instead it displayed them by deflecting the electron beam at the right location in a stencil, then deflecting it again to the right spot on the screen!

[http://history- computer.com/ModernComputer/Electronic/SAGE.h...](http://history- computer.com/ModernComputer/Electronic/SAGE.html)

<http://www.wps.com/projects/Charactron/>

EDIT: Ooh, better information in this PDF: <http://design.osu.edu/carlson/history/PDFs/p19-hurst.pdf>

The Typotron was like a Charactron, but could store data, too. Apparantly the light gun was used only to click on light points, not on dark bits of the tube, so it was 'trivial' to determine what was clicked on (the second page of the PDF talks about how the light gun was basically invented and prototyped in one day somewhere in '48 or '49).

</comment></comment></comment><comment><USER7> For some reason, when I look at pictures of SAGE, the part that _really_ makes it look outdated is the ashtray built in to the operator console.

<comment><USER8> According the the SAGE Wikipedia entry the operator consoles also had built in _cigarette lighters_ as well as ashtrays. :-)

[http://en.wikipedia.org/wiki/Semi_Automatic_Ground_Environme...](http://en.wikipedia.org/wiki/Semi_Automatic_Ground_Environment)

<comment><USER9> "By the time SAGE was completely operational, the Soviet bomber threat had been replaced by the Soviet missile threat, for which SAGE was entirely inadequate."

They still kept it running for 20 years though.

<comment><USER10> If that isn't the defining quality of a government project, I don't know what is.

</comment></comment></comment></comment><comment><USER11> Feel like science-fiction to anyone else?

<comment><USER12> It did to Hollywood. Many decommissioned AN/FSQ-7 control panels were used in various movies and TV shows. Or maybe it was just the same one used over and over...

<http://sturgeon.css.psu.edu/~mloewen/Q7/>

</comment></comment><comment><USER13> My dad worked on SAGE for a short while. All I know is the bldg was a big block of windowless concrete.

</comment><comment><USER14> Really an amazing system. Too bad modern computer terminals don't have consoles like that :)

</comment><comment><USER15> They look so clean did they get that way through lack of use or were they restored I wonder?

I can't imagine the night janitorial crew giving a spritz and wiping down those workstations with all the buttons and switches.

<comment><USER16> I'm sure there was some restoration, but I thought leaving the yellowed note on the phone with the General's number was a nice touch.

Those machines were pretty darned expensive. They were all taken very good care of. Except for the paper-handling equipment, almost anything that involved opening the cabinet would probably have been done by IBM personnel.

The military was also known for keeping just their ordinary stuff clean. It surely went double for the air defense computers. Top brass from the Pentagon were likely dropping by for a tour on a regular basis.

In the years following WWII as one of the only large industrial nations that had not been bombed to smithereens, the amount of capital the US had to spend on this kind of thing just boggles the imagination.

Wikipedia <http://en.wikipedia.org/wiki/AN/FSQ-7> : The AN/FSQ-7 computer contained 55,000 vacuum tubes, occupied 0.5 acres (2,000 m2) of of floor space, weighed 275 tons, and used up to three megawatts of power. The _fifty- two_ AN/FSQ-7s remain the physically largest computers ever built, and will likely hold that record in the future.

</comment></comment><comment><USER13> The blinkin lights remind of WOPR. Wonder if this commercial inspired that movie?

</comment><comment><USER17> I don't have the citation to-hand, but part of SAGE's development cycle was a emulator/simulator on which tests were run. It was reported as being a reasonably effective debugging mechanism.

</comment><comment><USER18> I wonder what the success rate for intercepts really was.

<comment><USER19> Imagine a legit flight that was punched in wrong. _Boom_ That would be a bad false-positive.

<comment><USER20> My thought exactly. Or one of those punchcards dropping on the floor.

</comment></comment></comment><comment><USER21> Wow. It really makes you wonder what can be accomplished today!</comment>


Ask HN: Best book/course to get started with PyTorch? - <AUTHOR> I'm relatively new to ML, it would be nice to have a simple straightforward introduction to PyTorch. Can you recommend me something good and reasonably easy to get started with? <comment><USER2> These videos were great intro to vanilla pytorch:

[https://m.youtube.com/playlist?list=PLZSPcxXPEZVqrk1CYgM2yJ4...](https://m.youtube.com/playlist?list=PLZSPcxXPEZVqrk1CYgM2yJ4BPXxiGSyIp)

</comment><comment><USER3> fast.ai I guess?

<comment><USER4> It does not teach vanilla pytorch but the fastai library is build upon pytorch.

Nonetheless I would recommend the fastai courses

<comment><USER5> Agreed. I would do the fast.ai courses, and go through the examples/tutorials in the PyTorch docs as needed during the course or afterwards. They are very good and go through what you need to know, but it helps to have done at least part of the fast.ai course.</comment></comment></comment>


Making of Byrne's Euclid - <AUTHOR> https://www.c82.net/blog/?id=79 <comment><USER2> I just saw this on twitter - it's a lovely bit of work.

In the depths of broke-ness as a cofounder a couple of years ago, I purchased this book for myself; it was a total extravagance at the time (£20). This gloriously drawn recreation of one of maths greatest works was the perfect relief from the stress of life. Highly recommend checking out the original work if you haven't (in any of its forms).

I don't know about the author's background, but he's gone to great pains to get this right. I'd love to see a version where the SVGs were created programatically so they could be tinkered with like in this brilliant game [https://www.euclidea.xyz/](https://www.euclidea.xyz/)

</comment><comment><USER3> That article had a really nice depth to it, answered all of my questions that I had yesterday when I first saw the project.</comment>


When it comes to composition and length, passwords mostly don't matter - <AUTHOR> https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Your-Pa-word-doesn-t-matter/ba-p/731984 <comment><USER2> In my opinion, Microsoft's implementation of MFA on Office 365 (at least our instance) is broken. SMS MFA is inadequate and should not be used, the SS7 network is apparently trivially hackable in some circles and text messages can be rerouted. So they want us to use MS Authenticator, great. However the 365 login screen always has the "Sign in another way" option in which I can just bypass the Authenticator app and use an SMS text. I cannot remove my mobile number from my profile to disable the option to SMS text because they are worried about me losing access to my app. I don't know if this is a limitation of Office 365 through our VAR or what, but it just seems pointless to offer an Authenticator app if there's an easy way to fall back to SMS and no way to disable SMS. If someone has my password and can reroute my text messages, a fancy shmancy Authenticator app is pointless. If this is not how it is for others with 365 I would love to know that, I hope it's not a limitation or policy put in place by our VAR.

<comment><USER3> Does anyone know if there's a way to prevent your SMS from being rerouted, or get a special protected number?

The ability to do this would not mitigate Microsoft's responsibilities here, but at least it would allow some people to help themselves.

<comment><USER4> I'm not a subject matter expert, but a Google Voice number can be used to receive texts and is protected by the relatively robust security of your Google account.

<comment><USER5> If the issue is the SS7 network, that won't help unless the originating text is also in Google Voice.

<comment><USER6> That seems pretty possible though, if SS7 is the only issue then providers of 2factor SMS auth should just have a number on each network and when a 2factor request comes in they should determine what network its being sent to and then actually send the SMS from the number they have on that network.

</comment></comment></comment></comment></comment><comment><USER7> I think the thesis of this article is rather forced. The actual claim is something like:

"Passwords don't matter, as long as your password isn't in the top few dozen common ones, it's not in any credentials breach accessible to attackers, it's longer than 8 characters or so, and you don't reuse it."

That was a lot of criteria that seemed to matter, if you ask me.

<comment><USER8> And also "Passwords don't matter as long as you aren't important enough or connected to a person or organization important enough to try more than the most routine password vulnerabilities"

<comment><USER9> That would be a shocking statement to make. However, I don't see anything like that in the original article. Did I miss it somewhere?

<comment><USER10> Yes for example in password spray - attackers often try just < 20 passwords. If your account is high value they could try a lot more.

<comment><USER9> But the original article literally never says that. It doesn't talk about the "value" of different kinds of accounts at all (and I just reread the "Spray" section to make sure I didn't miss it).

It would be incredibly naive to think that one account has significantly more value than another because once you are in the system, your ability to compromise it skyrockets -- no matter what kind of account you have. Sure, you're probably trying to work your way up to administrative account level, but there are _so many more_ local attacks than remote attacks that it isn't even funny.

I'm not sure there is an accusation that the article is being naive in this way or not (there seems to be some confusion). It would be really shocking to see a blog post from Microsoft talking about security that would say something so naive. But as far as I can tell, they didn't.

</comment></comment></comment></comment></comment><comment><USER11> _If you are using a password manager, use the maximum possible length – there's no usability downside if you are already cutting and pasting._

That's fine and dandy until you need to manually type it in somewhere (e.g. reading it from your phone, typing it in on another device). Has this guy ever even used a password manager? He understands how they work in theory, but in practice it's not always quite so clean. Humans will be human.

<comment><USER12> The best is typing that 20 character mixed-case-plus-numbers-and-symbols password for Netflix into your TV app using an on screen keyboard and directional arrows...

<comment><USER13> This is a huge benefit of AppleTV and having an iOS device. When the password is prompted for on the TV, my phone buzzes and I use the LastPass vault on the phone to paste the gibberish automatically.

I'm sure there are similar schemes for other devices (Chromecast/FireTV?). But when the TV itself is "smart", I bet it's infuriating.

<comment><USER6> Chromecast doesn't have its own UI or authentication, it just uses the authentication of the device the stream was started from (being able to delegate that is a requirement for chromecast support). So it solves the same issue but in a very different way. Its a pretty clever solution but requiring all interaction with your tv to happen through another computing device can get annoying.

</comment></comment></comment></comment><comment><USER14> The number one reason I don't turn on MFA has nothing to do with the effort in entering the MFA code/pressing a confirm button. The lifecycle of MFA is the problem.

The backup/recovery options are just terrible. You either print out a sheet of "one time codes" (which I need to not lose forever), my phone simply needs to never break, or I need to configure an insecure recovery account (creating a whole chicken/egg problem).

This is in no way mitigated by using physical keys either. Which can also be lost/broken/stolen/etc. You still need recovery/backup.

Plus a ton of vendors allow customer support to trivially turn off MFA via social-engineering, so what is the point? If people want MFA to be more common, make the lifecycle better. Right now the backup/recovery situation is all over the place and frankly bad.

<comment><USER7> I was blown away when I discovered that there was no way for me to export my Google Authenticator TOTP secrets from my locked Android phone, since unlocking it wipes the disk. I guess I will not make the mistake of not immediately unlocking an Android phone again.

<comment><USER15> So what do you do? How did you get your account back?

<comment><USER16> I ran into a similar issue. I had 1100 dollars in an account secured by authenticator and did not save the recovery codes when I set it up. I had to jump through hoops to get it back, which is good.

But I didnt realize I would have to reset up every single code on authenticator on the new phone. When you have a lot of accounts it's pretty obnoxious even with recovery codes. It didnt help that google support directly told me that they would be automatically be restored on the new phone along with the rest of the settings.

</comment></comment></comment></comment><comment> default-kramer > Your password doesn't matter, but MFA does! Based on our studies, your > account is more than 99.9% less likely to be compromised if you use MFA.

I'd be much more interested what that percentage is when you only consider people who use password managers. (Which is not to imply that MFA isn't good.)

<comment><USER17> Furthermore many sites make it difficult to use a password manager because it's hard to block automated password guessers and not interfere with password managers trying to enter passwords.

<comment><USER18> My old bank used to "encrypt" your password as you typed it into the input field, on keydown it would take the character you typed and — and I'm not making this up — _ROT13 it_. This had the effect of making it impossible to paste anything into the input field since the script would capture your ctrl+v and replace it with the letter "i".

The icing on the cake is that when I called to complain about it, the support agent insisted in very sombre tones that it was a measure to stop keyloggers. I don't use that bank any more.

<comment><USER19> >since the script would capture your ctrl+v and replace it with the letter "i".

not an issue on firefox because you can toggle the dom.event.clipboardevents.enabled to false, and sites won't be able to hijack your pastes.

<comment><USER18> The only problem with that is that the stupid ROT13 step wouldn't be performed so the site would reject your login attempt anyway. It was one of the dumbest design decisions I've ever seen, honestly.

<comment><USER20> I'm guessing the solution would've then been to 1) disable the update event and 2) paste the ROT13'd password, either into the browser or into the input field value via the inspector.

Like you, whenever I run into sites that do weird things like that, I always find it hard to shake a bit of suspicion about how their backend is implemented (or not, depending on the case). For instance, when they start rejecting characters like "%" or "'" which have special meaning in SQL. I can't help but wonder if they're storing things in plain text.

I've run into at least two vendors I can think off the top of my head that limit what characters you can use for a password. That always makes me uneasy, and I don't buy anything from them on principle. Who knows what else they're doing that's not immediately obvious.

</comment></comment></comment></comment></comment></comment><comment><USER21> > Based on our studies, your account is more than 99.9% less likely to be > compromised if you use MFA.

An important thing to remember here is that MFA works _with a password._ Otherwise, that 99% goes down dramatically because I can just steal your phone/Yubikey/whatever.

This article isn't suggesting that we get rid of passwords. It's suggesting that the energy we spend making sure that passwords are _good_ would be better spent encouraging users to enable MFA.

In other words, having two relatively weak authentication mechanisms that must be used in tandem is still better than having one strong authentication mechanism.

<comment><USER22> > Otherwise, that 99% goes down dramatically because I can just steal your > phone/Yubikey/whatever.

If this were true your car would probably get stolen a lot more often. You're less secure from targeted attacks from people who know you IRL but that's a lot rarer than the attacks you'll actually encounter.

<comment><USER21> Eh... cars are really big. A better way of phrasing this is, "if this were true, your wallet/phone would get stolen a lot more often."

But aren't wallet/phone thefts relatively common?

> You're less secure from targeted attacks from people who know you IRL

I'm also not completely certain this is true. If a YubiKey is the only thing securing most people's accounts, I don't need to target you. I can walk into a coffee shop, or locker room, or office and steal as many YubiKeys as I can find.

And then I can check later whether or not any of them are linked to bank accounts. I don't know the stats; are most petty wallet/phone thefts targeted?

<comment><USER5> A wallet is useful to a thief, a yubikey is not.

There is little overlap between petty thieves and people trying to get into a particular target's account.

<comment><USER21> > There is little overlap between petty thieves and people trying to get into > a particular target's account.

But isn't that the point? There's little overlap because right now we have a multi-factor system where stealing one part of the authentication mechanism from a random person in the street isn't enough to get into their account.

If everyone's account is secured with just a YubiKey, then you don't have to target a specific person. What's to prevent any petty thief from grabbing a bunch of wallets and/or YubiKeys, walking into a library, and just checking a few of the most common banks to see if any of them log in?

Maybe I'm missing something? It's not clear to me why an MFA attack would ever need to be targeted in a world without passwords. I guess maybe you're hoping that petty thieves can't figure out your username? But that's just treating your username like a password.

For a lot of bank accounts, your username will be some variant of your first and last name, which is helpfully printed on the drivers license in the wallet I just stole. I don't need to know who you are beforehand.

</comment></comment></comment></comment></comment><comment><USER23> This is a good article. However, in regards to credential stuffing:

> Some guidance says to ban all passwords on this list. Try that and see how > successful your users are at choosing passwords at all.

We're doing that. We don't let you choose any password that's been discovered in a prior breach.

Did Microsoft implement the same thing and discover a high rate of users bouncing off the registration page?

<comment><USER24> Do you guys specifically alert the user that the password has been exposed publicly? If I got that sort of message, I would be grateful to the website rather than annoyed I couldn't use my favorite password.

<comment><USER25> Not the password _for you_ , just that password, for someone, on some site, ever.

If that's happened thousands of times, sure, that's the sign of a relatively common/weak password. If it's happened once? I'd be frustrated if I was trying to pick something memorable and got stuck because of that.

<comment><USER24> Yes, I understand it was whether it's exposed anywhere, not just for this user. If it was someone else's password, I would still find it super valuable information to know I'm using something that's common enough to have been used by a stranger.

</comment></comment></comment></comment><comment><USER26> This is somewhat unrelated, but I think the Microsoft 2FA (in Outlook, Skype, Xbox, etc.) has a lot of unnecessary friction.

After entering my password, the app usually takes me to a second page where I am required to type out my email address. I'd much rather prefer that I get an email immediately, because the way things currently are, I won't be notified of any attempts that breach my password but not my 2FA. It provides no perceivable security benefit to me (and if someone did hijack my email account, then they know my address anyway).

If I pick the text message option, then (after confirming my number the same way as above) I get a 7-digit code. For some odd reason, I find it much more difficult to remember a 7-digit code than a 6-digit one, which seems to be standard for most other companies. I don't see any extra security benefit in a longer 2FA code, but maybe there's a valid reason for this one.

The issues above are mildly annoying on a PC. In an Xbox, however, with the onscreen keyboard, it honestly makes me want to throw my console out the window.

<comment><USER27> > It provides no perceivable security benefit to me (and if someone did hijack > my email account, then they know my address anyway).

I think you're over focused on targeted attacks. Consider: some company gets hacked. Hackers take the credential list, try all the passwords for @outlook accounts against Microsoft using cloud VMs to avoid IP blocking. If Microsoft displayed the full email address without having the user re-type it, the attacker has now discovered the TFA email address and will try the same hacked password against that (usually Gmail) account. If Microsoft displays nothing, users with multiple emails get confused about which inbox to check. Displaying a starred out email address and asking for a re-type solves both problems. It also prevents Microsoft from having a huge SMS bill each time a big company gets hacked and the hackers try all the passwords.

The solution for Xbox is really for Xbox to use a flow designed for low input devices, like the OAuth device flow which allows you to do all the typing on your computer of cell phone, not the Xbox controller.

<comment><USER26> > Displaying a starred out email address and asking for a re-type solves both > problems.

Sure, but why not simply show the starred out email without asking for the re- type?

I agree with the Xbox idea, that would perfectly solve the problem.

</comment></comment></comment><comment><USER28> Note this is from the perspective of a security decision maker, like an IT administrator. Policy-wise, users can't be forced or trusted to create excellent passwords on their own.

But as an individual, your passwords do matter. It makes a world of a difference to use a password manager and long, completely random passwords - such passwords are immune to all sorts of cracking attempts, and using them can often make MFA unnecessary/redundant (though using MFA always reduces your personal attack surface).

<comment><USER29> The point of the article is that many common attacks work just as well against completely random, unique passwords as they do against weak/reused ones. If you get phished, it doesn't matter if your password is strong. If your machine has a keylogger on it, it doesn't matter if your password is strong. Etc.

Lots of attacks boil down to the attacker convincing you to unknowingly divulge your password, and if that password is the only thing securing your account, you're boned no matter how strong it is.

<comment><USER28> > unknowingly divulge your password

What's to keep you from unknowingly divulging your MFA token's current generated code?

You're right that being phished/keylogged pwns a password-only account no matter how strong the password, but MFA isn't immune to phishing/keylogging/clipboard stealing either. Yes, the generated code will only give them access for 30 seconds (or whatever the algorithm's time window), but that's more than enough time for an attacker to get substantial work done.

I maintain that strong passwords in a password manager are probably good enough for security-conscious/appropriately skeptical people. For folks like that, MFA likely isn't worth the trouble - at least not quite yet.

<comment><USER30> My main gripe with MFA, is that once you have 20+ services each one with a different token, it becomes tedious to sift through them to find the right one. I'd much rather have some MFA app capable of detecting where you're logging in, and a "click to authorize" option.

That wouldn't completely stop someone from being able to steal the token, but it would thwart most simple keyloggers.

<comment><USER28> 1Password has that :-)

So if you auto-fill on a login page, it will place your username, password, and 2FA codegen into the site's authentication fields. It will _not_ auto- suggest a login if you're not on the site it originated from - which is often enough to cause people to take a second look at the URL (which really helps thwart phishing).

Plus, it sends your authentication info to the browser via a secure connection to the 1Password browser extension, so (a) your credentials can't be keylogged, and (b) they never touch the clipboard, so they can't be stolen from there either.

But all of that is also true of non-MFA logins from 1Password. So again, I don't see the added benefit of MFA if you're already using 1Password with long random passwords.

</comment></comment></comment></comment></comment><comment><USER31> This kind of shit coming from Microsoft is fucking rich. Then why do I have to change my password constantly on outlook and get routed to at least two different types of password change servers, one with rules stupider than another? Especially when I'm trying to use a password manager with a strong, long, random password and they are preventing me from doing so with their shitty UX and their limitation on characters? They should take their own fucking advice because you know what else reduces security? The stupid bullshit I described above. Now I just use a base password (that's probably been compromised) and increase the last digit by one each time. Insecure? You betcha. But it's for work and it was work's decision to use outlook so not my problem. Microsoft should either shut the fuck up about this shit or fix their own fucking systems. Of course it doesn't matter what password you use in such a shit system (outside of a password manager generated one). And they have intentionally created a situation that makes the passwords even less secure.

<comment><USER32> Sounds like the place where you work has assigned some dumb password policies, and has a clumsy federation setup for password changes.

<comment><USER31> No, we have nothing custom set up. It's just Outlook 365. They send you to one password change page sometimes and another at other times. They both have different password policies. Microsoft is just shit as far as security is concerned. Or it could be a bug. Either way, it's garbage and it encourages not using a password manager and not using strong passwords since the length is limited. I just wish they would shut up with their fucking research into security if they won't bother to implement it themselves. Do as I say, not as I do. That's Microsoft and frankly, I'm fucking tired of their stupid bullshit.

</comment></comment></comment><comment><USER33> If we start thinking passwords don't matter, we go back to single-factor authentication.

What makes the "second" factor in 2FA more secure than the first? Is that it's usually a time-based generated key? Or is it that users usually use a physical device for this second key, hence removing a lot of internet-only attack vectors?

<comment><USER34> TOTP and U2F both perform a single authentication from a captive secret, rather than revealing a reusable secret.

U2F does even better, and ensures you are authenticating to the right website, not an intermediary.

If we eliminated passwords in favor of onboard U2F chips, we'd be much better off than today, though not as amazing as U2F + passwords.

<comment><USER35> Arguably what's inside a U2F/ FIDO token isn't a secret but a private value.

The TOTP secret is known to the authenticator, they calculate the same TOTP value as you to verify that yours is correct.

In U2F / WebAuthn the device just proves it still knows a private asymmetric key that it can use to sign messages, the authenticator learns the _public_ key, but not the private one, it can authenticate these signatures but not produce its own.

To deliver pseudonymity the device doesn't use a single public/private pair for everything but instead generates them randomly from a seed or key it knows and _this_ private value is what makes your FIDO Security Key different from my FIDO Security Key so that you can be authenticated, whilst not making it possible to fingerprint you and see where else you use these credentials.

Single Factor FIDO is a thing, Microsoft offers it. The device takes a PIN (something you know) and incorporates that into the results, so that anyone who doesn't know the PIN now can't authenticate even if they've stolen your Security Key. You need a suitable device, the Yubikey Security Keys with a "2" emblazened are suitable.

</comment></comment></comment><comment><USER36> The article seems to contradict itself. The table says password strength doesn't matter for brute force unless you're using an unusable password. But then in the conclusion it recommends you use a 9+ character password because that protects you from brute force.

<comment><USER37> yeah. What the table needs is a column of how to mitigate each risk. Besides MFA, there's also all the things that the very first para says aren't important, e.g. avoiding password reuse (HIBP is now a Microsoft thing)

</comment></comment><comment><USER38> This article is slightly inconsistent.

All those arguments for why a password's strength doesn't matter because the attackers gets the exact one have one important conclusion: Don't reuse your password.

And then there are a bunch of arguments that the strength mostly doesn't matter but the password shouldn't be _too_ weak.

So we end up with having to remember lot's of non-trivial passwords and now the conclusion should be to use a password manager and certainly not that your password "mostly doesn't matter".

What sadly mostly still doesn't matter is MFA because it is a site-specific pain to set up and use.

</comment><comment><USER39> There is some very bad analysis or interpretation done here.

Just with one or two minor tweaks the analysis falls flat.

For instance, they seem to only look at mass scale script kiddie sprays, a targeted attack will likely not use the mentioned passwords. As one can come up with much better and more likely to succeed candidates.

It also entirely misses attacks that come from a more privileged position (like in Windows directly authenticating to the domain controller) where an adversary can do millions of attempts in short time because of typical monitoring gaps.

</comment><comment><USER40> > _500M is ½ a billion, home rigs can run 100B guesses a second – so that > complete list just takes 5ms to try._

5ms?

It would take more than that to just read the 500M passwords into memory, no?

<comment><USER41> Well yeah. But you, presumably, only have to do that once. After that you get 5ms per account, which seems to be the important takeaway.

<comment><USER40> But even then, 5ms seems extraordinarily fast on a home machine.

A couple of years ago I tried to bruteforce my WPA wifi handshakes and also played a bit with Hydra and I don't think I got even close to such speed.

</comment></comment></comment><comment><USER42> Which is why we use hardware password managers and randomly generated unique passwords for every account. _pets finalkey_</comment>


The trade war is weighing on Chinese home buying in the US - <AUTHOR> https://www.cnbc.com/2019/06/26/the-trade-war-is-weighing-on-chinese-home-buying-in-the-us.html <comment><AUTHOR> It is bizarre to me that the language in this article implies this is a bad thing.</comment>


Ask HN: What do you do for lunch as a remote employee? - <AUTHOR> As a remote employee, what do you typically do for lunch?
I work for a fully remote company (i.e. we have no office so all our employees work from home or locations of their choosing).
To increase facetime with friends (and people in general), I generally make lunch plans either inviting other friends who work remotely over for lunch or go out with friends who work nearby. <comment><USER2> When I work from home (about twice a week) I usually take my elderly mom out to a local restaurant for a quick lunch. I regret nothing. :)

<comment><AUTHOR> Good for you! That sounds like a lovely way to catch up and make sure you see each other regularly!

</comment></comment><comment><USER3> I just accepted a nearly-100% remote position at a software startup. I'm interested in any details others can share about what works and doesn't work in daily life.</comment>


HireArt (YC W12), A Job Applicant Screening Service, Gets More Affordable - <AUTHOR> http://techcrunch.com/2013/09/30/hireart-a-job-applicant-screening-service-used-by-airbnb-cisco-ebay-others-gets-more-affordable/

<comment><USER2> This is completely shameless. Several of the commenters here, such as "onewong", are sock puppet accounts for the company. See him/her previously giving "good job!" type comments to esharef (the founder). Other account with a similar comment created just for this post. A Y Combinator company manipulating HN with shill accounts? Really?

<comment><USER3> Yep, it's embarrassing and really unnecessary as HireArt sounds like a good idea and appears to be well executed. If you look back at many of their posts, there's at least one newly created account and a few reused accounts adding very little to the conversation, just espousing the company.

</comment></comment><comment><USER4> GREAT to see Hireart making moves. I've used them in my job search in the past and have always had an awesome experience.

</comment><comment><USER5> I just checked out the website. So it doesn't have any jobs in programming/development/engineering?

</comment><comment><AUTHOR> Here is a discount code you can use (25% off for employers) [https://www.hireart.com/for- employers?code=techcrunch](https://www.hireart.com/for- employers?code=techcrunch)

</comment><comment><AUTHOR> Hey Baltcode, This is Elli, Co-Founder at HireArt. We actually only do jobs for non-technical hires (marketing, business development, sales, operations, etc)

Thx for checking it out!

</comment><comment><USER6> Great platform update

</comment><comment><USER7> this is truly a shameless advertisement in the form of a news article. throwing in a discount code at the end to put the cherry on top.

</comment><comment><USER8> This is a great improvement. Good idea to offer the coupon...</comment>


Getting fancy with the console - <AUTHOR> http://www.thecssninja.com/javascript/console <comment><USER2> This could really do with the word "JavaScript" in the title, as "the console" could mean a great deal of different things to different readers.

<comment><USER3> I don't even like the name "console" in the context of js, why didn't they pick "logger"</comment></comment>


Lockheed Martin receives $187.5M for mesh network of 10 small satellites - <AUTHOR> https://defence-blog.com/news/lockheed-martin-receives-187-5-million-for-mesh-network-of-10-small-satellites.html <comment><USER2> This is lifted from [https://news.lockheedmartin.com/news- releases?item=128968](https://news.lockheedmartin.com/news- releases?item=128968). We ban sites that do that.

</comment><comment><USER3> This is timely, considering that the antisatellite arms race seems to be heating up:

[https://www.spacecom.mil/MEDIA/NEWS- ARTICLES/Article/2285098...](https://www.spacecom.mil/MEDIA/NEWS- ARTICLES/Article/2285098/russia-conducts-space-based-anti-satellite-weapons- test/)

[https://en.wikipedia.org/wiki/Anti- satellite_weapon](https://en.wikipedia.org/wiki/Anti-satellite_weapon)

We're insanely dependent upon satellite communications for much of the world, and they're really fragile. Even military applications aside, it's massively commercially useful to be able to push a button and disable a competitor's communications (or a whole nationful of competitors).

<comment><USER4> I don't think it is possible to ever develop a satellite constellation that will be able to defend against a terrestrial actor intent on disabling it. At least not until the space-based weapon systems are superior to all ground- based weapon systems and can comprehensively track and disable any threats before they strike.

<comment><USER5> It would be difficult to disable a significant fraction of the proposed 60,000 Starlink satellites.

</comment></comment></comment><comment><USER6> I wonder if any of the "in-silo, ready to launch at a moment's notice" ballistic missile platforms could be repurposed to carry a bunch of communications satellites. In the event of a wipeout, it could be a way to quickly get back in the game.

<comment><USER7> Unfortunately private corporations cannot reuse ballistic missile platforms due to a law passed long ago to stop undue competition and favoritism, the payload has to be earmarked for government use, but if so, then yes.

I wish I could find a reference to the bill, maybe someone can chime in.

<comment><USER8> Minitaur is a US space launch system that isn't only based on ICBMs like many others but is literally made from decommissioned Peacemaker ICBMs.

</comment></comment></comment><comment><USER9> The protocol of communication used in this network is most probably highly proprietary. Though I wonder which of the reference routing protocols they have used as a base [https://en.wikipedia.org/wiki/List_of_ad_hoc_routing_protoco...](https://en.wikipedia.org/wiki/List_of_ad_hoc_routing_protocols)

</comment><comment><USER10> space force</comment>


Firefox Version Number Degraded To "Implementation Detail" - <AUTHOR> http://www.conceivablytech.com/7622/products/firefox-version-number-degraded-to-implementation-detail

<comment><USER2> I as a web developer really like this, users shouldn't be required to do all these chores of upgrading every simple app, especially web browsers, though to be reasonable they should get an opt out option, in case they want to do it manually.</comment>


MoHo: New real estate product: any feedback? - <AUTHOR> http://www.mo-ho.xyz

<comment><USER2> Didn't return any results. Let me know when to try again.</comment>


What is GraphBLAS? - <AUTHOR> http://aldenmath.com/what-is-graphblas/ <comment><USER2> Back in my heady grad school days I was working on the old "Texas" concepts proposal for C++. We published this paper:

        https://parasol.tamu.edu/~jarvi/papers/gpce07.pdf

Which used the 'concept map' feature to lower a flood-fill onto the Boost Graph library (BGL). What went unpublished was that we then lowered the PBGL (parallel BGL) onto a Fortran BLAS implementation. Then we ran image algorithms (usual spectral analysis stuff) on BGL on Fortran BLAS. It was _lightning_ fast. In fact, the results were so good, we didn't publish them because it was too much work to explain how — with all the abstraction layers — it could be so fast. Good times.

</comment><comment><AUTHOR> Also see Prof Tim Davis recent interview with the ACM: [https://www.acm.org/articles/people-of-acm/2019/tim- davis](https://www.acm.org/articles/people-of-acm/2019/tim-davis)

</comment><comment><USER3> Sorry if this is nonsense, are these semirings a form of "Kernel (linear algebra)"? They seem superficially similar at least, a normalized matrix which can serve as an operation applied stepwise to a larger dataset.

<comment><USER4> Here are are a couple good introductions to semirings:

[https://www.youtube.com/watch?v=Gd_VT_Nj8Xw](https://www.youtube.com/watch?v=Gd_VT_Nj8Xw)

[https://www.youtube.com/watch?v=dluPFbuq6zs](https://www.youtube.com/watch?v=dluPFbuq6zs)

Dr. Jeremy Kepner's paper is a good follow up read after those two quick videos:

[http://www.mit.edu/~kepner/GraphBLAS/GraphBLAS-Math- release....](http://www.mit.edu/~kepner/GraphBLAS/GraphBLAS-Math-release.pdf)

<comment><AUTHOR> Hi Michel - You're working on a GraphBLAS Postgres implementation [0] -- here's an open question I've been pondering...

[0] Postgres GraphBLAS [https://github.com/michelp/pggraphblas](https://github.com/michelp/pggraphblas)

Now that we have SOTA linear algebra models for graphs [1], logic [2] and the lambda calculus [3] that are being optimized for vectorized parallel compute on modern CPU/GPU/TPUs -- do we have the makings for a unified linear algebra model that obsoletes the relational algebra model in relational DBs?

[1] _Graph Algorithms in the Language of Linear Algebra_ (2011) [https://epubs.siam.org/doi/book/10.1137/1.9780898719918](https://epubs.siam.org/doi/book/10.1137/1.9780898719918)

Mathematical Foundations of the GraphBLAS (2016) [https://arxiv.org/pdf/1606.05790.pdf](https://arxiv.org/pdf/1606.05790.pdf)

[2] A Linear Algebraic Approach to Datalog Evaluation (2017) [pdf] [https://arxiv.org/abs/1608.00139](https://arxiv.org/abs/1608.00139)

A Linear Algebraic Approach to Logic Programming (2018) [https://www.imperial.ac.uk/media/imperial-college/faculty- of...](https://www.imperial.ac.uk/media/imperial-college/faculty-of- engineering/computing/public/1718-pg-projects/AspisY-Logical-Abduction-via- Linear-Algebraic-Methods.pdf)

[3] Lineal: A linear-algebraic Lambda-calculus (2017) [https://arxiv.org/pdf/quant-ph/0612199.pdf](https://arxiv.org/pdf/quant- ph/0612199.pdf)

The Vectorial λ-Calculus (2017) [https://arxiv.org/pdf/1308.1138.pdf](https://arxiv.org/pdf/1308.1138.pdf)

Simple λΠ-interpreter for matrix computation (2017) [http://cs242.stanford.edu/assets/projects/2017/nykh.pdf](http://cs242.stanford.edu/assets/projects/2017/nykh.pdf)

Algebra and the Lambda Calculus [https://people.csail.mit.edu/jaffer/lambda.txt](https://people.csail.mit.edu/jaffer/lambda.txt)

</comment></comment></comment><comment><AUTHOR> Has anyone tried to compile GraphBLAS via emscripten [1] and have it running on wasm [2]?

[1] [https://emscripten.org](https://emscripten.org)

[2] [https://webassembly.org](https://webassembly.org)

<comment><USER4> sounds like a pretty cool idea!

</comment></comment><comment><USER5> How do these dense linear algebra oriented implementations differ with stack- oriented algorithms, like in [https://github.com/chen0040/lua- graph](https://github.com/chen0040/lua-graph) ?

<comment><USER6> Nitpick: The article talks about sparse linear algebra (rather than dense) by modeling a graph traversal as a sparse matrix-vector multiplication. The sparse matrix represents the adjacency matrix of the graph, and the vector represents the subset of vertices that are currently "active" (you can think of an active vertex as being in the workqueue for a breadth-first-search).

I haven't tried benchmarking Prof. Davis's GraphBLAS implementation myself against the one you linked to. My intuition would be that the GraphBLAS one is faster for larger graphs, because it uses data structures like CSR (compressed sparse row) [1], which are heavily optimized for processing static graphs (i.e. graphs that are not very amenable to adding vertices or edges). Based on the code examples on the first page, lua-graph seems more focused on small, dynamic graphs where the user can easily add vertices and edges. Short answer: they target different sets of applications. GraphBLAS is faster for processing large, static graphs with |V| and |E| in the millions or billions. lua-graph perhaps more flexible and handles dynamic graphs.

[1] [https://en.wikipedia.org/wiki/Sparse_matrix#Compressed_spars...](https://en.wikipedia.org/wiki/Sparse_matrix#Compressed_sparse_row_\(CSR,_CRS_or_Yale_format\))

<comment><USER7> GraphBLAS uses sparse matrices internally, and the API assumes a sparse format. The data structure is opaque, however, so if I want, I could use dense matrices if it's faster (and there are times when that's faster; see for example the vector v in the push/pull BFS in LAGraph, at [https://github.com/GraphBLAS/LAGraph/blob/master/Source/Algo...](https://github.com/GraphBLAS/LAGraph/blob/master/Source/Algorithm/LAGraph_bfs_pushpull.c) ). However, I don't switch to dense matrices automatically yet.

SuiteSparse:GraphBLAS does have a fast incremental update mechanism, but it's not (yet) as flexible as other approaches. But the beauty of GraphBLAS is that the data structure is entirely opaque to the user, so if a library implementor such as myself wants to plunk in an entire new one, then the user code that relies on GraphBLAS doesn't change. It would be possible, even, to use lua- graph internally (or anything else, license permitting), and then to select the fastest format for the problem at hand. Or, lua-graph (or any graph library) could be augmented to support a GraphBLAS API to its functionality.

Currently, SuiteSparse:GraphBLAS has four matrix formats: CSR, CSC, hypersparse CSR, and hypersparse CSC. The CSR and CSC formats take O(|V|+|E|) space, and the hypersparse formats take O(|E|) space. Hypersparse matrices arise in some problems, and subgraphs are often hypersparse. In the future, I would like to add a CSB format as well. I select between standard and hypersparse formats automatically. The default is CSR and I don't pick CSC automatically. In some cases, it would make sense to hold the matrix in both CSR and CSC formats, simultaneously, thus allowing fast access to both the in- and out-adjacency lists at the same time (at the cost of double the memory). I don't do that yet, however.</comment></comment></comment>


MacOS Sierra Beta - <AUTHOR> https://developer.apple.com/macos/ <comment><USER2> I've been a Mac-only user for about 15 years now, and I'm teetering on the edge of abandoning the platform. A lot of technically-minded people I know are considering the same. The hardware is outdated, underperforming, and overpriced - and what's worse is Macs are now _completely_ user-unservicable. So I'm weary when I read about an OS update nowadays (it used to be I was excited), because OS X has been getting slower and more tedious to work with for a long time now.

Metal: it's good that Metal exists, even though Apple has no ambitions to introduce performant or even recent graphics adapters into its PC products. Some people may even have wished for Metal adoption beyond Apple, but that's not happening. What's conspicuously missing from Sierra is Vulkan support, so gaming on the Mac is basically a prohibitively walled garden that can only be tackled economically by the big graphics engines (which have mostly ignored the platform) and pre-existing iOS developers.

Swift 3 and Apple Pay: this should not be an OS feature, or at least one that is featured as spots #2 and #3 on the bullet point list.

Picture in picture: in a better world, this would be a window management feature, but OS X is reducing its windowing capabilities in anticipation of a full merge with iOS, it seems. So this is going to be a specialized video component feature instead. Even on the screenshot they chose to show this off with, it's clear this is drastically worse than just lining up non-fullscreen windows side-by-side.

<comment><USER3> PiP looks great. There's nothing stopping you from opening two browser windows side by side, but that's a huge pain. I don't want all the various other parts of the webpage showing, or to have to resize the window manually to just show the video. I just want to pop-out the video only. I love the feature on my iPad. I think when you try it, you may grow to appreciate it.

<comment><USER2> _> PiP looks great._

For me at least, there is no way to look at that screenshot of a space-wasting yet partially occluded fullscreen app with an awkwardly-placed naked video component on top of it and say it "looks great".

 _> windows side by side, but that's a huge pain_

Window positioning on OS X is a huge pain because literally no work has been done on this by Apple for many years now. Other OSes all have window snapping and other conveniences, but on OS X I need 3rd-party software for that. What's more is that PiP is a barely adequate specialized component from iOS. The more generalized desktop element would instead have allowed to "PiP" any window content I choose by essentially being an always-on-top decorator-less partial window. But the way they are presenting it is not going to be empowering for desktop users in any way. It's a thoughtlessly ported component from the more unpleasant corners of the Youtube iOS app.

<comment><USER4> There is window snapping in macOS, websearch for Sierra window snapping.

</comment></comment></comment></comment><comment><USER5> I am using the public macOS and iOS betas. They are buggy.

Do not enroll in the macOS beta if you have your user account login linked to iCloud, as there have been documented problems with this. My wife still can't get in to her account on our Mac; I'm hoping they fix this in Public Beta 3.

All things considered, it probably wasn't worth enrolling in the betas. I don't want to risk messing up my devices by stepping back to production versions, so I'll just ride these out and get off the beta profile when the final versions are released in the fall.

Hopefully the public betas get more stable as we approach release time.

<comment><USER6> Interesting to see the other side. I've always used the iOS betas and they've always had the usual expected bugs before say the last pre-release version, but with iOS 10, for the very first time I've found it to be really very usable. It does destroy your battery life like all betas - but it'll have so much debugging turned on and it is... well... beta! But yeah I'm loving iOS 10 (dev) beta as are my coworkers so much that we've put it on our personal phones and are really happy with everything but the battery life and the odd springboard crash every few days or so.

<comment><USER7> I've had opposite experience, prior betas were very usable, no issues, while iOS 10 has first weirdly notable bug in a "public" beta for me:

Certain Apple first party app background processes don't seem to be updating status as background tasks progress:

\- App Store Updates tab doesn't show progress in the circles. Shows initial circle, appears frozen, until app is ready to open and moved to the recently updated section.

\- Photos "Uploading n items" status doesn't update until changes to time stamp of when done updating or Now.

Leaving and coming back, force quitting, even rebooting, doesn't seem to cause these screens to update until background process is complete.

However, they are definitely progressing in the background as the tasks eventually finish, then screens update to show completed.

</comment></comment></comment><comment><USER8> GPGTools (MailGPG etc) and rustc / cargo stable are broken with macOS Sierra.

Moreover there seem to be a few memory leaks. Finder eats up more and more RAM until it requires a force-relaunch. Unfortunately the same seems to be true for the kernel, which therefore requires a sporadic reboot. I also encountered the calendar notification service using 100% of the CPU a few times.

I'd wait for a later beta release or the final version.

<comment><USER9> What's broken about Rust? Can you file an issue :)

</comment></comment><comment><USER10> Looks like Safari is getting some much needed updates with extensions and the upcoming community engagement. Apple Pay in Safari will allow Apple to add another device type to its payment ecosystem. Overall Safari is getting stronger and is moving in the right direction to keep pace.

<comment><USER11> Still Apple Pay seems to be americo-centric with only supporting credit cards. In Europe SEPA wire transfers and direct debit is cheaper, safer and has a wider use-case (you can send money to any bank account).

<comment><USER12> > Still Apple Pay seems to be americo-centric with only supporting credit > cards

I don't understand - do you pay for everyday goods and services with wire transfers and direct debits? Because that's the use case of Apple Pay isn't it?

I'm not sure how anything could be quicker than a credit card. A normal contactless transaction from me taking my wallet out of my pocket to being done takes about two seconds. Apple Pay is no different except I take my phone out of my pocket instead of my wallet. Maybe Apple Pay by watch could be quicker?

<comment><USER13> For groceries: 50% cash, 50% debit cards or direct debit – they instantly score you and the content of your shopping cart and use the riskier but free direct debit if they trust you.

But most people have CCs now as well. It's the only sane option besides paypal and quite useful when traveling. I'm pretty sure though that a rather large percentage of CC users pay it within the month and avoid interest.

<comment><USER12> Direct debit may be free, but they pay _me_ when I use a credit card, with cashback, so it's even better than free. (Of course I know I pay for processing fees in the overall price, but if I'm paying that anyway I should use the credit card).

</comment></comment></comment></comment></comment><comment><USER14> Meh. A bunch of silly gimmicks. Meanwhile, drag & drop still randomly breaks in Finder, using certain USB 3.0 devices on my mid 2012 MBP causes reproducible kernel panics and Mail.app occasionally crashes while downloading emails.

Maybe have some of the gimmick crew look at all those crash reports I keep sending instead?

</comment><comment><USER15> Since there's no context, the news today is Beta 4.

The betas have been on a roughly 2 week release cycle.

</comment><comment><USER16> This seems pretty underwhelming. Swift isn't even a platform feature. Metal is mostly useless for portable application developers, who probably wish it were Vulkan; and furthermore it may indicate that the quality of the OpenGL stack will degrade over time. Given how little time is actually spent entering payment details, I do it maybe once a month, I also don't see the point in Apple Pay on OS X except perhaps for completeness.

The deeper platform features, especially the new filesystem, are exciting primarily because they're replacing vastly outdated predecessors.

</comment><comment><USER17> Anyone using the betas?

I'm thinking about installing the iOS 10 beta to my main phone but couldn't find any decent info on its stability for a daily driver. macOS is more dangerous anyway so I'd only get into iOS beta.

<comment><USER18> Don't install the beta. iOS 9 beta literally bricked iCloud backups on my iCloud account. I had to get Apple Engineering to wipe everything. Even deleting backups wouldn't fix it, it had to be cleaned up in the backend. Yuck.

<comment><USER7> The production iOS 9 cloud restore 'bricked' iCloud photo sync from my devices (iCloud Photo Library, not Photostream which was fine).

iCloud Photos wouldn't update on the devices because iOS 9 thought the devices were still restoring from backup. Apparently a known issue with tedious workarounds involving mounting phone as a drive.

iOS 10 beta fixed the issue (perhaps expectedly, as it wouldn't make sense to preserve a pending iOS 9 restore after update), and all the iCloud Photo Library syncs worked again.

</comment></comment></comment><comment><USER19> I prefer as little interaction with Apple's data centers as possible, but that is the opposite of the direction MacOS is headed. A quick review of increasing number of web services I pay for each month makes for depressing reading and I see the handwriting on the wall... soon I'll be paying apple to view my files.

</comment><comment><USER20> Looks like go(lang-1.6.3) is broken again in this beta, worked nice in beta 3.

<comment><USER21> Do you have a link to a discussion around this? A quick search of their GH issues as well as mailing lists didn't turn up anything.

<comment><USER20> Go 1.7-rc5 with a fix for macOS Sierra beta 4 is released [0], see also this issue [1]

[0] [https://golang.org/dl/#go1.7rc5](https://golang.org/dl/#go1.7rc5)

[1] [https://github.com/golang/go/issues/16579](https://github.com/golang/go/issues/16579)

</comment></comment></comment><comment><USER3> Are there APIs for Apple Pay and PIP that would let Firefox integrate those features if they desire, or are those APIs locked down for Apple only?

<comment><USER22> Apple Pay: From [https://developer.apple.com/videos/play/wwdc2016/703/?time=9...](https://developer.apple.com/videos/play/wwdc2016/703/?time=908): "You take an Apple Pay server URL, and this URL is provided from Safari. You send this URL to your web server, which then requests the merchant session." -> Seems like Safari only :/

PiP: From [https://developer.apple.com/macos/](https://developer.apple.com/macos/): "And if you use a custom video player, it's easy to add a Picture in Picture control using the JavaScript presentation mode API." -> Seems like it's possible for 3rd party browsers to implement it!

<comment><USER23> They have said that Apple Pay for the web would converge with window.Payment but atm they do not feel the spec is acceptable enough.

<comment><USER3> Not familiar with Apple APIs. Is that supposed to mean that they plan to eventually open up the API so that other browsers could implement it, or no?

<comment><USER23> No so the window.Payment[1] isn't in the right place yet—according to Apple—to be ready for their use. You can read more in [2]. So eventually ApplePay.js would (I presume based on their language) disappear to some extent and all browsers could use the Payments API and Apple wouldn't need their own custom solution.

[1] [https://www.w3.org/TR/payment-request/](https://www.w3.org/TR/payment- request/) [2] [https://lists.w3.org/Archives/Public/public-payments- wg/2016...](https://lists.w3.org/Archives/Public/public-payments- wg/2016Jun/0013.html)</comment></comment></comment></comment></comment>


New cancer treatments have perplexing side effects - <AUTHOR> https://www.washingtonpost.com/national/health-science/new-cancer-drugs-have-perplexing-side-effects/2018/01/02/9b84fa1e-d909-11e7-a841-2066faf731ef_story.html <comment><USER2> I am not a scientist or a MD but I always thought there was a strange logic in using immunotherapy against cancer.

Virtually all chemotherapies cause depression of the immune system, and it makes sense for patients who have an advanced form of cancer, as metastasis has a lot in common with wound healing [0].

Even NSAIDs are known to slow metastasis.

So in my lay person view I have problems to understand how _increasing_ the activity of the immune system would help. After all we are not the sum of isolated unspecialized cells, on contrary the ECM is a biology active area with lot of signaling.

Maybe someone can shed some light on this question?

[0] The biology of cancer, Weinberg

</comment><comment><USER3> Until we have the ability to make/tailor drugs to the individual, there will always be side effects.

Also throw in the fact that curing someone is not nearly as profitable as treating them. It's the American way!</comment>