Gigabytes of user data from hack of Patreon donations site dumped online - <AUTHOR> http://arstechnica.com/security/2015/10/gigabytes-of-user-data-from-hack-of-patreon-donations-site-dumped-online/ <comment><USER2> That's pretty devastating to anybody who gave up their data to support things they enjoy. I would really like to see services getting hit with massive fines so they actually "take security very seriously" before they get owned. It's far too late to care about it now, there's a lot of compromising data in that leak.

<comment><USER3> How do you distinguish someone who was lax with their security from someone who actually takes it seriously and still got hacked?

<comment><USER4> You can't :)

There is a huge Market for Lemons ([https://en.wikipedia.org/wiki/The_Market_for_Lemons](https://en.wikipedia.org/wiki/The_Market_for_Lemons)) style scenario in IT systems with relation to security.

Everyone will say "we take security seriously", but there's no way for ordinary consumers (or indeed most companies) to determine what the company meant by their statement, and to evaluate the relative security of the systems of two companies.

This could actually provides a market incentive for companies not to spend too much on security, as those that do will have lower profits than those that don't.. until they get breached, and even then companies with good security can be breached...

<comment><USER3> I don't think it's actually that bad; for example, Patreon said that they don't store CCs and that they correctly hashed passwords, and as a consumer myself, I did take that into account. Obviously less knowledgeable consumers don't know what "bcrypt" is, but that's true of any product - you can't judge what you don't know how to judge.

<comment><USER4> so with two patreon style sites both of which say "we take security seriously" , until they have a breach, how would you judge which one would take better care of your data?

The information (AFAIK) about their security mechanisms only got released as a result of the breach, so even assuming you knew what the terms were and how to judge good security from bad, you wouldn't have the information until the site got compromised.

This is a _very_ common problem, some more examples here [http://raesene.github.io/blog/2014/06/08/finding- security/](http://raesene.github.io/blog/2014/06/08/finding-security/)

<comment><USER3> The information that they didn't store CC cards was available in FAQs previously: [https://patreon.zendesk.com/hc/en- us/articles/203913779-Do-y...](https://patreon.zendesk.com/hc/en- us/articles/203913779-Do-you-store-my-credit-card-information-)

The password hashing algorithm wasn't, but then again an informed consumer uses unique passwords for each site, so that's less relevant.

<comment><USER5> Many informed customers - perhaps most - use the same passwords on many sites because it's too hard to remember hundreds of passwords.

<comment><USER3> I don't think they're particularly informed if they aren't aware of password managers.

<comment><USER6> I'm aware, I just can't be bothered. Every time I create an account I ask myself "do I care if this gets compromised?". If the answer is no, then it gets a standard password.

<comment><USER7> As long as you understand that when that site gets compromised, all other sites where you use your standard password get compromised for you as well. Collectively, all those sites getting compromised for you may be enough of a reason to consider password managers.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Apparently they were compromised via a publicly exposed Werkzeug debugger: [http://labs.detectify.com/post/130332638391/how-patreon- got-...](http://labs.detectify.com/post/130332638391/how-patreon-got-hacked- publicly-exposed-werkzeug)

<comment><USER9> There's almost no hack needed here, as the article says, they basically opened up remote code execution to anyone. That's shockingly bad.

<comment><USER10> Makes me wonder what can be done to prevent this from happening without making it a terrible experience from a user point of view. Maybe the solution would be to store a password for the debugger and ask for it on first usage.

<comment><USER11> It said the guys name in the subdomain that this was available on. I can only imagine how that guy must feel, worst thing that I can imagine happening as a dev.

We've all made stupid mistakes and not paid a price as high as this!

<comment><USER12> Mistakes happens. But it should not be possible to put production data in publicly accessible systems by mistake. Not without committing a criminal offense, at the very least.

Your customer data is your customers' data. It's not yours to toy with as you please.

<comment><USER13> >Your customer data is your customers' data. It's not yours to toy with as you please.

That's the European point of view. In the US, customer data is nothing more than an asset.

</comment></comment></comment></comment></comment></comment><comment><USER14> This just got me thinking, which would be worse -- your account data from any one site leaked, or _metadata_ about your internet activities leaked? Thinking about the arguments about mass data collection and metadata, I'm pretty certain I'd be most worried about metadata. Do metadata-collecting companies tend to be more secure, or more security aware, or it just hasn't happened yet?

What I mean is, if your private browsing session from your laptop, along with non-private sessions, and data connections for IM conversations, were all leaked, that would be intensely revealing.

<comment><USER15> AIUI most states don't require breaches to be announced unless they get some combo of credit cards, passwords, email/name/phone, and govt' IDs. So metadata spying companies like Adobe/Omniture might never report being hacked at all.

Frankly it bothers me how lackadaisically business types treat security sometimes, caring more about company image than customer privacy, to the point of never revealing massive breaches if they don't hit states' ridiculous requirements for disclosure.

</comment></comment><comment><USER16> I was somewhat surprised to find my email on the list, since I don't have a Patreon account.

It seems that when Subbable was acquired by Patreon, they got the user information, and possibly password database, too. I can't log in to Patreon with my Subbable password, but my email address is definitely in the breach.

Makes me glad I use a password manager.

It's also a sobering reminder of the permanence of user data. You have to trust the competence of not only the service you use now, but any company that owns that service down the road. (Not that Subbable was necessarily more secure than Patreon.)

</comment><comment><USER17> I had just been listening to the "Talk Python to Me" podcast episode with Albert Sheu of Patreon ([http://talkpython.fm/episodes/show/14/moving-from- php-to-pyt...](http://talkpython.fm/episodes/show/14/moving-from-php-to- python-3-with-patreon)). Having heard the guy's voice and his enthusiasm for his work makes me really feel sorry for the team at Patreon. This is pretty much worst case and may end the company.

<comment><USER18> Why do you think it'll end the company? It's a marketplace with network effects. And not to mention, many people depend on Patreon for their primary source of income. It won't simply just go away.

</comment></comment><comment><USER19> Hey, guess what? To delete your account, you have to e-mail firstname.lastname@example.com "from your registered e-mail address". There is no way to do it over a secure connection. What could go wrong?

<comment><USER20> For anyone that doesn't know, email is not a "secure connection" and the "from" address on an email can be spoofed.

</comment></comment><comment><USER21> This scares me. I'm the eng lead of a startup that's a bit smaller than Patreon. And hey, we program in Python too.

We're not vulnerable to this particular problem. And I feel pretty confident that both our stage and production environments are well-protected. However, I can't help but wonder if I'm missing something. I'm sure Patreon felt confident a month ago.

<comment><USER22> If you'd like some free help I don't mind spending some time looking at your overall setup. Feel free to email me ross [at] ruselabs.com.

</comment></comment><comment><USER23> Has anyone checked to see if any Facebook access tokens were saved unencrypted in the database? They mention that users who logged in with Facebook instead of username/password would be completely safe, but if access tokens were leaked, then many users could have their Facebook data mined.

<comment><USER24> Are Facebook access tokens vulnerable to such an attack?

If I remember correctly, at least Google tokens wouldn't be: The application receives a token from Google. With that token, a new session token is created. This session token expires and can only be renewed with the application token and the correct redirect URL.

If Facebook uses a similar scheme, tokens would be useless without the running application renewing session tokens.

<comment><USER21> Nothing like that happens with Facebook, if I recall correctly. Once you have an access token you're good to go until it expires.

</comment></comment></comment><comment><USER25> This is the first time I've been Pwned ([https://haveibeenpwned.com/](https://haveibeenpwned.com/))

Does anyone know a responsible way I can check WHICH of my data has leaked short of downloading the entire archive and searching for myself?

<comment><USER26> Through the API: [https://email@example.com...](https://firstname.lastname@example.com)

I also couldn't find the details in the site anywhere.

<comment><USER27> [https://haveibeenpwned.com/PwnedWebsites#Patreon](https://haveibeenpwned.com/PwnedWebsites#Patreon)

</comment></comment></comment><comment><USER28> So what of importance is in their database that one could not find by otherwise searching the web?

From the email i received from patreon i reckon the only actual private thing is the exact sum i pay to who.

Some find addresses to be private, but at-least in my case any one can find where i live by looking on the local yellow pages website.

<comment><USER29> Some GamerGate supporters have made claims that video game reviewers have covered games and develelopers that they have backed financially through Patreon without disclosing this to their audience.

This disclosuee would allow those making that claim to demonstrate if their claims are accurate, and it allows those about whom the claim is made to demonstrate that the claim is inaccurate.

<comment><USER30> Do GG accusations actually matter anymore? Does anyone still care besides the people actually making the accusations?

</comment></comment></comment><comment><USER31> There is a lot we can do as programmers to make data leaks of that scope a lot harder to pull off. I think web apps of a certain magnitude should not be talking directly to the database, they should be talking to their internal data API that resides on a different server. The reason for this is that a completely separate data layer is easier to lock down, and also way easier to monitor for unusual activity. Ideally, that internal API server couldn't even communicate with the internet directly.

I've been doing web programming for a long time, and while direct DB access is both convenient and fast, I have to admit it's not easy to monitor these databases for breaches, or to stop them from spilling their entire contents if so requested.

<comment><USER3> If the frontend layer needs to access the data anyway, how does that separation help? And why is it easier to monitor for unusual activity?

<comment><USER31> _> If the frontend layer needs to access the data anyway, how does that separation help?_

It helps in multiple ways. Since you define the data API yourself, you can tailor it tightly to only the exact operations you need. This makes it more difficult to flat-out drain everything (or even query everything, depending on your app). It's also another layer of insulation. The fact that it's another, non-standard access protocol also helps. If I'm an attacker, I'll probably have a harder time figuring out how the custom data layer works; and when I'm done with that I still need to actually siphon the data, which will ideally require me to either issue millions of suspicious requests, or try to break into the API server itself, which has a drastically reduced attack surface compared to a typical web app. Which is where your second question comes in:

 _> And why is it easier to monitor for unusual activity?_

Because you know what the legitimate access patterns of your app look like, you can raise flags programmatically. In fact, you can incorporate certain checks right from the time you start writing your API. It puts you, as a programmer, into a position of control and you can use the global insight you have into your app's design to your advantage by defining what's normal and what's not.

Compare that with a general-purpose DB interface, which is ...well, general purpose. It doesn't _know_ when it's doing something implausible. When something goes wrong with these databases, it's often the _admin /ops_ people who notice it, if at all.

<comment><USER3> _> Since you define the data API yourself, you can tailor it tightly to only the exact operations you need. This makes it more difficult to flat-out drain everything (or even query everything, depending on your app)._

Considering that the database was designed specifically to support the website (so it's not supposed to have unrelated data), and that the frontend intermediates all access to the data, wouldn't the sum of the operations require access to all data? Why would you have data that was not needed by the website?

 _> If I'm an attacker, I'll probably have a harder time figuring out how the custom data layer works_

This is just security by obscurity, except if the attacker has access to the client code, it's not even very obscure. Finding all calls to the backend API is a trivial task nowadays.

 _> Because you know what the legitimate access patterns of your app look like, you can raise flags programmatically._

Why can't you do that from the database logs? A query is just like an API call - you can raise flags if the frontend makes queries outside of a known pattern (ie, non-recognized queries or in an unexpected order).

<comment><USER31> _> wouldn't the sum of the operations require access to all data_

 _How_ you can access the data matters, and typically not all data (nor all views to that data) are required to run the app. Some info should only ever travel one way (typically from the web server to the backend, like passwords, analytics, or payment data). There are whole categories of information that do not _ever_ need to be queried in bulk by a legitimate user.

 _> This is just security by obscurity, except if the attacker has access to the client code, it's not even very obscure._

It's not like this approach in any way _relies_ on that obscurity, but as a measure to increase time and effort required by the hacker, I'll take it. Just increasing the time spent figuring out how to query the backend gives site operators additional opportunities to spot that something is wrong. Compare this to the immeasurably small effort required to dump all SQL tables into a text file.

 _> Why can't you do that from the database logs?_

Typically logs aren't analyzed in real time, and I'd hazard a guess in most cases they're not even analyzed at all. Most databases don't even keep an access log by default, and in many cases it's hard to implement one that is useful.

 _> A query is just like an API call - you can raise flags if the frontend makes queries outside of a known pattern_

Theoretically: yes, practically: no. In case of SQL databases, this would practically mean communicating with the DB exclusively through stored procedures (or event handlers/filters in case of document databases), which is a poor man's version of what we're talking about in the first place. In practice, almost nobody uses their database in this way, because it's really painful and does not even offer that much protection.

</comment></comment></comment></comment></comment><comment><USER32> This is now so common I am starting to become numb to about it.

</comment><comment><USER33> "we take security seriously" reminds me "we come in peace" from Iron Sky :)

<comment><USER34> Unless every single employee actually follows this clause, just one bad apple can ruin every security procedure in the world. Layer 8 is awfully vulnerable...

<comment><USER33> >Unless every single employee actually follows this clause, just one bad apple can ruin every security procedure in the world.

the point of good security architecture is exactly that such thing can't happen. Security by compliance isn't good security.

</comment></comment></comment><comment><USER35> I'm wondering what their setup is?

Are they running on their own machines? AWS? Heroku?

From looking at their careers the use PostgreSQL/MySQL, Python, Scala, Ruby, Node.

I am assuming because of the nature of the breach that they are running their own servers (either on AWS or their own machines), it's a completely compromised server which had access to everything.

<comment><USER36> Since their servers appear to run on AWS, and knowing that the breach was possible because their development servers were exposed to the public with production user data, it is safe to assume that they had their development servers on AWS as well.

<comment><USER35> Ah, development servers with real data.

</comment></comment></comment><comment><USER37> This could be quite a scary prospect. There are certain anonymous and controversial artists who have solicited and received donations through Patreon. Some of these artists remain anonymous because of the controversial nature of their work. I think this is a scary prospect for both patrons and artists.

</comment><comment><USER18> Why don't more websites that are vulnerable to these types of breaches also encrypt user email addresses as well any personally identifiable information? I don't foresee any performance implications if everything is cached anyways.

<comment><USER4> the problem is, if you intend to use the data within the application, you need to be able to decrypt it. If you can decrypt it, so can anyone who compromises the website :)

with e-mail addresses you need to use them in their unencrypted form (e.g. as login names), so encrypting wouldn't do much for you against most attacks.

<comment><USER18> Depends on the attack. If the key used to encrypt the data is stored on another server and loaded into memory when the application is initialized, then the attackers technically wouldn't be able to get access to that key unless they also hacked the server with the key.

<comment><USER2> I don't see how that protects anything, if the information is around for the webserver to use it's around for whoever has root on your box.

<comment><USER18> It would still protect against attacks that don't involve having root access to the box (i.e. Ashley Madison data breach)

</comment></comment></comment></comment></comment><comment><USER38> On the bright side if they dump the source code we may finally get a public API

<comment><USER39> We have a public API in development. ping david at patreon dot com for more info if you'd like.

</comment></comment><comment><USER40> All the data breaches lately have demonstrated the need for some kind of professional engineering license to ensure compliance with best practices. Even if your app is meaningless in and of itself, a data breach can reveal Personally Identifying Information or credentials for other sites and accounts.

There's too much of a "code cowboy" mentality out there right now. As a community we've become very feature-driven and security is usually the last consideration. You need somebody whose name goes on the dotted line and assumes responsibility for the overall integrity of the system, because otherwise it's always Somebody Else's Problem. If you get breached and you weren't following best practices, then your PE takes on the liability, just like a building collapse or something.

This can be accomplished without significant burden to smalltime admins now that we have stuff like AWS and Docker. You should be able to Chef yourself a secure AWS instance and then Docker-Compose yourself a functional application deployment. Most smalltime users probably want some combination of CMS, storefront, or forum, and it should be pretty easy to provide these as prefabs. Some customization will be necessary, but then it will fall on the appdevs to force validation and security on the webdevs. If your defaults let someone inject SQL or something then it falls on the appdev, if the webdev uses an "unsafe" flag and overrides the defaults it rolls downhill onto the webdev. If you don't follow unit/integration testing best-practices, then it falls on you. If you don't pin your versions and a vulnerability opens up in the future - falls on you. Etc.

These standards should apply whenever you are a commercial entity or store Personally Identifying Information. If you are a legit smalltime user and don't want to use professionally licensed software then go ahead and do whatever, but you should be content with storing a username/password and perhaps using a one-time SMS or email validation that doesn't get stored. These then travel in a "viral" fashion like copyleft - if you are building a commercial website you need to do it using a storefront that has a licensed PE, that runs on a runtime that has a licensed PE. Once these are commonly available then most users would probably follow suit anyway.

This idea isn't going to be very popular with startup coders from Silicon Valley, but the reality is that the US is way out there on this stuff and we're seeing an epidemic of data breaches as a result. The EU has much more stringent data privacy laws. These don't have a whole lot of teeth at the moment, but the principles are down on paper and this is what I think you would need to implement them effectively.

To me HTML code is really a microcosm of the problem. People will write whatever old crap for as long as you let them get away with it. You have to make it as easy as possible to do the right thing, but a lot of people will have to be dragged kicking and screaming by turning on XHTML and disallowing standards non-compliance. Professional licensing is how you do that for applications and systems engineering.

<comment><USER41> If we are going to put collective political effort into stemming the tide of data leaks and hacks, I would much rather put it into finding and punishing the people who steal the data than the people who are trying to create a productive service and get hacked through less than perfect security.

<comment><USER40> That's pushing on a string, man. You will never be able to effectively track down and punish every bored Russian teenager.

As Schneier puts it - security is a process. The process doesn't have to be perfect, but there needs to be one. If your process is drastically substandard, someone need to be liable for that. The need for a standards group and a single point of liability follow logically from that, just as it does with other engineered systems. Under HIPAA an individual must be designated a "security officer", and that role should extend to other systems that store Personally Identifying Information as well.

I think the real point of disagreement with many people is about the significance of a data breach. In my opinion (and the standards of the EU) anything that leaks Personally Identifying Information is significant. It doesn't matter if it's leaking from an app that sends fart noises to your friends, only that it can be tied to you or your other accounts. If you really need to be storing PII then there needs to be a requirement to do it securely (meaning in accordance with secure best-practices). Otherwise, again, nobody does it until it's too late.

A good read: [https://www.schneier.com/essays/archives/2000/04/the_process...](https://www.schneier.com/essays/archives/2000/04/the_process_of_secur.html)

</comment></comment></comment><comment><USER42> The centralisation of services like this has to stop. Why should giving money to creators be a centralised thing (many to many) instead of just a one to many relationship between the creator and their fans?

<comment><USER43> So content creators should use PayPal then for donations? That's also a centralized service. How do you propose a transaction takes place without a service to process the details?

<comment><USER42> Simple standard bank transaction? If you want to support the creator regularly, you can easily set that up as well.

<comment><USER40> I'm assuming you're a Euro - most places don't have giro transfers like you guys do.

A long time ago the US and the European financial systems diverged. The US banks optimized for check processing and credit cards, while the Euro banks optimized for bank transfers. Domestic bank transfers typically cost around $25-35 a pop and take several days to clear in the US. Checks usually post instantly but take about as long to clear - the time between it posting and clearing is basically a loan, and the check may still bounce. Until a few years ago, many banks didn't even allow you to do bank transfers online. Stores will sometimes use "electronic checks" where you provide a blank check and they read the account numbers off it, but this is just a shortcut to avoid handling the piece of paper. The funds are still moved through the checking system. These are not available to regular account-holders either.

That's why we come up with all these systems like Paypal and Patreon to move money around - the bank-level tools are cumbersome, slow, and expensive for us.

</comment></comment></comment></comment><comment><USER44> Wow, I avoided Patreon because I didn't trust that all the music being hosted was following proper licensing and compensation rules (e.g. looked like >50% of songs were covers), so this is kind of a double shock to me about how they ran their operation.

Believe it or not, this re-inforces my commitment to SoundCloud, which isn't monetized (yet), thereby keeping listeners' financial information off the table for the present.

<comment><USER45> I believe you are thinking of a different platform. Patreon is a Kickstarter- like site, but with a monthly pledge. It is not for music hosting.

<comment><USER44> No, I'm not mistaken, at all. I'm very clear on what I understand about Patreon.

If you want, you can probably get into the hacked data and see my email warning them that by being a financial conduit they were not abiding by Safe Harbors with respect to the real rights owners.

It may not have "hosted" the music, but if you click on the music page, what do you see? Music videos. Then Patreon was the method to give those people money. People who may or may not have secured the proper licenses and paid the original artists.

Also, if I was an artist on the site, my personal information would be part of that dump - SSN, etc - so my reluctance to engage with them was prudent.

Edit: Downvoting my observations? I guess there are more people here that don't understand copyright than I figure, oh well.

</comment></comment></comment><comment><USER46> I've never heard of Patreon until now. This might be the most press they've ever gotten. At what point do we start asking questions like, did this company "hack" themselves for the publicity? There is a great moral hazard in providing so much free publicity to companies that get "hacked."

<comment><USER44> Unlikely, due to the rumored personal information of all the artists being compromised. That's not a rational avenue.

<comment><USER46> Unless nobody finds out...</comment></comment></comment>


Microsoft Secretly Installs Firefox Extension Through Windows Update - <AUTHOR> http://www.osnews.com/story/23436/Microsoft_Secretly_Installs_Firefox_Extension_Through_WU <comment><USER2> You can get outraged that updates do not list every package affected, or you can have your software used by people who think both Internet Explorer and Firefox are actually called "the Google", but you cannot have both. I think MS is making the right call here: assume that a user who has expressed desire for a toolbar, via installing it and requesting an update, wants it in all browsers.

The four people in the world who use both IE and Firefox and wanted the bar in IE but not in Firefox are capable of tweaking that setting themselves.

<comment><USER3> Why is this getting upvoted? That is a monkey chatter comment. That's the stupidest justification I've ever heard. This is scummy tactics. Period. Why would you defend it unless you had a vested interest in doing so? You know its bad. Why on earth would I EVER want someone to install additional software on to my computer without consent or notification.

I NEVER WOULD. That simple. You wouldn't either.

Google's update tactics are really shitty as well but at least you know you are installing it in the first place. This is just crap and you know it.

There is a third option to get outraged about that you didn't mention. Shitty tactics. It was obviously a sneaky move. You know it, they know it and I know it.

<comment><USER2> _Why would you defend it unless you had a vested interest in doing so?_

Because I have a longstanding, passionate interest in making software which can be used by people who do not make software. If your software requires package management, they can't use it. If your software requires configuration, they can't use it. If your software requires consent or notification, they either a) click right past without reading it or b) can't use it because they process anything longer than one sentence as "The scary box is showing me an error message."

Let me give you an example, taken straight from Ubuntu/Firefox. Firefox depends on ubuntu-desktop, a meta-package. Ubuntu-desktop contains, among other things, ure.

Do you _really_ want to show my aunt -- who thinks Firefox is called "the Google" -- "Firefox requires installing a piece of software called 'ure' on your computer. Think carefully whether you consent to installing 'ure'."

[Install Ure] [Don't Install Ure] <\-- P.S. My aunt does _not_ understand this will cause her to fail at what she is trying to do.

There are several dozen _other_ packages to run through, too.

My aunt is _not capable of making that decision_. She doesn't know what ure is. Hell, I don't even know what ure is (+), and it is my business to know things like this. It is her business to teach high schoolers and she has told you she wants to use Firefox to do it. _Make it happen and get out of her way._

\+ On checking with the Googles, I have discovered it is an OpenOffice run- time component. Duh, why didn't I think of that.

<comment><USER3> Well your passion is misguided and you should quit the software business now. Seriously.

Your argument is completely invalid. You are debating a dependency issue vs the installation of additional _unrelated_ software.

I'm sure Microsoft has your aunts best interests in mind when they put their search bar into a product that they dont maintain.

If you are all for software companies installing random peices of bullshit software on your computer during regular updates of their software, then I'll gladly setup an update server that you can use. Dont worry, your aunt wont have to make any decisions.

</comment></comment></comment></comment><comment><USER4> I can't figure out which bothers me more: Microsoft being so underhanded with these updates to software it doesn't produce or that they allow pretty much any company to install an add-on within Firefox without user consent. This has happened once before with Microsoft and it's even happened with Skype, a company founded by modern, savvy entrepreneurs. Why won't Firefox add a feature to disable an installed add-ons until flagged as wanted by the user?

<comment><USER5> You consented when you selected "Install updates automatically," instead of "Check for updates but let me choose whether to download and install them."

<comment><USER6> We're talking about a new Firefox add-on being installed here, not an update to one already installed. That's a huge difference.

<comment><USER7> Windows Update installs new software all the time.

<comment><USER6> Windows Update installs new software in the domain of Windows and other Microsoft products. It is not expected to install updates or extensions to any 3rd party software.

</comment></comment></comment></comment></comment><comment><USER8> If only we could sneak in Google Chrome Frame into IE this way...

<comment><USER9> Or Firefox...

</comment></comment><comment><USER10> This happened last year too: <http://annoyances.org/exec/show/article08-600>

</comment><comment><USER11> Firefox central can "recall" and block any rogue extension.

They did it last year when Microsoft tried this, they should do it for this one too asap.

I purposely do not run as the default firefox profile, so I don't think Microsoft got me this time...

</comment><comment><USER12> I hope they are doing it for security reasons. I seem to recall that if your default browser is set to Firefox, and you click the Windows Update link, that Windows Update won't run correctly because it depended on an ActiveX control.

<comment><USER9> If a specific critical piece of the OS relies on defaults to select the only environment it can run on, then it's very poorly designed.

Somehow, this doesn't surprise me one bit.

</comment></comment><comment><USER13> While the indirect way they did this is less than ideal, I think they have the right idea. IE and Firefox are browsers. A search toolbar is something that goes in a browser. Odds are, if you installed a search bar in your browser (not that I personally would ever do such a thing), you want it in whichever browser you use. It would be better if they just asked, 'hey do you want us to install this for firefox too?' (maybe?) but I'm not terribly upset by the idea of it.

</comment><comment><USER14> Microsoft intentionally made Netscape (more) unstable and slower, if I recall. is there any reason to think they wouldn't respond to Firefox's growing popularity is to intentionally make it perform poorly? I'm very, very suspicious of Microsoft interacting with Firefox in any way whatsoever. No doubt they'd like to exert control over it in some way.

</comment><comment><USER15> Did any of you outraged people actually have the toolbar installed? My auto updates are on and I don't have it in either browser.

If you already had it then it's not so inconceivable that they would update both browsers through lazy programming. No conspiracy theory required.

<comment><USER14> I don't think you can 'accidentally' install a toolbar in Firefox.

</comment></comment><comment><USER16> The original article:

[http://arstechnica.com/microsoft/news/2010/06/microsoft- slip...](http://arstechnica.com/microsoft/news/2010/06/microsoft-slips-ie- firefox-add-on-into-toolbar-update.ars)</comment>


Federal workers turn to encryption to thwart Trump – POLITICO - <AUTHOR> http://www.politico.com/story/2017/02/federal-workers-signal-app-234510 <comment><USER2> I am not fan of Trump but I do wonder how many of these complaints are really "opposition reasearch" bots. Both parties are known to play the game on Facebook and Twitter I see no reason to expect it would be different for these other encrypted platforms. With that being said I am sure there are many real complaints as well.</comment>


Show HN : Slogan Generator [weekend fun project] - <AUTHOR> http://slogangenerator.co/

<comment><USER2> Silly, but made me think: what words are the most slogan-like in my life?

 _We build peanut butter._

 _fatwood is fully of joy!_

Couldn't think of much.

<comment><AUTHOR> sorry for the typo! ( _fully_ ). I'll fix that.</comment></comment>


The World Religions Tree (huge visualization) - <AUTHOR> http://000024.org/religions_tree/religions_tree_4.html <comment><USER2> This is very inaccurate. It invents splits in Judaism (for example) that simply don't exist.

For example it has a bizarre split of Beit Hillel and Beit Shammai and even more bizarrely continues the lines to modern times as if there are actually two separate branches.

When the parts that I know best are inaccurate, it seems likely to me that everything else will be just as bad.

<comment><USER3> It seems to be attempting to list the church organisations rather than the faiths -- for instance, the Anglicans and Presbyterians have an entry for each country. If you were to list the faiths, you would have something very much smaller.

<comment><USER4> Even so, the part on Judaism (about which I have the most knowledge) is still highly inaccurate: marking divisions that do not exist, branching in the wrong places, over-branching in some places, under-branching in others.

It seems like an compelling idea undertaken by somebody vastly under qualified to implement it properly. (Which is not altogether surprising given the enormity of the task)

</comment></comment></comment><comment><USER5> Is Greek / Roman / Norse mythology (basically everything Western that isn't Christianity) not considered religion? Because maybe I'm just blind but I can't seem to find those anywhere in the tree.

<comment><USER6> It seems to be incomplete and inaccurate in a lot of ways.

For example, Christianity borrows elements of Zoroastrianism and Judaism is actually derived from ancient Babylonian polytheism. Maybe I just didn't see it, but Confucianism seems to be missing too.

<comment><USER2> > Judaism is actually derived from ancient Babylonian polytheism.

That isn't true. At best, and even this is debated, there are some traces, but it's not in the slightest "derived from".

<comment><USER6> Maybe not derived from, but certainly descended from.

Yahweh was the national god of the Israelites, who were part of the Canaanite polytheistic system. In the context of Yahweh being a warrior deity in a polytheistic system, the phrase "there are no other gods like our god," and also the crusades against neighboring settlements seem to take on more meaning.

Interesting reading: [https://en.wikipedia.org/wiki/Yahweh](https://en.wikipedia.org/wiki/Yahweh)

<comment><USER7> >Certainly descended from

Also no.

Yahweh is clearly at a level "above all gods", i.e. on his own level as omnipotent creator of all things. Angels and fallen angels (aka demons/ heavenly hosts and other "gods") are on a second level of power/influence, and then earthly creations below that.

As such, Yahweh doesn't "compete" against other (lower-case) gods, because they're not omnipotent creators and he is.

Although the Israelites were pretty famous for rejecting him and worshiping lower-case gods, (and subsequently incurring Yahweh's wrath), there's never a question that he is the I AM and not any derivation.

<comment><USER8> I'm talking about the historical and anthropological record, not the Hebrew mythology. Of course the religion's modern texts would paint themselves in an infallible light.

So yes, Judaism _is_ descended and evolved from Canaanite religion.

<comment><USER2> Your own links don't support such a strong claim. At best the strongest claim you can make is that the _name_ might have some correspondence with the name of Canaanite Gods, but you have zero information on the direction of the influence.

Your own links make no claim at all that the religion itself has any relationship with the Canaanite religions.

Regarding the direction, do not forget that Abraham was very active in the region, and proselytized extensively. It is hardly surprising if the Canaanites took some concepts from him.

<comment><USER8> That article has been restructured quite a bit after it was made part of the Judaism portal, compared to when I first found it and then looked into the subject a couple of years ago. Just because one wikipedia article is incomplete doesn't mean it's not an accepted fact.

<comment><USER7> > Accepted fact

Whoah. Be careful slinging around the F-bomb, bro.

When talking about causation of events where there is no data, much less reproducible data, you certainly have room to disagree with some evidence and prefer others, but it goes too far to claim "Judaism is actually derived from ancient Babylonian polytheism" is unassailable fact.

That may your belief--and you may interpret some evidence to support your belief--but as you'll be quick to point out to others, having a belief doesn't mean it's true.

The bar for something being a fact is higher than that.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> This is interesting, but you would be naive if you think this is in any way comprehensive or accurate.

My religion and main area of knowledge of Catholicism shows a limited number of picked and chosen orders of priests, (i.e. Franciscans, Cistercians, Capuchins). These are not separate religions by any means whatsoever; they are all members of the Catholic faith. They certainly don't belong on a chart that is meant to display different religions and schisms.

<comment><USER10> According to the key, they are listed as "adherent branches".

Schisms are shown by ovoids with white fill and appear to make some sense.

I guess the chart is trying to show practices that have a lot of adherents, not just a diagram of religions. Much of the problem is probably just using the word "branch", which isn't a great description of what is shown.

</comment></comment><comment><USER11> Nice visualization! I feel like there's room for many improvements both technically and in accuracy, though.

For example, the Bahá'í Wold Center is not a branch, though. It's just the spiritual and administrative center of the Bahá'í Faith [0][1]. Likewise, the Universal House of Justice [2][3] is the supreme governing institution of the Bahá'í Faith (and its seat is located at the Bahá'í World Centre), so it's not a branch either.

[0] [http://www.bwc.org/](http://www.bwc.org/)

[1] [http://en.wikipedia.org/wiki/Bah%C3%A1%27%C3%AD_World_Centre](http://en.wikipedia.org/wiki/Bah%C3%A1%27%C3%AD_World_Centre)

[2] [http://universalhouseofjustice.bahai.org/](http://universalhouseofjustice.bahai.org/)

[3] [http://en.wikipedia.org/wiki/Universal_House_of_Justice](http://en.wikipedia.org/wiki/Universal_House_of_Justice)

</comment><comment><USER12> This could be awesome, but instead it falls very flat. If the author is reading this, I think my advice boils down to:

      1. Cite sources
      2. Make it an SVG

<comment> ryan-c (I am a friend of the author and host the site for him) Sources were cited, the submitter deep-linked. A redirect is now in place to the page that has more information.

Edit, for clarity:

* 000024.org is owned by my friend, Alex Fink

* The 000024.org website is hosted on one of my servers, along with a few other static sites belonging to friends. I have been doing this for free as a favor to those friends for many years.

* The submitted link was not the intended landing page, but is now redirecting to it.

* The intended landing page explains where the images came from.

<comment><USER10> You should rephrase to be a little more careful about who the creator of the image is.

(at least, if I understand correctly, you are friends with the person hosting the jpg of the image that was extracted from the pdf that had the image that was pieced together from the original).

edit: You've made an edit, but you missed what I meant. Alex Fink is not really an author here where the point of the link is the image, he is the "page owner" or something like that. There is plenty of attribution and I don't mean to imply any attempts at obfuscation, but egwynn was talking to the original creator of the image, not to the hoster of this version of the image.

<comment> ryan-c I didn't miss what you meant, I just didn't want to remove the part of my comment that you were talking about because then someone reading your comment might be confused.

I've been a little scatterbrained due to commenting while trying to get the bandwidth usage under control (sorted now), and I apologize for anything unclear in my comments here.

</comment></comment></comment></comment><comment><USER13> Nice chart. Glad to be an atheist. Now imagine the man-millenia wasted on all that hocus pocus.

Anyway, you are here: [http://i.imgur.com/WNkmN.jpg](http://i.imgur.com/WNkmN.jpg)

<comment><USER14> An atheist, a vegan, and a CrossFitter walk into a bar.

I only know because they told everyone within two minutes.

<comment><USER15> Really? How many official atheistic rituals are performed per week? per month? per year? How many atheistic personalities do you see/hear on the radio / television (talking about atheism, not about pizza)? How many atheistic politicians do you know (probably very few, since it is political suicide)? How many times per year is an atheist ringing at your door to tell you the wonders of atheism? (I get several calls per year from the jehova's witness and other groups, trying to convince me - very educately - that their religion is "the good one - tm")

I heard people are going to the church (or synagoge, or mosque, or whatever) every Sunday (Saturday / Friday) (or they should ...), and they are very freely and openly telling everybody how much they believe in their choice of god.

Compared to the publicity with which believers are living their faith, atheist's non-faith is very introvert.

Which is according to the nature of the thing - why would you be talking about your non-beliefs all the time? Basically, we all have so many non-believes (an atheist has only one more than a believer) that there is no material time to talk about them.

Of course whenever an atheist breaks this code of silence (like poor madengr just did above) with a single sentence (not a three hours prayer - mind you!), it clearly proves that atheists are exhibitionists.

All this makes your joke a very stupid joke (since its logic is broken)

EDIT: added more ranting

<comment><USER16> Based on your response I think the joke was actually critically perfect.

You feel hook line and..

<comment><USER15> Sorry, I must be dense, I do not get it

<comment><USER17> The joke was that atheists (along with the others listed) are inclined towards outspoken rants at everyone. You responded with an outspoken rant to the joke.

<comment><USER15> A) the joke was that atheists are exhibitionists, not that they are ranters. BAD joke.

B) In case the joke was meant to include ranters, the same case can be made that religious people are generally more ranting inclined. BAD joke.

C) I do not say anywhere that I (the ranter) am an atheist, which makes the whole point moot

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> I checked some random branches and found a lot of errors and inaccuracies. Nice visualization though

<comment><USER12> Truth. It has "Taoism" mispelled near the root. :-\

</comment></comment><comment><USER19> Krishnamurti Foundation is not at all about religion. In fact Jiddu Krishnamurti was completely against any dogma to the point where he asked people to not even follow his words. And they still made it part of the Hinduism branch, which is funny.

</comment><comment><USER20> I always thought Buddhism was an off-shoot of Hinduism - a kind of cleaned up version by the Buddha, who was born Hindu.

</comment><comment><USER21> Anyone knows what software was used to make the visualization?

</comment><comment><USER22> Early history provided is not very accurate. And it is missing religions not generally believed any more.

</comment><comment><USER23> This is less "inaccurate" than fundamentally conceptually flawed. Human ideological systems are not like biological systems that speciate through schism. They are creations of living human minds and societies that piece together ideas that they find meaningful and useful.

So this chart lists a couple of major sources: Chinese folk Taoism, Japanese mythology, Shramana traditions (non-vedic), Early Vedic period, and Ancient Israelite religion. Most of these traditions have been cross-pollinating, merging, and re-dividing for millenia. Yet this kind of visualization can only depict schism, not influence.

<comment><USER24> > This is less "inaccurate" than fundamentally conceptually flawed. Human > ideological systems are not like biological systems that speciate through > schism.

Given the existence of horizontal gene transfer [0], neither are the biological systems traditionally described that way. Nevertheless, the schism model can be a useful illustrative approximation even when its not a completely accurate model.

[0] [http://en.wikipedia.org/wiki/Horizontal_gene_transfer](http://en.wikipedia.org/wiki/Horizontal_gene_transfer)

</comment></comment><comment><USER25> If they wanted to they could break off LDS into LDS, Reorganized LDS/Community of Christ, and FLDS, and Church of Christ Temple Lot, as well as a handful of defunct schisms like Strangite.

</comment><comment><USER26> Some sort of minimap for navigation would be useful. Also a zoom, the text is a bit small for my eyes.

Edit: browser zoom works well. There's a legend in the lower left.

<comment><USER27> I wouldn't say it does. The very first thing I did was to zoom out, and then understood that I cannot really use it without magnifying glass. So I installed xzoom to find out (unsurprisingly) that I cannot use it as well, because on that scale pixelation is strong enough for text to be unreadable, so the only solution would be to actually implement that feature in js.

Or to have 50" display.

</comment></comment><comment><USER28> It is astonishingly bizarre that this so called tree focuses only on a small number of recent religions and their sects and orders.

There are thousands of religions not represented, most significantly older than the oldest concrete points on this graph.

I do recognize though that this focuses on fairly modern religions of the last two millennia. Still, what a small, narrow, and uninteresting group of beliefs that is.

</comment><comment> ryan-c The site may go down entirely for a moment... This site belongs to my friend Alex Fink.

Edit:

Mods, please adjust link to point to [http://000024.org/religions_tree/](http://000024.org/religions_tree/)

I've done an emergency move of the images to another server that's better able to handle the load and re-written the image links (I host his site).

<comment><USER29> You could also host it on CloudFlare for free.

<comment> ryan-c We just made changes to run it through cloudflare, but that'll take some time to go through. It's on a faster server in the meantime.

</comment></comment></comment><comment><USER30> The Ethiopian Jews do not observe Hanukkah, which would indicate that they split of from the rest of the Jews earlier than 167 BC.

Also "Ancient Isrealite Religion" should probably be "Ancient Caananite Religion". And a lot of things happened there before 500 BC - such as Yahweh becoming the dominant deity and King Hezekiah forbidding the worship of any other gods.

</comment><comment><USER31> Couldn't see it linked anywhere yet, but the original OpenMap version is at

[http://funki.com.ua/ru/portfolio/lab/world-religions- tree/](http://funki.com.ua/ru/portfolio/lab/world-religions-tree/)

<comment><USER10> That's the first link at the result of the redirect, the text "World Religions Tree".

<comment><USER31> Thanks, I went through three or four links looking for the original!

Must have missed it on first parse.

</comment></comment></comment><comment><USER32> The Anabaptist/Baptist branches are also pretty inaccurate.

</comment><comment><USER33> Looking at this, I can't help but see a few original Gits, forking into hundreds, then thousands of moral software programs, installed across human history.

</comment><comment><USER34> I think there are many inaccuracies. Many branches are dead but seems to be alive. Some branches are actually should not be separated. Nice try tough.

</comment><comment><USER35> The 4 most numerous religious groupings by number of followers in the world are each color-coded in the popular mind:

* Green for Islam

* Red for Hinduism

* Yellow for Buddhism

* Blue for Christianity

</comment><comment><USER36> Question for the author: Where is Shambhala Buddhism? It emerged from the Kagyupa and Nyingmapa branches of Tibetan Buddhism.

</comment><comment><USER37> Where is Manichaenism?

</comment><comment><USER38> (for Europe and Asia)

</comment><comment><USER39> Who made this?

</comment><comment><USER40> As expected, European native beliefs (and their link to hinduism) are not even mentioned.

<comment><USER41> Im interested in this link between hinduism and European native beliefs. A quick google search didn't lead to anything authoritative. Do you know where more info could be found?

<comment><USER42> In theory Hinduism, Zoroastrianism, and the ancient Greek, Roman, Germanic, Celtic, Norse, etc, religions, are all descended from [https://en.wikipedia.org/wiki/Proto-Indo- European_religion](https://en.wikipedia.org/wiki/Proto-Indo-European_religion) \- however, that is so long ago, by the time we get to the historical period, they have diverged a lot, both due to their own organic development in different directions, and also due to the influence of differing non-Indo- European cultures - such as Dravidian culture in the case of Hinduism; Semitic and Sumerian cultures in the case of Zoroastrianism; Etruscan culture in the case of the Romans

</comment></comment></comment><comment><USER43> Wow. Nice taxonomic work.

It sure is a good thing there is only one true religion eh? /s</comment>


The problem with p-values - <AUTHOR> https://aeon.co/essays/it-s-time-for-science-to-abandon-the-term-statistically-significant <comment><USER2> _Take the proposition that the Earth goes round the Sun. It either does or it doesn't, so it's hard to see how we could pick a probability for this statement._

Sometimes I fail to follow the distinctions made in certain strains of classical statistics. How is his "conundrum" different than this one? "Roll a 6 sided die whose result we cannot see. Take the proposition that the top shows a 6. It either does or it doesn't, so it's hard to see how we could pick a probability for this statement."

 _What matters to a scientific observer is how often you'll be wrong if you claim that an effect is real, rather than being merely random._

I think "scientific observer" may mean statistician here.

For the scientist, what should matter is the probability that the claimed effect is real -- period. That is, unlike the statistician, the scientist isn't (shouldn't be) allowed to blame "modeling error" when it turns out that the measurements are biased, the samples are correlated, or the effects are nonlinear. False assumptions that "randomness" is the only (or main) danger can lead to unrealistic error bars and unwarranted confidence in the effectiveness of flawed models.

<comment><USER3> Well, it's less of a conundrum in the case of the die because it's easier to estimate the priors. That's the power and difficulty of using Bayesian reasoning; you need some estimate of how likely something is to be true before you perform the statistical test.

In case of the six-sided die, we have a good physical model and years of memory to know that there should be a 1/6 chance of any number coming up, so it's easy to estimate that prior. Similarly, when doing a disease screening test, we have data on how common diseases are in the general population that can be easily used.

The problem comes when using Bayesian methods on unsolved scientific problems. Suppose you don't know if the Earth goes around the Sun or the other way around, it's the early Renaissance and you've gathered some data that could indicate a probability of one or the other. What's the prior odds that one theory is correct? You have no idea, that's why you're investigating! The worry when using Bayes's theorem to replace deductive p-value methods is that the prior probabilities may just be made up out of baseless intuition, and skew the final calculation. (It can still be used effectively, you just have to get a little fancy.)

<comment><USER2> _Well, it 's less of a conundrum in the case of the die because it's easier to estimate the priors._

I agree, but in the case of a die, "estimating the priors" is the same thing as "knowing the probability of a 6". So you are saying (correctly) that once we have a model that we believe in, we can assign a probability because we believe we know the probability in advance.

I was pointing more to the author's emphasis on "either it does or it doesn't". One view is that probability requires replication, and we can only speak of probabilities in the long run of many trials. The other view (Bayesian to my limited understanding) is that probability can also be used to measure appropriate degree of belief in a proposition.

While it's hard to quantify, and dependent on one's assumptions, I do think it's possible to speak of "the probability that the earth revolves around the sun", much as I think it's meaningful to talk about "the probability of anthropogenic warming" even though we only have a single Earth to study.

I don't really understand how classical statistics disallows discussion of the first while allowing discussion of the second. Maybe it doesn't?

<comment><USER3> I'd say classical statistics lets you deduce, based on some knowledge that something is the case, the probability of an event. It doesn't let you induce the probability of something being the case (that's why we have all this indirect dodging with p-values.) So I think there is a fundamental difference between "What are the odds of rolling a six" as "What are the odds of that event happening," and "What are the odds the Sun revolves around the Earth" as a question about whether or not something is true.

That's what the author seems to mean by "either it does or it doesn't," though it isn't worded that well. Even if the die has already been rolled, we know that it _could_ have been a 4 or a 5, and have good knowledge of the probabilities of those events. This is more like looking at a picture of the top of a die and seeing a six: what are the odds that it's a standard die, vs. a die with sixes on each face? I don't think it's meaningful to talk about that, or the sun going around the Earth, without using a Bayesian prior.

<comment><USER4> > So I think there is a fundamental difference between "What are the odds of > rolling a six" as "What are the odds of that event happening," and "What are > the odds the Sun revolves around the Earth" as a question about whether or > not something is true.

Right, using Bayes makes the difference not a "fundamental" one, but just a practical one of coming up with the Bayesian prior. Even if it would be hard to establish a consensus on the most appropriate complete set of factors determining the Bayesian prior, there are clearly some examples of meaningful inputs. Like, for example, if you somehow had information about how many of the researcher's previous hypotheses on the subject failed to obtain a "p-value of significance".

But perhaps more practically, you could consider things like the (Kolmogorov) complexity of the hypothesis. Since the number of "low complexity" hypotheses are finite, they are less susceptible to "p-value mining"[1]. The challenge being deciding which inputs to use to evaluate the complexity.

This seems to me like an area where machine learning should be applicable. Rather than lament about the impracticality of determining an appropriate, tractable set of (quantifiable) criteria for determining a Bayesian prior, why not just include every potentially relevant piece of information and let Deep Thought[2] figure out which are actually relevant? So what we really need is unified data about all published results that have been confirmed and discredited.

[1] obligatory xkcd: [https://www.xkcd.com/882/](https://www.xkcd.com/882/)

[2] for the youngsters: [https://en.wikipedia.org/wiki/List_of_minor_The_Hitchhiker%2...](https://en.wikipedia.org/wiki/List_of_minor_The_Hitchhiker%27s_Guide_to_the_Galaxy_characters#Deep_Thought)

</comment></comment></comment></comment></comment><comment><USER5> I think the article is a very good explanation of the application of Bayes theorem to p-values.

My only issue with this kind of calculations is that their assumptions dramatically changes the results. He says that 10% of the drug tests are going to be effective. This might apply to an specific area, but not to others. Here is a Nature publication that changes the most important parameters, power and % of programs/drugs/tests that trully have an impact [http://www.nature.com/nmeth/journal/v10/n12/full/nmeth.2738....](http://www.nature.com/nmeth/journal/v10/n12/full/nmeth.2738.html).

If you assume power of 80% (not crazy in rigorous studies) and 50% of programs having an effect (not crazy in many areas) then you get that 94% of the programs that you stated that had impact, were trully effective.

<comment><USER6> > If you assume power of 80% (not crazy in rigorous studies) and 50% of > programs having an effect...

You're making another assumption: that the power calculations are actually rigorous and the effect size (not "having an effect", but "having an effect of at least the size used to calculate power at a given alpha") is sufficient. If you've ever designed a clinical trial or written up the statistics for a grant, you know damned well that these numbers are cooked 6 ways from Sunday.

Colquhoun is a sharp guy (I have debated various fine points with him on several occasions and he has convinced me with reproducible examples that I was wrong in my beliefs). It would be nice if the name of the article was "It's time for science to abandon the term statistically significant", as in the URL, because that's the real point here.

"Signficance" can only be judged in context. Post all your data and then we'll see whether you can be believed. But that notion of transparency is absolutely terrifying to the sorts of senior scientists who control most funding and peer review at the moment. It's OK, though; the rest of us put up preprints knocking down the most egregious lies and those who care about the truth can have it (for free, no paywall).

I've got plenty of Cell, Nature, and NEJM papers on my CV; direct support on grants where I am PI, Co-I, or KP is over $5M; and I still think the situation is fucked up. I'm not bitter because I feel left out; I'm bitter because I fear that the bad money is driving out the good, as it always does.

Take away the monetary incentive, the Journal Impact Factor BS, the "prestige" of hoodwinking 3-5 referees with a pile of STAP or single-sample comparisons (had to warn a student about this when he pulled some data from a Nature paper that a respectable MSKCC scientist gooned for...) and let's see what's left...

</comment></comment><comment><USER7> This statement is a misunderstanding of the Bayesian approach:

"Take the proposition that the Earth goes round the Sun. It either does or it doesn't, so it's hard to see how we could pick a probability for this statement."

Bayes Factor, the Bayesian alternative to a NHST, is quite a bit different than simply creating the Bayesian equivalent of a t-test. Bayes factor asks "How many times better is my Hypothesis at explaining the data than an alternate Hypothesis". So the Bayesian statement would first pit one model of the Earth's orbit against another. The Bayesian statement of the question of the Earth's orbit would be:

"How much more likely is the astronomical data we've observed to have happened given that the Earth revolves around the sun than it is if the sun revolved around the Earth."

For a more concrete example let's suppose that we have a coin. I think the coin has only heads and you think it is a fair coin, with a 50/50 chance of getting heads or tails. We observe three heads in a row. My hypothesis says that the probability of getting 3 heads in a row given a trick coin is 1. Your hypothesis says that the probability of getting 3 heads in a row given a fair coin is 0.5 x 0.5 x 0.5 = 0.125. My hypothesis explains the data 1/0.125 = 8 times better than your hypothesis. Now suppose the next flip is a tail. The probability of HHHT in my model is 0 and yours is 0.5 x 0.5 x 0.5 x 0.5 = 0.0625. You're hypothesis explains the model infinitely better than mine!

Now we can say that our new Hypothesis is that the coin is fair. Suppose another friend comes along and claims that they thought the coin had a 75% chance of getting heads and only a 25% chance of tails. We flip the coin 5 more times and get HHTTH. Your hypothesis says 0.5^5 = 0.03125, and the friend's says 0.75^3 x 0.25^2 = 0.0263... You're hypothesis explains the data only 1.2 times better than theirs. Clearly, we need more data to feel really confident in one hypothesis over the other.

If you want an even longer example, I wrote a post awhile back about "Bayesian Reasoning in the Twilight Zone" that goes into more detail (including priors)[0]

[0] [https://www.countbayesie.com/blog/2016/3/16/bayesian- reasoni...](https://www.countbayesie.com/blog/2016/3/16/bayesian-reasoning-in- the-twilight-zone)

<comment><USER8> So in the real world, are there developed techniques to build relatively complex models that account for covariates and sources of variability (e.g. random effects) and repeated measures?

</comment></comment><comment><USER9> >The problem is that the p-value gives the right answer to the wrong question. What we really want to know is not the probability of the observations given a hypothesis about the existence of a real effect, but rather the probability that there is a real effect – that the hypothesis is true – given the observations. And that is a problem of induction.

The problem of induction is real and unavoidable in the general case, but there is no such thing as "the probability that there is a real effect". Either there is a "real effect" or there is not.

It might be possible to find a "probability" that you observed a "real effect".

>The problem of induction was solved, in principle, by the Reverend Thomas Bayes in the middle of the 18th century.

The problem of induction is fundamentally unsolvable (hence, "problem"). The article just states that it was solved and never mentions it again. Is it a widely held view that induction was solved by Bayes? Does anyone know where I can read more detailed claims about how people believe Bayes _solved induction_?

<comment><USER10> Bayes did not "solve induction". If we define induction as telling which specific model generated this data: that is not possible. Countless models could in theory generate our data. What we need is some restriction. Like a prior. And when was the last time you started a research project without _any_ idea what to expect? And if you did, wouldn't it be wiser to do some literature study, experts interviews etc. before starting experiments? Modeling the state of the art, pre-experiment, seems like a clever move anyway.

To name just a few of the NHST/p-value flaws:

1- I'm interested in P(H1 | data) but I get P(data | Ho). Contrary to popular belief P(data|Ho) != P(Ho|data). Let alone that conclusions about P(H1|data) can be drawn.

2- it is vulnerable to wrong interpretations. * No, a 95% confidence interval (a,b) does NOT mean there is a 95% chance that Mu is in (a,b). * No, p=0.04 does not mean they is a 96% chance that H1 is true.

3- the p-value depends on the intentions of the scientist. If you end your experiment after 80 observations, as planned, your p-value is different from that of an experiment that ended unplanned after 80 observations. So the same data have different evidential power, influenced by results you did not see in experiments you did not do. This is very unsatisfactory.

4- the idea of "an effect that exists or does not exist", based on some arbitrary threshold. The reality is, in many cases, uncertainty and variation. In group A I see effects of medicine A, with lots of variation between persons. In group B I see varying effects of medicine B. Then I introduce uncertainty by drawing random samples from A and B. Let's day I used those samples to make an inference: is, on average, medicine A better than medicine B ? Matras like "there is an effect, or there isn't" are not very helpful. Statistics should be about quantifying uncertainty rather than give false yes/no statements.

5\. Basing decisions and knowledge on the data only makes t vulnerable to outliers, unlucky samples and so on. And why should you NOT use information, when it's there ?

<comment><AUTHOR> P-value being defined as the probability of observing a result equally or more extreme under a model H0. So if you start with with assumption that H0 is true, there's not much you can say about alternative hypotheses.

The American Statistical Association actually put out a statement this year on the issue of p-value. You can find the whole article here [http://dx.doi.org/10.1080/00031305.2016.1154108](http://dx.doi.org/10.1080/00031305.2016.1154108) but here are the main points:

1) P-values can indicate how incompatible the data are with a specified statistical model.

2) P-values do not measure the probability that the studied hypothesis is true, or the probability that the data were produced by random chance alone.

3) Scientific conclusions and business or policy decisions should not be based only on whether a p-value passes a specific threshold.

4) Proper inference requires full reporting and transparency.

5) A p-value, or statistical significance, does not measure the size of an effect or the importance of a result.

6) By itself, a p-value does not provide a good measure of evidence regarding a model or hypothesis.

As an additional curiosity, the group of writers was not completely unconflicted coming up those definitions and the article contains a number of supplemental articles by the individual authors to clarify/dispute some of the points made.

[edit] fixed formatting

<comment><USER10> Good points. The NHST thing was invented by Neyman & Pearson as a tool for decision making, not for finding the truth.95% confidence means your intervals will be not to far off, in 95% of all samples.

Perhaps this is nice fur Quality Asurance in factories. Where I do repeated measurements and where I want a simple YES or NO.

But science usually asks: "what can I learn from this specific data? I don't do 100 samples and I'm not interested in being "not to far off moist of the time". I want a best estimation based on this specific sample".

NHST does not give that answer. Bayes does.

<comment><USER9> Science only asks, "Have I observed something contrary to my theories?" For non-deductive theories, the only real approach is to count the number of times you observed something agreeing with your theories vs. the total number of times you observed something (ie. p-value).

</comment></comment></comment></comment></comment><comment><USER11> It's ironic the author starts off saying they need to get more rigorous in their science and statistics. Then goes on to write a relatively short and not very rigorous overview of Bayesian statistics.

Statistics and probability are difficult subjects. They are also not intuitive subjects for many people.

Besides the publish or perish thing, I would guess many authors of these unreliable/non-replicable biomedicine papers were focused on biomedicine during grad school - while they learned statistics it was a secondary subject.

A solution seems to be more statistics training for academics doing studies or requiring a trained statistician on the team/reviewing a study prior to publication. I don't see either happening to be honest, and this problem will likely continue.</comment>


Show HN: 'Halo' ring three.js small demo - <AUTHOR> http://mixingrealities.site44.com/halo/

<comment><AUTHOR> If it seems super blurry, that's by design. I wanted to make it seem like you were viewing it from the 'depths of space' if you will. ;)</comment>


The Art of SEO - <AUTHOR> http://www.hn-books.com/Books/The-Art-Of-SEO.htm <comment><USER2> "So this SEO copywriter walks into a bar, grill, pub, public house, Irish bar, bartender, drinks, beer, wine, liquor" <http://twitter.com/#!/drelabre/status/24646925328326657>

</comment><comment><USER3> OMFG - this is the worst seo book ever - and i know because i'm propably the only one who ever read it front to cover (during my sabbatical on a beach in mexico) there are four authors which republish their old blog posts mixed together by an editor who was obviously overwhelmed with the task. but it is not only mixed (with no way to find out who wrote what) it is also repetitive (the same topic up to 5 times) and unstructured (soemtimes there are refferences like: read more about that in this chapter, but then the whole topic is discussed again nothingtheless) ... oh yeah some of it is factually false, with refernces to blogposts wich talks about something completely different.

the truth is: this book stands for everything that is wrong with SEO as a profession. SEO as a profession is 80% bullshit and 20% actionable knowledge. this book celebrates the 80%.

the biggest letdown is, that its published by oreily but way below their quality standard they are known for.

</comment><comment><USER4> The art is there is no art. It's called "making useful stuff that people can find." I always felt like a criminal when people paid me loads of money to do this :(

<comment><USER5> 1.) People pay public relations firms a lot for press coverage. And they pay Google ~ $30 billion a year for AdWords ads. If SEO is way cheaper (and it typically is) then what makes it overpriced (when similar traffic streams indicate that rates should be, if anything, higher)?

2.) Surely you were not knee deep in link building if you felt overpaid. ;)

</comment></comment><comment><USER6> The title of this post should really be: The Art of Affiliate Marketing

Good show!

<comment><USER7> Not sure what you mean? Because the guy who runs hn-books adds an affiliate code to amzn?

(this is what the book url expands to: [http://www.amazon.com/gp/product/0596518862?ie=UTF8&tag=...](http://www.amazon.com/gp/product/0596518862?ie=UTF8&tag=whtofi-20&linkCode=as2&camp=1789&creative=390957&creativeASIN=0596518862))

EDIT: The first line on the homepage states this quite clearly: _external links to amazon are through their affiliate program_

<comment><USER6> I think it's general Internet etiquette that when you are referring a community of people (that you are a member of) to a specific product though your own site, you don't pass in a referral code. It shows that the product you are talking about is actually recommended, rather than a quick money maker for yourself.

I don't have a problem with the website in general, especially if I found it through Google. But, what's to say that 10 other HN'ers don't post a book review tomorrow with an affiliate link? Because, after all, it's profitable. Who cares if the book is good or not?

Given the OP's unofficial librarian status, I don't think it's a major offense in this case. But, I didn't find that out until after I posted my first comment.

</comment></comment></comment><comment><USER8> It's a good book to use as reference. Such as should I do x or y. Easy to read, and with well explained examples.

Great book to sit along with Web Analytics 2.0.

<comment><USER3> yeah you open it one page which tells you you should care about x, but you do not like x, so you open it on another random page which tells you to do y and you like y better so you do y.

seriously this book is shit, if you see an SEO mention it as his reference run for cover, take your business with you

</comment></comment><comment><USER9> It hurts me deeply that HN has become a stage for the SEO circus. Wasn't "Spinh" enough?</comment>