Are two RX 480s faster than a single GTX 1080? - <AUTHOR> http://arstechnica.co.uk/gadgets/2016/07/amd-rx-480-crossfire-vs-nvidia-gtx-1080-ashes/ <comment><USER2> The real TL;DR is no. They are about equal.

Ashes of the Singularity is a game AMD had a big hand in making. There are driver level optimizations the studio paid for. Furthermore the game leverages D3D12's Async Compute which Pascal Architecture can't handle as well as GCN.

That being said in non-AMD sponsored games they two set ups in question (RX480 CFire vs GTX1080) do manage to stay within step of one another [1].

The real issue becomes overclocking and crossfire.

The GTX1080 has a much higher overclock threshold then RX480 (currently this may change as board partners make custome PCB's). So if you start fiddling with power levels this comparison breaks down.

Also crossfire/SLI is to a degree Russian Roulette. Studio's have to opt-in to supporting it, and sometimes don't. Leaving you only with a single card. Also very weird bugs can sometimes crop up. Some people have no issue with this, some have huge issues. YMMV.

The main thing I'm trying to express is when looking into hardware reviews CPU/GPU's more information from more sources is always better. And all sources/chips aren't equal.

[1] [https://youtu.be/cVVJPbFRDEc](https://youtu.be/cVVJPbFRDEc)

<comment><USER3> Async Compute is a big mess for nVidia right now. Latest trouble is Total War: Warhammer game. They released dx12 support for it and nVidia cards are losing 10fps+ while AMD cards are gaining 30%+ in performance. Also reason why Ark Survival Evolved is holding off dx12 release because of nVidia ...

<comment><USER4> It's really difficult to draw conclusions from DX12 benchmarks at the moment.

The problem is that DX12 shifts most of the responsibility for architecture- specific optimizations (and avoiding pathological cases) from the driver to the application. So although you _could_ draw the conclusion that Nvidia are struggling with DX12 due to their Total Warhammer performance, it's just as easily explained by Nvidias veteran DX11 driver team being better at tuning for Nvidia hardware than a game studio who partnered with AMD during development.

</comment></comment></comment><comment><USER5> I would never consider a multi-GPU setup. I know from first hand that support on those setups ranges from pretty good to non-existent, but it is an area that receives only little attention once the initial multi-GPU launch is done (if there even is multi-GPU support). So future patches etc may introduce instability for those setups (and they are often unstable at launch with quite a few issues) and only luck or a driver update (1-2 months) will fix it.

Additionally, with ever increasing resolutions and complex rendering pipelines that need an increasing number of syncs between the individual GPUs; SLI and CrossFire bridges are becoming more and more of a bottleneck.

Would not recommend.

<comment><USER6> Why do you think they are so poorly supported? I know relatively few users have multi-GPU systems...it may be as simple as that, but I would have expected DX, OpenGL, and the new one from Valve (blanking right now, Vulcan?) would have improved usage and stability with minimal per-game development.

</comment></comment><comment><USER4> TechPowerUp tested it more thoroughly than Ars: [https://www.techpowerup.com/reviews/AMD/RX_480_CrossFire/](https://www.techpowerup.com/reviews/AMD/RX_480_CrossFire/)

In short: even if you exclude games that don't utilize multiple GPUs, a pair of RX 480s is slower than a GTX 1080 on average.

If you do include non-scaling games they're slower than a GTX 1070 on average, which is cheaper than the 480s and uses half the power.

<comment><USER7> So the 1070 is the no-brainer choice in this price range. A single card is always better than XFire/SLI, and you have the option to move to 2x1070s if you need the boost. SLI scaling on the 10xx series has been really impressive.

<comment><USER8> Is that a good card? I saw an article linked somewhere from this post that I can't find now, but it said that things are about to get very good for graphics card purchases. I'm not sure if the article was old and things have gotten better.

I'm basically wondering what I should replace my current card with (I run Linux and play a few games like rocket league).

<comment><USER9> You can get used 970s for about $200 now

<comment><USER10> You can get new 970 for slightly more than that... I regret buying a 380x instead.

AMD drivers have serious bugs (that also affect the 480!) that they promised to fix a year ago, but not only they didn't fixed it, they also removed it from the "known issues" list on the changelogs. This was my first AMD purchase and will be my last, their hardware is mediocre (super power hungry and throttles because of that), software is outright terrible, and support from both them and Sapphire is nonexistent.

And when I asked for help on forums and chats, people accused me of being nvidia paid troll and even banned me. (And someone later pointed out to me that the places that most aggressively attacked me are the ones that have AMD employees as moderators)

<comment><USER11> _> their hardware is mediocre_

It also seems like RX 480s also overdraw the PCIe bus (drawing more than 75W from the slot--cards are supposed to be able to pull 75W from the slot, 75W from the six-pin connector, and 150W from the eight-pin connector), which is potentially dangerous for the _rest_ of your hardware, too.

I went from being a steady AMD/ATI customer (last card was an HD4870) to a 980Ti and don't see myself going back anytime soon.

<comment><USER4> More on the PCI-E slot overdraw: [http://www.pcper.com/reviews/Graphics- Cards/Power-Consumptio...](http://www.pcper.com/reviews/Graphics-Cards/Power- Consumption-Concerns-Radeon-RX-480)

It's concerning at stock settings but gets far worse when the card is overclocked, with the card overloading the 12V pins by about 50%. AMD say they are working on a driver fix at least.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Considering the idea was to spend less, I'm amazed he didn't mention power usage of having 2 cards vs 1 (best case you spend double in electricity, worst case you actually need a better PSU)

</comment><comment><USER13> Betteridge's law of headlines strikes again, though as least Ars seems to be self-aware about it.</comment>


The Status of the P Versus NP Problem  - <AUTHOR> http://cacm.acm.org/magazines/2009/9/38904-the-status-of-the-p-versus-np-problem/fulltext

<comment><USER2> For anyone who enjoyed reading this you may want to check out his (Lance Fortnow) blog (that he shares with Bill Gasarch).

<http://blog.computationalcomplexity.org/>

I am not in TCS, but I do enjoy what bits and pieces are understandable to me.

</comment><comment><USER3> I've always been intrigued by the P vs. NP problem. If I had to bet, I'd say P != NP, but imagining a world where P = NP is like imagining a world where a Star Trek-like utopia is suddenly achievable. It definitely would make the Internet feel like a "footnote" in history.

<comment><USER4> or we'd all just get wiped out by a super virus by some jerk messing around after solving protein folding.

<comment><USER5> Slightly off topic, but I just wanted to point out that protein folding is not, strictly speaking, an NP problem. It can be expressed as one, but Levinthal's paradox essentially says that either the actual process of protein folding is not really NP or P=NP and nature has figured it out.

(For those who are more familiar with the topic, I am generalizing. I'd love to debate Protein Folding != NP though...maybe in a different forum?)

<comment><USER6> Not that I have the biology chops to contribute to it myself, but a Protein Folding != NP debate is exactly the kind of discussion I'd like to see here.

<comment><USER7> Protein-folding can be expressed as a superset of molecular modeling(my area of research). In the strictest physical sense this is not a P problem if you consider the interactions of every atom with every other atom O(n!) for n atoms. No one does it that way of course. Once you ignore all but nearest neighbor interactions you have a problem that is polynomial time for n.

Proteins have too many atoms for even these techniques to be efficient. Now we're getting out of my area. As I understand it researchers do a Monte Carlo search of all possible configurations of amino acids(or even protein segments). Naively searching the space of all configurations would be make this NP. Of course you don't have to search the entire space. You can limit each step to make small changes only from an initial configuration and stay along a Markov chain of probable intermediate steps. I don't know enough to say that this would always be solvable in polynomial time, and of course you could miss the true minimum answer.

I'd love to hear from someone who knows more.

<comment><USER5> So, as I've alluded to elsewhere, the thing to remember about P vs NP is that you can solve NP problems very quickly, but it takes NP time to verify that the solution is correct. In other words, you can walk a traveling salesman to all the houses in the time it takes to walk to all the houses (that's __a __solution), but in order to verify that the path you walked was the shortest, you'd have walk all the possible paths (or at least, walk them until they were longer than the original path you walked, which is part of how heuristic methods of solving the problem work).

The way this works with proteins is assuming that proteins fold to a conformation that is a global minimum. For any given combination of atoms, you would have to consider all possible conformations (which, as you point out, can more easily be expressed in terms of pair-wise and higher-order interactions). This is the classic NP-complete, traveling-salesman type problem. Now, not _all_ proteins fold to a global energy minimum, but many or most do. So really, whether protein folding is P or NP depends on what you mean by the "protein folding problem".

If, by "protein folding problem", you mean determining the global energy minimum for any given chain of amino acids, then yes, this is NP. However, what Levinthal realized (with his paradox) was that if this was how proteins actually folded, it would take more than the age of the universe for a single protein to fold. This is even more paradoxical when you consider that most proteins fold on the millisecond to microsecond time scale. In other words, nature isn't solving an NP problem.

If, by "protein folding problem", you mean figuring out how a protein reaches its final conformation, then this is where the funnel comes in. Think of a protein on a surface in conformation space. Each spatial arrangement of atoms represents a different point in space. The surface represents the region of space that is accessible to the protein at a given energy. So, at high energy, the protein can wiggle around pretty much at will. All conformation space is open to it. However, as you lower the energy, fewer and fewer conformations are energetically allowed (that is, the protein no longer has enough energy to break certain hydrogen bonds or ionic interactions). Eventually, you lower the energy enough, and you find the global energy minimum.

Where this gets tricky is that there could be "traps" in the funnel; local energy minima that the protein can't escape from. If the protein gets caught in one of these traps, then it hasn't solved the NP problem of finding the global energy minimum. What's remarkable about proteins, however, is that the path they do follow (the one that's kinetically favorable) almost always avoids these traps. So, the protein is solving a P problem (finding the steepest path down the funnel), but in doing so also solves an NP problem (finding the global minimum).

If you think about it then, it's actually the __funnel __that has solved the NP problem (or rather, turned it into a P problem). This funnel is constructed by the laws of physics as they pertain to proteins, and it seems as though the unique properties of the 20 amino acids that make up proteins are the key to this NP to P conversion. Now, do I think this means that P = NP? No. The protein folding funnel is a heuristic, just like any other. Just because proteins usually find the global energy minimum, doesn't mean they always do. To absolutely, _positively_ verify that they are at their global minimum, you still have to solve an NP hard problem.

<comment><USER8> _the thing to remember about P vs NP is that you can solve NP problems very quickly, but it takes NP time to verify that the solution is correct._

I think you have it backwards. A problem is in NP if the solution can be verified in (deterministic) polynomial time. But (as far as we know) finding the solution may take much longer.

For example, the statement of TSP as a decision problem is: "Given these distances between the cities, is there a closed tour of length less than K?" If someone hands you a proposed solution -- a list of the cities, in the order you should visit them -- it is easy to (a) verify that the list contains all cities, and (b) the length of the tour is less than the required K. That is why TSP is in NP.

I didn't really follow the rest of your comment, so I'm not sure what bearing this has on your ideas on protein folding.

<comment><USER5> I may have my terminology backward. (I am a computational biologist, not a mathematician.) I think we're saying the same thing, though. Given that a protein folds to a particular conformation (3-D arrangement of atoms in space), you should be able to verify that a specific folding pathway is valid for getting there. However, without knowing ahead of time what the folded conformation is, determining the lowest energy conformation would require trying all possible conformations.

So, yeah, I think I've got the terminology backward, but the point remains. Nature can solve protein folding very quickly (depends on kinetics), but to know whether the fold is the best (depends on thermodynamics) requires trying all possible folds.

<comment><USER8> _determining the lowest energy conformation would require trying all possible conformations_

I apologize if it seems like I'm arguing over semantics, but from the computer science perspective, _solving_ the protein folding problem (as opposed to _approximating_ it) means finding an algorithm that does give the lowest energy conformation, without (in order for it to be tractable) trying all conformations.

In some formulation of protein folding that is NP-complete, your statement ( _require[s] trying all possible conformations_ ) is tantamount to P!=NP. So I'm guessing you don't have a proof of that. ;)

I admit that this is weak reasoning, but consider an analogy from computational biology: the Needleman-Wunsch algorithm for finding the optimal global alignment between two sequences. There are exponentially many possible alignments. Through the magic of dynamic programming, Needleman-Wunsch guarantees us the optimal alignment without trying all of them (it works in polynomial time). We can't rule out the possibility that some similarly clever algorithm can do the same for protein folding.

Now, Needleman-Wunsch works with respect to a scoring function that happens to make the problem tractable. In the case of protein folding, we'd have to ensure that the energy function we're optimizing with whatever clever algorithm we come up with is close enough to reality for the results to be useful to biologists.

<comment><USER5> No need to worry about arguing semantics, I'm learning here. As I've said, I'm what you'd call an applied computer scientist. While I've got a good handle on tractability, dynamic programming, and the like, sometimes I miss the formalisms of the terminology.

 _In some formulation of protein folding that is NP-complete, your statement (require[s] trying all possible conformations) is tantamount to P!=NP. So I'm guessing you don't have a proof of that. ;)_

Haha, ok, yes. You've got me there. Actually, that also clears up a few issues I was having with the original article. I tend to confound tractability and NP-complete. If I follow you now, an algorithm that can fold a protein to lowest energy is the _solution_. If that solution can be shown to be correct _without_ trying all possible conformations, then it is P. If the only way to verify it correct would be to explore all fold space, then it would be NP and and P!=NP.

In other words, my original assertion that protein folding is not, strictly speaking, NP relates to the fact that nature does not try all possible conformations. We could write an NP solution that does, but this is not what happens in reality. So, either nature is solving a slightly different problem (it doesn't worry about finding the global energy minimum exactly), or P=NP and the "algorithm" (in this sense a combination of physical laws) used by nature solves the same problem as our NP search of all conformation space.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> Executive Summary: Still Open

<comment><USER9> This is the top comment, really HN?

<comment><USER10> Frankly, I found that comment useful. The first question I had was if this was about a new solution, idea or a fresh development and the comment in question answers that in the negative. I suppose a lot of people here are already familiar with the problem, it's history and gct.

<comment><USER11> Of course, the second sentence of the article also answers that question.

</comment></comment></comment></comment><comment><USER12> Here's something that I've always been confused about regarding P vs NP: It seems like what researchers are looking for is not necessarily an answer yes or no, but really a transform that would convert NP problems into P ones. I have a background in electrical engineering, where it is common to use Laplace and Fourier transforms to convert differential equations in the time domain to polynomial equations in the frequency domain, so I see the P vs NP issue to be somewhat analogous to that. Am I understanding the issue, or completely off?

<comment><USER13> Well, complexity theory does have this concept. I.e. you can convert one problem to another, they call it a reduction. I.e. you reduct problem A to problem B.

So, in that sense, if you can somehow reduce an NP-Complete problem to a problem in P, then yes, you would prove that P=NP. However, this would not be the only way to prove this. If you could just find a polynomial time algorithm for any NP-Complete problem, then you've proved P=NP.

Of course, most expert think P != NP, so if thats true then you'll fail in your attempts to do these...

</comment></comment><comment><USER14> Lance Fortnow is my academic adviser!

<comment><USER15> Hah, I like how I tried to read the article from the NU wireless when I'm literally less than a building away from the guy but the ACM still required me to sign in.</comment></comment>


Ask HN: Facilitating payments between users - <AUTHOR>

When I bounce around startup ideas in my head, there's one class of ideas that seems so daunting that I don't even consider it an option: Facilitating payments between users.
For example, take Google Answers. Someone posts a question and puts up a financial reward and whoever answers it gets the money.
How complicated is it to set up a service like that?
From a distance it seems simple enough: User 1  pays you and then you pay User 2.
However... What big legal hurdles do you need to deal with? What about taxes for the money you pay people? Is there a some line that, once crossed, users become employees? What about money laundering? What about refunds and dealing with fraud and abuse? Is there an easy way to deal with all of this? <comment><USER2> Scenario. User Alice pays you $10k and poses a list of 10 questions. Many people come to respond, Alice reads the replies, but consistently approves the answer provided by Bob. As required, you would pay Bob $10k minus your commissions.

Congratulations, you have just facilitated your first money laundering operation.

The major difficulty in e-payment solutions is not technical one, it's legal.

<comment><USER3> Exactly. The OP may want to look into what happened to E-Gold.

<comment><USER2> What happened to E-Gold is that they tried to be hereos to their clientele and went out of their way to refuse to cooperate with Uncle Sam. Opening a foreign bank account and calling yourself a foreign entity does not save you; Saddam and Noreaga each _owned_ an entire country :-)

What he can do is what most freelancing websites do: show tangible products or services changing hands; make sure the amounts stay low, make sure you're not paying out U.S. citizens without reporting their income, etc.

A tangible good or service would be something whose price is market dictated and doesn't seem too outrageous, the delivery of which _you_ control.

It's OK to facilitate the sale of a domain name for up to $1000, and require that the seller wait a certain number of days, then transfer to a U.S. or EU bank.

However, it's not OK to setup an auction room for impossiblystupiddomainthatnoonewouldbuy.com and have one buyer start bidding at $10k. That's a rigged auction.

It might be far easier to setup an escrow service (if you can even survive the bad name the escrow industry has) and just deal with people in the U.S., taking SSNs from all the payees.

We tried something like this a while back but it wasn't worth the trouble.

<comment><USER3> You make a good point about controlling the delivery of a tangible good. That _may_ get around some of the regulation that applies to money transmitters, but either way I think this type of business is going to require some rather expensive lawyers to review.

</comment></comment></comment></comment><comment><USER4> well, that sounds basically like what the YC company tipjoy tackled, i do believe.

<http://tipjoy.com/>

<comment><AUTHOR> Looks like the user must have a Paypal account.

From the Tipjoy FAQs:

 _Click it, and from there you can cash money out of your Tipjoy account into your PayPal account. You can also give your money to another website (a charity, maybe?), or have us turn it into an Amazon gift card for you. For legal reasons, if you're going to cash out to PayPal you'll need to tell us a bit of info about yourself (name and address), which we will keep private in accordance with our Privacy Policy._

Anyone know how they deal with the money laundering problems? And if they're using Paypal to transfer the money, how do they have smaller fees than them?

<comment><USER5> _Anyone know how they deal with the money laundering problems?_

I do not, but this is the Internet, so I can speculate wildly :)

Tipjoy seems to be focused on micropayments. Unless you are only trying to launder $5 or $10, it would take a metric fuckload of "tips" to launder any significant amount of money. I would presume (which sounds so much more highbrow than assume) that it would be simple to look to filter out and flag potential laundering schemes. Either the average amount of tip, or the average # of tips between two users would be obvious outliers.

<comment><USER2> What you describe (large amounts of small payments to one user) is called _smurfing_ , and both banks and paypal have something in place to guard against it. One "benefit" of requiring Paypal is that you're offloading the responsibility of final delivery to them.

<http://en.wikipedia.org/wiki/Smurfing_(crime)></comment></comment></comment></comment>


The Japanese Boy Fighting for His Right to Play Video Games - <AUTHOR> https://www.nytimes.com/2020/06/11/business/japan-video-games.html <comment><USER2> Japan's "entertainment" industry is built on limbic capitalism. There is no 'play' involved in those games, only carefully calibrated stimulation and monitoring. It should be the companies making the games regulated not the families. I'm surprised the ultraconservative camp is anti-game, many of them seem to be pretty nationalistic.. Let's play a dating sim with avatars of Japanese swords or WWII Battle ships.</comment>


Shopping Brought to You Live - <AUTHOR> https://www.livepitch.tv/ <comment><AUTHOR> We still love to shop at stores. While E-Commerce is convenient, the experience of visiting your favorite store in person is a unique experience. We created LivePitch to allow you to visit real stores through your phones. Chat live with your hosts and fellow shoppers and discover the coolest shops around NYC.</comment>


Open redirects – a vulnerability class no one but attackers cares about - <AUTHOR> https://stevetabernacle.github.io/blog/open-redirects-the-vulnerability-class-no-one-but-attackers-cares-about/ <comment><USER2> I don't know, I think this case is pretty flimsy. In practice, the value of an open redirect against modern applications is for "phishing". But speaking as someone who has dealt with several ATO dramas over the past two years: users will click on anything. They're not hovering over links to make sure they're safe.

Open redirects are worth fixing, but they're a lot more common than I think people expect they are. I think the severity:low the "good" (unconstrained, straightforward links, persistent, across all browsers) ones get is well measured.

I see open redirects as sort of the archetype of the "t-shirt vulnerability" \--- the one the bug bounty sends you swag, instead of cash, for finding.

<comment><USER3> That's quite true, but I think the value in these attacks is that they work against more technical users than typical phishing attacks - I remember several years ago someone posted a link on a large technical subreddit which appeared to be to youtube.com.

It presented a page which claimed to be an age flagged video - at the time youtube was having many problems with age flagging videos - and sure enough many people tried to login to it - they looked at the "(youtube.com)" text on reddit, they looked at their browser when they first clicked the link, but they never noticed when the URL changed to offsite when they had to login. It never struck them that a legitimate youtube link could have sent them offsite.

The solution most of those people arrived was simple though: use password managers which will force some extra suspicion if the login page doesn't behave as expected.

EDIT: Found the link and discussion, [https://old.reddit.com/r/programming/comments/bpy7h/think_yo...](https://old.reddit.com/r/programming/comments/bpy7h/think_youre_immune_to_phishing_attacks_see_if_you/)

By the numbers it looks like about 1/2 the people who made it to the sign in page made it to the submit page. That's a pretty good result especially given that it's a technical subreddit and people were primed with "think you're immune to phishing attacks"...

<comment><USER4> It is interesting to note that YouTube now inserts an interstitial "you are leaving YouTube" screen on its open redirect spot.

That Reddit shows the domain name _next to the link_ (HN also) is, I think, the key here—it casually set expectations. Most link situations won't be like that, and so I'm broadly with tptacek, that it's not actually so useful. Plus, businesses commonly use all sorts of different domains, rather than subdomains, and something like yourbank-security.com instead of yourbank.com may not even raise eyebrows—to say nothing of people probably not even twitching at login.yourbank.com.evil.com anyway.

</comment></comment></comment><comment><USER5> A decade ago people were using Google redirects to lure people into visiting shock sites.

Back then, it seemed reasonable to not consider this a real security flaw. Now that everyone has a Google account, the possibility of credential theft seems like something worth taking seriously.

At the very least, either host the redirect on a domain that is clearly distinct from the domain users log into, or ignore the destination parameter if the referrer is not a trusted source.

Now I'm wondering if this is also a potential vector for DDoS attacks against a third party. Widely distribute links "to a cute puppy on Instagram" that redirect to a URL that triggers a resource-intensive search operation on the victim's server? (Bonus points if the redirect points to a page that loads an actual cute puppy in one frame, and targets the victim with a 1-pixel frame.)

It sounds like a stretch, but I can't rule the possibility out. Even if it can't be used to launch a DDoS, I could see it being used for advertising fraud.

<comment><USER6> > _Now that everyone has a Google account, the possibility of credential theft > seems like something worth taking seriously._

Not sure I follow - is the idea to redirect from google.com to an attacker's site that spoofs the Google login page? I think we'll get more mileage out of solving that with origin-aware authentication mechanisms (password managers, U2F, WebAuthn, etc.) and perhaps address bars that show the eTLD+1 instead of / more prominently than the full URL. Phishing is already a problem even without open redirects.

> _Widely distribute links "to a cute puppy on Instagram" that redirect to a > URL that triggers a resource-intensive search operation on the victim's > server?_

Keep in mind that unrelated web pages can send GET requests to each other by just using an image tag, so if your website has a resource-intensive search delivered over GET and no automation to detect suspicious behavior and spikes in certain types of requests, you're already vulnerable to this via e.g. someone submitting an interesting blog page to HN that loads youe search page as a resource. Either make it POST or add some HTTP-level DDoS protection a la Cloudflare.

Same with advertising fraud - ad clicks should be POSTs. (Open POST redirects do seem more dangerous but are probably rare.)

<comment><USER5> Relying on your customers to use password managers to protect themselves is not very useful in the Eternal September age of the internet. (I do see your point that a Google redirect is only marginally more likely to be effective for phishing than a link to something like goegle.com.)

Everything else in your comment is spot on.

</comment></comment></comment><comment><USER7> The problem is that often Open Redirects can be leveraged in unexpected ways, beyond the conventional attacks listed.

I have previously been awarded a bug bounty by Google for an issue that leveraged open redirects on victim sites to hijack their link equity (PageRank): [http://www.tomanthony.co.uk/blog/google-login- hijack/](http://www.tomanthony.co.uk/blog/google-login-hijack/)

It would have allowed a non-trivial financial impact on victim companies.

Secondly, I submitted an issue to Google which leveraged open redirects on their properties to hijack the login flow (i.e. a user is on an official Google page, selects a user and is redirected to an attacker for the password prompt - halfway through the login flow, when a user has likely already established they are on a real site): [http://www.tomanthony.co.uk/blog/google-login- hijack/](http://www.tomanthony.co.uk/blog/google-login-hijack/)

Sometimes open redirects are unavoidable, but all too often they aren't necessary and so it is simply lazy to not fix them and point to Google and others who mark them as WONTFIX as reason not to bother doing so yourself.

</comment><comment><USER8> Surprised the author doesn't mention oauth - open redirects are the achilles' heel of oauth flows and allow for full account takeovers. It is very common.

<comment><USER9> Very common in 2019? I haven't run across an OAuth provider in some time that isn't properly checking redirect_uri against at least a whitelist of domains (if not the full URL).

Is there another redirect attack I'm not aware of? The other attacks on redirect generally involve gaining access to some other page on the client you are attacking and using that as a redirect which the provider will often allow if it's only validating the domain. That's not really an open redirect, however...

Am I missing something?

<comment><USER10> If they check the domain, chain it with another open redirect in the same domain.

</comment></comment></comment><comment><USER11> They're also really useful for evading spam filters. I found[1] a bunch of government domains with open redirects.

Spammers were sending out emails containing links to `example.gov.uk/redirect?url=dodgy-viagra.ph` - and certain spam filters were trained to whitelist "trusted" domains.

You also see a lot of open redirect abuse on forums - especially where they're configured to only show the first few dozen characters of a link.

[1] [https://www.openbugbounty.org/researchers/edent/](https://www.openbugbounty.org/researchers/edent/)

</comment><comment><USER12> Open redirect alone doesn't look dangerous. But combining it with another vulnerabilities like OAuth misconfiguration -> account takeover. I wrote a blog about this common mistake some time ago: [https://pwn.netlify.com/open- redirect-to-oauth-token-theft.h...](https://pwn.netlify.com/open-redirect-to- oauth-token-theft.html)

</comment><comment><USER13> If you ever get a third party penetration test, this is like, the first thing they find. To say "no one but attackers cares about," is pretty nonchalant – we immediately patched up this clearly bad attack vector, despite it not being extremely likely to manifest as a serious problem to us, because, like, you should just do that.

<comment><USER14> I just fixed one myself. It's not that hard to sanitize redirect parameters. One good way, if it fits your app, is to insist they be internal-only: "/app/profile" rather than external "[https://evil.example.com/phish/login"](https://evil.example.com/phish/login")

I believe it's worth fixing these, not only because it gets penetration tests to shuddup, but because cybercreeps...

</comment></comment><comment><USER15> Open redirects are also used for SEO spam to hijack domain authority and other nefarious purposes.

It's silly that these big tech companies won't fix them.

</comment><comment><USER16> I once reported an open redirect attack to GitHub, and they were like, nah, WONTFIX. I believe the issue still exists.

That said, how useful is an open redirect attack really?

<comment><USER17> Depends on where in the system it is. If it's part of a flow involving sensitive data, an open redirect can be used to harvest that data from users. This might be anything from login credentials to bank account info, depending on what flow is involved.

</comment></comment><comment><USER18> Open redirects are also used to prevent referrers from propagating through. In that sense, they're very useful for anonymisation.

<comment><USER19> there are many browser extensions to spoof or disable your referrer

<comment><USER18> The point is for the site owner to prevent it from showing up in the referer logs of other sites, regardless of browser.

<comment><USER19> I wish every site would do that... but they like to do the opposite

</comment></comment></comment></comment><comment><USER20> You could just add some kind of hash based on the redirect url and check that, to ensure that it can't be altered.

<comment><USER21> For this you need some pepper (i.e. a secret) to prevent doctoring.

The better option is an encrypted blob containing all relevant data and a timing component. Of course those thing do require effort. It makes it opaque for everyone but the server handling the redirect.

</comment></comment><comment><USER22> I don't think most browsers support redirect to javascript anymore. Maybe IE?

<comment><USER23> Yes, they still do depending on how you redirect (i.e. unsanitized: location.href = url).

A nice benefit of using a framework like angular, Vue, react, etc, is that they prevent attacks like this unless you explicitly disable those features.

</comment></comment><comment><USER24> Is there a definitive list of attacks with prevention mechanisms somewhere ?

<comment><USER17> You might find this to be interesting and informative reading: [https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Proje...](https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project)

This covers what the vulnerabilities are, how they happen, how they work, and how to prevent them. It's not exhaustive, because that list would be endless, but it's one of the best resources for a web developer who is not a security practitioner.

</comment></comment><comment><USER25> Also a great tool for bypassing corporate firewall for browsing.</comment>


Ten things to achieve when starting 3D programming - <AUTHOR> http://www.gamedev.net/topic/609071-ten-things-to-achieve-when-starting-3d-programming/

<comment><USER2> This is a great list.

I would probably put number 4 "Learn everything you can about vectors and matrices" right at the top though. That stuff really is the foundation of most of what you do in 3D programming.

Trying to implement a camera viewport without some significant investment in vector & matrix math is a recipe for disappointment & throbbing temples ;)

<comment><USER3> Can you recommend any good resources for learning 3D-oriented maths? I took linear algebra back in college but definitely think I'll need some refreshers, as it's been a while.

<comment><USER2> If you can look past the retro vibe this is a nice overview: <http://programmedlessons.org/VectorLessons/index.html>

Some interactive matrix maths lessons: [http://www.intmath.com/matrices- determinants/matrix-determin...](http://www.intmath.com/matrices- determinants/matrix-determinant-intro.php)

Free textbook on linear Algebra: <http://linear.ups.edu/>

and for the intrepid soul actually implementing a viewport: [http://zach.in.tu- clausthal.de/teaching/cg_literatur/lightho...](http://zach.in.tu- clausthal.de/teaching/cg_literatur/lighthouse3d_view_frustum_culling/index.html)

Good luck ;)

<comment><USER3> Thank you!!

</comment></comment></comment></comment><comment><USER4> I think that's a great list, and for the most part, how I'm going about it.

But I don't think these need to be done before you actually make your first 'game'. It's perfectly okay to use other peoples' methods for a while until you solidify what you think is wrong with them, and how you think you can improve them. At that point, it's probably time to code your own and find out all the little intricacies.

You will eventually want to know all this, though.

</comment><comment><USER5> I had done all of this by the time I hit 10th grade. I hated my 10th grade geometry class because I preferred spending my time writing 3D games to applying the law of cosines and proving millenias-old theorems. I'm now confident that was the right choice.

</comment><comment><USER6> One thing missing is a physics engine/collision response. Sounds hard but not really. Only implement the collision response after you have implemented collision detection.

</comment><comment><USER7> This list has nothing to do with say, creating a 3D game like Minecraft.

There are other ways to go about it. This is a good example of one way to do it.</comment>


Some children at higher risk of privacy violations from digital apps - <AUTHOR> https://www.eurekalert.org/pub_releases/2020-09/mm-u-sca090420.php <comment><USER2> This is pretty sad but expected and indicative of perverted incentives from the ad industry. It pays for sites but I ask myself if it is really worth it.

It isn't easy to explain the benefits of being restrictive of data sharing especially in those demographics.</comment>


First HN Meeting in Paris: story and pics - <AUTHOR> http://blog.medusis.com/first-paris-hackers-meetup

<comment><USER2> Thanks for posting the summary. I imagine it helps forming a somewhat coherent group.

Some of your activities could be a good inspiration for the next HN Zurich meetup, which reminds me...

</comment><comment><USER3> I really enjoyed this night, and especially the vast array of topics we got to discuss either in "stand up" mode or in small groups with beers.

A unique opportunity to keep up with the bleeding edge research done in Bayesian Data Fusion applied to StartCraft AI competitions.

\- <http://en.wikipedia.org/wiki/Bayesian_network>

\- <http://en.wikipedia.org/wiki/Data_fusion>

\- <http://skatgame.net/mburo/sc2011/>

</comment><comment><USER4> Thanks for writing this summary :) It was a real pleasure to see so many people (+ not French-speaking).

As discussed yesterday, next time we'll probably use badges to spark discussions and we'll find more time for recruiting sessions and MVP demos :)

BTW, we're looking for sponsors. _hint_ _hint_

</comment><comment><USER5> To follow the next meetups there : <http://parishackers.org/>

</comment><comment><USER6> The event was hosted by Sylvinus (CTO of Joshfire.com) at the Joshfire office. He did a splendid job. I'm very appreciative of the effort and the event was quite successful. Thanks for the pizza and beer (and for allowing me to babble on about Clojure ;)

<comment><USER5> well, thanks! You sir are a gentleman and a scholar, I hope you can make it to the next ones!

Thanks again for coming and shedding some light on this weird Clojure thing ;-)

</comment></comment><comment><USER7> Just curious - was it mostly in French? English? Mixed?

<comment><USER8> Which raises an interesting question: Should local hacker/nerd/entrepreneurial communities adopt an all-English approach or should they strive to invent at least some new vocabulary and use those.

<comment><USER9> The fact that the _Paris_ meetup was conducted in English and not French means the question has already been settled.

</comment></comment></comment><comment><USER10> It was a really fun night: quite different to most meetups (thanks to the diverse range of people that HN attracts)... so there was something for everyone!

</comment><comment><USER11> Great event, awesome host and lots of good / original ideas for a meetup. I'm used to technology meetups with pre-planned presentations, but the top-10 / buzzwords "improvised" discussions were actually really cool.

As a bonus point, I got to practice my English. Still need to get rid of my french accent, though...

EDIT: I forgot to add the two links I talked about, in case you were interested but didn't write them down:

\- [http://talkfast.org/2010/07/23/a-cure-for-hacker-news- overlo...](http://talkfast.org/2010/07/23/a-cure-for-hacker-news-overload) \--> HN RSS and Twitter feeds

\- [http://html5slides.googlecode.com/svn/trunk/template/index.h...](http://html5slides.googlecode.com/svn/trunk/template/index.html) / <http://code.google.com/p/html5slides/> \--> Google's HTML slide templates (relatively similar to those used at Google I/O 2011)

</comment><comment><USER12> Thanks for this great summary and thank you all guys, it was a great start I think ! The buzzwords session was really fun.

</comment><comment><USER13> Damn, I just came back from vacation when I received the notification yesterday. Sunburned and jetlagged, I could not make it.

See you in September!

</comment><comment><USER14> Really cool night, cool people, nice talks, interesting demos. Can't wait to do it again. And hope we'll hatch a nefarious plan to have PG over :)

</comment><comment><USER15> It was a great event..kudos for Sylvinus for organizing the meetup and for the Pizza and Beer!

<comment><USER5> you also have to thank tbassetto for that! :)

<comment><USER15> My bad.. thanks a bunch tbassetto!

</comment></comment></comment><comment><USER16> can't believe i missed that, I wasn't aware a lot of people were reading HN in Paris :O

<comment><USER17> Me too. Looking forward to the next event!

</comment></comment><comment><USER18> great event, great host and interesting spontaneous interventions.</comment>


Laptops vs. Learning - <AUTHOR> http://www.washingtonpost.com/wp-dyn/content/article/2007/04/06/AR2007040601544.html

<comment><AUTHOR> I am interested in this topic because my younger son has just started at secondary school here in France. On most days he has to carry more than 12 kilograms in weight (school books and writing materials). [That's over 26 pounds for those that use the Imperial measurement system.]

It is clear to me that all his text books could be made available on a device like the Amazon Kindle. Plus, a good deal of his "written" work could be completed and submitted using a small laptop. I suppose that rough sketches and drafts are often best managed using a pencil and paper but even here an electronic device using a stylus could be useful.

However if classroom devices are unwelcome because they represent a distraction then I can't see us moving forward on this issue and school children will forever be carrying an unacceptable weight.

<comment><USER2> Buy him a bag with wheels!

<comment><USER3> When I was in school I 'accidentally forgot' most of my books almost all the time. Worked as well.</comment></comment></comment>


The Insecurity of Secret IT Systems - <AUTHOR> https://www.schneier.com/blog/archives/2014/02/the_insecurity_2.html <comment><USER3> I know that NSA/Snowden continues to be at the top of the news, but it's still worth pointing out again that NSA's internal system is probably one of the most secret of internal IT systems and through Snowden's work, we've found out: 1) NSA employees are easily phished and 2) They probably don't have the same level of deterministic dev ops deployments that modern tech companies depend on, given that it was Snowden's job to install an "anti-leak" system and apparently no one double-checked to make sure he had installed it. Hell, who knows if even that secret anti-leak system would actually do anything besides add more cruft to their internal operations? [http://arstechnica.com/tech-policy/2013/10/snowdens-nsa- post...](http://arstechnica.com/tech-policy/2013/10/snowdens-nsa-post-in- hawaii-failed-to-install-anti-leak-software/)

<comment><USER4> I'd not realised that it was the person whose job it was to install the anti- leak system who leaked everything. I guess that's an obvious outcome..

<comment><USER5> This gives the new meaning to "copying production database to test environment"... ;).

</comment></comment></comment><comment><USER6> Regarding voting systems, all we ever needed was open source software.

Voters were incorrectly recording their paper ballots. A PC with a punch card machine attached and running open source software could have correctly punched these cards.

And we also could have had another system that read the cards right there in the polling place that the voter could use to confirm their ballot was correctly encoded. Or an phone app that could read a photo of it.

We could have gotten that software for free. It could have run on ancient PCs. It could have solved the actual problem that we had.

But the lobbyists got there first, influencing politicians into buying unneeded and overpriced solutions, just like they do in every other area of government.

<comment><USER7> As much as I agree that the software should be open source, that's not nearly enough. There are large numbers of rootkits and vulnerabilities for Linux, for instance. There would be a huge incentive to modify the software of these machines in some undetectable way in order to influence elections.

There's been a lot of scholarly literature written on how to do secure electronic voting, and I understand the consensus is that some sort of voter verifiable paper audit trail is the only way to match or exceed the security of the paper ballot system.

<comment><USER8> stretchwithme addresses that in the third (and subsequent) sentences of his comment. I know that's a lot to read, but still. They were in fact describing a voter-verified paper trail system.

<comment><USER9> He appeared to specifically exclude that possibility by requiring a machine to read it.

This entire discussion is predicated on a mistaken assumption that we have significant levels of fraud – often asserted but never convincingly supported – or that electronic systems reduce those odds. We'd be much better off sticking with a simple optical system which can be reviewed and scored by hand and providing a computer-assisted system to help those who have difficulty to fill in that ballot. As a plus, this system is really cheap and easy to scale rather than requiring a bunch of expensive computers and support staff for an infrequent event.

</comment></comment></comment></comment><comment><USER10> His point applies equally to general software quality. Even in the workplace, I always see the bad programmers try to sling shitty code with private repos or direct pushes with no peer review. The good ones always operate in the open and appreciate peer reviews.

</comment><comment><USER11> How is a an airport xray scanner maker supposed to participate in that iterative process for improving security if they aren't in a mass market? No security researchers took interest for a long time till Rios purchased a scanner. "It runs an outdated windows 98 operating system" just shows how little anyone cares, even if Rios would like it to show how awesome he is as a researcher or how awful windows 98 is as an OS.

Also unrelated, how to factor a large prime to break RSA 1024 quickly is a secret too.

<comment><USER5> > _How is a an airport xray scanner maker supposed to participate in that > iterative process for improving security if they aren 't in a mass market?_

Invite pentesters. Hold competitions for people to try and break it in an isolated part / mockup of an airport. Donate one to your local hackerspace and ask them to have fun with it.

Possibilities are endless; the only things needed is understanding the points in Schneier's essay and a little courage to do the right thing.

</comment></comment><comment><USER12> The fact is that sometimes security through obscurity works. Take Skype for example, it was well known that the US government had for a long time wanted access and, depending on who you ask, failed. After being bought by MS and reconfigured, it could be argued that there are now fewer access problems.

Where obscurity fails is where the product has been poorly designed in the first place - perhaps due to lack of time or manufacture costs - or there is a failure to update when the scenario or environment for which it was built changes.

Obscurity is really a term about confidence and PR of a system (eg. ISO standards compliant?) or company (RSA anyone?). How does the company convince you that it is using best practices without compromising its competitive advantage?

The grumbles about running Windows98 are pointless if the system meets the requirements.

<comment><USER13> "Take Skype for example, it was well known that the US government had for a long time wanted access and, depending on who you ask, failed. After being bought by MS and reconfigured, it could be argued that there are now fewer access problems."

That is not a security through obscurity success story. The Skype design was changed by Microsoft in a way that made government access easier.

"How does the company convince you that it is using best practices without compromising its competitive advantage?"

Your competitive advantage is not my problem. I need a secure voting machine, a secure ATM, a secure medical database, etc. If you cannot deliver a secure system to me in a way that allows me to verify its security, then you never had a competitive advantage in the first place.

</comment></comment><comment><USER14> "Smart security engineers open their systems to public scrutiny, because that's how they improve. The truly awful engineers will not only hide their bad designs behind secrecy, but try to belittle any negative security results."

Or restated:

All bad engineers try to hide their work from the public, therefore all good engineers try to show their work to the public. I'm sure there is a logical fallacy in there somewhere.

</comment><comment><USER15> Windows 98, Really?

wow. I'm just, wow.

Like I can understand an ancient version of Solaris, or Windows NT4 - <USER2> Windows 98?

just wow.

</comment><comment><USER16> security in any application has to start from the beginning and nurtured by all developing this application. security can not be a bolt-on after the fact patch works. when at least these two are not applied all applications will fail miserably. security by obscurity only a make believe.

</comment><comment><USER17> Is there a video of this talk anywhere?</comment>


Ask HN: What web database(s) do you guys use? - <AUTHOR>

I was today in the middle of a mysql scenario where it corrupted index, had to repair it etc.. anyways which database are you guys using? Seems like Mysql pretty much prevails, but I was wondering what are your experience with other solutions - mainly PostgreSQL and others. <comment><USER2> I have used both Postgres and Mysql and recently found out that Rails postgres adapter is broken for legacy databases. However, here's a good discussion on stack overflow: <http://tinyurl.com/c29ftj>

<comment><USER3> According to the current ruby driver author, the latest driver should support back to Postgres 7.4. Any older version of postgres is unsupported by the postgres project itself, but if you really need something that old, you should be able to use the old "postgres" gem. Granted there might be driver / database / platform combinations that have issues, but if you know of one, please submit a bug report with the specifics. HTH :-)

</comment></comment><comment><USER4> I've always preferred Postgres because of its stability and solid construction.</comment>


The reality distortion field is in the consumer's brain - <AUTHOR> http://arstechnica.com/science/2012/10/weve-located-the-reality-distortion-field-and-its-in-the-consumers-brain/

<comment><USER2> This is an interesting hypothesis, but the one example they give of what they actually tested leaves me skeptical.

In one case the product contains "natural enzymes", in the other the product contains "grains made of alcalase and esperase protein molecules". The problem is this latter explanation does not really explain more since the meanings of alcalase and esperase would only be known to experts who probably make their own detergent in their private lab.

To reach a credible determination whether people like more complex explanations, the more complex explanations need to be good ones, and not ones intentionally designed to intimidate people with undefined specialist language.

It should be one that someone reasonably knowledgable would have a fair chance of understanding. For example, someone with a high school education level could be told "Contains enzymes for better cleaning.†" and then in explanation, "†Enzymes are protein molecules which can act as a catalyst to change the energy levels required for chemical reactions. We extract enzymes called alcalase and esperase from bacteria found in bird feathers and hay. These enzymes allow water to bind with the proteins that hold grass and sweat to your clothes, allowing them to be broken down by the soap into more soluble compounds so that they can then be washed away by the water."

Now maybe people would hate knowing that, but at least it explains what is really going on to a depth that an intelligent non-specialist could understand it. Myself, knowing that a given detergent uses enzymes known as alcalase and esperase, where they come from, what they do and how they work gives me more confidence in the product. Knowing that it has magic beans called alcalase and esperase isn't very helpful though and is just frustrating because the explanation is obviously lacking sufficient detail for much anyone but a detergent specialist to follow.

I am not surprised that people told the detergent had specific types of enzyme magic beans rated their understanding of their product at a lower level than those told it had enzymes generically. Nor would I be surprised to find in a more detailed study of actual understanding should both groups actually have identical and very shallow understanding.

I suspect, or rather, hypothesize, that with a _good_ explanation, people might rate their understanding higher _and_ actually have real understanding of the product rather than the superficial one they would get from either of the descriptions tested by this study.

<comment><USER2> Follow up.

I tracked down the actual study "Explanation Fiends and Foes: How Mechanistic Detail Determines Understanding and Preference".

The "alcalase and esperase" explanation was from the "non-causal detail" section of the experiment, where they constructed detailed explanations of things that had little to do with the actual reasons for the benefit claimed. They also tested people with "causal detail" explanations that had relevant explanations. The understanding scores were higher for causal explanations than non-causal.

Example non-causal:

"The post-free beater is made from a steel alloy, which is made by combining iron ore with small amounts of chromium and aluminum under very high heat. This reduces mixing time."

Causal detail:

"Without a center post to hinder movement of the ingredients, a vortex is created within the beater that forces dry ingredients to dissolve more easily, thereby reducing mixing time."

Causal details resulted in more understanding, as one would expect.

They also tested for several different levels of detail. The highest level for beaters was this:

"Without a center post to interfere with movement, liquid molecules move uniformly within the beater creating a lot of spin. This forces dry particles into suspension in the liquid, thereby reducing mixing time."

Rather than say "dissolve" they say "force into suspension in the liquid". Self evaluation of understanding went down for both groups once it got to that level. It seems clear to me that "force into suspension in the liquid" is less clear and provides no real additional details beyond "dissolve", which contributes to the confusion. It's not that people don't like technical details, it's that the explanation is actually less clear.

Compare also the explanations for white saran wrap being better because it blocks light:

intermediate: "The white coloring reflects light waves that would otherwise break down the amino acids that maintain the structure and freshness of the food, thereby keeping food fresh for longer."

detailed: "Atoms in the tinting agent oscillate when hit by light waves causing them to absorb the energy and reflect it back rather than reaching food where it would break the bonds holding amino acids together, thereby keeping food fresh for longer.

"Atoms in the tinting agent oscillate when hit by light waves causing them to absorb the energy and reflect it back" is cool, but "The white coloring reflects" is really a better way to explain it. Dropping down to the level of atoms in the wrap itself doesn't convey more relevant detail, it just obscures the meaning at this level. (Covering how the photons break amino acid bonds by causing molecules to shift configuration to handle the extra electrons created from the photon collisions might have been a better way to go hard core in the "detailed" level since that speaks more to the mechanism.)

The non-causal explanation for this one was "The cling wrap uses a white tinting agent which is composed of a mixture of titanium dioxide molecules and other binding agents. This keeps food fresh for longer." This fails to include the detail about light breaking down amino acids leading to less fresh food, so it introduces confusion since the TiO2 detail is less relevant than the amino acid detail. And as one would expect, fewer people felt they understood what was going on with this explanation than when the actual causal chain was presented.

In summary, the arstechnica article's example was selected incorrectly as it was from a different part of the study than what the arstechnica author was discussing at the time: he looked at Table 2 which dealt with experiment 3 rather than Table 1 which covered all phases including Experiment 1.

Also, in Experiment 2 where they tested whether people would be more likely to pay more for a premium product with additional features the curves for low CRT people were not linear. It went down from 4.3 to 3.1 with intermediate explanations, but back up to 3.4 with detailed explanations. This also suggests the possibility that it is not explanations but inadequate explanations that are confusing for some people.

Also relevant is that in Experiment 1 the level by which which reported understanding went down by "Low CRT" people was quite modest, only from 5.5 to 5.0 as explanations went from shallow to detailed. It should also be mentioned it went down slightly for high CRT people as well, from around 6.0 to 5.9 or so. (Estimates since I'm eyeballing the graph in the article.)

Finally, an extremely relevant detail is that when going from no detail to some detail, both understanding and product preference went up for BOTH groups.

Consider the example of bandaids with bubbles compared to bandaids without bubbles.

no detail: "The bubbles help cuts heal faster."

shallow detail: "The bubbles increase air circulation around the wound, thereby killing bacteria. This causes cuts to heal faster."

detailed: "The bubbles push the padding away from the wound allowing air to circulate. Oxygen in the air interferes with the metabolic processes of many bacteria, killing them and allowing the wound to heal faster."

Understanding goes from 3.5 to 5.5 for the low-CRT people and 2.2 to 4.5 for the high-CRT people. Some detail is better for everybody, and I would even say that the level of detail given here is sufficient for many to posit a more complete explanation, or at least find one through research if curious. Whereas the no detail explanation offers nothing, it might as well define energy as "energy makes things go" and it's certainly expected that this would result in the least understanding across the board.

Product preference goes from 3.9 to 4.3 for low-CRT people when we go from no detail to shallow. And 3.1 to 3.5 for high-CRT. So everyone benefits from a reasonable level of causal information.

This is extremely different from the vibe given by the article, which suggested that saying "it's blue" or "it's newfangled" was all you needed. That is not correct, that level of explanation performed the worst for all subjects in both understanding and product preference.

There's also a fourth Experiment in the paper. It should be addressed, but mostly to note that it is quite different from the rest. Subjects were presented with four products that were considerably less familiar than bandages and washing soap. They were given shallow explanations taken from product marketing literature, asked to rate their understanding, and then were ambushed with a demand to write a detailed essay describing in precise scientific detail exactly how the product actually worked, step by step. After this "exercise", not only did their evaluation of their own understanding go down (obviously), but the non-CRT people became quite hostile to the product itself and were much less likely to buy it.

Recall that in Experiment 2 these same people liked products more when proceeding from no explanation to a shallow one. In this experiment they did NOT test how willing they were to buy it after explaining it and before ambushing them, they only tested how willing they were to buy after ambushing them. The experimenters conclude that the explanation caused them to be less likely to buy. This is a plainly absurd conclusion and the experimenters have to realize this. It was the ambushing and demand that the person provide an essay describing the detailed workings of the product after forcing them to state whether they understood it or not that made them angry that is the cause here. This also is a scenario that is never found in actual consumer purchasing workflow, and quite irrelevant to marketing other than to tell you it is a mistake to corner your customer and demand explanations of them of how your product works after asking them if they understand it. All that does is embarrass them. Yes, the high-CRT people did well with the the exam and were more likely to buy, but obviously this is because they did understand how it worked. This experiment is completely disconnected from the important observation that a cursory, accurate and functional explanation of product benefits improved desirability of the product.

</comment></comment><comment><USER3> _Those with low cognitive reflection scores felt their understanding was sufficient with the minimalist information—any more and their sense of fluency dropped. Those who scored highly on the CRT showed a linear increase, where more details meant greater understanding._

In most other contexts, I'd say the low-CRT people had a point. It's reasonable to expect that someone will tell you what's important and leave out what isn't important, so it's reasonable to estimate your competence by how well you understand what is presented to you. Your average consumer doesn't know what enzymes do, so if the ad doesn't explain, they conclude that they don't _need_ to know. When the ad starts to explain, they conclude they _do_ need to know, and they rate their knowledge lower. It makes perfect sense. The mistake is not in how they process the details but in their implicit assumption that the advertisement is a cooperative, good-faith interaction instead of an adversarial one.

</comment><comment><USER4> > _"Contains natural enzymes" to "The detergent has enzymes. Grains made of > alcalase and esperase protein molecules are dissolved in the detergent, > thereby making clothes cleaner."_

I think the latter is a less complete explanation, in that it introduces concepts without explaining them. What are alcalase and esperase, specifically? These are unfamiliar terms to me, what do they refer to? How do they differ? And how exactly do enzymes make clothes cleaner, anyway? I find this explanation annoying and dissatisfying, because it's a specious explanation, and doesn't actually explain anything. It raises more questions than it answers.

The former "explanation" is complete, because it's just a claim. It doesn't even attempt to explain.

Of course, you can always request a deeper explanation (just respond "why?"), but one can work within a level of abstraction, which can be more-or-less complete and self-consistent within its terms. A gross example is sociology vs psychology vs biology vs. chemistry vs physics vs <http://xkcd.com/435/> To introduce new terms without explanation or definition is incomplete.

</comment><comment><USER5> When watching TV ads it's easy to spot the products that people don't really _need_ to continuously buy month after month, but the company trying to sell it continually tries to ram it down our throats anyway.

Any ad for a toothbrush, razor, shampoo, sweeping device, detergent etc. will use the words "New", "Improved", "Re-Designed", "Bigger/Better/Faster" many times throughout the ad, often using the name of the product only once.

In order to sell a razor, they don't spend time telling people it's a razor, or what it can do, they spend time saying over and over how "New and Improved" it is, often leaving me guessing through the ad as to what they are actually selling.

tldr; Consumers don't care what a product is or what it does, they just want "NEW".

<comment><USER6> >tldr; Consumers don't care what a product is or what it does, they just want "NEW".

Really? When I see "new and improved" on a product I use I think "Great. I was perfectly happy with this product and now they've gone and changed it. All I want is a frickin razor that works."

</comment></comment><comment><USER7> It's got what plants crave. It's got electrolytes!

</comment><comment><USER8> I wonder if there's some information about the ratio of high vs. low CRT people. Are most people low/medium/high? Is there some kind of a bell-curve for distribution in the general population? between genders or ethnic groups? This can certainly help deciding what's the best marketing strategy for products or services.

</comment><comment><USER9> Almost all consumers -- heck, almost all human beings -- have one of those reality distortion fields. The trick to being an entrepreneur is to have much less of one than average.

</comment><comment><USER10> Now I want to take the Cognitive Reflection Test, but I'm afraid that just knowing what it is will unfairly alter the way that I go about taking it.

<comment><USER2> Very likely you've seen all three questions before. Here's one.

In a lake, there is a patch of lily pads. Every day, the patch doubles in size. If it takes 48 days for the patch to cover the entire lake, how long would it take for the patch to cover half of the lake?</comment></comment>


Lessons learned: working remotely as a cofounder - <AUTHOR> http://blog.netguru.co/post/59475675764/being-a-remote-founder

<comment><USER2> This is how we are at Pathwright. Two of the co-founders are up in Greenville, SC, and I'm down near Atlanta, GA. Still close enough for me to be in the office periodically, but too far to commute.

</comment><comment><USER3> Interesting to see that he mentions Hipchat, Google Hangouts and Skype. Isn't that 3 tools for doing the same thing? Even though Hipchat is just text communication.

Hard for team members to know what tool to send a message with.

<comment><USER4> In my team I use the same tools: Hipchat for text communication - among teams (chat rooms) and 1-1; Skype for 1-1 video calls but I use Hangouts for video conferences. 3 tools but each has own application.

But I'm curious how Netguru use it.

<comment><AUTHOR> We use it in similar way. We also use skype for ad hoc, private group chats/im.

More about how we use hipchat here: [http://blog.netguru.co/post/45142686929](http://blog.netguru.co/post/45142686929)

</comment></comment></comment><comment><USER5> Stephen Wolfram is doing it too ;D [http://blog.stephenwolfram.com/2012/03/the-personal- analytic...](http://blog.stephenwolfram.com/2012/03/the-personal-analytics-of- my-life/)

</comment><comment><USER6> good read!

<comment><AUTHOR> thank you sir

</comment></comment><comment><USER7> I don't agree with the article's first comment, about it sounding arrogant. Sounds like the guy has good advice, that's all.

// icp - quit the last job because I wanted to work remotely and wasn't allowed to.</comment>


Proposed changes to haproxy chef cookbook - <AUTHOR> https://github.com/cookbooks/haproxy/pull/2

<comment><AUTHOR> The maintainer of the cookbook doesn't use haproxy, and would like a second opinion. If you use haproxy and think my commits are an improvement, can you please leave a comment saying so?</comment>


If Aliens Were Tuning Into Our Television Frequencies… - <AUTHOR> http://flowingdata.com/2009/07/17/if-aliens-were-tuning-into-our-television-frequencies/

<comment><USER2> Aliens are almost certainly not tuning into our broadcasts, they dissipate rather quickly over universal distances, to the point where they are not distinguishable form background noise.

<comment><USER3> Well, for all we know, given we have hardly left our little dirtball much, they could be sitting right around the proverbial corner and shaking their collective green heads over that infantile bio-experiment going on down here.

Or, in Star Trek terms: They could have a cloaked probe in our solar system. Or they could possess technology that deals with time and space in ways we can't imagine. Broadcast dissipation might just not be an issue for them.

I don't know, you don't know. I think that's the only thing we can say "almost certainly" here. :-)

</comment></comment><comment><USER4> Amazing Stories: Book Five "Fine Tuning". <http://www.imdb.com/video/screenplay/vi1068892441/>

Much less epic than Contact.

</comment><comment><USER5> Luckily they are also receiving things like the discovery channel, and presumably don't have a method of detecting which signals are tuned into more frequently by earthlings.</comment>


F# Software Foundation - <AUTHOR> http://fsharp.org/

<comment><USER2> F# is a great language, and Petricek's enthusiasm for it is really inspiring. However, my major problem with the foundation in its current form is that they appear to be at least informally very closely tied to Microsoft. And I don't mean the cool people from MSR who developed the language in the first place.

For example, the official MS party-line has been to withhold releasing standalone compilers unless they are bundled with some "free" visual studio crap. Compiling the compiler from source every time I want to check something on another machine is simply not an option and it's one of the primary reasons I haven't moved to the new 3.0 version.

That's precisely the kind of problem a truly independent foundation could easily solve, but so far they haven't demonstrated any willingness to move in a way that could be considered competing with Microsoft's own products.

<comment><USER3> I'm glad you like F#. I agree it is a great language and I think it fills a big gap on mono and the CLR. The foundation (www.fsharp.org) is still _very_ young! We are looking into how to improve cross platform tooling and support. For example, soon (if not already) MonoDevelop 3 will come with F# pre-built on Mac. There is still a lot of work to do but we do recognise this as a key issue. I encourage you to join the foundation and help out by suggesting how we might go about improving.

Zach (a programmer - never employed by Microsoft)

</comment></comment><comment><USER4> F# transfers a few interesting ideas from OCaml and has some language- constructs I really like.

But when it comes to using F# in the past, I always ended up spending too much time assisting the language in inferring my types.

It became a chore to write properly generic code and reusable functions in F#. Maybe I didn't follow some convention or did things in an un-idiomatic fashion. I don't know. But it always ended up more work than I assumed it would be.

These days, if I need my functional kick, I'll go to clojure. And clojure seems to have a much more healthy ecosystem and third party support.

As much as I like F#, especially as a .NET developer, I'm sorry, but I just don't find myself using it very much.

<comment><USER5> How did you learn your F#?! Have never had any problem writing reusable functions.

On windows 8,000 nuget packages works for me as an ecosystem. on linux/osx/droid we have xamarin booming along.

</comment></comment><comment><USER6> Nice page, an example of the language in action of the front page would be nice though. After some browsing I have, although I have looked at F# in the past, resorted to Wikipedia for a quick glance to remind me of the looks of the language.

<comment><USER7> I strongly agree with this. F# is a very readable language, and can do quite a lot with very small amounts of code. I think more people would be interested in it if they could see how beautiful F# code can be.

</comment></comment><comment><USER8> REPL doesn't seem to work. Am I missing something? I don't see a "run" button, and Ctrl-Enter doesn't work. Chrome on OS X 10.8.

I agree with the other comments, would be nice to have a sample "hello world" on the front page to set the tone for the website. I always feel like websites like these should have a strong bias towards noobs, because advances users don't need help finding there way around.

It's also missing a prominent download button and "Getting started" link.</comment>


Mobile Summer Series Kickoff Event in SF - <AUTHOR> http://www.stackmob.com/2011/06/summer-series-kickoff-event/

<comment><USER2> I'm excited for this event.</comment>


Einstein has only 15 followers on Google Scholar. - <AUTHOR> http://scholar.google.com.tr/citations?user=qc6CJjYAAAAJ&hl=en <comment><USER2> I wonder how far they hope to go, given his ashes were spread to an undisclosed place, assumedly on Earth. What would the speed of diffusion of matter from Earth to the universe be? There's some outgazing, some artefacts, getting out of Earth, but so far I'd not expect much of Einstein having gone too far.</comment>


Revised estimates of ocean surface drag in strong winds - <AUTHOR> https://arxiv.org/abs/2002.10590 <comment><AUTHOR> Lead author here. We found further evidence of drag saturation in hurricane winds, which was independently discovered in the field and laboratory in 2003. Drag saturation means that the air-sea drag coefficient ceases to increase with wind speed beyond some value. This happens in strong winds, between tropical storm and Cat. 1 hurricane force. It's one of essential key unknowns for accurate hurricane prediction.

Data from the leading laboratory study that discovered drag saturation (Donelan et al., 2004) was used soon after to implement the surface drag parameterization for tropical cyclones in the most widely used numerical weather prediction model (WRF). The original study is highly cited and referred to by influential review papers. The WRF parameterization in question has been used by many tropical cyclone prediction studies.

During our analysis, we discovered an error in the original Matlab source code used by Donelan et al. (2004). The error appears in the scaling of in situ wind to the reference height of 10 m. With the original stress data, which we have, the correction is straightforward. The corrected data are now in agreement with the field data in low-to-moderate winds, which is encouraging.

The bottom line is, the original data underestimated the level of drag saturation by 34%, and overestimated the wind speed threshold at which the saturation occurs by 12%. If you use any isftcflx setting other than 0, the air-sea drag in your WRF model is significantly underestimated.</comment>


Show HN: Never forget what you've loaned or borrowed with IOUmate.com - <AUTHOR>

I.O.U. Mate is a new service for tracking I.O.U.s of any kind, from dollars to drinks to books you've loaned. It can be used to schedule recurring debts like allowances or shared rent. You can invite friends to share I.O.U.s with Facebook, Twitter or email, or you can choose to track debts privately.
As the designer and developer of this service, I'd love to get some feedback (and of course, early users). My company (Cerebris - I'm a co-founder) developed this application in order to try out a lot of tech, from Rails 3 to jQuery Mobile to Omniauth to hosting at Rackspace. Once we realized how useful it had become to us personally, we decided to add some extra polish and features.
We're keeping this service completely free, although we may add premium features in the future. We also plan to introduce native apps for a small fee (perhaps $1.99).
I really hope you find I.O.U. Mate fun and useful. Please let me know what you think - I'd appreciate feedback of any kind. Thanks in advance for checking it out!
http://IOUmate.com <comment><AUTHOR> Clickable: <http://IOUmate.com/></comment>


World's most economically powerful cities  - <AUTHOR> http://www.forbes.com/2008/07/15/economic-growth-gdp-biz-cx_jz_0715powercities_slide_2.html?partner=rediff

<comment><USER2> This makes me want to learn Japanese /that/ much more.</comment>


Show HN: Flockmetrics.com – Signup analytics for startups to help get more users - <AUTHOR> https://flockmetrics.com/ <comment><AUTHOR> I've been working on this for a little while. Flockmetrics provides signup analytics, the idea being that if you can measure how people are signing up you can begin to understand why and focus your time and energy on areas that will result in more users.

Feedback welcome!</comment>


Twitter kicks off Bluesky: independent decentralized protocol for social media - <AUTHOR> https://twitter.com/paraga/status/1204766188074459136 <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=21762510](https://news.ycombinator.com/item?id=21762510).

</comment><comment><USER3> Duplicate: [https://news.ycombinator.com/item?id=21762780](https://news.ycombinator.com/item?id=21762780)

</comment><comment><USER4> Could the mods change the title? Bluesky is not a protocol itself, but an independent effort to develop a decentralized standard (which may or may not be an existing standard like ActivityPub or Matrix).</comment>


Director-General ASD Speech to the National Security College - <AUTHOR> https://www.asd.gov.au/publication/speech-transparently-secret-asd <comment><USER2> For many countries the good news is that Australia is on the other side of the planet.</comment>


My experience of using NixOps as an Ansible user - <AUTHOR> https://blog.wearewizards.io/my-experience-of-using-nixops-as-an-ansible-user <comment><USER2> Rolling back with Ansible (Puppet/Chef/Salt) is best done by provisioning a new server. Yum/Apt do not support "rolling back" packages in any reasonably sane manner.

I would love to get to the point where I could do immutable deploys in real life. We're getting closer by using Docker, but we're encountering a number of hard problems, one of which is simply finding ways to keep all of the images up-to-date with all of the recent packages.

That said, convincing a company to use Nix (which is still relatively immature, in the grand scheme of things) is going to be an uphill battle. When you can stand up a fresh VM using Ansible in a few minutes, the value of being able to roll a server back easily is hard to justify.

It's also hard to justify when you have to wait for a third party to decide to update their core packages. It took nix two days to build new packages for heartbleed, Ubuntu and CentOS were updated that day. How much longer could you be waiting on a fix which wasn't so broadly publicized?

<comment><USER3> With Nix it seems like the technology is there. It works. It has a superior model compared with other systems. However, it lacks a corporate sponsor or large community to make it "professional-grade". Canonical and RedHat make their money from people depending on their packages being continuously up to date. Debian has an enormous community ensuring that stable is stable and secure for the duration of its life. Nix doesn't have either, so it is up to the users it does have to be reactive.

That said, I think the benefits of Nix are real. The existing configuration management systems do not have the ability to fully understand the system. Nix does, because everything about the system is contained in the configuration file. As a consequence, you can up and down grade servers without fear of breaking everything. You can check to see exactly what changes between different versions. There is much more control and more assurance that the nodes are in the proper state.

One part of your comment which I do not understand is:

> When you can stand up a fresh VM using Ansible in a few minutes, the value > of being able to roll a server back easily is hard to justify.

Isn't this also true for Nix? You just launch the image and push your desired configuration? If you mean time to write a new ansible playbook/role then in my experience, although I am fairly productive with ansible, I would not put it at "a few minutes" from nothing to a new service. Maybe you are talking about the learning curve? Nix definitely seems steeper so a clear win for ansible on that front.

<comment><USER4> Both Canonical and RedHat seem to be doing their own things in this space, Snappy and Atomic.

<comment><USER5> I haven't looked at Atomic yet, but the design of Nix is so much better than Snappy.

<comment><USER4> Yes its a pity they had to reinvent this.

</comment></comment></comment></comment></comment><comment><USER5> This was a good read. I'm currently designing the deployment tool for GNU Guix (a package manager and distro based on Nix) so I find stories like this very valuable. The author didn't seem crazy about the NixOps state file, which is something I'm trying to think hard about for Guix. They claim that the state file isn't easily shareable across machines. Couldn't they just version control it and clone the repo on every workstation that does deploys or are there complications?

<comment><USER6> It's an SQLite database, so you wouldn't be able to merge changes made in different clones.

<comment><USER5> Ah, I see. Thanks. My initial prototype will use a flat text file (a serialized s-exp) instead.

<comment><USER7> Another issue is full paths to the nix config file encoded in the state file itself. The state file should not point to the config files used IMO.

<comment><USER5> Totally agreed. The user should pass the config file to the program each time.

</comment></comment></comment></comment></comment><comment><USER8> One of the things I don't understand about the newer automation tools like ansible is lack of ability to go back in time.

I used Radmind and for all it's old school complexity and faults you could roll back production changes really easily. That was hugely powerful.

<comment><USER9> How do you "go back in time" after upgrading a package in a sensible manner?

<comment><USER6> This is what makes Nix special. The "functional package manager" paradigm means you don't overwrite the old version when installing the new version.

<comment><USER9> To clarify, the question is about Radmind, not Nix.</comment></comment></comment></comment>


EU blocking cities' efforts to curb Airbnb, say campaigners - <AUTHOR> https://www.theguardian.com/world/2018/may/21/eu-blocking-cities-efforts-to-curb-airbnb-say-campaigners <comment><USER2> I'm not an economist but I'm pretty sure that the price of housing is determined by supply and demand.

Wouldn't housing be more affordable if more houses would be allowed to be built?

Cities seem to enjoy banning people from using their own property as they deem fit. Instead less bureaucracy with faster and cheaper costs for building housing would curb this phenomenon at the roots.

This doesn't solve issues where there isn't enough land (like an island) but in most cases it should work.

<comment><USER3> Land prices determine the larger share of a house price. That depends on what other purposes than housing, the land can be put to. Also infrastructure cost, taxes and transportation.

And nobody is going to build a new house if they can't make good money on it. So its all tied up in interest rates, expected rate of return for capital etc.

Supply can matter say in a depressed area where folks are in a hurry to get out from under a mortgage. But nobody is making money there. Its not a typical house price at all.</comment></comment>


Dave McClure: Angel, VC or Pirate? - <AUTHOR> http://www.readwriteweb.com/archives/dave_mcclure_angel_vc_pirate_interview.php <comment><USER2> I hope Twilio decides to support inbound/outbound faxes. I only need to send and receive faxes a couple times a year, and I would love a pay per use fax service. Every inbound fax-to-email service I've seen uses a subscription model and wants to charge me $10 a month plus setup fees.

The only suitable option I've seen so far was faxaway.com, but I can't tell if they're still in operation. I tried signing up online and was hit with the weirdest catch-22 I've ever seen: they wanted me to print out the application and fax it in.

<comment><USER3> Check out these:

<http://www.faxitnice.com>

<http://www.faxzero.com>

</comment></comment><comment><USER4> "A 30% return (the minimum needed to give LPs a return commensurate with venture risk after the GPs have taken a 20% performance cut) on $1 million is $300,000. A 30% return on $1 billion is $300 million. Basically, unless you land a Google-like winner, it is very, very hard to get a $300 million return."

The writer has no idea how a fund works or how to calculate returns. That statement assumes the lifespan of the fund is one year, which it isn't. The lifespan of a fund is usually 5-9 years. When you hear about Sequoia returning 140% on their 2001 fund, that is _per annum_ over the life of the fund.

So going by the $1B example. If you have $1B to invest, and have set a target of a 30% return, you need to return $300M _each year_ to your investors. That is almost impossible in years one and two (and even three) so its usually a curved path of returns (that dies down towards the end as the last investments are either killed off or sold for scrap).

As for fee's:

"Ahem, 2% of $1 billion is $20 million, which should be enough for a coupla Partner Ferraris. "

The 2% fee is also _per annum_. Most funds are not $1B, but they are $150M - $500M, so the fees can really build up. The better funds wont charge fees in years where there were no returns or heavy losses, or in the later years of a fund.

As for the actual interview - not much substance there either.

</comment><comment><USER5> Answer to the last question: yes. I'm totally planning to take advantage of this service.</comment>


You Are Not "Your Brain" - <AUTHOR> http://neuroskeptic.blogspot.com/2012/04/you-are-not-your-brain.html

<comment><USER2> The blurb that sparked the article:

      > We are not our brains. We are "conscious agents"... It's
      > very good news that you are not your brain, because when
      > your mind finds its true power, the result is healing,
      > inspiration, insight, self-awareness, discovery,
      > curiosity, and quantum leaps in personal growth. The
      > brain is totally incapable of such things. After all, if
      > it is a hard-wired machine, there is no room for sudden
      > leaps and renewed inspiration...

Not to slight the blog response under discussion, but the quoted paragraph betrays such deep ignorance of basic neurobiology that any reaction seems like a waste of time. It's quite literally a (neuro-)philosophical equivalent of "Lots of spinach, ergo sum".

<comment><USER3> I find it highly fascinating that the Wikipedia article on "consciousness" says it's basically, well, crap. See for yourself:

"Consciousness - The having of perceptions, thoughts, and feelings; awareness. The term is impossible to define except in terms that are unintelligible without a grasp of what consciousness means. Many fall into the trap of equating consciousness with self-consciousness—to be conscious it is only necessary to be aware of the external world. Consciousness is a fascinating but elusive phenomenon: it is impossible to specify what it is, what it does, or why it has evolved. Nothing worth reading has been written on it."

"The most compelling argument for the existence of consciousness is that the vast majority of mankind have an overwhelming intuition that there truly is such a thing.[20] Skeptics argue that this intuition, in spite of its compelling quality, is false, either because the concept of consciousness is intrinsically incoherent, or because our intuitions about it are based in illusions. Gilbert Ryle, for example, argued that traditional understanding of consciousness depends on a Cartesian dualist outlook that improperly distinguishes between mind and body, or between mind and world. He proposed that we speak not of minds, bodies, and the world, but of individuals, or persons, acting in the world. Thus, by speaking of 'consciousness' we end up misleading ourselves by thinking that there is any sort of thing as consciousness separated from behavioral and linguistic understandings.[21] More generally, many philosophers and scientists have been unhappy about the difficulty of producing a definition that does not involve circularity or fuzziness.[17]"

<http://en.wikipedia.org/wiki/Consciousness>

So, I don't find the word very useful.

</comment></comment><comment><USER4> I think the biggest counterargument (if one were needed) is that if I start doing things to your brain, it affects your mind. If I cut a part of your brain out, your mind is impacted. This has been shown by injuries to the brain, lobotomies, etc. etc.

Beyond that, we could get into all sorts of philosophical arguments about the link between the mind and the brain, but it seems to me as a somewhat philosophically naive person that this fact is a clear and demonstrable link between the brain and the mind.

<comment><USER5> I think no one here assumes Chopra speaks with any authority as to the physiology of the brain. Yes, he's a doctor - of internal medicine with a specialism in endocrinology, but that hardly qualifies him to discuss the brain. That being said, I think the key to understanding the brain physically is to read this book: An Anatomy of Thought: The Origin and Machinery of the Mind by Ian Glynn

And to understand the inner workings of the brain and how it theoretically functions:

Society of Mind by Marvin Lee Minsky

I believe the idea that the mind is just a "set of agents" is best explained in "Society of Mind".

</comment></comment><comment><USER6> One thing I've never heard a neuroscientist answer (although I have asked at least a dozen) is how to distinguish between the expression of consciousness and the generation of consciousness (i.e. the difference between a light bulb and an electrical generator). It's interesting to consider this question when we include the fact that the brain can't really operate without good blood flow into the brain. When blood flow is blocked the function of the brain (as well as the expression of consciousness) are blocked.

<comment><USER2> I genuinely have no clue what your question means and entails (as a neuroscientist with a reasonable undergraduate career in anglo-american philosophy). Can you elaborate?

<comment><USER7> If I were going to say something that sounded like that, it would be this:

We think of a lightbulb as a device which generates light, but it isn't that _intrinsically_ ; the filament glows only when electrified, and the bulb is only a small part of the light-generating system which includes an electrical generator (and, presumably, a burning fuel source). The bulb is the place where the light first becomes visible, but it makes less sense to say that it is the place the light _comes from_.

Similarly, we think of the brain as a thinking machine, but it isn't that intrinsically; it is only a small part of a much larger thinking _system_ which includes functions of respiration, circulation, ingestion, et cetera. So we can say that the brain may be the place where thinking first becomes noticeable _per se_ , but it makes less sense to say that it is where thought is _created_.

Which is all well and good. I'm not sure what part of it is supposed to be a hard question about neurology rather than a PHIL100 essay topic, though.

<comment><USER8> The light bulb is definitely a less-than-apt metaphor. I think the crux of what he's asking about is the line between a system's production of subjectivity and a subject's experience of it (which constitutes the subject as such). The separation between the two seems to be absolute, i.e. if "brains cause minds," as Searle puts it, no amount of introspection on the part of the mind allows it access to the brain. Consciousness is a one-way trip.

How to distinguish between the two might be an interesting question from, say, a Chinese Room[1] or p-zombie[2] standpoint, which might have some philosophical bearing on AI. But that's about all I can think of off the top of my head.

1\. <http://en.wikipedia.org/wiki/Chinese_room>

2\. <http://www.skepdic.com/zombies.html>

</comment></comment></comment></comment><comment><USER9> I would go so far as to say that we may one day be able to take away the legs, arms, organs, torso, head, everything that will eventually break down. Then upload our brains into a virtual, (dare I say) MMO world and not even notice the difference.

Of course, we'd have to get around the problem of parting with "self" when transitioning to the virtual immortal life. And therein lies the philosophical problem of the conscious.

<comment><USER10> Wouldn't this be similar to the concept behind The Matrix? You're virtually plugged in; you feel like yourself, but the steak you're eating has been graphically programmed inside this "MMO" world to trigger the appropriate stimulation in your brain to make the entire experience "real."

One thing remains inconsistent though. I understand that we remove our legs, arms, organs, torso, head, etc. in pursuit of becoming immortal via a virtual life, but... isn't the brain itself also within the same classification as the aforementioned body parts? It's biodegradable.

Say we find a way to preserve the brain eternally, wouldn't it then become irrelevant to live through a virtual life? For if we can preserve the brain, the same method can be applied to preserve the rest of the body that we earlier considered ridding ourselves from.

The mind is a metaphysical repository. The brain is not the cause of the mind; it is only a channel that allows us to associate with--and add to--it. If we were to say that the brain is the cause of the mind, then--by necessity--upon physical death, the mind would have to vaporize, vanish, cease to exist. Now.. our identity IS our mind. We generally don't identify who we are through our bodies. Our memories, habits, traits, tendencies, affinities, aversions, and reactions all emanate from our mind. And if we subscribe to the latter notion --that our minds continue to exist even after we end our mortal lives--then that postulates that there must exist another world, an accentuated world, devoid of time and space, that allows an endless progression of fulfillment and enlightenment and an infinite array of things to do, only without an aging body to drag us around as we attempt to do them.

</comment></comment><comment><USER11> Related article from _Science_ magazine, vol 210, no. 4475 (Dec 12, 1980)

 _Is Your Brain Really Necessary?_ <http://www.rifters.com/real/articles/Science_No-Brain.pdf>

tl;dr: "the brain can work in conditions we would have thought impossible".</comment>