Modern anti-spam and E2E crypto - <AUTHOR> https://moderncrypto.org/mail-archive/messaging/2014/000780.html?hn <comment><USER2> It's amazing how little sender reputation can count for with Gmail in the face of other features, however. I have a good reputation as a sender but also send almost a million mails a month and I spend a lot of time investigating oddities in Gmail deliverability.

All of my mails are newsletters containing 10-30 links, and more than once I've found the mere inclusion of a single link to a certain domain can get something into spam versus a version without that link, often with no clear reason why (domains that are particularly new are one marker, though). Or.. how about using a Unicode 'tick' symbol in a mail? That can get a reputable sender into Spam versus a version without the same single character (all double tested against a clean, new Gmail account) :-) Or how about if you have a link title that includes both ALL CAPS words and ! anywhere? Your risk goes up a good bit, but just go with one of them, you're fine..

I now have a playbook based around numerous findings like this, some based on gut feelings looking at the results and some truly proven, and even with my solid reputation as a sender, I'm having to negotiate a lot content-wise each week. But do I like it? Yeah, in a way, because it's also what stops everyone else being a success at it.. Gmail sets the bar high! :-)

(Oh, a bonus one.. include a graphic over a certain size? Your chance of ending up in the Promotions folder just leapt up. Remove it, you're good. It doesn't seem to be swayed much by actual content. So I've stopped using images where at all possible now and open rates stay up because of it.)

<comment><USER3> I think the author has developed too much the kind of thinking he needed to fight spam at regular e-mail companies.

I think there could be multiple, relatively easy methods to avoid encrypted spam.

Someone here already suggested the first email being a "poke". And only if you send a poke back, would that user be allowed to send you an e-mail.

The user could also have some description about him, from his profile, appear when you hover over his profile image or whatever. If you receive an e-mail say from a company you're expecting to receive email from, then you could poke back, so they can send you that email. I mean there should be ways to make it easy for people to know who's a total stranger that could be a spammer, or someone trying to reach out to them for good reasons.

Then you could also have the emails under different labels by default. All the _trusted_ e-mails would come to the regular Inbox, while the rest will go under a different label.

As you said, the email provider could also see the user's reputation over time, and if he's a spammer or not.

And these are just some easy solutions we can come up with almost immediately. I'm sure there can be others with a little bit more thought put into it. I certainly don't see encrypted email as some kind of "doomsday scenario" like the author predicts in the post.

<comment><USER4> Actually the "poke" method would work and I suggested it on a different thread on that mailing list. It's the S/MIME model although these days you'd just stick an ECC key into a header and sign it with DKIM, then upgrade the clients. Doesn't have to be technically complicated.

There are at least three major downsides:

1) You still leak lots of metadata and the full data of the poke including most obviously the subject line.

2) Do users understand that their spangly new "encrypted mail" actually fails to protect a lot of important data? What if they (gasp) came to rely on it? I'd want to see usability studies showing a clear understanding of what is protected and what isn't.

3) You break other features that rely on the server being able to see content, like search, and the ads that pay for all of this.

</comment></comment></comment><comment><USER5> > A possibly better approach is to use money to create deposits. There is a > protocol that allows bitcoins to be sacrificed to miners fees, letting you > prove that you threw money away by signing challenges with the keys that did > so.

This wouldn't work, because a miner can easily pay himself any amount of bitcoins that he has saved up in fees, and include this transaction in his own block (not broadcasting it). Thus he can basically create these "deposits" for free, and sell them for a profit.

That's the thing: whatever you try as a counter-measure, you _always_ come back to money: in the above scenario, money would replace "deposits" because "deposits" would just be sold on the open market for money. Proof-of-work becomes money: if something important requires proof-of-work, you can be sure that a web app would surface that performs proof-of-work in exchange for money.

It always comes back to money, because whatever restriction you put on something, whether it be "pay fee to Bitcoin miners", "Solve proof-of-work puzzle", or something else entirely, these things will always end up being sold for money in an efficient market, because of the increased efficiency of division of labor: why should I use my inefficient smartphone to calculate proof-of-work, when I can pay a service with custom ASICs to do the job for me at a fraction of the cost?

As far as I can see, the only alternative that can work besides money is something that cannot be sold for money. And I can't come up with anything that fits this requirement.

<comment><USER6> But your smartphone is something you already have. If it takes ten seconds then you already paid for those ten seconds when you brought it.

Of course spammers can buy their services but when the price for normal sending is effectively free for normal users you can jack up the price for spammers to make it too expensive for them.

A nice benefit is that it forces sites to use something other than email, such as RSS, since they can't afford to send newsletters anymore.

<comment><USER7> Maybe, but the performance difference between a power-strapped smartphone CPU and an ASIC tailored for the specific task is so massive I doubt you could make it expensive enough for the latter while maintaining a reasonable experience for the former.

<comment><USER8> I see two solutions to it. First: have the phone include a chip specifically for doing this type of work. Second: make the calculation such that it cannot be performed faster on cheap hardware specialized for the task. I believe that is the peppery of scrypt, and the reason why we do not see LiteCoin ASIC's yet.

</comment></comment></comment></comment><comment><USER9> One important concept that seems to be missing from the discussion is Sender Stores.

Email currently uses a Receiver Stores model. SMTP servers can relay messages, but in almost all cases the message is transmitted directly from the originator's network to the recipient's network. The storage of the message only effectively changes _ownership_ once, even if the message headers say it was forwarded many times.

That makes email a Receiver Stores model: the recipient's network is expected to accept the message at any time and then hold it until the recipient comes to look at it.

Some of the bitcoin messaging protocols propose a Sender Stores model. That is, the message may be transmitted any number of times but the recipient's network is not responsible for long-term storage. The sender's network must be able to provide the message at any time up to the point when the recipient actually looks at the message.

There are some obvious restrictions such as requiring that the message be encrypted with a Diffie-Helman key (negotiated when the message is first transmitted to the receiver's network) to reduce the feasibility of de- duplicating millions of messages. And in order to prevent revealing exactly when the recipient reads the message, the recipient's network doesn't ack the message for a while.

Ultimately all of this is just designed to make bulk email (slightly) more expensive. Spammers run on very, very thin margins. But it doesn't do anything to solve the problem of account termination or blacklisting.

<comment><USER10> The problem with the sender stores model is that the sender does not need to store anything: they just generate the spam message at retrieval time. So it does not actually increase their costs. Spam moves to the notification mechanism that tells receivers that a message is available: this is just as unsolicited as in current junk mail, and needs to contain enough information for the receiver to know if it is worth retrieving the message. All the current spam and anti-spam techniques will apply fairly exactly to these notification messages.

<comment><USER11> A fair point, but it _does_ require that the sending host _persist_ in its network location (or have continuously updated DNS which reports its present location).

Since early recipients of the spam will likely report it, it's fairly likely that subsequent retrieval attempts will find a downed (or sanitized) host, no longer delivering spam.

This will reduce the amount of spam actually delivered, and the spammer's production / revenue margins.

</comment></comment></comment><comment><USER12> Worth reading for confirmation regarding the importance of reputation in deliverability, which is something that is not widely understood by non- experts but which has really toothy consequences for many HNers' businesses.

</comment><comment><USER13> This is an incredible write-up. Can someone who knows the author plead with him to write up the long history of the Spam Wars that he mentions in this document? I could read this stuff all day.

<comment><USER14> Read Spam Kings. It covers a lot of the history.

</comment></comment><comment><USER15> I'm not too knowledgeable about this stuff, but would it work if end-to-end encryption was only initiated after the first time somebody replies to an address? e.g. If somebody contacts you for the first time, they lack your public key (and/or a shared secret for authentication) and must send you plaintext. Then, if you reply, you automatically provide them with your public key and/or authentication info to send you encrypted messages in the future. Thus, most spam would be in plain-text, anyone who knows how the system works would avoid discussing sensitive info in the first email they send somebody, and everybody else wouldn't know the difference.

<comment><USER16> MITMing the message with the public key attached would be pretty straightforward and impossible to catch without verification over some other secure channel

<comment><USER17> This would be solved by public key encrypting and signing both sides of those messages. Nothing stops people from sharing your public key, so you could develop some kind of one off token for everyone instead, that way you can kill those tokens after a time.

<comment><USER16> The question is how do you know that it's actually _their_ public key.

The usual approaches are:

1) verification of they key fingerprint by some other channel, such as the PSTN, but this is obnoxious and feels like tradecraft; you are unlikely to get normal people to do this for normal communications.

2) certification of trust based on 3rd-party verification of government identity documents or control of some address.

3) the web of trust. Might work well for a bunch of security-conscious HN types, but unlikely to be a good solution for people such as our mothers who have neither the cryptographic background to make intelligent decisions about signing keys, nor the inclination to care.

</comment></comment></comment></comment><comment><USER18> Well this is pretty neat.

I've been working on custom software to improve the spam filtering on my mail server for the last year (side project). It currently works by letting hosted users forward spam messages to a flytrap account, and then the daemon runs, reads the forwarded message, tracks down the original in the user's mail directory, does a whois on the origin in the mail headers, consults its logs, and then adds a temporary network-wide blackhole to iptables.

Originally it was intended to work alongside SpamAssassin and SQLGrey and all that, but last night I started considering replacing SpamAssassin altogether. I love SA, but the spammers are beating it regularly now. My TODO notes in the code actually say, "reputation tracking for embedded URLs, domains, ccTLDs and gTLDs, sender addresses, and content keywords." I wrote the first bits of code for reputation tracking this morning.

It's not much of a step for the software really, because it already uses embedded URLs in a message as part of the profile "fingerprint" for finding the original message from a forwarded version.

But I'm a bit chuffed to hear that I'm on the right track, considering how effective Gmail's tactics have been. :-)

Small service providers have it really tough right now. Users don't tolerate any spam at all. A few years ago, the state of the art for small independent services was SpamAssassin + SQLGrey (or other greylisting) plus a few other tricks; that's not sufficient anymore, and most of us smallfry lack the resources to come up with something much better.

After just 6 weeks in production, the software already has 20+million IPs blocked at any given time.

<comment><USER14> I think SA has suffered from some of the original core developers (myself included) moving on to other projects in a completely different tech area. The good news is that other projects have taken up some of the mantle, like Haraka, check out the karma plugin. It does some amazing blocking of spam and penalizing clients.

Beyond that also one of the things SA doesn't do well is actually rejecting hard on sensible blacklists like the CBL. We worked hard to make everything heuristic based but it wasn't always the right choice. Some things need to be black and white. There's some code on SA for short circuiting now but it's not really the best solution. In my own spam filtering I have a bunch of hard rejects and they work really well.

Anyway, check out Haraka or Qpsmtpd for solid anti spam mail serving solutions. They work really well.

<comment><USER12> Hey wait, I _did_ vaguely recognize your username from somewhere. Thanks for SpamAssassin! I spent more hours spelunking through your guys' source code and community rulesets than you'd want to know, about a decade ago, while working for the anti-spam group in our R&D department at a tech incubator.

</comment></comment></comment><comment><USER19> One thing nice about E2E crypto in messaging is that it implies strong identities, which most importantly allow building whitelists with high level of confidence. And of course if we can make those identities costly to acquire/burn, either by proof-of-work or even just with a CA model, that alone should cut spam significantly.

</comment><comment><USER20> Couldn't some form of proof-of-work system be used to increase the cost of sending a message without it having much of an economic impact on a casual sender? Was that what he was alluding to with the "burning bitcoin" reference?

<comment><USER21> Funnily enough, proof-of-work was originally invented to combat spam and denial of service attacks[1][2]. I asked that in a reply, and it seems that the large gap between server compute power and mobile compute power would make a reasonably taxing proof-of-work system too costly for mobile phones[3].

[1] - [https://en.wikipedia.org/wiki/Hashcash](https://en.wikipedia.org/wiki/Hashcash)

[2] - [http://hashcash.org/papers/pvp.pdf](http://hashcash.org/papers/pvp.pdf)

[3] - [https://moderncrypto.org/mail- archive/messaging/2014/000782....](https://moderncrypto.org/mail- archive/messaging/2014/000782.html)

<comment><USER22> Just to be clear, "Pricing via Processing or Combatting Junk Mail" (Crypto 1992), by Dwork and Naor, invented the idea of Proof Of Work, suggested it for fighting Spam (before the term was even coined!), provided actual functions, and more. This predates HashCash by half a decade. [Edited to de-obfuscate.]

<comment><USER21> Ummm, that's the paper referenced in [2]…

</comment></comment></comment></comment><comment><USER23> I wonder if this would be an interesting application for Homomorphic Encryption. True FHE is still wildly inefficient, but there are some interesting applications like CryptDB where sort-of-Homomorphic-Encryption is feasible for certain restricted operations (keyword search being one).

In a system like that, maybe you could send your encrypted message along with some encrypted keywords that you consider to be spammy to some centralised service. That would, at least, avoid some of the client-side-filtering-is-too- hard problem.

As far as reputation, this might be one of the rare times where a Web of Trust seems like a good idea. Generating lots of false positives and negatives would be a lot less powerful if the value of those reports was filtered by how much you trust the account that made them. With email you already have an implicit source of trust, in that anyone you mutually email with is unlikely to be a spammer.

Seems like a really interesting problem space to be involved in.

</comment><comment><USER24> Btw, this is written by Mike Hearn, who'd I'd like to nominate to hacker of the year. Super cool guy, mad respect to him :)

</comment><comment><USER25> I don't understand the objection against email costing money. I send you a mail? I pay $0.0001 to you. You reply? You pay $0.0001 back.

There is idea that this somehow blocks access to email for people who have a hard time paying for things on the internet (for whatever reason), but it is misguided: everybody who has access to the _internet_ pays for it. ISPs could easily give every subscribed 10000 free emails every month.

Texting costs money and yet people do it.

What am I missing?

<comment> mike-cardwell "What am I missing?"

The specs and the software for a start.

Then there's the fact that it's not the spammers that will end up paying, but the people running the systems that are compromised and abused to send spam, be they shared hosting servers or home computers.

Then there's the network effect. I'm not going to feel good telling my friends and family that it will now cost them money to email me. Especially when they can just contact me using Facebook instead for free and without having to set anything new up. Especially when the email service they're already using probably wont even support this new fangled paid-email system.

It would be a massive task to add this functionality to email, and it wouldn't stop the spam, so it's not worth it.

</comment></comment><comment><USER26> So why not use one key per source, kind of something like this:

Alice wants to receive mail from Bob. Alice generates a public/private key pair and gives the public half to Bob. When Bob wants to send mail to Alice, Bob uses the public key Alice gave him. If Alice receives spam, she marks the public key it was encrypted with as "fuck it, the spammers got it" and never receives mail with that key again. Then she notifies Bob that the key he had has been compromised and sends him a new one. Alice could then, after Bob has lost her key to spammers one too many times, simply decide not to talk to someone like him.

This would give mailing list operators a large incentive never to share your email with anyone, otherwise you could just block them forever.

On the flip side, if the mailing list is really important to you, the operator could reject your new key and tell you you'll either receive their spam or you won't be part of the mailing list. Though I don't see why someone would do that in favour of just including ads in the mails themselves.

<comment><USER27> Lets suppose Bob was a spammer pretending to be a mailing list operator.

Alice gives her key to Bob, in the expectation that Bob would not be sending her spam. Bob then sends both spam, as well as legit mail that alice did want. Assuming that alice does not want to stop receiving the legit mail, but want to stop the spam, how does she do it in this scenario?

If alice blacklist the key for bob, but sends a new one, the situation didn't improve. If she doesn't send a new one, she stops receiving legit mail (that she wants, and cannot go without).

</comment></comment><comment><USER28> I think reputations are part of it but there are other aspects to.

I switched to gmail because my mail with every other provider and client was choked with phishing messages from major banks. So much work has been done on preventing origin spoofing in 2014 that accepting phony mail from chase.com is a sign of gross incompetence.

</comment><comment><USER29> The discussion here is already quite long so maybe I missed it, but I don't see anyone asking (or answering) the first question that came to me while reading the linked email:

Why is the cost of end-to-end crypto never taken into account?

I just can't believe that we have reached a point where it is possible to cheaply mass mail the way spammers do if you need to encrypt each email for each recipient. That alone should be disuasive enough, at least that's always what I thought. If I'm right, all the discussion about the need for client to extract features from emails and send them to a necessarily trusted centralized third party is useless. But I may be missing something, where am I wrong?

<comment><USER30> Even at a reduced rate, end to end crypto means spammers will have a much higher success rate since they don't have to fight a centralized spam system with global knowledge. This more than makes up for the extra time to encrypt a message.

<comment><USER29> Mh, okay.

But let's make the crazy assumptions that we are effectively in a world where end-to-end crypto is massively used, virtually by everyone.

I guess it would be stupid to assume that the message are encrypted but not signed.

This means that it would be easy to have a list of identities (i.e., keys) which are sending spams, for instance using a web of trust, without users having to disclose any other informations that "I trust these identities, not these ones" (which could be as easy to do as clicking "spam" or "not spam" for the users).

Now that means that the spammers not only have to encrypt every single email for every single recipient but also to generate new key-pairs for almost each encryption.

Of course it is also very easy to mark as spam any email signed with a key that is considered too small (i.e., too quick to generate).

Now if you tell be that still won't do it without a "centralized spam system with global knowledge", I have to seriously rethink a lot of my assumptions about the cost of some computations.

<comment><USER31> Some numbers:

\- Public key encryption: 2048bit RSA can achieve up to about 200k encryptions per second on a high end cpu [1]. ElGamal-like encryption schemes using elliptic curve cryptography can get to about 100k encryptions [2].

\- Public key signatures: RSA is hopelessly slow for good keys. There is no reason to use strong keys for this case, though. If you reuse primes you can use a 1000 primes to generate a million RSA modules (you need two primes per public key), effectively eliminating the costly prime search. Using elliptic key cryptography the key generation step is dirt cheap: With ed25519 you get 200k key generations per second [3]

[1] [http://bench.cr.yp.to/results- encrypt.html](http://bench.cr.yp.to/results-encrypt.html) [2] [http://bench.cr.yp.to/results-dh.html](http://bench.cr.yp.to/results-dh.html) [3] [http://bench.cr.yp.to/results-sign.html](http://bench.cr.yp.to/results- sign.html)

Formula used for each of the above numbers: 3500x10^6/[median for Intel Xeon E3]x4

<comment><USER29> Thanks for the number, it's very informative.

I guess there's still the solution to only accept message from trusted keys but that means that 1- we have to be able to detect signature-rings from spammers in the graph (that clearly should not be a big problem), and 2- that there is an easy and realistic way to have a legitimate key in the trusted network before it can be used to sends emails…

Anyway, all that is very interesting from a theoretical point of view, but we are far from being in a world where end-to-end crypto is massively used.

<comment><USER32> > trusted keys

The problem with Web-of-Trust is that once you try to roll it out mainstream, most people will just click "accept" or "I trust this key" without thinking about it. Instead of "signature-rings from spammers" you would have spammers duping less-aware real people into trusting their keys.

That said, it would seem to be a longer feedback loop to get a number of _actual_ people to open emails and trust their keys.

<comment><USER29> > most people will just click "accept" or "I trust this key" without thinking > about it

What if they don't have to do that because it's transparently done for them when they use the "flag as spam", "not spam", and "reply" buttons for instance?

</comment></comment></comment></comment></comment></comment></comment><comment><USER33> I submitted this without the ?hn at approximately the same time. Pretty weird that this one gained traction while my submission did not.

[https://news.ycombinator.com/item?id=8275787](https://news.ycombinator.com/item?id=8275787)

</comment><comment><USER34> Mike Hearn is also a core Bitcoin developer, as well as an HN commenter. Hi Mike!

</comment><comment><USER35> could there be a antispam gateway that replies to 'maybe'(as in spam, ham and maybe) mails with a temporary url that hosts a webform, before they reach the inbox? the webform could even limit message length, prevent attachments, be protected by akismet and so on. let the message from the form be actually relayed to the real mail server. and once the recipient replies, automatically whitelist that sender or possibly even the domain?

</comment><comment><USER36> >we had put sufficient pressure on spammers that they were unable to make money using their older techniques

Could anyone comment how spammers make money actually?

<comment><USER37> One way is referral links. If you click on a link in my email and buy something on, say, Amazon, I could potentially make up to 10% of the purchase price (Amazon is actually normally around 5% I think).

</comment></comment><comment><USER38> Some of my contacts have been using verification gateways/whitelists for email for decades. If spam were to become a problem, I would use one.

</comment><comment> loup-vaillant > _Botnets appeared as a way to get around RBLs, and in response spam fighters > mapped out the internet to create a "policy block list" \- ranges of IPs > that were assigned to residential connections and thus should not be sending > any email at all._

So basically, I can't send email from home? This is… unfortunate. If we want freedom, we need decentralization, and this kills it.

<comment><USER39> Hey I've no idea of anything, and don't have a dog in this fight either, but reading everything here I think decentralization is actually the answer. Yes, you'd not get that global reach, and your network of contacts would be severely limited (presumably to those you know). But a decentralised system could do E2E and P2P and run from home. Running that beside traditional, clear-text and consequently spam-proof email strikes me as a sensible balance.

One (open, centralized) system for global comms. Another (closed, decentralized) for secure comms. Maybe even more than one "another", if contexts require different audiences.

<comment> loup-vaillant I'd rather not have most of my communications (even mundane ones) read by a third party that also reads everything else. Gmail is bad enough, but this is a _really_ Big Brother.

</comment></comment></comment><comment><USER40> I wish Google provided an API to lookup a sender's reputation so that even a locally deployed spam filter could use the information.

<comment><USER41> It wouldn't be in Google's best interest to do so. First, it could be used by spammers to lookup their own reputation for a given IP or domain before deciding whether to move on. Second, it would enable competitors to use some of Google's hard work in their products.

<comment><USER42> a central authority for email reputation is one of the ideas put out by Mike during his presentation at RIPE, not that his ideas are Googles'.

[https://ripe64.ripe.net/archives/video/25/](https://ripe64.ripe.net/archives/video/25/)

</comment></comment></comment><comment><USER43> > When we started gmails were about $25 per 1000 so we were able to quadruple > the price. Going higher than that is hard because all big websites use phone > verification to handle false positives and at these price levels it becomes > profitable to just buy lots of SIM cards and burn phone numbers.

How does that work? Don't SIM cards cost more than 10 cents?

<comment><USER44> Not all the accounts need verification by phone.

</comment></comment><comment><USER45> The Gmail spam filter is indeed impressive, but on several occasions I have found 'real' emails being triggering it. Those times were just me browsing the spam folder randomly and I hate to think what else it has swallowed.

<comment><USER46> Even worse, I've seen Google originating emails being flagged in GMail as spam/fishing

(in mailing lists, and yes, I checked, it seemed to be a legitimate email, so I let the sender know, but never heard back)

<comment><USER47> I have had gmail flag a message I sent to myself as spam.

</comment></comment></comment><comment><USER48> Really interesting article until it gets into the Bitcoin talk. I feel like his passion towards Bitcoins seeped a little too much into the article towards the end.

</comment><comment><USER49> No mention of Bitmessage, which provides E2E crypto and anti-spam.

<comment><USER50> Bitmessage is hardly immune from spam. I've seen it there.

And cranking up the proof of work isn't going to do anything to prevent it. The only thing that prevents Bitmessage from becoming a cesspool is its obscurity.

<comment><USER49> I would not call the random strings showing up in the general chan spam. I highly doubt it is profitable for whoever sent it. Industrial scale spam seems unlikely on Bitmessage.

<comment><USER50> I get it on some chans I run. I'm not talking about the annoying "test" message either, I'm telling you there is already actual spam.

And the only reason there isn't tons of it is because Bitmessage doesn't have the kind of user base that it's profitable to spam to.

It is much eaiser to spam Bitmessage on an industrial scale and profit than it is to do so against Gmail's anti-spam systems today. If Bitmessage had a hundred million users, then it would be profitable to spam there and it absolutely would happen a lot. In my opinion spam would quickly become the dominant form of traffic on the network, and the broadcast message feature would go the way of VRFY and open relays in SMTP.

</comment></comment></comment></comment><comment><USER51> Can someone explain botguard? I'm not sure I get it.

<comment><USER27> my understanding (which may be wrong - please i welcome all corrections) is that an obfuscated piece of code that is somewhat randomized is generated on the signup page. If you ran it, it produced a token, which is submitted as part of the signup.

If you didn't obtain a fresh piece of this script, but instead either reused, or tried to guess the token, then your signup still succeeds, but is marked as bad. Then, in an undetermined amount of time, a wave of bans would occur on all accounts that got marked as bad.

This prevents signups via scripts, but does so via making signup scripts untrustworthy, and so no one would be willing to put money in for they cannot be sure that it actually works.

<comment><USER51> But what prevents you from requesting another token from Google?

<comment><USER27> I suppose nothing does, except for the resources required to do so (i.e., you need to run your script in a browser, which means lots more overhead and resources).

</comment></comment></comment></comment><comment><USER52> Fascinating read, and as amazing as email is, the OP manages to still make me realize how much I take it for granted:

> _So I think we need totally new approaches. The first idea people have is to > make sending email cost money, but that sucks for several reasons; most > obviously - free global communication is IMHO one of humanities greatest > achievements, right up there with putting a man on the moon. Someone from > rural China can send me a message within seconds, for free, and I can reply, > for free! Think about that for a second._

<comment><USER53>
        Someone from rural China can send me a message within seconds,
        for free, and I can reply, for free!

Yeah, you both "only" need some machine that can go online, an internet connection, electricity, the required technical knowledge, and to (implicitly) agree to your personal data getting harvested... otherwise it's "free".

<comment><USER54> I am willing to give you £50 in cash for free as long as you come pick it up at my place in Sweden.

This offer is only available for you alone and in person. Are you interested? Because I'd really like to know how your pedantic definition of "free" works out for you when it's obvious that things that require infrastructure (such as online communications, or traveling to a different country)... require infrastructure.

(TLDR: If you don't find it amazing that with a very small indirect investment we can actually communicate with people anywhere in the world _for free_ , you and I need to have a long chat about being spoiled.)

<comment><USER55> Well, you could mail the money. Using the national postal systems that exist in both countries that have established means of transferring mail long distances. Same as the farmer in rural China could send a message to the Google engineer.

It costs money, yes, but if you're sending a one off message and it's not time citical, it's not unreasonable to say that sending the message via email is cheaper overall.

Edit: which isn't to say that communication via the Internet isn't really cool, just that it's not actually free, nor would it necessarily be cheaper than sending a message via other means, depending on the circumstances.

<comment><USER54> You missed the critical "within seconds" in the original message. Email is near-instantaneous.

Are we seriously debating the merits of email over snail-mail on hacker news? I hope this is merely people enjoying being thick and provocative, because the alternative is that there's some massive bubble-blindness going on right now.

<comment><USER55> And I was considering nsns' point about how the costs associated with sending email aren't nonexistent, and how, given a certain set of concerns and constraints, might be higher than other means.

I also thought your £50 example was a bit silly. Of course infrastructure costs money. There's means of communicating and delivering things like money that use infrastructure that require a far lower initial investment for a user, and that might be a better deal for that user, circumstances dependent. And not all communications need to be near-instantaneous.

<comment><USER54> > the costs associated with sending email aren't nonexistent

> Of course infrastructure costs money.

You do realize you're.. well, you're not contradicting yourself, but on the one hand you agree it's obvious and on the other hand you insist it must be pointed out.

My example about money was just that. I _could_ use Western Union or a bank transfer. Those things also have non-nonexistent (sic) costs. If you start pointing out everywhere that "Oh but there's _this_ cost you didn't think about!", you won't be done by next week. You know all those libraries that let you check out books for zero cost? Reading those books requires education, which in turn is no free (No matter how much you wish to contradict that statement, the road you've taken requires you to admit to an unending set of cost upon cost which you don't think about in your day to day life).

You live in a society which expects you to have access to certain things. In the case you can't, there usually is infrastructure in place to help you out at little to no cost.

So again, please, just take this in: You can communicate with people at the other end of the globe. _For free_. This is not a legal forum and we don't need asterisks everywhere.</comment></comment></comment></comment></comment></comment></comment>


Security update for IntelliJ-based IDEs v2016.1 and older versions - <AUTHOR> http://blog.jetbrains.com/blog/2016/05/11/security-update-for-intellij-based-ides-v2016-1-and-older-versions/ <comment><USER2> So I have just updated WebStorm. The "About" dialog now says:

      WebStorm 11.0.4
      Build #WS-143.2370, built on April 29, 2016

"Check for Update" tells me I have the latest version.

However the FAQ ([http://blog.jetbrains.com/blog/2016/05/11/security-update- fo...](http://blog.jetbrains.com/blog/2016/05/11/security-update-for-intellij- based-ides-v2016-1-and-older-versions/)) says:

      "All updates published after May 10th contain the security update."

Which would mean that a version built "April 29, 2016" is vulnerable?

Also the linked download page ([https://confluence.jetbrains.com/display/WI/Previous+WebStor...](https://confluence.jetbrains.com/display/WI/Previous+WebStorm+Releases)) says:

      "Latest version: WebStorm 11.0.5 (build 143.2370, May, 11 2016)"

That is, the version number and date are different from what I have, but the build number is the same?!

Maybe it's too late in the day for me to think straight, but somethings wrong here. What product versions are safe?

<comment><USER3> Sorry for the confusion. The latest update for version 11 is 11.0.4 and you're using it now. It fixes the vulnerability. I fixed the error on the confluence page, thanks for pointing that out.

</comment></comment><comment><USER4> If anyone on OSX has trouble launching the updated .app bundle: check the JVM specified in info.plist (right-click on the .app -> Show Package Contents -> Contents -> Info.plist) is 1.7* or (better, for Retina support) 1.8* . The default 1.6* just kept crashing for me (PyCharm 3.4.4, OSX 10.11.4, way too many Java versions installed for my own mental health).

<comment><USER5> In my Info.plist: <key>JVMVersion</key><string>1.8*,1.8+</string>, but still kept crashing. Have to rollback to old vulnerable version.

<comment><USER6> There is a workaround for start-up crashes

[https://intellij-support.jetbrains.com/hc/en- us/articles/208...](https://intellij-support.jetbrains.com/hc/en- us/articles/208516145)

Please see if that works.

</comment></comment></comment><comment><USER7> What is the built-in web server used for and how can I disable it?

<comment><USER6> It's used for numerous things, including web development, running and debugging, as well as other uses such as serving docs, etc. Unfortunately right now it's not possible to disable.

</comment></comment><comment><USER8> If you run on not the latest version, make sure to check for updates twice in order to see the free minor version upgrade.

</comment><comment><USER9> FYI this also covers Android Studio as well so anyone using that should upgrade as well.

</comment><comment><USER10> I'm behind a firewall, doesn't this mean I'm safe?

<comment><USER11> No, all that's necessary to trigger it is browsing to a page containing attacker-controlled JavaScript or Flash. The browser on your own computer would be connecting to the server on your own computer, and firewalls tend to only block external connections.

</comment></comment><comment><USER12> This is very disappointing from JetBrains :-/

<comment><USER6> We're sorry.

We've done our best to address the issue, provide the fixes for current versions as well as back-port it up to 3 years for all products running on the platform. In any case we apologise and have learned from this and will improve.

<comment><USER13> I'm happy with how the issue was addressed. No one can expect perfection from a complicated piece of software such as this. I was glad to have received the email and find the blog post with a thorough list of FAQs.

I'm glad to see proper credit given to Jordan for finding the flaw. Maybe I'm a cynic, but I'm glad that this was an open process and not a one line blog post about a critical security update. Keep up the great work.</comment></comment></comment>


In Retrospect: The Selfish Gene - <AUTHOR> http://www.nature.com/nature/journal/v529/n7587/full/529462a.html <comment><USER2> The selfish gene is one of the few books if you read it with an enquiring mind it will change you forever. I first read it 30 years ago now (amazing how time flies) and it still affects the way I see the world.

<comment><USER3> It definitely had an effect on me.

To elaborate... prior to reading TSG, I thought of myself as an atheist, but I held open a (very) small amount of willingness to consider the idea of some sort of creator, mainly because I'd not heard a convincing counter to the "irreducible complexity" idea. After reading TSG, I felt convinced that there is a reasonable way for, say, the eye, optic nerve, etc., to evolve, that doesn't require the entire thing to appear at once.

Once I crossed that hurdle, I felt a lot more confident in publicly declaring myself an "atheist" instead of just saying "agnostic" which always felt like something of a weasel term.

Of course, having grown up in the "Bible Belt" and having many family members who are devout Christians, this led to some interesting, erm, "discussions" over the years.

I also appreciated TSG for introducing me to things like the Iterated Prisoner's Dilemma and the works of Robert Axelrod, Robert Trivers, etc. and ideas like "kin altruism", "reciprocal altruism", etc. A lot of things make more sense after reading that book.

<comment><USER4> Climbing Mount Improbable had much the same affect on me. However it is worth noting that Dawkins himself is not certain God does not exist.

[http://www.telegraph.co.uk/news/religion/9102740/Richard- Daw...](http://www.telegraph.co.uk/news/religion/9102740/Richard-Dawkins-I- cant-be-sure-God-does-not-exist.html)

</comment></comment></comment><comment><USER5> All of these years later, I still find it _fascinating_ that the man who brought us the notion of the evolutionarily stable strategy, and who spelled out why it would be a fools errand to try to work against the ESS ... spends his free time railing against all of the dimwits he sees going to church.

He should read his own book.

<comment><USER6> It was Maynard-Smith and not Dawkins who introduced ESS.

<comment><USER7> Contrary to popular belief, Dawkins has never produced original research. He is a popular science writer, who synthesises recent discoveries in the field of evolutionary biology into an understandable narrative for the layperson (albeit with extensive commentary on the non-existence of God).

<comment><USER8> I'm not sure why you'd think that, it's clearly false. Dawkins publication record is easily available (it's even on Wikipedia) and he has most definitely published original research.

</comment></comment></comment></comment><comment><USER9> If TSG has a flaw it is IMHO that Dawkins did not fully have the courage of his convictions. When he introduced the concept of a meme he insisted it was just an allegory, an illustrative thought experiment but nothing more. I think this is wrong. I think memes are every bit as legitimately considered alive as genes. This idea has a lot of explanatory power. We humans are hosts not just for genes, but for memes as well, in a sort of symbiotic relationship. Sometimes the interests of our genes and our memes align, such as when we invent antiseptics and antibiotics. Other times they conflict, such as when we invent birth control. The seemingly irreconcilable split between liberals and conservatives could be explained as the beginning of a species split resulting from this conflict, with liberals evolving a bias towards the interests of memes and conservatives biased towards the interests of genes

<comment><USER10> I think he was right to not focus too much on the "meme" concept he invented, because it is quite different from genes, scientifically (which is what he cares about).

1\. The crucial thing with genes is that they are "binary", you either get a gene from a parent, or not. Mutations happen, but they produce new genes. Genes are "immortal" (exist for many, many generations in identical form). Memes, on the other hand, are not binary in this way. Ideas constantly change, and we can't reduce them to a binary code.

2\. The rules of genetic competition are complex, but we have a good framework: natural selection and sexual selection. However, to explain memetic competition, we need to talk about psychology and sociology and so forth (in addition to biology). There are already fields doing that, from psychology and sociology to literature and religious studies, mostly in a non-scientific way, because we have yet to find a good scientific one.

3\. For those reasons, "memetics" never succeeded as an academic discipline. The field has not succeeded in providing useful theories to be tested that tell us quantative things we don't already know.

Of course, at the same time the insights you mention are true. But they are not anywhere near as powerful as the concept of genes. They are mostly useful as an analogy, and to open people's minds, but not scientifically.

<comment><USER11> > The crucial thing with genes is that they are "binary", you either get a > gene from a parent, or not. Mutations happen, but they produce new genes. > Genes are "immortal" (exist for many, many generations in identical form). > Memes, on the other hand, are not binary in this way. Ideas constantly > change, and we can't reduce them to a binary code.

Memes are not ideas, they are behaviors. They are either preserved exactly (like genes) or something modifies them to create a new replicable behavior (again, like genes.) The difference you attempt to paint here is spurious.

<comment><USER10> > Memes are not ideas, they are behaviors.

Why do you say that? Wikipedia's definition disagrees with you,

> A meme (/ˈmiːm/ meem)[1] is "an idea, behavior, or style that spreads from > person to person within a culture".

as does Dawkins himself, [https://en.wikipedia.org/wiki/Meme#Origins](https://en.wikipedia.org/wiki/Meme#Origins)

And Genes aren't behaviors either. Behaviors are something that the phenotype might perform due to certain genes, but the behavior is not the gene.

Genes are a code. They are abstract, discrete, and immortal. That's why they are so useful in biology. As the Wikipedia article notes, the lack of such a parallel in memes limits their scientific utility.

</comment></comment></comment></comment><comment><USER12> Great article!

Here's a question: What other books that were written for a popular audience (or that achieved a largely popular audience) also served as works that affected science itself? E.g. the article talks about The Selfish Gene being both a pop-sci book, but also a book that profoundly changed the field of Evolution.

Are there other good examples?

<comment><USER13> On the origin of species by Charles Darwin

<comment><USER14> That's an interesting one, but was it _written_ for a popular audience? (Maybe it was; I don't know.) In terms of achieving a popular audience, "Relativity: The special and general theory" may be in the same league as Darwin.

<comment><USER15> I read Origin of Species before The Selfish Gene and I enjoyed it a lot. I actually knew enough about evolution to follow all arguments easily. This is not surprising given that Darwin tried to introduce the idea to an audience that was largely alien to the concept.

I think what I liked most about the book is the (clearly labeled) speculations. He was already anticipating a lot.

</comment></comment></comment></comment><comment><USER16> The first chapter alone blew my mind the first time I read it around ten years ago. I read this book once every couple years and it's always thought provoking.

</comment><comment><USER17> A groundbreaking book to me, both for the genetics as well as the concept of the meme. Brilliant.

</comment><comment><USER18> Ridley's The Red Queen was a fascinating follow up after having read this. They both completely changed my world view.

<comment><USER3> Yeah, _The Red Queen_ was great. Some other good related titles are _Sperm Wars_ , _The Evolution Of Desire: Strategies of Human Mating_ , and _The Mating Mind_.

</comment></comment><comment><USER19> When I first picked up the book I was not ready for it---I hated it. It took about ten years for me to read the book, and by the time I finished my view of biology/evolution was forever changed.

<comment><USER20> What did you hate about it?

<comment><USER2> I can't speak for the OP, but my experience with giving the book to people who say they hated it, is that for some people it questions too many of their basic assumptions about the world. They can't rationally argue against the content so they are left with irrational hate.

<comment><USER21> [https://en.wikipedia.org/wiki/Cognitive_dissonance](https://en.wikipedia.org/wiki/Cognitive_dissonance) at work

</comment></comment></comment></comment><comment><USER22> Dawkins and Jiddu Krishnamurthi changed the way I see/experience life, the way I see culture, my sense of morality, forever.

</comment><comment><USER23> The Extended Phenotype:The Long Reach of the Gene, another author's book is also very interesting. Althought the book might include too expert knowledge, the core idea is simple as such it can be explained in the book's title. To think what the idea implies caltivate our view of world.

</comment><comment><USER24> I know the TSG gets lots of attention and lots of people seem to take it as the fundamental word on how evolution works. This is simply not true. TSG presents the rather limited view of a geneticist thinking about genes and is directly at odds with other understandings of how evolution works such as genes as followers [0]. I often have a visceral reaction to such individualistic and incredibly western views of how evolution proceeds because they seem to be wilfully blind to the fact that for 99+% of the time evolution does not operate at the level of individuals, in fact, if you are in one of those rare events where individuals DO matter your likelihood of extinction is incredibly high and as a species you really don't want to be there. If the perspective offered in TSG has a place anywhere in evolution it is long before there were multicellular organisms or perhaps even cells.

I was inspired to this rant the other day when watching a video of tortoises flipping each other over [1]. Early in tortoise evolution there are HUGE benefits to a male that doesn't flip his buddies over and gets all the ladies as a result. No amount of kin selection can prevent this if there is not already a significant latent potential in the organism's behavioral repertoire to cooperate (flip). The notion that a single gene is somehow in control is a complete and utter fiction, SNPs are not robust ways to build behaviors or even to create phenotypic diversity. The variation that leads one tortoise to flip the other over is likely the product of thousands of genes and is far more continuous than a simple 'flipping gene.' In fact, if you see flipping behavior at all it is extremely likely that the developmental program and the genome of the organism as a whole is structured such that the behavior will arise repeatedly in different individuals as a result of a number of different minor changes in gene expression. If a flower grows, its is more likely to be the case that the ground is good for growing flowers than that the flower suddenly innovated.

tl;dr If you want your tortoises to flip, you're going to need more than one gene and you can't think about evolution on an individual basis.

0\. [http://www.ncbi.nlm.nih.gov/pubmed/21257223](http://www.ncbi.nlm.nih.gov/pubmed/21257223), [https://www.researchgate.net/profile/Eva_Jablonka2/publicati...](https://www.researchgate.net/profile/Eva_Jablonka2/publication/226572469_Genes_as_Followers_in_Evolution__A_Post- synthesis_Synthesis/links/552806e90cf29b22c9ba0641.pdf) 1\. [https://www.youtube.com/results?search_query=tortoise+flip](https://www.youtube.com/results?search_query=tortoise+flip)

<comment><USER25> > I was inspired to this rant the other day when watching a video of tortoises > flipping each other over [1]. Early in tortoise evolution there are HUGE > benefits to a male that doesn't flip his buddies over and gets all the > ladies as a result.

I'm not sure if you are actually disagreeing with TSG.

Dawkings repeats several times in the book that to him evolution is not about individuals, but about genes. Heck, even the title is "selfish gene", not "selfish tortoise".

Your tortoise benefits from screwing over his competitors, but his genes might not. Like, for example, suppose there is a combination of genes for noncooperative tortoise. He leaves others to die so the next generation is all assholes like him and they die out because there is noone to help when they inevitably get in trouble. Boom, genes are gone.

In fact, TSG also tries to analyze how cooperative and noncooperative strategies may coexist in single species and tend towards some equilibrium, which depends on costs/benefits of particular behaviors. And, iirc, such crude strategies like "always defect" often ended up outsmarted by subtler ones.

<comment><USER24> Yes, I guess in the right light a selfish gene operating locally ends up promoting cooperative behavior for exactly the reason suggested to the local detriment of the individual (It is just that there is unlikely to be any single gene that can do that). It would be interesting to see what the carrying capacity of such defector genes is as a function of population size. I usually interpret 'selfish' to mean genes that produce defectors (ie no flip) since there is a local benefit to the organism (and thus the gene itself over short timescales) but Dawkins does use it a bit more broadly. I still find implying telos to genes is misleading since the same gene (allele) can produce opposite effects when surrounded by different environments and thus any function it may appear to serve is not intrinsic but conditional.

<comment><USER25> > I usually interpret 'selfish' to mean genes that produce defectors (ie no > flip) since there is a local benefit to the organism (and thus the gene > itself over short timescales) but Dawkins does use it a bit more broadly.

Dawkins seems to define "selfish gene" as "one caring about its long term survival and spread", whether individual tortoises like it or not. Because that's what ultimately counts - contemporary tortoises are shaped by genes which survived millions of years by whatever means happened to be successful, which needs not to be defection.

And, btw, you may want to actually read TSG, it's pretty cool :)

</comment></comment></comment></comment><comment><USER26> My best friend is a devout atheist and he likes to quote dawkins and hitchens and other high priests of his religion. I use these terms purposefully. He's every bit as fervent as any hell fire and brimstone Baptist.

We are/were both raised in, and still live in, the "Bible Belt" as well. I've studied most world religions, have read quite a bit in that arena from the esoteric like "A Course in Miracles", "The Book of Urantia", Meister Eckhart, much of Jiddu Krishnamurti, the Tao Te Ching, etc etc to formalized things like William James's the variety of religious experience.

I've had my own, I would say spiritual rather than religious, experiences that are deeply personal and beyond the rationale of atheists. I have seen firsthand how introspection and quiet-minded observation can provide insight and intuition.

However, I also I went to science magnet schools starting in pre-school, work in IT, and am quite a rational pragmatic individual.

I consider myself to be an agnostic at the moment mostly due to a lack of options. I don't consider it to be a "weasel term". Uncertainty is ubiquitous in life. How is this topic any different? There's always Pascal's Wager ;)

<comment><USER27> Uncertainty is ubiquitous, yet few people feel a need to qualify their disbelief in leprechauns, unicorns, Darth Vader, etc. Why is it only gods where this seems to be required?

As for Pascal's Wager, what if God rewards atheists and sends believers to Hell?

<comment><USER28> > Uncertainty is ubiquitous, yet few people feel a need to qualify their > disbelief in leprechauns, unicorns, Darth Vader, etc. Why is it only gods > where this seems to be required?

It's because those things would by definition be within our universe and thus probably testable. However a deity that controls our universe may be outside it, thus leaving us with no way to test for him, despite his control.

In hacker analogy, would a Sim character in a VM be able to be completely sure that you (god) don't exist?

To "not believe in god" is rational based on available evidence. To "believe there is no god" is an act of faith in itself because it (very likely) cannot be tested.

At least IMHO.

<comment><USER27> Darth Vader, having lived a long time ago in a galaxy far, far away, is untestable too.

<comment><USER29> and what's more if he's outside my light cone that's a physical fact.

</comment></comment></comment></comment></comment><comment><USER30> If selfishness is driving genes, why do they mutate?

<comment><USER31> See the note in the article about the use of the phrase immortal instead of selfish. Simply, selfish was a poor word choice, not a literal statement of the action of genes.

Genes don't "choose" to mutate any more than they "are selfish"

<comment><USER30> "the digital information in a gene is effectively immortal"

I'm having a tough time with this part; the information is clearly NOT immortal. It changes.

[ btw, looks like dang got here before you did ; thanks, dude ]

<comment><USER32> If you increment the number 3, you get 4, but 3 has not changed -- it's still and always will be 3.

<comment><USER31> I love this, and will use it in the future to explain a few things to people who believe in the essential immutability of the being (such as ourselves) versus the invariants of the universe.

</comment></comment></comment></comment></comment><comment><USER33> While it has become fashionable and easy to cease believing in God, humans are wont to continue believing in Authority.

Why, for example, that despite professing to uphold the gene-centric evolutionary understanding humans, who are otherwise flesh and blood bodies, can't help but think inside the restrictive box of self/ identities .... while granting authority to select set of identities - not just clergy men, but authorities in various forms.

Modern social justice movements are another example of this authority-complex, wherein victim-disciples "pray" to the Government-God to "bless" them with advantages and "fight" against the privileged-evils. Does not anyone recognize a familiar pattern?

Belief in a supernatural being (God) is but a symptom of something much more sinister about humanity. It is one thing to question _a_ belief, but entirely another thing to question _the_ need to believe itself.

Refer to the Milgram experiment for the classic study done on Authority: [https://en.wikipedia.org/wiki/Milgram_experiment](https://en.wikipedia.org/wiki/Milgram_experiment)

<comment><USER22> Religion != God.

<comment><USER33> I renamed the one mention of "Religion" in my post to "Belief in a supernatural being". This is such a trivial edit anyway ... do you have anything substantial to contribute towards the key point I've made in my comment above?

<comment><USER34> There exists religions that do not believe in a God like Buddhism. Buddha was just a human being who reached enlightenment and taught how to reach it. He was not a God or super natural.

<comment><USER33> Be that as it may ... as existence of religions without Gods is a tangential point, do you have anything substantial to contribute towards the key point I've made in my (mysteriously downvoted) original comment further above?

<comment><USER34> You got downvoted because you attacked religion and authority.

Let me try and make a point. When Steve Jobs founded Apple he also had founded a religion that worshiped technology. Apple had a certain cult following of Apple users wanting to belong to Apple's culture and way of life. Steve Jobs wanted a different company than IBM and other corporations, he wanted Apple to be different from Microsoft. Steve Jobs was an authority on how computers should work and function. He tried to make easier to use computers with the Lisa and original Macintosh but both failed because they cost a lot and didn't have a lot of apps available for them. After being fired in 1985 or resigning whatever you want to believe, Steve Jobs founded a new company named Next that used Unix instead of starting over from scratch. Steve Jobs tried to create a new religion with a new company. Apple struggled without Steve Jobs, it seemed as if the CEO chair at Apple had an ejector seat. When Steve Jobs was brought back at Apple he turned around the company and got people interested in the new projects they worked on. Apple has this user experience factor that just attracts people to their religion. The iPhones and iPads basically sell themselves and the Macintosh sells itself because it doesn't have the flaws of a Windows PC. Even after Steve Jobs died, Apple still has a religious following to it.

Sure there is a religious experience wired into our genes to worship something and obey some sort of authority. Which is why people follow politicians as authority figures even if they pass laws taking away rights and freedoms and doing domestic spying. It is why some people worship sports stars or musicians or movie makers or even the rich elite.

Atheists for some reason don't seem to have this gene to worship something. Their brains are wired for skepticism and they question authority instead of blindly follow them.

The more math and science one learns, the more likely one is to become an atheist. This is a problem Islam faced when they had their golden age of science and math discoveries. It is what had stopped the golden age out of fear that people would abandon Islam and worship science and math instead. The Catholic Church also faced this and it lead to the dark ages. In fact India, China, and other nations, once they stopped researching math and science, their empires declined.

During the golden age in Europe, people wanted to worship science.

The more science, math, and technology advances the more likely people will abandon religion because they don't need it anymore.

Sure you got Dawkins criticizing religion in many areas, he used to be a Catholic but lost his faith. People see him as an authority and want to follow him as well. He has written great books on biology and is very smart.

People want to follow some authority figure and be like them, they want leaders to tell them how to live their lives and what the meaning of life is to them. Be it a God, a politician, a business person, a sports figure, a musician, a singer, an atheist, whatever people want to follow someone they think has it all figured out. I think this is some part of evolution and in our genes but not everyone has this in their genes. It goes back a long way when people formed tribes for survival. Perhaps before religion was developed. Every tribe has a leader who is an authority figure. For religions that leader happened to be a God or in the case of Buddhism a human being who discovered enlightenment and the end to suffering.

Even if there was no belief in a God or Gods, there still would be a religion worshiping something else.

The rich elite worship money and power for example, and most have stopped practicing their religions in order to spend more time to manage their businesses.

The poor who can't find a good paying job, turn to religion for hope and help. There exists a fellowship of people they can get support and advice from.

I don't know if any of this makes sense to you. But religion plays a role in humanity and has played a role in evolution as well. Over time people have followed a religion because of some basic need for hope and understanding. As technology and medical science advances people leave religion because they feel they don't need it anymore as problems are solved by technology and medical science.

The human race goes through a social evolution as well, changes to society that don't always agree with religious views.

<comment><USER33> I am not at all sure what point you are trying to make. Moreover you contradict the key point in my original comment - that despite being an atheist, one is _not_ free of the belief in an Authority. And there is no gene to worship something (which gene some people lack); that is your (strange) belief, as no scientist anywhere on the planet has discovered such a gene. The need to believe in, and follow, an authority is as instinctual as any other emotion.</comment></comment></comment></comment></comment></comment></comment>


IOS 8 strikes an unexpected blow against location tracking - <AUTHOR> http://www.theverge.com/2014/6/9/5792970/ios-8-strikes-an-unexpected-blow-against-location-tracking

<comment> jack-r-abbit Pretty cool idea. I don't really walk around with my WiFi on so I don't think I get tracked that way. But still a nice idea.</comment>