SQL injection search - <AUTHOR> https://github.com/search?p=3&q=extension%3Aphp+mysql_query+%24_GET&ref=searchresults&type=Code <comment><USER2> While we are at it.. XSS search: [https://github.com/search?q=extension%3Aphp+%3C%3F%3D%24_GET...](https://github.com/search?q=extension%3Aphp+%3C%3F%3D%24_GET&type=Code&ref=searchresults)

<comment><USER3> Is it an XSS if you can only make it output code to your own browser? I can already execute whatever JavaScript I want in the console, so what's the advantage of having the server deliver that code to (only) me?

I can definitely see the issue if the server saves the unfiltered input and tries to print that out for other uses, but it seems to me that outputting a raw $_GET variable will only go to the requester and therefore could only run unfiltered code on that requesters machine.

EDIT: Answering my own question:

This is a security hole because the unsafe JavaScript is stored in the URL for the page (it is a GET parameter). This bad URL could then be sent as a link in a spam email or similar. Victims clicking on the link would then see a page that comes from the legitimate source, but is running unsafe code compromising that user's session. This sort of attack relies on the attacker distributing the link with the bad code as a URL parameter, and is not a vulnerability that a user could encounter when just visiting that site as I had first assumed.

<comment><USER4> That's _exactly_ what XSS is about. One possible way to exploit things like this is if I send you a link to a website, that embeds the target page through an iframe with javascript output injected. I could then have the JS steal your cookies/session or worse.

</comment></comment></comment><comment><USER5> Heh, cute. This means Github could probably do some automated means of informing these people that their code is insecure and would be a danger to themselves and their users. I'm not sure if they should, but it's interesting that they could.

<comment><USER6> I'm pretty sure anyone can write a github bot. I remember there used to be several (some of which would submit pull requests!)

<comment><USER7> GitHub has not been friendly to bots in the past[1].

[1] <https://news.ycombinator.com/item?id=4982240> "GitHub Says 'No Thanks' to Bots — Even if They're Nice"

</comment></comment></comment><comment><USER8> This is a potentially great idea. You could make your build process include submitting your code to a search engine like this (perhaps in some obfuscated manner) and making illegal patterns fail if not manually "approved". Just because the halting problem exists doesn't mean there's not a low hanging fruit in approaching it.

<comment><USER9> Yep, It's called 'static analysis'. <http://en.wikipedia.org/wiki/Static_program_analysis>

<comment><USER8> Heh. I sure romanticized a semi-mundane thing that already exists. ;-)

<comment><USER10> Don't worry. That's basically what every tech company does these days anyway.

</comment></comment></comment></comment><comment><USER11> This isn't a search for SQL injection, its a search for a couple things that you often find in older PHP code that is generally hacked together and likely to have SQL injection vulnerabilities for historical and cultural reasons. However it's perfectly easy to avoid SQL injection even using these things.

        $id = mysql_real_escape_string($_GET['id']);
        $res = mysql_query("SELECT foo FROM bar WHERE id='$id'");

That may be ugly, but it's bulletproof regarding injection.

<comment><USER12> "mysql_real_escape_string" is the silliest function name ever. I assume there is a "mysql_escape_string" function that doesn't do what you expect it to do?

<comment><USER13> Don't forget strstr(). So nice, they named it twice.

<comment><USER14> In PHP's defense, strstr() originally comes from C: [https://developer.apple.com/library/mac/documentation/Darwin...](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man3/strstr.3.html)

</comment></comment></comment></comment><comment><USER15> I don't know much about PHP but I happened to rewrite some old forms a couple of years ago. The original author had relied on a technique called "magic quotes" (<http://php.net/manual/en/security.magicquotes.php>) which automatically sanitized user input. When we upgraded our version of PHP "magic quotes" had been deprecated and dropped.

It would be interesting to know if some of these developers are relying on "magic quotes" or something similar... and also to know how large share of the total number of projects these projects represent.

<comment><USER16> Yeah no, magic quotes didn't ever sanitize.

</comment></comment><comment><USER17> There's a joke to be made here about "broken crypto search".

<comment><USER18> I'll make that joke, but it won't be very funny.

[https://github.com/search?p=2&q=MD5+password+extension%3...](https://github.com/search?p=2&q=MD5+password+extension%3Aphp&ref=searchresults&type=Code)

[https://github.com/search?q=CURLOPT_SSL_VERIFYHOST+NOT+depre...](https://github.com/search?q=CURLOPT_SSL_VERIFYHOST+NOT+deprecated+NOT+2&type=Code&ref=searchresults)

There's more low-hanging fruit, if you're willing to use more specialized searches. For example, guess what mode of operation the PyCrypto library uses by default for all its block ciphers if you don't explicitly pick a sane one:

[https://github.com/search?p=1&q=extension%3Apy+crypto+ci...](https://github.com/search?p=1&q=extension%3Apy+crypto+cipher+aes+new+NOT+PyCrypto_AES+NOT+Crypto%2B%2B&ref=searchresults&type=Code)

<comment><USER17> The joke was more like:

[https://github.com/search?p=2&q=AES&ref=searchresult...](https://github.com/search?p=2&q=AES&ref=searchresults&type=Code)

</comment></comment></comment><comment><USER19> Looking around I found a simple CMS sold to small online stores. Through their links you can find a listing of their customers (people who use their CMS). Problem is the CMS is open to SQL injection everywhere. If a script kiddie found this info they could take down a lot of online stores. Not good.

<comment><USER20> Did you tell them?

<comment><USER21> Or better yet write a patch and submit a pull request informing them.

</comment></comment></comment><comment><USER22> Nice example, but not all are insecure. For example, the second one here is:

        $result = mysql_query('DELETE FROM saves WHERE id = '.(int)$_GET['delete']);

<comment><USER23> That's an example of hazardously bad programming practices. You're one mistake away from complete disaster. You should be sure that it takes more than one mistake to expose you to that sort of risk.

Casting to int is not a general purpose escaping system, and further, if you miss even one of these your entire application can be trashed.

Using mysql_query at all is a sign there's something severely wrong with your application.

<comment><USER24> There is an opposing viewpoint, i.e. if you actually need an int, casting to int is one of the most reasonable ways of getting it.

<comment><USER23> In this case, you don't "need an int", you need a value that's safe to put in a database query.

If you're inserting a value in a database, you always, always, always use the proper escaping mechanism. No exceptions.

That's why using a library with a reliable, well-defined, easy to use escaping system is absolutely imperative.

<comment><USER24> In any case the real problem with this line of code is not the int cast, it's that it's using a GET request to delete a record.

<comment><USER25> Not necessarily - there can still be data in the _GET array, even if the request method is POST.

<comment><USER24> Yes, fair point, but I do think it's a red flag. On looking a bit further I see that yes, in fact, he is using a GET link to delete records: [https://github.com/Paton/Saaave/blob/master/_views/browse.ph...](https://github.com/Paton/Saaave/blob/master/_views/browse.php)

This is an actual, serious problem which I would note in a code review, as opposed to the int thing which cannot, as far as I can can tell, ever lead to an exploit or malfunction which would have been avoided by using a named escape function in this code. If anyone can think of a specific example to prove this wrong, please say so.

</comment></comment></comment></comment></comment></comment></comment><comment><USER26> I would like to say i'm surprised, but I'm not. PHP makes this easier by not even supporting parameter binding in the older, original mysql binding, so it's more prevalent.

That said, I'm sure a slight tweak to the search would find a lot in other languages as well.

</comment><comment><USER27> Sort the results by "last indexed" and see that people are doing it right now!

[https://github.com/search?q=extension%3Aphp+mysql_query+%24_...](https://github.com/search?q=extension%3Aphp+mysql_query+%24_GET&type=Code&s=indexed)

</comment><comment><USER28> There is a _huge_ need in the space for a well marketed quality assurance contractor who can find problems like this and fix them.

"We found these issues, and we can fix them all. Pay us for finding them or pay us some more for fixing them, too." sort of thing.

Why don't you see QA shops popping up like this?

<comment><USER29> You'd need some pretty iron-clad liability waivers... if you miss something, you're opening yourself up for a "malpractice" sort of scenario.

<comment><USER30> Liability can be addressed with non-reliance disclosures.

Bigger issue is a market problem. People who need the help the most do not know they need it.

</comment></comment></comment><comment><USER31> I'm just amazed and disturbed that people who write this kind of code are aware of version control.

<comment><USER32> The person who checked in code isn't necessarily the person who wrote it in the first place.

When dealing with legacy code, especially code going back into the 1980s for example, it's not at all unusual for the code to have been stored in several different version control systems over that time. I know of projects that started with SCCS, moved to RCS, then to CVS, then to Perforce, then to Subversion, and most recently to Git.

If those transitions are done quickly, then somebody will often just take all of the code from a checkout of the old VCS, and check it into the new system.

The same can happen when initially using a VCS, after having not used one before, especially when taking a project over from a developer or even a team that was less-talented. Even if the new developer(s) are going to review the code, and fix bugs and other flaws, a version with the initial state of the code is often a useful thing to have.

</comment></comment><comment><USER33> I guess people would pay for a service that could identify 90% of all security issues with an online service by going through source code and available routes. Anything that is available today?

<comment><USER34> <https://www.tinfoilsecurity.com/>

<comment><USER35> Tinfoil scans remotely for known vulnerabilities (i.e. WordPress version X has exploit Y). What you really want is source code analysis. WhitehatSec.com and Veracode.com are the two huge players in this space.

</comment></comment></comment><comment><USER36> In addition to $_GET searching for $_POST and $_REQUEST are bad too. Could even through in $_COOKIE and $_SERVER for that matter.

</comment><comment><USER37> GitHub (and friends) sound like a great repository to train and prove the value of an automated code review product.

</comment><comment><USER38> Using unsanitized $_GET is the least of their problems considering mysql_* is deprecated.

<comment><USER39> So a gaping security hole that compromises all data is less important than using a deprecated interface?

<comment><USER23> For an application with no exposure, arguably it is.

When you upgrade to PHP 5.6 and your application grinds to a halt because mysql_query isn't available, you'll be wishing you'd fixed it sooner.

<comment><USER40> If you're on RHEL/CentOS, 2023 is gonna be a bad year.

(RHEL/CentOS is currently on PHP 5.3 and will stay there for a long time.)

</comment></comment></comment></comment><comment><USER41> More comprehensive search for bugs: [https://github.com/search?q=extension%3Aphp&type=Code...](https://github.com/search?q=extension%3Aphp&type=Code&ref=searchresults)

</comment><comment><USER42> And for examples not limited to github <http://searchcode.com/?q=mysql_query%20%24_GET%20lang%3APHP>

</comment><comment><USER29> Some of these look like deliberate examples of vulnerable code (e.g. the one named "Injection.SQL.php")

Alarmingly (and sadly) most do not.

<comment><USER43> No need to be alarmed (or sad.)

Without some real-world context for each project, we just can't say whether the code we're looking at represents a real security problem. I'm certain that github hosts just as many one-off, let-me-scratch-some-code-together- that-I'll-never-use-again type projects as it does hard core, production quality ones.

That said it's a neat technique for quickly auditing code. Someone should now write an automated tool for submitting security patches to all of these projects.

</comment></comment><comment><USER44> I'd love to see the number of search results graphed over time.

</comment><comment><USER45> 75 thousand results. And these are just the public repos!

</comment><comment><USER46> mysql_query is deprecated... use MySQLi or PDO

<comment><USER47> MySQLi or PDO will not automatically solve almost any of the security issues found in this search.

<comment><USER23> Using either of them correctly will.

It is very easy to verify that a mysqli or PDO call is correct by looking at it. The same cannot be said for mysql_query.

</comment></comment></comment><comment><USER48> This f'ing insane, and absolutely brilliant.

</comment><comment><USER49> ;.;</comment>


Ask HN: Advantages of immutable variables besides concurrency - <AUTHOR>

Some languages, notably erlang has immutable variables. Are there any advantages to this besides making concurrent programming easier ? <comment><USER2> Yes. It makes composing larger programs out of smaller programs easier. Especially if functions have to be real mathematical functions, and can't have any side-effects.

"Composability means that you can put two bits of code together and important correctness properties will be preserved automatically. This does not mean, of course, that the composition is automatically correct in a wider sense, but it does mean that you don't introduce new bugs merely by sticking two things together." ([http://paulspontifications.blogspot.com/2007/09/composabilit...](http://paulspontifications.blogspot.com/2007/09/composability- and-productivity.html))

</comment><comment><USER3> Allows for laziness, in languages like Haskell.

Also, some data structures are simply _incorrect_ when the data is mutable. A hash table with mutable keys comes to mind. Why? Once you insert the key-value pair, and mutate the key, you may not be able to find that key anymore.

</comment><comment><USER4> It means you know where the variable's value came from.

It also makes sharing common parts between different data structures easier.

</comment><comment><USER5> depending on your language, modifying an immutable variable may throw a runtime/compiletime exception, giving you insight into your bug (potentially)</comment>


Thoughts on OpenAI, reinforcement learning, and killer robots - <AUTHOR> http://www.fast.ai/2017/07/28/killer-robots/ <comment><USER2> I've worked in a lot of AI-related projects and was around when the AI winter arrived.

These various techniques that currently work by training, either supervised or self-training, can have fatal flaws.

Take, for example, some high-tech camera technology. Use it on a drone to take pictures of warships from thousands of angles. You take pictures of U.S. warships, Russian warships, and Chinese warships. You achieve 100% accuracy of identifying each ship using some Neural Net technology.

One day this net decides that an approaching warship is Chinese and sinks it. But it turns out to be a U.S. warship. Clearly a mistake was made. Deep investigation reveals that what the Neural Network "learned" happened to be related to the area of the ocean, based on sunlight details, rather than the shape of the warship or other features. Since the Chinese ships were photographed in Chinese waters, and the U.S. warship that was sunk was IN those waters at the moment, the Neural Net worked perfectly.

Recognition and action are only part of the intelligence problem. Analysis is also needed.

<comment><USER3> That's called 'data leakage'.

[http://machinelearningmastery.com/data-leakage-machine- learn...](http://machinelearningmastery.com/data-leakage-machine-learning/)

<comment><USER4> Actually this is a clear case of overfitting leading to a high false positive rate resulting in the misidentification of a US ship for chinese.

<comment><USER5> I don't think that's a clear case of overfitting. You could have used a subset of the original data for training and the rest for validation and it would have generalised pretty well.

It doesn't generalise when the US ship is in Chinese waters, but that's because the system was never "learning" to recognize ships in the first place.

</comment></comment></comment></comment><comment><USER6> Top people including DeepMind's CEO Demis Hassabis and Prof Stuart Russell, a AAAI and AAAS fellow who is a co-author of the AI textbook used at most of top universities, agree that AGI is definitely possible and going to happen. [1]

Hassabis also stated in another session that there are probably _at least half a dozen mountains to climb before reaching AGI and he would be surprised if it takes more than 20._ He also said that it has been easier to develop major advances than he thought. [2]

Considering that there has been about one major leap per year in neural networks architecture and systems for the past 3-4 years, and this includes training neural networks to do one-shot learning for physical robot control after practicing in a simulator, should we really be that complacent?

Even if the advances slow down to one per 2 years and it takes 12 of them to get to AGI, that's only 24 years. If the rate continues to be one per year, that's only 12 years.

[1] From the start of [https://youtu.be/h0962biiZa4](https://youtu.be/h0962biiZa4)

[2] [https://youtu.be/V0aXMTpZTfc](https://youtu.be/V0aXMTpZTfc)

Note: Reinforcement Learning is far from the only component being researched at major labs, including DeepMind and OpenAI.

<comment><USER7> > Top people including DeepMind CEO Demis Hassabis and Prof Stuart Russell, a > AAAI and AAAS fellow who is a co-author of the AI textbook most used at top > universities, agree that AGI is definitely possible and going to happen.

Even though they are high-profile people, in DL, since people still don't know a lot about it, their confidence means nothing.

When I was in college, my professors/textbook alike, claimed that in order to conquer Go, we probably needs quantum computer or something really sci-fi, maybe in 50 years, even 100 years. Guess what, no one, not even the most optimistic person, would predict it will beat the best human player in 10 years. So, yeah, AGI might happen, maybe in 10 years, maybe in 100 years, but until it happens, no one really knows when is that moment exactly.

<comment><USER6> The point is whether we should be complacent and dismiss concerns just because we don't know when it will happen.

Once someone builds it, stopping it might be very difficult. Here's why: [https://youtu.be/4l7Is6vOAOA](https://youtu.be/4l7Is6vOAOA) (less than 9 minutes and very clearly explained).

Dismissing even a 10% chance of possible catastrophic risks is not what we practice in any other domains. Would you dismiss a concern over airplanes that have a 10% or even just a 1% chance of crashing?

<comment><USER7> Point is, nobody knows whether AGI really exists or not, based on our current approach. As I have answered in another comment section, natural language understanding haven't been cracked, at all. I mean at all.

So the reality is, it is like ancient human knows birds can fly with wings, but people can only fly in their dreams. Now, we know people can think intelligently with their brain, but no one knows how to make computer works the same. It is far too early to talk about the risk, until we have the Wright brothers of AI to enlighten us on such possibility.

<comment><USER6> Unlike airplanes, AGI possesses agency and the ability to cause widespread harm and damage in today's computer-penetrated world. So if we wait until it is invented, there is no guarantee that there won't be danger or even catastrophes. Wouldn't you even agree that there is a 1% chance that AGI is possible and that it could harm us once invented?

Also, the goalpost for identifying something as a challenging cognitive skill worthy of the name AI is moved almost every time we make progress so people keep denying that we are closer to AGI. AlphaGo is the latest example.

Some AI researchers and CS people believe that Natural Language Understanding (NLU) is AI-complete, i.e. once we solve it we basically solve AI in the sense of AGI. I do not personally believe that--There are certain human cognitive skills that are not required for NLU. But I do think that solving NLU does bring us closer to solving AGI.

Let's say someone makes progress on NLU. What would be the _minimum_ level sufficient to convince you that AGI is possible? Why minimum? Because we don't want AGI to be right at our doors before starting to prepare.

* Would getting _80% on Winograd Schema_ be sufficient?

Other suggestions are welcomed, including by others.

[https://en.wikipedia.org/wiki/Winograd_Schema_Challenge](https://en.wikipedia.org/wiki/Winograd_Schema_Challenge)

<comment><USER7> For NLU, to convince me the potential, one important evidence I would be particularly interested, is the demonstration of reasoning. Unlike the current black-box model, I would love to see the model give explanation, along with the answer, what it takes to lead such conclusion, be it a rule listed in the manual or case that happened before.

This itself presents several big challenges: how do we represent the concept of reasoning, in mathematical form? Knowledge required or not? What is the representation of such knowledge?

A truly intelligent machine, should be able to take what human takes, a piece of text, then build its knowledge base from there, then answer a question just like human, then give explanation when asked for it.

</comment></comment></comment></comment></comment></comment><comment><USER8> _investments into addressing mass unemployment and wealth inequality (both of which are well-documented to cause political instability)_

I don't really expect to see this solved in the USA before it's solved in poorer countries. In the USA there's a tension between pleasing the millions of surplus workers and pleasing the top billionaires that'll be minted when robots can replace millions of workers. It's cheaper for the billionaires to buy legislatures than to endure higher taxes or weakened IP rights.

By way of contrast, there are no local power brokers whose fortunes are built on intellectual property in Bolivia or Bangladesh. It'll be 99% upside for populist politicians to just ignore American IP concerns and freely "pirate" machines-that-do-work and machines-that-make-those-machines. The long term solution to machines-do-all-the-useful-work isn't to tax the profits and redistribute them to unemployed people for spending anyway. That's just an elaborate historical-theme-park imitation of a 20th century economy. "Machines make all clothing, then we tax those machines and redistribute money to the people so they can buy the clothing." The better solution is widespread copying of the maker-machines and the dramatic price deflation that follows on everything they can make.

<comment><USER9> The day we will invent a self-replicating factory that only uses cheap local raw materials, the current economic system will end. We could say the whole of the economy is a self replicating system, but we need to shrink that to a small size and make it not dependent on rare or contested materials. Humans, genes, and the ecosystem are self replicators as well. Self replication might be a different kind of singularity that we reach even before AGI.

Basically, in order to make a self replicating factory we need advanced 3d-printing, robotics and a large library of schematics. Then, a "physical compiler" could assemble the desired object by orchestrating the various tools and the movement of parts inside the assembly line. If this automated factory can create its own parts, then we have a self replicator. If you make it all open source and ship seed factories around the world, soon everyone will have their own stack to rely on.

<comment><USER10> I would rather have successful AGI before universal replicators that are available to many merely human intelligences. Super especially hope for that if these replicators operate at the nano scale, which I think you're implying with the suggestion everything can be made from common raw material like dirt. But I'm not too optimistic. Governments couldn't even stop proliferation of 3D printed guns, how will they cope with other things in the future that have an economic incentive too?

Don't forget that even if certain materials no longer become rare or contested, location and raw energy will still be. Without a supreme AGI, or an upheaval of our most basic knowledge of physics, expect wars to be fought over rotating black hole real estate.

</comment></comment></comment><comment><USER11> Ok, so I consider myself an above-average programmer, capable of building a standard database driven web applications using the latest du-jour techniques.

I suck at Math - I mean I _really_ suck at Math. I can visualize algorithms and data structures and have no problem whipping up programs. I have written a lot of code in my lifetime and have helmed a lot of successful projects as my capacity as lead programmer or architect.

But I will never be a programmer that writes code that uses Math, like for games, simulation, 3d graphics, operating systems, drivers, autopilots, etc...

So, can a Math idiot like me get into A.I. by going to your site?

<comment><USER12> I'm working on a book for programmers who want to learn math. I can send you the first few chapters if you're interested, but I'm also interested to hear your thoughts about math in general.

<comment><USER13> If you are doing this, this is what I'd love : a book with theory and ton of exercises. My usual workflow is : I read theory, kind of understand something. Then first try one type of exercise that applied that theory. I don't understand a thing. Then I read the solution and I get it. I then need at least two if not more exercises more to play with that theory before I REALLY get it in my mind.

So please, add at least three exercises for each of the applications of each concepts explained in your book.

<comment><USER14> Seconded 1000 times. We have tons of books written in a pompous manner with self-patting on the back and full of theory only.

If you do indeed finish that book, consider me sold on it even if it costs $150 -- if it contains a lot of practical examples and exercises.

</comment></comment></comment></comment><comment><USER15> Best paragraph:

"Cracking AGI is a very long-term goal. The most relevant field of research is considered by many to be reinforcement learning: the study of teaching computers how to beat Atari. Formally, reinforcement learning is the study of problems that require sequences of actions that result in a reward/loss, and not knowing how much each action contributes to the outcome. Hundreds of the world's brightest minds, with the most elite credentials, are working on this Atari problem."

<comment><USER16> Calling it an "Atari problem" sounds quite disparaging and misses the point. It's like calling a convolutional network doing the ImageNet task a "Doggy- detection" problem. That may be the original development problem, but the final product still helps detect cancer in CT scan images... Same goes for advances in reinforcement learning made on atari games.

<comment><USER17> Perhaps, but the jury is still very much out. The vast majority of RL applications are game playing. Very few examples of valuable applications to society or the economy.

There's also plenty of evidence already that RL isn't really the right way to tackle the credit problem. E.g random search is only 10x slower.

<comment><USER18> In what circumstances is it only 10x slower? Random search is totally useless when your environment is stochastic. These algorithms aren't learning sequences of actions, in fact most use a 30 'no op' random start to avoid just that.

<comment><USER19> By 'random', he means evolutionary search. It's not really random, and is just a slower method for policy gradient. Here's the OpenAI blog post: [https://blog.openai.com/evolution- strategies/](https://blog.openai.com/evolution-strategies/)

</comment></comment></comment></comment></comment><comment><USER20> > ...but is it really the best use of resources to throw $1 billion at > reinforcement learning without any similar investments into addressing... > <important things>

The precise same sentiment could be made about his plans to go to Mars- people are starving on Earth. But a Martian "backup civilization" _might_ someday save humanity. Similarly, godlike AGI _might_ be mere decades away and apocalyptically dangerous- predicting scientific advancements is generally impossible, but some people working in the field don't think it's an unreasonable possibility [1]. That humanity, via Musk, has put a billion dollars into worrying about this somewhat plausible existential threat seems reasonable, to me.

Musk is not a staid, Bill Gates-style philanthropist optimizing for dollar- for-dollar benefits. He's picked a set of flashy, long-term goals and started manic efforts to promote them. Perhaps it's a character flaw. But given that, I think he's at least chosen _well._

[1] [http://aiimpacts.org/2016-expert-survey-on-progress-in- ai/](http://aiimpacts.org/2016-expert-survey-on-progress-in-ai/)

<comment><USER21> Yes, I had very similar thoughts.

I think there's room for both. It's great what fast.ai are doing and they'll benefit me more directly, but Elon Musk is pushing at the other end of the scale.

I keep feeling like I'm a total Musk fanboy, but lots of his arguments that I've seen make sense:

1\. The major one, is that doing things like aiming for Mars provides inspiration for a better future. There's similar quotes from other people involved with NASA.

2\. He talks repeatedly about improving the chances of better futures (clean energy, hyperloop), and lowering the chances of bad ones (Bad AI, single- planetary species on planet that has an extinction event)

He's put all his money into the things he sees as important, of which bad AI seems to be high on his list.

</comment></comment><comment><USER22> > Cracking AGI is a very long-term goal.

Is this fair to say? I feel like advancements in the field happened far quicker than anyone expected, and every few years we are reevaluating timelines. Especially given the research happening in tandem that will almost certainly speed up AGI, like graphene, quantum computing, advanced GPU design...

If you asked someone 10 years ago about the possibilities of ML/Deep learning they'd say it was far off too. I'm not going to say Kurzweil is correct but if I know anything, it's that historically these things have happened faster than expected. Look at 1997 -> 2017\. 20 years, but what isn't changed?

Appreciate any discussion as I am not an expert :)

<comment><USER17> We don't make specific time predictions because it's just not possible. But we can make relative predictions. However long it takes to get to AGI, when we're (say) half way there, the amount of societal upheaval will be enormous.

If we can't navigate that successfully, we'll never get to see AGI...

<comment><USER3> > when we're (say) half way there, the amount of societal upheaval will be > enormous.

I had a conversation with a C level exec of a large company last week around this theme. My suggestion that limited AI such as self driving cars has the potential to create a vast number of extremely frustrated individuals making a second round of 'Sabotage' and Luddites a definite possibility was waved away as if those people don't matter and don't have any power.

I really wonder how far you'd have to be removed from the life of a truck or cab driver not to be able to empathize with them and to realize that if you take away some of the last low education jobs that allow you to keep your hands clean that there will be some kind of backlash.

AGI will expand that feeling to _all of us_.

<comment><USER23> If self driving cars/trucks become a thing, and cause millions of people to be unemployed, there is ALSO a correspondingly massive economy increase.

IE, the world is now massively richer because of all this awesome new technology.

Yes, there could be some short term disruption, but honestly I think things will end up fine, just because of the massive amount of extra money and wealth that the world will have that could be used to solve all those short term problems that disruption causes.

<comment><USER17> That's not how things have generally worked out in the world. Billions live in abject poverty even although the world has plenty enough to feed them and provide shelter.

The issue is income distribution - and just making more money doesn't magically fix the problem.

<comment><USER24> > just making more money doesn't magically fix the problem

Magically, no. With an effort yes. There are already experiments with basic pay for example.

Jeremy Rifkin books such as [https://www.amazon.com/End-Work-Decline-Global- Post-Market/d...](https://www.amazon.com/End-Work-Decline-Global-Post- Market/dp/0874778247/) & 'Zero Marginal Cost' discuss the topic.

<comment><USER17> Yes exactly. We really hope to see this effort made. It's a fixable problem, but often in history great inequality is only fixed by violent revolution, which I don't want to see happen in my (or my daughter's) time!

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> I agree with this article: all the fear about AGI taking over the species seems the hide the far more dangerous likelihood of efficient but non-general AI ending up in the hands of intelligences with a proven history of oppressing humans: i.e. other humans.

Besides which AGI, when it comes, is just as likely be a breakthrough in some random's shed rather than from a billion dollar research team's efforts to create something which can play computer games well. Not a lot Musk or anyone else can do to guard against that, except perhaps help create a world that doesn't need 'fixing' when such an AGI emerges.

<comment><USER26> > help create a world that doesn't need 'fixing' when such an AGI emerges.

I wish we would run with this rather than relying on tech and the market to solve all our woes.

</comment></comment><comment><USER17> Rachel and I (fast.ai co-founders) will be keeping an eye on this thread, so if you have any questions or thoughts, let us know!

<comment><USER27> Thanks Jeremy and Rachel for always sharing with the community!

</comment></comment><comment><USER28> Does anyone else feel this is opertunistic? While I appreciate the online course, why start firing shots at another non-profit? Seems the only realistic answer is to drum up attention.

> One significant difference is that fast.ai has not been funded with $1 > billion from Elon Musk to create an elite team of researchers with PhDs from > the most impressive schools who publish in the most elite journals. OpenAI, > however, has.

<comment><USER17> It's because we care about our mission and want to support it and promote it. We're entirely self funded from our own personal finances, so trying to suggest we have some other purpose to our work is a little odd...

We want to bring attention to the important problems and people working to solve them, and contrast that with things that are distracting from that.

</comment></comment><comment><USER29> I can't speak for OpenAI as I know very little about it, but I 'm more than half way thru part 1 of the fast.ai course and it's truly been a joy so far. Thanks Rachel and Jeremy!

</comment><comment><USER30> _I support research funding at all levels, and have nothing against mostly theoretical research, but is it really the best use of resources to throw $1 billion at reinforcement learning without any similar investments into addressing mass unemployment and wealth inequality (both of which are well- documented to cause political instability), how existing gender and racial biases are being encoded in our algorithms, and on how to best get this technology into the hands of people working on high impact areas like medicine and agriculture around the world?_

Not quite my field, but perhaps such currently intractable, high-impact societal and medical problems _do_ require theoretical breakthroughs after all... I guess I'm just concerned Rachel that --to put it in reinforcement learning terms-- we need _both_ exploration _and_ exploitation.

<comment><USER17> Absolutely! We'd like to see investment in both. Currently we're just not seeing the investment we think there ought to be in the areas Rachel mentioned, or in application areas around food production, education, medicine, and so forth.

<comment><USER21> Perhaps obvious question - but have you tried approaching the Gates foundation? They are more concerned with sorting the issues of inequality.

Or, to be slightly obtuse, have you tried approaching Elon Musk for funding? Perhaps he'll be a bit more flush with cash once the Model 3's start rolling out the door and he'll have another billion around to donate. One of Musk's OpenAI principles was trying to democratise AI and that sounds pretty much exactly like what you're doing.

</comment></comment></comment><comment><USER31> Any timeline for when Part 2 is coming out? I checked your site and the URL went to a 404. Loved Part 1 (it enabled me to do an ML project I had been thinking about for over a year) and looking forward to part two! Please keep it going!

<comment><USER17> Planning to release it on Sunday night :)

</comment></comment><comment><USER32> As for the intellectual challenge, I really think Francois Chollet says it very well in his latest book: deep learning is a way to unpack, transpose, visualise and re-aggregate data fundamentals. We only need to master a bit of algebra and coding to make it happen on top of freeware wrappers like Keras and Anaconda, to say two. All the rest pertains to domain knowledge, ethics, politics and access to the hardware. Thanks Rachel and Jeremy for demystifying this field for the masses.

<comment><USER28> How did you get a copy?

<comment><USER32> From its website at Manning here [https://www.manning.com/books/deep-learning- with-python](https://www.manning.com/books/deep-learning-with-python) ... 42% discount code is deeplearning , as provided by Chollet himself... the ebook is complete already, little work still needed to finalise before commercialisation in October

</comment></comment></comment><comment><USER33> > It is hard for me to empathize with Musk's fixation on evil super- > intelligent AGI killer robots in a very distant future.

I would argue this person has no business working with AI with this sort of myopic thinking.

If you think "fake news" is a problem now, just wait until decentralized AI networks are able to tweet, publish articles and affect public discourse in a way that is indistinguishable from human influence. This AI could be trained such that it pushes targeted propaganda and is able to destroy the lives of dissidents using a variety of tactics (generation of fake audio and video material that is indistinguishable from real life targets for the purpose of slander [1][2] as well as other techniques like DDOS, hacking, etc).

Now imagine a world in which all devices are connected in an "Internet of Things" and AI becomes sophisticated enough to exploit these networks and turn them against humans. This has wide ranging implications from surveillance to killing people by hijacking the computer systems in cars to even taking control of military weapon systems that can be used to control and oppress humans.

Now take all of that functionality and embed it within an actual robot that can move around in the real world and is physically stronger than humans [3].

There is nothing that can be done about this because non-proliferation treaties are impossible to enforce due to the nature of software. AI is going to lead to the extinction of all human life on this planet and this is coming from someone who generally disregards conspiracy theories as paranoid fear mongering. We have every reason to be afraid.

[1] [https://arstechnica.com/information- technology/2016/11/adobe...](https://arstechnica.com/information- technology/2016/11/adobe-voco-photoshop-for-audio-speech-editing/)

[2] [https://www.theverge.com/2017/7/12/15957844/ai-fake-video- au...](https://www.theverge.com/2017/7/12/15957844/ai-fake-video-audio-speech- obama)

[3] [http://mashable.com/2014/01/12/robotic- muscle/](http://mashable.com/2014/01/12/robotic-muscle/)

<comment><USER3> > I would argue this person has no business working with AI with this sort of > myopic thinking.

What kind of thinking would you suggest would permit someone to 'work with AI'? Should they be quaking in their boots before being allowed to work at the altar?

You could argue (and with substantially more basis in fact) that Twitter and Facebook have elevated each individuals utterings to broadcast status and that even without decentralized AI networks all the effects that you are listing are already present in the modern world.

It just takes a little bit more work but there are useful idiots aplenty.

Your SkyNet like future need not happen at all, what we can imagine has no bearing on what is possible today and that seems to me to be a much more relevant discussion.

> AI is going to lead to the extinction of all human life on this planet and > this is coming from someone who generally disregards conspiracy theories as > paranoid fear mongering.

Well, you don't seem to be able to resist this particular one. So your 'generally' may be less general than you think it is.

> We have every reason to be afraid.

No, we don't. I haven't seen a computer that I couldn't power off yet, SF movies to the contrary.

<comment><USER34> I would challenge you to power off Amazon's or Google's infrastructure. Because a dangerous AI won't live in a desktop; it will live in a geographically replicated system, across multiple power grids and legal jurisdictions—all of which is possible _today_. And all these systems have spent untold hours of very smart people's time to ensure they never turn off.

<comment><USER3> That doesn't mean they don't have off switches and it does not mean they can't be turned off. I guarantee you the fire department knows how to switch any and all of those off in such a way that the diesels and the no-break PSU's all don't matter one little bit.

</comment></comment></comment></comment><comment><USER2> Another subtle point (one of many) involves transfer of knowledge. My most recent system "learned" by self-modification (similar in concept to growing new synapse connections but done by self-modifying code). This kind of modification will eventually arrive with Neural Nets as they move beyond simple 'dropout' techniques to more context-specific additions of specialized subnets and/or cooperating subnets (e.g. the room-recognizer adds a 'table'-specific subnet).

Assume two systems start out in a similar state. After interactions the systems are no longer identical and they gradually diverge over time (think twins). One is used in accounting and thinks of a 'table' as a kind of spreadsheet. Another is used in woodworking and thinks of a 'table' as a wooden object.

The implication is that one cannot just 'copy' what the first system knows to 'teach' the second system. There would have to be some sort of teaching mechanism (aka college) to transfer the information.

</comment><comment><USER35> Personally I think it's absolutely important for some people to be working on AGI and other to be working on practical applications. Trying to push the boundaries teaches you a lot about what tools you still need. Researching narrow applications hones our experience with the techniques we already understand well and gives us new tools

</comment><comment><USER36> it sounds like people who don't work with machine learning asked that question. People who do work with machine learning should see the difference. Besides what is mentioned in the blog post, OpenAI is a research effort for moving start of the art, while fast.ai is for teaching students in a non math heavy way.

<comment><USER17> We also do research and try to move the state of the art. Although we share our results and methods largely through courses rather than academic papers.

Our plan is to teach more material each year, in less time, with less prerequisites, by both curating the best practice techniques and adding our own.

So far we've spent much more time on education than research since that's the highest leverage activity right now (helping create more world class practitioners helps move the field forward). And most of the research is more curation and meta-analysis to figure out what really works in practice.

<comment><USER36> Didn't realize you are doing research as well. I love what you have done with the courses and look forward to seeing how the linear algebra computational course does. anyway I could contact you to ask you more questions? My email is in my profile

</comment></comment></comment><comment><USER37> There is little to object to in this post, but there is also little to praise. While it is an accurate description of the differences between OpenAI and Fast.ai, it doesn't make a compelling argument that Elon and friends should be spending their money elsewhere. Indeed, if the potential for neural nets to help the world is so large, research into techniques like RL are by extension even more promising, and should be funded and explored. Sure, neural nets are being applied to all sorts of new problems of the sort we are familiar with. This is a period for making incremental improvements in the paradigm. But that should not obviate or preclude research that will lead to a paradigm shift. A false dichotomy.

</comment><comment><USER19> > Reinforcement learning: the study of teaching computers how to beat Atari.

This statement says more about the author and her inability to understand RL than about RL itself. RL doesn't fit fast.ai's "AI is easy" narrative therefore it's not worth doing.

<comment><USER17> There's nothing hard to understand about RL. I'm not sure where you get that idea - if you find it hard, perhaps you just need to look at some different way. Karpathy summarizes the differences with regular supervised learning in his policy gradient post:

> _Policy gradients is exactly the same as supervised learning with two minor > differences: 1) We don't have the correct labels yi so as a "fake label" we > substitute the action we happened to sample from the policy when it saw xi, > and 2) We modulate the loss for each example multiplicatively based on the > eventual outcome, since we want to increase the log probability for actions > that worked and decrease it for those that didn't._

(from [http://karpathy.github.io/2016/05/31/rl/](http://karpathy.github.io/2016/05/31/rl/) )

<comment><USER19> I find RL hard and no I don't need Karpathy's or fast.ai's dumbed down version of RL. I'm talking about cutting-edge RL like PSRL or RETRACE, not policy gradient or DQN.

<comment><USER17> Well OK... I don't know why you think those are hard (let alone cutting edge - PSRL isn't new), but it seems important for you to feel like you understand things other people aren't smart enough to, so there's probably not much more I can say.

<comment><USER19> You can say RL is not hard when you manage to teach all aspects of the SOTA RL algorithm ([https://arxiv.org/abs/1707.06887](https://arxiv.org/abs/1707.06887)) to your class such that they are able to answer any question about it (not just implement it). Good luck teaching metric spaces to code monkeys.

You guys are doing good work teaching tensorflow and algorithms/models researchers are coming up with, but are slapping those same researchers by disrespecting what they're working on now. Some humility would be wise.

<comment><USER38> Not sure why the exact details of state of the art research is relevant here. Obviously that definition of RL is dumbing it down, as I'm sure Rachel knows, but the point is simple - teaching a computer to do something specific a human can without explicitly telling it whether something is good or bad, but rather have it learn on its own.

The latest research in RL isn't getting us that much closer to AGI. We can't plop a robot into the real world and tell it to use RL to learn everything.

<comment><USER19> Before 2012, you also couldn't run a system to classify among 1000 classes. Just because RL isn't there yet, doesn't mean it's not worth doing.

The reason we're discussing hardness of RL is fast.ai's narrative of "you don't need math for AI" and "AI is easy". Sure, implementing and applying AI is easy, and you just need to learn tensorflow, but doing even a modicum of novel research in RL requires a tremendous background in all kinds of math. I appreciate what fast.ai is doing to democratize as much of AI as possible, but that doesn't need to be at odds with other people prioritizing RL research.

<comment><USER38> fast.ai's narrative is "AI is easy for what you probably want to use it for". There are a ton of awesome applications that are enabled by the level of AI taught in the course. However, Rachel's article is about how AGI is actually really, really hard. So much so that we have no idea how to get there and can't predict when it will happen. So instead of fearmongering about AI, we should instead be encouraging everyone to do awesome new stuff with AI.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER39> > It is hard for me to empathize with Musk's fixation on evil super- > intelligent AGI killer robots in a very distant future.

This reminded me of a talk by Andrew Ng I watched recently [1]:

"Worrying about evil AI robots today is a little bit like worrying about overpopulation on the planet Mars ... how do you not care ... and my answer is we haven't landed on the planet yet so I don't know how to work productively on that problem...of course, doing research on anti-evil AI is a positive thing but I do see that there is a massive misallocation of resources."

Nice talk all around if you can find the time.

[1] [https://youtu.be/21EiKfQYZXc?t=37m45s](https://youtu.be/21EiKfQYZXc?t=37m45s)

</comment><comment><USER40> "how existing gender and racial biases are being encoded in our algorithms" sounds like a great first problem to work on for those worried about super- intelligence, as it's basically a concrete instance of the value-alignment problem.

IMO, as long as you accept that human brains run on physical processes (no souls) and that computers continue to improve, super-intelligent AI is inevitable; but it's reasonable to think it's more like 150 years away than 10. Given the magnitude of the consequences here, it's still worth spending some resources to work on.

</comment><comment><USER41> Reinforcement Learning is fundamental research, it needs sponsors like Musk to survive. Agriculture and medicine are applied research, they can find their own independent business models for monetization. That's what we are doing at Startcrowd: [http://www.startcrowd.club](http://www.startcrowd.club)

</comment><comment><USER42> I think Mark Nelson had succinctly described the problem with OpenAI (more broadly, with the "AI safety" concerns): [https://twitter.com/mjntendency/statuses/859189428748791810](https://twitter.com/mjntendency/statuses/859189428748791810)

</comment><comment><USER43> Regarding "killer robots":

If we can't make "paperclip maximization" the main goal of a some human, why do we expect to be able to make it the main goal of some AGI?

<comment><USER44> We can't make anything the main goal of some human, because for us us (just like any other animal) the goal system is genetically hardwired to a bunch of complex feedback loops (hunger, sexual drive, pain, social status feedback, etc etc etc), and we can't turn off any of them, much less all of them, without fundamental alterations of something that's formed _very_ early in evolution of multicellular life.

Any AGI system will also have _some_ set of goals, just like we do. For us the goal is to (vaguely speaking) "feel good" and all the direct things that affect that, including feelings caused by anticipation of future events, etc - but this set of goals is pretty much arbitrary if these goals didn't have to survive through millions of years of natural selection and orthogonal to intelligence power.

I mean, if it doesn't have goals, then it won't _do_ anything, it's not an agent. You could have very smart narrow systems that aren't "agentive" and just e.g. provide answers to very complex questions, but whenever we talk about _general_ artificial intelligence we are talking about a system that has a feedback loop with the external world, i.e., it _does_ stuff, observes the results, learns from that (i.e. is self-modifying in some sense) and decides on further actions - which means having some goals.

</comment></comment><comment><USER45> What about using machine learning to estimate time to solve difficult task with ai?

</comment><comment><USER46> Maybe I'm missing something here.

First of all, I know a lot of the popular perception of artificial "general intelligence" is overly simplistic - I don't believe in the nerd rapture, and I agree with a lot of what was written in the three articles tweeted by Chollet that have been linked in this thread. And yet, I still don't see how AI is not a plausible existential threat.

Unless you believe that some magical business is going on in the human mind that isn't subject to the normal laws of physics, then I don't see how you can believe that there's anything our brains can do that another machine can't. Even if no cognitive skill can be increased to infinity, we have no good reason to believe that our brains represent the maximum performance of all possible cognitive modes. That's an appeal to the discredited idea that evolution has a "ladder", upon which we stand at the apex as the finished product. Natural selection doesn't optimize for intelligence, and it is not "finished". So, if our brains are machines (albeit highly complex ones that we only partially understand), and if they probably don't represent the maximum potential performance of cognition, then how can we say with any confidence that it is not possible to create another machine with higher cognitive performance across all (or nearly all) modes of cognition? And if that is possible, how can we say with confidence that such machines could pose no existential threat to us? Sure, maybe they won't, or maybe we'll never figure out how to build them. But how is it implausible? How is it something to laugh out of the room?

Furthermore, AI need not surpass us in all modes of cognition in order to be an existential threat. As AI gets better at accomplishing a wide variety of tasks, it becomes an ever more powerful lever for those who own it. The near- term threat from AI is socioeconomic: the replacement of vast numbers of jobs with AI/robotics controlled by a small number of people who receive all the profits of their "labor". It doesn't take much imagination to see how thie could be, at the least, an existential threat to our current society if it is not addressed with adequate forethought.

All in all, I just do not see how AI is not an existential threat worth thinking about and sinking some money into researching how we can make it safer. The tired old argument about the need to spend those resources on more urgent matters doesn't hold water. There are seven billion of us. We can specialize - indeed, it's arguably our greatest strength! We can - and must! - devote resources and talent to a great many urgent issues, such as poverty, conflict, disease, and illiteracy. But I think we would be very unwise not to put a little of our wealth and time into researching how best to mitigate the long-term threats that don't seem urgent yet and might not even come to pass. If we don't, then chances are someday one of them will in fact come to pass and we'll wish we had worked on it sooner.

<comment><USER17> I agree with everything you said. However, I don't agree it's what should be hogging the money and interest right now. The impact of AI on employment (and therefore societal stability) is a much more pressing problem. As is the misuse of AI by people in many areas.

If society can get through these issues, then we may get to the point where the existential threat of superhuman AI is of most immediate concern.

Either way, we're not arguing that this issue deserves no time and attention at all. But currently it's the first (and often only) thing I'm asked about when I give talks about the future implications of AI, and it's receiving huge amounts of funding. Elon Musk, when he had the opportunity of addressing some of America's most powerful people, elected to spend his precious time discussing this issue, rather than anything else.

<comment><USER46> I definitely agree that it shouldn't hog all the money and interest - I just don't think that it's hogging a disproportionate share right now. Musk and Altman's OpenAI is a drop in the bucket in the universe of philanthropy. In the AI field, the bulk of work at companies and research at univesities is not going toward existential risk mitigation.

I think the "If society can get through these issues, then..." perspective is fundamentally flawed. We will always, always have urgent problems. Guanranteed. We need to work hard on them. But we also need to work a little bit on the big things that are not of most immediate concern. I think a great analogy for this is climate change. If people in the early Industrial Revolution knew what we know now about greenhouse gases, they wouldn't have been inclined to worry. The amount they were putting into the atmosphere just was not significant, and even if it rose sharply, it would be many generations before there _might_ be an issue. And yet, if people had put some focus on long-term threats, we might be in less dire straits now.

I definitely sympathize with your experience as an AI educator being constantly peppered with hypotheticals about superintelligence. I love your fast.ai course and I am sure you'd rather talk about teaching AI than about something that may or may not be an issue decades from now. But that doesn't mean the issue doesn't deserve more funding.

Musk's topic choice may seem repetitive to us, as we are in the tech world and read about/discuss this topic all the time. But a bunch of older politician types probably have not even been exposed to these ideas of existential risk, and as they hold a lot of power, it's not a bad thing to educate them on. For what it's worth, Musk also spent a lot of time discussing nearer-term implications like job displacement.

<comment><USER17> > _For what it 's worth, Musk also spent a lot of time discussing nearer-term > implications like job displacement._

That's great to hear - I honestly had no idea. Which suggests that the media doesn't have as much interest in covering that as it does the 'killer robots' angle...

<comment><USER46> The transcript is definitely worth reading.

I think that's what has happened with this topic in general and Elon in particular. In the talks I've seen him give, he seems less concerned with AI being "out of control" and more with it being a very powerful lever under the control of a small number of people. That's what he's given as the rationale for OpenAI, and if you look at the research on their website, it's all real research, not bloviating about killer robots. But of course the media just wants to talk about killer robots.

</comment></comment></comment></comment></comment><comment><USER43> I have the intuition that, given a specific "dangerous" goal (i.e., paperclip maximization), AGI will have too much autonomy to stick to it and AI won't have enough autonomy to make it happen.

I believe that the fear of AI is unfounded.

<comment><USER44> Can you elaborate what you mean by "AGI will have too much autonomy to stick to it" ?

Any system that is capable decide that e.g. paperclip maximization is a bad goal must unavoidably have some scale of what constitutes better or worse goals... and that de facto means that whatever is at the "good" end of that scale will be the true goal of that system. But where does that scale come from?

Especially given that this scale is _absolutely_ arbitrary, there are no competing "innate drives" (like mammals have) that would make it difficult to stick with any arbitrary goal. We're not talking about giving some intelligence orders that might conflict with what it "really wants" \- we're talking about configuring the ultimate desires of that system, this configuration will define the world states that it will find more or less "desirable" given complete autonomy.

</comment></comment><comment><USER47> How would you compare the work that you are doing to the work that is being done in China?

<comment><USER17> Can you be more specific? China is a big place and there's a lot happening there! One non-profit in China for instance has kindly translated the entirety of part 1 into Chinese and provided a discussion group for Chinese students.</comment></comment>


Show HN: InstaLove – Tinder on Autopilot - <AUTHOR> http://blog.instamotor.com/instalove <comment><USER2> I've never used Tinder, but I've had multiple men tell me they swipe right (I think? whichever is "yes") on every women, and multiple women tell me the response rate from men who have swiped right on them is very low.

That doesn't sound like a very good system to me...

<comment><USER3> They should have some system of swipe potency. The more you swipe [per day], the less important each swipe becomes. Like Flattr.

</comment></comment><comment><USER4> Just because you can hack another app doesn't mean you should. You're just enabling another form of spam. There are more interesting things you can work on. Don't be that guy.

<comment><USER5> Just having some fun. One of our out of state interns was playing on tinder (doesn't really know anyone around here) after a long day of work and we thought it might be fun to see if we could automate the process. No harm intended; just blowing off steam.

<comment><USER6> For what its worth, I think its a funny/cool project that you guys were obviously just messing around with. A lot of these top comments are taking this much to seriously. Cool execution guys!

<comment><USER7> Thanks for restoring sanity :)

</comment></comment></comment></comment><comment><USER8> Tinder library in ruby : [https://github.com/nneal/tinder_pyro](https://github.com/nneal/tinder_pyro)

<comment><USER9> This is pretty cool. Wonder if we could get rid of the need for charles

</comment></comment><comment><USER10> Tinder would be able to counter a little this by showing the % that the other person swiped right. Women (and I guess Men) would be able to filter out those who swipe right 80%+ of the time...

(I've not used it - maybe this already show this?)

<comment><USER11> In a system as shallow as Tinder it's often hard to find reasons to swipe left. You're allowed a handful of pictures and a few words about yourself. Everyone puts their best foot forward, selecting their most attractive pictures and saying little of substance about themselves in the tagline. Unless someone's appearance is unattractive to you don't really know enough about them to make a judgement either way. It seems that men err on the side of approval, while women err on the side of disapproval.

To be honest, I don't think there are any men who are regular users of Tinder who swipe right less than 80% of the time.

<comment><USER12> I don't think I've swiped right even 20% of the time. Wonder if you can extract the stats from the iOS backup files...

</comment></comment></comment><comment><USER13> Can you add a chatbot to carry on enough conversation to get to a date? Then just message the user when and where to go.

And for ultimate virality, can you somehow encourage unprotected sex through either a filter on users' profiles(1), or the chatbot? Then you can create more users who are predisposed (through nature or nurture, I don't know) to use the app. Yes, that will take a while to really have an effect, but hey, we're not here to build some fly-by-night startup. We're changing the world.

(1) I don't actually know anything about Tinder.

<comment><USER14> Better yet, have it auto-hire a professional to turn up in your place and make sweet love to the object of your momentary affections. you save time and your reputation as a lover is improved by outsourcing this messy task to a specialist.

</comment></comment><comment><USER15> Since I'm currently in a relationship I have not looked at Tinder. Is it exclusively picture based? Since I'm blind I actually had to read dating profiles and determine if someone was interesting and deal with the looks portion if I got a reply. I could see this being useful for me but I could also getting a bunch of hits on people I have no interest in.

<comment><USER16> Basically yes. There is a "tagline" section, but the point of the app is to find people you think are attractive.

</comment></comment><comment><USER17> Auto-swipe enhancement = So damn hard to do

Always-yes for an online dating app = So brilliant

i have to admit that you guys are the geniuses of our generation.

<comment><USER18> Why is your username green?

<comment><USER19> They registered the account on HN very recently

</comment></comment></comment><comment><USER20> The great benefit of something like tinder is that it only allows contact _after_ both people show some sign of interest. Compare that to an app where you can just message someone...and you've experienced spam on a new level. I've seen several people message others over 20 times, without ever receiving a response.

</comment><comment><USER21> "Recently, we decided to take a crack at one of life's most perennial problem: finding love."

The solution makes me sad and frustrated.

I bet someday someone thinks it's a good idea to create a daemon bot to represents us in virtual dating world, and start relationship simulations, so that we need not bother.

<comment><USER22> Imagine that you provide all your preferences and quirks and whatnot to a bot. Others do as well.

Then you have the bots date. And have the bots do your quirks to be judged by the other bot.

After your bots date for sme period of time, successfully - without earning bad-relationship-simulation-karma, the bots can agree to introduce the real yous to one another. Your relationship bot pre-screened the other for you....

I hope I have some time to write a short story about this.

<comment><USER21> That's about what I meant.

If you write a story, let us know.

</comment></comment></comment><comment><USER23> Does Tinder identify fake accounts to Facebook? Tinder has a huge problem with spam already. I'm ashamed to say that I'd be inconvenienced if my Facebook account was disabled; don't want to have to re-sign up for all my other apps.

</comment><comment><USER24> I made the same in a 10-line Python script the other day and I am running it on my machine.

I obtained access_token from Tinder API using mitmproxy. So it works quite well without installing Cydia or another app to my phone.

<comment><USER25> This is good first date conversation material.

</comment></comment><comment><USER26> Congratulations on making Tinder even less useful than it is now.

</comment><comment><USER27> Perhaps I've misunderstood and just mistaken but is the auto-swiping random ? As in, Will it swipe yes or no randomly to people ?

<comment><AUTHOR> always yes. The more the merrier :)

<comment><USER28> I just commented the other day to someone that Tinder should analyze the features of those you swipe yes, and build a profile based on your history to auto-swipe in the future. Machine learning at its finest.

<comment><AUTHOR> We're actually in process of hacking that one too based on your Facebook stated preference :)

<comment><USER28> I'm talking about using OpenCV on profile pics of those you swipe yes on. :)

</comment></comment></comment></comment></comment><comment><USER29> If enough people use this hack, then we all end up with tons of false positives. That means we all have tons of matches as a result but few of them are real matches!

A better idea for Tinder is to charge a dollar to both people of a match so people will swipe with more consideration! The current scheme of things encourages frivolous insincere interaction.

PS: I am looking for new talented tech(ruby,js,ios) friends in sf. I am a rubyist. legendben@gmail

<comment><USER11> > The current scheme of things encourages frivolous insincere interaction.

That's probably because it's a hookup app.

</comment></comment><comment><USER30> Congratulations on writing a spambot, I guess.

</comment><comment><USER31> Welp, somebody needs to get this ported to an XPosed Module please. I'm on the Android L Developer Preview so I can't work on one. :/

</comment><comment><USER31> Welp, somebody needs to get this ported to an XPosed Module please. I'm on the Android L Developer Preview so I can't work on one. :/

</comment><comment><USER32> Gonna give this a try now time to jailbreak

</comment><comment><USER33> So basically it's just a way to waste your time going through the hundreds of ugly chick that swiped you right too, to filter the few you would actually date? No thanks, might as well just not use Tinder and go for a real dating service.</comment>


Why the economic value of a face mask is $56.14 - <AUTHOR> https://www.economist.com/finance-and-economics/2020/08/22/why-the-economic-value-of-a-face-mask-is-5614 <comment><USER2> They doesn't mention how they arrived at this figure, but suggesting an accuracy down to a penny seems a bit much.

Archived copy: [http://archive.is/vQQM6](http://archive.is/vQQM6)

<comment><USER3> US has GDP of roughly 20B (2018) and population of 328M

($20B _5%) /(328M _ 15%) / 365 = $55.68 a day

A penny per person per day is $1.2 billion a year</comment></comment>


Saudi Arabia Gives Citizenship to a Robot - <AUTHOR> https://www.bloomberg.com/news/articles/2017-10-26/saudi-arabia-gives-citizenship-to-a-robot-claims-global-first <comment><USER2> So citizenship for a robot. That implies 'human' rights for the 'thing'. Healthcare, unemployment, etc. It should be allowed to vote I guess? And as citizens cannot have an owner, it is now an independent legal entity? It can go to jail?

So many questions, so little answers...

<comment><USER3> It's Saudi Arabia so most of these aren't relevant questions.

A better question should be would the robot be allowed to operate without a male companion.

</comment></comment><comment><USER4> Hmm...

This gave me an interesting thought. Well, interesting to me. I give it to you.

What happens when Saudi Arabia gives region to a robot? I imagine it would be assigned. Would it need to be assigned a religion to work at Mecca during the Haj?

There's a short story in there, somewhere.

</comment><comment><USER5> Sofia will wear burqah.

<comment><USER6> I was thinking what kind of citizen, more or less rights than women, more or less duties , will it have to stop on Fridays?. Sounds funny but they have to answer those questions in a strict religious country.

</comment></comment><comment><USER7> and now for something completely different...</comment>


All new Kindle Fire models will show Amazon's Special Offers lock screen ads - <AUTHOR> http://www.theverge.com/2012/9/6/3298418/new-kindle-fire-hd-special-offers

<comment><USER2> I won't buy such a thing, no matter how good a device it might be otherwise. Putting ads front and center means whoever's writing the checks for the ads has the first say on the device, not the person holding it.

<comment><AUTHOR> I won't be buying a new kindle in large part due to how disappointed I was with the first Fire. The ads are the final nail in the coffin though. While I've read a number of people writing positive things about the ads (coupons for amazon mp3 etc) it's still not something I care to see on a device I'm spending hundreds of dollars on.

</comment></comment><comment><USER3> This is what I like about Android forks! Who wants that boring dull stock Android lockscreen? Let's have some ads in there.</comment>


Market survey for iphone game - <AUTHOR> http://www.polldaddy.com/s/5CCEDF07130C3F9D/ please fill out this market research survey for an upcoming iPhone game. just 5 questions.
http://www.polldaddy.com/s/5CCEDF07130C3F9D/
picture street fighter 2 bonus rounds... <comment><USER2> When my partner and I built Warbook, we didn't do any market research. We saw an opportunity (Facebook Platform) and a game design that worked (Utopia) and just -built it-. We went from idea to whiteboard to code on day one. 4 weeks later we launched a successful game.

Start small, get feedback, and iterate. That's how you make a kick-ass game. ([http://lostgarden.com/2007/02/rockets-cars-and-gardens- visua...](http://lostgarden.com/2007/02/rockets-cars-and-gardens- visualizing.html))

</comment><comment><AUTHOR> thanks in advance for your participation :)</comment>


Why should I found my innovative, game-changing startup in litigious America? - <AUTHOR>

I'm a young American entrepreneur who has spent the last five years (full-time) researching and building the technology for our Lisp startup.
Set aside the details for now, because they don't really matter to my question. Just assume for the sake of argument that our startup has something quite a bit more interesting up its sleeve than some new photo-sharing app---and that we proceed to draw the anti-competitive ire of the established players. (If you're not comfortable with that assumption, instead fantasize about one of your own startup ideas. It's much easier to imagine that those are great.)
Cutting to the chase: the more I learn about the U.S. legal environment for software businesses, the less I want to actually start my business here. Among other things, the depressing history of DMCA jurisprudence; the new Nortel Cartel; and the profound dysfunction of the USPTO (and increasingly, the Library of Congress) have got me in a funk.
To sum up: as our project becomes more exciting, my gut feeling becomes stronger that I should take it outside the United States. As an American I am profoundly saddened by this.
So, can anyone on HN explain convincingly why I should bet on America? <comment><USER2> _Preface: This is not legal advice. Consult your attorney and CPA. Blah blah blah_

This is a great question.

The short answer is to license the IP between several corporate entities.

Here's a structure that offers a huge amount of protection and risk reduction:

-You own 100% of Company A

-Company A owns all IP

-Company B licenses the IP from Company A

-Company B is an operational company (with a merchant account, employees, office, etc).

Any potential litigation will target Company B because it's exposed. However, you structure the licensing agreement between Company A and Company B such that:

-Company A is indemnified of all of Company B's transgressions

-Company A has very little value because most income is paid to Company B as the licensing fee. You want Company B to essentially be worthless, which means it's not a big target for lawsuits.

Company B would probably be a US-based company. However, Company A could be based in another country, which would further reduce the likelihood of a lawsuit touching the IP.

So you get to operate in the US, but still protect your IP from litigation. The best of both worlds.

</comment><comment><USER3> Here's a simple reason why: can you get the visas needed to move yourself anywhere else and can you find the resources you need in that country?

There are lots of places I would consider over the US, but in many countries to come in and start a business it will take showing that you can properly capitalize the business and provide for yourself until the business reaches profitability. You may be in tens of thousands in moving costs and legal fees before you even get yourself started in order to set up shop in a new place.

And, if your target audience is in the US, you may run into consumer perception or other problems if you are based elsewhere.

</comment><comment><USER4> You do not have to move, all you need to do is split the company into different parts and setup those parts in different countries that give you the protection you seek. For example you could have a US company that does the development and a company in a different country that does the sales. You really need to talk to a lawyer about this so you can make informed choices about how the companies relate and also potential investors so that not only are you legally covered but that the arrangements do not spook future potential investors.

</comment><comment><USER5> Why the US? Legally: low taxes; generally no personal liability for corporate bankruptcy or failed contracts. Culturally: businesspeople are respected; no shame in having a failed business.

How would hardware patent trolling affect your software business? How would the DMCA affect your software business? (Rhetorical.)

I don't like patent trolling or the DMCA, but that doesn't mean I need to move to Oslo.

</comment><comment><USER6> Because of the size of the market. I had to experience it for myself: back in 1999 I founded the first flower and gift ecommerce store in Germany, at about the same time similar stores launched in the US. Within the following years the US Stores grew tenfold compared to us. We had the same products and comparable set ups, but the stores in the US had the market advantage by far.

</comment><comment><USER7> OK, so then what do you propose as a better location?

What country offers a non-litigious society, allows outsiders to start and own a business, and has a tax basis that won't take all your money if you actually become successful?

Personally, I'm not aware of too many better options for an American than America, but I'd love to hear some viable alternatives.

<comment><USER8> Canada?

No healthcare costs (might have to become permanent resident, not hard to do). Low taxes for small business owners (tons of write-offs, lower tax rates). Less litigation. Very generous rules for foreigners to operate businesses. Close to US w/ easy travel. Short flights from major cities (re: Toronto, Waterloo, Ottawa, Montreal).

</comment></comment><comment><USER9> There are things you will find more easily in the US, like funding, mentors, strategic partners, and decent payment. Depending on where you move to, you have to contend with taxes and bureaucracy. All in all, you trade some money and convenience to minimize your risk. Personally, I won't be surprised if this becomes a trend.

</comment><comment><AUTHOR> The wording of the title is definitely tongue-in-cheek, but I think as a hypothetical it's something many of you could form an opinion on.

</comment><comment><USER10> Try Vienna Austria, I have been based here for 5 years for the very same reason.

<comment><USER2> What made you choice Vienna?

</comment></comment><comment><USER11> Any thoughts anyone on Australia?

</comment><comment><USER12> Are you Jewish? make Aliyah!</comment>


Shy U.S. Intellectual Created Playbook Used in a Revolution - <AUTHOR> http://www.nytimes.com/2011/02/17/world/middleeast/17sharp.html

<comment><AUTHOR> "That is straight out of Gandhi," Mr. Sharp said. "If people are not afraid of the dictatorship, that dictatorship is in big trouble."

I wonder which country will find people losing their fear next?</comment>


Dreamlifter stuck: Boeing cargo jet lands at wrong Wichita airport - <AUTHOR> http://edition.cnn.com/2013/11/21/travel/kansas-cargo-plane-wrong-airport/ <comment><USER2> It seems like the media is trying to turn this into a bigger problem by quoting the 9100 foot minimum runway length for maximum takeoff weight and a 6100 foot runway.

We can't tell if this is a real problem or not because we don't know if it has any cargo on board. The plane only needs to fly a few miles to the Air Force base, so draining the fuel tanks may be all that is required to lower the minimum takeoff distance to below the runway length at this airport.

<comment><USER3> It had a 787 fuselage in it.

</comment></comment><comment><USER4> ..."SatNav and ILS app written in 3 lines of javascript"?</comment>


Real VC Might Be The Safest Asset Class Today - <AUTHOR> http://www.readwriteweb.com/archives/real_vc_safest_asset_class.php

<comment><USER2> As an employee in a large, well funded RVC venture, I would say I feel considerably more secure about my position than I would be if I was in a MVC or possibly even in the financial sector.

Our pockets are certainly no deeper than our (established) competitors, but having strategic investment from household names is certainly reassuring.

I'm not an investor (beyond my options in this company) but I'd say that "here's our burn rate" is a lot safer and easier to understand than "we've been loaning people imaginary money and it will all be ok, please don't ask how". Even if the IPO market sucks right now it's entirely possible for well funded companies to go lean, and then profitable, and then grow from there. In fact, that used to be the way most businesses grew.

</comment><comment><USER3> How do "RVC" "classic VC funds" and angels make any money if there are no stock market exits and big fish have no leverage or market cap to buy little ones? There are companies that will very likely cancel S1's now.

<comment><USER4> It is simple. Become profitable. That is what businesses were designed to do. Once you become profitable, you get lots of options. You can take Dividends aka share of profits, sell to another firm, sell to Private Equity (OK, without cheap credit that game is over for a while), even go public when the time is right or in the right location (eg AIM in London). Think Buffet more than Soros. Something happened around 1995 when techies became traders. Build a great biz and forget about Mr. Market. If your current VC won't finance you to profitability, change your business model and if you cannot do that close shop and start again. Bernard Lunn (author of the article)

</comment></comment><comment><USER5> I would consider VCs much safer than the garbage going on in Wall Street. I know Aerons are expensive, but damn, a $400,000 week-long vacation at St. Regis?</comment>


Dark Matter Experiment Finds Unexplained Signal - <AUTHOR> https://www.quantamagazine.org/dark-matter-experiment-finds-unexplained-signal-20200617/ <comment><USER2> Tritium has a half life of around 12 years, and they saw 53 excess counts over a year. To be explained by tritium decay, there would only need to be 1000 atoms of contamination. These types of low background experiments are build from some of the purest and cleanest objects ever manufactured. However, electron recoils weren't a focus in the design of the experiment, much of which is focused on reducing backgrounds. Tritium is just hydrogen chemically, which has a tendency to exchange with hydrogen in organic compounds, and can be innadvertantly captured by metals and later released. This is a pretty pernicious problem to deal with and i really feel for the students. If it is tritium, letting everything run for a long time and looking for a time dependent effect is a possible approach, but this isn't very compatible with phD timelines, and the xenon will probably be in demand elsewhere.</comment>


Instacart Expands To Chicago - <AUTHOR> http://techcrunch.com/2013/09/17/growing-10-weekly-grocery-delivery-service-instacart-expands-to-chicago/

<comment><USER2> _Mehta tells TechCrunch that "33 percent of the year, Chicago has some form of precipitation" and that his company has learned in the San Francisco area that "people just do not like grocery shopping when it's raining."_

I think in Chicago he's going to learn something about how much people like grocery shopping when it's 15°F outside too...

<comment><USER3> I can't tell if this writer actually lived in Chicago, or just can't handle weather that isn't 72F and sunny.

 _" It's as cold as the last circle of Dante's Inferno in Chicago about half the year"_

Um, not even close. And even when it _is_ 15F, we don't sit and home and moan about it. Life goes on.

<comment><USER4> Seriously, it's as hot as the last circle for about 20 percent of the year, but when it's 10 degrees out you sack up and deal with it.

<comment><USER2> I live in Chicago but I'm originally from the south. I feel exactly the opposite. To me, it feels a little bit warm in the summer for all of a month or two, then it's cold as hell in January and February.

<comment><USER3> You acclimate. This is why you see Chicagoans wearing shorts in March when the temperature hits 50F.

</comment></comment></comment></comment></comment><comment><USER5> My roommate just signed up for Peapod and got our first delivery last week. I am looking forward to trying out Instacart and comparing the experience. It seems like I've been seeing an increasing number of Peapod trucks around the city the past six months (maybe it's just me), so I agree with the article's suggestion that there is demand for the service in Chicago.

Edit: In case the team is reading, I'm also curious: Does Instacart have anyone (like an Operations Manager) in Chicago, or are all the logistics being handled remotely from SF?

<comment><AUTHOR> yes, we do have people on the ground in Chicago. And, we are looking for more ops focused people to join. Please email us at email@example.com - Thank you.

<comment><USER6> CV on its way!

</comment></comment></comment><comment><USER7> I live in Chicago and a Trader Joes opened up near me about a week ago. This is the most fantastic news I've heard in a long time: cheap, good groceries delivered to my door!

<comment><USER8> If it opened up "near" you, can you explain why delivery is fantastic news? I think I do grocery shopping different than most people living in the city that find these services useful. If a grocery store is five minutes away or on the walk home from the train, just-in-time shopping seems much more practical.

<comment><USER9> 1\. You're going to spend 15-30 minutes in a grocery store vs 5 minutes selecting items from a website

2\. 30 minutes + travel time is worth more to me than $3.99

3\. Not having to deal with finding the items in the grocery store is worth its own point

<comment><USER10> It's more than just $3.99 extra. The food is marked up as well. The site live chat rep just told me to except groceries to be 10% more expensive via Instacart than if you shopped yourself.

I imagine it will be easy with things packaged goods, but when it comes to meat or fruit, you're hoping the personal shopper doesn't pick out some rotten fruit.

</comment></comment></comment></comment><comment><USER11> What neighborhoods? Surely, not the whole city.

</comment><comment><USER12> I really hope they expand to Seattle. I know Amazon Fresh exists and that Safeway does delivery here, but they don't do same day delivery and its a lot more expensive than instacart. Some competition will do this area some good. If they can keep quality up and keep prices down, I know they can dominate this whole market.

<comment><USER13> I agree. I've also found that neither carries a lot of the brands and products that I want. Or alternatively, they are out of stock.

</comment></comment><comment><USER10> Hoping they expand to my neighborhood soon so I can give them a try. I think there's a big future in grocery delivery because there is so much energy expended per household buying groceries.

      - Drive to grocery store
      - Roam around store picking out groceries and putting in shopping cart
      - Remove all items from shopping cart, put them on belt to checkout
      - Take all bags of purchased groceries and put in shopping cart
      - Take all bags out of shopping cart, put in car
      - When you get home, take all bags out of shopping cart and bring into house

</comment><comment><USER14> I cannot wait until they (hopefully) come to Austin. The only chances I have to go to the grocery store are at peak hours, which makes me dread the trip, and often causes me to put it off and eat out.

</comment><comment><USER15> Everytime I think about using instacart I see the prices are all significantly higher than me schlepping my butt down to whole foods / berkeley bowl and I don't see it as worth it.

</comment><comment><USER16> Chicago though?

<comment><USER17> "Instacart CEO Apoorva Mehta told AllThingsD that his company built a 'feasibility matrix' to determine which city it would expand to. Components of the matrix included what you might guess: car-ownership density and income. Weather was reportedly also a factor. Mehta tells TechCrunch that '33 percent of the year, Chicago has some form of precipitation' and that his company has learned in the San Francisco area that 'people just do not like grocery shopping when it's raining.' Seattle, you might be next."

I think Chicago is a natural fit. The specific neighborhoods they picked have about 600k people in 33 square miles (a bit denser overall than San Francisco as a whole). There are a ton of residential skyscrapers in those neighborhoods, which means they probably can hit several orders in one go. 30% of Chicago households don't have a car, about the same as San Francisco. It rains or is cold about half the year, and is hot and humid a couple of months out of the remainder, which makes people not want to carry groceries home.

<comment><USER18> Agreed. Being from Chicago I think that its very natural for all the points listed above. The density of the city with the void of competition in the space (only Peapod comes to mind) make Chicago a great market to expand too. Chicago usually doesn't come to mind first as an early adopter market but given the rapid adoption of Uber (like other cities) I think the market is proving it is interested in similar services.</comment></comment></comment>