I'll actually stand by those comments. They're one of the most reliable forms of data in medical science, and one of the least reliable forms of data in science.:)
Compared to experimental disciplines in physics/etc, or even biology, the medical areas are practically witchcraft. This is largely due to the ethical issues with experimenting on humans, and that is just the nature of the field - it isn't like doctors don't WANT to generate reliable data. This isn't unlike being an astronomer - you can't make your own stars and galaxies, so you're stuck building arguments on whatever observations can be gleaned from the world around you. In an experimental science you could actually generate your data on demand, in much more controllable conditions. Your data is also much easier to reproduce.
I do recognize the challenges with reliably storing data, and being able to read it is even a bigger issue (good luck reading a few GB of raw data generated by some random piece of scientific software 15 years ago). However, the cost to store data only goes down with time, and compared to the cost of actually generating the data the cost to retain it is usually small (it just isn't as glamorous).
In any case, I wasn't trying to snub your profession. Medical research is obviously important. I just find it very frustrating since even good trials can be misleading, and many important ones over the last few decades cannot be reproduced. The costs are high, and the power of the trials are low - we're just stuck with what we can do, which will no doubt improve over time.
Yeah, but this is a robotic mission that gives good results now, compared to a hypothetical manned mission that costs 100X as much this year and every year for the next 50 years, and gives perhaps better results 50 years from now, assuming the crew doesn't die on the way.
We could probably send 10 probes every launch window for a fraction of the cost of a manned mission. Surely they can't all have fatal flaws?
True, but the assembly-line concept still exists. If you are building or testing or whatevering a part, chances are that before you got it right you had to make 10 of them anyway, and so making a few extra is just a tiny marginal cost.
Maybe if you're talking about telescope mirrors it is a different situation (months to years of effort on a single piece). However, if you give me any assembly job to do then having me do each step twice instead of once is a pretty small cost in the big scheme of things.
Maybe, but if nobody knows up-front if you're willing to negotiate from 40 up to 60 or 110 up to 130, they may not bother applying. Unless I were actually out of work I'm not sure I'd apply for a job without a posted salary, unless it was with a company that I knew by reputation.
Well, I'm not sure that all fruits are eaten in such a manner to guarantee that the seeds are not eaten. However, in your illustration you're merely tossing naked babies into the wilderness to starve to death, instead of just eating them and putting them out of their misery. Those fruits have all those nutrients in them for a reason...
I'll agree with everything you say, certainly. I wasn't saying that double-blind controlled trials were useless, or that they were worse than other methods in the same field. I was just saying that their value was limited because they are prone to error. The recent reforms about trial registration will certainly help, for those trials that are subject to them (not every clinical trial is done by a drug company).
The fact that nothing better exists doesn't mean that clinical trials are without problems. They're certainly better than anecdote, but their error rates are FAR higher than in other fields of study that don't involve people/doctors/etc.
You also raised a very good point about the fact that publications rarely include the raw data, which makes any kind of criticism of the publication difficult. That actually applies to more than just clinical trials - it is a big problem in all fields. In today's era of computers I have no idea why journals don't just require full submission of all raw data necessary to fully arrive at the conclusions. I can understand why they wouldn't print it in the paper version, but there is no reason it couldn't be made downloadable. For areas regulated by privacy legislation I'd probably require that the full uncensored data be made available to reviewers (that is, any data the investigators themselves would have), and then publish anonymized data to the public. Trials would need to include this provision in their consent forms, otherwise they would not be publishable.
Yup, when somebody emailed me this news in a panic I checked and the bug was fixed on Gentoo over a month ago, though if you were on itanic or sparc you got it a bit late (still a week or two ago). The article only refers to 64-bit Gentoo, but as far as I can tell it should be fixed on all the security-supported archs (and likely on the non-security ones by now also).
I'm not an expert, but basically you want to generate a large search dictionary. You start with a small one (like the english dictionary), and then apply rules to generate more words to search. The kinds of rules you listed are typical, and you start applying them individually, and in combination. So, if you have 1000 words, and 10 rules you apply individually, you end up with 10k words. If you allow permutations of 10 rules then you have 1k*10^10 or something like that (depending on the rules order may or may not be important).
Sure, that sounds like a lot of things to test, but compared to a full brute-force search it is still a greatly reduced space.
All of this comes down to diminishing returns. The only way to guarantee getting them all is a full brute-force. However, if you can get 900k with a single pass with common words and a simple set of rules in a few hours, that is probably good enough for most purposes. If all you need is one chances are you just need a dictionary.
Unfortunately the perception of work is what tends to get rewarded. If all is going well, managers will question whether they need you. It causes perverse incentives all over IT.
I think this is where Google Docs... or drive... or whatever comes in handy. You'd be surprised at how many companies are switching from Office/Outlook to GoogleDrive/Gmail for this very reason.
Sounds good, until the company picks a standard that doesn't work on your device, except via some degraded mobile interface. Probably not so much of an issue if they pick Google, but for whatever reason I just can't see the PHBs making those decisions picking Google...
1. The email server is Exchange, using EAS, and the company is very picky about what clients they allow, and thus they blacklist devices based on the info they supply when authenticating. Why none of the FOSS Android distros don't let you edit this stuff easily is beyond me. This is easily fixed by figuring out whatever the iPhone uses and spoofing it.
2. Half of our "web" applications use plugins of various types, which means they aren't really web apps at all. While html might be a standard, ActiveX and plugins in general aren't really. I saw massive carnage at work a few months ago when a "web-based" application was upgraded and there were issues with getting the plugins updated on all the client computers. Obviously they got some box checked for "web-based" without giving any thought to why it is that web-based apps are preferred in whatever selection process they were gaming.
Children? No, my friend; he eats the bits where the children are made. Eww.
That would be true if he ate flowers, but the seeds are in fact the children. Each seed contains a fertilized embryonic plant, just waiting for the proper conditions to start growing. It isn't even dependent on its mother for survival.
I think the issue is more that people who truly grok CS are in short supply, and the fact is that not all employers really need them equally.
What most companies call IT is really more about technology/business integration and management, and not creating technology from scratch. Many people don't really need somebody who can build some wonderful application so much as somebody who can understand what the needs vs wants are, and evaluate the options that others have built. The job has as much in common with marketing as it does with CS.
As the risks of BYOD are primarily about things like data theft/breaches and introducing malware into the organisation, I don't see providing a nice screen and keyboard as a mitigating factor.
Well, it isn't a risk in the same sense, but the other risk with BYOD is employees not being able to effectively work together.
Right now BYOD is OK because people only use it for email and browsing, for the most part.
When you try to apply that to everything else, you start having problems. One employee starts authoring all their documents in one format, and another uses a different one. So, you impose some standard. Now a bunch of employees can't comply with the standard readily, unless you buy a lot of software for them. Some employees have devices that don't work well with the corporate Exchange server or whatever.
So, then you start certifying individual models of devices. At that point you're not really doing BYOD so much as Pay For the Corporate Device. My own company has started taking that route, which just means that I don't use my smartphone for work. They don't even certify a single device for my carrier, and since they aren't paying for my phone bills, I'm not going to revolve my phone around their selections.
While it's possible that animal testing has contributed to medical science in the past, these days it's mostly done in the name of developing pharmaceutical products of dubious social value.
Uh, then why are people so concerned about their cost/etc? If they are of little value, then nobody would be buying them.
It is true that the incremental value of pharmaceuticals over what is already available has been decreasing, but I think that just is an example of the principle of diminishing returns. Lots of research is being done to try to get around this, including the entire concept of personalized medicine which didn't really exist a decade or so ago (at least, not to the extent that things are going today - where personalized medicine is seen by many as being the future default and drugs).
The bottom line is that animal testing can be harmful for medical progress. We just do not know to what extend and it could be that without animal torture we would be better of.
The people doing animal testing try to account for that as best they can. Of course they cannot do so perfectly. However, I don't really see what the alternative is.
Sure, lots of drugs are halted before going into humans because of problems in animal testing (the vast majority of all proposed drugs are). However, the alternative is to just go into humans anyway. If a drug is known to cause serious harm to animals, how ethical is it to test on humans just in case it turns out to be perfectly fine (even though most of the time this is not the case - that is why animals get tested)? If you don't test the animals you can be willfully ignorant of which drugs fall into which category, but I don't see how it makes things any more ethical.
While applying animal testing data to humans is not 100% accurate, the fact is you can learn a lot more from testing animals than people. With people you have to deal with huge amounts of variation and poor experimental control. With animals you can start with a population of creatures that is nearly genetically identical and control almost all aspects of their existence. You don't have to deal with doctors enrolling patients who shouldn't be in the trial just to make a few more bucks or out of sympathy for their condition. You don't have to deal with patients forgetting to take their pills. You don't have to use non-invasive diagnostics to try to gauge how things are going - you can just cut the animals apart at the end and directly measure the therapeutic effects (to varying degrees depending on what those effects are). Sure, you need to deal with all of those issues eventually since humans will end up having to take the pill, but being able to eliminate them during early research yields a lot of data that would simply be unethical to collect in people.
Nobody would want to test animals if any viable alternative existed. The companies that do animal testing also invest heavily on researching those alternatives, simply because the animal testing is very expensive and time-consuming. If you could predict the therapeutic and safety profile of a compound before you ever had to spend the money to even synthesize it, don't you think every drug company on the planet would want that?
Another alternative is to not use neither humans or animal models and to accept a slowing of medical progress.
Keep in mind that this has a death toll associated with it as well. If you delay medical progress on some treatment for 20 years, then you condemn to death anybody who gets that disease in the next 20 years.
Also, how do you expect ANY medical progress to take place in the absence of either human or animal testing? Somebody has to be the first to have a new treatment performed, unless you never perform it. Unless you can simulate the entire human body with all the operations of all its cells you won't be sure whether a proposed treatment will work until you test it on something or somebody. Such a simulation is still MANY decades off, and that is assuming that the scientists along the way can butcher all the animals they require.
I for one really miss 4:3 monitors. I just bought one that was VGA-only the other day mainly because it was cheap and 4:3.
I could care less for 16:9 screens. I don't mind letterboxing at all - it isn't like my viewable area is any less. In most settings the display is horizontally constrained. I couldn't put a wider monitor on my desk if I wanted to - it would waste too much space. However, above the monitor is nothing but 5 feet of empty space. I don't need to fill all that space, but I certainly don't mind filling something closer to 4:3 than 16:9.
For larger TVs I can see why I wouldn't want to waste the money on LCD surface that isn't used most of the time. However, that space gets plenty of use on my computer monitor...
Everyone involved with software development these days has surely heard of Ruby, and especially Ruby on Rails.
You must work at a company that sells software, or something. If I walked around my department (an IT department at a Fortune 500), and polled the department of ~75 people, I'd be surprised if more than about 3 had heard of Ruby. We use VB.NET for new stuff, but I'm sure we're still doing the odd upgrade in VB6.
Much of software development is a couple of forms on top of a database, and a few reports. For that sort of thing VB is adequate, and often the people doing the work barely understand object oriented languages, assuming they understand them at all.
The guy who coded the inventory application for your local appliance repair shop wasn't debating between taking a job there or at Facebook. More likely than not they were hired to fix appliances, not code.
Half the time IT is the unwitting force behind this sort of thing.
If somebody spent an hour with him and gave him the odd assistance, then chances are his application, while not pretty, would be far more effective and maintainable. However, that would be an act of ceding control, so typically IT will say "no backend databases or help for you" and proceed to try to tell the business that they should invest in a $500k development investment to basically do what they can already do with the hobbled-together solution. The business instead spends their money hobbling together yet another solution until the whole thing is no longer sustainable, and then somebody has to clean house.
The problem is the my-way-or-the-highway mentality that is very common in IT shops.
I wouldn't say that password-hashing is a best practice in my industry. Note, that my industry has nothing to do with making computer software, though it makes a lot of computer software in the process, and buys quite a bit from other companies who have incentive to deliver the features customers are looking for, and not the ones they should be looking for.
If I had to guess I'd imagine that the majority of systems at my company that store passwords do not hash them. At best they encrypt them, which is virtually useless as protection (but good luck explaining that to a PHB).
Slashdot Mirror
I'll actually stand by those comments. They're one of the most reliable forms of data in medical science, and one of the least reliable forms of data in science. :)
Compared to experimental disciplines in physics/etc, or even biology, the medical areas are practically witchcraft. This is largely due to the ethical issues with experimenting on humans, and that is just the nature of the field - it isn't like doctors don't WANT to generate reliable data. This isn't unlike being an astronomer - you can't make your own stars and galaxies, so you're stuck building arguments on whatever observations can be gleaned from the world around you. In an experimental science you could actually generate your data on demand, in much more controllable conditions. Your data is also much easier to reproduce.
I do recognize the challenges with reliably storing data, and being able to read it is even a bigger issue (good luck reading a few GB of raw data generated by some random piece of scientific software 15 years ago). However, the cost to store data only goes down with time, and compared to the cost of actually generating the data the cost to retain it is usually small (it just isn't as glamorous).
In any case, I wasn't trying to snub your profession. Medical research is obviously important. I just find it very frustrating since even good trials can be misleading, and many important ones over the last few decades cannot be reproduced. The costs are high, and the power of the trials are low - we're just stuck with what we can do, which will no doubt improve over time.
Yeah, but this is a robotic mission that gives good results now, compared to a hypothetical manned mission that costs 100X as much this year and every year for the next 50 years, and gives perhaps better results 50 years from now, assuming the crew doesn't die on the way.
We could probably send 10 probes every launch window for a fraction of the cost of a manned mission. Surely they can't all have fatal flaws?
True, but the assembly-line concept still exists. If you are building or testing or whatevering a part, chances are that before you got it right you had to make 10 of them anyway, and so making a few extra is just a tiny marginal cost.
Maybe if you're talking about telescope mirrors it is a different situation (months to years of effort on a single piece). However, if you give me any assembly job to do then having me do each step twice instead of once is a pretty small cost in the big scheme of things.
Even if he had restored the system to Windows, I SINCERELY hope that NewEgg would re-image the hard drive anyway.
Or, if we buy a computer with an OS pre-installed should we expect it to include rootkits as well?
That is fine as long as they disclose this, and the commission approves it. Good luck with that...
Maybe, but if nobody knows up-front if you're willing to negotiate from 40 up to 60 or 110 up to 130, they may not bother applying. Unless I were actually out of work I'm not sure I'd apply for a job without a posted salary, unless it was with a company that I knew by reputation.
Well, I'm not sure that all fruits are eaten in such a manner to guarantee that the seeds are not eaten. However, in your illustration you're merely tossing naked babies into the wilderness to starve to death, instead of just eating them and putting them out of their misery. Those fruits have all those nutrients in them for a reason...
I'll agree with everything you say, certainly. I wasn't saying that double-blind controlled trials were useless, or that they were worse than other methods in the same field. I was just saying that their value was limited because they are prone to error. The recent reforms about trial registration will certainly help, for those trials that are subject to them (not every clinical trial is done by a drug company).
The fact that nothing better exists doesn't mean that clinical trials are without problems. They're certainly better than anecdote, but their error rates are FAR higher than in other fields of study that don't involve people/doctors/etc.
You also raised a very good point about the fact that publications rarely include the raw data, which makes any kind of criticism of the publication difficult. That actually applies to more than just clinical trials - it is a big problem in all fields. In today's era of computers I have no idea why journals don't just require full submission of all raw data necessary to fully arrive at the conclusions. I can understand why they wouldn't print it in the paper version, but there is no reason it couldn't be made downloadable. For areas regulated by privacy legislation I'd probably require that the full uncensored data be made available to reviewers (that is, any data the investigators themselves would have), and then publish anonymized data to the public. Trials would need to include this provision in their consent forms, otherwise they would not be publishable.
Yup, when somebody emailed me this news in a panic I checked and the bug was fixed on Gentoo over a month ago, though if you were on itanic or sparc you got it a bit late (still a week or two ago). The article only refers to 64-bit Gentoo, but as far as I can tell it should be fixed on all the security-supported archs (and likely on the non-security ones by now also).
I'm not an expert, but basically you want to generate a large search dictionary. You start with a small one (like the english dictionary), and then apply rules to generate more words to search. The kinds of rules you listed are typical, and you start applying them individually, and in combination. So, if you have 1000 words, and 10 rules you apply individually, you end up with 10k words. If you allow permutations of 10 rules then you have 1k*10^10 or something like that (depending on the rules order may or may not be important).
Sure, that sounds like a lot of things to test, but compared to a full brute-force search it is still a greatly reduced space.
All of this comes down to diminishing returns. The only way to guarantee getting them all is a full brute-force. However, if you can get 900k with a single pass with common words and a simple set of rules in a few hours, that is probably good enough for most purposes. If all you need is one chances are you just need a dictionary.
While SHA1 is broken, I doubt it makes much difference here.
Per your link, you can find collisions in SHA1 with 2^69 hash operations per password.
The people doing the cracking here did CONSIDERABLY fewer operations per password than this.
Sure, everybody should be moving on, but the fundamental issue here is that passwords that people can remember generally don't have enough entropy.
Unfortunately the perception of work is what tends to get rewarded. If all is going well, managers will question whether they need you. It causes perverse incentives all over IT.
I think this is where Google Docs... or drive... or whatever comes in handy. You'd be surprised at how many companies are switching from Office/Outlook to GoogleDrive/Gmail for this very reason.
Sounds good, until the company picks a standard that doesn't work on your device, except via some degraded mobile interface. Probably not so much of an issue if they pick Google, but for whatever reason I just can't see the PHBs making those decisions picking Google...
Yeah, but at work I've seen the following:
1. The email server is Exchange, using EAS, and the company is very picky about what clients they allow, and thus they blacklist devices based on the info they supply when authenticating. Why none of the FOSS Android distros don't let you edit this stuff easily is beyond me. This is easily fixed by figuring out whatever the iPhone uses and spoofing it.
2. Half of our "web" applications use plugins of various types, which means they aren't really web apps at all. While html might be a standard, ActiveX and plugins in general aren't really. I saw massive carnage at work a few months ago when a "web-based" application was upgraded and there were issues with getting the plugins updated on all the client computers. Obviously they got some box checked for "web-based" without giving any thought to why it is that web-based apps are preferred in whatever selection process they were gaming.
Children? No, my friend; he eats the bits where the children are made. Eww.
That would be true if he ate flowers, but the seeds are in fact the children. Each seed contains a fertilized embryonic plant, just waiting for the proper conditions to start growing. It isn't even dependent on its mother for survival.
I think the issue is more that people who truly grok CS are in short supply, and the fact is that not all employers really need them equally.
What most companies call IT is really more about technology/business integration and management, and not creating technology from scratch. Many people don't really need somebody who can build some wonderful application so much as somebody who can understand what the needs vs wants are, and evaluate the options that others have built. The job has as much in common with marketing as it does with CS.
As the risks of BYOD are primarily about things like data theft/breaches and introducing malware into the organisation, I don't see providing a nice screen and keyboard as a mitigating factor.
Well, it isn't a risk in the same sense, but the other risk with BYOD is employees not being able to effectively work together.
Right now BYOD is OK because people only use it for email and browsing, for the most part.
When you try to apply that to everything else, you start having problems. One employee starts authoring all their documents in one format, and another uses a different one. So, you impose some standard. Now a bunch of employees can't comply with the standard readily, unless you buy a lot of software for them. Some employees have devices that don't work well with the corporate Exchange server or whatever.
So, then you start certifying individual models of devices. At that point you're not really doing BYOD so much as Pay For the Corporate Device. My own company has started taking that route, which just means that I don't use my smartphone for work. They don't even certify a single device for my carrier, and since they aren't paying for my phone bills, I'm not going to revolve my phone around their selections.
While it's possible that animal testing has contributed to medical science in the past, these days it's mostly done in the name of developing pharmaceutical products of dubious social value.
Uh, then why are people so concerned about their cost/etc? If they are of little value, then nobody would be buying them.
It is true that the incremental value of pharmaceuticals over what is already available has been decreasing, but I think that just is an example of the principle of diminishing returns. Lots of research is being done to try to get around this, including the entire concept of personalized medicine which didn't really exist a decade or so ago (at least, not to the extent that things are going today - where personalized medicine is seen by many as being the future default and drugs).
The bottom line is that animal testing can be harmful for medical progress. We just do not know to what extend and it could be that without animal torture we would be better of.
The people doing animal testing try to account for that as best they can. Of course they cannot do so perfectly. However, I don't really see what the alternative is.
Sure, lots of drugs are halted before going into humans because of problems in animal testing (the vast majority of all proposed drugs are). However, the alternative is to just go into humans anyway. If a drug is known to cause serious harm to animals, how ethical is it to test on humans just in case it turns out to be perfectly fine (even though most of the time this is not the case - that is why animals get tested)? If you don't test the animals you can be willfully ignorant of which drugs fall into which category, but I don't see how it makes things any more ethical.
While applying animal testing data to humans is not 100% accurate, the fact is you can learn a lot more from testing animals than people. With people you have to deal with huge amounts of variation and poor experimental control. With animals you can start with a population of creatures that is nearly genetically identical and control almost all aspects of their existence. You don't have to deal with doctors enrolling patients who shouldn't be in the trial just to make a few more bucks or out of sympathy for their condition. You don't have to deal with patients forgetting to take their pills. You don't have to use non-invasive diagnostics to try to gauge how things are going - you can just cut the animals apart at the end and directly measure the therapeutic effects (to varying degrees depending on what those effects are). Sure, you need to deal with all of those issues eventually since humans will end up having to take the pill, but being able to eliminate them during early research yields a lot of data that would simply be unethical to collect in people.
Nobody would want to test animals if any viable alternative existed. The companies that do animal testing also invest heavily on researching those alternatives, simply because the animal testing is very expensive and time-consuming. If you could predict the therapeutic and safety profile of a compound before you ever had to spend the money to even synthesize it, don't you think every drug company on the planet would want that?
Another alternative is to not use neither humans or animal models and to accept a slowing of medical progress.
Keep in mind that this has a death toll associated with it as well. If you delay medical progress on some treatment for 20 years, then you condemn to death anybody who gets that disease in the next 20 years.
Also, how do you expect ANY medical progress to take place in the absence of either human or animal testing? Somebody has to be the first to have a new treatment performed, unless you never perform it. Unless you can simulate the entire human body with all the operations of all its cells you won't be sure whether a proposed treatment will work until you test it on something or somebody. Such a simulation is still MANY decades off, and that is assuming that the scientists along the way can butcher all the animals they require.
Fascist! He's fruitarian!
What, he eats the children of plants, who toil day and night making oxygen for him to breathe!!?
How barbaric!
I for one really miss 4:3 monitors. I just bought one that was VGA-only the other day mainly because it was cheap and 4:3.
I could care less for 16:9 screens. I don't mind letterboxing at all - it isn't like my viewable area is any less. In most settings the display is horizontally constrained. I couldn't put a wider monitor on my desk if I wanted to - it would waste too much space. However, above the monitor is nothing but 5 feet of empty space. I don't need to fill all that space, but I certainly don't mind filling something closer to 4:3 than 16:9.
For larger TVs I can see why I wouldn't want to waste the money on LCD surface that isn't used most of the time. However, that space gets plenty of use on my computer monitor...
Everyone involved with software development these days has surely heard of Ruby, and especially Ruby on Rails.
You must work at a company that sells software, or something. If I walked around my department (an IT department at a Fortune 500), and polled the department of ~75 people, I'd be surprised if more than about 3 had heard of Ruby. We use VB.NET for new stuff, but I'm sure we're still doing the odd upgrade in VB6.
Much of software development is a couple of forms on top of a database, and a few reports. For that sort of thing VB is adequate, and often the people doing the work barely understand object oriented languages, assuming they understand them at all.
The guy who coded the inventory application for your local appliance repair shop wasn't debating between taking a job there or at Facebook. More likely than not they were hired to fix appliances, not code.
Half the time IT is the unwitting force behind this sort of thing.
If somebody spent an hour with him and gave him the odd assistance, then chances are his application, while not pretty, would be far more effective and maintainable. However, that would be an act of ceding control, so typically IT will say "no backend databases or help for you" and proceed to try to tell the business that they should invest in a $500k development investment to basically do what they can already do with the hobbled-together solution. The business instead spends their money hobbling together yet another solution until the whole thing is no longer sustainable, and then somebody has to clean house.
The problem is the my-way-or-the-highway mentality that is very common in IT shops.
I wouldn't say that password-hashing is a best practice in my industry. Note, that my industry has nothing to do with making computer software, though it makes a lot of computer software in the process, and buys quite a bit from other companies who have incentive to deliver the features customers are looking for, and not the ones they should be looking for.
If I had to guess I'd imagine that the majority of systems at my company that store passwords do not hash them. At best they encrypt them, which is virtually useless as protection (but good luck explaining that to a PHB).