Without using the talk.origins links, I can say this: The fact that we cannot explain something is hardly evidence that God did it. It just means that we need to study it further.
I think the grandparent poster was asking something different. He wants to know how hard it is to create an evil binary that has the same hash as some preexisting non-evil binary, assuming that you have no control over the contents of the non-evil binary. The answer, as I understand it, is that this is still quite intractable. It's easy to create two *new* messages which collide, but it's very hard to create a message which collides with some specific existing message.
IMO, attacks like the one you describe are not actually very interesting. Signing executable code (including postscript) which you did not create yourself is asking for trouble, whether or not your hash is broken. Someone could just as easily write a program which behaves differently depending on, say, the current time. So, today you sign that check for 50 cents and tomorrow the same check -- still signed -- claims to be for $1,000,000. No collisions needed.
Do you know of any better examples of ways to exploit hash collisions?
No, I was working in the middle of the night because I'm weird. I often wake up late in the afternoon on Sunday (after being out late Saturday) and, rather than try to go to sleep early that night, I just stay up and work 4AM-noon Monday. Other times I will work late one day then only come in for a couple hours another day. That's just me, and Google has no problem with me doing that.
If I work more than 40 hours a week, it's only because I really enjoy what I'm doing. I have friends who work strictly 40 hours a week, and it has never hurt them. I have one friend who used to work 10 hours a day Monday-Thursday then took Fridays off. I'd probably do that too except then I'd have to buy food on Fridays.:)
Well, GLAT is supposed to be funny. They don't actually make you take it.:) And, yeah, some of the questions on there I couldn't answer. But, in reality, ability to answer brain-teasers isn't necessarily indicative of good programming skills.
I really couldn't say how "hard" it is to get in. There's a lot of competition, but there's also a lot of hiring going on. Personally, I just had a bachelor's degree with a good GPA and some open source projects and I didn't have much trouble. In any case, there's no reason not to apply; writing a cover letter and attaching your resume isn't that hard.:)
I work for Google. Sorry, but your post is misinformed.
all of these benefits... are only (generally) available to the upper brass and engineers
As far as I've seen, all the contractors, interns, etc. get the same access to the cafes and microkitchens as everyone else. In the middle of the night you'll often see some of the janitors enjoying a game of pool between emptying garbage cans. I have seen bus drivers -- who technically work for the bus company which runs our shuttles -- grabbing dinner in the cafe before going on their route. Some benefits are limited to full-time employees, but I have never heard of a benefit being limited to engineers.
they always hire their entry-level employees through a temp agency for the first year
I know many people who went straight from college to Google and I have never heard of this practice. I myself was considered "entry-level" and this did not happen to me. I do know one person who was a contractor before he became full-time, but this certainly isn't the norm.
Obligatory disclaimer: I don't speak for Google. What I write here are my own observations, not official Google policy, and it's possible I am just blissfully unaware of some other side of the company where things work differently.
I just played one of the FPS games in Super Monkey Ball, and frankly I was amazed at how natural it felt. Sure, it doesn't beat a mouse, but it's certainly much better than using an analog stick to aim.
My experience with most Wii games so far is that they can feel very awkward at first -- and if you are an experienced gamer, you may find this frustrating, because you feel like a beginner -- but after 10-20 minutes it feels totally natural.
Viruses do not need root access to look in your home directory, open up tax_return.pdf, and send it to someone who will steal your identity. Nor do they need root access to mail copies of themselves to everyone listed in your address book.
Administrator priveledges only protect your operating system files, which are probably the *least* valuable information on a single-user desktop since they are the easiest to replace.
For real security you would need to run every program in its own restricted user account. I do this (on Windows!), but I imagine you do not, since it is quite a pain in the ass and a lot of programs don't work. Long-term, the real solution to all this is to use capability-based security. Unfortunatley, neither Windows nor Mac OSX nor Linux implement this.
I would submit the fact that Wikipedia material usually appears much higher in Yahoo search results compared to Google.
First of all, Google does not demote competitors.
Second, I did some random test queries which I figured should produce Wikipedia results:
Wikipedia appeared at the same position on both engines for: [Eisenhower] (1), [LALR parser] (1), [Putin] (1), [Holy Roman Empire] (1), [elephant] (2)
Wikipedia was higher on Google for: [first amendment] (6,7), [Iran] (1,5), [physics] (8,11)
Wikipedia was higher on Yahoo for: [Linux] (3,12), [Scientology] (2,4), [Microsoft] (11,13), [Civil War] (3,5), [renaissance] (1,3)
So I guess in this totally unscientific test, Yahoo does put Wikipedia slightly higher than Google does, but I wouldn't call it "much higher". Do you have any better examples?
It's still my personal opinion that Wikipedia only makes Google better, so it would be pretty silly for Google to feel threatened by them. (I'm a Google engineer working on the search engine, but of course these are my personal opinions and not necessarily those of my employer.)
Wow, that's awful. Did you report this to your recruiter? It sounds like that interviewer needs to repeat the interview training. (It's also a silly thing to say. Google employs engineers of all ages.)
In general, www.google.com/jobs has a huge listing of openings. Many of them are generic openings looking to hire multiple people. Very few of them are looking for "gurus".
Yes it matters, because if 90% of the clicks are fraud, then you are spending 90% too much money on advertising.
Wrong. Google sells ads by auction. So, the price is determined by what people are willing to pay for it. If 90% of clicks turned out to be fraudulent and were filtered out, then people would just be paying 10 times as much for the remaining 10%.
The real problem is when click fraud is targetted at individuals, who end up getting 100% screwed.
(Also, if the ads are being displayed on some site other than google.com, then those publishers are getting screwed since they should be paid 10x more per click.)
If Google does a better job at helping people find things, more people will use Google, and thus there will be more people to advertise to, which means more money.
So, you're incorrect. Google does, in fact, make money by helping people find things.
Actually, it's a whole lot more complicated and interesting than you think. The idea is that videos which have been steadily popular for a long time shouldn't show up, but videos which have become popular recently should. So, you don't see the same old boring videos every day like you do with the top 100 list.
Chinese people are free to use www.google.com (rahter than.cn) to get uncensored results. This option has always been available, and for a long time it was the only way for Chinese users to access Google. Of course, if the Chinese "Great Firewall" detects anything it doesn't like in the results, it will block the page and prevent your IP from accessing google.com for some amount of time.
So, if you were a Chinese user, and your options were between:
1) Use a search engine where, if the results contain anything sensitive, you will simply be cut off from it. 2) Use a search engine where, if the results contain anything sensitive, those results will be removed and replaced with a note indicating that some results were removed.
A WoW server certainly does not run on a single machine.
However, the dynamically-redistributing system you suggest would be extremely difficult to write and debug. The game would probably still be in beta. It also wouldn't be worthwhile, since after the server population passes a certain point, adding more people degrades the gameplay. It's no fun playing on a server where the mobs you need to kill are always dead already and there's high-level players of the opposite faction everywhere trying to gank you.
Blizzard really just needs to add more servers. They've been doing so, but apparently not fast enough.
I mostly agree, but there's one problem: The messages put out by the government should identify themselves as being from the government. They should not be attributed to supposedly unbiased third parties, or otherwise attempt to hide their source. Wouldn't you agree?
Running AJAX on Slashdot would be like running a newsreader that fetches all messages _and_ their content on USENET.
There is no requirement that an AJAX client receive "everything". That's silly. When you use Google Maps, your browser does not download a map of the entire words. It only downloads what you're looking at. When you use GMail, your browser does not download your entire e-mail history. It only downloads the e-mails you click on.
In reality, AJAX applications typically make the same pattern of requests to the server as simple HTML applications (as I demonstrated in my example), except that the responses contain only the relevant new data rather than an entirely new copy of the web page.
All that additional code and complexity for perhaps 20% bandwidth gain on markup costs?
The page I'm looking at right now is 5k in size. Your post itself is around 2k. An AJAX client would not have to re-download the page layout when I click to read your post; it would only download your actual post text. That's at least a 50% savings. However, most posts are significantly shorter than yours, while the page layout remains about the same size, making the savings even greater.
Also, when I clicked the "reply" link under your post, Slashdot had to send me a completely new copy of the entire page, including your post, with a reply box underneath. An AJAX client would not even have had to make a request to the server.
I'd conservatively estimate at least a 50% reduction in total bandwidth usage site-wide if Slashdot were entirely AJAX-based.
Of course, the real advantage of AJAX is the ability to provide a better user interface, not the bandwidth savings.
Slashdot Mirror
So... Every single one of these is written by the same guy?
Without using the talk.origins links, I can say this: The fact that we cannot explain something is hardly evidence that God did it. It just means that we need to study it further.
AdWords and AdSense probably qualify as "huge".
I think the grandparent poster was asking something different. He wants to know how hard it is to create an evil binary that has the same hash as some preexisting non-evil binary, assuming that you have no control over the contents of the non-evil binary. The answer, as I understand it, is that this is still quite intractable. It's easy to create two *new* messages which collide, but it's very hard to create a message which collides with some specific existing message.
IMO, attacks like the one you describe are not actually very interesting. Signing executable code (including postscript) which you did not create yourself is asking for trouble, whether or not your hash is broken. Someone could just as easily write a program which behaves differently depending on, say, the current time. So, today you sign that check for 50 cents and tomorrow the same check -- still signed -- claims to be for $1,000,000. No collisions needed.
Do you know of any better examples of ways to exploit hash collisions?
OK, then, I guess some positions are just very different than others.
No, I was working in the middle of the night because I'm weird. I often wake up late in the afternoon on Sunday (after being out late Saturday) and, rather than try to go to sleep early that night, I just stay up and work 4AM-noon Monday. Other times I will work late one day then only come in for a couple hours another day. That's just me, and Google has no problem with me doing that.
:)
If I work more than 40 hours a week, it's only because I really enjoy what I'm doing. I have friends who work strictly 40 hours a week, and it has never hurt them. I have one friend who used to work 10 hours a day Monday-Thursday then took Fridays off. I'd probably do that too except then I'd have to buy food on Fridays.
Well, GLAT is supposed to be funny. They don't actually make you take it. :) And, yeah, some of the questions on there I couldn't answer. But, in reality, ability to answer brain-teasers isn't necessarily indicative of good programming skills.
:)
I really couldn't say how "hard" it is to get in. There's a lot of competition, but there's also a lot of hiring going on. Personally, I just had a bachelor's degree with a good GPA and some open source projects and I didn't have much trouble. In any case, there's no reason not to apply; writing a cover letter and attaching your resume isn't that hard.
I work for Google. Sorry, but your post is misinformed.
As far as I've seen, all the contractors, interns, etc. get the same access to the cafes and microkitchens as everyone else. In the middle of the night you'll often see some of the janitors enjoying a game of pool between emptying garbage cans. I have seen bus drivers -- who technically work for the bus company which runs our shuttles -- grabbing dinner in the cafe before going on their route. Some benefits are limited to full-time employees, but I have never heard of a benefit being limited to engineers.
I know many people who went straight from college to Google and I have never heard of this practice. I myself was considered "entry-level" and this did not happen to me. I do know one person who was a contractor before he became full-time, but this certainly isn't the norm.
Obligatory disclaimer: I don't speak for Google. What I write here are my own observations, not official Google policy, and it's possible I am just blissfully unaware of some other side of the company where things work differently.
I just played one of the FPS games in Super Monkey Ball, and frankly I was amazed at how natural it felt. Sure, it doesn't beat a mouse, but it's certainly much better than using an analog stick to aim.
My experience with most Wii games so far is that they can feel very awkward at first -- and if you are an experienced gamer, you may find this frustrating, because you feel like a beginner -- but after 10-20 minutes it feels totally natural.
Viruses do not need root access to look in your home directory, open up tax_return.pdf, and send it to someone who will steal your identity. Nor do they need root access to mail copies of themselves to everyone listed in your address book.
Administrator priveledges only protect your operating system files, which are probably the *least* valuable information on a single-user desktop since they are the easiest to replace.
For real security you would need to run every program in its own restricted user account. I do this (on Windows!), but I imagine you do not, since it is quite a pain in the ass and a lot of programs don't work. Long-term, the real solution to all this is to use capability-based security. Unfortunatley, neither Windows nor Mac OSX nor Linux implement this.
Since the security restrictions of OS X prevent the automatic spread of viruses
What security restrictions might those be?
I would submit the fact that Wikipedia material usually appears much higher in Yahoo search results compared to Google.
First of all, Google does not demote competitors.
Second, I did some random test queries which I figured should produce Wikipedia results:
Wikipedia appeared at the same position on both engines for: [Eisenhower] (1), [LALR parser] (1), [Putin] (1), [Holy Roman Empire] (1), [elephant] (2)
Wikipedia was higher on Google for: [first amendment] (6,7), [Iran] (1,5), [physics] (8,11)
Wikipedia was higher on Yahoo for: [Linux] (3,12), [Scientology] (2,4), [Microsoft] (11,13), [Civil War] (3,5), [renaissance] (1,3)
So I guess in this totally unscientific test, Yahoo does put Wikipedia slightly higher than Google does, but I wouldn't call it "much higher". Do you have any better examples?
It's still my personal opinion that Wikipedia only makes Google better, so it would be pretty silly for Google to feel threatened by them. (I'm a Google engineer working on the search engine, but of course these are my personal opinions and not necessarily those of my employer.)
Wow, that's awful. Did you report this to your recruiter? It sounds like that interviewer needs to repeat the interview training. (It's also a silly thing to say. Google employs engineers of all ages.)
This seems to be what you're looking for. That's just for Mountain View; you should also check New York, Seattle/Kirkland, or whatever other office you're interested in.
In general, www.google.com/jobs has a huge listing of openings. Many of them are generic openings looking to hire multiple people. Very few of them are looking for "gurus".
On the contrary, Google loves Wikipedia. Wikipedia provides excellent content for Google's index. Why else would Google actively support them?
None of those things are outlawed in the United States. If you believe otherwise, please cite your sources.
Wrong. Google sells ads by auction. So, the price is determined by what people are willing to pay for it. If 90% of clicks turned out to be fraudulent and were filtered out, then people would just be paying 10 times as much for the remaining 10%.
The real problem is when click fraud is targetted at individuals, who end up getting 100% screwed.
(Also, if the ads are being displayed on some site other than google.com, then those publishers are getting screwed since they should be paid 10x more per click.)
If Google does a better job at helping people find things, more people will use Google, and thus there will be more people to advertise to, which means more money.
So, you're incorrect. Google does, in fact, make money by helping people find things.
After hurricane Katrina, rescue workers used Google Earth to navigate while looking for survivors, since they couldn't very well go by road signs.
That would not find videos which have been around for a year but just became popular yesterday.
Actually, it's a whole lot more complicated and interesting than you think. The idea is that videos which have been steadily popular for a long time shouldn't show up, but videos which have become popular recently should. So, you don't see the same old boring videos every day like you do with the top 100 list.
Google already does that. It's called google.com.
.cn) to get uncensored results. This option has always been available, and for a long time it was the only way for Chinese users to access Google. Of course, if the Chinese "Great Firewall" detects anything it doesn't like in the results, it will block the page and prevent your IP from accessing google.com for some amount of time.
Chinese people are free to use www.google.com (rahter than
So, if you were a Chinese user, and your options were between:
1) Use a search engine where, if the results contain anything sensitive, you will simply be cut off from it.
2) Use a search engine where, if the results contain anything sensitive, those results will be removed and replaced with a note indicating that some results were removed.
wouldn't you choose option 2?
A WoW server certainly does not run on a single machine.
However, the dynamically-redistributing system you suggest would be extremely difficult to write and debug. The game would probably still be in beta. It also wouldn't be worthwhile, since after the server population passes a certain point, adding more people degrades the gameplay. It's no fun playing on a server where the mobs you need to kill are always dead already and there's high-level players of the opposite faction everywhere trying to gank you.
Blizzard really just needs to add more servers. They've been doing so, but apparently not fast enough.
I mostly agree, but there's one problem: The messages put out by the government should identify themselves as being from the government. They should not be attributed to supposedly unbiased third parties, or otherwise attempt to hide their source. Wouldn't you agree?
Running AJAX on Slashdot would be like running a newsreader that fetches all messages _and_ their content on USENET.
There is no requirement that an AJAX client receive "everything". That's silly. When you use Google Maps, your browser does not download a map of the entire words. It only downloads what you're looking at. When you use GMail, your browser does not download your entire e-mail history. It only downloads the e-mails you click on.
In reality, AJAX applications typically make the same pattern of requests to the server as simple HTML applications (as I demonstrated in my example), except that the responses contain only the relevant new data rather than an entirely new copy of the web page.
All that additional code and complexity for perhaps 20% bandwidth gain on markup costs?
The page I'm looking at right now is 5k in size. Your post itself is around 2k. An AJAX client would not have to re-download the page layout when I click to read your post; it would only download your actual post text. That's at least a 50% savings. However, most posts are significantly shorter than yours, while the page layout remains about the same size, making the savings even greater.
Also, when I clicked the "reply" link under your post, Slashdot had to send me a completely new copy of the entire page, including your post, with a reply box underneath. An AJAX client would not even have had to make a request to the server.
I'd conservatively estimate at least a 50% reduction in total bandwidth usage site-wide if Slashdot were entirely AJAX-based.
Of course, the real advantage of AJAX is the ability to provide a better user interface, not the bandwidth savings.