January 30, 2004

A privacy hole in Orkut?

Like lots of other techies, my friends have sucked me into the Orkut vortex. I'm not sure I'm that thrilled with it, but here's a complaint I don't quite get:
Wanna see a big phat privacy hole on Orkut? Go to messages. Click compose. Click "friends and friends of friends." Click next. Copy & paste all of your friends and their friends' email addresses.

Oh, but don't worry, you can't delete either your account, your photos or any of your friends! So, do you really trust the friends of those friends who keep adding everyone and their mother to the network?

Don't worry, when everyone gets the hang of it, you'll get to deal with your Orkut inbox because everyone in any community you're in, or any friends of friends can send you messages there. As if you didn't get enough virus mail this week.

Maybe I'm just not imaginative enough, but I don't see what the big deal is. First of all, noone's making you put your main e-mail address on Orkut. Second it's not like my email is a big secret. It's on my web site in several locations, so anyone who wants it can screen scrape it off there. As long as other people can access my friend's lists--which is kind of the point right?--then it doesn't exactly take a rocket scientist to dig up my email address. Now, it's true that the feature that lets you spam the friends of your friends is kind of annoying, but that's a different problem from them leaking your email address.

Posted by ekr at 09:07 PM | Comments (26) | TrackBack

More reasons to doubt Diebold's voting system

So, the State of Maryland commissioned another audit of the Diebold voting system [*]. (via Ed Felten). The results aren't exactly encouraging:
Maryland has bought more than $55 million worth of the machines. Georgia has chosen Diebold machines for elections statewide, and they have been chosen by populous counties in California and Ohio, among other states.

The authors of the report said that they had expected a higher degree of security in the design of the machines. "We were genuinely surprised at the basic level of the exploits" that allowed tampering, said Mr. Wertheimer, a former security expert for the National Security Agency.

William A. Arbaugh, an assistant professor of computer science at the University of Maryland and a member of the Red Team exercise, said, "I can say with confidence that nobody looked at the system with an eye to security who understands security."

Worse yet...

And the server computers do not have the latest protection against the security holes in the Microsoft operating systems, and they are vulnerable to hacker attacks that would allow an outsider to change software, the group found.

Really makes you think it's a good idea that have voting machines accessible wirelessly, eh?

Posted by ekr at 08:41 PM | Comments (3) | TrackBack

Why vote for the lesser of two evils...

Ronnie James Dio for president.
io for America is pleased to announce the addition of Merlin Mann as Senior Technical Minion for Ronnie's Campaign '04. He arrives to fill the position left by recently-departing campaign consultant, Anil Dash.

"When there's lightning," said Dr. Dio, reached for comment in his room at a motor lodge outside Nashua, New Hampshire, "you know, it always brings me down."

Dash, heavily criticized by Dio supporters for minimizing the "angry" side of Dr. Dio's carnate human form, could not be reached for comment.

"People say Dio's angry," Mann said, "or 'He's got lots of anger' or 'Boy, that little fella sure seems angry.' Well, I'm here to tell you, Ronnie James Dio is very goddamned angry. He's angry about schools, he's angry about veterans' benefits, and he's angry about the unchecked proliferation of evil women and dragons in America today.'"

Dio's campaign is in high gear preparing for next Tuesday's raft of primaries; he's next scheduled to appear on Friday morning at a Scottish Rite pancake breakfast in Scottsdale, Arizona.

Link via Colby Cosh.

Posted by ekr at 08:21 AM | Comments (1) | TrackBack

January 29, 2004

Jail substitutions

According to this article, there's this Danish black market in getting other people to serve your jail sentence for you [*]. Criminal activity or genius of capitalism? You be the judge.
Posted by ekr at 10:24 AM | Comments (2) | TrackBack

January 28, 2004

Can't we just buy off the farmers?

So, the US spends between 15 and 25 billion dollars a year on farm subsidies [*]. Like all price subsidies, these subsidies distort the market, but farm subsidies are particularly pernicious because they price poor African farmers out of the market [*]. [*]. So, basically, American farm subsidies are a big transfer payment program from pretty much everyone else in the world to American farmers.

If I were king of the world, I'd just cancel farm subsidies entirely, but I understand that that's politically impossible. Kevin Dick suggested an alternate strategy to me: we buy off the farmers by giving them a lump sum payment that's equivalent to the subsidy that they would have gotten. This payment wouldn't be contingent upon whether the farmers farmed or not and so the market price would relax to its natural level. The net present value of a $25 billion dollar/year subsidy is about $750 billion, so a one-time payment that size should do the job. That sounds like a lot of money--and it is--but remember that that's equivalent to what we're paying already. At least this way we wouldn't be starving poor African farmers in the bargain.

Posted by ekr at 06:44 PM | Comments (96) | TrackBack

In defense of Ikea

Check out Adam Greenfield's defense of Ikea and Starbucks (via BoingBoing):
I must hear some version of this spiel once a month, generally from some self-consciously leftie male between the ages of sixteen and twenty-two desperate to prove his authenticity, present his down-with-the-people, fuck-the-Man bona fides. This despite the fact that Ikea was explicitly founded on the premise of providing well-designed furniture to the masses at affordable prices - a premise that the company still largely delivers on. (If I have a quibble, it's with quality, not price.)

You know what? I'm done with it. If your life is mediocre, I promise you, Ingvar Kamprad didn't make it that way. You did. And if you're so desperate for your own soixante-huit moment that you can sit there with a straight face and tell me that you're being oppressed by flat-packable pine furniture with goofy pseudo-Scandinavian names, I'd advise you to spend a few days working with child slaves in the Sudan, or something.

Indeed. Have you tried going furniture shopping lately? Even now, there are basically three kinds of furniture at least in my price range: crap, massively overpriced (and frankly over-ornate and ugly) but ostenstibly classy and Ikea rip-offs. That's it. When Ikea moved into my neighborhood I was so happy I almost cried. Finally I could buy more book shelves and move my books off the floor and out of the boxes in which they had been hiding for so long. Even my books were so happy they nearly cried.

I think that Adam gets the psychology wrong a little later in the article, though:

The dynamic at work in both cases is one many of us might recognize from bad relationships: when a deeply wounded person suffering from low self-esteem finally fights back against the various agents of their distress, very often it's the closest, most sympathetic soft target they lash out at first, in defiance of all logic (or justice).

Not the absent father, but the present lover. It feels like the same neurosis at work with young activists of the No Logo stripe: never ADM, General Dynamics, Monsanto, but Nike and Ikea and Starbucks. And never mind that each of these latter firms is, to a greater or lesser degree, founded on what used to be known as progressive principles, or is to a greater or lesser degree responsive to the demands of a politically and socially conscious audience.

I actually get to hear on a fairly regular basis that Monsanto is evil (the usual litany of sins is Round-up Ready crops, the Terminator gene, and genetically modified crops in general). Now, to my mind, ADM is by far the worst offender of the three (I'm actually in favor of GM but don't even get me started on putting ethanol in gasoline) but they never seem to take the rap. I don't think it's cause they're faceless and invisible but rather:

  1. They're pitched as being good for the environment.
  2. They transfer money from the urbanized coastal regions (which is where you probably live if you're a leftie 16-22) and to the the farming states, which assuages one's sense of middle-class guilt.
Now, it's true that the environmental value is questionable at best and the money mostly goes to faceless megacorps instead of struggling farmers, but knowing that would require actual analysis rather than emotional reaction, which, as Adam has pointed out, is the problem in the first place.
Posted by ekr at 09:44 AM | Comments (45) | TrackBack

January 27, 2004

I'm cheap, therefore I spam

The worst part about the collateral damage caused by the myDoom worm is that it's totally unnecessary. So, you want to punish SCO for being jerks about Linux.... Misguided, but OK. You want to do this with a DDoS attack... Illegal, morally questionable, probably ineffective, but whatever. But even if a DDoS is our plan, a worm isn't the coolest way to do it. My sources inform me that one can purchase DDoS attacks from Black Hats. The price ranges from barter and tens of dollars to upwards of a few thousand dollars. No need to blow up people's mail servers at all. That is, if what you care about is actually doing damage to your target versus just inflicting random damage on a bunch of innocent people. Heck, it would be less damaging to just steal the required few thousand dollars and then pay for the attack. I'm quite certain that myDoom is costing the Internet as a whole a lot more than that.
Posted by ekr at 08:54 PM | Comments (3) | TrackBack

Collateral damage

So, you may have heard that aside from filling your mailbox with crap, the myDoom worm is going to be mounting a DDoS attack on SCO starting on February 1 [*], no doubt in revenge for SCO's anti-Linux activities.

I've just got one question. What asshat thought this was a good idea? Fine, so you hate SCO. I get that. You want to harm them. I get that too. But you're also harming lots of totally innocent people--users and operators alike--by floodingthe network with worm traffic. If you want to go after SCO, couldn't you find some way of doing it that doesn't screw the rest of us over as well? Idiots.

Posted by ekr at 10:03 AM | Comments (22) | TrackBack

What does that new weight loss study mean?

So, there's a lot of coverage of the new Arkansas study in Archives of Internal Medicine (which I can't read online right now). Here's the introductory paragraph from the UAMS press release [*]:
Researchers at the University of Arkansas for Medical Sciences (UAMS) show in the journal Archives of Internal Medicine today that older people can lose weight on a diet rich in complex carbohydrates, even if they eat until they are satisfied and do not reduce the calories they consume.

Or from CNN: [*]

In the midst of the low-carb craze, a new study suggests that by eating lots of carbohydrates and little fat, it is possible to lose weight without actually cutting calories -- and without exercising, either.

Now, as I said, I can't get at the original article, but based on WebMD's rather good summary of the results, that's not what the data shows at all. Here's the key paragraph:

When allowed to eat all they wanted, those eating the high-carb, high-fat diet had about 2,825 calories a day. The high-carb, low-fat dieters that didn't exercise ate about 2,250. The high-carb, low-fat exercisers ate about 2,400 calories.

In other words, the reason that the people on the high-carb diet lost weight is that the high-carb diet is less calorically dense than the high-fat diet, at least per unit of satiation. There doesn't seem to be any evidence in this study that the macronutrient mix is important if you control for caloric intake.

I can see how reporters might be getting confused because for some reason the researchers almost seem to be trying to obscure this point:

"The whole idea that you could lose weight without reducing energy intake flies in the face of 100 years of data," Foster said.

Lead author William Evans of the University of Arkansas for Medical Sciences stood by his findings.

"Calories in minus calories out does not always determine the amount of weight loss," Evans said. "This is because we metabolize fats and carbohydrates very differently."

That may be true, but as far as I can tell, this study doesn't show anything of the kind. It's not clear to me why Evans wants to suggest that it does. I'll update things if I can get my hands on the actual paper and it sheds some light on the topic.

Posted by ekr at 08:19 AM | Comments (20) | TrackBack

January 26, 2004

Great, another worm, and this one uses ZIP files

You've no doubt noticed that you're getting all sorts of worm-source email [*]. As I've mentioned before, FreeBSD is immune to this kind of worm but that doesn't mean my mailbox isn't full of worm mail so I use a Postfix filter to just reject all the worm's email [*]. Unfortunately, the filters I use work by removing the active content types that the worms transmit themselves as. That works great when the payload is an EXE since I shouldn't be getting them anyway, but unfortunately, this worm's payload appears to be a ZIP file, and people sometimes send me those. Now, I can tune my spam filters to reject these payloads, but I'm not quite brave enough to throw out everything my filters think is spam, so they're still filling up my disk in the spam folder. Outstanding.
Posted by ekr at 08:03 PM | Comments (3) | TrackBack

Am I a crook?

The good news is that the other day I found my copy of Highway 61 Revisited, which has been missing for a year or two. It was stuck behind my old computer. The bad news is that I appear to have dropped something on it and it was thus cracked and totally worthless.

From a technical perspective, this isn't a problem. A friend of mine (name withheld to protect the guilty) has a copy and lent it to me long enough to rip. I then burned it onto a CD which I plan to put into the CD case (if can I ever find that. How do you think the CD got broken?). But then I got to thinking. Is this legal? A little net searching doesn't exactly yield what you'd call a definitive answer.

Worse yet, it's not even clear that I could legally have made a backup copy and then burned a new CD with that. Here's the EFF's discussion of the issue:

The legality of taping and ripping CDs involves interpretation of a number of overlapping statutes and court decisions. As a result, sometimes there aren't clear answers and lawyers disagree about what's legal, based on differing interpretations of the law. This is a brief explanation of the issues and arguments.

Surprisingly, the legal status of "ripping" (making a MP3 format copy of a CD you own), and burning (making a CD-R copy of a CD you own), is not clear-cut. However, many lawyers believe these activities are legal if done for personal, non-commercial uses under the copyright doctrine of "fair use".

First, they argue that Congress intended that it would be legal for consumers to make personal noncommercial home recordings of pre-recorded music and music broadcasts, when it passed amendments to the Copyright Act. They point to comments made by Congress in 1971 which specifically addressed the home taping issue.

Second, many lawyers believe that making a CD-R back-up copy of a CD you already own for your personal use is "fair use". They also believe that conversion of music on CD to MP3 format or "space-shifting", for personal, noncommercial use, is analogous to "time-shifting'", (using a VCR to record copyrighted tv programs for later viewing). The Supreme Court stated that time-shifting was fair use, when done for private noncommercial purposes, in the 1984 Sony Betamax decision ( Sony Corp. of America v. Universal City Studios et al, 464 US 417, 455). A 1999 California Court of Appeals decision in a case brought by the Recording Industry Association of America against Diamond Multimedia, the maker of the Rio MP3 player, supports this view of space shifting. ( R.I.A.A. v. Diamond Multimedia Systems, Inc., 180 F. 3d 1072 at 1079 (9th Circ US Court of Appeals).

There is a category of devices (including mini-disc players, stand-alone audio CD recorders and DAT recorders) and media (including the more expensive "audio" CD-Rs) for which different rules may apply. These items fall within the definitions of "digital recording devices" and "digital recording mediums" under the Audio Home Recording Act of 1992. The AHRA allows you to make analog or digital copies of a CD you own for noncommercial use on devices and mediums that comply with AHRA, without fear of legal action (see section 1008 of AHRA). These rules are quite complex, and most importantly, do not cover personal computers (so don't apply to burning and ripping done on personal computer).

Check out that last sentence. Is it really possible that it's actually illegal for me to rip the CDs in my own collection onto my own computer? All I can say to that is "Come and get me, Copper! I tore the tag off my mattress!" [0]

[0] apologies to Philip Roth.

Posted by ekr at 09:54 AM | Comments (54) | TrackBack

Incentive failure in antibiotic development?

Reuters health has an article about antibiotic resistant bacteria and the emptiness of the pipeline for new antibiotics. Now, the fact that there are a lot of resistant strains and the pipeline is kind of empty isn't really news, but about halfway down the article there's something interesting:

"That scared a lot of drug companies because it still has not been approved in the United States," said Tally. "The other thing that is scaring off big pharma is that if you do have a drug against resistant strains of bacteria, hospitals restrict use of it. They hold it in reserve, which cuts down on sales."

Now, in an ordinary market this would be ok. The obvious conclusion would be that the revealed preference of the customers is that they don't really want drugs for resistant strains and so it's a good thing that companies aren't investing much in R&D on them. But in this case I'm not sure that's a good analysis. It's enormously expensive to bring a new drug to market and it takes a very long time to go from the point where you have a new compound to the point where it's approved, on the market, and doctors are comfortable using it. If it's going to add another five years before there's enough resistance to make it a first line drug, the market may just not be responsive enough to prevent a real gap in antibiotic coverage.

I don't know if this is actually the case, but it's worth looking into. I sure don't want to go back to the days when people died of ear infections.

Posted by ekr at 09:39 AM | Comments (10) | TrackBack

January 25, 2004

Some other fantasy classics

Here are some other fantasy novels I recommend.

Susan Cooper's The Dark is Rising novels. There's a war going on between the Light and the Dark. Will Stanton is the last of the Old Ones to be born--simultaneously a powerful force for good and a teenager, but either way with an important part in saving the world.

Lloyd Alexander's Chronicles of Prydain. Basically a coming of age story set against a background of a decade's long battle between good and evil.

The above two serieses are classic children's novels, but I've reread them recently and they hold up well.

As far as adult stuff goes, I recommend:

  • Steven Brust
  • Emma Bull
  • Ellen Kushner
    • Thomas the Rhymer is a retelling of the True Thomas myth. Thomas is a medieval bard who kisses the Queen of Elfland. The price he must pay is to serve her for 7 years and cannot speak to anyone else during that time.
    • Swordspoint is hard to characterize. It's a romance in a sort of never-existed semi-medieval city.
  • Pamela Dean's Tam Lin. This is probably the best known of the fairy tale retelling series edited by Jane Yolen. It's a novelization of the song Tam Lin (made famous by Fairport Convention on their Liege and Lief album. Highly recommended.). It's not my favorite, but it's not bad and it's one of the all-time favorites of one of my friends, so...

If you read all this stuff, that ought to be enough to keep you busy for a while.

Posted by ekr at 08:56 PM | Comments (25) | TrackBack

Book Recommendation: Nobody's Son

I'm not normally much for fantasy, but there are a few fantasy books that I come back to again and again. One of these is Sean Stewart's Nobody's Son. Unlike so much genre fiction, Stewart really cares about character and Nobody's Son uses the fantasy setting to tell a story that's really about the relationships between fathers and sons and between men and women. Nobody's Son is about what happens after "Happily ever after", because, of course, that's never really the end of the story.

Like the classics, Nobody's Son begins with a young man's quest to break the curse that's hung over the land for generations.

You come with no spell sheaf, no flight of impossibles. Many might men that were flesh and fearless i' th' sun are clay now: their soul-pots cracked and ground to dust." Stroking Shade, Husk met his eyes, "What can tha do that they could not?"

How many times had Mark asked himself the same question? "Maybe I can't. Maybe I'll die." He twisted the haywire between his fingers, then stuffed it abrubtly back in his pocket. "I go because I must. This is what has been given to me. This is my only gift. I am no general, no lover, no wizard no duelist, no hero nor thief. I am only Shielder's Mark, who waited all his life to go to the Ghostwood, and went."

Unlike in the classics, it turns out that breaking the curse doesn't make everything better like magic.

Gail and Lissa slept in one room, Mark and Val in the other. The long day and the mulled wine had Val snoring softly the instant his head touched the pillow.

Mark was not so lucky.

Hush little soldier ...

Like a mill-wheel the lullaby turned and turned within his heart, each turn bringing up a new wash of grief.

Part of it was Janey the innwife, of course: singing for some daughter lost or sick or fallen. Many a mother had such a ghost to haunt her.

But the grief ran deeper still.

It was his mother's voice that sang the song, Mark realized. His mother singing that song to him ... while in the background his father made to go.

A silver sword to keep...

He couldn't find his father's face.

This memory was like all the rest: angry footsteps, a clattering shield, part of a leg walking by, a man with his back to Mark's bed, bending over to stow something in his pack.

Tension like a wire round his heart.

And in the air his mother's song, trying to soothe him, trying to make him go to sleep.

Make him go to sleep so they could fight. And it was rage that stiffened your dad's back, rage that made your mother's voice tremble as she sang.

And you always knew it. You never told yourself before. But you've always known, haven't you.

Always.

His mother was willing him to sleep and he was a good boy and he tried to do what she wanted. But after he closed his eyeas the voices would go outside; hers mostly, rising and falling outside their cottage walls like a bitter wind.

... time to go to sleep.

So sad. So sad a song.

He lay on his back and stared up at the darkness. "What's happening to me?" he whispered.

For something moved inside of him. All his life he'd been leather-tough, stone patient, fierce as fire. He took pride in knowing every warp and grain of his own character. He thought he knew his heart like a house he'd made himself: the good and the bad together.

But something had changed.

He'd barely been scratched at the Red Keep, but he was bleeding to death inside. T'awd Mark's dying, dying. It's like when you think you've woken in your own bed, but you're still asleep: everything you thought you knew is strange and witched w' shadows. The house he'd made of himself was full of long, empty passages he could not remember, and dark cornrs that had never seen the light. A wild, dark wind blew into his heart.

When had he forgotten that terrible lullaby? How long had he known that his mother was biting back her fury and willing him to sleep? How many years had wire been cutting into his heart?

How did you forget everything that mattered?

Nobody's Son is Stewart's second novel and the cracks show through occasionally. The writing is a bit clunky in places and a few of the characters feel like they could come out of a Lloyd Alexander book. On the other hand, I loved the Lloyd Alexander books so much as a child that I think of that more as praise than criticism.
Posted by ekr at 07:42 PM | Comments (2) | TrackBack

January 24, 2004

Identifying stuff from RFID tags

I caught the KQED Forum program about RFID tags the other day. One of the arguments made for why this isn't a privacy threat was the claim that the RFID tags just contain opaque identifiers and that without access to the directory you wouldn't be able to learn anything useful. I don't buy this argument, for two reasons:
  1. This kind of information often leaks.
  2. It's not clear how the numbers are assigned. One obvious way to do it is to give every manufacturer a range of numbers. The natural thing for the manufacturer to do is to subdivide the range for each product line. So, even if you don't know exactly what each number means, you can learn a lot from the structure of the number.
  3. Even if you don't know what any given identifier means, it's still a unique tag, so you can link individual's actions. [0]

It's certainly possible to design identifier systems that protect privacy, using rocket science crypto, but I don't see any evidence that the manufacturers are doing that.

[0] It appears that each item gets a unique id, so any two packages of even the same item have different ids. Even if these are just item-type identifiers like bar codes, the exact constellation of identifiers that any given person has on them is going to be unique if enough different items are tagged.

Posted by ekr at 07:01 PM | Comments (82) | TrackBack

The flu and the buffet line

Now that I'm a little healthier and my IQ is approaching normal levels, my thoughts have turned to ethics, namely the ethical responsibilities that my illness imposes on me. The particular question I have is: what are the ethical implications of going to Fresh Choice when I'm sick?

For those who don't know Fresh Choice, it's a standard buffet restaurant where you serve yourself. Everything is served with tongs, so I'm not actually touching anyone's food, but there are a number of items (muffins, pizza, bread) that are intended to be eaten by hand, so people who don't wash their hands after serving themselves and before eating are presumably infecting themselves with a fairly nasty flu strain.

The Self-Interest Theory
If we subscribe to Parfit's self-interest theory "S", then I should do what will make things go best for me. If I would be happiest if I eat at Fresh Choice, then what's the problem? If other people don't like it, that's their lookout.

The Golden Rule
Of course almost noone subscribes to a theory as extreme as S. On the extreme opposite side we have the Golden Rule (either in the classic form or the negative form attributed to Hillel). If one subscribes to the Golden Rule, it's clear that going to the buffet line is fairly questionable behavior. I'd certainly much rather that other people not go contaminate my buffet utensils when they're sick, so I should do the same. Nothing complicated here.

The Utilitarian Perspective
On the other hand, if you're a utilitarian, life is a lot more complicated. I rather like eating at Fresh Choice. Obviously, I'm imposing some negative externalities on the other diners, but it's not clear how large those externalities are. Remember that the flu is an epidemic and so there are probably lots of other people who are sick and serving themselves here. With that in mind, it's not clear that my marginal contribution to the viral exposure of other diners is actually increasing their risk very much. It would be different if I had Ebola or something that was rare.

Assumption of Risk and Due Care
Finally, we have to consider the question of assumption of risk. You know and I know that people go to the buffet when they're sick. Therefore, it's reasonable to take precautions if you don't want to get sick during flu season. People who don't do that (wash their hands before eating, get the flu shot, etc.) have assumed the risk of getting sick and don't have grounds to complain.

Not so easy to do the right thing, is it?

Posted by ekr at 02:27 PM | Comments (6) | TrackBack

January 23, 2004

Book recommendation: Hyperion

While I was sick this week, I've been rereading Dan Simmons's Hyperion. Hyperion is far future SF of wide scope loosely modelled on the Canterbury Tales.

What's unique about Hyperion is the depth and richness of the universe. Simmons uses all the standard science fiction tropes, FTL travel (though still fairly slow), instant teleportation (via devices called farcasters), AI (in the form of the independent AI TechnoCore), but really explores what people would do with this kind of technology:

Notes for a sketch of life in the Hegemony:

My home has thirty-eight rooms on thirty-six worlds. No doors: the arched entrances are farcaster portals, a few opaqued with privacy curtains, most open to observation and entry. Each room has windows everywhere and at least two walls with portals. From the grand dining hall on Renaissance Vector, I can see the bronze skies and the verdigris towers of Keep Enable in the valley below my volcanic peak, and by turning my head I can look through the farcaster portal and across the expanse of white carpet in the formal living area to see the Edgar Allan Sea crash against the spires of Point Prospero on Nevermore. My library looks out on the glaciers and green skies of Nordholm while a walk of ten paces allows me to descend a short stairway to my tower study, a comfortable, open room encircled by polarized glass whcih offers a three-hundred-sixty-degree view of the highest peaks of the Kushpat Karakoram, a mountain range two thousand kilometers from the nearest settlement in the easternmost reaches of the Jamnu Republic on Deneb Drei.

The huge sleeping room Helenda and I share rocks gently in the boughs of a three-hundred-meter Worldtree on the Templar world of God's Grove and connects to a solarium which sits alone on the arid saltflats of Hebron. Not all of our views are of wilderness: the media room opens to a skimmer pad on the hundred and thirty-eighth floor of a Tau Ceti Center arctower and our patio lies on a terrace overlooking the market in the Old Section of bustling New Jerusalem. The architects, a student of the legendary Milton De-HaVre, has incorporated several small jokes into the house's design: the steps go down to the tower room, of course, but equally droll is the exit from the eyrie which leads to the exercise room on the lowest level of Lusus's deepest Hive, or perhaps the guest bathroom which consists of toilet, bidet, sink and shower stall on an open, wall-less raft afloat on the violet seaworld of Mare Infinitus.

There are actually four books in the Hyperion series. The first three (the second two are "The Fall of Hyperion" and "Endymion") are fairly strong and just as inventive as Hyperion. The last, "The Rise of Endymion", has some good packages but goes off the rails a bit, especially towards the end. However, I strongly recommend that you at least read Hyperion.

Posted by ekr at 07:57 PM | Comments (39) | TrackBack

Finally, dextromethorphan pills

I've been doing a lot of coughing lately, so I'm pretty familiar with the OTC anti-cough technology. The standard cough suppressant is dextromethorphan, but for some reason it's pretty hard to get dextromethorphan in tablet form, at least not alone (you can get it in combination with guafenisin, but I didn't want that). [0] The standard thing is Robitussin DM, but that tastes revolting. Until recently, the best thing I'd found was Delsym, which is a not-terrible tasting extended-release liquid. [1]

Anyway, I was in Safeway today and I saw Dexalone, a dextromethorphan gelcap formulation. I wonder why this took so long to come on the market, but I guess I'll be trying it next time.

[0] The rationale I've heard for the guafenisin is that it prevents people from overdosing on dextromethorphan, which is somewhat hallucinogenic in high doses.

[1] I've heard rumors that people prefer cough syrups because they think that it needs to coat their throat, but of course that's not how dextromethorphan works.

Posted by ekr at 05:31 PM | Comments (50) | TrackBack

January 22, 2004

So that's why there are so many Windows developers...

Kevin and I are working on a project that requires using Windows. I was about to go fork over for a couple of Windows 2000 server licenses but it's a much better deal to sign up for the Microsoft Developer's Network. For $700 you get copies of every current MS Operating System and enough licenses for 10 machines. You can only use them for development purposes, but that's just fine for us. It's programs like this that made MS such a popular choice for development. Now, it's true that it's even cheaper to become a Linux or BSD developer, but that's a fairly recent development.
Posted by ekr at 08:41 PM | Comments (9) | TrackBack

January 21, 2004

Four out of ten computer scientists hate our plan, but that's ok...

So, you're designing a new electronic voting system. You bring in some computer scientists to critique it. Four out of ten hate it so much that they go public about it. [*]. What's your response?
"We're not stopping the SERVE program," he says. "We're aware of the concerns and we're calling it a minority report because it is only four out of the ten review group members who felt they had to express themselves."

I don't know who the other six people were, and I only know two of the objecting reviewers, but if Dave Wagner and Avi Rubin hate your electronic voting system, you should probably take that fairly seriously...

Posted by ekr at 06:27 PM | Comments (9) | TrackBack

Is finding security holes a good idea?

I've just posted the first draft of a paper describing some of the work I've been doing for the past 8 months or so. The background for this work is that pretty much all software has security vulnerabilities. Many of those vulnerabilities can be exploited by attackers. There's been an intense public debate over the past 5-10 years over how those vulnerabilities should be handled once they are discovered. In particular, should they be disclosed to the public ("full disclosure"), kept secret by the manufacturers, or something in between (what's called "responsible disclosure"). Underlying all this work is the assumption that finding and fixing this kind of vulnerability improves security.

I've been trying to measure whether this is actually the case. This turns out to be quite tricky to do and the only data available to me was quite noisy. However, the initial results aren't very encouraging.

Here's the abstract of the paper:

A large amount of effort is expended every year on finding and patching security holes. The underlying rationale for this activity is that it increases welfare by decreasing the number of bugs available for discovery and exploitation by bad guys, thus reducing the total cost of intrusions. Given the amount of effort expended, we would expect to see noticeable results in terms of improved software quality. However, our investigation does not support a substantial quality improvement--the data does not allow us to exclude the possibility that the rate of bug finding in any given piece of software is constant over long periods of time. If there is little or no quality improvement, then we have no reason to believe that that the disclosure of bugs reduces the overall cost of intrusions.

The full paper can be found here in PDF and PS.

Posted by ekr at 03:17 PM | Comments (104) | TrackBack

January 20, 2004

Wireless electronic voting machines?

Apparently Diebold's voting machines are designed to allow wireless transmission of voting data via add-on card [*]:
Transmission of voting tallies via a wireless network would enable a central server to collect all the votes from a polling station quickly - currently the memory cards from all the e-voting terminals have to be physically collected. Wireless connection could also allow software to be updated remotely.

"The benefits to election officials would be huge," admits Doug Jones, a computer scientist at the University of Iowa. But for Jones and other computer scientists contacted by New Scientist, the potential risks outweigh the benefits.

Some say wireless communication is too insecure to be trusted with the democratic process. They also point out that simply having the PCMCIA slot means a bogus election official or voter could secretly slip a wireless card into the machine. If this happened and a wireless link was made, it would be very difficult to monitor who was trying to hack the terminal.

I'm not concerned that the data can't be transmitted securely. Votes which are being electronically transmitted should be secured with crypto to prevent tampering whether they're going over wires or RF. What concerns me about wireless access to voting machines is that it provides an easy channel for remote attack, especially given the apparent quality of Diebold's software [*]. If voting machines are going to have network access, it should be tightly controlled, require positive physical control by authorized personnel, and only be active when absolutely necessary to transmit the results. The idea that remote software updates be performed via wireless strikes me as a particularly bad one. In a mission critical application like this, you'd need some very serious cryptography to ensure that unauthorized updates cannot be performed.

Posted by ekr at 06:56 PM | Comments (15) | TrackBack

Human clones might be defective... so what?

One of the standard objections to human cloning is the concern that the resulting child will be defective (see, for instance, this AMA article.) This certainly is a reasonable concern from a technical perspective. A number of the non-human mammalian clones so far have exhibited birth defects, including "large offspring syndrome", immune dysfunction, etc. It's certainly possible, perhaps likely, that human clones would exhibit similar defects.

Intuitively, this seems like a strong argument against attempting human cloning at this stage in our knowledge, but let's check our intuitions against a case we already deal with: children with birth defects conceived via normal means. For concreteness, let's consider the case of Tay-Sachs Disease, a particularly nasty incurable genetic disorder that causes retardation and death before age 5. One copy of the Tay-Sachs gene is harmless but two is lethal. About one out of 30 Ashkenazi Jews is a Tay-Sachs carrier [*]. So, about 1/900 Ashkenazi couples has both parents being Tay-Sachs carriers. In such cases, about 1/4 of their children will have TSD.

So, if we are to say that human cloning should be illegal on the grounds that it's likely to cause birth defects, then itwould seems to follow that we should forbid couples where both parents are Tay-Sachs carriers from breeding as well. There's a test for carrying Tay-Sachs, so in principle we could test everyone, but even if we didn't want to do that, we could still forbid parents who have had one Tay-Sachs baby from from breeding. If we're not comfortable doing that, I think we need to reconsider whether the risk of birth defects is sufficient grounds to ban human cloning.

It's worth pointing out that there's one respect in which these two cases are different: Tay-Sachs can be detected in utero and so the parents could potentially terminate the pregnancy, whereas we don't understand enough about cloning to be able to detect problems in utero. However, some parents may choose not to terminate the pregnancy even if their children have Tay-Sachs (Tay-Sachs is sufficiently terrible that I imagine that few would make that choice, but parents of Down Syndrome babies do often choose bring the fetus to term), and once we understand more about cloning it may be possible to detect such defects in utero it. Thus, I think that the analogy is close enough to be troublesome.

Posted by ekr at 04:56 PM | Comments (47) | TrackBack

January 19, 2004

Nice work FreeBSD guys

Just purchased my 250 GB backup drive ($279 at Fry's, plus a $50 rebate). With some trepidation I wired it up to my PC--FreeBSD doesn't have the best reputation for working with arbitrary hardware. To my amazement, it worked pretty well. It automatically detected the drive in both USB and Firewire modes. For some reason it seems to have decided to stick with USB 1.1, but Firewire works fine at 50 MB/s. Easiest drive install I've ever had.
Posted by ekr at 04:41 PM | Comments (55) | TrackBack

January 18, 2004

Masking the symptoms

One good thing about having the flu is that it's a good time to cut back on my caffeine consumption. The general unpleasantness of the flu masks the caffeine withdrawal symptoms quite effectively. In fact, "flu-like symptoms" are a pretty common reported feature of withdrawal.
Posted by ekr at 04:13 PM | Comments (11) | TrackBack

Power connector standards

So-Crates over at PM Style wonders how we can have standardized connectors for stuff like 802.11 but not for power. The answer, of course, is installed base. The power system interfaces were standardized on a national level and now it's too late to standardize them internationally. It's not just a matter of power plug form factor, either, since the national systems use different voltages and frequencies, so interfacing with them means more than just connecting some wires.

At least, it used to. These days portable electronic gizmos mostly run on DC, so you need a power supply to convert 120 VAC to 12V (or 15 V or 24 V or whatever) DC anyway. Modern power supplies work just fine on any voltage from 110-240 and any frequency from 50-60 Hz. So, instead of having to carry a 220 VAC to 120 VAC power converter, you just need an adaptor to convert the plugs.

Posted by ekr at 03:39 PM | Comments (17) | TrackBack

January 17, 2004

Trackback spam

I've just been the recipient of a new kind of spam: trackback spam. Check out the trackback pings on this blog post, which now point to a Britney spears fan site. Outstanding.
Posted by ekr at 05:45 PM | Comments (10) | TrackBack

January 16, 2004

Curse you, Fujian flu!

Apparently, the reason I feel like crap today is that they put the wrong strains in the flu vaccine [*] [*]:
Last season was unusual because several strains were circulating with nearly equal frequency -- one B, several A (H1N1) strains, and in smaller numbers, two A (H3N2) strains. Late in the season, though, an ominous picture emerged. A particular strain of A (H3N2) began to move out of the pack.

This was the "Fujian" strain. All influenza viruses carry names denoting the place and the year they were first found. This one was isolated on Aug. 25, 2002, from a 2-year-old child in that province on China's southeastern coast. Fujian was related to the previously dominant A (H3N2) strain, called Panama/1999, which is included in this year's vaccine. But Fujian is different enough that the vaccine provides only partial immunity to it.

Fujian was emerging as 13 influenza experts met in February and March to advise the Food and Drug Administration on what strains of virus should make up this season's vaccine. The Vaccines and Related Biological Products Advisory Committee must deliberate then because it takes vaccine makers all spring and summer to make their product. The committee agreed it was time to throw out Panama/1999 and replace it with Fujian/2002.

However, there was a problem. Technicians were unable to grow in eggs used to make vaccine the Fujian strains they had gotten from patients' throats. Although few doubted a strain would eventually be found that would grow, nobody could say how long it would take to find it. The only strains that did grow in eggs were samples that were first grown in dog kidney cells. But these "MDCK" cells were not approved for making flu vaccine.

The FDA has extremely strict rules about how vaccines can be made. It believes that something designed to prevent one illness should have just about zero chance of causing another one.

To win approval for a dog cell "line" to be used to grow vaccine viruses even briefly, the FDA would need to learn all about the history of the cells, what else was in the laboratory, where they were used, what kind of substances were used to feed them (often fluid derived from calf blood) and other details. This takes months. And in March, nobody had months.

One of the panel members, Peter Palese, a virologist at Mount Sinai School of Medicine in New York, argued this was a time to make an exception. He said the risk that a strain of Fujian virus might pick up something dangerous in a brief pass through the kidney cells was tiny -- and worth the benefit of getting Fujian into the vaccine.

"I don't see a real problem in having one MDCK passage," Palese argued, according to a transcript of the March 18 meeting. He went on to say that keeping Fujian out of the vaccine could "jeopardize 80 million doses and also give the influenza vaccine a bad name because many people may get sick."

He did not get very far.

Decker, representing the vaccine industry, said all sorts of hurdles lay ahead in fully adapting Fujian for commercial use, and that even if the FDA allowed it, the vaccine would probably be late arriving. An FDA official basically said the agency would not bend the rules. In the end, Palese was the only person who voted to put Fujian into this year's vaccine formula.

The FDA's caution is certainly understandable here, but right now I'm starting to wish they'd taken a chance.

Posted by ekr at 05:24 PM | Comments (20) | TrackBack

The Fry's Index

There's a lot of debate about what economic statistics to use to determine whether the economy is picking up or not. We here at EG would like to propose a new one: the Fry's Index. The Fry's Index is the time consumed by purchasing a predefined basket of items at Fry's Electronics. That basket consists of:
  • One package AA batteries.
  • One computer cable.
  • One SDRAM (requires getting it out of the cage).
  • One item requiring rebate (requires finding the rebate slip).
We're not interested in measuring the length of the line here. We just want to measure the amount of time the actual transaction takes.

Here's why the Fry's Index works. When economic conditions in the valley are good, the only people willing to work for the slave wages Fry's pays are recent immigrants who don't speak English or have any concept of how to use the cash register. The result is that purchasing anything takes forever. When conditions are bad, Fry's an afford to hire out of work Webmasters, thus resulting in a generally higher quality of service.

I've recently noticed a substantial decline in the Fry's index, leading me to believe that good times are right around the corner.

Posted by ekr at 11:04 AM | Comments (22) | TrackBack

January 15, 2004

XFree86, FreeBSD, the Matrox P650, and you

The new machine has a Matrox P650. The bad news is that XFree86 does not support this card natively. The good news is that Matrox provides a Linux driver. Even better, the driver works on FreeBSD. Thanks to Daniel Lang, I managed to get this working. Here's the procedure.
  1. Get the driver from Matrox here. I used the Red Hat 7.3 one.
  2. Unpack the driver (it's a shar file). Do not attempt to use the install program. Just unpack things.
  3. Copy the driver from xfree86//mtx_drv.o into your modules directory. On my machine that was /usr/X11R6/lib/modules/drivers.
  4. Copy the sample XF86Config file of your choice from samples/ into /etc/X11/XF86Config.
  5. Edit the file appropriately. By default, mine wanted to be in 1024x768 16-bit mode but it worked fine in 1600x1200 24-bit.
And then you're good to go. Actually, this was easier than the average X install because I didn't have to run the insanely useless XFree86 config program.

Now, it's true that unfortunately when you use the driver this way it's not accelerated, but seeing as the most advanced graphics stuff I do is Emacs and R, this isn't exactly a crisis for me.

Posted by ekr at 06:59 PM | Comments (9) | TrackBack

An embarassment of disk space

After 6 years with one computer, I finally forked over for couple of K for a new computer. Seeing as one problem I was having with my old machine was that I kept running out of disk space, I forked over for the 200 GB SATA drive. Which is great, except for one minor problem. I have no idea what to do with all this storage. Here's what you get when you do df on my old machine:

Filesystem          1K-blocks     Used    Avail Capacity  Mounted on
/dev/da0s1a             99183    79568    11681    87%    /
/dev/da0s1g           3834439  3482214    45470    99%    /home
/dev/da0s1f           3969982  3299345   353039    90%    /usr
/dev/da0s1e            198399   115432    67096    63%    /var
/dev/da1s1e           8931723  8193681    23505   100%    /home2
/dev/da1s1f           8397172   700089  7025310     9%    /space4

So, I figure to go whole hog. I allocate 1G for /, 4G for /var, 10G for /usr, 4G for swap and and 100G for /home, which is more storage than I ever dreamed of using and I still have 70G or so in reserve for full motion video or something. I'm starting to wonder what ridiculous disk-wasting projects now look practical. How about an audit log of every keystroke I make? That might be useful when it comes time to write the methodology section of research papers.

Posted by ekr at 11:26 AM | Comments (33) | TrackBack

January 14, 2004

The moon, then Mars

Unbelievably, the Bush administration really is serious about going to the moon and Mars. [*]. At a couple billion a year, at least it's going to be cheaper than some of the stupid things that the Administration has decided to spend your money on.
Posted by ekr at 08:10 PM | Comments (9) | TrackBack

January 13, 2004

Rocket science at the 7/11

You may have noticed that 7/11 has recently introduced the Diet Pepsi Slurpee. [*] The key to this is the use of a new sweetener called Tagatose [*]. Tagatose is a stereoisomer of fructose that's 92% as sweet but has fewer calories. The way this works is that the human body is better at digesting sugars with one chirality than others and so you get less of a caloric impact with Tagatose than you would with fructose.

Thanks to Terence Spies who put me onto this this story.

Posted by ekr at 01:03 PM | Comments (52) | TrackBack

ISOC NDSS Program

You might want to check out the rest of the ISOC NDSS program. There are also some nice tutorials. I've sat in on Radia Perlman and Charlie Kaufman's tutorial when Radia was giving it alone and it was quite good. Steve Kent's tutorial is actually a series of lectures that looks quite interesting.
Posted by ekr at 10:15 AM | Comments (9) | TrackBack

Datagram Transport Layer Security

The Internet Society Network and Distributed System Security Symposium (NDSS) program is out. Nagendra Modadugu from Stanford and I have a paper [PDF] [PS] in it on Datagram TLS. Basically, DTLS is intended to provide security for a bunch of applications that can't currently use SSL/TLS.

Here's the abstract:

A number of applications have emerged over recent years that use datagram transport. These applications include real time video conferencing, Internet telephony, and online games such as Quake and StarCraft. These applications are all delay sensitive and use unreliable datagram transport. Applications that are based on reliable transport can be secured using TLS, but no compelling alternative exists for securing datagram based applications. In this paper we present DTLS, a datagram capable version of TLS. DTLS is extremely similar to TLS and therefore allows reuse of pre-existing protocol infrastructure. Our experimental results show that DTLS adds minimal overhead to a previously non-DTLS capable application.
We've also written an Internet-Draft that describes the protocol itself in more detail (the link above is to my web site because the I-D editor is slow).
Posted by ekr at 10:11 AM | Comments (9) | TrackBack

January 12, 2004

Hurrah for Happy Donuts!

Happy Donuts on El Camino Real has a sign up advertising free wireless. Not only are they open 24 hours a day, you can get food while you hack. Outstanding.
Posted by ekr at 04:40 PM | Comments (10) | TrackBack

January 11, 2004

The march of technology

I was a fairly early adopter in the WiFi arena, having purchased an Apple Airport back in 2000. At the then bargain price of $300, it was the cheapest 802.11b Access Point on the market. The Airport started to fail a couple of weeks ago and yesterday, I replaced it with a Linksys combined 802.11b/g router for $89.99 + a $10 rebate. The Linksys even has a firewall, something the Airport didn't.

The Linksys isn't even the cheapest AP on the market. You can buy a Linksys 802.11b-only AP for $60 and one from Uniden for $40! That's cheaper than the cheapest 802.11 cards were back in 2000. Next year APs will probably come for free in cereal boxes.

Posted by ekr at 05:38 PM | Comments (64) | TrackBack

The FDA chickens out on breast implants

Chris Rangel has a nice article about the FDA's rejection of Inamed's request for approval of silicone breast implants, whose use has been restricted in the United States since 1992.
In light of the large body of literature that attests to the safety of silicone breast implants this current FDA decision (which even goes against the recommendation of it's own advisory committee) appears to be purely political and they can't even give a reason for this decision that doesn't sound like text-book, government, doublespeak, bullshit!
In explaining the new FDA requirements, Commissioner Mark B. McClellan said in a release that "the FDA, sponsors, and the clinical community have learned a great deal about breast implants, especially silicone gel-filled breast implants, over the last 10 years. Based on this knowledge, this revised guidance is our view on the information needed to provide a reasonable assurance of safety, and to allow women and physicians to make informed decisions about silicone implants."
The official reasoning behind this decision was the supposed continuing uncertainty about the "long term" safety of these devices. Not to be blunt, but this is complete nonsense. The first silicone breast was implanted in 1962 and up until 1992 millions of women have had these devices implanted. The data from these long term implants in thousands to millions is out there and since 1992 several epidemiological studies have looked at these women and have found no link to serious illness or health consequences. Currently we have more long term data on breast implants than we have on most medications (the majority of our current medications have come on the market after 1980). How much long term data do we need? 40 years? 80 years? A lifetime?

I'm sure glad we have the FDA there to protect us from the safety risks of increased breast size.

Posted by ekr at 05:29 PM | Comments (9) | TrackBack

January 10, 2004

Hurrah for the Palo Alto Library! Boo for Yahoo!

So, the SO is having a party today but I need to work. Conveniently, the Palo Alto library is quiet and has free 802.11 access, so my laptop and I are working here today. Together with the iPod, it's a pretty passable work environment, though it would be nicer if there was some private room to hang out in. The bad news is that it closes at 6, so I'll have to scurry off to some local coffee shop, which won't offer Internet.

On the other hand, I'm pretty grumpy about Yahoo. A number of my friends use Yahoo IM and so I'm force to have a Yahoo account, despite the fact that I mainly use AIM since I have an AIM client that runs under Emacs. I'm using Yahoo's client on my PC but on the road I use VeriChat on my Treo. The problem is that periodically Yahoo changes their IM protocol and locks out everyone else. That happened a few days ago and so I can't use Yahoo fromo my Treo until VeriChat reverse engineers the Yahoo protocol. I suppose I could use Yahoo's mobile IM client, but frankly, it looks horrid and the whole point of using a multiprotocol IM client is so that you don't have to switch between a bunch of custom clients. Grumble.

UPDATE: VeriChat already has their client working with Yahoo again. Nice work.

Posted by ekr at 03:43 PM | Comments (17) | TrackBack

January 09, 2004

Mercury standards

There's been a lot of fuss about the EPA's proposed emissions plan [*]. Basically, instead of having restrictions on the emissions from any particular power plant, the EPA proposed a "cap and trade" scheme where power plants would be able to trade the right to emit mercury.

Unsurprisingly, environmental groups are a little grumpy:

"When it comes to the risks of mercury exposure, the administration just doesn't get it," said Angela Ledford, director of Clear the Air, an environmental advocacy group. "Despite mounting scientific evidence, the Bush EPA is still trying to pretend mercury is not as dangerous as it really is."

Now, my initial reaction was that this was just another example of environmentalists hating pollution credits--a fairly common event--but it's actually a little more complicated than this because, unlike many kinds of air pollution, it's not clear how much mercury travels from place to place, as indicated in an article in the January 2 issue of Science:

The "cap and trade" rule is modeled on the successful reduction of acid rain (Science, 6 November 1998, p. 1024). But many scientists say that mercury may behave differently from those air pollutants, most crucially in how far it travels from power plants. Models produce a wide range of results, and some predict that up to 50% of mercury emissions are deposited locally. That raises the concern that if particular plants do not reduce emissions, nearby communities will remain polluted. EPA acknowledges that these so-called hot spots could conceivably occur but notes that states can implement tighter restrictions.

The rest of the article goes on about how there just isn't enough data to know what the effect of various restrictions would be. So, while it's not clear to me that the "cap and trade" plan is a bad idea, it's not clear that it is a good one, either.

Posted by ekr at 09:25 PM | Comments (54) | TrackBack

Infrastructure first

Check out Gregg Easterbrook's comments on the rumor that President Bush is going to propose a Mars mission. Easterbrook is completely right here. The basic problem with spaceflight is that we've got a "first 22,000 miles problem". Mars is 100 million miles away, but most of the energy consumed getting there will be used to get the craft into orbit, and it's not cheap. Current costs are on the order of $50,000/kg to get into geosynchronous orbit. So, if we're going to do anything significant in space--as opposed to just launching satellites, which is no big problem now--we need to figure some way to get into orbit that's a lot more cost effective than what we've got.
Posted by ekr at 05:35 PM | Comments (11) | TrackBack

January 08, 2004

My view isn't your view

One of the interesting things about the "visible limited probabilities" I discussed in the previous post is that because players estimates of the quality of their own hands depends on secret information, their estimates are inconsistent. In particular, you and I can both believe that we have a better than even chance of winning.

It's easiest to see this by actually trying some sample hands. Because poker is so complicated, we'll play a simpler game I've just invented, called "Noker". Noker is played with 8 cards: the Jack and Queen of each suit. Each player is dealt two cards and the player with the best hand wins. In practice, this means that the relevant hands in descending order of quality are:

  • QQ
  • JJ
  • QJ suited
  • QJ off-suit

For the moment we'll say that all suits are equally valued, so you can get ties in which case the players split the pot.

So, say for the sake of argument, let's say that I've been dealt the Queen of Hearts (QH) and the Queen of Diamonds (QD). That means that there are 15 possible other hands held by the other player, again in descending order of quality:

  • Queen of Clubs (QC), Queen of Spades (QS)
  • JC,JD; JC,JH; JC,JS; JD,JH; JD,JS; JH,JS
  • QC,JC; QS,JS
  • QC,JD; QC,JH; QC,JS; QS,JC; QS,JD; QS,JH

All of these hands are equally probable, so there's a 1/15 chance of splitting the pot and a 14/15 chance that I win. So far so good, but what happens if my opponent is dealt QC, QS? He makes the same calculation and also concludes that he has a 14/15 chance of winning (remember, he doesn't know my hand). So, when you sum up our expected winning probabilities you see that they add up to 28/15, which is way over 1. What's going on here, of course, is that one estimates one's chances of winning based on probabilities about how the other cards in the deck will be arranged. Since I only know about my cards and you only know about your cards, we can only estimate the probability of a given arrangement of the other person's cards, and thus can't make a completely accurate estimate of our respective chances of winning.

Posted by ekr at 02:10 PM | Comments (11) | TrackBack

Gimme more poker info

One of the nice features of the ESPN coverage of the World Series of Poker is that they display the probability that any given hand will be the best hand on the table after all the rest of the cards are dealt. Actually, there are at least five potential sets of probabilities, in decreasing order of accuracy:
  1. The omniscient view--the probability of winning given that you know the position of every card in the deck. This wouldn't be very interesting since it's always a zero or a one. Once the cards have been dealt there's no randomness.
  2. Temporally bounded omniscience--the probability of winning given that you know all the cards that have been dealt but not the cards left in the deck.
  3. Hand-limited omniscience--the probability of winning given that you know all the cards in people's hands. The difference between this probability and the previous one is that the dealer "burns" a card with each deal. Before dealing a card, he takes the top card off the deck and deals it face down. Then he deals the actual card. The difference between this probability and the previous one is that in the previous one we know the cards that have been burnt).
  4. Live hand-limited omniscience--the probability of winning only taking into account the hands that are currently live. So, if someone folds before the flop, we don't take their hand into account here, whereas we did before.
  5. Visible limited--the probability of winning given that one only knows what's in one's own hand and what's on the table.

It's not clear exactly what probabilities are being displayed on the screen. Clearly, it's not the omniscient view and a little observation is enough to convince one