Hacker News Reader

Comment by sapphireblue | Hacker News Reader

This may be an unpopular opinion, but I find it completely fine and reasonable that CPUs are optimized for games and weakly optimized for crypto, because games are what people want.

Sometimes I can't help but wonder how the world where there is no need to spend endless billions on "cybersecurity", "infosec" would look like. Perhaps these billions would be used to create more value for the people. I find it insane that so much money and manpower is spent on scrambling the data to "secure" it from vandal-ish script kiddies (sometimes hired by governments), there is definitely something unhealthy about it.

View on HN

Bernstein agrees with you. His point isn't that it's dumb that CPUs are optimized for games. It's that cipher designers should have enough awareness of trends in CPU development to design ciphers that take advantage of the same features that games do. That's what he did with Salsa/ChaCha. His subtext is that over the medium term he believes his ciphers will outperform AES, despite AES having AES-NI hardware support.

This is so blaringly obvious that it's crazy that more Crypto people didn't realize this sooner.

It is in retrospect a pretty banal observation. If cipher design is about achieving a certain security level at the lowest cost per byte, it sort of stands to reason that you'd want to design them around those features of a CPU on which the market is going to put the most pressure to improve.

In fairness, some of this design philosophy --- which Bernstein has held for a very long time! --- gets a lot clearer with the advent of modern ARX ciphers, which dispense with a lot of black magic in earlier block cipher designs.

A really good paper to read here is the original Salsa20 paper, which explains operation-by-operation why Bernstein chose each component of the cipher.

Many non-obvious observations are banal in retrospect. :)

If you base your cipher on features that will be cheaper in future, maybe you are also making it easier to brute-force it?

https://cr.yp.to/snuffle/spec.pdf

https://cr.yp.to/snuffle/design.pdf

Eh. Remember that a lot of these guys think about hardware implementations, so they're fixated on ASICs, not GPUs.

At some point the inequality gets too far out of whack and it's time to reconsider your values. Same reason we keep switching back and forth between dominant network architectures every 8 years. Local storage gets too fast or too slow relative to network overhead and everyone wants to move the data. Then we catch up and they move it back.

There can often be a strong disconnect between theory and implementation. I don't believe you can be truly effective unless you can get your hands dirty with both. Although if you have to choose, I'd rather know a bit of theory, and a whole lot about reality, than vice versa. Constants factors matter in big O.

Besides, CPUs are only optimized for games if you write your code to take advantage of it.

I worked on AAA engines that completely disregarded caches and branch prediction and while that worked great 10 years ago the same architecture became crippled on modern CPUs. Its so very easy to trash CPU resources that at this point I'm convinced most programs easily waste 90% of their CPU time.

For the last AAA title I shipped we spent weeks optimizing the threads scheduling, priorities and affinities along with profiling and whatnot; it was still an incredible challenge to use the main core above 80% and the other cores above 60%. If your architecture doesn't take the hardware into account from the ground up, you're not going to fully use the hardware :)

> I'm convinced most programs easily waste 90% of their CPU time.

Hah, in my experience that's hopelessly optimistic. The C I write is probably 10-100x slower than it should be (leaving SSE and threading aside entirely), but the Python I write most days is a hundred times slower still.

One data point to support your claim:

* pure Python: 1.0x (baseline)

* NumPy (numeric python): 120x

* Google-optimized pure C: 2,500x

* optimized Python + Cython + BLAS: 8,700x

This is optimizing the same numeric algorithm (word2vec) using different languages and tricks, from naive pure-Python down to compiled Cython with optimized CPU-specific assembly/Fortran (BLAS) for the hotspots [0].

[0] http://rare-technologies.com/word2vec-in-python-part-two-opt...

and I'm sure pure Fortran would be even faster

That's mostly because of Fortran doesn't have the same aliasing trouble as C?

Pointer indirection is expensive tradeoff for flexibility

Eh, doubtful. Sure, it'll be faster than unoptimized C. But when you observe strict aliasing rules in C a modern compiler will generally produce similar quality assembly for both languages. The reason BLAS is so fast is that every single line of code in a hot loop has been hand-optimized and tons of CPU-specific optimizations exist

Fortran yields some of the fastest code out of the box, yes, but C/C++ can yield equivalent performance by adhering to certain basic rules.

Even with strict aliasing, the only way C/C++ standard effectively lets one type to be cast to another is incurring a copy. Tell me what can be done better for performance in C that can't be done in Fortran or "another static language without pointer indirection".

You can get a lot of performance back just by taking branch predictions and cache misses into your designs.

I did just that in C# last years and got at least two orders of magnitude of performance gain from it. Still, I constantly wished I was working in C instead :)

There is a potential counter-argument that this is because multicore is an example of a CPU feature that was not designed for videogames. :)

I don't know if that's strictly true, but I do feel games aren't as easy to split across threads/cores as many other types of software. Ultimately, a game boils down to one big giant blob of highly mutable and intertwined state (the world) that is modified very frequently with very low latency and where all reads should show a consistent view.

In other domains, avoiding interaction between different parts of your application state is a good thing that leads to easier maintenance and often better behavior. In a game, the whole point is having a rich world where entities in it interact with each other in interesting ways.

If you're interested in how a game might use multiple cores, this GDC talk is worth a watch: http://www.gdcvault.com/play/1022186/Parallelizing-the-Naugh...

This one is quite good too: http://gdcvault.com/play/1021926/Destiny-s-Multithreaded-Ren...

> There is a potential counter-argument that this is because multicore is an example of a CPU feature that was not designed for videogames.

That's a common trope; it mostly applies to the rendering path. AI / Physic engines are nicely scalable with the number of cores (AI in particular, because a) it's oftern agent based, which naturally work concurrently and b) with AI, slighly relaxed synchronization constraints sometimes generate some desirable degrees of fuzziness and unpredictability ... although this is probably a very slippery slope ...)

To me the whole view of the game world being a "giant blob of highly mutable and intertwined state" stems from the fact that for over a decade all games had to do was have an update and a render pass in the main loop. So you could have a big mess because all of the world updates were serial, and so the developers didn't really experience the problems arising from such design.

Now it takes a change in perspective on how to structure code and data to properly exploit multiple cores to their full potential. It is certainly possible to have interaction in the game world and do it in a multi-core multi-threaded way, it just needs smarter structures and better organisation of data.

Game developers have and will adapt to this.

Its not nearly as easy as it sounds. I think game engine developers now understand multi-core a LOT better than programmers from most other domains.

Games are still just an update and render pass in a loop. Nothing will change that, they might be decoupled and overlapped but they're still present. They're just much more complex than they used to be. Some engines will fork/join at every step (sometimes hundreds of times per frame), others will build task graphs and reduce them and a 3rd team will use fibers to build implicit graphs. No matter what you do you're still executing code with very clean sequential dependencies.

Game engines started going multi-core at least a decade ago. First by using one thread per system, then moving towards tasks. Today I don't know of any AAA game engine not already parallelizing its render path and unit updates massively.

Games simulate the world, more or less. The world has mutable state.

I don't think any CPU features were designed specifically for video games. But video games often have workloads that fit nicely on top of the CPU.

You don't need interactions between entities at every point in time. There are very specific sync points during a frame and there isn't many of them (maybe 5 or 6). Your units can also be organized in a table where each row can be updated in parallel before moving on to the next.

Many types of software can get away using only concurrency or parallelism. Game engines have to master both. You want parallelism to crunch your unit updates and you want concurrency to overlap your render pass on top of the next frame's update pass.

Yes well maybe if Intel's cool toolkit to highlight cache issues didn't cost more than a hobbyist could plausibly justify...

Its far worse than that. Even PC games are often optimized by hardware vendors rather than the actual developers.

See http://www.gamedev.net/topic/666419-what-are-your-opinions-o...

On consoles we get access to the hardware specs and profilers for everything - even if behind huge paywalls and confidentiality contracts. Yet with all that information available its still insanely hard to optimize the codebase.

There's absolutely no incentive to push these tools/specs to hobbyists because even professionals have a hard time getting them. Its also worth mentioning that having access to the tools and specs doesn't mean you'll understand how to properly use them.

People spend a lot of money on physical security as well. They put locks on their homes and cars, install safes in banks, drive money around in armored cars, hire armed guards for events, and pay for a police force in every municipality. The simple fact is that if your money is easy to get, someone will eventually take it without your permission. That is reality, but calling it "unhealthy" implies that the current state of things is somehow wrong. I agree with that premise, but it carries with it a lot of philosophical implications.

An interesting study on the growth of "guard labor": http://opinionator.blogs.nytimes.com/2014/02/15/one-nation-u...

> That is reality, but calling it "unhealthy" implies that the current state of things is somehow wrong.

I don't spend a lot of money on physical security. I leave my car and front door unlocked usually, and don't bother with security systems.

If you find yourself having to lock and bolt everything under the sun lest it get damaged/stolen, then yes, I think it is an indication that the current state of things is wrong. There is something wrong with the economy/community/etc. in your area.

I realize that "the internet" doesn't really have boundaries like physical communities do, but I too wish for a world where security was not an endless abyss sucking money into it and requiring security updates until the end of time. In other words - a world where you could leave the front door unlocked online without having to worry about malicious actors. It will never happen, of course (at least not until the Second Coming ;)

You're only able to be lax about physical security because institutions take care of it for you. Your taxes go to police, FBI, military. You keep your money in a bank, and the bank spends money on security. If people stopped keeping their money in banks and started storing it in their homes, the incentive for burglary would go up in your area.

I also assume you don't live in a dense city. Even in a utopia you couldn't have perfect safety without investing in security: some people are going to commit crimes and violate property just for fun, and when there's a lot of people in one area, that becomes a concern.

There has never in history been a time when people can be secure without investing in security. To claim that investing in security is in indication of something "wrong" is therefore at best a sentiment far ahead of its time.

some people are going to commit crimes and violate property

Why are we still assuming that as a given, instead of trying to change it at its roots?

He/She could believe that people are inherently bad.

Breaking the rules is fun. The thrill in taking such risks is exhilerating and if you get good at it — if you can repeatedly break the rules and get away with it — you feel powerful. Unless you're suggesting a transhuman approach, there's no way to get around that. You can eliminate any incentives for crime, and eliminate all sources of childhood strife, and still have people who commit crime because it's a great hobby.

It certainly is. Personally, I've grown beyond purely breaking rules for the sake of it, without concern for the repercussions. I still break the rules, all the time, but only when I think the rules are wrong and no true harm will come from my breaking them. It's gotten much less fun in my old age, just seems rather boring and rational.

Only if the chance of capture is low. If people got cought 9 times out of 10 I don't think they would have that hobby.

And now we're back to spending billions on security.

I think that can be fixed at a cultural level, so it's no guarantor of crime.

Sexual desire was fixed at a cultural level until it wasn't. The narrative that people only steal because they're poor and desperate is just that, a narrative. Anyone can feel excitement at taking another's property. Your perfect society free of crime is begging for a "disruption."

> Anyone can feel excitement at taking another's property.

My upbringing has had this "golden rule of ethics" (don't do to others what you don't want done upon yourself) ingrained in me pretty well, so I would never feel excitement about this.

(Hypothesis: This ridiculous objectivism has had people forget how much cooperation is ingrained into humans by nature.)

That said, I am aware that such thoughts exist in my subconsciousness, because the subc is always exploring all possible paths, but I have never experienced that as an even remotely acceptable (in terms of my own moral) path of action.

> don't do to others what you don't want done upon yourself

This only works for people who sufficiently appreciate their own possessions. Others might develop a very relaxed "stuff comes, stuff goes, who cares it's just materialistic crap anyways" attitude and and that equips them to have surprisingly little remorse in regards to theft. This is probably exemplified best in the extremely high rate of theft affecting near-zero-value bikes in many Dutch cities. That kind of thief might even rationalize by inverting guilt, "if he feels bad about the loss it's his own fault that he is not as cool about shitty old piles of rust as I am"

Have you ever watched a heist film? If so, you can't claim not to understand how it could be exciting to break into someone's property, risk imprisonment or death, and take their stuff. Go watch one some time, the writers make sure to paint the victims as bad men and the thieves as anti-heroes so that you can enjoy the fantasy without guilt.

You've missed my point for the opportunity to moralize and posture. Consider this: You know cheating is wrong, you probably consider yourself to be someone that would never do it, yet you can still acknowledge that it would most likely be enjoyable for at least a very short while, right? That's all I'm saying, not (lmao) some kind of faux-objectivist philosophy on the right to take other people's property or whatever it is you seem to be imagining.

Easy to say, but people are selfish. There will always be evil sinful people in this world

Only if you believe in the concept of evil and sin.

There will always be people who will happily infringe upon your person to their benefit and your dismay.

There, now the philosophical twaddle is excised without ruining the spirit of the point

Exhibit B: A human expending energy to protect an idea from a self-important prat too busy playing word games and Tea with Philosophers to listen.

Yea, I wish we could all live in Anarchy without rules or police or armies etc. But there is always an asshole who want more, or think he deserves more. I mean, we reward these people today with jobs on WallStreet etc, but these people would still exist in an anarchy, and would do their best to "solve" the world to their liking.

Exhibit A. A human selfishly ignoring the thesis of a statement in order to sound wise and try to win the disagreement by subterfuge.

Since the discussion is about criminality, and it was suggested that this arises due to some religious notions rather than eg (a) people being defective or (b) social-economic disadvantage, it thought that out to be challenged. From an evolutionary perspective you could say that there must be an advantage in such behavior to the individual, even if the society suffers.

Also, thanks for the unjustified rudeness, you've made a great contribution today.

>Why are we still assuming that as a given, instead of trying to change it at its roots?

You mean change human nature?

I imagine it'd be more like changing human behaviors, and the societal conditions in which they are shaped.

So, have any society ever changed those exact behaviors?

Human nature is the least productive concept ever. It is only ever brought up to defend the status quo and declare it as inevitable. It is a mystical concept impervious to examination. Whether it's "God" or "human nature" it's just a term for an abstract master that keeps us all in bondage.

Do you think animals have a "nature"? If so, why are humans any different? Sure, we can reflect on our behavior and try and change it, but it's undeniable there are innate drivers that can be hard to overcome.

I take issue with the way "human nature" is used, not the idea that we have a nature. It is almost always unproductive. Even so, most who make an argument from human nature always convince me that they know nothing about other human beings within a sentence or two.

Oh I got it. Fair point. It doesn't add much to a complex conversation.

>Human nature is the least productive concept ever. It is only ever brought up to defend the status quo and declare it as inevitable. It is a mystical concept impervious to examination.

Actually it's the exact opposite: very pragmatic and empirically verified.

It's exactly what people, in statistical quantities, tend to do over what they tend not to do.

Plus, most of it is shared with our animal siblings.

Except if you think that an Elephant or a Cat doesn't have certain natural characteristics (insticts, behaviors, traits) based on their species.

Do you see a specific claim backed up with empirical research in the above usage of human nature? I don't. Do people ever? Any time someone brings up human nature they could omit the term and just talk about the research itself. They don't. Human nature is a rhetorical shortcut. You can't assail human nature, you can't examine it like scientific evidence. It is intellectual laziness to make any argument from human nature.

>Do you see a specific claim backed up with empirical research in the above usage of human nature? I don't.

That's because it's a casual online conversation. I don't stuff my responses with citations when I'm not writing a paper.

>Do people ever?

Yes. There are tons of research on human psychology, cognition, physiology, evolutionary traits, instincts and other aspects of what colloquially is called "human nature".

How do you plan on preventing people from wanting things?

Idealistically and for the fun of philosophically considering the matter, by creating a world composed of societies in which the inhabitants are free from want.

> ... inhabitants are free from want.

Do you mean chemical lobotomies or a post scarcity economy? Because there are some wants that are impossible to fulfill, for example: there are a bunch of murderers in Syria motivated by the desire to fly a winged horse to a sky mansion where 72 infinity virgins await. I don't see that happening, even post scarcity.

Because those roots are hard wired into us by a billion years of evolution.

And yet we evolved a rather handy set of features for altering and shaping our behaviors.

And they'll continue to evolve and improve, but that takes thousands of generations.

Naturally.

You're radically underestimating mankind's potential of disruptive innovation.

Now I have to apologize for playing both sides of this conversation, but we've been working on this tribalism for a few hundred years, maybe if you were a better student of human history than I am you could make a case for a few thousand.

We have a way to go, but we have made at least some progress. Maybe in another few hundred years humans won't be so 'Us and Them'. Maybe materialism will be the next thing we work on. Who knows, maybe by the time we reach the next galaxy we'll have it sorted out.

It's human nature to crave sex, maybe not with every single person you meet, but certainly with more than a single partner in your entire life, right? For thousands of years, Christianity attempted to "work on this" aspect of human nature and make non-monogamous sexuality taboo. It was fairly successful at it. Yet (depending on your perspective) it only took somewhere between a few years and a few decades post-sexual revolution for it all to come crashing down spectacularly.

If the most powerful institution in the western world couldn't "fix" this aspect of human nature over millennia, it is sheer arrogance to think we can do better today.

I'm not sure if that's the best example. People that don't crave sex fall out of the gene pool pretty quickly.

Something like aggressive behavior though, is something that can be selected against.

Feminists have selected against male aggressive behavior in our education systems for decades. They have "successfully" ruined the lives of countless western boys and laid the foundation for immigrants from non-castrated cultures to take their stead with redoubled aggression. Turns out that it's much easier to beat boys into submission than it is to subvert female attraction to dominance.

This is not r/redpill, if you're going to make outlandish claims, please back them up with good citations.

"This is not r/redpill" says it all, but ok. http://www.theatlantic.com/magazine/archive/2000/05/the-war-...

Because "we're" being realistic. Changing that is unrealistic.

> ... instead of trying to change it at its roots?

Because eugenics went out of fashion a long time ago. The "roots" is free will, so you can't really change that without horrific consequences. Using birth control (voluntary and involuntary) to bias the population was a popular idea in the 1920s. China's latest gamifaction of "social credit" is another biasing attempt. I'm not aware of any "roots" solution that doesn't require total surveillance or head measurements...

More than just for fun. In a global society so encapsulated by money people are always going to tend toward the path of least resistance to maximise that goal. In many cases, despite the moral factors, risk, etc; this is going to be crime. It seems to simply be human/animal nature and something which society itself won't easily be able to change.

I live in Japan, where there seems to be a much stronger respect for other people's property. It's a common story for people who forget their wallet on a park bench or something to come back hours later and it's either still there or at the local police box. There's also a lot less vandalism - I don't usually see things like trashed bus stops that were a daily sight back home. Most people seem to lock their bikes with a simple lock between the frame and back tyre - those would have all been hauled away by a truck and disappeared by the next morning back where I used to live. (edit: another anecdote - I was very surprised when my wife thought nothing of leaving a brand new MacBook Pro visible in the back seat of the car when going into a restaurant for lunch)

And yes, people here (mainly the elderly) do keep vast sums of cash at home http://www.dailymail.co.uk/news/article-2027129/Honest-Japan...

Japan also has some of the densest cities on earth.

Of course, it's far from perfect (there's plenty of crime, people still lock their doors, and sexual violence seems to be off the charts), but it shows that paranoia doesn't have to be the default state. If they made it this far, how much further is possible within human nature?

I moved to Rome, Italy last year and was quite surprised how little respect they seem to have for other people's property.

All the apartments have thick security doors[1], lower windows of buildings have iron bars and all gardens have tall fences. If you leave anything that looks even remotely valuable in your car, someone will break a window and grab it. There is tonnes of vandalism, and even if you leave a motorbike locked with a secure lock it's somewhat likely it won't be there the next day.

It sounds the complete opposite of Japan!

[1] A few weeks after I arrived I was at a friends house and there was a disturbance of some sort in the apartment next door. The police couldn't get in, so called the fire service who had to work for 20 minutes to break the door down. They considered going in through the outside, but it was the third floor and all the windows had metal shutters.

I live in Zürich. The joke here is that if you left a pile of money on the pavement in the city centre, it would stay there for a week and then you'd be fined for littering.

People here are basically honest. There aren't any turnstiles on the transit system --- they just assume you'll have bought a ticket. Children roam the streets on their own and think nothing of talking to random adults.

Of course, they back up this trust with enforcement; there are occasional spot checks on the transit system with big fines; and if you don't pay a driving ticket the police will come to your house and remove your license plates...

In Paris, I used to leave my bag on the street in front of my high school whole days. It was just leaning on the front door, for hours. That was before.

Now I guess someone would call a bomb disposal team and cut the traffic 3 blocks around it. (and I would have been very sad, because to this day I still love that bag, leather, light, durable, practical, it still fits a modern 13" laptop perfectly)

Anyhow, this thread is all anecdotes.

> Anyhow, this thread is all anecdotes.

That's true. And crime statistics aren't much more useful because willingness to report and how well the police handle filing differ a lot between cultures.

Most places also have data from crime surveys, so it's possible to make decent predictions about how much crime is reported or not.

The crime statistics themselves are very useful, there's no need to chuck them about because some level of crime goes unreported. Statisticians have long ago realised that we can measure this too.

Most of your physical security comes from two things:

1) the fact that the rest of us lock our doors, so most ne'er-do-wells have accepted the notion that closed doors tend to be locked. It's a form of herd immunity that protects you so long as only a small number of people behave like you.

2) the shift from cash to electronic money, meaning that physical theft is less lucrative than it once was (and meaning that most money is protected by entities that invest meaningfully in security.)

You're a free rider, benefiting from effort made by others, while being a (small) net negative to society. You're welcome for the security we've provided for you.

1) is not necessarily true. There are entire communities, even in tourist towns that leave their doors unlocked. Just go to Santa Cruz.

It doesn't matter whether or not you buy or use locks.

You passively pay for security at a bar when you buy a drink - the price of the bouncer is part of how they derive the cost of your beer. Similarly you pay taxes (local, state, federal) that pay for a massive amount of physical security that you utilize unknowingly on a day to day basis.

Just because you don't find it necessary to lock up your stuff in your driveway doesn't mean that you can claim that you don't use or pay for physical security.

Wow, what country do you live I that you feel comfortable keeping you door and car unlocked? I've lived I the US and Germany and wouldn't have felt comfortable doing that in either place.

Countries are not granular enough to use for this sort of thing. I've lived in several places in the US where unlocked doors were the norm, and then in several places where it would be a bad idea if you want to keep your things.

I spent a semester abroad in New Zealand and there were people there that left their doors unlocked. Similarly, in college a lot of my classmates left their doors unlocked even though the college administration repeatedly told us not to.

I think it's a density thing. In a small town, there's nobody to steal from you, and even if there was you'd eventually figure out who it was since everybody knows everyone. In a big city, someone can be in and out without you ever knowing, and you would never find them again. Indeed, most of the city residents I met in NZ still locked their doors (the people mentioned above were in smaller villages), while when my family went on vacation to a rural vacation home (in the US) my mom felt comfortable enough to leave the back door unlocked.

There is a lot of places where you can get away with it even in dense area of the US and Germany.

There is some social engineering going on there. If you live in an area where everybody locks his door and don't have a huge problem (like bands of bored teens trying every house, or lots of junkies, ...) the chances are very small that anyone would try to open your door, and if they do, they most likely come prepared. I remember that in my previous flat in the center of London, we left the kitchen window opened for years without even realising it. It would have been trivial to break into our place, but nobody cared. They entered 2 times over the same period at my neighbour place, likely because they saw something they wanted to steal through the window.

I lived in Atherton, CA for a while (granted, one of the richest and safest [1] ZIP codes in the US) and we never locked our house. In fact, I did not even have keys!

[1] https://www.buzzfeed.com/copyranter/police-blotter-reports-f...

Off-topic,

I was once walking through Atherton and a police officer stopped me to make sure I wasn't doing anything suspicious. I suppose the number of "walking while white" infractions a community tallies might be a good (if unfortunate) indication of how wealthy they really are.

The same police officer later bought me a coffee for no particular reason. What a country.

Even more off-topic, here's something I don't understand:

- Cheapest home for sale in Atherton on Zillow is listed for $3.2 million

- The public schools shown to be in the same area as this house have unbelievably low scores (as measured by GreatSchools.org):

-- Selby Lane Elementary (assigned) .... 4/10

-- Garfield Elementary ..................2/10

What gives?

The wealthy people may send their kids to private schools. The public schools may have students from working class families in adjacent areas in the same school district.

I wonder if there is a certain level of wealth where school test scores aren't a worry anymore.

Part of Atherton is in the Menlo Park School District and part of it is in the Redwood City School District. The former is considered to be much better than the latter.

I wouldn't feel exactly comfortable doing that anywhere I've lived since I've began urban living, but here is a fun story (in the U.S, in a high crime city, but a lower crime area):

Before I moved into my second college apartment, the previous tenants warned that they got robbed a few times, and then learned never to open the blinds, and didn't have a problem after that. We therefore never opened the blinds. We pretty quickly broke off a key in the lock and ended up leaving it unlocked except when everyone was gone for multiple days (I won't bother explaining how this worked, or why we didn't get it fixed for a year.)

So our door was always unlocked, but since you couldn't see inside, theft was never the goal of the folks who wandered in. It was always those who were friends and customers of other people in the building who were told they could hang out with us until their friends got back from class or those who had to use the bathroom late at night.

One of my roommates was up until 4 am in the living room every night, and one time someone wandered in while no one was there, and left a note thanking us for letting them use the bathroom, but nothing was ever taken except xbox controllers, and we thought we knew the culprit.

I come from a small town, small enough to yell across and we're perfectly safe leaving our doors unlocked. Home invasions and break ins are unheard of entirely, in the last 30 years at least. Similar behavior in surrounding towns with slightly larger populations.

I lived in a small, ostensibly safe town in Sweden, but people would come in from outside to violate the trust the people had. You need to be good friends with your neighbor so they can confront or report any suspicious outsiders.

This is an embarrassing story, but one time I left my car running outside a coffee shop while I had coffee with a prospective employer for about an hour. When I got to my car it was no longer running but it was blisteringly hot because I had left the heat blasting, and there was a note on the dash that said "I turned your car off, I hope that's ok, your keys are in the console". So yeah, sometimes and in some places stuff doesn't get stolen when it could.

This is an entirely normal thing to do if you live in an area that doesn't have a semi-permanent criminal underclass.

It's not even really a poverty issue - there are places where people are poor as churchmice, but the social stigma around theft is strong enough to keep people in line.

my parents live in an affluent southern california suburb and still do this all the time. when i visit i just walk in the front door.

in most suburban places you can also leave the garage door open all day long just fine.

it's primarily dense cities that are the issue. just like online, when there's transience and anonymity, there's a high incentive for people to behave poorly.

>when there's transience and anonymity, there's a high incentive for people to behave poorly

Sometimes people tend to behave even more poorly if there is no anonymity. This happens when they think that they are morally right in an important area although they are totally wrong. Many racist "this needs to be said" comments are written using real names.

I have relatives in the rural Dakotas who don't really need to lock anything up.

I went to college in Atlanta, where leaving anything slightly valuable inside your vehicle would lead to a smashed window. So I've developed a lifelong paranoia about never leaving valuable items in sight in a locked car.

Also, HN crew if someone is going to rob your house they don't just try to enter in a locked door. The robber is going to knock, if you answer, make up some story how they are looking for Alice & Bob, and go on their way. If nobody answers, then they try to see if your doors are locked. I used to frequently get strangers "looking for someone" at my door in Atlanta, too. Few things are scarier than hearing a knock at the door when you are in bed, ignoring it, then hearing them try to open your door.

May I ask where you lived in Atlanta? I'm attending Tech right now and chose to live outside the city for safety reasons - in Dunwoody to be precise. I never knew it was that bad though.

I guess the long commute is worth it.

I went to Tech too. This was all > 8 years ago though. Staying on/near campus you are much better off, in the sense that access to the building is more restricted and people are going to notice someone sketchy in the hallway. But even on campus cars were frequently robbed, especially at night when I was there. I remember seeing a guy with a backpack full of LCD monitors getting arrested outside the College of Computing once. And bikes were stolen left and right, I lost one.

I once did a Habitat for Humanity build out the Bankhead (not Buckhead, big difference) highway. The had to have Atlanta PD watch the lot DURING THE DAY because multiple cars had been stolen from Habitat Volunteers. I still think that was crazy cars were stolen that brazenly in broad daylight.

I don't have a pulse how things are these days. But don't get scared off by these stories, there are lots of good things about living in the city too. Go Jackets. :)

Yeah, I heard that things are much better than they were back then. I guess I'll reconsider once my lease is finished. The good thing is that MARTA is pretty good and on-time usually from what I saw.

What did you study btw?

Upper-middle-class low-density areas are great for this. Your neighbors have too much to lose to steal anything, and it's too far to bother for out-of-towners.

The epitome of this is most of Switzerland. I went on a Tinder date with a girl recently whose apartment door did not even have a lock.

I don't lock up unless I'll be away for several days, I know many of my neighbors don't either; I live in the outskirts of Copenhagen and it's not even in one of the "fancy" areas.

Not him, but I live in a little village in Bavaria. My mother frequently leaves the doors of her car unlocked at night.

Sure it's different when you're in the city, but out here it's mostly older folks.

I live in a place where anything not locked up will get stolen. I agree with you that something is wrong here, and I am doing my best to fix it. But it's tightly connected with intergenerational poverty. I would love it if you would come help me.

If you're suggesting I should move, then sorry. I would love to live in the woods on a lake and live out my days. I could do that easily. But I think I have a responsibility to help solve the problems the economy that pays my rent is causing. I choose to live in the ghetto where I can see what's going on so that I can help.

> I choose to live in the ghetto where I can see what's going on so that I can help.

If that is true, I very much respect that ...

Anyway, I suppose you know, that people usually adopt to their enviroment. So if you see not so nice changes in your ethics and livestyle, you should probably reconsider your home ...

That's an interesting assumption you're making about the ethics of people who live in ghettos.

An endless abyss sucking money? Most online services, even huge ones, manage to thrive for years with terrible security practices. OpenSSL, the cornerstone of online communication security, had until recently a single full-time developer.

I think it's amazing we manage to spend so little on security.

squeaky wheel gets the grease.

>I don't spend a lot of money on physical security. I leave my car and front door unlocked usually, and don't bother with security systems.

Try living in a bad neighborhood then.

If you already live somewhere nice and safe, the spendings and effort you don't do on security has been done by the state (police), buying or paying rent for the house, etc.

What we need to do to save money, then, is make all neighbourhoods into nice and safe neighbourhoods.

You'll discover that this costs money.

And perhaps more than it saves (like policing, it's a continuous effort too, you can just make the nice and safe and leave them at that).

The boundaries are key here. You just found a community without thieves and our physical world has natural boundaries which prevent other people to enter your community. An analog is some kind of LAN with trusted peers. There's often little to no security in such a networks, the only security is firewall preventing any connections from the outside. But Internet is requires a completely different thinking. You are always living in the worst nightmare, everyone's attacking you constantly, checking your doors and locks. And there are such places in the Earth.

In my city you can't use a wooden door, because thief can easily break it with good kick, so everyone uses heavy iron doors with good locks. You can't leave your automobile with factory locks, it'll be stolen, sooner or later. Everyone uses additional security systems. You can't even leave your bag in the closed car, if your windows are not tinted. Someone will see it, break window and stole your bag. You must use heavily tinted window, so no one from the street could see anything inside. Even the thought that I could leave my car or home unlocked is foreign for me. It's my property, so it's my work to defend it.

"People spend a lot of money on physical security as well."

You would have spent more money on personal entertainment than on your personal security. Your TV, tablet and books would have cost you a lot more than your locks.

Add in the cost of tickets to concerts and plays and your entertainment expenses dwarf any security expenses that you have had.

> That is reality, but calling it "unhealthy" implies that the current state of things is somehow wrong.

The current state of things is wrong, and unhealthy. We may one day achieve a healthier reality after recognizing this is so.

Most digital "security" is theater. Enterprises waste billions on antivirus and vulnerability scanners that are practically worthless.

Anti-virus scanners are viruses. There's nothing like having some yahoo decide that Windows Defender isn't good enough, and so you need multiple, heavily intrusive real-time virus scanners running, fighting with each other, constantly thrashing your hard drive, and making a beefy development workstation waddle along - I already have Visual Studio doing that, but at least that's helping me do my job, not obstructing it...

"Optimized for games" means "optimized for single-precision linear algebra", more or less.

My experience is that double precision is very common on demanding game areas, notably physics. I recall older versions of the ODE physics engine recommending and defaulting to double precision and lots of newbies on the forums being surprised there wasn't much performance difference. That was all some time ago.

My experience is that it's extremely uncommon, including on physics systems. While I no longer work in games, I did for several years, I probably can count the times that I used double precision on one hand (if you exclude the JavaScript work that plagued the end of my game development career).

The reason for this is simple -- it's twice as slow. The vector width is half the size, and so you can do half as many operations at a time.

My experience is just as an amateur, so it's only worth so much. I'm pretty sure though that the difference was much less than a factor of two.

Probably because double precision floats are just as fast as single precisions if you don't vectorise. I bet you didn't.

This would also explain for instance why many programming languages drop single precision floats altogether: they don't plan to vectorize in the first place.

Yeah, it looks like ODE doesn't use SIMD or anything, and hence performs poorly compared to more modern engines: http://blog.wolfire.com/2010/03/Comparing-ODE-and-Bullet

A pretty solid rule of thumb is that 32 bits has enough precision for rendering, physics needs doubles if it's going to use a lot of iterations. Simplified models like Super Mario jumps or the tractor beam in "Thrust" (single rigid joint) can get away with 16-bit fixed point precision.

OTOH rendering of geometry only needs about as much precision as the display offers, which often means 8 bits on older hardware.

This is what I came here to say. With comments in the article such as:

"CPU designers see vastly more benefit to spending area on, e.g.,vectorized floating-point multipliers."

followed by "Intel is doubling the vector size in its newest CPUs---again!---this time from 256 bits to 512 bits."

Seems like they are being optimized to be better at vector math, and games just happen to highly use these pieces of HW.

> Seems like they are being optimized to be better at vector math, and games just happen to highly use these pieces of HW

More likely the other way around ...

Given that games tend to be deployed on a wide range of computers, it's hard for them to use newer x86 extensions (e.g. AVX), while most scientific computing applications tend to be compiled for a specific machine. To get to see the larger improvements, you must use the newer instructions and registers, like you can see in BLAS benchmarks[1].

[1]: https://www.bountysource.com/teams/openblas/fundraiser

Yep, at my old job we still had to support Windows XP 32 bit for the game client (internal tools were Windows 7 64 bit) as so many people were still playing on systems. I don't remember if we could use SSE2 or what the minimum was in that regard.

Some compilers support multiple codepaths depending on the supported instruction set. Intel's C++ compiler makes this easy, for instance.

> Seems like they are being optimized to be better at vector math, and games just happen to highly use these pieces of HW.

It may in fact be that desktop/mobile CPUs are being optimized for their contemporary benchmark suites, thus targeting the ensuing benefits in marketing. The benchmarks themselves were, for a fair amount of their existence, focused on games-related performance, at least from what I recall.

I don't mind the downvotes, but more interested to know why if anyone cares to comment? I should have specified that by desktop/mobile, I do mean desktop/laptop essentially (and, not smartphone CPUs). And, I am talking about Intel/AMD largely, and how I perceive their evolution over the past two and half decades.

In short, I think "optimizing for games" means nothing to a CPU designer at say Intel, and anyways qualitative differences (expanding the ISA, or integrating new features on the IC) are more expensive to develop and sometimes tricky to market. Instead, marketing quantitative differences is much easier (hence optimize for benchmarks) - though arguably no easier to develop. Witness Intel's first rocky attempt at targeting the benchmarks in the early 2000s: Netburst [0]. Of course, in the past 5 years, things have changed (the rise of smartphones, meteoric rise in GPU performance with expanding markets & new software, CPU "per core" performance stagnation), so Intel is in the process of re-positioning itself.

[0] https://en.wikipedia.org/wiki/NetBurst_(microarchitecture)

So then you better optimize your algorithms and apps for a world where CPUs are good at single-precision BLAS stuff.

Which is funny, because games would have benefited more from half (16 bit floats) HW support. There is almost no support on CPUs (X360's CPU had conversion to and from half, IIRC, and ARM in handhelds supposedly supports full half arithmetics), even less on x86/x64 CPUs specifically.

The comedy here is that AMD and NVIDIA are adding it to CPU and GPU designs for the benefit of DNN training workloads; something that took off because of hardware designed for video games ;)

> Sometimes I can't help but wonder how the world where there is no need to spend endless billions on "cybersecurity", "infosec" would look like.

A goofy example, but I suspect that the aliens in the Independence Day film lived in such a world; their system didn't seem to have too much security - and why would you need any, in a telepathic society?

Additionally, I believe they functioned as a hive mind. It would be like an individual trying to keep their password secret from another part of their body.

That brings up an interesting hypothetical... Is it possible to have a password that you don't even know? Sure biometrics is one method, but are there any password schemes that work on things like word associations or unconscious behaviors found during the typing process, like statistical analysis of the time between key presses?

I remember doing an online course and they had me type several paragraphs in order to determine my typing "signature" but it seems doubtful to me that it would be precise enough to be used for authentication.

Yep, it's possible, at least to some extent.

https://www.technologyreview.com/s/515726/a-password-so-secr...

> Is it possible to have a password that you don't even know?

Certainly, that's why the "forget password" link is so common ;)

> It would be like an individual trying to keep their password secret from another part of their body.

Trying to recall a password that I commited only to muscle memory is damn near impossible without some kind of keyboard in front of me.

I'm not convinced that they were a hive mind, but that's a discussion for another forum :P

(edit: in fact, I went ahead and posted the question: https://www.reddit.com/r/AskScienceFiction/comments/4x7yin/i...)

> Is it possible to have a password that you don't even know?

Seemingly, yes, according to https://www.usenix.org/conference/usenixsecurity12/technical... , which has a paper I read a while ago and a video I never got around to watching.

Abstract:

Cryptographic systems often rely on the secrecy of cryptographic keys given to users. Many schemes, however, cannot resist coercion attacks where the user is forcibly asked by an attacker to reveal the key. These attacks, known as rubber hose cryptanalysis, are often the easiest way to defeat cryptography. We present a defense against coercion attacks using the concept of implicit learning from cognitive psychology. Implicit learning refers to learning of patterns without any conscious knowledge of the learned pattern. We use a carefully crafted computer game to plant a secret password in the participant’s brain without the participant having any conscious knowledge of the trained password. While the planted secret can be used for authentication, the participant cannot be coerced into revealing it since he or she has no conscious knowledge of it. We performed a number of user studies using Amazon’s Mechanical Turk to verify that participants can successfully re-authenticate over time and that they are unable to reconstruct or even recognize short fragments of the planted secret.

Another possibly unpopular opinion: having some bad people makes us safer on the whole. If the world were perfectly safe, and we didn't have to study and invest in security, redundancy, weapons, emergency response, and so on - we become more vulnerable as a race to potential future badness. Phrased differently, if badness is physically/theoretically possible, we're better off having to practice defending against it, than be caught off guard when it does manifest later on (by natural events, aliens, whatever).

Similarly with war, there is likely some optimal level above zero that increases our overall safety as humans by honing our abilities in force.

That's a key part of Bernstein's argument. ChaCha20 and Salsa20 take advantage of optimizations made for games.

Games use floats and pointers, and I suspect the only floating point bits they use is the 52-bit integer multiply that was added specifically to optimize crypto algorithms.

The integer vector extensions they're almost certainly using I'd argue are primarily designed to optimize various codecs not games; unsurprisingly, crypto algorithms tend to have similar CPU loads to compression algorithms.

I didn't read this as lamenting the state of CPU development. Instead, the argument showed how chacha and similar software ciphers benefit more that hardware ciphers (such as aes) from the current state of CPU development.

It was a really big deal for a long time that a better 2d graphics card meant your spreadsheet software ran faster.

People would justify getting a better machine for playing games by saying that it would make their work more productive too.

In more recent times, look at all of the video games that made sure they could run well enough for casual players on a reasonably recent vintage laptop. I know I bought a new laptop at least once specifically so that a video game would be playable. My code compiled a lot faster on it (SSD) but I accept that I really bought it for playing games.

A long, long time ago, I read a blog post in which a developer chided people for making expensive-to-develop games that could only run on 5% of PCs, then complaining about low sales. His point was, "Why would you drive up your development costs just to drive down your potential sales?"

edit: found it http://draginol.joeuser.com/article/303512/Piracy_PC_Gaming

We lived in a world where we didn't spend anything on security, and it was awesome. That's the environment that unix, the internet, web browsers, IRC, and all the other really cools stuff we use every day was developed in. Hacking, exploring, and sharing was encouraged, easy, and expected.

Now what do we have? Ssl protecting the packets that we broadcast to everyone on ad delivery platforms.

We grew our computer systems in a clean room, and inadvertently gave them Bubble-Boy syndrome - https://en.wikipedia.org/wiki/Bubble_Boy

Now what do we have? Now we're spending more money time and effort, getting poor and limited solutions, trying to patch up email sender verification, shove SELinux around things, wrap every browser request in "are you sure?" modal dialogs and "Request refused for your protection" trip-ups, replace IRC-plain-text-chat with "text-chat in a browser" (Slack, Discord) or walled gardens (iMessage, Google, Skype), fight hard to replace C with languages where buffer-overflows aren't one mistake away and everything isn't de-facto built around rudimentary-types and string-concatenation, and do it all without compromising backwards compatibility or established user experience too hard.

'Awesome'.

Plus, cryptography's speed/strength levels aren't really the weak-link in security anyway.

The real problem is, for lack of a better term, the mentality of individuals and businesses. It doesn't matter how uncrackable and fast your encryption is if nobody uses it because it's fundamentally inconvenient or hard to justify on a balance-sheet.

I once heard a priest say:

'Every time I use a key in a lock, I am reminded that we live in a fallen world'

It's kind of sad isn't it.

I feel you. Plus being a security expert means that you are competing in an arms race which you have no chance of winning. It always bothers me that there are a lot of people who want to brake things and I have to think about security concerns just because of them.

Games can usually tolerate some cheating because it's just a game. But they're hardly immune. Spam and abuse make everything suck, definitely including games.

Now, put real money on the line and you get the gambling industry which is much more serious about security.

Interested in understanding why spending billions to literally "play games" is okay, but it's illogical for governments to secure digital assets and if needed, attack digital assets as needed.

Yes, I get it makes sense that there's more of a market for fun stuff than serious stuff, but putting aside security theatre, false flag operations, etc. - the idea that there aren't really threats in the world seems like it needs a bit more explanation.

Ehmm. That's how the world has functioned since before humans existed; it's inbuilt into our evolutionary system. Competing for resources is what we have evolved to do, whether this competition is against other humans or other animals is irrelevant.

Nature doesn't have any inherent ethical system, so unless you can fault the universe for existing incorrectly, I don't buy your argument.

Yeah but games the majority of people want to play don't need special hardware. I mean how much horsepower does Solitaire, Tetris, Minecraft or Angry Birds take?

How many people play call of duty? Overwatch? Battlefield? Skyrim? Not the majority of people, but a hell of a lot of people still.

But now the question is: is it still reasonable to design all CPUs for that segment of a segment of customers?

Yeah, because gamers have the deepest pockets in consumer-grade hardware, that isn't a tiny niche segment. Business users aren't tricking out desktops to the tune of thousands of dollars to push the envelope of performance.

Well, aside from the cult of Mac... They spend the same amount of money as gamers, but for bog-standard commodity hardware in a pretty case.

How much of a percentage do gaming rigs actually constitute of CPU sales?

That is not the correct question. The correct question is: How much of a percentage do gaming rigs actually constitute of high-end CPU sales.

Gamers are willing to pay three times the price for hardware just to get a few percent more performance. I would claim that drives innovation.

I agree with the question though maybe not the assumption that goes with it.

I imagine professional workstations for industries such as software development, visual arts, industrial design, film production, music production etc. are large users of high end CPUs.

My gut says that all of these fields are much smaller worlds than you assume, especially when compared to the 7-11 million concurrent Steam users and countless more PC gamers in countries like China and Korea.

"I imagine professional workstations for industries such as software development, visual arts, industrial design, film production, music production etc. are large users of high end CPUs.

None of them uses overclocked CPUs (like Intel's K-series) that's fairly standard for high-end gaming

Don't disregard the amount of computation Minecraft does. It is not in the same league as the other games you mention. Even more so if you place blocks that require frequent updates (such as redstone logic).

I'm sure Minecraft does a lot of impressive things on a technical level.

However, I remember running it just fine on an old XP machine with a 32bit, single-core pentium III and 2GB of RAM. In addition, this game has been available on smartphones quite some (phone model) generations ago.

> I'm sure Minecraft does a lot of impressive things on a technical level.

Actually, Minecraft is widely derided as being extremely wasteful with resources. And yet yeah, it still runs on my kids' 9-year-old laptop.

The smartphone version isn't the same as the desktop version - it was literally rewritten from scratch, and as such is much more performant, although it lost support for mods of the original version as a result.

I wonder the same about ads.

Most frequently, good security is the absence of vulnerabilities. When vulnerabilities are bugs, security is software quality. A lot of other techniques are just mitigation, and the "endless billions on cybersecurity" is often security theater and optics.

Yes - imagine there's no countries, it isn't hard to do. Nothing to kill or die for - and no religion, too.

Someone should write a song about it.

Reply on news.ycombinator.com