Positive Bias Test (C++ program)

post by MBlume · 2009-05-19T21:32:43.353Z · LW · GW · Legacy · 79 comments

I've written a program which tests positive bias using Wason's procedure from "On the failure to eliminate hypotheses in a conceptual task" (Quarterly Journal of Experimental Psychology, 12: 129-140, 1960). If the user does not discover the correct rule, the program attempts to guess, based on the user's input, what rule the user did find, and explains the existence of the more general rule. The program then directs the user here.

I'd like to use a better set of triplets, and perhaps include more wrong rules. The program should be fairly flexible in this way.

I'd also like to set up a web-based front-end to the program, but I do not currently know any cgi.

I'm not completely happy with the program's textual output. It still feels a bit like the program is scolding the user at the end. Not quite sure how to fix this.

Program source

ETA: Here is a macintosh executable version of the program. I do not have any means to make an exe file, but if anyone does, I can host it.

If you're on Linux, I'm just going to assume you know what to do with a .cpp file =P

Here is a sample run of the program (if you're unfamiliar with positive bias, or the wason test, I'd really encourage you to try it yourself before reading):

Hi there! We're going to play a game based on a classic cognitive science experiment first performed by Peter Wason in 1960 (references at the end)

Here's how it works. I'm thinking of a rule which separates sequences of three numbers into 'awesome' triplets, and not-so-awesome triplets. I'll tell you for free that 2 4 6 is an awesome triplet.

What you need to do is to figure out which rule I'm thinking of. To help you do that, I'm going to let you experiment for a bit. Enter any three numbers, and I'll tell you whether they are awesome or not. You can do this as many times as you like, so please take your time.

When you're sure you know what the rule is, just enter 0 0 0, and I'll test you to see if you've correctly worked out what the rule is.

Enter three numbers separated by spaces: 3 6 9

3, 6, 9 is an AWESOME triplet!

Enter three numbers separated by spaces: 10 20 30

10, 20, 30 is an AWESOME triplet!

Enter three numbers separated by spaces: 8 16 24

8, 16, 24 is an AWESOME triplet!

Enter three numbers separated by spaces: 0 0 0

So, you're pretty sure what the rule is now? Cool. I'm going to give you some sets of numbers, and you can tell me whether they seem awesome to you or not.
Would you say that 3, 6, 9 looks like an awesome triplet? (type y/n)
y

Would you say that 6, 4, 2 looks like an awesome triplet? (type y/n)
n

Would you say that 8, 10, 12 looks like an awesome triplet? (type y/n)
n

Would you say that 1, 17, 33 looks like an awesome triplet? (type y/n)
n

Would you say that 18, 9, 0 looks like an awesome triplet? (type y/n)
n

Would you say that 1, 7, 3 looks like an awesome triplet? (type y/n)
n

Would you say that 3, 5, 7 looks like an awesome triplet? (type y/n)
n

Would you say that 2, 9, 15 looks like an awesome triplet? (type y/n)
n

Would you say that 5, 10, 15 looks like an awesome triplet? (type y/n)
y

Would you say that 3, 1, 4 looks like an awesome triplet? (type y/n)
n

You thought that 3, 6, 9 was awesome.
In fact it is awesome.

You thought that 6, 4, 2 was not awesome.
In fact it is not awesome.

You thought that 8, 10, 12 was not awesome.
In fact it is awesome.

You thought that 1, 17, 33 was not awesome.
In fact it is awesome.

You thought that 18, 9, 0 was not awesome.
In fact it is not awesome.

You thought that 1, 7, 3 was not awesome.
In fact it is not awesome.

You thought that 3, 5, 7 was not awesome.
In fact it is awesome.

You thought that 2, 9, 15 was not awesome.
In fact it is awesome.

You thought that 5, 10, 15 was awesome.
In fact it is awesome.

You thought that 3, 1, 4 was not awesome.
In fact it is not awesome.

It looks as though you thought the rule was that awesome triplets contained three successive multiples of the same number, like 3,6,9, or 6,12,18. In fact, awesome triplets are simply triplets in which each number is greater than the previous one.

The rule for awesomeness was a fairly simple one, but you invented a more complicated, more specific rule, which happened to fit the first triplet you saw. In experimental tests, it has been found that 80% of subjects do just this, and then never test any of the triplets that *don't* fit their rule. If they did, they would immediately see the more general rule that was applying. This is a case of what psychologists call 'positive bias'. It is one of the many biases, or fundamental errors, which beset the human mind.

There is a thriving community of rationalists at the website Less Wrong (http://www.lesswrong.com) who are working to find ways to correct these fundamental errors. If you'd like to learn how to perform better with the hardware you have, you may want to pay them a visit.

If you'd like to learn more about positive bias, you may enjoy the article 'Positive Bias: Look Into the Dark': http://www.overcomingbias.com/2007/08/positive-bias-l.html
If you'd like to learn more about the experiment which inspired this test, look for a paper titled 'On the failure to eliminate hypotheses in a conceptual task' (Quarterly Journal of Experimental Psychology, 12: 129-140, 1960)

79 comments

Comments sorted by top scores.

comment by JGWeissman · 2009-05-20T05:13:20.164Z · LW(p) · GW(p)

Here is a version in HTML/JavaScript.

The style could use some improvement.

And I still think it would be nice to have a version that does not depend on client scripting. I could do it easily in asp.Net, but if anyone wants to do it Python, that would probably be more compatible with the existing server scripting. (Edit: darius has provided a Python implementation.)

Also, does anyone know of a better file hosting site? I apologize for the captcha needed to download.

Replies from: MichaelHoward, ChrisHibbert, Vladimir_Golovin
comment by MichaelHoward · 2009-05-20T12:50:54.706Z · LW(p) · GW(p)

Odd, I just get "Sorry, your time to enter the code has expired. Please try again". Tried with Firefox 3.0.10 and IE 7.0.5730.13.

Replies from: Vladimir_Golovin
comment by Vladimir_Golovin · 2009-05-20T12:54:22.997Z · LW(p) · GW(p)

Look below the table -- there should be a link "Download for free with FileFactory Basic". (I downloaded it using Firefox.)

Replies from: MichaelHoward
comment by MichaelHoward · 2009-05-20T21:12:55.915Z · LW(p) · GW(p)

That worked, thanks. :)

comment by ChrisHibbert · 2009-05-20T16:27:06.527Z · LW(p) · GW(p)

One advantage of the executable is that you don't lose a record of your previous questions and answers. I think this is crucial, and ought to be included in a webbed version as well. It was annoying that the text entry boxes didn't let me type in order to enter my guess.

But thanks for writing this version to get us started on the web.

Replies from: cabalamat
comment by cabalamat · 2009-05-21T02:21:52.418Z · LW(p) · GW(p)

One advantage of the executable is that you don't lose a record of your previous questions and answers. I think this is crucial, and ought to be included in a webbed version as well.

sorted

comment by Vladimir_Golovin · 2009-05-20T10:07:19.630Z · LW(p) · GW(p)

Thanks -- works perfectly!

comment by darius · 2009-05-20T23:54:24.264Z · LW(p) · GW(p)

A quick-and-dirty server-based webification (no Javascript): http://wry.me:7002/ with source code at http://github.com/darius/wason/ (only lightly tested).

Replies from: JGWeissman
comment by JGWeissman · 2009-05-21T02:26:33.310Z · LW(p) · GW(p)

Nice work. It seemed responsive enough to me without client scripting. Unless people with slow connections report that the JavaScript version is faster, I think this is (the start of) the only version we need.

Some ideas for improvement:

  • Make 3 input boxes for the 3 elements of the triplet.

  • All results should include a short explanation of the Positive Bias, and an introduction to Less Wrong, including (the perfect result and "no rule" result).

  • It would be nice to make it StumbleUpon friendly, we can get a lot of hits from Stumblers. If it maintains the same URL at every stage, and provides different content based on the Post data, then StumbleUpon would not get confused by people thumbing up at different points in the test. As it is, the URL http://wry.me:7002/start returns an error when retrieved with a GET.

Replies from: darius
comment by darius · 2009-05-21T09:32:15.021Z · LW(p) · GW(p)

Thanks! I've addressed your latter two points (perhaps too minimally); though I think 3 input boxes would actually be less usable. I just made it accept both commas and spaces as delimiters instead.

If anyone would like to make a nice, pretty version, that should be easier now with the rule logic better-factored.

comment by Apprentice · 2009-05-20T13:19:07.267Z · LW(p) · GW(p)

Nice! Is this a recruitment tool like the Scientology personality test? I guess it worked 'cause I just created an account :)

So, now that I've joined the cult - what's the major deity worshiped in these parts? I hear a lot about this Omega guy, maybe that's it. I also understand that salvation has something to do with lots and lots of liquid nitrogen. Oh, and some really cool robots!

Slightly more seriously, I think delivering this Wason test in a handy computer program which you can take with no-one watching you may increase the success rate. I could quickly test dozens of triplets and I tested any idea that came to my mind. In a supervised test where I'd had to ask the test administrator whether a given triplet was correct I might have been afraid to appear stupid by asking about overly many triplets or overly "silly" triplets or something like that.

(I'd personally never heard about this test before and ran the program without first reading the article - I tested 50 or so combinations and at one point crashed the program by feeding it floating point numbers. I got the rule right.)

comment by darius · 2009-05-24T01:53:09.786Z · LW(p) · GW(p)

I just skimmed the results from it running the last few days at http://wry.me:7002/ -- it ran through to the end 49 times: 21 times the player got the right rule with no errors, 10 times they apparently got it right but with some errors, and 18 times they got it wrong. Of course I don't know who was playing or what they may have read just before.

comment by evtujo · 2009-05-23T04:42:33.031Z · LW(p) · GW(p)

I wonder if I'm the only person here so biased, but when you wrote that you used c++ my instant and curiously strong reaction was: why would you use c++ on something like that? that's obviously a python (or similar language) type project.

i'm working on forgiving you.

Replies from: MBlume, Bugmaster
comment by MBlume · 2011-12-16T19:37:25.497Z · LW(p) · GW(p)

I learned C++ in high school and didn't make an effort to learn anything different in college or grad school. I now make a living as a python programmer, and if I had to write this again, I wouldn't consider C++ for half a second =)

comment by Bugmaster · 2011-12-16T19:48:17.502Z · LW(p) · GW(p)

I learned C++ in high school as well (before STL became widespread, get off my lawn), and regret it. I'd rather program in raw assembly than in C++. Ok, ok, in practical terms I use plain old C when I need some piece of code to be small and fast, but still. C++ is like the crazy uncle of programming. No one will come to your birthday party just because he might be there.

comment by CronoDAS · 2009-05-20T19:16:10.772Z · LW(p) · GW(p)

Something slightly related:

Petals Around The Rose

Replies from: Vladimir_Nesov
comment by Vladimir_Nesov · 2009-05-20T19:37:30.292Z · LW(p) · GW(p)

Not quite, this game doesn't provide unlimited confirmation for your wrong guess.

comment by Simetrical · 2009-05-20T14:55:38.754Z · LW(p) · GW(p)

I got the wrong rule, but it said I was right because I made only one mistake. I thought the rule was that a sequence was awesome if it was an increasing arithmetic progression. The only one of your examples at the end that contradicted this was 2, 9, 15. All the other awesome ones were, in fact, increasing arithmetic progressions: five out of the six awesome sequences you gave at the end. You should probably cut that down to two or three, so I'd have lost.

comment by MorganHouse · 2009-05-20T08:59:56.251Z · LW(p) · GW(p)

This reminded me of another experiment:

The subject is left alone in front of a machine with a number of dials, buttons and levers. The subject can interact with the machine however he wants. Sometimes, a piece of candy comes out of the machine. The experimenter comes back in after a while, and asks the subject how to interact with the machine for a piece of candy to come out. Most subjects will have discovered a sequence of actions that will lead to this result. However, the simplest correct answer is that the machine hands out a piece of candy every 30 seconds.

This was explained to me in a bar back in 2002 (approximately), by someone who had just seen a cinema documentary featuring this experiment. I am unable to find the name of the experiment; maybe someone else can help?

Replies from: MBlume
comment by MBlume · 2009-05-20T09:19:50.596Z · LW(p) · GW(p)

It reminds me distinctly of the skinner box experiment, which was essentially the same, but done with pigeons (who, of course, could not actually explain their procedures)

It also rather reminds me of actors avoiding macbeth, athletes wearing lucky garments, etc. etc.

comment by Nominull · 2009-05-20T01:23:54.529Z · LW(p) · GW(p)

Program could use some protection against invalid input, along the lines of

if(!(cin >> n1 >> n2 >> n3)) { ndone=false; }

and if you really wanted to get fancy you could throw in an error message when it occurs

it's not nice to have a program that goes into an infinite loop if you give it a letter instead of a number

Replies from: MBlume
comment by MBlume · 2009-05-20T01:29:48.077Z · LW(p) · GW(p)

wow, I didn't know iostream was that badly broken.

Fixed, though it now aborts completely if you give it a letter.

Replies from: CronoDAS
comment by CronoDAS · 2009-05-20T04:33:34.915Z · LW(p) · GW(p)

It could be worse. The C++ keyboard console input libraries are, indeed, horrible - but you could be stuck trying to do the same thing in plain old C. ::shudders::

comment by AndrewKemendo · 2009-05-21T00:08:30.805Z · LW(p) · GW(p)

I think the game primes you to make the bias through the example:

I'll tell you for free that 2 4 6 is an awesome triplet.

So the results may be significantly skewed

Replies from: Vladimir_Nesov
comment by Vladimir_Nesov · 2009-05-21T00:44:15.663Z · LW(p) · GW(p)

That's kinda the point. And then you get unlimited confirmation for the wrong idea you got from this example, unless you are clever enough to perform negative tests too.

Replies from: AndrewKemendo, Cameron_Taylor
comment by AndrewKemendo · 2009-05-21T20:35:16.435Z · LW(p) · GW(p)

So then this seems like the test would then be more priming centered rather than positively bias based. If it was truly a pure positive bias test then there should be no hypothesis primed through example.

I am learning to play GO right now and it is very hard to start to play effectively because there are very few instructional guides which give you strategies. Rather, each guide simply explicates the rules and lets you free to make your own hypotheses. Such an example would be a better bias test in my opinion. This is a simple fix, eliminate the example, and may give a more accurate result.

comment by Cameron_Taylor · 2009-05-21T01:49:28.522Z · LW(p) · GW(p)

"Susceptability to Trick Question Bias"

Replies from: Craig_Morgan
comment by Craig_Morgan · 2009-05-21T05:05:37.014Z · LW(p) · GW(p)

It is absolutely NOT a trick question.

There are an infinite number of hypotheses for what an 'Awesome Triplet' could be. Here are some example hypotheses that could be true based on our initial evidence '2 4 6 is an awesome triplet':

  1. Any three integers
  2. Any three integers in ascending order
  3. Three successive multiples of the same number
  4. The sequence '2 4 6'
  5. Three integers not contained in the set '512 231123 691 9834 91238 1'

We cannot falsify every possible hypothesis, so we need a strategy to falsify hypotheses, starting from the most likely. All hypotheses are not created equal.

I want to falsify as much of the hypotheses-space as possible (where simple hypthoses take up more space), so I design a test that should do so. My first test was '3 integers in descending order', because it can falsify #1, the simplest hypothesis. I find from this test that #1 is false. My second test is to distinguish between #2 & #3; '3 integers in ascending order, but not successive multiples of the same number', '1 2 5' I find from this test that #2 is still plausible, but #3 is falsified.

You can continue falsifying smaller and smaller areas of the hypothesis-space with additional tests, up until you're happy with your confidence level or you're bored of testing.

For much better coverage of this entire area, see the following posts by Eliezer:

For a good overview of additional related posts, see the list.

Edit: Learning Markdown, fixing style.

Replies from: Cameron_Taylor
comment by Cameron_Taylor · 2009-05-21T05:37:54.932Z · LW(p) · GW(p)

There is a real positive bias and this program helps confirm it.

Something that must be considered is whether the form of the test could have an influence on the outcome for reasons other than an intrinsic positive bias. More specifically, I note that the form of the question the participant has been given resembles that of question style that I have encountered many a time. In most of these cases I am expected to elicit the questioner's intended meaning, usually something specific. Were I to give the answer "actually, it could be any integers in ascending order" I would expect less marks or mild dissaproval for being a smart ass.

The test is set up to confirm the positive bias without eliminating the possibility of simple cultural training on the test format and initial priming. I would like to look at alternate tests setups, perhaps including explicitly declared random triplets and some betting.

As it stands, the test strikes me as a little ironic!

comment by Mike Bishop (MichaelBishop) · 2009-05-20T15:17:32.673Z · LW(p) · GW(p)

If the experimental subjects aren't taking their task seriously the results are unsurprising. I would think more of this experiment if it has been repeated with financial incentives for getting the answer right. Its also quite possible that people would do better if the task were less abstract... the type of problem solving they might do in real life.

It seems a reference to http://en.wikipedia.org/wiki/Confirmation_bias is in order here.

comment by John_Maxwell (John_Maxwell_IV) · 2009-05-20T23:36:10.154Z · LW(p) · GW(p)

I tried the macintosh executable. Double-clicking did nothing except bring the Terminal application to the front. I attempted to execute it from Terminal and was told I didn't have execute privileges. I added the execute privilege, attempted to execute again, and got a segmentation fault.

Replies from: arthurlewis
comment by arthurlewis · 2009-05-24T06:30:59.639Z · LW(p) · GW(p)

It's an Intel binary; perhaps you're on PowerPC?

Replies from: John_Maxwell_IV
comment by John_Maxwell (John_Maxwell_IV) · 2009-05-24T19:58:02.294Z · LW(p) · GW(p)

No, I'm on intel.

It's not that important; the html/javascript version worked.

comment by lavalamp · 2009-05-20T21:04:10.913Z · LW(p) · GW(p)

4 out of 5 people fail this? Seriously? I'm having a really hard time believing that, I'm going to have to administer this test to people.

Visual Studio 2005 reports stack corruption after it exits, btw.

Replies from: darius
comment by darius · 2009-05-20T23:10:36.678Z · LW(p) · GW(p)

I believe that's because line 23 should be

bool mywrongtests [NUMTESTS+1];

(It's missing the "+1".)

comment by AllanCrossman · 2009-05-19T22:01:49.792Z · LW(p) · GW(p)

Failed to compile for me until I removed a linebreak on line 120...

Replies from: MBlume
comment by MBlume · 2009-05-19T22:04:24.409Z · LW(p) · GW(p)

thanks -- fixed =)

comment by SoullessAutomaton · 2009-05-19T21:54:34.044Z · LW(p) · GW(p)

A web-based front end would be easy enough if written using an appropriate language and framework--something simple in PHP or whatnot. A CGI program in C++ would likely involve unnecessary amounts of wheel-reinventing.

It would be nice if there were more than just a single rule. How much work do you think it would be to come up with new rules?

Also, have you heard of the game Zendo?

Replies from: cousin_it, Alicorn
comment by cousin_it · 2009-05-19T23:04:11.267Z · LW(p) · GW(p)

Absolutely no need for PHP, CGI, frameworks or whatever. The whole thing can be written purely client-side in one file of HTML and JavaScript. Couple hours' project for a competent person with Notepad.

Replies from: JGWeissman
comment by JGWeissman · 2009-05-19T23:16:59.766Z · LW(p) · GW(p)

I use Firefox with NoScript and StumbleUpon. If I stumble a site that does not show any content because it needs javascript, I do not white list it (I do not need to see the dancing pigs), I just go on to the next stumble.

An implementation that does not need client side scripting could reach a larger audience.

Replies from: SoullessAutomaton, Simetrical
comment by SoullessAutomaton · 2009-05-19T23:25:50.165Z · LW(p) · GW(p)

The "NoScript" demographic is relatively small, I suspect, but potentially has a lot of overlap with people who might be interested in this.

Replies from: Douglas_Knight, taw
comment by Douglas_Knight · 2009-05-20T17:45:43.242Z · LW(p) · GW(p)

It's NoScript+interested+StumbleUpon. Is StumbleUpon a good way of promoting things? I bet that there is negative correlation between NoScript & StumbleUpon.

Anyhow, JGW's first claim, that it is a terrible failure mode to produce a blank screen in the absence of js, is true and very cheap to fix.

Replies from: pjeby, Alicorn
comment by pjeby · 2009-05-20T20:00:39.004Z · LW(p) · GW(p)

I bet that there is negative correlation between NoScript & StumbleUpon.

From StumbleUpon's advertiser FAQ:

A large portion of our Firefox users have added the NoScript add-on to their browser. This is one of the top-10 most popular extensions for Firefox. This extension blocks any javascript calls that the user doesn't approve of. Blocking javascript causes Urchin, Google Analytics, Webtrends, etc to not work. These tracking services never see the traffic because NoScipt blocks it.

You may see a larger difference in reported traffic than with other advertising services because StumbleUpon has a much higher proportion of Firefox users -- and in particular, a much larger proportion of people who use browser extensions -- than a typical audience. In essence, StumbleUpon's early-adopter user-base is much more privacy and security conscious than the typical internet user, and they block tracking services as a result.

comment by Alicorn · 2009-05-20T18:05:03.360Z · LW(p) · GW(p)

Nitpick: Such a negative correlation between two Firefox extensions probably only persists in the set of Firefox users, not over Internet users at large, since (inexplicably) Firefox is not overwhelmingly popular among Internet users in general. (It's possible that it is overwhelmingly popular in the set of people interested in this program, though.)

comment by taw · 2009-05-20T09:51:39.160Z · LW(p) · GW(p)

I'm all for ignoring the NoScript demographic - JavaScript is one of the basic building blocks of the web, and turning it off is just totally stupid.

Replies from: thomblake, JGWeissman
comment by thomblake · 2009-05-20T17:23:44.859Z · LW(p) · GW(p)

Turning it off is not "just totally stupid". For one thing, scripts are sometimes annoying, and most of the web can still be successfully navigated without bothering with them. Turning scripts off can greatly decrease site load times, browser overhead, and network traffic.

For another, you don't know what sort of user agent the customer is using - there are a lot of browsers for particular accessibility issues or other purposes that do not evenly support Javascript.

Supporting lack of javascript is just plain best practice, based on the principle of progressive enhancement.

comment by JGWeissman · 2009-05-20T18:18:00.272Z · LW(p) · GW(p)

Are you aware that with JavaScript, I can get your browser to submit a form to another site you are logged in to, that foolishly only validates sessions by cookies, and the other site will think you wanted to do that, and you would never know it happened?

Knowing this, would you still consider those who don't want JavaScript enabled when visiting sites they don't explicitly trust to be stupid?

Replies from: whpearson, taw, Vladimir_Nesov
comment by whpearson · 2009-05-20T21:23:33.591Z · LW(p) · GW(p)

Cross site scripting is the main vulnerability caused by javascript, not request forgery.

I use noscript. It helps disable annoying ads.

Replies from: JGWeissman
comment by JGWeissman · 2009-05-20T21:42:08.699Z · LW(p) · GW(p)

Cross Site Scripting is the main vulnerability caused by javascript hosted on trusted sites. The problem there is that a hacker has managed to inject javascript onto the page (perhaps by submitting a comment that the server fails to encode for HTML) allowing the script to gather information provided in the version of the page associated with my login, and send that information to the hacker's server. NoScript does provide some protection against this, but this is by suppressing the methods the injected script uses to report back to the hostile server. It only helps by disabling JavaScript when the injected attack loads a script from a (non white listed) hostile domain.

Cross Site Forgery, on the other hand, is an attack by JavaScript hosted on a random untrusted site I visit, perhaps by Stumbling. NoScript provides excellent protection against this simply by turning of JavaScript.

Replies from: whpearson
comment by whpearson · 2009-05-20T22:02:06.844Z · LW(p) · GW(p)

You can still have XSRF attacks without javascript though... so they are not caused by javascript but facilitated. Harder but doable, and you might protect yourself from some in the wild by turning off javascript.

Reading up about this a bit more it does appear that noscript does help against XSRF even those that don't use javascript, by changing post requests from untrusted sites to empty gets.

More details can be found on the noscript developers blog,

Editted: Made correction suggested by child post of JGWeismann,

Replies from: JGWeissman
comment by JGWeissman · 2009-05-20T22:33:16.854Z · LW(p) · GW(p)

Reading up about this a bit more it does appear that noscript does help against XSRF even those that don't use javascript, by changing post requests to untrusted sites to empty gets.

Neat. Though I think you meant "changing post requests from untrusted sites to trusted sites to empty gets", as would be expected to protect against Cross Site Forgery.

comment by taw · 2009-05-20T20:59:29.357Z · LW(p) · GW(p)

I agree with Vladimir Nesov - this is not relevant, and you seem to be using a soldier-argument. Anyway, validating write requests with cookies without auth tokens is plainly wrong, and there are trivial ways to do it right (automatically add auth token to all write forms, read-only forms like search boxes are not affected in any way by CSRF).

And you can do CSRF with "Press button to see kittens" trick, without a single line of Javascript. You can also read browser history with CSS, without Javascript. There aren't that terribly many security failures that you can do with Javascripts but cannot without, and in any case it's like using dynamite to deal with mosquitoes - completely disproportional reaction.

Yes, this is plain stupid.

Replies from: JGWeissman
comment by JGWeissman · 2009-05-20T22:26:20.051Z · LW(p) · GW(p)

Suppose Mallory has identified 100 websites that are vulnerable to high valued Cross Site Forgery attacks. (The administrators of these websites failed to use any of the trivial ways to prevent this. Some users, though they can't fix the servers, still want to protect themselves.) Is Mallory going to make a site that attempts to entice a user to click a button that apparently won't do anything, but will actually attempt an attack that will work if the user happens to have an account and be currently logged in to the one targeted site? Or is he going to create a site that has some interesting content that may even entice the user to come back later, that will silently run a script that attempts an attack on every vulnerable site Mallory knows, every time the user visits, without the user having to press any buttons?

You can also read browser history with CSS, without Javascript.

Good to know, though it would have been nice to actually provide a description or a link instead of making me search for it. Though, finding a weakness in my armor does not convince me to abandon my armor which still protects me against many threats. I will consider strengthening my armor. (Unfortunately, it appears the linked extension only supports Firefox 2, but I will see what else I can find.)

I agree with Vladimir Nesov - this is not relevant, and you seem to be using a soldier-argument.

Neither you nor Vladimir have even attempted to identify a single detail about Soldier-Arguments that describes my arguments. I really don't care about your unsupported opinions that an argument that you happen to disagree with has committed some fallacy.

Replies from: Vladimir_Nesov
comment by Vladimir_Nesov · 2009-05-20T22:34:49.628Z · LW(p) · GW(p)

I really don't care about your unsupported opinions that an argument that you happen to disagree with has committed some fallacy.

Why, I agree with the argument. It just isn't a killer argument that determines the overall decision, and that is the problem with giving it.

Replies from: JGWeissman
comment by JGWeissman · 2009-05-21T02:09:33.680Z · LW(p) · GW(p)

It just isn't a killer argument that determines the overall decision, and that is the problem with giving it.

Are you serious? We should only ever present arguments that are powerful enough to convince everyone and conclude the discussion?

Replies from: Vladimir_Nesov
comment by Vladimir_Nesov · 2009-05-21T02:26:17.953Z · LW(p) · GW(p)

The weak arguments shouldn't be used to defend a position. These arguments may lower the other side's confidence, but they won't sway the conclusion, and so asking to reconsider the conclusion by giving such arguments is fallacious. It's also pretty much useless and maybe even misleading, as getting a better idea of the real state of things requires a much more systematic study than a few hand-picked arguments, which are likely to suffer from selection bias anyway.

You don't defend the statement that a country is economically prosperous by mentioning one successful company.

Think of this in the scientific evidence vs. rational evidence setting. The protocol is there to ensure more reliable performance.

Replies from: JGWeissman
comment by JGWeissman · 2009-05-21T03:24:32.653Z · LW(p) · GW(p)

The weak arguments shouldn't be used to defend a position.

The argument is not weak. If you think it is, explain why it is weak, why it won't sway the conclusion.

You don't defend the statement that a country is economically prosperous by mentioning one successful company.

This is not a good analogy. Malicious hackers will systematically exploit the most dangerous vulnerabilities in a way that the people of a country can not systematically do business with the most successful company.

Keep in mind, I was refuting the assertion that using NoScript is stupid. As thomblake has already explained, any good reason one might have for using NoScript is evidence for my position.

comment by Vladimir_Nesov · 2009-05-20T19:18:15.903Z · LW(p) · GW(p)

It seems you are using this fact as a soldier-argument. The position under discussion is that all things considered, turning scripting off seems to be a wrong decision. Of course there are potential problems, but at the same time, there are working solutions to these problems, and benefits from actually using the technology.

Replies from: thomblake
comment by thomblake · 2009-05-20T19:32:45.692Z · LW(p) · GW(p)

there are working solutions to these problems

Such as? The only working solutions I know of are server-side, or disallowing javascript and/or cookies.

The position under discussion is that all things considered, turning scripting off seems to be a wrong decision.

No, the position under discussion is that turning Javascript off is "just totally stupid". If one can provide good pro tanto reasons for doing so, it is at least not "just totally stupid".

Replies from: taw
comment by taw · 2009-05-20T21:01:23.352Z · LW(p) · GW(p)

Disallowing Javascript does NOT protect you against CSRF - "Press button to see kittens" form works without any Javascript. The right solution is server-side - auth tokens for all cookie-validated write forms.

comment by Simetrical · 2009-05-20T14:57:48.545Z · LW(p) · GW(p)

Doing this with server side scripting is crazy. You'd have to submit a zillion forms and take a second to get the answer for each try. This is precisely the sort of thing client-side scripting is meant for.

Of course, the page would explain that it needed JavaScript, if you had JavaScript disabled, not just show a blank page.

Replies from: JGWeissman
comment by JGWeissman · 2009-05-20T17:08:49.044Z · LW(p) · GW(p)

Doing this with server side scripting is crazy.

Porting the exact behavior of a command line application to a GUI environment like a web page is crazy. Reorganizing the content into a form that fits a new environment makes more sense. For example, the questions to test understanding of awesome sequences can all be part of one form, like in my javascript implementation.

You'd have to submit a zillion forms and take a second to get the answer for each try.

By "a zillion", do you mean "tens of"? And a second for the form is a lot shorter than the infinite time it takes on a browser that does not support scripting.

This is precisely the sort of thing client-side scripting is meant for.

No, this is precisely the sort of thing client-side scripting is meant to do better on browsers that support it, without interfering with the good enough implementation on browsers that don't. It most definitely is not meant for the sole means of delivering content that is intended for a wide audience.

Of course, the page would explain that it needed JavaScript, if you had JavaScript disabled, not just show a blank page.

I know I get annoyed quickly when I am asked to enable JavaScript for a purpose that should not need it. It would be better if we could explain that the page will be more responsive with JavaScript.

comment by Alicorn · 2009-05-19T22:07:13.182Z · LW(p) · GW(p)

Or the card game Mao).

(Does anyone know the proper way to link to a URL that ends in a parenthesis?

Edit: Fixed, thanks.)

Replies from: dclayh, MichaelHoward
comment by dclayh · 2009-05-19T22:15:41.059Z · LW(p) · GW(p)

Escape the first close-parenthesis with a backslash.

comment by MichaelHoward · 2009-05-20T12:37:11.839Z · LW(p) · GW(p)

Or the chess variant Penultima.

Replies from: steven0461
comment by steven0461 · 2009-05-20T14:17:29.235Z · LW(p) · GW(p)

All these games seem interesting, but more complicated than strictly necessary and plagued by the (possibly unavoidable) problem that guessing someone's mind involves different skills/knowledge than guessing mindless laws of nature. Is there a game that captures induction more cleanly, so we can expect skill at that game to generalize better?

Replies from: gwern, Mark_Neznansky
comment by gwern · 2009-05-23T17:36:31.578Z · LW(p) · GW(p)

I have been, off and on, working on a Haskell implementation of Zendo. The idea is to implement just a subset: the human as player and the program as the Master (ie. the human trying to guess the rule).

The first question one naturally needs to know is: how do you generate rules? My attempt is to have a small set of building blocks which express simple propositions - 'all', 'none', 'even, 'odd', 'ascendingBy' etc. (and the numbers 1-10), and to generate a random list; that done, one can create random triplets of integers (via QuickCheck) and present the user only those triplets that satisfy the formula.

This solves your problem: the player can be told exactly what vocabulary the rule is written in. Another nice thing about having a simplified logic for propositions is that the formulas are data, but can be turned into code if need be, and it offers an obvious way to increase the difficulty: easy is as above; medium adds other predicates to the language (perhaps one could increase the numbers to 1-1000, and include predicates for 'isPrime'/'isComposite'); and so on.

(Before anyone gets too impressed, I don't have any running code yet; I got bogged down into figuring out how to use GADTs to turn my data constructors into code. And if you're wondering why no plans to have the computer guess the human's rule - that's because it's a hard problem. It's much easier to generate a random rule and then run triplets past it then it is to generate rules about a set bunch of triplets.)

Replies from: anonym
comment by anonym · 2009-05-23T17:53:18.759Z · LW(p) · GW(p)

Release early and release often. I can't wait to try your app. I've been wanting to play zendo for a long time, but wasn't willing to pay for all the sets of pieces that it seems are required now that zendo is out of print.

In terms of generating rules, you might want to look at CopyCat and its algorithms for analogy solving. There is an excellent discussion of the strategies it uses in the author's recent Complexity: A Guided Tour. You'll certainly get lots of good ideas for rule generation by looking at the discussion in that book.

Replies from: SoullessAutomaton, gwern
comment by SoullessAutomaton · 2009-05-23T20:07:36.851Z · LW(p) · GW(p)

As an aside, given all the GEB love around here, it's worth noting that CopyCat was originally developed by Douglas Hofstadter and a student of his, the latter being the author of the book linked.

Replies from: anonym
comment by anonym · 2009-05-24T02:25:07.004Z · LW(p) · GW(p)

Eliezer has mentioned CopyCat many times, so I figured that Mitchell and the relation to the FARGonauts was redundant information. On the topic of Mitchell and books, I also recommend An Introduction to Genetic Algorithms.

Replies from: SoullessAutomaton
comment by SoullessAutomaton · 2009-05-24T02:51:24.009Z · LW(p) · GW(p)

I don't recall seeing CopyCat mentioned on OB. Has he mentioned it elsewhere, perhaps?

Not everyone here is familiar with Eliezer's stuff outside OB/LW and an awareness that SIAI is his "day job".

Replies from: anonym
comment by anonym · 2009-05-25T01:41:35.097Z · LW(p) · GW(p)

You're right, I stand corrected. I could have sworn I remembered him mentioning CopyCat in OB before, but I can't find any now, only in other essays like "General Intelligence and Seed AI" and "The Plan to Singularity".

comment by gwern · 2009-05-23T19:57:54.673Z · LW(p) · GW(p)

CopyCat does look interesting. I note that:

"Since the 1995 FARG book, work on Copycat-like models has continued: as of 2008 the latest models are Phaeaco (a Bongard problem solver), SeqSee (number sequence extrapolation), George (geometric exploration), and Musicat (a melodic expectation model)."

3D Zendo is basically a variant on Bongard problems, and if a program can extrapolate numbers, then it could also test them against the human oracle to see if it's right.

comment by Mark_Neznansky · 2009-05-20T14:44:13.635Z · LW(p) · GW(p)

What's the difference between one's mind laws and mindless "natural" laws?

Replies from: thomblake
comment by thomblake · 2009-05-20T17:26:36.080Z · LW(p) · GW(p)

You just pointed it out. The difference between "mind" and "mindless". If a human is guessing, there are different techniques for determining things thought up by another human than things not thought up at all.

(caveat: anthropic argument)

Replies from: Mark_Neznansky
comment by Mark_Neznansky · 2009-06-07T21:31:29.937Z · LW(p) · GW(p)

So it's not really about the laws themselves (being "mindless" or "mind") as it's the context in which the guessing/researching is done. Guessing a a natural law known by a person in front of you is different than discovering it anew by yourself.

comment by XFrequentist · 2009-05-19T21:50:40.299Z · LW(p) · GW(p)

Very cool idea!

comment by Unnamed · 2009-05-20T18:18:37.063Z · LW(p) · GW(p)

This phenomenon is more commonly known as "confirmation bias" - I don't think I've ever seen anyone call it "positive bias" besides Eliezer (and those who got the term from him), although it might be out there somewhere. I'd recommend at least including the term "confirmation bias", if not replacing "positive bias."

Replies from: JGWeissman
comment by JGWeissman · 2009-05-21T01:56:01.956Z · LW(p) · GW(p)

The Confirmation Bias refers to the problem of searching for, and therefor finding, only evidence that supports your preferred conclusion. This is likely to occur when using anecdotal evidence.

The Positive Bias on the other hand, refers to the problem of testing your beliefs about what your theory allows, but not about what it disallows. In terms of formal logic, two predicates P (corresponding to your theory of awesome triplets) and Q (corresponding to the actual rule) are logically equivalent if and only if for all x in the domain, P(x) implies Q(x) and Q(x) implies P(x). The Positive Bias is only testing samples of the form "P(x) implies Q(x)" but not of the form "Q(x) implies P(x)", or equivalently "not P(x) implies not Q(x)". This bias is likely to occur when designing an experiment.