brute force algorithm (not working)