worlds slowest brute force -- works in test case