cthor

Isn't OWASP top 10 based on impact and prevalence?

I think drawing the line at the OWASP top 10 is reasonable.

Probably would look like a union (a dirty word in software), where their collective bargaining allows them to have leverage on software firms and have policies to punish non-payment in an ethical way.

Sequence looks something like: Security researcher submits exploit to the union. Union verifies it and decides it's worth $x. They inform software firm of the exploit and a deadline for payment. If payment is received before deadline, they get full, private disclosure. If not, then exploit is made public. Union takes a cut.

Security researchers don't really need a market maker. (It's not a real market: Actually converting exploits into money is typically antisocial and illegal.) They need someone to negotiate for them.

These already exist. There are darknet firms that independently verify that an exploit is real (staking their reputation that they won't take it and run once shown), and then open it to the market.

The main trouble is that for it to fully work, you need to have the big corps bidding against black hats in this market. I can't see that happening. It'd have big corps dirtying their hands too openly.

The other trouble is that a lot of the damages (or value) of software bugs aren't readily fungible to dollars. For example, to actually profit from the Ashley Madison hack you'd need to blackmail a whole lot of people, which is incredibly time consuming. So software firms would be able to underpay for most exploits: The amount they'd be have to pay is at most what a black hat can profit from the bug, which is necessarily less than the real damages because the black hat has to cost for fungibility.

I don't think meritocracy implies cosmic fairness.

The way it's used by most hackers is to say that someone's work is judged only on its own merits, rather than the author's social status or how good they are at playing political games or anything else orthogonal to the work actually being valuable.

At least, that's the ideal.

The list of "maddening" items in this article are so comically low-budget it's hard to take this complaint seriously.

None of the 9 listed in the article sound particularly egregious. Almost all are grants to research institutions, which as a process has a lot of flaws, sure, but unilaterally cutting all grant funding is definitely not the solution.

The report totals at $5 billion, but the supposedly most egregious are not even in an order of magnitude near that cost.

Meanwhile, federal income is measured in trillions.

If you want to actually cut federal spending, you have to cut pensions or military spending—political suicide.

Are there any big examples of feminine names becoming masculine? It always seems to go the other way.

The main situation that this was apparent is Euls on Axe when he blinks onto a target.

Axe's Beserker's Call has a 500ms cast time. Euls is instant. Bots have a 200ms reaction time. Humans have 200-300ms.

The problem is the human doesn't just have to react to Axe blinking on top of them and decide to target him with Euls. Humans also have move their mouse cursor onto the Axe, which for a human is hard to do in 200-300ms (the time they have after reacting to the Axe blink).

A comparable situation that happens a lot is using BKB or Manta to react to a similar initiation. Pros can hit this counterplay much easier because they only have to press a keyboard hotkey, rather than move their mouse to a target first.

So, basically, stick your head in the sand and pretend the problem doesn't exist.

Ah, ok, I misread. Yeah, that requires a subquery then, but not because of floats being unsuitabe for sorting, but because you're doing a 1-to-many thingy in a 1-to-1 way by hardcoding 3 columns. It's like writing

   items[0].text + items[1].text + items[2].text

In code to simplify it, instead of

   items.slice(0,2).map((e) => e.text).concat('');

The former mostly works, but it's definitely not elegant. And you have to be sure the number of items being 3 is set in stone.

Having run into this problem a few times now, Approach 1 is unfortunately best. Two reasons:

(1) If updates fail, you don't get a resulting broken state

(2) The size of the lists is not that large (<50), so the extra writes are not that expensive.

Essentially, with any variation on fractional updates (where only 1-2 rows are updated per list update), the client is sending to the server "move item a to position x". Then, shortly after, "move item b to position y", etc. And if any intermediate step fails, the server and client are out of sync.

If, instead, the client message is "here is the new state of the list: (a,b,c)" and the server updates, failed requests only leave the state temporarily out of sync. The client will continue to send the complete correct state at each update.

SELECT * FROM list ORDER BY pos LIMIT 3

If there's an index on pos, there's no cost to the sort.

How do you make a SELECT that gets the items in the correct order?

The point of the solution here is so you can simply go `SELECT * FROM list ORDER BY pos` and have the correct order.

TFA is slashdot slang: the f'ing article

It really depends on what you want the ranking to mean.

If you want it to mean: "If all the players in the world played in a tournament, what would the expected result be", then a normal Elo-like rating system (e.g. glicko-2) should be fine, because all the data available is from real tournaments, and it's not really feasible for players to strategically dodge bad matchups to pad their ratings.

But one criticism TFA has of this method is matchup discrepancy. I'm not sure that's actually important (players choose their mains freely), but if it is can't you just correct for it?

I think you're right that this correction would create an undesirable result. That just means that the matchup discrepancy criticism isn't good.

> The problem is that the matchup disparity matrix is difficult to derive.

Well, TFA had no bones about calculating one.

> Is HBox just the best player ever

The current data says pretty definitively, yes.

If other players can learn how to get his winrates vs Fox, then the matchup matrix would end up reflecting that. The matchup matrix doesn't need to reflect the perfect ("objective") state of the matchup, just the current one.

(The system I'm talking about would look more suspicious if HBox wasn't considered the best, because it would probably put him at #1 anyway.)

Has this been tried?

(1) Figure out a matchup discrepancy matrix

e.g. Peach vs Puff winrate is 0.43

(2) Use an Elo head-to-head variant where the Elo update function takes matchup discrepency into account

e.g.

- A vs B has an expected 0.9 winrate

- A is Peach and B is Puff

- Elo update is done expecting A to have a winrate of 1 - (1 - 0.9) * (0.5 / 0.43) = 0.884

The most recent discussion I saw on this subject[1] makes it very clear that there isn't a consensus. If there is, it's in the "Perl 6 should rename" direction.

[1]: https://www.reddit.com/r/perl/comments/7r1b33/an_open_letter...

Clarification: Decided by the Perl 6 devs who want to keep the name and don't seem to care about the damage that decision does to Perl 5

Getting Over It: With Bennet Foddy breaks all these rules and was wildly successful.

The Witness sold at $40 and people bought it anyway.

Good games will sell. But you might not have a good game.

The market doesn't owe you anything.

Also what kind of bogus metric is "price per MB"?

Clementine is better than foobar imo

I'll precommit to being very impressed if a bot can achieve >5k MMR in solo ranked or if a bot-controlled team wins a tier 6 (or higher) battle cup.

When Checkers and Chess and Go pros were beaten by AI at the actual game, people were impressed, because it was impressive. (The goalpost moving involved claiming each consecutive game could not be solved.)

I don't think anyone here is saying Dota 2 won't be solved eventually or that its complexity is beyond the realm of AI (as was claimed of Chess/Go in the past). They're just saying this particular achievement isn't actually meaningful progress. It's using known techniques to do something those techniques are known to do.

> [T]here is a general formula for successful pop songs

What would you say that is?

Your answer has to be detailed enough that a computer can understand it.

There's a lot of patterns to pop songs but there's patterns in all music. I haven't seen any function that inputs x and outputs a pop hit.

Having listened to the song linked in the OP I was blown away, but then:

> I ought to note that a human being is involved in all this: the French composer Benoit Carré, who took the raw data generated by the CSL and matched it to audio from existing recordings [..] Benoit then arranged, produced, and mixed the tracks that resulted from this collaboration. Carré has also written the words.

I feel like there's a big difference between "AI creating music" and "AI as an assisstive tool for creating music".

The U.S. reaping these benefits from their two party system is confounded by the primaries. The "centre" of each primary is with respect to the party platform, not the general population.

Presidential candidates' optimal strategy is to be centre of the party base in primaries, then centre of the entire country in the general election. (And they have to do this while avoiding accusations of flip flopping.)

(And there are other confounders that apply regardless of voting system. Nobody involved is working with perfect information and nobody is a perfectly rational actor.)

When talking about the effect of voting systems on elections, something I think is overlooked is the game-theoretic implications on the candidates.

Take the second diagram in the article and move the candidates around. What's the optimal strategy? To move as close to your opponent as possible, while staying closer to the centre.

Now take the diagram with three candidates, and move them around. What's the optimal strategy? To move as far away from both opponents.

This works even if you consider an n-dimensional space for every conceivable issue. Two-party system encourages both parties to move towards the centre. Three- (or more) party system encourages them to spread out.

I think the point being made is that Facebook, NYT, et al. are not in a position to moralise about journalistic ethics.

I would go further and say that the half-truths being peddled by these outlets are far more dangerous than obvious non-truths peddled by "fake news" outlets, because seeing through their lies is much harder.

If we live in a world where "fake news" has been successfully censored, but the merely partisan outlets remain, the only result is people being lulled into a false sense of security: "It has to be true -- fake news is banned!"

There's some perverse doublethink going on when it's considered racist to suggest we stop discriminating on the basis of race.

You don't think him reciting a canned script made to give the impression of expertise and closing with "I could talk about this for ages..." is deceptive?

He was talking like he was well-versed in the subject, when he had really just read some cliff notes.

Businesses can be simultaneously profit seeking and for the public good. In fact, that is the ideal.

It's concerning that many feel this is not the case.

What made colours much easier for me was stating them as hsl values, rather than rgb ones, because that's how we actually think about colours.

For example, I can tell just by looking at it that the HN banner is orange (hue: ~30), fully saturated (sat: ~100%), and neither light nor dark (l: ~50%).

The figures are also easier to fiddle with. Something is too saturated? Decrease saturation. Too bright? Decrease brightness. etc. With an rgb value it's very hard to fiddle with meaningfully.