4 ms·
it sounds like they would have to run their tests with mock dates for every date out of the year to discover anything, unless they happened to run their tests o
by dlhavema 8y ago
it sounds like they would have to run their tests with mock dates for every date out of the year to discover anything, unless they happened to run their tests on one of the 3 days mentioned in the code, they wouldn't find it. how many tests would they need to run to really tell if there is any bias?
- lostlogin 8y agoWhat if the rigging was only in a certain year? Auditing each day for the next decade would be safer. A good code review sounds even better.
- emodendroket 8y agoWhile code review isn't foolproof, this seems like it should have been fairly obvious.
- emodendroket 8y agoWell, more than is practical to run, probably.
- Slartie 8y agoWhy would it even be okay at all for a piece of code that determines the seed for a pseudo RNG via observation of hardware events (a Geiger counter measurement, according to the article) to even access the date and time on a given system? It should have no use for that information, and with a piece of code of that criticality, one would expect auditors to scrutinize any and all syscalls that it performs. This way it should have been fairly obvious that it's requesting the time from the OS, which it shouldn't do in the first place. Mocking date/time info is unnecessary if your code under test is entirely unable to get time information from the system in the first place.
- moltar 8y agoAll of the brightest minds were building Facebook ;)
- thedirt0115 8y agoI feel like generating a lot (100k? You can tweak to get whatever confidence you want) of numbers for every day for the next several (30?) years and running tests like chi-squared (or others, see http://www.cse.wustl.edu/~jain/iucee/ftp/k_27trg.pdf http://www.cse.wustl.edu/~jain/iucee/ftp/k_27trg.pdf) doesn't seem too crazy when you're talking about millions of dollars in prize money.