7 ms·

Gambit – open-source tools for doing computation in game theory

84 points by lixtra 4y ago

mountainriver 4y ago
Cool name
ttyyzz 4y ago
I feel like these days everyone should get a SSL certificate, especially Software related websites.
- capableweb 4y ago
  Eh, there are usecases where SSL/TLS doesn't add any value (in terms of security). Software repositories that only serves packages that are already signed (and verified before installing) for example could be served over http or a piece of string even.
  - melony 4y ago
    That's just kicking the ball down the road. It is more reasonable to expect one developer to perform sufficient security work than to expect N users, some of whom may be non-technical, to check verified packages.
    - capableweb 4y ago
      Package managers don't force people to manually check the signature of downloaded packages, that all happens automatically. No balls kicked here :)
      - melony 4y ago
        Uploading to package managers (or convincing said managers to package your upstream, this is a particularly big problem for fragmented OSes like Linux desktops) also don't scale easily from the developer's side compared to configuring TLS which is usually a single toggle on your cloud host's DNS config.
        capableweb 4y ago
        If I had to chose between developer signed packages and TLS, I'd go with signed packages, because at least then I know I get what the developer intended to give me, no questions asked. TLS guarantees security in transport, yes that's true, but a package signed by the developer guarantees that even if the mirror itself been compromised and still has a valid TLS connection, my system won't install a rogue dependency. Luckily in our real world, we can have both of them, and that's of course best :)
  - zasdffaa 4y ago
    I'm really in no position to argue with you but still, isn't onion-layer security better than single layer, and isn't this one more layer?
    - deleted 4y ago
      [deleted]
    - capableweb 4y ago
      Generally yeah, but the value of it dives of the cliff in some cases, compared to the hassle it introduces. Lets say you create a encrypted LUKS partition with a 32 character password. Would it be more secure by nesting 3 more encrypted LUKS partitions inside of that one, with each having different 32 character passwords? Yeah sure, but you're already pretty secure with just one as long as the password is good. In the case I mentioned, adding TLS certificates to something that is already signed in a similar way that TLS would do, would add nothing in terms of security, but would add additional privacy.
      - zasdffaa 4y ago
        I see your point, and I repeat I'm not arguing with you, I don't have the knowledge you clearly do, but onion layer security is I guess useful when mistakes are made - > Lets say you create a encrypted LUKS partition with a 32 character password. Would it be [...] Quite so, but if someone does a booboo and uses a 3 character password for one of them (well, imagine more sophisticated form of such a mistake) then the extra layers become valuable. I guess it's about guarding against dumbness or accidents rather than correctly implemented best practice.
thesuperbigfrog 4y ago
Not to be confused with Gambit (Scheme programming language implementation): https://github.com/gambit/gambit https://github.com/gambit/gambit https://gambitscheme.org/ https://gambitscheme.org/
TooLazyToPlay 4y ago
Does anybody interested in algorithmic game theory? I've looked around but it's seem like only researcher interested in this.
- jonahbenton 4y ago
  20 years ago I almost did a PhD in game theory. Simulating/modeling power dynamics and incentives in groups of agents. Mechanism design. I didn't do it but see echoes of that work in the web3 world now. DAO governance and tokenomics are 100% game theory. There are also links to social media influence modeling.
OscarCunningham 4y ago
I was looking at Gambit recently; trying to work out how to set it up to solve 'Guess Who?'. Such a cool project.
- armanboyaci 4y ago
  Is your work publicly available? If you are interested, I've tweeted my notes on 'Guess Who' game: [https://twitter.com/arman_boyaci/status/1463139888489025537?t=g8oDYvczfXP0pFxHkVBUBA&s=19 https://twitter.com/arman_boyaci/status/1463139888489025537?...]
  - OscarCunningham 4y ago
    I don't have much yet, but I'll send you a link when I do. The reason Gambit is required is that you pick characters by drawing from a deck. So you both know you can't have the same person. But if you let this knowledge affect your guesses then you leak information. So there's potentially some amount of bluff required.
    - armanboyaci 4y ago
      Super interesting. Do you know how much advantage a player using this information gets against a 'naive' player non-using it?

84 points by lixtra 4y ago

mountainriver 4y ago

Cool name

ttyyzz 4y ago

I feel like these days everyone should get a SSL certificate, especially Software related websites.

capableweb 4y ago
Eh, there are usecases where SSL/TLS doesn't add any value (in terms of security). Software repositories that only serves packages that are already signed (and verified before installing) for example could be served over http or a piece of string even.
- melony 4y ago
  That's just kicking the ball down the road. It is more reasonable to expect one developer to perform sufficient security work than to expect N users, some of whom may be non-technical, to check verified packages.
  - capableweb 4y ago
    Package managers don't force people to manually check the signature of downloaded packages, that all happens automatically. No balls kicked here :)
    - melony 4y ago
      Uploading to package managers (or convincing said managers to package your upstream, this is a particularly big problem for fragmented OSes like Linux desktops) also don't scale easily from the developer's side compared to configuring TLS which is usually a single toggle on your cloud host's DNS config.
      - capableweb 4y ago
        If I had to chose between developer signed packages and TLS, I'd go with signed packages, because at least then I know I get what the developer intended to give me, no questions asked. TLS guarantees security in transport, yes that's true, but a package signed by the developer guarantees that even if the mirror itself been compromised and still has a valid TLS connection, my system won't install a rogue dependency. Luckily in our real world, we can have both of them, and that's of course best :)
- zasdffaa 4y ago
  I'm really in no position to argue with you but still, isn't onion-layer security better than single layer, and isn't this one more layer?
  - deleted 4y ago
    [deleted]
  - capableweb 4y ago
    Generally yeah, but the value of it dives of the cliff in some cases, compared to the hassle it introduces. Lets say you create a encrypted LUKS partition with a 32 character password. Would it be more secure by nesting 3 more encrypted LUKS partitions inside of that one, with each having different 32 character passwords? Yeah sure, but you're already pretty secure with just one as long as the password is good. In the case I mentioned, adding TLS certificates to something that is already signed in a similar way that TLS would do, would add nothing in terms of security, but would add additional privacy.
    - zasdffaa 4y ago
      I see your point, and I repeat I'm not arguing with you, I don't have the knowledge you clearly do, but onion layer security is I guess useful when mistakes are made - > Lets say you create a encrypted LUKS partition with a 32 character password. Would it be [...] Quite so, but if someone does a booboo and uses a 3 character password for one of them (well, imagine more sophisticated form of such a mistake) then the extra layers become valuable. I guess it's about guarding against dumbness or accidents rather than correctly implemented best practice.

thesuperbigfrog 4y ago

Not to be confused with Gambit (Scheme programming language implementation): https://github.com/gambit/gambit https://github.com/gambit/gambit https://gambitscheme.org/ https://gambitscheme.org/

TooLazyToPlay 4y ago

Does anybody interested in algorithmic game theory? I've looked around but it's seem like only researcher interested in this.

jonahbenton 4y ago
20 years ago I almost did a PhD in game theory. Simulating/modeling power dynamics and incentives in groups of agents. Mechanism design. I didn't do it but see echoes of that work in the web3 world now. DAO governance and tokenomics are 100% game theory. There are also links to social media influence modeling.

OscarCunningham 4y ago

I was looking at Gambit recently; trying to work out how to set it up to solve 'Guess Who?'. Such a cool project.

armanboyaci 4y ago
Is your work publicly available? If you are interested, I've tweeted my notes on 'Guess Who' game: [https://twitter.com/arman_boyaci/status/1463139888489025537?t=g8oDYvczfXP0pFxHkVBUBA&s=19 https://twitter.com/arman_boyaci/status/1463139888489025537?...]
- OscarCunningham 4y ago
  I don't have much yet, but I'll send you a link when I do. The reason Gambit is required is that you pick characters by drawing from a deck. So you both know you can't have the same person. But if you let this knowledge affect your guesses then you leak information. So there's potentially some amount of bluff required.
  - armanboyaci 4y ago
    Super interesting. Do you know how much advantage a player using this information gets against a 'naive' player non-using it?