mlyle

36 ms·

631.
by mlyle 2y ago
No, I'm assuming there's a tradeoff between sensitivity (spotting cancers) and specificity (having your positive results actually be cancer). ANOVA to pick variables and then reasonably selecting thresholds is a fine process that
632.
by mlyle 2y ago
> If we're talking about mid-90s race conditions there, with "temporary names", there was never a market for those vulnerabilities. More like mid-80's with effects dragging on to mid-90's. There was never a marke
633.
by mlyle 2y ago
> I think our biggest point of disagreement is just on the notion that you can sell bugs like the one on this thread to brokers. I don't think you're getting a ton of money for them. But, it's my understanding that there a
634.
by mlyle 2y ago
> I think we're on a trajectory towards those marketable bugs having something like a vintage. I'm reminded of when we really systematically started treating temporary names correctly and thought security was going to be so muc
635.
by mlyle 2y ago
The economic argument doesn't change whether it's a private cost or purely a social cost (private costs are included in social costs, since private expenditures are part of society's expenditures).
636.
by mlyle 2y ago
> I don't think market competition is going to meaningfully improve security. I think the things you describe all have long-term wins but may worsen the short-term picture. Sure, using better tools is good, but younger code is risk
637.
by mlyle 2y ago
You're free to disagree, but you don't need to do it with the snarky variant "I like that story too! It's fun." that's so easily misread on the internet. You're right that I've not been involved in th
638.
by mlyle 2y ago
> You can just run test multiple times to eradicate this possibility The measurements are not independent and the quality of the measurement is not improved by this. > you can confirm it with another method. Yes. And usually the othe
639.
by mlyle 2y ago
There's a ton of research and regulatory oversight in this area, and the choices made generally make sense. You can safely assume that the testing recommendations are 3-5 years behind the research, though.
640.
by mlyle 2y ago
> In the case of pancreatic cancer, it is much more aggressive and you need to catch it early. It's not clear that the cancers that you would find early with a more sensitive test are those more aggressive cancers. The pancreatic ca
641.
by mlyle 2y ago
You have to be careful with screening tests. Say that this test has a false positive 1 in 1000 times. If you test 100,000 people, you'll get 100 positives that need invasive further testing and followup, and 5 real pancreatic cancer c
642.
by mlyle 2y ago
Yes, and overflowing the mantissa moves the exponent in the right direction by the right amount; just now the least significant bits are not quite in the right place anymore. But that's by definition a small error.
643.
by mlyle 2y ago
> Millions of usernames and emails are leaked every month; if this was the case you'd be seeing these murders in the news every week. Yes, because all possible scenarios kill the same fraction of people-- whether we're talking
644.
by mlyle 2y ago
> I really think people just like to think about stories where someone like them finds a bug and gets a lottery jackpot as a result. I like that story too! It's fun. P.S. a lot of time your writing comes off as having a smug tone th
645.
by mlyle 2y ago
> I really think people just like to think about stories where someone like them finds a bug and gets a lottery jackpot as a result. I like that story too! It's fun. Increasing bounties by a small factor will be enough to reduce thi
646.
by mlyle 2y ago
There's not a standard price in a list, but you can absolutely sell a platform exploit to a broker.
647.
by mlyle 2y ago
It's not a crime to sell a bug. You can sell something like this to Crowdfense and receive money wired from the company (or cryptocurrency if you prefer anonymity).
648.
by mlyle 2y ago
I'm not a SWE anymore and haven't been one for a long time. I think it's in everyone's interest for bug bounties to be higher than harmful markets for the same bug, and a decent fraction of the harms they prevent. That&
649.
by mlyle 2y ago
Prominent youtuber doxxed and killed; terrible press extended for an extended period by litigation. 1 in 5000 but very high cost. Large scale data leak and need for data leak disclosure. 1 in 3, moderate cost. Bug report saving engineerin
650.
by mlyle 2y ago
> If I as a third party find a bug that is causing Google to undercharge on ads by a fraction, should Google be obligated to pay me a mountain of cash? No, but Google should understand that if they give a token payment, people will be le
651.
by mlyle 2y ago
Organizations price future, nebulous things all the time. Imagine a possible downside or two, imagine a probable risk, multiply, discount.
652.
by mlyle 2y ago
Selling a bug is not a crime. > Bounty programs are very much not trying to compete with crime. Nor did my post posit this. Bounty programs should pay a substantial fraction of the downside saved by eliminating the bug, because A) this g
653.
by mlyle 2y ago
> Bounty programs are a pretty recent development and the idea that they should be scalable and stable well paying employment for a lot of people is a bit strange to me. So, the value to the researcher of having a found bug has a floor o
654.
by mlyle 2y ago
I'm not sure level 3 is a problem. In L3, the car is required to initiate handover and be able to give you a long time to take over. This may or may not end up OK. (Witness the Mercedes eyes-off, hands-off Traffic Jam Assist). If t
655.
by mlyle 2y ago
> Medical providers aren't supposed to deny procedures based on insurance coverage. This is false. There's EMTALA, which requires that emergency services will be provided until a patient can be transferred. But doctors absolu
656.
by mlyle 2y ago
Of course, on the opposite side: if you have higher Fmax and lower power, you need fewer transistors to get the same characteristics for end users.
657.
by mlyle 2y ago
Things the webpage should answer: - If it's free, like you say here, that it's free. - What languages does it work for? - What's the process to start? Things I'm curious about: - Is this intended to be a business? How d
658.
by mlyle 2y ago
Resistance in democracy needs to be well-timed. Too early, and you don't have a critical mass of force to oppose the ruling regime and appear unreasonable. Too late, and it's too late to do anything. The right moment is only obv
659.
by mlyle 2y ago
https://www.newsweek.com/democrats-blocked-education-departm...
660.
by mlyle 2y ago
Wouldn't be the first time that a syndrome ends up having basically two opposite etiologies. Abnormal synaptic density-- high or low) producing autism-like social deficits wouldn't be too much of a surprise. Alternatively, startin

More ›