Hacker Newsnew | past | comments | ask | show | jobs | submit | anArbitraryOne's commentslogin

I'm glad consumers have a choice. Unlike the ultraprocessed crap they fed us in school.

Not to mention much of long island and the bronx


Nice. But it deters people like me who aren't totally confident in sending reports, trading false positives for false negatives


> Nice. But it deters people like me who aren't totally confident in sending reports, trading false positives for false negatives

There's no such thing as a reasonable "false positive" on a security report. There is such a thing as a false positive on a bug report. (A real bug, that happens to have no security impact, is still a true positive, just without a security risk)

If you can make it crash, or behave incorrectly, or have some repeatable, weird behavior; but you have no idea how you could exploit that for an articulable advantage, or access to the system you shouldn't have. What you have is a bug, not a security issue. You can, and should submit a bug report.

Then, critically; "if you waste our time" seems to be an important part of the statement.

If you don't know, you suspect it's a security bug because you shouldn't be able to do this, and it is leaking information that you think is suspicious, and you can easily demonstrate that you can make it happen on demand. And you report that bug, and make it easy for them to understand and either confirm the security, or reject because [reason]. You haven't wasted anyone's time and this wouldn't apply to your bug.


> it deters people like me who aren't totally confident in sending reports

This is by design, you shouldn't be submitting reports on anything less than certainty. It's not the maintainers responsibility to prove out your idea. It's yours, and when you're sure, reproduceable, and documented it, then you can submit it.


The real problem here is that this is now the only way the maintainer/reporter can reasonably work.

Proving out a security vulnerability from beginning to end is often very difficult for someone who isn't a domain expert or hasn't seen the code. Many times I've been reasonably confident that an issue was exploitable but unable to prove it, and a 10s interaction with the maintainer was enough to uncover something serious.

Exhausting these report channels is making this unfeasible. But the number of issues that will go undetected, that would have been detected with minimal collaboration between the reporter and the maintainer, is going to be high.


I improved everything by converting to metric first if the recipe happens to be otherwise, and using metric measuring tools


It would be more straightforward to remove the permutations and just display the combinations and the symmetry between heads and tails. And solve it analytically Eg: if p is the probability that the NPC is correct

  P(A|AAAA) = p^4 
  P(A|BBBB) = (1-p)^4
Anyway, the apparent strangeness of the tie case comes from the fact that the binomial PMF is symmetric with respect to n (the number of participants) and n-k.

  PMF = (n choose k) * p^k * (1-p)^(n-k)
So when k = n/2, the symmetry means that the likelihood is identical under p and 1-p, so we're not gaining any information. This is a really good illustration of that; interesting post! (edit: apparently i suck at formatting)


I clicked on this hoping is was about physical garbage collection


I aim to displease!


Shear with one component always in the y direction


"...sum of squared distances to the line" would be a better description. But it also depends entirely on how covariance is estimated


I learned about turning energy into useful work and having heat as a byproduct, but never thought about turning it into useless work


So it's basically saying that smoking is a proximal cause of mortality, and locale is a distal cause of smoking, intensified by not having a college degree?


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: