gerard

Our intuition is that random processes produce high-entropy output. Patterns carry less entropy and therefore offer less convincing evidence that the result is indeed the product of a random process if any alternative explanation or generating function is permitted. It would not be biased to think so, but it would be a misinterpretation of the question to use that as the basis of an answer, and of course people may be biased in their reading of the question.

But to be fair to researchers that's not the bias they are trying to illustrate. There does appear to exist human bias that 'characteristics of the generating process will be represented, “not only globally in the entire sequence, but also locally in each of its parts”.

There are other ways of putting it, or there are related biases if you like, which I would generalise as a belief that mean reversion should be expected in the short term, a notion that the future will balance the past naturally, inevitably and here's the bias: quickly. It arises imho from a misplaced intuition of mean reversion 1) as a process that operates, like a force of nature, rather than being an emergent phenomenon and 2) as a tendency for results to converge to expectation in absolute terms rather than in the mean.

I've seen some dark satire on HN lately. What I see here is another neat implementation of an unconstructive idea, amusing for reflecting our flaws. We really should know better than to share or encourage sharing passwords with third parties. The same goes for CC details ("enter your CC and see if it's been stolen"). The right place for a widget like this is on the signup or change password page itself.

You've put forward a little risk/reward proposition where users are unable to properly assess the risk. People love to be rated, that part's easy. You rely on them to take your word on the site's affiliation, to not understand that you can collect passwords despite saying otherwise, or vary the site's behavior mod N, or cross-match fingerprint:password with leaked/purchased/accumulated fingerprint:username data, and so on. They look at it and think, 'looks legit'. It might well be, but the proposition is unfair and its unconstructive to condition users to accept this type of trade-off.

A common rule for determining whether “who” or “whom” is right is to substitute “she” for “who,” and “her” for “whom,” and see which sounds the better. Take the sentence, “He met a woman who they said was an actress.” Now if “who” is correct then “she” can be used in its place. Let us try it. “He met a woman she they said was an actress.” That instantly rings false. It can’t be right. Hence the proper usage is “whom.” -- Thurber /s

https://www.reddit.com/r/badlinguistics/comments/26c3v4/was_...

On a more serious note, and not to claim right or wrong, I was taught in primary school that "whom" should be used as the object of a preposition "she, to whom I gave," or "she, with whom I studied," but never as a direct object; "who do you know?", not "whom do you know?". No idea if the latter is a geographical artifact or just what's taught nowdays. Speakers of slavic languages would recognise those first two usages as the dative (кому, komu, etc) and instrumental case (кем, kým, etc) respectively, and afaict in Old English the dative hwǣm was used for both. I suppose the direct object "whom do you know" came to popularity through more creative use somewhere along the line.

This also requires some assumptions: That there is no minimum stake and stakes are infinitely divisible. They're important assumptions because finding yourself near zero can easily happen on "full Kelly", especially if it's not a game of perfect information.

A good point, in that the house is not necessarily in a nett negative-ER position due to the skilled gambler. In totalizator markets the house will always make x% of the pool. In fixed-price markets the house could face a negative position overall but that is mitigated by bet limits and a quick banhammer. For gambler who is +ER though, the house must be negative in respect to that single transaction.

It's a misconception that the house always makes money with respect to an individual customer, given enough time. I don't accuse you of this, I just mean generally. Let's take fixed markets. Overrounds of up to 25% are common, and if you back a prospect blindly you'll find that your -ER approaches that. But you're free to chose prospects and stakes in the same way Warren Buffet chooses stocks. With sufficient information and a high enough filter as Teleb calls it, you are free to pick off the bargains.

The information available to market participants is reflected in the price of prospects. Any one gambler may posess information others don't. It won't be perfect information, and most times the overround will absorb the difference, leaving the gambler with no option but to place a negative-ER bet or no bet at all. But when when the match is over and the waveform collapses and the fans have gone home and all prices are irrevocably shown to have been "wrong" to some degree, you can see that it's really an information game, not one based on luck, and from that it's unfair to say all players are eventually doomed.

You've defined a fair game [1], one which you're just as likely to win or lose, by the same amount each time. Clearly neither side of this game has an advantage over the other, for any given coin toss. But you expect that long term it will work in your favour?

[1] technically it's a martingale https://en.wikipedia.org/wiki/Martingale_(probability_theory...

This implies that both side of the transaction will inevitibly go bust, bookmaker and gambler alike. It may be true, but it's like saying we're all going to die at some point. The expected times are long enough that it's mostly not worth worrying about.

If the positive-expectation gambler can reduce his stakes he will find a comfortable expected time-to-ruin, which might be hundereds of years if he was able to quantify it. In this position, he should continue to place his bets.

We make hundreds of small positive-ER decisions like this every day and we don't shy away from them for fear of the black swan.

NB: Even in skill-based games, the odds still always (and I mean always) favor the house.

In BlackJack, card counting can reveal plays where the odds favor the gambler. In sports betting, which can be though of as a market with high commissions, skilled players consistently make decisions with positive expectation.

The format of a COM file is... um, none. There is no format.

This makes any small file a valid COM file as far as Windows is concerned. NTVDM doesn't care, it will happily execute your holiday snaps if given the chance. It's not difficult to craft a valid GIF, PNG, etc that does something useful when executed from byte 0.

Such an image will pass most mime-sniffing protections. For example, given such an image and a "foo.png.exe" Content-Disposition header, Internet Explorer used to skip all security warnings. Combined with "Hide extensions for known file types" it would ask you where you'd like to save "foo.png", preserving the executable extension behind your back.

Upon double-click the loader notices the MZ signature is missing, fires up NTVDM, and starts executing the image from byte 0. If running under NTVDM is too restrictive, it can always break out with BOP instructions.

The lack of structure also makes COM files a simple vector for exploiting hash collisions. Any two prefix blocks with matching hash that can survive execution can be used to create two variants of an program with matching hashes. Bit differences in the two blocks can be used as switches to control program behaviour.

Not mentioned in the paper's implications section, so I'll ask, is there also a significant "bootstrapping" class of attacks on services where special access is granted to the earliest created account? Eg. Wordpress-like systems without a hardcoded admin username, and an installation process that asks the 'first' client to set the administrator credentials.

Having no cleartext to hand over in individual cases is one form of plausable deniability. Cleverly, it also appears to offer plausable deniability of your service's "primary purpose", since there are few conclusions that can be drawn from the encrypted data in aggregate. So some protection, yes, but there are certainly other ways to get yourself indicted, or your customers blocked, under such general tests.

The example in the article shows the decryption key as a URL fragment, which never hits the wire. A subpoena on Mega's own servers is one thing, but a court compelling them to collect keys from client machines? I would hope not.