Re:Neutered random number generator let man rig million doll...
by koolba on Saturday April 09, 2016 @12:18PM
(#11461891)
> It would seem open-source is not always advisable when it comes to sensitive information.
For behavior models like risk ratings sure. A similar example is threat and fraud detection; if scammers know what you're checking it'd be easier to work around.
In this case though the output is supposed to be a "fair" random number. If knowing how it's generated allows you to be able to predetermine it, i.e. exactly what the offender in this case did, then the code itself is bad and public eyeballs might find it.
Re:Neutered random number generator let man rig million doll...
by farzadb82 on Saturday April 09, 2016 @12:32PM
(#11461952)
This also assumes that the "eyeballs" looking at the code are doing it for the greater good and not personal profit. Given a big enough jackpot, do you really believe that the person who finds a loophole in the algorithm will do the right thing?
> Interestingly, one of the techniques used by the banks to dupe the rating agencies [before the 2008 economic crisis] was to reverse-engineer the computer models the agencies used to devise their ratings. Reverse-engineering was facilitated by the fact that the rating agencies made their computer models public. Thus the banks could trick them starting from answers and then working backward to get the intended result.
It would seem open-source is not always advisable when it comes to sensitive information.