News for hackers. Stuff that matters.
Re:Army National Guard announces data breach by x5n1 on Saturday July 11, 2015 @06:30PM (#9871807)
It is better to simply assume that all data has been breached unless incontrovertible proof is found to the contrary.
Re:Army National Guard announces data breach by shortstuffsushi on Saturday July 11, 2015 @06:35PM (#9871823)
Seems kind of like the "law of security testing" -- the lack of evidence of data breaches doesn't preclude the possibility of leaked data.
Re:Army National Guard announces data breach by shawndumas on Saturday July 11, 2015 @07:01PM (#9871893)
the absence of evidence is not evidence of absence.

http://youtu.be/MFBjCM0mZHg

Re:Army National Guard announces data breach by spacehome on Saturday July 11, 2015 @07:47PM (#9872004)
Off topic, but absence of evidence is in fact evidence of absence, though depending on the circumstances it might be weak.

Say we'd like to know if A exists. There's some evidence for A's existence, which we'll E. The absence of this evidence is ~E.

By Bayes' theorem:

P(A) = P(A intersect E) + P(A intersect ~E) = P(A|E)* P(E) + P(A|~E)*P(~E)

So the probability that A exists is a weighted average of the probability that A exists when there is and is not evidence.(Since P(E)+P(~E)=1) There is a kind of 'conservation of probability'.

If the idea that 'E is evidence of A' is to mean anything at all, then it means that P(A|E) > P(A). Hence P(A|~E) must be less than P(A). Another way to say it is that P(~A|~E) > P(~A). And absence of evidence is absence of evidence.

Re:Army National Guard announces data breach by shawndumas on Saturday July 11, 2015 @11:41PM (#9872507)
You're speaking of negative evidence; as in, evidence that negates a particular truth claim.

Negative evidence is not the same thing as the utter and complete non-existence of any evidence whatsoever—the absence of evidence. That's because negative evidence absolutely is evidence.

The saying goes, 'the absence of evidence is not evidence of absence' not 'the evidence of absence is not evidence of absence'. See the difference?

Watch the linked video when you have a moment.

Re:Army National Guard announces data breach by spacehome on Sunday July 12, 2015 @11:19AM (#9873717)
> You're speaking of negative evidence

I wasn't. ~E is a shorthand way to write that E is not found, not that the opposite of E is found. In the language of probability/set theory, ~E is E's complement - every event in the space of probabilities except for what's in E. It's the unique set such that ~E intersect E = empty set, and ~E union E is the whole space.

The point of the proof I gave is that there is no distinction between 'negative evidence' and 'absence of evidence'.

As I mentioned earlier, there is a kind of conservation of probability. The only way for a piece of evidence to give evidence for A is that the lack of that evidence reduces the probability of A. The probability mass has to come from somewhere.

Re:Army National Guard announces data breach by shawndumas on Sunday July 12, 2015 @11:32AM (#9873765)
"I wasn't. ~E is a shorthand way to write that E is not found"

You where. What you are describing is, 'we constructed a hypothetical experiment and arrived at a null result'; that is, in fact, evidence.

No one is saying, 'a null result is not evidence of absence'.

Please stop conflating the presence of something with the absence of something.

Yes, the statement is a tautological statement. We are repeating the same assertion twice using different phrasing. And as such, the proposition as stated is logically irrefutable.

'No evidence is no evidence', is a correct—but diminished—restatement.

Have you watched the video?

Re:Army National Guard announces data breach by spacehome on Sunday July 12, 2015 @11:47AM (#9873810)
I watched the video you linked. It's a straw man and misrepresents the way the maxim is commonly used.

Let's go back to my original example and say we want to know if A is true. We have the choice to run an experiment whose positive result E would give support to A. The linked video would say that before we run any experiment, we have no additional evidence for A. Essentially that P(A) = P(A). This is true.

The way this should be used in the real world is: I look even the slightest bit for A and don't find it. As long as my search for A had the smallest positive chance of finding it were it to exist, then my lack of ability to find A gave me information about the world, and we get that P(~A | ~E) > P(~A).

Edit: To be precise the maxim should be something like: "Absence of evidence after looking for evidence is evidence of absence".

Re:Army National Guard announces data breach by shawndumas on Sunday July 12, 2015 @12:11PM (#9873882)
The very act of "looking for evidence" moves it out of the category of the absence of evidence.

Again, what is being said is, 'no evidence is no evidence'. If you have the absence of evidence then you have no evidence of absence.

We are--kind of--using the word absence in two senses. First as a synonym for none, a number less than one, zero; the second as a synonym for non-presence, non-existence, the lack of an extant sample.

Having zero [absent] evidence is not evidence that there is no extant sample [absence]. I hope that helps.

Re:Army National Guard announces data breach by threatofrain on Sunday July 12, 2015 @04:46AM (#9872941)
I think in a world where physical things influence a system so pervasively so as to be irrevocable, leaving their causal footprint everywhere, absence of evidence predicts absence of evidence. It's not proof, but evidence, which is something else. A better word might be information. I argue that absence of evidence is information that should influence your bet on the course of future information.

Say I'm looking for alien civilization. I write a magical program to search one planet at a time, and stop when it finds an alien civilization. I argue that with every planet that fails the test, we should consider that as information toward the case that this program will never stop. I think these claims are testable if crafted into narrower versions.

A reframed version of the maxim would be: Absence of evidence is not information for evidence of absence. Another reiteration could be "absence of evidence does not provide predictive utility toward any claims on the evidence of absence". I claim the opposite.

I think the author of your link would say that in my rephrasing of things, the whole class of my examples are negative evidence, because he counts any information as negative or positive evidence, and in consistency he demands perfect ignorance. No peeking in the cat box. Unfortunately, me scanning for planets counts as peeking, or getting information, into portions of a very large cat box.

Re:Army National Guard announces data breach by shawndumas on Sunday July 12, 2015 @09:07AM (#9873362)
You are correct; any evidence that negates a particular truth claim would be the presence of evidence not the absence of evidence.

And so the tautological saying, 'the absence of evidence is not evidence of absence' still stands unassailed.

Re:Army National Guard announces data breach by jgome on Sunday July 12, 2015 @04:51AM (#9872948)
Off-topic... That's also a good advice for those "skeptics" that are too obsessed about science (or whatever they think science is).
Re:Army National Guard announces data breach by wfunction on Saturday July 11, 2015 @09:23PM (#9872237)
But it is. It's just not necessarily as strong of an evidence.
Re:Army National Guard announces data breach by shawndumas on Sunday July 12, 2015 @12:55AM (#9872607)
how could the absence of something simultaneously be both absent and also be that something too? (weak or not.)
Re:Army National Guard announces data breach by innguest on Saturday July 11, 2015 @07:20PM (#9871940)
That advice is good for logicians, not consultants. Clearly it is better from a consultancy point of view to assume all data has been breached and everything that could break is broken and needs fixing.
Re:Army National Guard announces data breach by thaumasiotes on Saturday July 11, 2015 @08:23PM (#9872080)
As spacehome points out, that advice is a logical contradiction (and therefore not particularly suitable for logicians). Absence of evidence is not proof of absence.