Full title: "SHOCKING! College professor reveals hidden secrets of news headlines. Can you guess? Examining the efficacy of clickbait detection training and news literacy"
TLDR:This study deployed both a survey and an experiment to examine how news literacy and clickbait training affect clickbait detection and engagement with clickbait via clicking, reading, and sharing. Research shows that news-literate readers are better at detecting clickbait and other false news content, and the results reported here support these findings.
Security is always context dependent. For many use case it works. But if any one knows a better alternative that is battle tested and used please shout out!
I don't know what a "real security audit" is in this context but I think I shared enough pain (with links) from my personal perspective to give a head start I suppose.
I agree security is always context dependent but "passes untrusted input through a package built in C which takes over a year to make security releases when the changelog already references those" makes the set of contexts in which something passes the test very small
One better alternative is presumably the Rust crate (mentioned in the article) it just happens that there's no Python bindings available for that.
Correct, 100% speculative. It could be true, seeing the history of secret services.
But this story is too good to be true! Real questions are: who benefits of this story? And why?
In my (probably naive) humble opinion, the entire population of the USA should benefit from knowing their leadership are corrupt and only interested in enriching themselves and their peers.
But having seen the huge amount of American citizens that spend their days justifying the actions of these corrupt politicians and bi/trillionaires where they apparently can do no wrong, I'm thinking that nobody will really benefit from this and it will be filed under "business as usual".
Dries was in the past imho excellent in inspiring people with his keynotes. Especially with his vision and roadmaps. This keynote was mediocre at best.
AI-AI-AI-AI...The big question was avoided: What is the relevance of Drupal in the AI era?
Most people who want to publish content in a nice looking way can now do that using just a prompt and using natural language. Content management, or managing the things online in a decent way is still an unsolved problem, since this is not a technical thing, but mostly sht work for content managers that nobody want to do. It is a matter of time till OpenAI or some other AI company can do what a CMS application can do, but than without the pain and complexity for users. I see no answer from this keynote in anyway!
This current strategy of Drupal has high risks in terms of maintainability, stability, security and privacy when leaning so heavy on AI-things that are still changing every 3 months.
100% disagree! Do not mix and cherry pick terms and definitions to make your point. That's not scientific -) Take e.g. a look in https://opensciencemooc.eu/ and check a nice accepted handbook like "The Turing Way" [1]
I'd love to hear you expand on how I cherry pick terms and definitions.
The Turing Way seems great and I'm all for education. One of the most interesting conversation topics in this thread is, to me, how to create the necessary incentive structures. Know how is only part of the way. We need to secure the credit assignment for "openness" both in academia and industry.
From a security perspective cc is highly relevant. I use it to get a solid rating of the security aspects of Python code. I use [1] which is solid and proven.
There are many studies about this subject, but mind that complexity in code something different than 'complex' systems. You will need to dive into complexity science , but hard and 'soft' aspects should be taken into account when it comes to cyber security!
Worst things happen always when 2 or more systems are combined because each system might be simple on its own, yet a combination is always much more complex.
For something the the prior statement it is never a weird question to ask of there actually evidence of this or just it seems like it should be true so we believe it.
There are tons of things that seem like they would obviously be true, but it turns out they aren't.
System is more complex based on possible states it can have or inputs/outputs.
That is just maths here working. Two systems combined always will have more states and inputs/outputs.
There is nothing to check here as it can be proven purely by maths.
Complex systems having more attack surface are obviously less secure.
They might be less interesting for attackers if they have to scan huge attack surface like IPv6 vs IPv4 but no one is claiming IPv6 network is more secure.
Cyclomatic complexity is funny math, though. The article demonstrates how. They took a single function that makes state changes to an object, and scattered that logic across four different functions that make the same set of state changes. That’s all. This had adverse impact on the complexity of the system - the logic and behavior of the top level function are the same. It’s just as stateful and has just as many linearly independent code paths. They just got shuffled around to game the way that cyclomatic complexity treats function calls.
But in the process they created three additional functions to call. That means the overall system has more possible code paths, and introduces a need to think about what happens if they are ever called from somewhere other than the original entry point. Introducing ways to screw things up that did not previously exist is not reducing complexity and it is not increasing maintainability.
Your insistence that this somehow managed complexity is exactly why I wrote the top level comment cautioning people about how they interpret cyclomatic complexity. If you don’t understand what it’s actually measuring - not complexity, not really - then it will mislead you into bad decisions.
It’s not obvious to me because cyclomatic complexity is not a straightforward proxy for the number of systems that are being combined.
It’s also the case that some of the most common sources of vulnerabilities, such as SQL injection, introduce no additional cyclomatic complexity. Heck, buffer overflows are good for your cyclomatic complexity - those array bounds checks are all extra branches.
Buffer overflow checks are really only going to be a linear growth in CC. It's when things move towards exponential growth or higher that it gets really easy to introduce flaws of many kinds.
Now, it's probably not a direct correlation. I'd think security bugs are more likely from programmers that unintentionally raise CC without really realizing it. Aka, overreaching their own knowledge when simpler structures are avaliable.
Sure. It’s just that there’s also so much research that has found that cyclomatic complexity is theoretically ill-founded, and that it tends to underperform other ways of measuring complexity. Most notably, just counting lines of code. (Not per function, in total.)
I'd argue that assuming something is obvious without any empirical validation is the root of a huge number of misconceptions that humanity has historically had. There's a reason science suddenly started moving a lot faster after we moved past Aristotle and started measuring things in experiments.
Nice improvement! Good reliable statistics for Python package use is a real challenge! So best is to use multiple indicators to get a rough indication!
"This change removes one source of potential confusion and misinterpretation, but does not mean download counts are an accurate measure of how many people use a package."
TLDR:This study deployed both a survey and an experiment to examine how news literacy and clickbait training affect clickbait detection and engagement with clickbait via clicking, reading, and sharing. Research shows that news-literate readers are better at detecting clickbait and other false news content, and the results reported here support these findings.
reply