Negative datapoints are nearly completely useless in this scenario, as we only have ~8% of the leaked UDIDs.
Think about it this way: there are more than 250m iOS devices in the world[1]. I think 300m is a good, conservative estimate.
12m (~4%) of the world's UDIDs have leaked. 1m of those (~.33% of the total, 8% of the dump) have leaked.
A data point saying "my iOS device is in the dump" represents 1/1m of its group. Pretty significant, relative to 300m devices!
A data point saying "my iOS device isn't in the dump" has two possibilities; a 96% chance it isn't in the dump and a 3.66% chance it is but wasn't leaked.
As one of the 99.66% of iOS users, your data point represents just 1/299m of its group, and is thus ~300x less powerful than a positive data point.
Think about it this way: there are more than 250m iOS devices in the world[1]. I think 300m is a good, conservative estimate.
12m (~4%) of the world's UDIDs have leaked. 1m of those (~.33% of the total, 8% of the dump) have leaked.
A data point saying "my iOS device is in the dump" represents 1/1m of its group. Pretty significant, relative to 300m devices!
A data point saying "my iOS device isn't in the dump" has two possibilities; a 96% chance it isn't in the dump and a 3.66% chance it is but wasn't leaked.
As one of the 99.66% of iOS users, your data point represents just 1/299m of its group, and is thus ~300x less powerful than a positive data point.
[1]: http://www.engadget.com/2011/10/04/apple-250-million-ios-dev...