Well, if that's what it comes down to, I guess we'll have to agree to disagree. (I don't understand why you would support IRV after C lost the ABCDE example, and if that doesn't convince you, I can't think of anything that will.)
1. There may be a 49/49 tie, and it has to be broken somehow.
Ties aren't unique to Plurality. What if the vote breakdown of an IRV election is 49 RLD, 49 DLR, 2 LRD? Libertarians are eliminated, then there's a tie between the Democrats and the Republicans, just like in Plurality. Ties pop up in Condorcet, too. No matter what voting system you use, there's just no avoiding the chance of a tie. It's a people issue, not a system issue.
2. With IRV, you aren't forced to choose a second, third, etc. choice. You can stick with just your first choice.
Nor are you in Condorcet. You just specify your first choice, then leave the rest unspecified. They all tie for last place by default -- which is exactly the same as what happens in IRV. If you honestly think all the others are equally bad, this is a good thing, but if you actually have an opinion, you're giving up your chance to express it. (For instance, I'm a rampant little-l libertarian on social issues, so despite the fact that I don't want the Republicans in office because I'm economically center-left, I *still* think they're better than the neo-Nazis in the Constitution Party. If I truncated my preferences, and by some nightmare scenario the Constitution Party were a serious contender this election, I'd be letting them waltz into office.)
This attitude that ranking is a bad thing stems from the mathematical fact that IRV throws away most of your ballot. This page shows some example rankings and demonstrates how much is thrown away by IRV:
63: A,B,C,D,E -> 63: A,B
75: B,A,C,D,E -> 75: B
100: C,D,B,E,A -> 100: C
86: D,E,C,B,A -> 86: D
73: E,D,C,B,A -> 73: E,D
1st round: A eliminated, xfer to B. 2nd round: E eliminated, xfer to D. 3rd round: C eliminated, xfer to D. 4th round: D wins. C was the candidate with the most 1st place votes, and the Condorcet winner, but it still loses.
And as for Condorcet, I still don't agree. My main reason: I don't advocate that method because that is a method that will use your lower choices to help defeat your earlier choices.
The smarmy one-liner reply is that IRV will ignore your lower choices and throw away the lesser evil first, then let the greater evil win by default.
Look at it from this perspective: suppose the IRV and Condorcet winners are different; then, by definition of Condorcet method, either the Condorcet winner would defeat the IRV winner in a one-on-one election (i.e. the IRV winner is more widely disliked), or the Condorcet winner and IRV winner were both part of an A-beats-B-beats-C-beats-A cycle and the Condorcet winner was the one ranked highest on most people's ballots (i.e. the IRV winner is more widely disliked).
To use a plausible example, suppose that, like me, you live in Kansas (heavily Republican, with Libertarians the biggest 3rd party), and suppose that Kansas instituted IRV. Now, a few elections from now, suppose that the Libertarian party has gained such that 40% of the voters are Republican (vote RLD), 25% are Libertarian (vote LRD), and 35% are Democrat (vote DLR). Condorcet would choose the Libertarian candidate. IRV would eliminate the Libertarian candidate in the first round, giving the victory to the Republican.
No, Tony Blair is the equivalent of Bush AND Delay rolled into one. Prime Ministers questions are more about keeping a check on the executive than on government legislation. Indeed, the other ministers also have to front the house to be quized about how they are running their departments too.
True. I was oversimplifying a bit, since most parliamentary forms of government don't have as strong a separation between Legislative and Executive as the US does.
Furthermore, there are other countries (Sweden for example) which have parliamentary control of prime ministers who are not themselves members of parliament. This is also - sort of - how the EU system works: the commission is the executive and is appointed by the national governments but it is still answerable to the parliament.
That's rather... odd. Wouldn't that merit a different title than Prime Minister?
Probably some voted for Democrats, because they're duopoly loyalists, many voted Libertarian, a good chunk of the extremists and especially Southern racists voted Constitution, etc., etc.
Actually, at that point in the hypothetical example, all parties except Republican, Democrat, and Libertarian have been eliminated, so the Constitution party isn't a player anymore. The point still stands, though, that people don't do what you'd expect. Those Constitution voters might vote Con, Rep, Dem, Lib, Green for all you know, maybe because they think of Libertarians as hippies for wanting to legalize drugs. (Which is about the most fucked up characterization of the Libertarians as I've ever heard, but then I've heard stranger things from people's mouths.)
Condorcet can elect one of your lower choices, unlike IRV. With Condorcet, each lower choice vote has the same weight as one of the higher choices.
That's the WHOLE GODDAMN POINT of Condorcet: to pick the winner that, while not everyone's first choice, the fewest people will bitch about. If a liberal, a conservative, and a moderate are all running, and the population is 50/50 split between liberals (who vote LMC) and conservatives (who vote CML), the moderate will win, because otherwise 50% of the population will be pissed off.
With IRV, you can rank someone higher and make them lose, or rank someone lower and make them win. This is a violation of the Monotonicity Criterion. Please explain why this is better.
With IRV, you should NEVER vote for a candidate you don't want, even if it's a protest vote. You should really vote for a candidate you would want to win.
In Condorcet, you just truncate your ballot at that point. You let all the people you can't stand all tie for last place, and then you have no problem.
Well, if Republicans come in third place, thus being elimanted, who do you think the Republicans voted for second, Democrats?
Probably some voted for Democrats, because they're duopoly loyalists, many voted Libertarian, a good chunk of the extremists and especially Southern racists voted Constitution, etc., etc.
A lot of Republicans HATE the idea of Libertarians, because they actually want to legislate people's private lives.
I wasn't supporting the current Plurality system, I was arguing against IRV because it has stability problems if a third party actually becomes viable. I guess I should have made that clearer, but I was hoping my.sig would speak for itself. It obviously needs some work.
I was talking about fraud. On Nov 2, we had about 5 choke points where fraud could have swung the election. If we eliminate the EC, we'll have 50 choke points, each of lesser usefulness. It's no different than securing a computer network.
And frankly, I live in Kansas, and I'm sick of the way that corporate-owned pig farmers already run this state. Every time I see a new kickback rider subsidizing the Kansas pig-farming industry passed by Sen. Brownback and his buddies, it makes me sick. Eliminating the EC won't fix that, but it's part of the same thing.
STV is acceptable for proportional representation, but it's useless in presidential elections and of questionable usefulness in Senate elections (2 seats per state, regardless of population). Any sort of PR would also require being approved by the current duopoly.
5a. Use IRV to determine the winner of the state popular vote. That winner receives two electoral votes.
Please don't support IRV. Australia's used IRV for almost a century, and they still have a two-party mess because IRV becomes just as unstable as our current system when a third party becomes powerful. For a peek at a similar system, look back at the two-round runoff elections used in France in 2002, when the lefties were so busy nominating their vanity candidates as their first choice that their second choice Jospin was eliminated in the first round, leaving center-right Chirac opposed to far-right racist LePen. IRV is also a nightmare to tally, since the data of each individual ballot must be kept separate (you can't just add up the votes, you have to have all 120 million ballots shipped to a central location). Support Approval or Condorcet instead, neither of which have these deficiencies and both of which encourage third parties.
The big difference between a Prime Minister and a President is that a Prime Minister is the leader of the Legislative branch. Tony Blair's counterpart in the US isn't George W. Bush, it's House Majority Leader Tom DeLay. When Blair speaks, he's doing it on behalf of the majority in Parliament, not on his own, so it makes sense for his fellow legislators to question how he performs his duty of representing them.
While a Q&A session with the President might be nice, very few presidents would agree to it (at least with Congress), merely on the grounds that it clouds the checks and balances between the Legislative and Executive branches.
Oh, regarding the abolishment of the Electoral College, there's one more point I forgot to make: if it comes down to the popular vote across the nation, that means no one location is so critically important. Whether or not you think fraud took place in this last election, you have to admit there was more room for it because of the Electoral College. If either party wanted to control the election, all they had to do was commit fraud in the swing states, not all 50. The Electoral College adds fragile centralization.
Absolutely, under all circumstances, mandatorily demand a Voter-Verified Paper Audit Trail. This applies not only to touch-screen technology, but to all voting machines. NO EXCEPTIONS, THIS MEANS YOU.
Having accomplished #1, Condorcet voting would be nice, maybe with Approval voting while we wait for everyone to get used to the idea. The Republicrat duopoly needs to end, and though I disagree with the Libertarians on economic issues, it'd be nice to see some real dialog rather than thumping gay abortionist Bibles for the imminently threatening Iraqi children.
Abolish the Electoral College and directly elect the President. This is about equally as important as #2. Land doesn't vote, so why should one land's people get more voting power than another's?
A while back, I wrote this rant on #2, and just last week I wrote this letter to my state legislators regarding #1 and #2. Please, please, PLEASE do the same to your own legislators. (Remember, don't bother so much with your federal legislators. For the forseeable future, the Electoral College will stay in place, and that means each individual state decides its own standards on audit logging and election methods. Only your state legislators currently have any say with regard to #1 and #2, so the rise of Condorcet/Approval will have to be a state-by-state thing.)
Re:My favorite in game humor... Warcraft/Starcraft
on
Humor in Games?
·
· Score: 4, Funny
"Once you head down the dark path, forever will it dominate your destiny... and you get dental." -- The Acolyte
The Dryad had some of the funniest lines, though. "I dont reveal much on the minimap. *sniff* It's all my fault."
I'd go into the requisite spiel on why plurality voting is broken and forces a two-party system on us, but instead I'll just point you to this article on electionmethods.org about the best alternative.
This isn't a flaimbate or anything but why don't gays create their own churches which respect and tolerate gay marriage? I mean really, their are so many denominations as it stands one more couldn't hurt. Why not create their own denomination which recognizes their marriage on religious grounds?
Let's see... there's the Metropolitan Community Church (founded in 1968 specifically for gays), the Unitarian Universalist Association (a very liberal Christian sect that officially endorsed same-sex ceremonies back in 1984, and was performing them at a local level 10 years before that), and numerous other branches of Christian and other faiths that have recognized same-sex unions over the years.
The problem isn't religious marriage. Gays have had religious marriage for years. It's a non-issue. The problem is that the government refuses to recognize the civil, secular aspects of those marriages. It refuses to give them the little piece of paper that gives them things like hospital visitation rights, next of kin status, etc.
While we're at it, get rid of any inkling of monetary 'rewards' for unions (marriage), why should people who don't find "that special someone" not be rewarded.
Actually, author Jonathan Rauch makes the case in his book that one of the principal reasons that we have marriage -- completely ignoring the "shouting points" of love, children, etc. -- is that a couple making a promise to take care of each other in hard times is a boon for society in general, since it means that support networks like extended family, charities, and welfare don't have to spend as much time and money taking care of that couple when something drastic happens. From this perspective, it makes perfect sense to give couples a slight tax break.
Actually, if the FMA were passed, it would outlaw the recognition of civil unions as well. The phrase "legal incidents thereof" is referring to the benefits that come as part of the marriage package (e.g. joint tax filing, power of attorney, hospital visitation rights, child custody rights, etc.). This means that, while a state could legalize civil unions (or even marriage), neither other states nor the federal government would have to recognize the rights that the state bestowed on the couple. (Which means you'll get crap like the recent Vermont/Virginia custody battle fiasco, except that then it'll be enshrined into the constitution and thus that much harder to mop up the mess.)
The first Mortal Kombat movie was cheesy but fun, but there is no end to the depths of my loathing for the second MK movie. For comparison, Rotten Tomatoes pegs the original Mortal Kombat at 26% fresh, but the sequel Mortal Kombat: Annihilation gets a paltry 5% fresh rating. It's just that much worse. To quote one of the critics: "You know that when an acting joke like Christopher Lambert won't even return for the sequel, some fragile line has been crossed." It's nothing but a string of cameo fight scenes connected with horrible dialogue (think Halle Berry's infamous "struck by lightning" line in X-Men, except *all* the dialogue is like that) and bewilderingly bad CGI (going by looks, it's a reasonable assumption that Babylon 5 had a higher per-episode production budget).
Actually, on a *real* OS (e.g. Linux, 32-bit Windows), the heap is a per-process area. It starts out as unallocated address space, and when the program needs more heap space, it asks the OS to map in more memory to expand the top of the heap. The heap allocator then breaks the heap into smaller chunks for the program to use. There's no reason why the heap shouldn't be marked NX by default (the program can always request execute permission if it's e.g. JITing something or building a trampoline).
(For anyone who's coded before but doesn't know what the heap is, it's where memory comes from when you call C's malloc, C++'s new, Visual Basic's Redim, etc. When a program needs memory, but doesn't know how much it needs until right before it asks, it's almost always using the heap.)
(Oh, and since there's probably someone out there wondering how the heap can be attacked, the problem boils down to the fact that each chunk of memory in the heap is part of a doubly-linked list. If you overflow your chunk and scribble on the header of the next one, the list pointers of the next block can be changed to point at any memory address you like. If you're very, very patient, you can figure out how to scribble on the heap in such a way that you can write any number to any place in memory, effective as soon as the program tries to free the chunk. The details vary a lot depending on the heap's implementation details, which can vary even from program to program on the same OS (e.g. the dlmalloc library on Linux replaces the built-in heap allocator in libc).)
I was actually asking about the scenarios that the NX bit doesn't cover that stack canaries do?
Like I said, return into libc is the obvious one. Since a return into libc attack still requires overwriting the canary to get to the return address, a stack canary still prevents it from happening, but the NX bit approach can't stop it since libc *can't* be NX.
Stack canaries have different problems. First, since the security relies on the attacker's inability to guess the canary, the random algorithm is a huge weak link. Eris help you if you're using linear congruential. Second, since the stack canary isn're-seeded each time, there are scenarios where an attacker gets as many attempts as he likes to guess the canary, over as long a time as he likes. For instance, if you're using a pre-forking server like Apache, or just any old fork-on-accept server, each copy of the server is using the same canary, since they were forked from the same parent instance. (Unless your C library is aware of the canaries and re-randomizes them on fork() -- which is tricker than it sounds, because now all the canaries in the cloned call stack are invalid. Even if fork() is updated, multi-thread servers are likely still vulnerable. It's really tricky to get right if you're not re-randomizing with every function call, and if you are, you have the question of where to store the "canonical canary" to compare the stack canary against. You can't really store it on the stack, now can you? You might end up spending a register just on the canary, which on the register-starved x86 can kill you.)
Slashdot Mirror
Well, if that's what it comes down to, I guess we'll have to agree to disagree. (I don't understand why you would support IRV after C lost the ABCDE example, and if that doesn't convince you, I can't think of anything that will.)
Err... bad example for the tie. 49 RLD, 49 DLR, 1 LRD, 1 LDR. (I'm an LDR. We exist.)
Ties aren't unique to Plurality. What if the vote breakdown of an IRV election is 49 RLD, 49 DLR, 2 LRD? Libertarians are eliminated, then there's a tie between the Democrats and the Republicans, just like in Plurality. Ties pop up in Condorcet, too. No matter what voting system you use, there's just no avoiding the chance of a tie. It's a people issue, not a system issue.
Nor are you in Condorcet. You just specify your first choice, then leave the rest unspecified. They all tie for last place by default -- which is exactly the same as what happens in IRV. If you honestly think all the others are equally bad, this is a good thing, but if you actually have an opinion, you're giving up your chance to express it. (For instance, I'm a rampant little-l libertarian on social issues, so despite the fact that I don't want the Republicans in office because I'm economically center-left, I *still* think they're better than the neo-Nazis in the Constitution Party. If I truncated my preferences, and by some nightmare scenario the Constitution Party were a serious contender this election, I'd be letting them waltz into office.)
This attitude that ranking is a bad thing stems from the mathematical fact that IRV throws away most of your ballot. This page shows some example rankings and demonstrates how much is thrown away by IRV:
1st round: A eliminated, xfer to B. 2nd round: E eliminated, xfer to D. 3rd round: C eliminated, xfer to D. 4th round: D wins. C was the candidate with the most 1st place votes, and the Condorcet winner, but it still loses.
So... your point is that compromise is bad, because if your first choice doesn't win, you're going home and you're taking your toys with you.
Please explain how IRV is better than Plurality then.
The smarmy one-liner reply is that IRV will ignore your lower choices and throw away the lesser evil first, then let the greater evil win by default.
Look at it from this perspective: suppose the IRV and Condorcet winners are different; then, by definition of Condorcet method, either the Condorcet winner would defeat the IRV winner in a one-on-one election (i.e. the IRV winner is more widely disliked), or the Condorcet winner and IRV winner were both part of an A-beats-B-beats-C-beats-A cycle and the Condorcet winner was the one ranked highest on most people's ballots (i.e. the IRV winner is more widely disliked).
To use a plausible example, suppose that, like me, you live in Kansas (heavily Republican, with Libertarians the biggest 3rd party), and suppose that Kansas instituted IRV. Now, a few elections from now, suppose that the Libertarian party has gained such that 40% of the voters are Republican (vote RLD), 25% are Libertarian (vote LRD), and 35% are Democrat (vote DLR). Condorcet would choose the Libertarian candidate. IRV would eliminate the Libertarian candidate in the first round, giving the victory to the Republican.
True. I was oversimplifying a bit, since most parliamentary forms of government don't have as strong a separation between Legislative and Executive as the US does.
That's rather... odd. Wouldn't that merit a different title than Prime Minister?
Actually, at that point in the hypothetical example, all parties except Republican, Democrat, and Libertarian have been eliminated, so the Constitution party isn't a player anymore. The point still stands, though, that people don't do what you'd expect. Those Constitution voters might vote Con, Rep, Dem, Lib, Green for all you know, maybe because they think of Libertarians as hippies for wanting to legalize drugs. (Which is about the most fucked up characterization of the Libertarians as I've ever heard, but then I've heard stranger things from people's mouths.)
That's the WHOLE GODDAMN POINT of Condorcet: to pick the winner that, while not everyone's first choice, the fewest people will bitch about. If a liberal, a conservative, and a moderate are all running, and the population is 50/50 split between liberals (who vote LMC) and conservatives (who vote CML), the moderate will win, because otherwise 50% of the population will be pissed off.
With IRV, you can rank someone higher and make them lose, or rank someone lower and make them win. This is a violation of the Monotonicity Criterion. Please explain why this is better.
In Condorcet, you just truncate your ballot at that point. You let all the people you can't stand all tie for last place, and then you have no problem.
Probably some voted for Democrats, because they're duopoly loyalists, many voted Libertarian, a good chunk of the extremists and especially Southern racists voted Constitution, etc., etc.
A lot of Republicans HATE the idea of Libertarians, because they actually want to legislate people's private lives.
I wasn't supporting the current Plurality system, I was arguing against IRV because it has stability problems if a third party actually becomes viable. I guess I should have made that clearer, but I was hoping my .sig would speak for itself. It obviously needs some work.
Cocaine isn't an opiate, it's a completely different family of drugs.
I was talking about fraud. On Nov 2, we had about 5 choke points where fraud could have swung the election. If we eliminate the EC, we'll have 50 choke points, each of lesser usefulness. It's no different than securing a computer network.
And frankly, I live in Kansas, and I'm sick of the way that corporate-owned pig farmers already run this state. Every time I see a new kickback rider subsidizing the Kansas pig-farming industry passed by Sen. Brownback and his buddies, it makes me sick. Eliminating the EC won't fix that, but it's part of the same thing.
STV is acceptable for proportional representation, but it's useless in presidential elections and of questionable usefulness in Senate elections (2 seats per state, regardless of population). Any sort of PR would also require being approved by the current duopoly.
Please don't support IRV. Australia's used IRV for almost a century, and they still have a two-party mess because IRV becomes just as unstable as our current system when a third party becomes powerful. For a peek at a similar system, look back at the two-round runoff elections used in France in 2002, when the lefties were so busy nominating their vanity candidates as their first choice that their second choice Jospin was eliminated in the first round, leaving center-right Chirac opposed to far-right racist LePen. IRV is also a nightmare to tally, since the data of each individual ballot must be kept separate (you can't just add up the votes, you have to have all 120 million ballots shipped to a central location). Support Approval or Condorcet instead, neither of which have these deficiencies and both of which encourage third parties.
The big difference between a Prime Minister and a President is that a Prime Minister is the leader of the Legislative branch. Tony Blair's counterpart in the US isn't George W. Bush, it's House Majority Leader Tom DeLay. When Blair speaks, he's doing it on behalf of the majority in Parliament, not on his own, so it makes sense for his fellow legislators to question how he performs his duty of representing them.
While a Q&A session with the President might be nice, very few presidents would agree to it (at least with Congress), merely on the grounds that it clouds the checks and balances between the Legislative and Executive branches.
Oh, regarding the abolishment of the Electoral College, there's one more point I forgot to make: if it comes down to the popular vote across the nation, that means no one location is so critically important. Whether or not you think fraud took place in this last election, you have to admit there was more room for it because of the Electoral College. If either party wanted to control the election, all they had to do was commit fraud in the swing states, not all 50. The Electoral College adds fragile centralization.
A while back, I wrote this rant on #2, and just last week I wrote this letter to my state legislators regarding #1 and #2. Please, please, PLEASE do the same to your own legislators. (Remember, don't bother so much with your federal legislators. For the forseeable future, the Electoral College will stay in place, and that means each individual state decides its own standards on audit logging and election methods. Only your state legislators currently have any say with regard to #1 and #2, so the rise of Condorcet/Approval will have to be a state-by-state thing.)
"Once you head down the dark path, forever will it dominate your destiny... and you get dental." -- The Acolyte
The Dryad had some of the funniest lines, though. "I dont reveal much on the minimap. *sniff* It's all my fault."
I'd go into the requisite spiel on why plurality voting is broken and forces a two-party system on us, but instead I'll just point you to this article on electionmethods.org about the best alternative.
What if one or both spouses convert to another religion?
Let's see... there's the Metropolitan Community Church (founded in 1968 specifically for gays), the Unitarian Universalist Association (a very liberal Christian sect that officially endorsed same-sex ceremonies back in 1984, and was performing them at a local level 10 years before that), and numerous other branches of Christian and other faiths that have recognized same-sex unions over the years.
The problem isn't religious marriage. Gays have had religious marriage for years. It's a non-issue. The problem is that the government refuses to recognize the civil, secular aspects of those marriages. It refuses to give them the little piece of paper that gives them things like hospital visitation rights, next of kin status, etc.
Actually, author Jonathan Rauch makes the case in his book that one of the principal reasons that we have marriage -- completely ignoring the "shouting points" of love, children, etc. -- is that a couple making a promise to take care of each other in hard times is a boon for society in general, since it means that support networks like extended family, charities, and welfare don't have to spend as much time and money taking care of that couple when something drastic happens. From this perspective, it makes perfect sense to give couples a slight tax break.
Actually, if the FMA were passed, it would outlaw the recognition of civil unions as well. The phrase "legal incidents thereof" is referring to the benefits that come as part of the marriage package (e.g. joint tax filing, power of attorney, hospital visitation rights, child custody rights, etc.). This means that, while a state could legalize civil unions (or even marriage), neither other states nor the federal government would have to recognize the rights that the state bestowed on the couple. (Which means you'll get crap like the recent Vermont/Virginia custody battle fiasco, except that then it'll be enshrined into the constitution and thus that much harder to mop up the mess.)
The first Mortal Kombat movie was cheesy but fun, but there is no end to the depths of my loathing for the second MK movie. For comparison, Rotten Tomatoes pegs the original Mortal Kombat at 26% fresh, but the sequel Mortal Kombat: Annihilation gets a paltry 5% fresh rating. It's just that much worse. To quote one of the critics: "You know that when an acting joke like Christopher Lambert won't even return for the sequel, some fragile line has been crossed." It's nothing but a string of cameo fight scenes connected with horrible dialogue (think Halle Berry's infamous "struck by lightning" line in X-Men, except *all* the dialogue is like that) and bewilderingly bad CGI (going by looks, it's a reasonable assumption that Babylon 5 had a higher per-episode production budget).
Actually, on a *real* OS (e.g. Linux, 32-bit Windows), the heap is a per-process area. It starts out as unallocated address space, and when the program needs more heap space, it asks the OS to map in more memory to expand the top of the heap. The heap allocator then breaks the heap into smaller chunks for the program to use. There's no reason why the heap shouldn't be marked NX by default (the program can always request execute permission if it's e.g. JITing something or building a trampoline).
(For anyone who's coded before but doesn't know what the heap is, it's where memory comes from when you call C's malloc, C++'s new, Visual Basic's Redim, etc. When a program needs memory, but doesn't know how much it needs until right before it asks, it's almost always using the heap.)
(Oh, and since there's probably someone out there wondering how the heap can be attacked, the problem boils down to the fact that each chunk of memory in the heap is part of a doubly-linked list. If you overflow your chunk and scribble on the header of the next one, the list pointers of the next block can be changed to point at any memory address you like. If you're very, very patient, you can figure out how to scribble on the heap in such a way that you can write any number to any place in memory, effective as soon as the program tries to free the chunk. The details vary a lot depending on the heap's implementation details, which can vary even from program to program on the same OS (e.g. the dlmalloc library on Linux replaces the built-in heap allocator in libc).)
Like I said, return into libc is the obvious one. Since a return into libc attack still requires overwriting the canary to get to the return address, a stack canary still prevents it from happening, but the NX bit approach can't stop it since libc *can't* be NX.
Stack canaries have different problems. First, since the security relies on the attacker's inability to guess the canary, the random algorithm is a huge weak link. Eris help you if you're using linear congruential. Second, since the stack canary isn're-seeded each time, there are scenarios where an attacker gets as many attempts as he likes to guess the canary, over as long a time as he likes. For instance, if you're using a pre-forking server like Apache, or just any old fork-on-accept server, each copy of the server is using the same canary, since they were forked from the same parent instance. (Unless your C library is aware of the canaries and re-randomizes them on fork() -- which is tricker than it sounds, because now all the canaries in the cloned call stack are invalid. Even if fork() is updated, multi-thread servers are likely still vulnerable. It's really tricky to get right if you're not re-randomizing with every function call, and if you are, you have the question of where to store the "canonical canary" to compare the stack canary against. You can't really store it on the stack, now can you? You might end up spending a register just on the canary, which on the register-starved x86 can kill you.)