Should difficulty be judged based on the exploits available?