This was a better read for me: https://www.securelist.com/en/blog?weblogid=208193767 saw it on slashdot