amalter

I'm not privy to any details, but a simple possibility would be to replace the destination address of any transfers initiated during the time period. You could even re-write all the DOM to hide double checks. It might have even been possible to initiate the server side request directly - but even if there was a 2FA confirmation of the transaction that included the address - I could easily see $2m worth of transfers successfully rerouted. This attack easily could have been against a bank with online wire transfers - the challenge there would be laundering the money.

I don't know much about this specific third party javascript and it's possible that tighter CSP policies could have mitigated some of the attack vectors. However, once you can MITM, it's really game over.

Before we blame usage of the js CDN, they could have performed the TLS attack on KLAYswap instead and then just reverse proxied while strategically rewriting data. It's possible that with this specific setup that the js CDN was the lowest hanging fruit.

This is such an fundamental and structural attack (BGP poisoning to screw with certificate ownership validation) that I find the comment by Phill Hallam-Baker incredulous. Perhaps there is a hobby horse against automatic certificate exchange (there is a mention on EV certs, which were such an obvious scam) or it's just a middlebrow rant about "javascript dependent pages".

There are many attacks possible with this method and plenty that will work on the simplest request/response Web 1.0 architectures.

Fwiw, as married to someone awaiting character and fitness confirmation from 2nd department of New York State - you cannot declare or imply that you are a lawyer, attorney or otherwise able to practice law until duly licensed and sworn in. While Websters says a lawyer includes those that study law, putting that in your email footer is a great way to never be barred.

Thus the definitions are in usage synonyms.

To the GP comment, 100% someone being an asshole.

Often inside your network you are more concerned with encryption than authentication. If you "just" need encryption over the wire, wildcard cert's are useful.

I mean, not to defend them too strongly, but literally half of this post mortem is addressing the failure of the Service Dashboard. You can take it on bad faith, but they own up to the dashboard being completely useless during the incident.

It sounds like this is just for them to mint Root Certificates. I don't see how this elaborate ceremony would impact other aspects of development. It perhaps speaks to a very security conscious development culture - and that can impact agility. But when you "move money" - that's a decent tradeoff.

Linked from the primary source of the article - https://www.thennt.com/nnt/statins-persons-low-risk-cardiova...

We don't have enough doctors and nurses to staff the ICU beds bolted to the floors of the hospital.

Those field hospitals are surge capacity; and work with hurricanes and earthquakes where a single part of the country is affected. You can bring in volunteers and reservists from other areas to create capacity.

When the emergency is everywhere, and on-going, all of your surge capacity is gone.

I watched the same Technology Connections video and started adding a squirt (I use inexpensive liquid detergent) just directly on the inside of the door.

It has remarkably increased the “crud busting” power of my Bosch. I used to be fastidious about pre-rinsing before going in the dishwasher. Not I’m more confident to just go from table to washer (with a super quick rinse)

Even if you use tablets, buy a bit of liquid or powder and put about a teaspoon into the initial rinse.

On a tangent, the dishwasher is such a wonderful improvement on hand washing. My parents generation still sees the dishwasher as some kind of cheat or lazy way out.

They are so much more efficient and environmentally friendly than hand washing.

If you have more than one or two pots, you’ll easily use more than the couple of liters of water your dishwasher uses (and the heat for that water has to come from somewhere).

I think you're arguing for a market with only direct investments and no secondary derivatives. If that was all the equity market was, we could be in the same zip code.

However, we live in this hyper-securitized world, where every part of the economic fabric has bets for and against, with insurance, leverage and information asymmetry baked in.

The only way to "discover" price is to provide instruments that provide "gravity" for both upward and downward price movements. The lack of supply on it's own is not enough, especially when malicious actors are pushing on the supply and demand levers.

Hard no! I want scams and shady schemes uncovered. What a disappointment that Herbalife wasn't brought down by the shorts.

I'm struggling to even understand what a market with "no negativity" means. We want to evaluate firms with a critical eye. If they are mis-valued, that serves no one.

Also unknown is the number protected by prior infection. Anywhere from 10-30%.

I think we’ll see R’ start to plunge during summer due to weather and never climb back up from increase in immunity. But “back to normal”. January earliest.

This is a very interesting document, but where does it discuss a 20% increase in violent crime? I read the section about organized crime involved with cultivation and assume that bring some violent elements.

While this is an ostensibly neutral collection of data, it reads to me very favorably about effects of legalization. Surprisingly even vehicle fatalities decreased significantly over the measured time period.

I agree with you and it's a mental model that Cloudflare isn't a swiss-army knife CDN.. They optimize for fronting web services (And do that very very well).

I use them on my personal site - but on the corporate side where we need TCP acceleration, edge serving of binary resources and POP presence in China - we turn back to crusty ole Akamai.

Yes. The couple they reused after fishing them out required extensive rebuilds.

There are a lot of electronics on these things and weight is ultimate factor.

Mostly reporting what I’m seeing with our workload. Is it possible OpenJDK/Hotspot has more ARM coverage than Graal?

We saw pretty decent performance with AWS Gravitron. The pricing is a bit opaque as AWS might be taking a loss, but M6g.2xlarge steps all over M5.2xlarge on your basic Tomcat/Spring Boot app.

Remember there has been a tremendous amount of effort made to make VM's like the JVM and v8 performant on ARM for mobile. Turns out all those intrinsics scale just fine when presented with your typical "Business Application" workload.

I think Intel is especially in trouble with JVM workloads as it's very rare for libraries to call out to native code (unlike Python).

You really can just drop you jar on an ARM (m6g), AMD (m5a) or Intel (m5, m5n) expect the same results. After a bit of hesitation it will become just a standard part of cloud price optimization.

Cloud operators win - Chip vendors get commoditized.

(Modulo specialized workloads like HPC, ML and such - but to the topic, that's not to Intel's strength)

Bringing a gasoline vehicle into the MTA would get you ticketed real quick. Oil/gas smells, potential leaks, hot exhaust - lots of things you don't want on an underground shoulder to shoulder transit vehicle.

From a purely pragmatic point of view, setting fire to a small business, especially a restaurant in NYC, is an act of kindness.

All of these folks are under water and suddenly the buck stops at the re-insurers.

Sometimes the disease is worse than the cure.

The following fails with expired certificate on all our OSX machines:

  curl -s -o /dev/null -vvv https://kernel.org

I sent out blood-ox monitors to all my family members after a discussion on COVID hypoxia with a MD friend.

It’s never my favorite source, but in the US there are a number of Chinese companies with US shipping on EBay.

I purchased 7 devices from “ConTec” at ~$26/each. All arrived and at least my unit read the same as a retail unit from Walgreens.

Not trying to shill, there are a number of other sources with thousands of positive reviews.

Last measured antigen rate in NYC was north of 20%. My bet is almost all “essential” workers have been exposed and that part of the “herd” is immune.

Who does that leave but everyone else, who are still shopping, going for walks, exercising, doing laundry in communal facilities and all the other minutiae of life that cannot be paused.

I’ve seen this comment a few times and don’t see the mystery. The virus has saturated the mobile and now is finding vectors into the less mobile.

This is a feature, not a bug, since the pickup rate is hopefully under the critical care capabilities.

Ecuador (literally on the equator) being the catastrophic and tragic exception.

Why not get a serological test?

They are being offered inexpensively at least here in NYC by commercial urgent care facilities.

I expect the mail-in Labs will get geared up pretty quickly also.

He doesn’t present an alternative hypothesis though for why (Or maybe it’s implied that this is somehow the natural order of things?)

I’m guessing he’s looking at modern proto-pandemics, because you only have to go back to 1918 to see exponential part of the s curve last longer than two weeks.

Wouldn’t the null hypothesis than be in these modern times, where we understand germ theory, people start naturally practicing social distancing due to fear?

Otherwise what action is slowing virus contagion?

Additionally - I don't know if Zoom's backend is Java, but if it is - Oracle has a sweet deal on getting the Enterprise version of Graal for free if you run on Oracle Cloud.

I think this could be a smart move for a company to be the "big fish in a small pond" - even if that pond is owned by a shark with freaking laser beams....

I think it’s supposed to imply Jewish? Although I don’t quite get the Zionist angle on doctors being kicked out by nervous co-op boards.

We do control the weather, but no cabal can control a cranky NYC co-op board (Not even Bill Gates and the UN)

That the 0.5% death rate in NYC is not higher is _because_ of the pause. We saw the death rates spike at the peak of the curve. We saw the hospitals near total collapse. We even have an example of what would happen if we didn't flatten the curve (Northern Italy). We have another counterexample of California that shows NY's pause was late.

I guess Sweden is the counter-counter example. I think the US would have needed to have built out a far different medical system to achieve what they have.

For a few days at the end of March and beginning of April, the hospitals came so, so close to collapsing. Just a few more days up the curve and we would have run out of beds. (In reality, we did run out of beds, as you can see stories of many turned away from hospitals in those dark days, but it wasn't quite a systematic collapse).

All of this happened, we were here to record it. Models are models, and we're in the early days of a deadly, virulent, confusing pandemic. But there is no doubt that our reactions and solidarity saved lives. The imperfect models helped us get there.

Now, there is a more reasonable question of where do we go from here. For urban metropolis like NYC, I think a slow re-open like Germany. We slightly open the spigit so that 20% becomes 40% becomes 60% (and hopefully immunity is immunity) and we achieve herd protection (at great cost).

And likely the less dense, the slower we'll need to go (depending on hospital saturation).

I certainly will cheer the scientists who took the best information they had at the time and worked with the leaders to make the best decisions they could. Yes, I will indeed hold them "accountable".

ICUs are below occupancy, but hospitals even in the Midwest are declining to do elective procedures because they can’t get enough PPE to handle run of the mill stuff.

The US had been losing actual Hospital capacity every week, even with empty beds.

When those beds fill in wave 2, get ready to donate your rain ponchos and industrial garbage bags.

Also how many unreported and cleared covid patients will end up with permanent injury?

In another post I described how I’m tracking a cohort here in the US of healthy young MDs who are experiencing symptoms consistent with lung injury +42 days after symptom clearance.

A bad flu does not limit you from athletics for life. COVID might. We just don’t know.

Given enough time, an unchecked virus with the attributes of this Coronavirus will saturate through semi-rural and even rural populations. It’s it might take more time, but that’s usually coupled with more spread out medical services.

Without significant efforts to lower the R value (Aka the actions I alluded to; facial covering, social distancing, track and trace) - it’s only a matter of when, not if.

Minus a wonderful medical breakthrough, come find me next winter and let’s see how sure you are with such a quip.

Oh, and by then, a great expense to life, the cities will likely have reached herd immunity, but I won’t quip back, as it would be in bad taste.