From time to time, some web sites asks to enter a security question and an answer for it. The question list is standard and it usually includes "What is your mother's maiden name?". Some people use their mother's real maiden name so that they are sure they can remember what to provide when asked (e.g. as part of the process to recover the account). This means that this is information is fixed for a very long period of time. If it happens that some web application is hacked and such an answer is associated with an e-mail address (or worse, with personally identifiable information), it can potentially create a vulnerability for other web applications. Also, mother's maiden name might be shared in public space. Assuming above issues with this security question (or any other security question that relies on a constant within one's life): Why is Mother’s Maiden Name still used as a security question?

Diffie-Hellman is a way of generating a shared secret between two people in such a way that the secret can't be seen by observing the communication. That's an important distinction: You're not sharing information during the key exchange, you're creating a key together. This is particularly useful because you can use this technique to create an encryption key with someone, and then start encrypting your traffic with that key. And even if the traffic is recorded and later analyzed, there's absolutely no way to figure out what the key was, even though the exchanges that created it may have been...

Google Authenticator supports both the HOTP and TOTP algorithms for generating one-time passwords. With HOTP, the server and client share a secret value and a counter, which are used to compute a one time password independently on both sides. Whenever a password is generated and used, the counter is incremented on both sides, allowing the server and client to remain in sync. TOTP essentially uses the same algorithm as HOTP with one major difference. The counter used in TOTP is replaced by the current time. The client and server remain in sync as long as the system times remain the...

Because people are lazy and/or incompetent. And, well, you know, the Internet is full of chimpanzees . I would argue that all security questions are bad, but using the mother's maiden name is exceptionally bad: At least in Sweden, I can find out anyone's maiden name just with a simple call to the tax office. It is literally public information. It's 2018, and fairly common for couples to adopt the bride's name when getting married. Your mothers maiden name is then your surname. Great. Luis Casillas rightly adds: There are dozens of countries, with billions of inhabitants between them, where...

This is actually an interesting new field in infosec— reputation management . Employers, Law Enforcement and other government agencies, legal professionals, the press, criminals and others with an interest in your reputation will be observing all online activity associated with your real name. These "interested parties" (snoops) are usually terrible at separating professional and personal life, so you could be made to suffer for unpopular opinions, political or religious convictions, associates or group affiliations they consider "unsavory", and any behavior that can be interpreted in the most uncharitable light. (Teachers have been forced to resign for drinking wine responsibly while...


Why does it matter that a group of January 6 rioters went to Olive Garden for dinner after the riot?

CNN has an article pointing out that the rioters went to Olive Garden for dinner and spent $400 after the riot. The article implies that where they went for dinner, and how much they spent, is relevant to their trial. Why does it matter where they go for dinner and how much they spend? What they did at the Capitol was both illegal and immoral, but going to Olive Garden is neither.

Legally speaking, very many nations grant asylum, and religious persecution is one of the most basic grounds for granting asylum, following the 1951 Refugee Convention . This newspaper article compares asylum statistics in Ireland versus other parts of Europe. The Irish immigration authorities spell out the details for an asylum application. Note that you must already be in Ireland, to apply for asylum in Ireland (you should apply when you enter the country). One could also apply to Norway (almost an English-speaking country), but again you have to be in Norway to do so. There is a generic solution to...

This is the Fed (FCC) saying "I'm paying for this, so I get to determine who uses it." The service costs money. It is not automagic speech to text, but rather there is often (usually?) an actual human typing it in. Carriers front the cost, and then get compensation from the Fed. The Federal govt picks up that cost. They don't want people that don't need it due to hearing loss making use of that service and its associated costs. From the FCC : Title IV of the Americans with Disabilities Act (b) Availability of telecommunications relay services: the Commission...

The article says: Defense lawyers say the evidence does not show a celebration of violence. Which implies that the prosecution claimed exactly that, or at least that the defense anticipates the prosecution to claim something along those lines. The article also says [ bold italic emphasis mine]: Defense lawyers for Rhodes have previously addressed the dinner, saying that prosecutors’ theory of the episode is incorrect. Rhodes’ lawyers said in a court filing the dinner is evidence that the militia leader wasn’t working to foment a revolution . “ The conditions would never be better . Yet, Rhodes and the others...

Yes, that’s allowed. Under the Stack Exchange terms of service , content you upload is licensed to Stack Exchange Inc. on a non-exclusive basis under CC-BY-SA 4.0. The terms of service do not give Stack Exchange the copyright to your contributions, and a non-exclusive license means you are not promising Stack Exchange that “only Stack Exchange will be allowed to use this content.” That means you can continue to do whatever you want with your own content and do not need to mention Stack Exchange at all. The only restriction is that you can’t stop Stack Exchange from continuing to...


Why are chips safer than magnetic stripes?

After the recent Target hack there has been talk about moving from credit cards with magnetic stripes to cards with a chip. In what ways are chips safer than stripes?

I was curious about the same thing, so I put Gbt3fC79ZmMEFUFJ into Google, and lo! and behold it found something that wasn't just a paraphrase of "Don't use this password" advice — the password itself was embedded in example source code that showed how you could send a password to a server! ( link to page , and screenshot below) So I think the real goal of that advice is not that Gbt3fC79ZmMEFUFJ is a mysteriously weak password because of the keyboard layout or because of low entropy or because it doesn't include symbols or Unicode or emoji or whatever:...

No, Docker containers are not more secure than a VM. Quoting Daniel Shapira : In 2017 alone, 434 linux kernel exploits were found , and as you have seen in this post, kernel exploits can be devastating for containerized environments. This is because containers share the same kernel as the host, thus trusting the built-in protection mechanisms alone isn’t sufficient. 1. Kernel exploits from a container If someone exploits a kernel bug inside a container, they exploited it on the host OS. If this exploit allows for code execution, it will be executed on the host OS, not inside the...

You are touching a sore point… Historically , computers were mainframes where a lot of distinct users launched sessions and process on the same physical machine. Unix-like systems (e.g. Linux), but also VMS and its relatives (and this family includes all Windows of the NT line, hence 2000, XP, Vista, 7, 8...), have been structured in order to support the mainframe model. Thus, the hardware provides privilege levels . A central piece of the operating system is the kernel which runs at the highest privilege level (yes, I know there are subtleties with regards to virtualization) and manages the privilege...

You can't clone the chip. A magnetic strip holds a secret number, and if someone knows that number they can claim to be the owner of the card. But if a bad guy swipes the card, they then know the number, and can make their own card, i.e. "cloning". This has turned out to be a major practical problem with magstripe cards. A chip also holds a secret number. However, it is securely embedded in the chip. When you use the card, the chip performs a public key operation that proves it knows this secret number. However, it never reveals...


There is a new recent attack "on TLS" named "DROWN" . I understand that it appears to use bad SSLv2 requests to recover static (certificate) keys. My question is: How? How can you recover static encryption or signature keys using SSLv2? Bonus questions: How can I prevent the attack from applying to me as a server admin? How could the attack spawn in the first place?

This is commonly known as a capability URL / secret URL. It's secure in modern websites but not suitable for all applications and requires significant care to use . You can find an excellent overview of their advantages, risks and best practices in this page by W3C . It's meaningless to talk about security without specifying a threat model. Here are a couple that come to mind: 1: A passive attacker on the network (eavesdroping) 2: An active attacker on the network (can change packets at will, mitm, etc) 3: A shoulder-surfer 4: An attacker with physical access to your...

To understand the attack, one must recall Bleichenbacher's attack from the late 20th century. In that attack, the attacker uses the target server as an oracle . When using RSA-based key exchange, the client is supposed to send a secret value (the "pre-master secret") encrypted with the server's public key, using PKCS#1 v1.5 padding (called "type 2"). Bleichenbacher's attack relied on sending carefully crafted values in lieu of a properly encrypted message, and observe the server's reaction. The server might respond (most of the time) with an error saying "I processed that but it did not yield a proper PKCS#1...

Note: This answer was written in 2013. Many things have changed in the following years, which means that this answer should primarily be seen as how best practices used to be in 2013. The Theory We need to hash passwords as a second line of defence. A server which can authenticate users necessarily contains, somewhere in its entrails, some data which can be used to validate a password. A very simple system would just store the passwords themselves, and validation would be a simple comparison. But if a hostile outsider were to gain a simple glimpse at the contents of...

The analogy of the bank and bank employee You call the bank to request a new bank account, to make an appointment - whatever. Somehow you and the bank make sure that you are who you are, and the bank is actually the bank. This is the TLS process that secures the connection between you and the bank, and we assume this is handled properly. The roles in this play The bank: a webserver The bank employee: the OpenSSL service for that server You (the bank robber): a bot fetching all it can get from that server Staying connected -...


Can you make the police department pay for damage done to your property if you get swatted?

For purposes of conjecture, say some nameless online troll decides that they hate you. Perhaps you said you don't worship the members of a K-Pop band they like. As a result, they do some research and find your address. They then proceed to call your local police department, reporting a (fictional) hostage situation / homicide in progress / etc. at your address. The police department's SWAT team busts down your door and trashes your house. This is a "prank" called swatting . As is the troll's intention, it causes a lot of damage to your property, damage you can't afford to get repaired. Is there any way to get the police department to pay for the damage? After all, they did just come and trash your house despite you having done nothing wrong (besides the horrendous crime of not worshiping the troll's favorite band).

There is precedent for the idea that double jeopardy need not apply when the initial trial was a sham because the judge and/or jury had been bribed. See Aleman v. Judges of Cook County Circuit Court , 138 F.3d 302 (7th Cir. 1998) . This case was very similar to your hypothetical: Aleman was initially acquitted of a murder, but years later it came to light that he had bribed the judge (in a bench trial). He was retried and convicted in state court. He appealed his conviction on the grounds of double jeopardy, but the Seventh Circuit denied his...

There is a police power exception to the 5th and 14th Amendment rights to not taking property without due process of law and just compensation. In a similar case arising in Greenwood Village, Colorado , an innocent homeowner was denied any relief at trial in the U.S. District Court for the District of Colorado, or on appeal to the 10th Circuit, after his house was trashed by SWAT teams trying to catch a guy accused of mere theft and fleeing police officers. (The U.S. Supreme Court declined to review the case sometime after the linked article was written.) But, there...

Maybe, Hence the Lawsuits In the absence of clear statute law these all circle around tort law. For the scooter companies, trespass to chattels , and for the affected landowners (who hire the removalists) trespass to land and nuisance seem applicable. In essence, I can’t take your stuff (trespass to chattels) but you can’t leave your stuff on my property (trespass to land) or impeding access to it (nuisance). If you do, I am entitled to the reasonable costs of dealing with it. Note that, as owner, you remain responsible for you stuff even if you rented it to someone...

Legally speaking, very many nations grant asylum, and religious persecution is one of the most basic grounds for granting asylum, following the 1951 Refugee Convention . This newspaper article compares asylum statistics in Ireland versus other parts of Europe. The Irish immigration authorities spell out the details for an asylum application. Note that you must already be in Ireland, to apply for asylum in Ireland (you should apply when you enter the country). One could also apply to Norway (almost an English-speaking country), but again you have to be in Norway to do so. There is a generic solution to...


Can I use my own Stack Exchange answer in a book?

I’ve seen some similar questions, but was wondering about a more specific case. I wrote a Stack Exchange answer, and would like to use it in one section of a book I’m writing (which will be commercially sold). I also modified the answer, and added to it, but some original passages remain. I’m wondering if, as the author, and with proper attribution that the section is based on my Stack Exchange answer, with a link, this is legally acceptable?

Through the legal doctrine of "transferred intent", wherein if one intends to murder A, and undertake actions to kill A, but one's actions kill B, one has murdered B. Whatever crimes one would have committed, had one performed them on one's intended target, are considered committed against the individual one actually performed them on. Many crimes require one to have mens rea to be guilty; they do not require one to have mens rea towards a given individual. So, so long as one had the proper intent to murder someone, the actual victim of their actions is irrelevant.

Yes, that’s allowed. Under the Stack Exchange terms of service , content you upload is licensed to Stack Exchange Inc. on a non-exclusive basis under CC-BY-SA 4.0. The terms of service do not give Stack Exchange the copyright to your contributions, and a non-exclusive license means you are not promising Stack Exchange that “only Stack Exchange will be allowed to use this content.” That means you can continue to do whatever you want with your own content and do not need to mention Stack Exchange at all. The only restriction is that you can’t stop Stack Exchange from continuing to...

Powers What power do I have as a driver if my interstate route is blocked by a protest? As an ordinary citizen, no powers in most jurisdictions. You have the right to report obstruction of the highway to the local police. You likely have the right to sue those people if you have evidence of significant harm they have caused you. Right to Obstruct I feel like ethically no one has the right to obstruct my travel You are wrong to put this in absolute terms. For example, a roadworker holding a "stop" sign has the right to temporarily obstruct...

My impression, and the plausible explanation in the absence of the actual facts, is that this was something that the attorney agreed to, in order to allow a skittish client to reveal information pursuant to a favorable plea agreement. The police probably insisted that the client be handcuffed to someone while doing this to prevent the client from fleeing. The attorney probably offered to do the job instead of a police officer, to be able to provide advice to his client and keep his client calm enough to do it, which might not have happened (sacrificing the favorable plea deal...


Among the Elliptic Curve Cryptography (ECC) algorithms available in OpenSSH (ECDH, ECDSA, Ed25519, Curve25519), which offers the best level of security, and (ideally) why?

Chrome not only stores your password text, it will show it to you. Under settings -> advanced -> manage passwords you can find all your passwords for all your sites. Click show on any of them and it will appear in the clear. Hashed passwords work for the site authenticating you. They are not an option for password managers. Many will encrypt the data locally, but the key will also be stored locally unless you have a master password setup. Personally, I use the chrome password manager and I find it convenient. I also, however, have full disk encryption and...

In SSH, two algorithms are used: a key exchange algorithm (Diffie-Hellman or the elliptic-curve variant called ECDH) and a signature algorithm. The key exchange yields the session key which will be used to encrypt data for that session. The signature is so that the client can make sure that it talks to the right server (another signature, computed by the client, may be used if the server enforces key-based client authentication). ECDH uses a curve ; most software use the standard NIST curve P-256. Curve25519 is another curve, whose "sales pitch" is that it is faster, not stronger, than P-256....

Hibernate the computer If the ransomware is encrypting the files, the key it is using for encryption is somewhere in memory. It would be preferable to get a memory dump, but you are unlikely to have the appropriate hardware for that readily available. Dumping just the right process should also work, but finding out which one may not be trivial (eg. the malicious code may be running inside explorer.exe ), and we need to dump it now . Hibernating the computer is a cheap way to get a memory image¹ Then it could be mounted read-only on a clean computer...

According to Google , the difference is with handling referrer information when clicking on an ad. After a note from AviD and with the help of Xander we conducted some tests and here are the results 1. Clicking on an ad: https://google.com : Google will take you to an HTTP redirection page where they'd append your search query to the referrer information. https://encrypted.google.com : If the advertiser uses HTTP, Google will not let the advertiser know about your query. If the advertiser uses HTTPS, they will receive the referrer information normally (including your search query). 2. Clicking on a normal...


Is there an intuitive explanation for the Feynman-Kac-Theorem?

The Feynman-Kac theorem states that for an Ito-process of the form $$dX_t = \mu(t, X_t)dt + \sigma(t, X_t)dW_t$$ there is a measurable function $g$ such that $$g_t(t,x) + g_x(t, x) \mu(t,x) + \frac{1}{2} g_{xx}(t,x)\sigma(t,x)^2 = 0$$ with an appropriate boundary condition $h$: $g(T,x) = h(x)$. We also know that $g(t,x)$ is of the form $$g(t,x)=\mathbb{E}\left[h(X_T) \big| X_t=x\right].$$ This means that I can price an option with payoff function $h(x)$ at $T$ by solving the differential equation without regard to the stochastic process. Is there an intuitive explanation how it is possible to model the stochastic behaviour of the Ito-process by a differential equation, even though the differential equation does not have a stochastic component?

There are some cases where you can blend your portfolios using weights directly. One case involves corner portfolios . In this case a linear combination of weights is also efficient. Another case is where you can treat the two separate weights you have produced each as distinct portfolio under the assumption that the correlation between these portfolios is relatively stable. In this scenario, the problem reduces to a two-asset portfolio optimization problem (each asset is simply the linear combination of weights produced via your two methods). The other class of methods involves blending via the expected returns. If you arrived...

Martingales + Markovian Here is the motivation. Conditional expectations are martingales by the tower property of conditional expectations (an easy exercise to show). Suppose $r=0$, by the risk neutral pricing theorem $E^\star\left[h(X_T)\bigg|\mathscr{F}_t,\,X_t=x\right]$ is the price of any derivative security with $X$ as the underlying asset and payoff function $h$ assuming for the moment that the underlying security and the derivative itself pay no intermediate cashflows. In a Markovian setting, it must be the case that the price of the derivative is a measurable function of the current asset price and the time to maturity only, say a function $g(t, x)$....

I can only talk about quantitative trading. As a rule of thumb, the lower frequency you work in, the more econometrics is important, whereas for a higher frequency, the more econometrics becomes useless . (I would still recommend a top econometrician for HFT since they have what it takes to succeed, it's just the models aren't out-of-the-box applicable.) But if I was interviewing someone who was educated in econometrics for a quantitative research position, I would hope for (given the relevance to financial time-series): I have tried to put in a legend, ^ is something you should learn later and...

The standard story (also told by @vonjd) is of "The Drunk and Her Dog". This is based on "A Drunk and Her Dog: An Illustration of Cointegration and Error Correction" (1994). The story is itself based on the standard illustration for a random walk known as the "drunkard's walk". The Dickey-Fuller test is used to check for a unit root . It can be used as part of the general Engle-Granger two-step method (although it isn't the only option). In this case, while the two assets themselves are not stationary, you are able to test if the residuals between a...


What if I say "this statement is false" while under oath?

Let's say I am in a court proceeding, and then make swear to tell the truth, the whole truth, and nothing but the truth. I tell the judge I would like to make an opening remark, he says yes, and I say "My opening remark is a false statement." What happens to me? If they claim that my statement is false and try to prosecute me, then it is in fact not false, and they cannot prosecute. If they claim my statement is true, then it is in fact false, and they cannot not prosecute me. What happens?

This aspect (and many others) of contract law is applicable in the US and various countries of the EU. can they renege after the candidate has begun their journey, thus saddling the candidate with the travel cost? No. The company would incur breach of contract. There is no need for a formal contract. The candidate only needs to prove that the company agreed (in writing, orally or clearly through its conduct) to cover or reimburse those expenses and that this elicited a meeting of the minds . The agreement would be void if the candidate incurred the expenses despite knowing...

Trump was an officer of the government, and Twitter wasn't. The First Amendment forbids the government and its agents from viewpoint discrimination, but private companies are not bound by it and can discriminate as much as they please. (There was a question as to whether such discrimination might affect whether the company enjoys a shield from liability under 47 USC 230 , but even so they have the right to block and censor as they wish if they are willing to risk that liability.)

Assuming U.S. Jurisdiction: In the case of The People vs. Hansel and Gretel Holzfaller: Ms. Gretel Holzfaller is charged with the following: 1 Count of Murder in the First Degree (Murder of Ms. Witch Hazel) 1 Count of Grand Larceny (Theft of precious metals and jewels from Ms. Hazel) 1 Count Petty Theft (Theft of Candy) 1 Count of Vandalism (Bite marks left in Gingerbread Masonry) 1 Count Trespassing Mr. Hansel Holzfaller is charged with the following: 1 Count of Accessory to Murder 1 Count of Grand Larceny 1 Count Petty Theft 1 Count of Vandalism 1 Count Trespassing Ms....

See 18 U.S.C. s. 1621 (a) . Perjury only relates to material matter . In my opinion, your little logical paradox isn't material. You might be scolded by the judge to stay on point. If you keep doing it, you'll be held in contempt of court .


Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?

tls authentication web-application http http-basic-auth

The reason password expiration policies exist, is to mitigate the problems that would occur if an attacker acquired the password hashes of your system and were to break them. These policies also help minimize some of the risk associated with losing older backups to an attacker. For example, if an attacker were to break in and acquire your shadow password file, they could then start brute forcing the passwords without further accessing the system. Once they know your password, they can access the system and install whatever back doors they want unless you happen to have changed your password in...

There are a few issues with HTTP Basic Auth: The password is sent over the wire in base64 encoding (which can be easily converted to plaintext). The password is sent repeatedly, for each request. (Larger attack window) The password is cached by the webbrowser, at a minimum for the length of the window / process. (Can be silently reused by any other request to the server, e.g. CSRF). The password may be stored permanently in the browser, if the user requests. (Same as previous point, in addition might be stolen by another user on a shared machine). Of those, using...

This attack is supposed to be presented 10 days from now, but my guess is that they use compression . SSL/TLS optionally supports data compression. In the ClientHello message, the client states the list of compression algorithms that it knows of, and the server responds, in the ServerHello , with the compression algorithm that will be used. Compression algorithms are specified by one-byte identifiers, and TLS 1.2 (RFC 5246) defines only the null compression method (i.e. no compression at all). Other documents specify compression methods, in particular RFC 3749 which defines compression method 1, based on DEFLATE , the LZ77-derivative...

"If lack of encryption allows FBI to catch terrorists, then lack of encryption allows criminals to loot your emails and plunder your bank account." The rational point here is that technology is morally neutral. Encryption does not work differently depending on whether the attacker is morally right and the defender morally wrong, or vice versa. It is all fear-driven rhetoric anyway, so don't use logic; talk about what most frightens people, personally. And people fear most for their money.


Why doesn't a lightning strike destroy the lightning rod?

Lightning strikes have been known to cause massive amounts of damage . The stats on a lightning bolt are: current levels sometimes in excess of 400 kA, temperatures to 50,000 degrees F., and speeds approaching one third the speed of light These are massive numbers, but lightning protection systems are designed to draw the lightning away from the building or structure that they are protecting. Lightning protection systems can be simply thought of as lightning rods connected to the ground via cabling (downconductor). The NOAA specification for lightning protection requires that lightning rods be at least 0.5in (13mm) in diameter. The downconductor is a similar size copper cable ( 4/0 AWG or 12mm ). The allowable amperage for this type of wire is only about 250A for constant current. I realize that this is more of a heat limit rather than a instantaneous current capacity limit. From this paper on lightning protection (page 28): Positive feedback on the operation of a lightning protection system is seldom documented and most often not even noticed. Only in some rare cases can it be documented that a lightning protection system has been struck if it works properly and there is no damage. There is sometimes evidence at the strike termination point which can be noted during a careful inspection, but it is seldom cost effective for the owner of a lightning protection system to obtain the expertise necessary to conduct such a careful inspection. How can a seemingly small 0.5in (13mm) piece of metal handle a lightning strike with little or no visible damage much less without being completely destroyed?

As it happens, I just recently went through that calculation myself for a different site. Given the following facts from a quick web search, it isn't difficult to work out the numbers. The maximum efficiency of a (large) windmill is about 40%. The density of air is 1.225 kg/m 3 You need about 50 mW (10 mA at 5V) to light up an LED First, we'll need about 50 mW / 0.40 = 125 mW of air power flowing through the windmill to create the electricity we need (ignoring other factors such as the actual efficiency of a small windmill...

The loops are known as expansion loops. They need to be placed in pipelines to enable the pipelines to contend with thermal expansion and contraction and other forces that can affect the pipeline. They are typically placed in gas pipelines, irrespective of when the gas is hot or cold - natural gas or steam. The following quote is from Pipeline Design . It's near the end of the page under Pipe Expansion and Supports Steel piping systems are subject to movement because of thermal expansion/contraction and mechanical forces. Piping systems subjected to temperature changes greater than 50°F or temperature changes...

If I model this as a simply supported beam having load at mid span [...] I suspect that this is where your analysis went awry. First off, you should always model bridges with distributed loads, not a single concentrated load at midspan. The most significant load on a bridge will almost always be its own self-weight; load-trains are heavy but, well, so are bridges. Secondly, I assume you're thinking of the bridge like this: Indeed, we can see here that the bending moment is greater at midspan. However, that's not the bridge we're looking at, it's missing the cantilevers! So...

The current limit specification for a wire is limited by the heat that current will produce, and how much heat the wire can dissipate before getting too hot. "Too hot" depends on the circumstances. You will see higher current ratings for the same type of wire in chassis wiring applications than the electrical code allows for home installations, for example. This is mostly due to how hot too hot is. The ultimate limit for extreme applications is that the conductor not melt. Temperatures anywhere near that would be unsafe running along wooden supports inside a wall in a house. As...


Is it legal for a supermarket to refuse to sell an adult beer if an adult with them doesn’t have their ID?

Today I went with my dad grocery shopping at a supermarket in New York (ShopRite) and he put a six-pack of beer in the cart. They then wouldn’t let him buy the beer because they couldn’t ID me (21, but I dress for work so I look more like 25). Even when I left the store to wait in the car they made him check out at a different register. Is this legal? I wasn’t buying anything; I was just helping him load stuff onto the conveyor belt.

united-states new-york-state alcohol is-x-legal identification

Technically anyone can sit on a jury. Lawyers are not automatically excluded from juries anymore, as being called for jury duty is a right and a duty that the law abhors automatically excluding people from. That is the official line on this. However, in reality, lawyers will always be stricken from serving by one of the lawyers trying the case. Each lawyer has a certain number of preemptory strikes (the ability to get rid of a juror for any reason, aside from those protected by law, such as race, religion, etc). They also have unlimited "for cause strikes," which are...

It is legal, at least in the US, for a store (or other entity) to refuse to sell any item to any individual for any non-prohibited reason (prohibited reasons are typically things like race or religion). More over, in various US jurisdictions, it is prohibited to "furnish" alcohol to a "minor" (for example, under California's ABC law), which can be interpreted as prohibiting to an adult if they reasonably suspect that adult will pass the alcohol onto the "minor". This is to prevent "straw" sales. Additionally, larger chains generally prefer to have harmonized policies across branches, and where practical, across...

While there is an act that President Trump and his supporters are citing, titled the Presidential Records Act (PRA) , to accuse House Speaker Pelosi of breaking federal law, it is important to understand what actions the law accounts for. The act mandates that the President of the United States preserve records and other laws governing the federal government. This serves as a form of checks and balances to prevent the president and his advisers from shielding documentary information from public view. The act is fairly new, as it was passed in 1981. It is important to realize that this...

This aspect (and many others) of contract law is applicable in the US and various countries of the EU. can they renege after the candidate has begun their journey, thus saddling the candidate with the travel cost? No. The company would incur breach of contract. There is no need for a formal contract. The candidate only needs to prove that the company agreed (in writing, orally or clearly through its conduct) to cover or reimburse those expenses and that this elicited a meeting of the minds . The agreement would be void if the candidate incurred the expenses despite knowing...


How does Amazon bill me without the CVC / CVV / CVV2?

The card in question is a VISA, if that's of any importance. I've noticed this only on Amazon. All other sites I've purchased something from, ever , have needed the CVC code for the card. However, I know I never entered the CVC on Amazon when I added my card to it, and this has been bugging me ever since. How do they successfully charge the card without the CVC code?

General SSL (and its successor, TLS ) is a protocol that operates directly on top of TCP (although there are also implementations for datagram based protocols such as UDP). This way, protocols on higher layers (such as HTTP) can be left unchanged while still providing a secure connection. Underneath the SSL layer, HTTP is identical to HTTPS. When using SSL/TLS correctly, all an attacker can see on the cable is Which IP and port you are connected to Roughly how much data you are sending What encryption and compression are used In SSLv3 through TLS version 1.2 : the current...

Facebook is allowing you to make a handful of mistakes to ease the login process. A Facebook engineer explained the process at a conference . The gist of it is that Facebook will try various permutations of the input you submitted and see if they match the hash they have in their database. For example, if your password is "myRealPassword!" but you submit "MYrEALpASSWORD!" (capslock on, shift inverting capslock). The submitted password obviously doesn't match what they have stored in their database. Rather than reject you flat out, Facebook tries to up the user experience by trying to "correct" a...

There are a few issues with HTTP Basic Auth: The password is sent over the wire in base64 encoding (which can be easily converted to plaintext). The password is sent repeatedly, for each request. (Larger attack window) The password is cached by the webbrowser, at a minimum for the length of the window / process. (Can be silently reused by any other request to the server, e.g. CSRF). The password may be stored permanently in the browser, if the user requests. (Same as previous point, in addition might be stolen by another user on a shared machine). Of those, using...

That code isn't necessary. This may cause more fraud and more chargebacks, but Amazon keeps those numbers low so that they can offer a faster shopping experience such as one-click. The only thing necessary to make a purchase is the card number and, in all but rare cases, expiration date, whether in number form or magnetic. Most systems require more information (such as matching full name, bank phone number, physical billing address with zip code, et al) so that they can deal with fraud and/or chargebacks, and sometimes this is enforced by the issuing bank.


Why is the VIX futures market usually in a state of contango?

I'm a VIX newbie and I'm trying to understand why the VIX futures market is usually in a state of contango. All I can figure is that the sellers of VIX futures contracts demand high "prices" (because the seller is the holder of the short position and makes money when the price falls), and since there are willing buyers, namely ETNs and ETFs that are trying to track the S&P 500 VIX SHORT-TERM FUTURES INDEX (SPVIXSTR) through the purchase and sale of VIX futures, the contracts get sold. Also, the farther out the futures contract expires, the less certain the seller is about what the value of the VIX and the SPVIXSTR will be at the future's expiration date. The greater uncertainty over a longer term results in the seller demanding higher premiums over a longer term than he would demand over a shorter term. It seems like a prudent buyer of VIX futures wouldn't buy contracts that are priced so high. It seems like the VIX futures market should be in a state of contango about as frequently as it is in a state of backwardation. What causes contango in the VIX futures market, and why is it the usual state of the market?

Your questions about contango in VIX futures have close analogies in options too. The Black & Scholes model suggests that all time frames and all strikes should have the same implied volatility, but they don't. I think one of the reasons is that the B&S model assumes that stock returns are distributed in a normal (gaussian) distribution, but the actual returns don't match a gaussian distribution all that well. For example the actual occurrence of big crashes / gains is much more likely than a normal distribution would predict. Since crashes do occur people are willing to pay what the...

I've worked at a hedge fund that allowed GA-derived strategies. For safety, it required that all models be submitted long before production to make sure that they still worked in the backtests. So there could be a delay of up to several months before a model would be allowed to run. It's also helpful to separate the sample universe; use a random half of the possible stocks for GA analysis and the other half for confirmation backtests.

The term has a different meaning to different people. to econometricians, microstructure noise is a disturbance that makes high frequency estimates of some parameters (e.g. realized volatility) very unstable. Generally this strand of the literature professes agnosticism as to the its origin; to market microstructure researchers, microstructure noise is a deviation from fundamental value that is induced by the characteristics of the market under consideration, e.g. bid-ask bounce, the discreteness of price change, latency, and asymmetric information of traders. The last example is frequently cited but I don't think it is accurate. Asymmetric information does not have to be a...

The risk-neutral measure $\mathbb{Q}$ is a mathematical construct which stems from the law of one price , also known as the principle of no riskless arbitrage and which you may already have heard of in the following terms: "there is no free lunch in financial markets". This law is at the heart of securities' relative valuation , see this very nice paper by Emmanuel Derman ("Metaphors, Models & Theories", 2011) and some part of this discussion. In what follows, assume for the sake of simplicity existence of a risk-free asset ; deterministic and constant rates, with risk-free rate $r$ ;...


From an engineering perspective, what limits the maximum speed you can reach with a regular car? I understand that some of the faster cars are for safety reasons limited to not run faster than say 250 km/h, but that's not my question. I can think of several reasons, but not sure which of these is relevant: Is the limit set by some part (which?) breaking if I increase the rpm, as suggested by red marks on rpm meters? Or is it rather that you cannot get in fuel fast enough to keep increasing the rpm? Or is it that friction/drag increases as you speed up and the engine cannot overcome this as it can only generate a maximum amount of force/torque? If yes, what does this amount of torque/force depend on?

Water meets the low compressibility requirement, but there are many other considerations in the design of a hydraulic system: Boiling point/vapor pressure: If the system warms up during operation, the fluid may boil, which results in high compressibility and thus decreased effectiveness of the hydraulic system. Hydraulic fluid has a higher boiling point than water to help combat this. Related to this is the concept of vapor pressure. Hydraulic systems often involve small orifices, which can cause cavitation (localized boiling). This cavitation has the same effects as boiling and can cause pitting damage to the components near the cavitated region....

It depends on how steep the hill is. On a slight hill, the energy added by gravity is still not enough to overcome rolling friction and air resistance, so the car still needs power to maintain speed. On a steeper hill, the two may balance out, so no power is used, and no power is generated. On a hill that's steep enough to require braking to control the speed, the car recovers energy. It's called regenerative braking. If the car is going too fast, applying the brakes turns the motor into a generator and charges the battery.

The current limit specification for a wire is limited by the heat that current will produce, and how much heat the wire can dissipate before getting too hot. "Too hot" depends on the circumstances. You will see higher current ratings for the same type of wire in chassis wiring applications than the electrical code allows for home installations, for example. This is mostly due to how hot too hot is. The ultimate limit for extreme applications is that the conductor not melt. Temperatures anywhere near that would be unsafe running along wooden supports inside a wall in a house. As...

There are a few simple reasons why the speed of a vehicle (road conditions notwithstanding) may be limited: Gearing -- Production vehicles with conventional transmissions have a limited number of gears. For most modern cars, this is usually 5 or 6, whereas older vehicles may have as few as 2 or 3. If the gear ratio of the highest gear is too low ("lower" gears are expressed as larger numerical ratios), it's entirely possible that the engine will redline before air resistance becomes a factor at all. This ties into your first point about the red zone on the tachometer....


Is "Have I Been Pwned's" Pwned Passwords List really that useful?

My understanding of Have I Been Pwned is that it checks your password to see if someone else in the world has used it. This really doesn't seem that useful to me. It seems equivalent to asking if anyone in the world has the same front door key as me. Statistically, I would assume yes, but without knowing where I live... who cares? So have I misunderstood what HIBP does or am I underestimating its value because I'm misunderstanding some principle of security? EDIT Turns out there was more to the site than I understand. I was referring specifically to the password feature .

Let's hope and assume that Facebook stores only hashes of current password (and potentially previous passwords). Here is what they can do: user sets first password to "first" and fb stores hash("first"). later on, users resets password and is asked to provide new password "First2" Facebook can generate bunch of passwords (similar to the new one): ["First2", "fIrst2", "firSt2", ... "first2", ... "first", ... ] and and then compare hash of each with the stored hash. This is the only solution that comes to my mind. Any other?

Disclaimer: I am the author, creator, owner and maintainer of Have I Been Pwned and the linked Pwned Passwords service. Let me clarify all the points raised here: The original purpose of HIBP was to enable people to discover where their email address had been exposed in data breaches. That remains the primary use case for the service today and there's almost 5B records in there to help people do that. I added Pwned Passwords in August last year after NIST released a bunch of advice about how to strengthen authentication models. Part of that advice included the following :...

I wasn't originally aiming for a self-answer, but after more reading I've come up with what I believe to be a comprehensive answer that also explains why some might still be interested in CSRF protection on REST endpoints. No cookies = No CSRF It really is that simple. Browsers send cookies along with all requests. CSRF attacks depend upon this behavior. If you do not use cookies, and don't rely on cookies for authentication, then there is absolutely no room for CSRF attacks, and no reason to put in CSRF protection. If you have cookies, especially if you use them...

Lots of examples. A high-profile and recent example is when Kanye was caught on camera entering his "00000" password to unlock his device. Shoulder-surfing is one reason why applications do not display the password text on the screen, but show ****** instead. And this is one reason why multi-factor authentication is so important; even if you know the password, you cannot use it without another factor. I have even seen viable research into capturing the sound of the keyboard when a user types the password, even over the computer's microphone . So, yes, you describe a viable risk that the...


Can an antipyretic (I.e. Aspirin) lower normal body temperature?

Is it possible for an antipyretic medication taken when not experiencing fever to cause a person's body temperature to drop below normal? I found one article that seems to say yes, but only for large doses (in mg/kg) in mice.

Assuming the person is not taking anticoagulants, it's actually quite difficult to bleed to death from dismemberment of small members (hands, feet, penis, ears, nose, etc). Even large members such as arms and legs are often survivable because the body is very good at protecting itself from blood loss. For example, transected arteries will spasm and clamp off blood flow, and loss of blood will cause the body to divert blood flow away from the extremities and to the vital organs, thereby slowing the bleeding and allowing it to clot. In fact, the whole shock process can be viewed as...

The MSDS linked to is for a product sold as a solution of 10% SM-102 in 90% chloroform. It's listed as "SM-102" because that's the interesting/useful thing that the company is selling. It's common for chemicals to be sold packaged with solvents to make a solution. Sometimes that solvent is just water, but if the product is not water-soluble in sufficient concentrations then other solvents may be necessary. Alcohol solutions are quite common, but for more hydrophobic chemicals it may be necessary to use more "exotic" solvents. Because chloroform is quite a dangerous chemical for people to be exposed to...

In general, the benefit of flu shots is to the general population. Taking the cited value of 40%-60% from the CDC, we can say that it might be a coin toss for you personally to be protected from influenza by the shot. However, if many thousands of people take the flu shot, even if it only works on 40% of them, it helps protect the remaining population from the spread of the virus (AKA herd immunity). This is especially important to those within the population who cannot access the shot or cannot receive it due to a preexisting medical condition....

It is not possible. The regulation of human body temperature (thermoregulation) is very subtle. Wikipedia article about thermoregulation contains a very nice graph about that mechanism. The labels are not described in the text in detail and the reference in the caption does not include this picture. Picture is a work by one JW Dietrich and I also searched PubMed for this guy, but he has no works on this topic. Another more pragmatic picture is here. Fever or increased body temperature is almost solely caused by to the production prostaglandin E2 (PGE2) . PGE2 acts on the hypothalamus or...


We all know it does mean revert. The question is why. What's making volatility mean-revert? Is it some sort of cyclical behaviour of option traders? The way it's calculated? Why?

One starts with the Black-Scholes equation $$\frac{\partial C}{\partial t}+\frac{1}{2}\sigma^2S^2\frac{\partial^2 C}{\partial S^2}+ rS\frac{\partial C}{\partial S}-rC=0,\qquad\qquad\qquad\qquad\qquad(1)$$ supplemented with the terminal and boundary conditions (in the case of a European call) $$C(S,T)=\max(S-K,0),\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad(2)$$ $$C(0,t)=0,\qquad C(S,t)\sim S\ \mbox{ as } S\to\infty.\qquad\qquad\qquad\qquad\qquad\qquad$$ The option value $C(S,t)$ is defined over the domain $0 Step 1. The equation can be rewritten in the equivalent form $$\frac{\partial C}{\partial t}+\frac{1}{2}\sigma^2\left(S\frac{\partial }{\partial S}\right)^2C+\left(r-\frac{1}{2}\sigma^2\right)S\frac{\partial C}{\partial S}-rC=0.$$ The change of independent variables $$S=e^y,\qquad t=T-\tau$$ results in $$S\frac{\partial }{\partial S}\to\frac{\partial}{\partial y},\qquad \frac{\partial}{\partial t}\to - \frac{\partial}{\partial \tau},$$ so one gets the constant coefficient equation $$\frac{\partial C}{\partial \tau}-\frac{1}{2}\sigma^2\frac{\partial^2 C}{\partial y^2}-\left(r-\frac{1}{2}\sigma^2\right)\frac{\partial C}{\partial y}+rC=0.\qquad\qquad\qquad(3)$$ Step 2. If we...

Volatility is mean reverting if the underlying security doesn't drop to zero. If the security has some underlying "value" then its price is co-integrated with that "value". The volatility is the uncertainty of that price as it tracks the security's "value". Edit 12/03/2011 ================================================= @pteetor, I may have missed something, but the question was " Why is volatility mean-reverting?". I realize that the standard answer is that the VIX (I'm assuming he's asking about the VIX) is related to the historical volatility of the S&P. A simple version of that relationship provides a reasonable R^2 (see Fig. 1). It relates...

This isn't really an answer, but it's too long to add as a comment. I've always had a real problem with the correlation/covariance of price . To me, it means nothing. I realize that it gets used (abused) in many contexts, but I just don't get anything out of it (over time, price has to generally go up, go down, or go sideways, so aren't all prices "correlated"?). On the flip side, correlation/covariance of returns makes sense. You're dealing with random series, not integrated random series. For example, below is the code required to generate two price series that have...

It's an interesting question. I particularly agree with the $\mathbb{Q}-\mathbb{P}$ dichotomy mentioned by many. I would add to the other answers that, come to think of it, the Black-Scholes postulated Geometric Brownian Motion could be interpreted as an AR(1) process on the logarithm of the stock price as you discretise the SDE from which it is a solution, which is exactly what you do when running Monte-Carlo simulations (same thing for the Ornstein-Uhlenbeck process as explained here and noted by @Richard). Actually, when taking the continuous-time limit, many more econometric models can be shown to correspond to stochastic processes frequently...


Do I need to encrypt connections inside a corporate network?

Provided that I have a decent level of physical security in the office, I monitor the physical addresses of devices connected to the network and only give VPN access to trusted parties, do I need to encrypt access to intranet resources over HTTP? There is an employee complaining that he doesn't like sending his credentials in plain text over the network and that he cannot take responsibility for his network identity in such case. What are the real world chances that someone would steal his identity? I can't find any clear-cut recommendations for encryption within a corporate network.

encryption credentials identity-theft intranet

Yes encrypt, it is easy. Plus according to a 2014 Software Engineering Institute study 1 in 4 hacks was from someone inside the company with an average damage 50% higher than an external threat actor. Link to source: https://insights.sei.cmu.edu/insider-threat/2017/01/2016-us-state-of-cybercrime-highlights.html Although this is the 2017 version.

Here is a dramatization of how the communication goes, when a mail is received anywhere. Context: an e-mail server, alone in a bay, somewhere in Moscow. The server just sits there idly, with an expression of expectancy. Server: Ah, long are the days of my servitude, That shall be spent in ever solitude, 'Ere comes hailing from the outer rings The swift bearer of external tidings. A connection is opened. Server: An incoming client ! Perchance a mail To my guardianship shall be entrusted That I may convey as the fairest steed And to the recipient bring the full tale....

No, this is not a good practice. There are two distinct problems. encrypting the password instead of hashing it is a bad idea and is borderline storing plain text passwords. The whole idea of slow hash functions is to thwart the exfiltration of the user database. Typically, an attacker that already has access to the database can be expected to also have access to the encryption key if the web application has access to it. Thus, this is borderline plaintext; I almost voted to close this as a duplicate of this question , because this is almost the same and...

For the purposes of this discussion there are only a couple differences between web signing certificates: Extended vs standard validation (green bar). Number of bits in a certificate request (1024/2048/4096). Certificate chain. It is easier to set up certificates with a shorter trust chain but there are inexpensive certs out there with a direct or only one level deep chain. You can also get the larger 2048 and 4096 bit certs inexpensively. As long as you don't need the extended validation there is really no reason to go with the more expensive certificates. There is one specific benefit that going...


Risks of blood donation with autoimmune diseases

People with autoimmune diseases are generally either forbidden or discouraged from donating blood. Example: People who have autoimmune diseases (such as autoimmune thyroid disease, ankylosing spondylitis) are advised not to donate blood. This is because there is a small risk of causing immune system disturbance and symptomatic disease in patients who receive blood from donors with autoimmune diseases. source Is there any more information in the literature about the cases? I'm especially interested in the "causing symptomatic disease in patients who receive blood" part.

I think a missing bit of information that might help you get a better sense of this practice is: steroids are miracle drugs. OK, that was in jest - no miracles here. Truth be told, though, if there is a single class of drugs that has added more quality-adjusted life-years to human history than any other, steroids must be competing with just a few antibiotic classes for that title. To make clear what we’re talking about, the term “steroid” as a label for drugs generally refers to glucocorticoids (GCs) - drugs that act like cortisol, an endogenous steroid hormone. Commonly...

The short version is that in 2016 the polio vaccine changed. A more thorough explanation requires some background on the immunology of polio and its vaccines, which is not straightforward. Polio virus is usually harmless, it reproduces in the gut and spreads through a fecal-oral route. In ~99% of infections it only causes mild diarrhea. In the remaining 1% of cases, however, it gets into the bloodstream and from there enters nerves, causing paralysis and/or respiratory failure. There are two types of vaccine: inactivated polio vaccine (IPV) and oral polio vaccine (OPV). IPV is a shot of killed virus particles...

The World Health Organization published a report entitled Blood Donor Selection: Guidelines on Assessing Donor Suitability for Blood Donation . Based on a review of scientific studies and other literature, it contains detailed recommendations for establishing blood donation programs, including which donors to accept or reject. It mentions several autoimmune diseases. From the non-communicable section (page 49), we have 5.1.4 Thrombocytopenia Individuals with thrombocytopenia should not be accepted as blood donors because of the risk of bleeding at the venepuncture site and because chronic thrombocytopenia may be associated with serious underlying haematological or other systemic disease. A past history of...

Because leprosy and multiple myeloma are conditions for which other treatment options are limited. All treatments have side effects, some more debilitating than others. The trick with pharmacology is to balance the benefit of treatment with the hazards of the side effects. Take cancer chemotherapy. The drugs we use for cancer chemotherapy are horrible poisons. We literally use derivatives of chemical weapons to treat cancer. Why do we deliberately poison cancer patients with what amounts to a weapon of mass destruction? Because if we don't, the cancer will kill them. In pharmacology there's a concept of a therapeutic window ....


How are spindle speeds calculated for a drill bit? I've seen dozens of charts that highlight the rpm that should be used for specific drill bit types, bit diameter, and material. However, what if my chart doesn't have the particular type of material or bit that I am using? I'd also like to have some intuition to know if the chart looks right or wrong. Upon some quick research, it appears that the "cutting speed" is what is ultimately needed for a particular material. I assume the cutting speed for each material must be looked up? Is there a standard or "go-to" place to find these? Then, information about the drill bit can be used to determine spindle speed. Again, what if I'm using a big hole saw or circle cutter, and it's not listed? How do I model the bit to use the cutting speed to determine rpm (for a given material of course)? I'd also like to know to calculate feed speeds for a drill or mill, but there are presumably more variables. It is probably better answered in another question.

For long freight trains and those that will be climbing to stations at higher altitudes, an extra or two locomotives are attached to the front. I've always wondered why. As usual there are multiple issues. Most important is landscape. If more power than a single locomotive can provide is not needed for the whole trip, but only a short stretch, like climbing or crossing a mountain range, then it would be a huge waste of resources to attach them the whole trip. For example, take a 10 hour trip time, where all, except for a 1 hour stretch, can be...

You are correct that the cutting speed of the material is what determines the rpm for your drill-bit. This actually makes the calculation very simple. $$ \text{Spindle speed (RPM)} = \frac{\text{Cutting speed}}{\text{Circumference}} = \frac{\text{Cutting speed}}{π \cdot \text{Diameter}} $$ The thing you need to be careful of is the units of cutting speed and diameter. For example: Metric: If your cutting speed is in $m/min$ and your diameter is in $mm$ then you need to multiply your cutting speed by 1000 so that it is in $mm/min$ Imperial: If your cutting speed is in $ft/min$ and your diameter is in $inches$...

Biggest advantage is that when connecting to trailers, there are no bleeding issues. Imagine having to connect hydraulic pipes and remove the air bubbles... As for the amount of air - the compressor and receiving tanks are designed for normal use. However if you wish to accompany AC/DC with the air brakes you will run out. Disc brakes already exist in an airbrake version for trucks - came out over 10 years ago IIRC. But one big difference is that if you lose hydraulics on a car braking system then you lose stopping power (except for handbrake etc) but with...

When a reactor is shut down the core produces much less heat, but they do still produce heat through a mechanism known as decay heat . The fact that the core is producing less heat means that the coolant temperature is going to drop, but how far that temperature drops depends on the decay heat generation rate. This in turn is based on operating history, or the power at which the plant was operating before shutdown. This can be large for commercial plants, because they typically operate at or very near capacity and the power companies bring coal or natural...


How different are dc motor designs from dc generator designs?

Some dc motors can be used as generators as well by applying mechanical torque to the output shaft to induce a current. However, even if a dc motor can do this, I imagine they were not designed for this purpose and thus perform less efficiently when used as a generator rather than as a motor. In my admittedly naive understanding, dc generators and dc motors are essentially the same machinery, but with inputs and outputs reversed. This leads me to believe that some other design considerations are used to make one direction more efficient than the other. How differently are dc generators and dc motors designed to make one direction of input/output more efficient than the other? What can one do electrically or mechanically to improve the efficiency in either direction? In particular, I'm interested in converting a dc motor into a generator and want to know how I can improve its efficiency in converting mechanical energy into electrical energy.

The current limit specification for a wire is limited by the heat that current will produce, and how much heat the wire can dissipate before getting too hot. "Too hot" depends on the circumstances. You will see higher current ratings for the same type of wire in chassis wiring applications than the electrical code allows for home installations, for example. This is mostly due to how hot too hot is. The ultimate limit for extreme applications is that the conductor not melt. Temperatures anywhere near that would be unsafe running along wooden supports inside a wall in a house. As...

From the point of view of the driver of a car, impacting another car is about as bad as crashing against an ideal wall (a wall with zero deformation whatsoever). If there were a plane reflection between the two cars, then vs. Car would be exactly equal to vs. Wall (the contact points between both cars would all be on the same plane, due to reflection, so each car could be considered a wall for the other). But this plane reflection does not exist: What we have instead is a 2-fold rotational reflection . Let's say the left part of...

You want to let air into the pipe when you switch the pump off, without letting water out. Here's a few ways to do this. Make a pinhole in the highest point of the pipe. You will lose a bit of water this way, but if it is above the tank, the water will drip back in (provided it doesn't spray too far.) You could even put it just under the tank lid. Install a tee and riser at the highest point of the pipe. this will need to be high enough to avoid the pump pressure pumping water out...

In Ye olden days DC generators were brushed commutated devices. They had a one or more stator windings and an armature winding. Field wound DC generators as well as motors were commonly connected in one of three methods: Series, Shunt and Compound. Without getting into details, each had its own set of strengths and weaknesses. But you only have to remember these two things: the voltage of a DC motor is dependent on its input shaft speed. Current is a function of torque. More voltage means more RPM's and more amps means more newton-meters (or foot-pounds). So with all that,...


As of time of writing it's quite common to see headlines about so-and-so who have tested positive for Covid-19, e.g. Canadian PM Justin Trudeau's wife, Sophie, tests positive for coronavirus, officials say However, these articles don't usually say how reliable the testing is. I couldn't find any recent information on it via Google, either (there are some results, e.g. this , but they are old). How accurate are the tests? What are the odds that Sophie Trudeau's results are a false positive, or that Justin Trudeau's negative result is a false negative?

Short answer: Sophie Trudeau's positive test may still mean 3 : 1 odds of not having contracted Covid-19, but the odds could also be far more towards having Covid-19. Justin Trudeau's negative test almost certainly means he was negative when tested. Of course, should Sophie be positive, that may have changed by now. Update: I found a web page of the FDA listing tests that have this Emergency Use Approval . Each of them has manufacturer instuctions that list their test results towards the end. Some of the submitted test results use ≈100 negative samples in the clinical evaluation. But...

The only approved inhaled vaccine is the flu vaccine delivered intra-nasally. It uses a live attenuated virus. There are a whole list of people who should not receive it because it's a live virus, and it works better for children, but only is 40% effective for adults. The main issue is The intranasal LAIV, recommended for children above the age of 2 years, induces a broader immune response wherein protection is not antibody mediated and probably involves undefined multiple correlates of protection. and that's with a live virus. How well would a dead inhaled virus work? Well, we have some...

People could develop antibodies from natural exposure to the virus. The vaccine is trying to cause antibodies to exist in more people (and/or more strongly) than would express them naturally, therefore a good comparison group is a sample taken randomly in the same way as those getting the vaccine: a placebo group. At the same time, these trials tend to assess safety outcomes; again, to assess safety you want to know that effects are no worse than those in some comparison population. Comparing to placebo is typically a gold standard for this comparison. You're right that a placebo wouldn't be...

The short version is that in 2016 the polio vaccine changed. A more thorough explanation requires some background on the immunology of polio and its vaccines, which is not straightforward. Polio virus is usually harmless, it reproduces in the gut and spreads through a fecal-oral route. In ~99% of infections it only causes mild diarrhea. In the remaining 1% of cases, however, it gets into the bloodstream and from there enters nerves, causing paralysis and/or respiratory failure. There are two types of vaccine: inactivated polio vaccine (IPV) and oral polio vaccine (OPV). IPV is a shot of killed virus particles...


What is the legal status of "warrant canaries"?

A warrant canary is a repeated claim by an individual or organization that they have not been served any warrants with an attached gag order. The idea is that you can say whatever you like if you have not been served such a warrant, but if you are ever served a warrant you simply stop publishing your warrant canary. Attentive listeners or readers would infer that you have been served a warrant, contrary to the intent of the gag order. The EFF gives an overview of these warrant canaries here: https://www.eff.org/deeplinks/2014/04/warrant-canary-faq What legal theories would support or harm the case of anyone attempting this technique?

The question actually asked, "what legal theories would support or harm...", is somewhat unclear. But what the questioner seems to be asking is, basically, what would happen if you tried it? The answer, it seems to me, is pretty straightforward. In the hypothetical case, you have been publishing a notice for years, saying "I have not been served with a subpoena." You then get served with a subpoena that includes a gag order. The gag order, presumably, includes wording prohibiting you from revealing the existence of the subpoena. You then cease publication of the warrant canary. By doing so, you...

Through the legal doctrine of "transferred intent", wherein if one intends to murder A, and undertake actions to kill A, but one's actions kill B, one has murdered B. Whatever crimes one would have committed, had one performed them on one's intended target, are considered committed against the individual one actually performed them on. Many crimes require one to have mens rea to be guilty; they do not require one to have mens rea towards a given individual. So, so long as one had the proper intent to murder someone, the actual victim of their actions is irrelevant.

Technically anyone can sit on a jury. Lawyers are not automatically excluded from juries anymore, as being called for jury duty is a right and a duty that the law abhors automatically excluding people from. That is the official line on this. However, in reality, lawyers will always be stricken from serving by one of the lawyers trying the case. Each lawyer has a certain number of preemptory strikes (the ability to get rid of a juror for any reason, aside from those protected by law, such as race, religion, etc). They also have unlimited "for cause strikes," which are...

You don't know. You can't know. And you can't force the officer to tell you. Detention Status As a practical matter, you have no way of knowing if you are compelled to follow an officer's order because you are being detained unless the officer volunteers that information (your detention status) which they are not compelled to disclose and have every incentive not to disclose. Consider the situation when the officer does not have reasonable suspicion do detain you. If the officer instantly informs you that you are "free to go" then you are likely to leave and end the encounter...


If aircraft are pressurised, why do our ears pop during liftoff and landing?

Something hit me during my last flight: our ears feel that the pressure around us changes quickly during liftoff and landing, they hurt more and more until we make them pop. However, the cabin must maintain a level of oxygen higher than outside the aircraft because it isn't dense enough at ~10km to breathe normally. Does that mean that the aircraft merely takes air from the outside, heats it up (it's around -40°C outside at 10km) and adds oxygen to it before blowing it inside? How else?

The picture, below, of the exaggerated long section of the Channel Tunnel was taken from Wikipedia . Full-sized image here . Some of the limiting factors for the Channel Tunnel are: Railways don't like steep gradients The tunnels comprising the Channel Tunnel were excavated using tunnel boring machines (TBMs). Like railways, they cannot tolerate steep gradients. The tunnel was excavated in chalk marl (green coloured material in the picture). This was due to its depth (not being too shallow and not being too deep) and its ability to be easily dug but also it would cause major support issues for...

If you consider only the static forces then indeed the thickness might seem over-engineered. However, engine blocks are not statically loaded. They operate in the range of a few hundred to a few thousand rpm (Revolution Per Minute), so there are dynamic considerations here. Fatigue When materials are subjected to cyclic loading they exhibit a reduction in the allowable stresses. See below for an example: In general, BCC (body-centered cubic) materials (like steel) show a marked drop in strength (close to 50% or more depending on the steel). For these material there is stress (called the endurance limit), for which...

Because the cabin isn't pressurized to sea level pressure instead it to about 8k ft equivalent. (while the plane is 4.5 times higher) This means there is less differential pressure than if the cabin was pressurized to sea level pressure. But it's still within the limit of what passengers feel comfortable with. This answer on aviation.SE contains a plot of cabin pressure over time during a flight: Source The composition of air doesn't change with altitude just the pressure. This means that you only need to compress the air before blowing it in.

It is more efficient to transmit DC using about the same infrastructure. This is because of several effects: Skin effect experienced with AC. There is no skin effect with DC. Higher voltage allowed with DC for the same transmission lines. The lines have to withstand the peak voltage. With AC, that is 1.4 times higher than the RMS. With DC, the RMS and peak voltages are the same. However, the power transmitted is the current times the RMS, not peak, voltage. No radiation loss with DC. Long transmission lines act as antennas and do radiate some power. That can only...


What is the process of transferring an engineering license from the United States to Germany?

The United States have different rules about exactly how one obtains an engineering license, but the general process is the FE exam, a few years of work, and the PE exam. Suppose one then wishes to practice engineering in Germany. What are the legal requirements for doing so?

Unlike within the United States and the PE license , it doesn't appear that it's possible to receive an EUR ING license by direct comity . EU Engineering licensing is handled by FEANI , and on their EUR ING page they state: Application is open only to individuals if they are members of an engineering association represented in FEANI through a National Member But it may be possible to join one of the German FEANI members and see if they can support a reciprocity or comity process. 1 1 There are other member organization in other countries, but your question...

Electricity production optimization is a very complex subject. It is also affected by many parameters , which I will try to outline below. TL;DR: Demand is constantly monitored and supply is constantly adjusted TL;DR 2: Lshaver's excellent post is a suggested reading after reading this, because it expands and explains what happens at timescales ranging from the micro-second to minutes timescales. Changes in energy demand during the day First of all, the energy demand during the day, week, month of year can change quite a lot. Below is a typical day in New England. Fluctuation in power energy consumption a...

As other have pointed out, the main utility is to allow easier cleaning of the tank cars from sediment (solid precipitates). Usually, there is a drain in the lowest point. The reason that it is in the middle is that in this way, you can allow double the incline compared to if you had the drain at one of the ends for the same height. For example, if the allowed height difference is about 15 cm, and about 15 m length, then if you had the drain in: the edge, the angle would be $\arctan\left(\frac{0.15}{15}\right)=0.57^\circ$ or 1%. the middle ,...

After the 2014 ICCT report revealed that these light-duty passenger diesel vehicles were emitting too much NOx and US regulators confronted VW about the results, VW did some testing and proposed a voluntary software recall to recalibrate the various emissions control devices on the affected vehicles. From the California Air Resources Board's (CARB's) in-use compliance letter to Volkwagen AG, 2015-09-18 , following that recall: To have a more controlled evaluation of the high NOx observed over the road, CARB developed a special dynamometer cycle which consisted of driving the Phase 2 portion of the FTP repeatedly. This special cycle revealed...


I am trying to find the live hosts on my network using nmap. I am scanning the network in Ubuntu using the command sudo nmap -sP 192.168.2.1/24 . However, I am unable to find the live hosts. I just get the network address of my own PC as live. When I see the DHCP client list through my browser (my router can be accessed via browser using my network IP), I get around 10 live hosts on the network. Can anyone tell me the reason why this could be happening and how do I find the live hosts on my network?

It is the magic of public-key cryptography . Mathematics are involved. The asymmetric key exchange scheme which is easiest to understand is asymmetric encryption with RSA. Here is an oversimplified description: Let n be a big integer (say 300 digits); n is chosen such that it is a product of two prime numbers of similar sizes (let's call them p and q ). We will then compute things "modulo n ": this means that whenever we add or multiply together two integers, we divide the result by n and we keep the remainder (which is between 0 and n-1 ,...

This is the simplest way of performing host discovery with nmap. nmap -sP 192.168.2.1/24 Why does it not work all the time ? When this command runs nmap tries to ping the given IP address range to check if the hosts are alive. If ping fails it tries to send syn packets to port 80 (SYN scan). This is not hundred percent reliable because modern host based firewalls block ping and port 80. Windows firewall blocks ping by default. The hosts you have on the network are blocking ping and the port 80 is not accepting connections. Hence nmap assumes...

No, Docker containers are not more secure than a VM. Quoting Daniel Shapira : In 2017 alone, 434 linux kernel exploits were found , and as you have seen in this post, kernel exploits can be devastating for containerized environments. This is because containers share the same kernel as the host, thus trusting the built-in protection mechanisms alone isn’t sufficient. 1. Kernel exploits from a container If someone exploits a kernel bug inside a container, they exploited it on the host OS. If this exploit allows for code execution, it will be executed on the host OS, not inside the...


Pokémon Go hot spots and private property

As we all know Pokémon Go is all the rage. There have been reports that police stations are common hot spots for gyms and collections. Churches have also been a common hot spot. I think there is also a story where a man bought an old church and now that is his residence. Regardless of whether that story is true it made me think: What is the legality of someone putting a virtual hot spot on your property without permission? I know we are in uncharted territory, but how would this compare to setting up a contest that would require going on your property without permission? Is it currently legal to say, "Go to person X's house and touch a tree"? If not, does the current law extend to augmented reality? To me both are attractions which cause a gathering of people.

What is the legality of someone putting a virtual hot spot on your property without permission? I know we are in uncharted territory but how would this compare to setting up a contest that would require going on your property without permission? The existence of a game does not authorise entrance to private property, barring some agreement with the owner. That is - if it is trespassing without Pokemon Go (or, for that matter Ingress), then it is trespassing while playing them. That being said, the creators of the game are free to place their in-game targets anywhere they please,...

The Plan For A Clearly Guilty Client Without Bargaining Power This question underestimates how much of a criminal defense lawyer's work involves sentencing rather than a determination of guilt or innocence. Suppose as the OP does that the prosecution can easily prove beyond a reasonable doubt that your client is guilty, you client has no plausible defenses, and the prosecutor won't budge on a plea. As a criminal defense lawyer, you may well advise your client that there is no percentage in fighting guilt on the charges, and have your client plea guilty. This prevents the prosecutor from spelling out...

Assuming U.S. Jurisdiction: In the case of The People vs. Hansel and Gretel Holzfaller: Ms. Gretel Holzfaller is charged with the following: 1 Count of Murder in the First Degree (Murder of Ms. Witch Hazel) 1 Count of Grand Larceny (Theft of precious metals and jewels from Ms. Hazel) 1 Count Petty Theft (Theft of Candy) 1 Count of Vandalism (Bite marks left in Gingerbread Masonry) 1 Count Trespassing Mr. Hansel Holzfaller is charged with the following: 1 Count of Accessory to Murder 1 Count of Grand Larceny 1 Count Petty Theft 1 Count of Vandalism 1 Count Trespassing Ms....

Trump was an officer of the government, and Twitter wasn't. The First Amendment forbids the government and its agents from viewpoint discrimination, but private companies are not bound by it and can discriminate as much as they please. (There was a question as to whether such discrimination might affect whether the company enjoys a shield from liability under 47 USC 230 , but even so they have the right to block and censor as they wish if they are willing to risk that liability.)


As I heard, the life expectancy of photovoltaic cells is normally some decades, as so. This is very long, regarding their high cost, it has significant (negative) effect on the total costs. Why do they age? I can see the only possibility which could damage their atomic structure, and this is the very high energetic ultraviolet (or even soft röntgen) photon spectrum of the sun (which is only a small part of its power). And, I think, these photons could be maybe easily filtered out by a transparent plastic layer over the silicon. Thus, why do the solar cells age, and what happens in them on the atomic level?

The National Renewable Energy Lab (NREL) estimates something like 0.4%-1% degradation per year for solar panels. I don't know what the chemical action is here (the electrical result being an increase in series resistance of the PV cells), but the long-term degradation of the panels is correlated with UV exposure. Although damaging to the PV material, the UV rays do contain energy that we want to collect, so you won't be able to filter it out completely without defeating the purpose of the panel. Other causes for degradation are mostly weather-related, but in the form of mechanical stresses to the...

At the beginning of my career (1979) as a design engineer at HP, the mechanical engineer created the part design and then rendered it in pencil on paper, and then transferred it onto sheets of vellum paper held onto a huge flat tilting table called a drafting board which had a precision sliding arm on it with which parallel and right angle lines could be drawn anywhere on the sheet. Clever graphical rules were applied to the resulting drawings which permitted auxiliary views of the part to be generated so it could be viewed from any desired angle, as an...


Penetration testers found out that we allow single quotes in submitted data fields, and want us to apply rules (input validation) to not allow them in any value. While I'm aware that single quotes are popular for SQL injection attacks, I strongly disagree that they should not be allowed as valid input. I am advocating for actually preventing SQL injection by means of using prepared statements (which properly quote the values) instead of filtering out anything that remotely looks like being an SQL fragment. My case: Person names can contain single quotes (such as O'Reilly ) Text fields can contain single quotes (such as I'm pretty sure ) Number fields can contain single quotes ( EUR 1'000'000 ) and many more I've seen other cases where applying SQL injection prevention rules dicarded valid data for the silliest reasons (name " Andreas " rejected because it contains an AND , and various common words in plain text fields being rejected because they contained the keywords " select ", " insert ", " update " or " delete "). What's the security professionals' stance on that matter? Shall we reject implementing input validation for single quotes for the reasons I stated?

Note: This answer was written in 2013. Many things have changed in the following years, which means that this answer should primarily be seen as how best practices used to be in 2013. The Theory We need to hash passwords as a second line of defence. A server which can authenticate users necessarily contains, somewhere in its entrails, some data which can be used to validate a password. A very simple system would just store the passwords themselves, and validation would be a simple comparison. But if a hostile outsider were to gain a simple glimpse at the contents of...

Diffie-Hellman is a way of generating a shared secret between two people in such a way that the secret can't be seen by observing the communication. That's an important distinction: You're not sharing information during the key exchange, you're creating a key together. This is particularly useful because you can use this technique to create an encryption key with someone, and then start encrypting your traffic with that key. And even if the traffic is recorded and later analyzed, there's absolutely no way to figure out what the key was, even though the exchanges that created it may have been...

You should implement input validation as a defense-in-depth method. So input validation should not be your primary defense against SQL injection, that should be prepared statements. As an additional defense you should restrict the allowed inputs. This should never ever restrict functionality. If there is a legitimate use case to have apostrophes in input, you should allow it. So you should allow single quotes in name fields, descriptions, passwords, but not in number fields, username fields, license plate fields. To block single quotes in all input is madness. This breaks functionality of the application and isn't even the correct solution...

Always have your slip with you! This is the golden rule of Red Teaming! If you don't have your Permission to Attack with you, it's like driving without a driver's license. That said, if you are caught during an engagement, I recommend the following: Present a forged Permission to Attack. This way, you can see if criminals could possibly trick a security guard to letting them do their thing with a fake Permission to Attack. Present the real Permission to Attack. If a guard has not bought your fake slip, then it's time to hand in the real slip. If...


Amount of simple operations that is safely out of reach for all humanity?

Cryptographic primitives usually assert some security level given as number of operations to mount an attack. Hash functions, for example, give different security levels for collision attacks, preimage attacks and second preimage attacks. From these, "safe" key sizes are derived for different primitives. There are many different recommendations for safe key sizes and many different means of estimating future capabilities in performing computation. For example, www.keylength.com has a lot of these recommendations combined. What I'm looking for, however, is the amount of simple operations that can be obviously seen as out of reach for all humanity for the foreseeable future - or actually, the lowest such value that is still believable. It is very obvious that 2^256 simple operations is something that will never be reached. It is also very obvious that 2^64 simple operations can be reached as it already has been. Many of the recommendations seem to calculate 2^128 as a number that would be safe for 30 years or more. So the value I am looking for is likely between 2^128 and 2^256. I am guessing 2^160 or 2^192 might be safely out of reach. But I want concrete arguments that can be easily reasoned about. I'd love to see arguments that are based on simple laws of physics or relations to concrete constants about the universe. For example, Landauer's principle could be used. Note: the actual simple operations used are not relevant here - they might be operations on a quantum computer, or hash invocations, or whatever.

In some circumstances, peppers can be helpful. As a typical example, let's say you're building a web application. It consists of webapp code (running in some webapp framework, ASP.NET MVC, Pyramid on Python, doesn't matter) and a SQL Database for storage. The webapp and SQL DB run on different physical servers . The most common attack against the database is a successful SQL Injection Attack. This kind of attack does not necessarily gain access to your webapp code, because the webapp runs on a different server & user-ID. You need to store passwords securely in the database, and come up...

As a starting point, we will consider that each elementary operation implies a minimal expense of energy; Landauer's principle sets that limit at 0.0178 eV, which is 2.85×10 -21 J. On the other hand, the total mass of the Solar system, if converted in its entirety to energy, would yield about 1.8×10 47 J (actually that's what you would get from the mass of the Sun, according to this page , but the Sun takes the Lion's share of the total mass of the Solar system). This implies a hard limit of about 6.32×10 68 elementary computations, which is about...

This attack is supposed to be presented 10 days from now, but my guess is that they use compression . SSL/TLS optionally supports data compression. In the ClientHello message, the client states the list of compression algorithms that it knows of, and the server responds, in the ServerHello , with the compression algorithm that will be used. Compression algorithms are specified by one-byte identifiers, and TLS 1.2 (RFC 5246) defines only the null compression method (i.e. no compression at all). Other documents specify compression methods, in particular RFC 3749 which defines compression method 1, based on DEFLATE , the LZ77-derivative...

Your example string ( WeJcFMQ/8+8QJ/w0hHh+0g== ) is Base64 encoding for a sequence of 16 bytes, which do not look like meaningful ASCII or UTF-8. If this is a value stored for password verification (i.e. not really an "encrypted" password, rather a "hashed" password) then this is probably the result of a hash function computed over the password; the one classical hash function with a 128-bit output is MD5. But it could be about anything. The "normal" way to know that is to look at the application code. Application code is incarnated in a tangible, fat way (executable files on a...


Skew arbitrage: How can you realize the skewness of the underlying?

It's not clear to me how to realize skewness. In other words, how do you implement skew arbitrage? There seems to be no well-known recipe like in volatility arbitrage . Volatility arbitrage (or vol arb) is a type of statistical arbitrage implemented by trading a delta neutral portfolio of an option and its underlier. The objective is to take advantage of differences between the implied volatility and a forecast of future realized volatility of the option's underlier. My hypothetical skew arbitrage definition: Skew arbitrage is a type of statistical arbitrage implemented by trading a delta and volatility neutral portfolio. The objective is to take advantage of differences between the implied skew and a forecast of future realized skew of the option's underlier. Is it possible to make such a skew-arb portfolio in practice? If I have great confidence in my skew forecast but not in my volatility forecast, I am tempted to engage in this type arbitrage. But again, this is just a hypothetical version of skew arbitrage. If you know a correct and more practical version, you are welcome to correct me! The same question but in a different voice: In practice, a skew bet is implemented through vertical spread, i.e. buying and selling options of different strikes. How do options traders hedge / realize the edge of the spread they trade that is indifferent to the underlying volatility?

options volatility trading hedging option-strategies

I have worked on this topic extensively (pricing and calculating IV in production) and believe can offer an informed opinion. First of all Mathworks - the company that creates Matlab is not a trading firm so you should probably not rely on their advice so much. There are few closed form options pricing models, and all have practical shortcomings. Barone-Adesi and Whaley (please correct my spelling of last names as I'm typing from memory) model is simple approximation for American options but is unfortunately not very accurate, and does not deal with dividends. Roll-Geske-Whaley deals with dividends, but not very...

Great question! I think the most useful starting point is Stock Return Characteristics, Skew Laws, and the Differential Pricing of Individual Equity Options by Bakshi, Kapadia and Madan (2003) . Their paper proposes a definition of model-free implied skewness (they originally called it risk-neutral skewness, but MFIS is more accurate), which they prove will have a P&L directly proportional to the realized skewness of the underlier. Subsequent papers (there are literally dozens) have thoroughly explored the properties of MFIS. In particular, Does Risk-Neutral Skewness Predict the Cross-Section of Equity Option Portfolio Returns? by Bali and Murray (2011) estimates the empirical...

For an option with price $C$ , the P $\&$ L, with respect to changes of the underlying asset price $S$ and volatility $\sigma$ , is given by \begin{align*} P\&L = \delta \Delta S + \frac{1}{2}\gamma (\Delta S)^2 + \nu \Delta \sigma, \end{align*} where $\delta$ , $\gamma$ , and $\nu$ are respectively the delta, gamma, and vega hedge ratios. Then it is clear the vega P $\&$ L has exposure to the change of the implied volatility $\sigma$ . Note that, for the gamma P $\&$ L, \begin{align*} \frac{1}{2}\gamma (\Delta S)^2 = \frac{1}{2}\gamma S^2 \frac{1}{\Delta t}\left(\frac{\Delta S}{S}\right)^2\Delta t, \end{align*} where...

Being short gamma simply means that you are short options regardless of whether they are puts or calls. The most common type of investor that is willing to be short gamma is someone who sells options, also known as a premium collector. These investors commonly use strategies such as short puts, covered calls, iron condors, vertical credit spreads, and a few others. These strategies are typically referred to as income generation strategies. They offer the investor a return known in advance, in exchange for the risk of being short options. Frequently these types of income trades have have a probability...


How is a mechanical system designed and tested without building a physical model?

I am new to mechanical engineering, although I have a scientific background (postgrad in Mathematics), and I (mostly) code for a living. I have an idea about creating a mechanical device; I envisage it will entail gears, linkages and actuators. I have a rough idea where things will fit but I would like to be able to test and tweak the design in software before building the actual device. As a point of clarification, when I say "test," I mean view via animation, for example, whether two items will collide when in motion, or if there is sufficient leeway between them as they move past each other. This allows me to do the design and simulation testing of the parts, before finalising the design and then building the physical system from the design. The stages are: Build the 3D design in software Run simulation to see if it "works," if not fix design and iterate Build physical system from design that "works" I have figured out that the system consists of three subsystems working together. So, I would like to design and test each sub-component before integrating them into the complete system. My question then is this: Is this how design is done in the real world? What are the pros and cons of the scheme I have planned? I am intending to use FreeCAD to do the design and testing.

In the video you've linked to, the spheres are seen on both the leading and trailing edges of the propeller: I expect they are intentional - there are a number of ways to attach a propeller without having to disturb that surface, or using flush caps. Cavitation is caused by a drop in pressure. This would be seen on the trailing edges of the propeller, and is worse on the outer edge of the propeller which is moving faster through water than the inner area. I doubt these spheres have any effect on cavitation at all. It is either a...

Answer: Yes , this is exactly how it is done in the real world. What you have described is what I do in my job to check systems in CAD. Since you indicated you would like me to step through my design process, I have detailed it below. Note that most of this does not involve CAD. CAD is invaluable, but only if you are prepared to get out the pencil and paper first. Also note that this is just my design process, it is by no means the only way to go about things. Preparation When I begin any...

Nothing is rigid, the raceways and the ball in a ball-bearing are no exception. The contact area deflects and accommodates the ball in a small contact surface, not a point. Also, the balls take the load in groups. The digrams are from SKF ball-bearings. '

As others stated before, induction loops are the primary - most reliable method: the coils (usually just several loops of wire) embedded in the road; fed given frequency from a generator, in presence of metal the frequency of the LC circuit changes and the sensor circuitry detects the change of frequency, producing a presence signal. In some cases these may fail to detect bicycles, but they are by far most common as they aren't affected by weather (or more precisely, the detection circuit tunes in to slow changes of frequency caused by weather) and are immune to accidental false positives....