Disclaimer: I have minimal web-dev/security knowledge so please answer as if talking to a "layman." I've heard that web-advertisements need to be able to run their own JavaScript so that they can verify they're being viewed by "real users." As this incident on StackOverflow shows, they're basically given free reign. I also know that JavaScript can be used to capture keystrokes on a webpage . So in a case like goodreads , where they have ads on the page and user/pass textboxes on the header, is there something in place to prevent the ad from reading keystrokes to record my credentials? Is reading keystrokes simply not possible from an ad? If I see ads on a login page should I assume that the page is not safe to enter my credentials?

If you hash on the client side, the hashed password becomes the actual password (with the hashing algorithm being nothing more than a means to convert a user-held mnemonic to the actual password). This means that you will be storing the full "plain-text" password (the hash) in the database, and you will have lost all benefit of hashing in the first place. If you decide to go this route, you might as well forgo any hashing and simply transmit and store the user's raw password (which, incidentally, I wouldn't particularly recommend).

I wasn't originally aiming for a self-answer, but after more reading I've come up with what I believe to be a comprehensive answer that also explains why some might still be interested in CSRF protection on REST endpoints. No cookies = No CSRF It really is that simple. Browsers send cookies along with all requests. CSRF attacks depend upon this behavior. If you do not use cookies, and don't rely on cookies for authentication, then there is absolutely no room for CSRF attacks, and no reason to put in CSRF protection. If you have cookies, especially if you use them...

Nothing prevents ads from reading your passwords. Ads (or any other script like analytics or JavaScript libraries) have access to the main JavaScript scope, and are able to read a lot of sensitive stuff: financial information, passwords, CSRF tokens, etc. Well, unless they're being loaded in a sandboxed iframe. Loading an ad in a sandboxed iframe will add security restrictions to the JavaScript scope it has access to, so it won't be able to do nasty stuff. Unfortunately, most of the third-party scripts are not sandboxed. This is because some of them require access to the main scope to work...


Applications of Fourier theory in trading

What are fashionable applications of Fourier analysis in trading? I have heard vague ideas of applications in High Frequency Trading but can somebody provide an example, maybe a reference? Just for clarification: The approach to split up a stock price in its cosines and to apply this for forecasts or anything similar seems theoretically not justified as we can not assume the stock price to be periodic (outside of the period of observation). So I don't really mean such applications. Put differently: are there useful, theoretically valid applications of Fourier theory in trading? I am curious for any comments, thank you! EDIT: I am aware of (theoretically $100\%$ valid) applications in option pricing and calculation of risk measures in the context of Lévy processes (see e.g. here p.11 and following and references therein). This is well established, I guess. What I mean are applications in time series analysis. Sorry for any confusions.

There are some cases where you can blend your portfolios using weights directly. One case involves corner portfolios . In this case a linear combination of weights is also efficient. Another case is where you can treat the two separate weights you have produced each as distinct portfolio under the assumption that the correlation between these portfolios is relatively stable. In this scenario, the problem reduces to a two-asset portfolio optimization problem (each asset is simply the linear combination of weights produced via your two methods). The other class of methods involves blending via the expected returns. If you arrived...

This isn't really an answer, but it's too long to add as a comment. I've always had a real problem with the correlation/covariance of price . To me, it means nothing. I realize that it gets used (abused) in many contexts, but I just don't get anything out of it (over time, price has to generally go up, go down, or go sideways, so aren't all prices "correlated"?). On the flip side, correlation/covariance of returns makes sense. You're dealing with random series, not integrated random series. For example, below is the code required to generate two price series that have...

I can think of an application in options pricing. I came across the following paper a long time ago but think it explains FT very eloquently as applied to pricing options under BS: http://maxmatsuda.com/Papers/2004/Matsuda%20Intro%20FT%20Pricing.pdf The fun starts on page 112 but it relies on the 1998 paper by Madan and Carr. What I like about the paper is that it gives a thorough introduction to FT and only when the groundwork is set it applies it to option pricing. Not a bad approach vs many other papers which make a lot of assumption and assume the reader can jump right...

The risk-neutral measure $\mathbb{Q}$ is a mathematical construct which stems from the law of one price , also known as the principle of no riskless arbitrage and which you may already have heard of in the following terms: "there is no free lunch in financial markets". This law is at the heart of securities' relative valuation , see this very nice paper by Emmanuel Derman ("Metaphors, Models & Theories", 2011) and some part of this discussion. In what follows, assume for the sake of simplicity existence of a risk-free asset ; deterministic and constant rates, with risk-free rate $r$ ;...


How to quickly estimate a lower bound on correlation for a large number of stocks?

I would like to find stock pairs that exhibit low correlation. If the correlation between A and B is 0.9 and the correlation between A and C is 0.9 is there a minimum possible correlation for B and C? I'd like to save on search time so if I know that it is mathematically impossible for B and C to have a correlation below some arbitrary level based on A to B and A to C's correlations I obviously wouldn't have to waste time calculating the correlation of B and C. Is there such a "law"? If not, what are other methods of decreasing the search time?

The minimum variance solution loads up on securities that have low variances and co-variances. Theoretically you are correct that this should have a low expected return profile. However, it turns out - in contradiction to modern portfolio theory - that securities that have low-volatility or low-beta experience higher returns than high-volatility or high-beta stocks. This is well-documented in the literature as the low-volatility anomaly . As a result, many funds and ETFs have been launched in recent years to exploit this phenomenon. There are a couple arguments as to why the anomaly exists. The paper I cite above argues that...

Yes, there is such a rule and it is not too hard to grasp. Consider the 3-element correlation matrix $$\left(\begin{matrix} 1 & r & \rho \\ r & 1 & c \\ \rho & c & 1 \end{matrix}\right)$$ which must be positive semidefinite . In simpler terms, that means all its eigenvalues must be nonnegative. Assuming that $\rho$ and $r$ are known positive values, we find that the eigenvalues of this matrix go negative when \begin{equation} c Therefore the right hand side of this expression is the lower bound for the AC correlation $c$ that you seek, with $\rho$ being...

It is hard to find a stable non-trivial dependence structure in financial data. Usually when such is found it is hard to rationalize. One of my favorite (although I am sure there are others) is the so called "Presidential Puzzle". This is an old finding by Santa-Clara and Valkanov (2003) They find that " Excess return in the stock market is higher under Democratic than Republican presidencies: 9 percent for the value‐weighted and 16 percent for the equal‐weighted portfolio. At the time the finding was very robust and did not seem to be explained by anything else. What is more...

Wavelets are just one form of "basis decomposition". Wavelets in particular decompose in both frequency and time and thus are more useful than fourier or other purely-frequency based decompositions. There are other time-freq decompositions (for instance the HHT) which should be explored as well. Decomposition of a price series is useful in understanding the primary movement within a series. In general with a decomposition, the original signal is the sum its basis components (potentially with some scaling multiplier). The components range from the lowest frequency (a straight-line through the sample) to the highest frequency, a curve that oscillates with a...


At what point does an I-beam becomes a H-beam?

According to BS5950, a beam section can be classified as plastic, semi-compact, compact or slender. For the same section area, a H-beam can take axial compression (without buckling) better than an I-beam, and as such, uses a different strut curve in the code: Now, I understand that a H-beam has a wider flange compared to an I-beam, but at what point, precisely, does this transition from I- to H- occurs? For example, is a 400x300 (depth x width) beam considered a H- or an I-beam? Update: Extracted from BS5950 guide, the following table shows H-beams (also known as universal columns, some of which with depth greater than width. This is the reason why I don't believe the differentiation is so straight forward.

I'm going to set aside the potential legal liability aspects of your question. In part because you didn't ask about them, but also because liability will vary based upon jurisdiction. Obviously, consult an attorney familiar with the relevant law. Ethically, I think you've done everything that you're obligated to do. You have contacted the customer and notified them of an unsafe situation or configuration of the product. And you have (strongly) advised them that they need to discontinue using the older product in the unsafe configuration. If the customer remains insistent about using the product in an unsafe manner, you...

If you consider only the static forces then indeed the thickness might seem over-engineered. However, engine blocks are not statically loaded. They operate in the range of a few hundred to a few thousand rpm (Revolution Per Minute), so there are dynamic considerations here. Fatigue When materials are subjected to cyclic loading they exhibit a reduction in the allowable stresses. See below for an example: In general, BCC (body-centered cubic) materials (like steel) show a marked drop in strength (close to 50% or more depending on the steel). For these material there is stress (called the endurance limit), for which...

BS5950-1:2000 Clause 1.3.23 defines an H-section as having " an overall depth not greater than 1.2 times its overall width ", and Clause 1.3.25 defines an I section as having " an overall depth greater than 1.2 times its overall width ". Note that at exactly a ratio of 1.2, it would be an H section not an I section.

So there's an incorrect assumption underlying your question. In an ideal world the lifting capacity required of the jacks would be the self-weight of the bridge divided by the number of jacks (+ allowances for wind/snow, etc.). And the assumption there is that the lifting capacity is equivalent only to the weight of the bridge. The problem is that if anything goes wrong, you're likely to see a catastrophic failure of some sort which could lead to irreparable damage. Real world lifts don't operate in that "ideal" manner, and instead rely upon a safety factor in order to make sure...


I'm trying to link the signs and symptoms of eczema (especially atopic dermatitis) to its causes . In short, what is the mechanism of the disease? In an answer of another question about eczema , @anongoodnurse has said (bolded words added by me): Signs and symptoms: Eczema (or Atopic Dermatitis) is an incompletely understood skin disorder, in which the normal skin barrier function (permeability) is compromised, allowing the skin to dry out more than normal skin. Causes: The cause of the dryness in AD is thought by some to be (1) a deficiency of a naturally occurring fatty substance in the skin called ceramide. Others believe it's (2) an abnormal or missing protein which causes the skin barrier to be compromised, allowing allergens and irritants to cause immune responses more easily, triggering the itch/chronic inflammation (this might explain the response seen with topical steroids). If the cause is a deficiency of ceramide, what causes this cause? Ceramides are a family of waxy lipid molecules , so exactly which chemical is produced? Is it because the skin produces another kind of ceramide which has lower quality, or it does not produce enough? If the cause is an abnormal or missing protein, what causes this cause? What protein it is? Is that something related to T cells (recognising antigens) or B cells (producing antibodies)? Is it a skin problem or an immune system problem? Also, I heard from many sources that this is an immune system problem. And the source of this problem is the gut. They quote Hippocrates: "All disease begins in the gut" . Is that true? Will just eating healthy food, adding more probiotics, and applying moisturizer help the skin effectively?

dermatology immune-system digestion eczema

This has been a controversial dispute for a long time and it can involve a lot of personal opinion, but I will try to answer this as scientifically as possible. There hasn't been any viable evidence that vaccines do cause autism. Several different theories have been proposed on why vaccines could cause autism, such as the ingredient in some vaccines thimerosal being harmful, but these have all been disproved by many different experiments. Many reliable sources such as the CDC 1 says that there is no link between autism an vaccines. A 2011 report 2 from the Institute of Medicine...

This is a pretty old old-wives tale, taking many forms: don't go out into the cold while it's raining, or without a hat, with wet hair, without a warm coat or scarf, without boots, etc., "or you'll catch your death of cold." The old wive's tale was immortalized by Jane Austin in her book, Pride and Prejudice , when the heroine's sister Jane falls ill after getting a soaking in the rain. This has been studied extensively. A New York Times article describes one such uncomfortable-sounding study: In the 1950's, Chicago researchers repeated the experiment on a larger scale with...

TLDR: The pathogenesis of eczema is multifactorial, but broadly follows a process of genetic (or epigenetic, in the case of the early gut microbiome) dysregulation relating to barrier integrity proteins like filaggrin with corresponding changes in the skin microenvironment's ceramide content. Following these changes in protein structure and function and lipid quantity, the compromised barrier is predisposed to irritation and infection, which leads to an abnormal immunological response as Th2 cells work to resolve inflammatory processes in the skin (it's not clear how B cells participate in the pathogenesis of eczema at this time). Treatment options for mild-moderate eczema are...

The MSDS linked to is for a product sold as a solution of 10% SM-102 in 90% chloroform. It's listed as "SM-102" because that's the interesting/useful thing that the company is selling. It's common for chemicals to be sold packaged with solvents to make a solution. Sometimes that solvent is just water, but if the product is not water-soluble in sufficient concentrations then other solvents may be necessary. Alcohol solutions are quite common, but for more hydrophobic chemicals it may be necessary to use more "exotic" solvents. Because chloroform is quite a dangerous chemical for people to be exposed to...


What should you do if you catch encryption ransomware mid-operation?

You boot up your computer one day and while using it you notice that your drive is unusually busy. You check the System Monitor and notice that an unknown process is using the CPU and both reading and writing a lot to the drive. You immediately do a web search for the process name, and find that it's the name of a ransomware program. A news story also comes up, telling you about how a popular software distribution site was recently compromised and used to distribute this same ransomware. You recently installed a program from that site. Clearly, the ransomware is in the process of doing its dirty work. You have large amounts of important data on the internal drive, and no backup. There is also a substantial amount of non-important data on the drive. This question's title says "mid" operation, but in this example we have not yet investigated how far the ransomware might have actually gotten in its "work." We can look at two situations: You want to preserve as much of your data as possible. However, paying any ransom is out of the question. If possible without risk, you want to know whether the important parts of your data are actually encrypted and overwritten. You also want to try and extract as much of your data as possible without making things worse. You would hate to pay a ransom. But certain parts of the data are so important to you that you would, ultimately, as a last resort, like to still be able to pay for a chance to get them back rather than risk losing any of them. Step by step, what is the ideal thing to do in situation 1 and 2? And why? Note: This is hypothetical. It hasn't actually happened to me. I always keep offsite backups of my important data and I've never been affected by ransomware.

encryption malware virus ransomware data-recovery

Plenty of places: BIOS / UEFI - BlackHat presentation (PDF) System Management Mode (SMM) or the Intel Management Engine (IME) - Phrack article . GPUs - Proof of concept rootkit on GitHub . Network cards - Recon 2011 presentation (PDF) A Quest To The Core (PDF) - a good presentation covering everything from BIOS to SMM to microcode. Modern hardware has a wide range of persistent data stores, usually used for firmware. It's far too expensive to ship a complex device like a GPU or network card and put the firmware on a mask ROM where it can't be updated,...

Hibernate the computer If the ransomware is encrypting the files, the key it is using for encryption is somewhere in memory. It would be preferable to get a memory dump, but you are unlikely to have the appropriate hardware for that readily available. Dumping just the right process should also work, but finding out which one may not be trivial (eg. the malicious code may be running inside explorer.exe ), and we need to dump it now . Hibernating the computer is a cheap way to get a memory image¹ Then it could be mounted read-only on a clean computer...

Yes encrypt, it is easy. Plus according to a 2014 Software Engineering Institute study 1 in 4 hacks was from someone inside the company with an average damage 50% higher than an external threat actor. Link to source: https://insights.sei.cmu.edu/insider-threat/2017/01/2016-us-state-of-cybercrime-highlights.html Although this is the 2017 version.

Diffie-Hellman is a way of generating a shared secret between two people in such a way that the secret can't be seen by observing the communication. That's an important distinction: You're not sharing information during the key exchange, you're creating a key together. This is particularly useful because you can use this technique to create an encryption key with someone, and then start encrypting your traffic with that key. And even if the traffic is recorded and later analyzed, there's absolutely no way to figure out what the key was, even though the exchanges that created it may have been...


How does measurement uncertainty combine with tolerances?

Given a tolerance within which your workpiece should be manufactured, say some length should be $10\pm1$mm. If you determine that your uncertainty in measuring this length is $0.2$mm (at 95%). How should a measurement of $9.1$mm be treated? Clearly there is a significant probability that this value will actually be outside of tolerance. Do you need to decrease you tolerance range based on the uncertainty in your measurement?

You need to ensure that even in the worst case scenario, you still meet your measurement spec of $10 \pm 1\text{mm}$. If your tolerance is $0.2\text{mm}$ of your measurement, then a measurement of $11\text{mm}$, while may look like it meets spec, it doesn't because it could be $11.1\text{mm}$. So the worst case that still meets your spec is a measurement of $10.9\text{mm}$, because then with a max tolerance of $0.2\text{mm}$, you still meet $11\text{mm}$. With a $0.2\text{mm}$ tolerance, your $10 \pm 1\text{mm}$ spec becomes $10 \pm 0.9\text{mm}$. How should a measurement of $9.9\text{mm}$ be treated? So revised spec is between...

Answering the question: What are possible types of low cost sensors I can use? There are several types of sensors that can provide millimeter level accuracy. "Low cost" is a very relative term, so you'll need to do some shopping around based on your specific budget. Optical sensors- Included here are those of the type you listed, though it's a very cheap sensor meant more to provide a "yeah something is in front of me, about yay-far-away". There are also laser sensor systems which can provide millimeter level accuracy. Ultrasonic Sensors- Most ultrasonic sensors have relatively low accuracy; in the...

Trees increase the turbulence of the air that reaches the turbines. That creates all sorts of uneven, rapidly-shifting loads on the blades and structure. That increases the maintenance costs, decreases availability, decreases the capacity factor, and decreases the life expectancy of the turbine. So, higher costs, lower revenue. One of the ways we measure the impact is the surface roughness coefficient $z_0$. Here are the figures from the book " Wind Energy - The Facts ". As you can see, forest and woodland has a much higher $z_0$ than open farmland - and that means higher turbulence. Open land also...

It is more efficient to transmit DC using about the same infrastructure. This is because of several effects: Skin effect experienced with AC. There is no skin effect with DC. Higher voltage allowed with DC for the same transmission lines. The lines have to withstand the peak voltage. With AC, that is 1.4 times higher than the RMS. With DC, the RMS and peak voltages are the same. However, the power transmitted is the current times the RMS, not peak, voltage. No radiation loss with DC. Long transmission lines act as antennas and do radiate some power. That can only...


Thermoelectric Technology to Harvest Energy from Internal Combustions Engines

Background: In an automobile, only 1 / 3 of the potential energy in the fuel is converted into mechanical energy and significant portion of the energy is lost as heat. There have been previous attempts to recuperate this lost energy. In the early 1990's, Porsche developed automotive thermoelectric generators (ATEG) which didn't go past prototyping stage. Currently, Porsche Motorsports is testing a thermal energy harvesting system in their LeMans series Race car. In addition to Porsche's research, GM is in collaboration with Future Tech, LLC. to explore the idea of using themoelectric technology to harvest energy from internal combustion engines. Other automotive manufactures, such as BMW, are also exploring this technology. Currently the power usage in a Small car is approximately 150 W Full size truck is approximately 500 W If this technology can successfully be implemented, then components such as the radiator, water pump, and alternator could effectively have reduced workload or removed from the system, thus reducing the load to the internal combustion engine. Question: With the growing interest in green technology, are there technology barriers beside efficiency that are preventing the implementation of energy harvesting from internal combustion engines using thermoelectric technology? References: Which one must be used matched output voltage or open circuit voltage? Benefits of Thermoelectric Technology for the Automobile The Promise and Problems of Thermoelectric Generators Modeling of an Automotive ThermoElectricGenerator (ATEG) Thermoelectrics to replace car alternators and improve MPG Thermo-Electric Generator in Turbocharged Diesel Engine Kettering University researchers are working with General Dynamics to convert the unused heat energy of their propulsion systems to useful and clean energy Porsche 919 Hybrid LeMans Racer Goes After The Two Thirds of Gasoline’s Energy That’s Wasted As Heat Germans trying to replace Alternator with Thermoelectric Generators or TEGs Porsche 919 Hybrid LMP1 Le Mans prototype... Footnote The suggested duplicate is related, but still distinctly different. The order of magnitude of energy available to recover from an internal combustion engine is significantly greater than within the GPU of a video card. As such, the economies of scale are different and different solutions are therefore possible.

This is to make sure they know what the foundation is made of. For all they knew there may have been an old tunnel underneath that would have collapsed when the new building is put on top. London is built on top of an old marsh, this type of soil is very prone to sinking and uneven settling, digging down and reinforcing the foundation alleviates that. It also ensures the foundation is uniform under the building to avoid a new tower of Pisa. Given the age of the city it may have been to scour the land for potential archaeological...

As with all good things, it depends. If you can assume that your supports are totally stiff and that the loading on the shelf will be approximately uniform, then you basically have the following structure: A rectangular cross-section (such as a plank) will behave equally under positive or negative bending moment, so your objective should be to balance both. To do so, you want your main span to be $2\sqrt2 \approx 2.83$ times the cantilevers. This is found by calculating the cantilever required to offset half of the bending moment due to a uniform load along a simply supported beam:...

If you consider only the static forces then indeed the thickness might seem over-engineered. However, engine blocks are not statically loaded. They operate in the range of a few hundred to a few thousand rpm (Revolution Per Minute), so there are dynamic considerations here. Fatigue When materials are subjected to cyclic loading they exhibit a reduction in the allowable stresses. See below for an example: In general, BCC (body-centered cubic) materials (like steel) show a marked drop in strength (close to 50% or more depending on the steel). For these material there is stress (called the endurance limit), for which...

As with any new technology, the cost is the big driver here. In addition, these devices produce electricity which is a form of energy that a typical internal combustion automobile can only utilize for ancillary equipment. This would effectively improve fuel efficiency but the gain would be relatively minor. Engineers are generally reluctant to use expensive new technologies that are relatively untested when existing methods are sufficient for achieving the goal. In this case, most automobile manufacturers strive to produce a cost-competitive product. The people who are most concerned with fuel efficiency will tend to consider a hybrid (or all-electric)...


Wikipedia is not very explicit on this, The exploit employs scripts to rewrite a page of average interest with an impersonation of a well-known website, when left unattended for some time. What is 'tabnabbing', how does one do it?

Tabnabbing is a phishing technique where a malicious web site changes its looks while the tab is inactive in order to trick the user into entering credentials. This page is simultaneously a description and a demo. When you visit it, it shows a description of what tabnabbing is. When you then click another tab, it changes the tabs favicon and title to look like Gmail. Later, when the user wants to read her mail she goes to this tab thinking it is Gmail and enters her credentials. Edit: In this animation, you see that while I am reading SE, the...

/** Dave's Home-brew Hash */ // user data $user = ''; $password = ''; // timestamp, "random" # $time = date('mdYHis'); // known to attackers - totally pointless // ^ also, as jdm pointed out in the comments, this changes daily. looks broken! // different hashes for different days? huh? or is this stored as a salt? $rand = mt_rand().'\n'; // mt_rand is not secure as a random number generator // ^ it's even less secure if you only ask for a single 31-bit number. and why the \n? // crypt is good if configured/salted correctly // ... except you've...

Here is a dramatization of how the communication goes, when a mail is received anywhere. Context: an e-mail server, alone in a bay, somewhere in Moscow. The server just sits there idly, with an expression of expectancy. Server: Ah, long are the days of my servitude, That shall be spent in ever solitude, 'Ere comes hailing from the outer rings The swift bearer of external tidings. A connection is opened. Server: An incoming client ! Perchance a mail To my guardianship shall be entrusted That I may convey as the fairest steed And to the recipient bring the full tale....

Note: This answer was written in 2013. Many things have changed in the following years, which means that this answer should primarily be seen as how best practices used to be in 2013. The Theory We need to hash passwords as a second line of defence. A server which can authenticate users necessarily contains, somewhere in its entrails, some data which can be used to validate a password. A very simple system would just store the passwords themselves, and validation would be a simple comparison. But if a hostile outsider were to gain a simple glimpse at the contents of...


How is it legal for a hospital to put two patients together in the same room in the US?

In the United States we have HIPAA regulations in place to (among other things) prevent healthcare providers, insurance providers, and any other entity that handles medical information from leaking patient information. From my experience with various HIPAA certifications, it seems pretty stringent. No leak is too small. So how is it legal for a healthcare provider to pair up two or more patients in a single room, when they are under inpatient care for several days? I ask this because I recently stayed in the hospital for 2 nights. Never spoke one word to the old guy I was roommates with. When I was discharged, I knew the following details about him: his full name his DOB his medical record # (if I felt like writing it down) some of his prior health history (he fought, and won, a battle with colon cancer) the reason he was in the hospital now (hasn't pooped in over a week) current health concerns (doctors wanted to do a biopsy to make sure the colon cancer wasn't back) These were all details given verbally by one or many different doctors or nurses over the course of my 3 days, 2 nights in the hospital. Of course, I'm sure he knows a lot of my details now, too, for the same reason - we were inpatient roommates in the hospital and the doctors used no discretion when discussing my condition. So how is this legal?

As a short answer, guidance from the Department of Health and Human Services has clarified that HIPAA does not require hospitals to provide separate rooms. As a longer answer, HIPAA is very deeply misunderstood. It does not prohibit "leaking" patient information; it prohibits unreasonable and unpermitted disclosures of protected health information (PHI). Among the PHI disclosures that are permitted are uses that are for the purpose of delivering medical treatment . Of course, the covered entity (in this case, the hospital) is required to take reasonable measures to safeguard that information. One of the areas that trips people up is...

Yes. Let's assume this anecdote takes place while Gates was CEO. Bill Gates doesn't own all of Microsoft, and as an officer of the company, he owes a fiduciary duty to act in the best interests of the company and its shareholders as a whole. Taking the company's property for personal use breaches that fiduciary duty . Now, in this particular hypothetical, Gates might have a decent argument that, as a public figure who can afford any piece of technology he desires, him being seen using a Microsoft Surface actually is acting in the company's best interests. But that wouldn't...

Through the legal doctrine of "transferred intent", wherein if one intends to murder A, and undertake actions to kill A, but one's actions kill B, one has murdered B. Whatever crimes one would have committed, had one performed them on one's intended target, are considered committed against the individual one actually performed them on. Many crimes require one to have mens rea to be guilty; they do not require one to have mens rea towards a given individual. So, so long as one had the proper intent to murder someone, the actual victim of their actions is irrelevant.

Maybe, Hence the Lawsuits In the absence of clear statute law these all circle around tort law. For the scooter companies, trespass to chattels , and for the affected landowners (who hire the removalists) trespass to land and nuisance seem applicable. In essence, I can’t take your stuff (trespass to chattels) but you can’t leave your stuff on my property (trespass to land) or impeding access to it (nuisance). If you do, I am entitled to the reasonable costs of dealing with it. Note that, as owner, you remain responsible for you stuff even if you rented it to someone...


Is "My Cousin Vinny" dismissal actually possible?

In one of my favorite films of all time, 1992's My Cousin Vinny , at the end of the trial when it's abundantly clear the prosecution will lose, at least that's the conclusion the filmmakers want the audience to surmise, Trotter pronounces... "the state would like to dismiss all charges." And . . . as per Hollywood, everyone rejoices. I am fully aware movies are movies and not real life and the film is a pure work of fiction . Since I have no direct connection to anyone in the legal field, I thought I would ask some knowledgeable users about something that's always had me wondering. (Just saw the film again tonight.) I am aware that an acquittal means one can not be tried for the same crime again (double jeopardy). But a dismissal may not provide such protection. Acquittal meaning the prosecution could not prove the defendant committed the crime, whereas dismissal may allow for retrial. So, is there a legal basis for Trotter dismissing a case merely because he'll clearly lose? Common sense leans towards thinking this may be "Hollywood fluff" and it could not actually happen at the final stages of a trial so close to jury deliberation. But.. again, I don't really know. I think this is fluff because if it were actually possible, why wouldn't all prosecutors merely drop charges if they fear they are going to lose, then go build a better case and retry the defendant. Are the requirement for an actual dismissal more stringent than the film would have the audience believe or in this aspect, is the film pretty close to reality? (I am referencing U.S. criminal law in general)

united-states trial law-in-fiction dismissal

You don't know. You can't know. And you can't force the officer to tell you. Detention Status As a practical matter, you have no way of knowing if you are compelled to follow an officer's order because you are being detained unless the officer volunteers that information (your detention status) which they are not compelled to disclose and have every incentive not to disclose. Consider the situation when the officer does not have reasonable suspicion do detain you. If the officer instantly informs you that you are "free to go" then you are likely to leave and end the encounter...

Yes, it's illegal You are missing something terribly important: The package might not be your property [yet]. In any way, it is not in your possession, while it is in the hands of the postal service! The contents of the package started fully owned by the sender and were entrusted to the postal service to deliver it. This entrustment is (contractually) defined as the time it is handed to the postal service, but the postal service does not gain any ownership. They do however have insurance on the parcel (to some degree), as they are liable for the loss of...

Public nudity is illegal in New York as it is in almost every U.S. jurisdiction. And, if the police had arrested the nude protesters, the arrests probably would have been upheld in court, because a ban on nudity in public would probably be viewed as a time, place and manner restriction on the freedom of speech which is constitutionally valid. For example, the Ninth U.S. Circuit Court of Appeals recently upheld San Francisco’s public nudity ordinance in Taub v. City and County of San Francisco (2017). As the court in that case explains in a factually very similar case: Public...

This is entirely possible in a number of different motions that could have been made. At this point, Vinny had destroyed the Prosecutor's eyewitnesses by showing they had issues that called their testimony into question (The first has a timeline that doesn't line up with events, the second has poor vision and her prescription glasses were not doing their job, and the third had many obstructions blocking his view of the scene). His first witness tears apart the "expert" witness, who was only there to testify that the tires were the same brand (albeit, a popular brand at the time......


How did "tech-supportcenter" phishers trick Google?

Related: Is the Web browser status bar always trustable? How can Google search change the location in a URL tooltip? I've always thought you can "hover" over a link to see where it really goes, until today. A coworker (working from home) searched for "Target" in Google Search (using edge). He clicked the top result, which happened to be an ad, and was redirected to a phishing page posing as Microsoft trying to get him to call a "tech support" number. I got the same results on a different computer, on a different network. When I hover over the link, both links show "www.target.com" at the bottom, but clicking the ad link takes you to a malware page and the second link (first search result after the ad) takes you to the real Target.com page. If displaying the wrong URL in the tooltip requires Javascript, how did tech-supportcenter get their Javascript onto the Google search results page? UPDATE Here's the same results in a virtual machine with a fresh install of Windows, on a different network: Here's the source for the URL. It looks like it does include the "onmousedown" Javascript as the first question I linked to mentioned. Does Google allow advertisers to display any URL they want for the tooltip?

Google Authenticator supports both the HOTP and TOTP algorithms for generating one-time passwords. With HOTP, the server and client share a secret value and a counter, which are used to compute a one time password independently on both sides. Whenever a password is generated and used, the counter is incremented on both sides, allowing the server and client to remain in sync. TOTP essentially uses the same algorithm as HOTP with one major difference. The counter used in TOTP is replaced by the current time. The client and server remain in sync as long as the system times remain the...

Note: This answer was written in 2013. Many things have changed in the following years, which means that this answer should primarily be seen as how best practices used to be in 2013. The Theory We need to hash passwords as a second line of defence. A server which can authenticate users necessarily contains, somewhere in its entrails, some data which can be used to validate a password. A very simple system would just store the passwords themselves, and validation would be a simple comparison. But if a hostile outsider were to gain a simple glimpse at the contents of...

Is this normal for a pentest? Absolutely not . Best case scenario: they are performing "social engineering" penetration testing and want to see if you can be pressured into fulfilling a very dangerous action. Middle-case scenario, they don't know how to do their job. Worst-case scenario they are only pretending to be an auditing company and fulfilling their request will result in an expensive breach. In the case of a code-audit the company will obviously need access to source code. However I would expect a company who provides such services to already understand the sensitivity of such a need and...

If displaying the wrong URL in the tooltip requires Javascript, how did tech-supportcenter get their Javascript onto the Google search results page? The scammers did not manage to inject JS into the search results. That would be a cross-site scripting attack with much different security implications than misleading advertisement. Rather, the displayed target URL of a Google ad is not reliable and may conceal the actual destination as well as a chain of cross-domain redirects. The scammers possibly compromised a third-party advertiser and hijacked their redirects to lead you to the scam site. Masking link targets is a deliberate feature...


How can I prevent a cold from spreading to the people around me?

I have to attend classes at the university, band rehearsals, I live with my family, so I come close with many people during the day. I have to meet most of these people on a daily basis, even when I have the (common) cold. How can I prevent it from spreading to the people around me?

There are lots of things you can do to be a responsible and considerate individual. Props for even asking this question! Cover your cough to prevent air-borne transmission with the inner part of your arm or your shoulder- whichever come into contact with other people less. Wash your hands with water and soap regularly for at least 20 seconds. That means before every meal and bathroom trip at least! Try as hot as you can bare so that it kills the bacteria. Carry hand sanitizer or some antibiotic wipes in case you don't have access to a sink or water....

Let's get a few things out of the way... Sex is normal ( 1 ). Sexual desire and arousal are normal ( 2 ). Asexuality is normal ( 3 ). Masturbation is normal ( 4 ),( 5 ). There is no problem whatsoever with these three things, although everyone blushes when they talk about them. Is Masturbation healthy? Downsides : Masturbation is not risk free. It is about as dangerous as chewing or walking ( 6 ). Some side effects are irritated skin and ruptured penis, but only if you really, really, really overdo it (Once or twice a day...

There is evidence that neonatal circumcision saying that the benefits of circumcision outweigh the risks. According to a study done on neonatal circumcision [1] , the lifetime benefits of being circumcised outweighed the risks 100 to 1. Some of the risks people may associate with circumcision are very unlikely. Excessive bleeding only happens 0.1% of the time, infections 0.02% of the time, and loss of penis 0.0001% of the time. The percentage of death is only 0.00001%. Overall, it shows that males who have been circumcised require half as much medical attention as males who have not been circumcised. Also,...