Why are programs written in C and C++ so frequently vulnerable to overflow attacks?

When I look at the exploits from the past few years related to implementations, I see that quite a lot of them are from C or C++, and a lot of them are overflow attacks. Heartbleed was a buffer overflow in OpenSSL; Recently, a bug in glibc was found that allowed buffer overflows during DNS resolving; that's just the ones I can think off right now, but I doubt that these were the only ones that A) are for software written in C or C++ and B) are based on a buffer overflow. Especially concerning the glibc bug, I read a comment that states that if this happened in JavaScript instead of in C, there wouldn't have been an issue. Even if the code was just compiled to Javascript, it wouldn't have been an issue. Why are C and C++ so vulnerable to overflow attacks?

Bcrypt has the best kind of repute that can be achieved for a cryptographic algorithm: it has been around for quite some time, used quite widely, "attracted attention", and yet remains unbroken to date. Why bcrypt is somewhat better than PBKDF2 If you look at the situation in details, you can actually see some points where bcrypt is better than, say, PBKDF2 . Bcrypt is a password hashing function which aims at being slow. To be precise, we want the password hashing function to be as slow as possible for the attacker while not being intolerably slow for the honest...

No, Docker containers are not more secure than a VM. Quoting Daniel Shapira : In 2017 alone, 434 linux kernel exploits were found , and as you have seen in this post, kernel exploits can be devastating for containerized environments. This is because containers share the same kernel as the host, thus trusting the built-in protection mechanisms alone isn’t sufficient. 1. Kernel exploits from a container If someone exploits a kernel bug inside a container, they exploited it on the host OS. If this exploit allows for code execution, it will be executed on the host OS, not inside the...

/** Dave's Home-brew Hash */ // user data $user = ''; $password = ''; // timestamp, "random" # $time = date('mdYHis'); // known to attackers - totally pointless // ^ also, as jdm pointed out in the comments, this changes daily. looks broken! // different hashes for different days? huh? or is this stored as a salt? $rand = mt_rand().'\n'; // mt_rand is not secure as a random number generator // ^ it's even less secure if you only ask for a single 31-bit number. and why the \n? // crypt is good if configured/salted correctly // ... except you've...

C and C++, contrary to most other languages, traditionally do not check for overflows. If the source code says to put 120 bytes in an 85-byte buffer, the CPU will happily do so. This is related to the fact that while C and C++ have a notion of array , this notion is compile-time only. At execution time, there are only pointers, so there is no runtime method to check for an array access with regards to the conceptual length of that array. By contrast, most other languages have a notion of array that survives at runtime, so that all...


Google Authenticator is an alternative to SMS for 2Step verification, installing an app on Android where the codes will be sent. It works without any connectivity; it even works on plane mode. This is what I don't get. How is it possible that it works without connectivity? How do the mobile phone and the server sync to know which code is valid at that very moment?

authentication passwords cryptography google one-time-password

This is actually an interesting new field in infosec— reputation management . Employers, Law Enforcement and other government agencies, legal professionals, the press, criminals and others with an interest in your reputation will be observing all online activity associated with your real name. These "interested parties" (snoops) are usually terrible at separating professional and personal life, so you could be made to suffer for unpopular opinions, political or religious convictions, associates or group affiliations they consider "unsavory", and any behavior that can be interpreted in the most uncharitable light. (Teachers have been forced to resign for drinking wine responsibly while...

It typically works like this: Say your password is "baseball". I could simply store it raw, but anyone who gets my database gets the password. So instead I do an SHA1 hash on it, and get this: $ echo -n baseball | sha1sum a2c901c8c6dea98958c219f6f2d038c44dc5d362 Theoretically it's impossible to reverse a SHA1 hash. But go do a google search on that exact string , and you will have no trouble recovering the original password. Plus, if two users in the database have the same password, then they'll have the same SHA1 hash. And if one of them has a password hint...

Google Authenticator supports both the HOTP and TOTP algorithms for generating one-time passwords. With HOTP, the server and client share a secret value and a counter, which are used to compute a one time password independently on both sides. Whenever a password is generated and used, the counter is incremented on both sides, allowing the server and client to remain in sync. TOTP essentially uses the same algorithm as HOTP with one major difference. The counter used in TOTP is replaced by the current time. The client and server remain in sync as long as the system times remain the...

The primary issue is that incorrect passwords have to be stored in a way that allows them to be later displayed to users. Which, as your dev pointed out, means they can't be cryptographically hashed first. The result is that you store them either as plaintext (bad) or encrypted (better but not normally recommended). The biggest risk is if this database of invalid passwords becomes accessible to attackers. Either they compromise the server, perform SQL injection, or retrieve it in some other way. Rather than cracking the primary passwords, which hopefully are strongly hashed and therefore tougher targets, they could...


Is it legal for Blizzard to completely shut down Overwatch 1 in order to replace it with Overwatch 2?

Overwatch (1) was a multiplayer first-person shooter video game created by Blizzard. It was released in 2016 and cost around 40€ . Earlier this year, Overwatch 1 was shut down : The servers are down. The game is not playable from the official Blizzard game launcher. It has been replaced by Overwatch 2 , which is considered its "sequel" by Blizzard and is free to play, but with very high-priced in-game cosmetics. I do not understand how this is considered a legal action for the following reasons: I paid 30/40 bucks for the right to own Overwatch 1 (did I?) and to play it. Overwatch 1, for which I paid, is now completely unusable for me, so the service (if not the product) I have paid for is now not available It is replaced by a free to play game (what happened to my 40 bucks) While playing OW1, I earned ingame credits which allowed me to purchase cosmetics (so, basically, I got those cosmetics in exchange for my time, not for my money). Those cosmetics have been "transferred" to OW2 and they now cost an insane amount of money (something like at least 10 dollars each, and there are a lot of them (purchasable and than I unlocked in OW1)). However, as I just said, I did not purchase the cosmetics, I (think I) purchased the product and the service provided to use it. Questions Did I pay for the right to own and play Overwatch 1, or just for the right to play it? Why is it legal (I assume, as they did it and I did not hear about some legal action taken to them for that) for Blizzard to shutdown completely (more like "take away from customers"?) a product and a service for which customers have paid? PS: I used the france and united-states tags as I am French and live in France and Blizzard Entertainment is a USA company.

united-states france service video-games

Through the legal doctrine of "transferred intent", wherein if one intends to murder A, and undertake actions to kill A, but one's actions kill B, one has murdered B. Whatever crimes one would have committed, had one performed them on one's intended target, are considered committed against the individual one actually performed them on. Many crimes require one to have mens rea to be guilty; they do not require one to have mens rea towards a given individual. So, so long as one had the proper intent to murder someone, the actual victim of their actions is irrelevant.

Your question is the subject of longstanding and ongoing debate that has generated countless articles and books and dissertations, so you're probably not going to get a fully satisfactory answer here. But here's the short version: Different systems operate on different assumptions. Your question suggests you are not a retributivist, i.e., someone who views sentencing as a means for taking retribution for the criminal's offenses. Some systems (most, I imagine) are built around that idea, but some view criminal sentencing primarily as a means of preventing recidivism, or as a means for achieving rehabilitation, the interests you indicated you see...

The answer from @user6726 is a good one. But, I'd like to add to it by pointing out that the body of law applicable to an individual is usually much, much smaller than the entire body of law. I'm a lawyer who has been in private practice for almost 25 years with an extremely diverse practice compared to the average lawyer, and I've never even looked at perhaps 80% of the laws on the books in the states where I practice, and even less elsewhere. By statutory and regulatory volume, the vast majority of statutory and regulatory law is applicable...

I believe you have just misunderstood what you paid for. Blizzard's End User License Agreement says: Your use of the Platform is licensed, not sold, to you, and you hereby acknowledge that no title or ownership with respect to the Platform or the Games is being transferred or assigned and this Agreement should not be construed as a sale of any rights. It also says: Blizzard may change, modify, suspend, or discontinue any aspect of the Platform or Accounts at any time, including removing items, or revising the effectiveness of items in an effort to balance a Game. Blizzard may...


Why is the rate of circulating vaccine-derived poliovirus disease booming?

The wikipedia entry on polio vaccines has the 1st graph below, showing that the rate of vaccine derived polio has increased massively over the last few years, with the rate of 1089 cases in 2020 compared to 56 - 71 per year from 2010 to 2014. The WEF page on the vaccine has the second graph below, show a fairly modest increase in the rate of immunisation coverage over this time. What is the reason for a roughly 20 fold increase in vaccine derived polio in such a short period of time, when vaccination rate has increased by only a fraction? (source: who.int )

The short version is that in 2016 the polio vaccine changed. A more thorough explanation requires some background on the immunology of polio and its vaccines, which is not straightforward. Polio virus is usually harmless, it reproduces in the gut and spreads through a fecal-oral route. In ~99% of infections it only causes mild diarrhea. In the remaining 1% of cases, however, it gets into the bloodstream and from there enters nerves, causing paralysis and/or respiratory failure. There are two types of vaccine: inactivated polio vaccine (IPV) and oral polio vaccine (OPV). IPV is a shot of killed virus particles...

This event occurred in the US. In the US, enzootic (dog-to-dog) canine rabies virus has been virtually eliminated through vaccination and stray control programs, making wild animals the primary concern. It is quite true, as @EMT_Jedi stated, that rabies is usually caused by an animal's saliva, usually introduced by a bite (e.g. rabid cats, raccoons, etc.) However, this is not true of bat-related rabies. There is reason to be vaccinated after any strange contact with a bat. The most dangerous and common route of rabies exposure is from the bite of a rabid mammal. An exposure to rabies also might...

Drug molecules, even when stored safely inside a tablet\capsule, inside a closed container, upon a high shelf (hopefully), are still exposed to the environment, and are thus exposed to all of the chemical processes and reactions that go about all around us (to name just a few - oxidation, hydrolysis, isomerization, polymerization, and more). Depending on the type of drug molecule and its functional groups, the molecule may undergo all kinds of chemical processes that may change its structure and\or properties. Therefore, drugs (and foodstuffs, as mentioned in the comment above) degrade and decompose over time, and are thus given...

The IARC has concluded that cell phones are a "possible carcinogen" due to the amount of evidence going both directions. The gist of it is summarised on the website itself: Cell phones emit radiofrequency energy, a form of non-ionizing electromagnetic radiation, which can be absorbed by tissues closest to where the phone is held. The amount of radiofrequency energy a cell phone user is exposed to depends on the technology of the phone, the distance between the phone’s antenna and the user, the extent and type of use, and the user’s distance from cell phone towers. Studies thus far have...


Why are lasers used for concentrated light applications instead of incoherent light sources?

Some laser applications consist simply of concentrating light into a small spot. Two example applications are laser welding and cutting. In these cases a CO 2 laser is often used which needs a regulated power supply, a water cooling system, and a supply of CO 2 gas. Why do these applications use a laser instead of a simpler (i.e. incoherent) light source such as an AC powered arc lamp?

The problem is that the formula $P=I\ V$ is correct when dealing with DC circuits or with AC circuits where there is no lag between the current and the voltage. When dealing with realistic AC circuits, the power is given by $$ P=I\ V\ \cos(\phi), $$ where $\phi$ is the phase difference between the current and the voltage. The unit kVA is a unit of what is called 'apparent power' whereas W is a unit of 'real power'. Apparent power is the maximum possible power attainable when the current and voltage are in phase and real power is the actual...

Please note : I'm not a building designer by trade, but I have had to investigate related questions for other reasons. I'll let you in on a dirty secret about sanitation lines within buildings - The biggest concern is not about how fast things are flying, it's about maintaining air pressure and providing adequate ventilation. This guide presents a bit of a historical background to tall building design with respect to sanitation system design. This presentation provides some more recent perspective and goes into some of the research that is refining current building standards. The traditional viewpoint is that waste...

There are many reasons why highly monochromatic light, such as that emitted by a laser, is useful for delivering a large amount of power to a small spot. First of all, incoherent light sources such as a lamp are extended sources which means that they are emitting light from a piece of material which takes up a finite amount of space. When focusing this light to a point, the focal spot is limited by the size of your source multiplied by the magnification of your imaging system. This may sound like a small effect, but if you want to focus...

At the beginning of my career (1979) as a design engineer at HP, the mechanical engineer created the part design and then rendered it in pencil on paper, and then transferred it onto sheets of vellum paper held onto a huge flat tilting table called a drafting board which had a precision sliding arm on it with which parallel and right angle lines could be drawn anywhere on the sheet. Clever graphical rules were applied to the resulting drawings which permitted auxiliary views of the part to be generated so it could be viewed from any desired angle, as an...


Can a law protect itself? For example, could it be written in to a law that, under no circumstances, it should be amended or abolished (a) for a fixed duration or (b) indefinitely? I am most interested in the United Kingdom but would also be interested to know what the general answer is, if there is one.

This aspect (and many others) of contract law is applicable in the US and various countries of the EU. can they renege after the candidate has begun their journey, thus saddling the candidate with the travel cost? No. The company would incur breach of contract. There is no need for a formal contract. The candidate only needs to prove that the company agreed (in writing, orally or clearly through its conduct) to cover or reimburse those expenses and that this elicited a meeting of the minds . The agreement would be void if the candidate incurred the expenses despite knowing...

In the UK Armed Forces, conscientious objection is grounds for a refusal at the admission stage and has been since the end of conscription in 1963. Where a person develops an objection to military service during their term of service, they have the option to appeal for a discharge. Interestingly there's no primary legislation to manage this process but there are established military procedures to take care of this when it happens. Mostly the process seems to be managed informally , with the objector simply being shuffled into a non-combatant role within their regiment and just left there for the...

No Parliament is sovereign : Parliamentary sovereignty is a principle of the UK constitution. It makes Parliament the supreme legal authority in the UK, which can create or end any law. Generally, the courts cannot overrule its legislation and no Parliament can pass laws that future Parliaments cannot change . Parliamentary sovereignty is the most important part of the UK constitution.

australia Deliberately rendering the TV non-operational through software would appear to be malicious damage. Under the Australian Consumer Law, one of the statutory guarantees is that a product must be “durable”. Manufacturer’s can offer explicit warranties in addition but these in no way impact on the statutory guarantees. What durable means depends on the product and the price paid for it. For a low end TV, 3 years might be durable enough although it’s arguable, but for a high end TV it wouldn’t be. For whitegoods, 10 years would be appropriate. A similar period would be appropriate for a car....


Is the typo in the 25th amendment significant?

The fourth section of the 25th amendment to the US constitution provides for the president to be declared unfit involuntarily. The first of its two paragraphs describes the declaration itself, made by the vice president along with "a majority of either the principal officers of the executive departments or of such other body as Congress may by law provide." The second paragraph describes a mechanism for the president to resume the "powers and duties" of the office by declaring "that no inability exists." This paragraph also establishes a mechanism for "the Vice President and a majority of either the principal officers of the executive department or of such other body as Congress may by law provide" to challenge the president's declaration. This question is about the difference in the designation of those whose action is required along with the vice president. The first paragraph uses the word "departments," plural, and the second uses "department," singular. I suppose that the second paragraph was added during the debates on the amendment, and that the use of the singular in the second paragraph is probably an error. Would courts be likely conclude that the difference is unintentional? If not, does the use of the singular change the meaning of the phrase significantly? I am especially interested in answers that look at the the legislative history of the amendment to support or refute the hypothesis that the second paragraph was an addition to the original form of the text. As far as I can tell, the relevant congressional documents are not available online for the 1960s.

Most leases have a provision allowing a landlord to make entry without notice in an emergency, but the better course of action, as noted in a comment by @BlueDogRanch, is to call the police and ask them to make a "welfare check." You would ordinarily be permitted to cooperate with police by unlocking doors in furtherance of their welfare check. The police are trained to do this properly in a way that properly balances the need to aid someone who is sick or ill, the need to preserve evidence if there was a death or crime that needs to be...

In order to accommodate various objections that have arisen in recent generations, in general: You are allowed to "affirm" instead of "swear" You do not have to say "so help me God" You do not have to place your hand on a Bible or any object These variances are often allowed by statute. A witnessed "solemn affirmation" has the same legal consequences as the traditional swearing on a Bible: I.e., you would be held to the same statutes and rules that apply to sworn statements.

Prologue , a magazine published by the National Archives, had an article about the missing S back in 2012. In short, the problem was due to a scrivener's error. Congress recognized the error at roughly the same time it submitted the amendment to the states but decided it was too late to fix it: There was a brief discussion of the possibility of recalling the joint resolution for reconsideration in each chamber, but Congress was operating under severe time pressures as it worked toward adjournment for the summer, and it was decided that the record of congressional debates and actions...

Assuming U.S. Jurisdiction: In the case of The People vs. Hansel and Gretel Holzfaller: Ms. Gretel Holzfaller is charged with the following: 1 Count of Murder in the First Degree (Murder of Ms. Witch Hazel) 1 Count of Grand Larceny (Theft of precious metals and jewels from Ms. Hazel) 1 Count Petty Theft (Theft of Candy) 1 Count of Vandalism (Bite marks left in Gingerbread Masonry) 1 Count Trespassing Mr. Hansel Holzfaller is charged with the following: 1 Count of Accessory to Murder 1 Count of Grand Larceny 1 Count Petty Theft 1 Count of Vandalism 1 Count Trespassing Ms....


How to explain Heartbleed without technical terms?

Most of my friends who are not experienced in computers want to know what Heartbleed is and how it works. How would one explain Heartbleed to someone without a technical background?

As of OpenSSL 1.1.1, providing subjectAltName directly on command line becomes much easier, with the introduction of the -addext flag to openssl req (via this commit ). The commit adds an example to the openssl req man page : Example of giving the most common attributes (subject and extensions) on the command line: openssl req -new -subj "/C=GB/CN=foo" \ -addext "subjectAltName = DNS:foo.co.uk" \ -addext "certificatePolicies = 1.2.3.4" \ -newkey rsa:2048 -keyout key.pem -out req.pem The commit message itself is also helpful to understand what's happening: Add 'openssl req' option to specify extension values on command line The idea is...

The analogy of the bank and bank employee You call the bank to request a new bank account, to make an appointment - whatever. Somehow you and the bank make sure that you are who you are, and the bank is actually the bank. This is the TLS process that secures the connection between you and the bank, and we assume this is handled properly. The roles in this play The bank: a webserver The bank employee: the OpenSSL service for that server You (the bank robber): a bot fetching all it can get from that server Staying connected -...

Here is a dramatization of how the communication goes, when a mail is received anywhere. Context: an e-mail server, alone in a bay, somewhere in Moscow. The server just sits there idly, with an expression of expectancy. Server: Ah, long are the days of my servitude, That shall be spent in ever solitude, 'Ere comes hailing from the outer rings The swift bearer of external tidings. A connection is opened. Server: An incoming client ! Perchance a mail To my guardianship shall be entrusted That I may convey as the fairest steed And to the recipient bring the full tale....


I am reading paper High-frequency trading in a limit order book by Marco Avellaneda and Sasha Stoikov. At the end of the paper they obtain a closed-form solution to the optimal market-maker quotes under diffusion without drift. They found that the optimal behaviour of the market-maker would be to set a bid/ask spread of size: $$ spread = \gamma\sigma^2(T-t) + \frac{2}{\gamma}ln(1+\frac{\gamma}{k}), $$ where $\gamma$ is a discount factor, $\sigma^2$ is the variance of the process, $k$ is the parameter corresponing to the intensity of arrival of market orders, $T$ is terminal time and $t$ is curent time, around a reservation price given by: $$ price = s - q\gamma\sigma^2(T-t), $$ where $q$ is the state of the inventory and $s$ is the current price. However, I do not see any specification of bounds for this reservation price and therefore I think there is no guarantee that ask prices computed by the market-maker will be higher or bid prices will be lower than the current price of the process. | How is this necessity of market makers' ask prices being higher and bid prices being lower than the actual price enforced in their model (e.g. in their simulations)? Edit : To be more concrete, I just specify, that in my opinion, it needs to hold that: $$ price + spread/2 - s > 0 $$ Lets denote $price$ by $p_{mm}$ and $spread/2$ by $s_{mm}$ . Then $$ p_{mm} + s_{mm} - s > 0, \\ s - q\gamma\sigma^2(T-t) + \frac{\gamma\sigma^2(T-t)}{2} + \frac{1}{\gamma}ln(1+\frac{\gamma}{k}) - s >0 \\ (...) \\ \frac{1}{2} + \frac{ln(1+\frac{\gamma}{k})}{\gamma^2\sigma^2(T-t)} > q $$ However, this situation does not need to happen, so there is no guarantee he will set prices compatible with current market prices.

The market-maker makes a bid-ask spread $\delta$ around the reservation price $r$. So at any time, the market-maker quotes the bid price $$ p_b = r - \delta/2, $$ and the ask price $$ p_a = r + \delta/2. $$ Bid price is hence always below the reservation price and ask price is always above the reservation price. The reservation price $$ r = s - q\gamma\sigma^2(T-t) $$ is the market price minus a term that depends on the inventory $q$ that the market-maker is holding. If $q$ is positive the reservation price moves lower (below the market price) and...

The lead paper in the January 2011 Journal of Finance ( Hendershott, Jones, and Menkveld ) addresses algorithmic trading (AT). In short, they find that AT improves liquidity as measured by bid-offer spreads. Taking the econometrics as correct (it is in the Journal of Finance) the next question is if bid-offer spreads are a sufficient statistic for measuring liquidity (or any other benefits). It is a difficult question to answer because, given current market structure, AT may improve liquidity (as measured by bid-offer spreads), but without data on other market structures, it is hard to say that we wouldn't better...

The volatiltiy surface is just a representation of European option prices as a function of strike and maturity in a different "unit" - namely implied volatility (while the term implied volatility has to be made precise by the model used to convert prices (quotes) into implied volatilities - for example: we may consider log-normal vols and normal vols). Volatility is often preferred over prices, e.g., when considering interpolations of European option prices (although this may introduce difficulties like arbitrage violations, see, e.g., http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1964634 ). A local volatility model can generate a perfect fit to the implied volatility surface via Dupire's...

There seems to be a basic fallacy that someone can come along and learn some machine learning or AI algorithms, set them up as a black box, hit go, and sit back while they retire. My advice to you: Learn statistics and machine learning first, then worry about how to apply them to a given problem. There is no free lunch here. Data analysis is hard work . Read "The Elements of Statistical Learning" (the pdf is available for free on the website), and don't start trying to build a model until you understand at least the first 8 chapters....


Why do many "No Trespassing" signs say "POSTED"?

Many "no trespassing" signs say "POSTED" in large letters at the top. Why? Obviously, the sign is posted; that's the whole purpose of a sign. To me, it makes as much sense as putting "ASKED" at the start of a Stack Exchange question or "TEXTED" at the start of a text. Does it serve any legal purpose? Or is it just designed to scare potential trespassers with legal-looking text?

united-states legal-terms common-law legal-history trespass

Yes, their waiver has no legal basis and is invalid under the GDPR. They should have hired a better lawyer. GDPR rights cannot be waived ( mrllp.com ). The last bit should have been: Therefore, in consideration of my participation in any project, I understand that retaining my name and email address, as described above, does not require my consent and that the right of erasure, as spelled out in the GDRP Article 17 (1) b does not apply. The legal basis for our lawful processing of this personal data is Article 6 (1) f ("processing is necessary for the...

"Posted" is a Term of Art " Posted " is a term of art in trespass law, specifically meaning that signs forbidding entry have been placed at the borders of a parcel. The page "Properly posted definition" from Law Insider reads: Properly posted means that signs prohibiting trespass—or bright yellow, bright orange or fluorescent paint—are clearly displayed at all corners, on fishing streams crossing property lines, and on roads, gates and rights-of-way entering the land. Or, they are displayed in a manner that is visible to a person in the area. The entry "Posting" in the "Legal" section of The...

Yes, that’s allowed. Under the Stack Exchange terms of service , content you upload is licensed to Stack Exchange Inc. on a non-exclusive basis under CC-BY-SA 4.0. The terms of service do not give Stack Exchange the copyright to your contributions, and a non-exclusive license means you are not promising Stack Exchange that “only Stack Exchange will be allowed to use this content.” That means you can continue to do whatever you want with your own content and do not need to mention Stack Exchange at all. The only restriction is that you can’t stop Stack Exchange from continuing to...

The Plan For A Clearly Guilty Client Without Bargaining Power This question underestimates how much of a criminal defense lawyer's work involves sentencing rather than a determination of guilt or innocence. Suppose as the OP does that the prosecution can easily prove beyond a reasonable doubt that your client is guilty, you client has no plausible defenses, and the prosecutor won't budge on a plea. As a criminal defense lawyer, you may well advise your client that there is no percentage in fighting guilt on the charges, and have your client plea guilty. This prevents the prosecutor from spelling out...


My young son keeps getting ear infections. The otolaryngologist want to perform surgery to put tubes in his ear drums. How does putting a tube in the ear drum help with the ear infections?

Race and ethnicity are risk factors in many diseases. Examples include, but are not limited to, cystic fibrosis and spinal muscular atrophy. There is also an epidemiological purpose of collecting this information. It is important to know if some disease is affecting some races or some ethnicities disproportionately. This is how it was found out that race or ethnicity is a risk factor in certain diseases in the first place. RFERENCES: Sheets L, Johnson J, Todd T, Perkins T, Gu C, Rau M. Unsupported labeling of race as a risk factor for certain diseases in a widely used medical textbook....

Ear tubes do many things to help ear infections. The most important things they do are draining the ear of fluid and ventilating the ear. Overall, this will help your child hear better. The tubes also stop fluid from building up behind the ear drum, which should help prevent the ear infections. Stuff to watch out for There is always the possibility of ear infections coming back after the 6-12 months that the tubes will be in. There is also a minor chance of hearing loss because of scarring of the ear drum. The tube can become blocked, stopping it...

I'm guessing the "iron" test was actually a hemoglobin test (though I'm certainly no expert in blood donation screens...). I suspect your nurse is reporting a folk tale rather than any true difference. Unfortunately, medical professionals are not always an excellent source of scientific knowledge. I looked for papers that have actually compared measurements in the two hands. Here's one: Patel, A. J., Wesley, R., Leitman, S. F., & Bryant, B. J. (2013). Capillary versus venous haemoglobin determination in the assessment of healthy blood donors. Vox sanguinis, 104(4), 317–323. https://doi.org/10.1111/vox.12006 Capillary fingerstick samples were assayed by HemoCue in 150 donors....

I think a missing bit of information that might help you get a better sense of this practice is: steroids are miracle drugs. OK, that was in jest - no miracles here. Truth be told, though, if there is a single class of drugs that has added more quality-adjusted life-years to human history than any other, steroids must be competing with just a few antibiotic classes for that title. To make clear what we’re talking about, the term “steroid” as a label for drugs generally refers to glucocorticoids (GCs) - drugs that act like cortisol, an endogenous steroid hormone. Commonly...


I'm trying to understand why it's useful to shrink the covariance matrix for portfolio construction or in fact general. Think I missing something. I know if you have 5,000 stocks it's a lot of calculations but if we assume that computing power is not a problem.

statistics portfolio-management covariance portfolio-optimization

Have a look at this classic paper: Honey, I Shrunk the Sample Covariance Matrix by O. Ledoit and M. Wolf The abstract answers your question already: The central message of this article is that no one should use the sample covariance matrix for portfolio optimization. It is subject to estimation error of the kind most likely to perturb a mean-variance optimizer. Instead, a matrix can be obtained from the sample covariance matrix through a transformation called shrinkage. This tends to pull the most extreme coefficients toward more central values, systematically reducing estimation error when it matters most. Statistically, the challenge...

The term has a different meaning to different people. to econometricians, microstructure noise is a disturbance that makes high frequency estimates of some parameters (e.g. realized volatility) very unstable. Generally this strand of the literature professes agnosticism as to the its origin; to market microstructure researchers, microstructure noise is a deviation from fundamental value that is induced by the characteristics of the market under consideration, e.g. bid-ask bounce, the discreteness of price change, latency, and asymmetric information of traders. The last example is frequently cited but I don't think it is accurate. Asymmetric information does not have to be a...

In my experience, a VaR or CVaR portfolio optimization problem is usually best specified as minimizing the VaR or CVaR and then using a constraint for the expected return. As noted by Alexey, it is much better to use CVaR than VaR. The main benefit of a CVaR optimization is that it can be implemented as a linear programming problem. Another option I have tried is the technique in this paper: http://www.math.uwaterloo.ca/~tfcolema/articles/bank_article.pdf Another option is the two-step heuristic where one first finds the mean-variance efficient frontier and then you could calculate whatever are the relevant portfolio statistics on only the...

Just to be painfully clear, it only seems to make sense to consider the logarithm of returns, i.e. $X=\log (1+\frac r{100})$ for a simple return of $r\%$ in an arbitrary period because this is what sums when returns are temporally aggregated. A basic property of cumulants is that cumulants of all orders are additive under convolution, for which a proof can be found here here . So if $X_1$, $X_2$, ... $X_n$ are i.i.d. , then all the cumulants of $$Y_n = \sum_{i=1}^nX_i$$ scale linearly with $n$, i.e. $$\kappa_k(Y_n)=n\kappa_k(Y_1).$$ However, I suspect that you are normalizing this sum so that...


If a shop prices all items extremely high and applies a "non-criminal discount" at checkout, will shoplifters get prosecuted based on the high price?

I came across this sign online that states that in the store, all items are marked at $951, with "non-criminal discounts" applied only for paying customers. The sign suggests that this is to ensure that shoplifters will be prosecuted for grand theft under California Penal Code 487 PC , according to which the threshold for grand theft is $950. I can't verify the post itself, but regardless - would this actually work? If a shoplifter were caught, could they be prosecuted based on the marked price of $951, even though noone actually has to pay that price, or would the actual price at checkout be considered in the prosecution? While the sign itself is specific to California, I'm interested in different legal systems as well. (I'm also interested if such pricing would be even legal in itself, but I want to limit my post to one question.)

Think through the logical combinations of two questions: The government is tyrannical or just, the revolution is successful or not. Tyrannical government, revolution successful: The revolutionaries will congratulate each other, and of course they are not persecuted by the new government they install . Just government, revolution successful: The revolutionaries will congratulate each other, and of course they are not persecuted by the new government they install . Tyrannical government, revolution not successful: The legal system will find the justified attempt illegal (because they are the legal system defending a tyrannical government), the would-be revolutionaries are persecuted. Just government, revolution...

california No, I don't think so. California's grand theft statute, Penal Code Section 487 (which you already linked) consistently uses the word "value" rather than "price" (emphasis mine): Grand theft is theft committed in any of the following cases: (a) When the money, labor, real property, or personal property taken is of a value exceeding nine hundred fifty dollars ($950), except as provided in subdivision (b). Earlier in that title, Section 484(a) says: In determining the value of the property obtained, for the purposes of this section, the reasonable and fair market value shall be the test, and in determining...

There isn't any indication in that news story that the disabled son was anywhere nearby. I agree the situation you describe sounds like a legitimate use of the placard, but it seems in this situation, the placard was being used in a manner totally unrelated to the transport of a disabled person. My guess is that the cops cited her because the son wasn't in the car, and was not inside the establishment at which she parked. California code has this to say: A person to whom a disabled person placard has been issued may permit another person to use...

Public nudity is illegal in New York as it is in almost every U.S. jurisdiction. And, if the police had arrested the nude protesters, the arrests probably would have been upheld in court, because a ban on nudity in public would probably be viewed as a time, place and manner restriction on the freedom of speech which is constitutionally valid. For example, the Ninth U.S. Circuit Court of Appeals recently upheld San Francisco’s public nudity ordinance in Taub v. City and County of San Francisco (2017). As the court in that case explains in a factually very similar case: Public...


Is youtube-dl takedown due to their tests which use copyrighted content?

The DMCA takedown notice posted on GitHub's youtube-dl page seems to be primarily based on the fact that youtube-dl is expressly advertised as a tool to "circumvent the technological protection measures used by authorized streaming services", to the point that the test cases consist in downloads of videos copyrighted by WMG and Sony Music: Indeed, the comments in the youtube-dl source code make clear that the source code was designed and is marketed for the purpose of circumventing YouTube’s technological measures to enable unauthorized access to our member’s copyrighted works, and to make unauthorized copies and distributions thereof: they identify our member’s works, they note that the works are VEVO videos (virtually all of which are owned by our member companies), they acknowledge the those works are licensed to YouTube under the YouTube standard license, and they use those examples in the source code to describe how to obtain unauthorized access to copies of our members’ works. Is this really the crux of the problem? That is, if youtube-dl developers removed problematic test cases, comments and links to copyrighted videos, would the project become compliant with the Section 1201 of the DMCA? Or is the real problem that youtube-dl implements the "rolling cipher" used by YouTube to protect their content?

The takedown action is a little sketchy. The law regarding takedown notices and host liability is here . The notice includes "Identification of the copyrighted work claimed to have been infringed", a "signature of a person authorized to act on behalf of the owner of an exclusive right that is allegedly infringed", and a statement that "the complaining party has a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law". These things are present in the notice, for which reason the items were taken...

A few possible reasons it could be illegal (on an issue spotting basis, not a careful analysis of each possible reason): The EO is intended to discriminate on the basis of religion and in fact does so in violation of the 1st Amendment to the United States Constitution. The EO is intended to unlawfully discriminate based upon race or ethnicity in violation of U.S. statutes or the 14th Amendment. The EO was adopted without observing the notice and hearing requirements of the Administrative Procedure Act. The EO took effect prematurely because it was not duly published in the Federal Register...

This has been prosecuted criminally, in the scenario of people taking a huge pile of "free" newspapers to sell for recycling. See coverage in the Independent from 16 February 2019. Some previous prosecutions against the same or similar groups had been dropped but this one succeeded. While copies of the Evening Standard are given away for free at train stations, the big stack of them is still somebody's property, and the socially expected arrangement is that a member of the public will take just one, rather than the lot. The reason they are being offered is to achieve a wide...

If you are not a member of the Bar of Maryland, you may not "practice, attempt to practice, or offer to practice law in the State unless admitted to the Bar." Maryland Business Occupations and Professions § 10-601 . "Practicing law" includes "representing another person before a unit of the State government or of a political subdivision." Maryland Business Occupations and Professions § 10-101 . "[A] person who violates § 10-601 of this subtitle is guilty of a misdemeanor and on conviction is subject to a fine not exceeding $5,000 or imprisonment not exceeding 1 year or both." Maryland Business...


Why are rear wheels not placed at the extreme rear of a bus?

In some cars, I have noticed the rear wheels are located at the extreme rear of the vehicle. However, I have noticed that the rear wheels of buses are always located about 1/4th of the way forward from the rear. What is the reason for this?

The loops are known as expansion loops. They need to be placed in pipelines to enable the pipelines to contend with thermal expansion and contraction and other forces that can affect the pipeline. They are typically placed in gas pipelines, irrespective of when the gas is hot or cold - natural gas or steam. The following quote is from Pipeline Design . It's near the end of the page under Pipe Expansion and Supports Steel piping systems are subject to movement because of thermal expansion/contraction and mechanical forces. Piping systems subjected to temperature changes greater than 50°F or temperature changes...

To slightly generalize I'll reform the question slightly. A ridged 2-D body (car) has a line $l$ that moves with it. The car can be linearly transformed as long as the instantaneous center of rotation lies along $l$ at least distance $R$ away from a point $c$ that also moves with the car. In this case point $c$ lies in the center of the rear axle and $l$ lies on the rear axle. Now imagine the car's domain is limited to a quarter plane with edges $A$ and $B$. It initially is placed against $A$, far from $B$ with $l$...

Some ideas: Wheel Load Distribution : The load is greater on the rear wheels providing the power; more force on the front ones bring no benefit and would provide less traction. Better manoeuvrability from having a shorter wheelbase. Better Ground Clearance in some conditions, especially for bumps and or up a increasing slope for instance. Better Driving : The front wheels now turn around a point closer to the C.G. than with the rear wheels. Not good with vehicle dynamics but this appears better than the rear end 'trailing' behind. Structural : As some people have pointed out, it's better...

It is more efficient to transmit DC using about the same infrastructure. This is because of several effects: Skin effect experienced with AC. There is no skin effect with DC. Higher voltage allowed with DC for the same transmission lines. The lines have to withstand the peak voltage. With AC, that is 1.4 times higher than the RMS. With DC, the RMS and peak voltages are the same. However, the power transmitted is the current times the RMS, not peak, voltage. No radiation loss with DC. Long transmission lines act as antennas and do radiate some power. That can only...


Can I enter a rental property without giving notice if I'm afraid a tenant may be hurt?

I rent a “Mother-In-Laws quarters” (guest area) that is on the side of my house. It has a private entrance. If I'm concerned something has happened to the tenant, am I legally allowed to enter the building without giving notice? Some background : For the first time, my tenant is late on rent, and hasn't contacted me in any way which seems very unusual for her. Yesterday I texted once to remind about the rent, and a second time asking if they are okay once I noticed there was still mail from a few days ago in her mail box right by her door with no response. I also couldn't hear TV through the wall which I usually can, and her curtains were never opened which I notice she usually does during the day. The air conditioning also wasn't on all day, which is also unusual. She's elderly and I'm afraid she may have fallen or even worse. I'm planning on knocking on her door on my lunch break. If she does not answer the door, I'm trying to figure out if I can go ahead and enter the property and make sure everything is okay.

Public nudity is illegal in New York as it is in almost every U.S. jurisdiction. And, if the police had arrested the nude protesters, the arrests probably would have been upheld in court, because a ban on nudity in public would probably be viewed as a time, place and manner restriction on the freedom of speech which is constitutionally valid. For example, the Ninth U.S. Circuit Court of Appeals recently upheld San Francisco’s public nudity ordinance in Taub v. City and County of San Francisco (2017). As the court in that case explains in a factually very similar case: Public...

This aspect (and many others) of contract law is applicable in the US and various countries of the EU. can they renege after the candidate has begun their journey, thus saddling the candidate with the travel cost? No. The company would incur breach of contract. There is no need for a formal contract. The candidate only needs to prove that the company agreed (in writing, orally or clearly through its conduct) to cover or reimburse those expenses and that this elicited a meeting of the minds . The agreement would be void if the candidate incurred the expenses despite knowing...

No Parliament is sovereign : Parliamentary sovereignty is a principle of the UK constitution. It makes Parliament the supreme legal authority in the UK, which can create or end any law. Generally, the courts cannot overrule its legislation and no Parliament can pass laws that future Parliaments cannot change . Parliamentary sovereignty is the most important part of the UK constitution.


https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a password hash client-side (using JavaScript) and then just compare it with the hash in DB server-side. But I am not sure this is any better than sending plain-text password over https and then hashing it server-side. My reasoning is that if attacker can intercept the https traffic (= read plaintext password) he can for example also change the JavaScript so it sends the plaintext password alongside the hashed one - where he can intercept it. The reason against hashing client-side is just ease of use. If I hash client-side I need to use two separate libraries for hashing. This is not an unsurmountable problem, but it is a nuisance. Is there a safety gain in using client-side hashing? Why? Should I also be using challenge-response then? UPDATE: what interests me the most is this - do these techniques (client-side hashing, request-response) add any significant security gain in case where https is used? If so, why?

web-application passwords tls authentication hash

This is the simplest way of performing host discovery with nmap. nmap -sP 192.168.2.1/24 Why does it not work all the time ? When this command runs nmap tries to ping the given IP address range to check if the hosts are alive. If ping fails it tries to send syn packets to port 80 (SYN scan). This is not hundred percent reliable because modern host based firewalls block ping and port 80. Windows firewall blocks ping by default. The hosts you have on the network are blocking ping and the port 80 is not accepting connections. Hence nmap assumes...

If you hash on the client side, the hashed password becomes the actual password (with the hashing algorithm being nothing more than a means to convert a user-held mnemonic to the actual password). This means that you will be storing the full "plain-text" password (the hash) in the database, and you will have lost all benefit of hashing in the first place. If you decide to go this route, you might as well forgo any hashing and simply transmit and store the user's raw password (which, incidentally, I wouldn't particularly recommend).

Yes, it is a security feature, and the purpose of the delay is to prevent attacks based around tricking the user into entering input to skip past the dialog by popping it up unexpectedly when the user is in the middle of inputting multiple key presses or mouse clicks in quick succession. The two examples that are given in this blog post explaining the feature are: A CAPTCHA that asks the user to type the word only . When they press n , a save dialog is popped up, and then the user will immediately press l and then y...

This is an active area of research. I happen to have done some work in this area, so I'll share what I can about the basic idea (this work was with industry partners and I can't share the secret details :) ). The tl;dr is that it's often possible to identify an encrypted traffic stream as carrying video, and it's often possible to estimate its resolution - but it's complicated, and not always accurate. There are a lot of people working on ways to do this more consistently and more accurately. Video traffic has some specific characteristics that can distinguish...


What are pros and cons of different approaches to aborting ventricular tachycardia?

Idiopathic (or spontaneous, unknown origin) ventricular tachycardia is a type of ventricular tachycardia (VT) that occurs in patients with structurally normal hearts. I would like to know what the pros and cons are of the three main corrective actions physicians seem to prefer: Verapamil : This seems like the drug of choice, but it tends to cause a drop in blood pressure (BP). If the patient already has a low BP (even if merely because of being young and fit), providers may be reluctant to give this drug fearing a significant drop in BP. Amiodarone : This is a drug with significant toxicity that stays in your system for a long time ( weeks to months ). Defibrillation : Assuming the patient returns to normal rhythm after the treatment and is not conscious when delivered, it seems to have less side effects than the drugs. I have looked around and have not found any negative long term side effects, but short term ( seconds to minutes ) there are some risks. My research so far is inconclusive on what the least harmful long term impact of the three are. I am pretty sure Amiodarone should be a last choice, but unsure about the other two. What are the pros and cons of these treatment options that a patient diagnosed with idiopathic VT should understand?

Let's get a few things out of the way... Sex is normal ( 1 ). Sexual desire and arousal are normal ( 2 ). Asexuality is normal ( 3 ). Masturbation is normal ( 4 ),( 5 ). There is no problem whatsoever with these three things, although everyone blushes when they talk about them. Is Masturbation healthy? Downsides : Masturbation is not risk free. It is about as dangerous as chewing or walking ( 6 ). Some side effects are irritated skin and ruptured penis, but only if you really, really, really overdo it (Once or twice a day...

I think a missing bit of information that might help you get a better sense of this practice is: steroids are miracle drugs. OK, that was in jest - no miracles here. Truth be told, though, if there is a single class of drugs that has added more quality-adjusted life-years to human history than any other, steroids must be competing with just a few antibiotic classes for that title. To make clear what we’re talking about, the term “steroid” as a label for drugs generally refers to glucocorticoids (GCs) - drugs that act like cortisol, an endogenous steroid hormone. Commonly...

Please see the following society guidelines first: The 2006 American College of Cardiology/American Heart Association/European Society of Cardiology (ACC/AHA/ESC) guidelines: ●There is evidence and/or general agreement supporting RF ablation in patients with symptomatic idiopathic VT that is drug-refractory, or in such patients who are intolerant of drugs or do not desire long-term drug therapy. ●The weight of evidence and/or opinion supports the use of beta blockers and/or calcium channel blockers for the treatment of symptomatic idiopathic VT. ●The weight of evidence and/or opinion supports the use of class IC antiarrhythmic drugs as an alternative to or in combination with beta...

In the blister shown, the likelihood of rupture is decreased because of the thickness of the epidermis on the palm of the hand, so you can leave it alone until the underlying area re-epithelializes. You'll know this is happening because of the decreased pain and the slow reabsorption of the fluid. Eventually you will just peal it off what's left of the blister, finding clean new skin underneath. But this is a great starting point for an answer about the treatment of blisters in general: is it better to leave them alone, drain the fluid, or de-roof them (take the...


How can I go about applying machine learning algorithms to stock markets?

Can anyone share their experience and basic pointers about how to go about it or at least start applying it to see results from data sets? How ambitious is this? Also, mention standard algorithms that should be investigated.

There seems to be a basic fallacy that someone can come along and learn some machine learning or AI algorithms, set them up as a black box, hit go, and sit back while they retire. My advice to you: Learn statistics and machine learning first, then worry about how to apply them to a given problem. There is no free lunch here. Data analysis is hard work . Read "The Elements of Statistical Learning" (the pdf is available for free on the website), and don't start trying to build a model until you understand at least the first 8 chapters....

1. Determine Factors Economically, the use of factor models can be either motivated using the ICAPM or the APT . Although there are some theoretical differences between the model, for empirical and practical work these differences are irrelevant. In the end, both models stipulate that returns and expected returns are linear functions of the factors: $$ r_{i,t} = \alpha_i + \sum_j \beta_{i,j} F_{j,t} + \epsilon_{i,t} \quad (1)$$ $$ \mathbb{E}[ r_{i,t}] = \lambda_o + \sum_j \beta_{i,j} \lambda_j \quad\quad\quad(2)$$ where $F_{j,t}$ is the factor surprise of factor $j$ at time $t$ and $\lambda_j $ is the factor risk premium of factor $j$....

Wavelets are just one form of "basis decomposition". Wavelets in particular decompose in both frequency and time and thus are more useful than fourier or other purely-frequency based decompositions. There are other time-freq decompositions (for instance the HHT) which should be explored as well. Decomposition of a price series is useful in understanding the primary movement within a series. In general with a decomposition, the original signal is the sum its basis components (potentially with some scaling multiplier). The components range from the lowest frequency (a straight-line through the sample) to the highest frequency, a curve that oscillates with a...


Passwords being sent in clear text due to users' mistake in typing it in the username field

Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing their passwords in the username field, either in the OS Domain logon, or within web applications. I am guessing those are people who cannot type without looking at the keyboard and in trying to do so, doing it fast, end up typing their passwords in the wrong field. This means that the password is sent in plain text everywhere in the network and end up recorded on the logs with an event that says something along the lines: User P@$$w0rd does not exist [...] Or An account failed to login: P@$$w0rd [...] (where P@$$w0rd is the actual user's password) It becomes pretty obvious to work out to whom the passwords belong: usually the previous or very next (un)successful event on the same log file will tell you an event triggered by the same user. Any other Analyst, looking at the logs, could get someone else’s credentials without the due owner even being aware of that; the worst case scenario is network eavesdropping, or actual log file compromise. I am looking for a general guidance to help preventing this. I assume simply masking the username is not feasible and even if it were, this would probably eliminate a lot of the log analysis for not being able to tell who did what. Note: There is already a post on a similar issue, but I am trying to address a way to prevent it. What's the risk if I accidently type my password into a username field (Windows logon)? Accepted Answer: I wish I could select a few answers from the list. Unfortunately I have to stick to just one in the forum, but in practice I can combine them. Thanks very much for all the answers; I see there is no single solution. As I agree that adding 'things' add complexity which increase likelihood of security holes, I have to agree with most of the voters that @AJHenderson has the most elegant and simplest answer as a first approach. Definitely SSL and a simple code verification on the server or even at the client side. As I am looking to mitigate not against malicious users, but the distracted ones, this will do fine. Once this is in place, we can start looking at expanding the implementation to ill-intended users if appropriate. Thanks ever so much again for everyone's input.

Go with RSA. DSA is faster for signature generation but slower for validation, slower when encrypting but faster when decrypting and security can be considered equivalent compared to an RSA key of equal key length. That's the punch line, now some justification. The security of the RSA algorithm is based on the fact that factorization of large integers is known to be "difficult", whereas DSA security is based on the discrete logarithm problem. Today the fastest known algorithm for factoring large integers is the General Number Field Sieve , also the fastest algorithm to solve the discrete logarithm problem in...

One thought is to not allow form submission if there is not a value in the password box. Generally if they accidentally entered the password in the username, then there likely isn't going to be anything in the password dialog. It is worth noting that this does not have to be simply done client side, but could also be done on a server as long as the transport used is secure and the input is not logged until after passing a check about the password field not being empty.

It typically works like this: Say your password is "baseball". I could simply store it raw, but anyone who gets my database gets the password. So instead I do an SHA1 hash on it, and get this: $ echo -n baseball | sha1sum a2c901c8c6dea98958c219f6f2d038c44dc5d362 Theoretically it's impossible to reverse a SHA1 hash. But go do a google search on that exact string , and you will have no trouble recovering the original password. Plus, if two users in the database have the same password, then they'll have the same SHA1 hash. And if one of them has a password hint...

Let's hope and assume that Facebook stores only hashes of current password (and potentially previous passwords). Here is what they can do: user sets first password to "first" and fb stores hash("first"). later on, users resets password and is asked to provide new password "First2" Facebook can generate bunch of passwords (similar to the new one): ["First2", "fIrst2", "firSt2", ... "first2", ... "first", ... ] and and then compare hash of each with the stored hash. This is the only solution that comes to my mind. Any other?


Why are railroad tank cars bent in the middle?

I recently noticed that the cylindrical shape of a railroad tank car is not completely straight but has a bend in the middle. The entire tank is a bit lower there. What's the reason for this bend? This is also visible on the drawing of a DOT 117 tank car on Wikipedia (the red nearly-horizontal lines were added by myself). I first thought it had something to do with pressure containment, but the model 117 is apparently used for non-pressured goods only.

As other have pointed out, the main utility is to allow easier cleaning of the tank cars from sediment (solid precipitates). Usually, there is a drain in the lowest point. The reason that it is in the middle is that in this way, you can allow double the incline compared to if you had the drain at one of the ends for the same height. For example, if the allowed height difference is about 15 cm, and about 15 m length, then if you had the drain in: the edge, the angle would be $\arctan\left(\frac{0.15}{15}\right)=0.57^\circ$ or 1%. the middle ,...

The picture, below, of the exaggerated long section of the Channel Tunnel was taken from Wikipedia . Full-sized image here . Some of the limiting factors for the Channel Tunnel are: Railways don't like steep gradients The tunnels comprising the Channel Tunnel were excavated using tunnel boring machines (TBMs). Like railways, they cannot tolerate steep gradients. The tunnel was excavated in chalk marl (green coloured material in the picture). This was due to its depth (not being too shallow and not being too deep) and its ability to be easily dug but also it would cause major support issues for...

From the point of view of the driver of a car, impacting another car is about as bad as crashing against an ideal wall (a wall with zero deformation whatsoever). If there were a plane reflection between the two cars, then vs. Car would be exactly equal to vs. Wall (the contact points between both cars would all be on the same plane, due to reflection, so each car could be considered a wall for the other). But this plane reflection does not exist: What we have instead is a 2-fold rotational reflection . Let's say the left part of...

The turbulence model can make a big difference in your simulation . There are many turbulence models around. It becomes a tough job to select one out of them. There is no perfect turbulence model. It all depends on several parameters like Reynold's number, whether the flow is separated, pressure gradients, boundary layer thikness and so on. In this answer, brief information about a few popular models is given along with pros and cons and potential applications. However, interested users can see this excellent NASA website and references therein to know more about turbulence modeling. A) ONE EQUATION MODEL: 1....


Service refuses to accept cash; is this misleading "convenience fee" legal?

A service advertises a price of $12. When the customer tries to pay, the service provider adds a $2.50 convenience fee for using a debit or credit card and refuses to take any other form of payment. The $12 price was posted, as was the convenience fee. But is it legal for them to say something costs $12 if there is literally no way to get it for that price? ETA: This was an in-person purchase. And yes, I asked to pay in cash and was refused.

united-states commerce fees false-advertising

An essential component of your contract with them is that they will provide you with food free of animal stuff (the exact nature of "vegan approved" may be up for debate, but actual meat should not be included). So they breached their contract with you, and you might sue them for breach of contract. The case of Gupta v. Asha (orders were mixed up) could be useful in this matter. In this case, Hindus were served samosas containing beef, despite repeated assertions that they were vegetarian. Plaintiffs sued, the case was dismissed, and the appeals court deemed that the lower...

united-states I think this may be legal at the moment. In October 2023, the FTC announced a proposed rule to prohibit "junk fees" that are not disclosed upfront. They held an unformal hearing on this in April 2024. But as far as I've been able to tell, this new rule has not yet been enacted. So "surprise" fees at checkout time are still legal.

Assuming U.S. Jurisdiction: In the case of The People vs. Hansel and Gretel Holzfaller: Ms. Gretel Holzfaller is charged with the following: 1 Count of Murder in the First Degree (Murder of Ms. Witch Hazel) 1 Count of Grand Larceny (Theft of precious metals and jewels from Ms. Hazel) 1 Count Petty Theft (Theft of Candy) 1 Count of Vandalism (Bite marks left in Gingerbread Masonry) 1 Count Trespassing Mr. Hansel Holzfaller is charged with the following: 1 Count of Accessory to Murder 1 Count of Grand Larceny 1 Count Petty Theft 1 Count of Vandalism 1 Count Trespassing Ms....

Legally speaking, very many nations grant asylum, and religious persecution is one of the most basic grounds for granting asylum, following the 1951 Refugee Convention . This newspaper article compares asylum statistics in Ireland versus other parts of Europe. The Irish immigration authorities spell out the details for an asylum application. Note that you must already be in Ireland, to apply for asylum in Ireland (you should apply when you enter the country). One could also apply to Norway (almost an English-speaking country), but again you have to be in Norway to do so. There is a generic solution to...


What to do if caught in a physical pentest?

I've seen a lot of people talk about how to pentest and how NOT to get caught during engagements but have a hard time finding "How to behave when caught during a Red Team engagement". Red Teams are to simulate adversaries attacking systems. Many actions can't be done (or at least very hard to) with just some computers and Red Teams often have to go on-site and break in (legally). What I've seen so far is people succeeding in not getting caught. However, I haven't seen anyone talk about what to do when caught. It may just be some suspicion or even being chased by security (possibly armed). In cases where a Red Teamer is caught during an engagement, what should he/she do? Say "I'm a security tester. You've caught me so I'll just leave." Run away like a criminal with their stolen data (which sounds fun but dangerous) to be more like an actual criminal attacker Contact the employer to report it and get a "just continue" pass Quietly come along for some possible interrogation (I think this would be the safest) Update: I've made another question here which covers the 3rd parties not discussed in this question.

General SSL (and its successor, TLS ) is a protocol that operates directly on top of TCP (although there are also implementations for datagram based protocols such as UDP). This way, protocols on higher layers (such as HTTP) can be left unchanged while still providing a secure connection. Underneath the SSL layer, HTTP is identical to HTTPS. When using SSL/TLS correctly, all an attacker can see on the cable is Which IP and port you are connected to Roughly how much data you are sending What encryption and compression are used In SSLv3 through TLS version 1.2 : the current...

Always have your slip with you! This is the golden rule of Red Teaming! If you don't have your Permission to Attack with you, it's like driving without a driver's license. That said, if you are caught during an engagement, I recommend the following: Present a forged Permission to Attack. This way, you can see if criminals could possibly trick a security guard to letting them do their thing with a fake Permission to Attack. Present the real Permission to Attack. If a guard has not bought your fake slip, then it's time to hand in the real slip. If...

Diffie-Hellman is a way of generating a shared secret between two people in such a way that the secret can't be seen by observing the communication. That's an important distinction: You're not sharing information during the key exchange, you're creating a key together. This is particularly useful because you can use this technique to create an encryption key with someone, and then start encrypting your traffic with that key. And even if the traffic is recorded and later analyzed, there's absolutely no way to figure out what the key was, even though the exchanges that created it may have been...

It is the magic of public-key cryptography . Mathematics are involved. The asymmetric key exchange scheme which is easiest to understand is asymmetric encryption with RSA. Here is an oversimplified description: Let n be a big integer (say 300 digits); n is chosen such that it is a product of two prime numbers of similar sizes (let's call them p and q ). We will then compute things "modulo n ": this means that whenever we add or multiply together two integers, we divide the result by n and we keep the remainder (which is between 0 and n-1 ,...


Is there anything preventing the NSA from becoming a root CA?

There are now tons of Certification Authorities (CAs) that are trusted by default in major OS's, many of which are unrecognizable without online lookup or reference. While there have been attempts by the NSA and others to "hack" or otherwise exploit root certicate authorities; is there anything preventing the NSA from becoming a Root CA itself? It certainly has the resources and expertise, and could "suggest" to major OS vendors to add its Root CA to the default trust store list (which is large enough that it may not be noticed by anyone..?) If it is feasible, what would the implications be? Could they essentially Man-in-the-Middle attack most HTTPS connections without a warning? (Perhaps not Dragnet-type interception, but close?) Or create a fake commercial root CA as obviously people would be suspicious if it had NSA plastered all over it?

Bcrypt has the best kind of repute that can be achieved for a cryptographic algorithm: it has been around for quite some time, used quite widely, "attracted attention", and yet remains unbroken to date. Why bcrypt is somewhat better than PBKDF2 If you look at the situation in details, you can actually see some points where bcrypt is better than, say, PBKDF2 . Bcrypt is a password hashing function which aims at being slow. To be precise, we want the password hashing function to be as slow as possible for the attacker while not being intolerably slow for the honest...

It is already done: It is the FPKI root CA, under explicit and full control of the US government. Windows already trusts it by default. Before you flip out and begin to delete root CA certificates, burn your computer's motherboard, or drink a gallon of vodka, think about what it means. It means that the US government could technically emit a fake certificate for any SSL site that you are browsing -- but with a certificate chain that would point back to the US government. That is the point of having a "trusted CA" in the client: so that the...

No, Docker containers are not more secure than a VM. Quoting Daniel Shapira : In 2017 alone, 434 linux kernel exploits were found , and as you have seen in this post, kernel exploits can be devastating for containerized environments. This is because containers share the same kernel as the host, thus trusting the built-in protection mechanisms alone isn’t sufficient. 1. Kernel exploits from a container If someone exploits a kernel bug inside a container, they exploited it on the host OS. If this exploit allows for code execution, it will be executed on the host OS, not inside the...

The reason password expiration policies exist, is to mitigate the problems that would occur if an attacker acquired the password hashes of your system and were to break them. These policies also help minimize some of the risk associated with losing older backups to an attacker. For example, if an attacker were to break in and acquire your shadow password file, they could then start brute forcing the passwords without further accessing the system. Once they know your password, they can access the system and install whatever back doors they want unless you happen to have changed your password in...


Advantages of transition from non-vegetarian to vegetarian

Influenced by PETA, a lot of people have already changed to vegan status. I would like to know how well the transition may work? It can be either in a physical or mental way. Some have changed for religious views, some for humanitarian reasons. But I would like to know the health beneficial aspects.

In the blister shown, the likelihood of rupture is decreased because of the thickness of the epidermis on the palm of the hand, so you can leave it alone until the underlying area re-epithelializes. You'll know this is happening because of the decreased pain and the slow reabsorption of the fluid. Eventually you will just peal it off what's left of the blister, finding clean new skin underneath. But this is a great starting point for an answer about the treatment of blisters in general: is it better to leave them alone, drain the fluid, or de-roof them (take the...

This is a question that cannot be answered by a simple yes or no. As a vegetarian for health purposes (who was a vegan for 1 year) I say that the human isn't supposed to be vegetarian, but rather an opportunistic omnivore. The fact that we can eat meat doesn't mean we have to. Most of people that went from non-vegetarian to vegetarian (no meat, no fish) felt better the following weeks, however the reasons could be numerous and ambiguous: Maybe they were eating too much meat until they stopped ? Maybe the meat they were buying was bad quality...

Your question contains a lot of misconceptions. A cure is definitely possible A cure could be found, proved, and proved safe, more quickly than a vaccine People and firms that could be working on cures are choosing to work on vaccines None of these are correct. Most virus-caused diseases have no cure: colds, Zika, Dengue, and so on. A tiny handful have treatments that can ease the course of the disease: you've heard of Tamiflu and so on. And some can be actually cured with medication. So the first assumption, that a cure exists to be found, is not a...

Let's get a few things out of the way... Sex is normal ( 1 ). Sexual desire and arousal are normal ( 2 ). Asexuality is normal ( 3 ). Masturbation is normal ( 4 ),( 5 ). There is no problem whatsoever with these three things, although everyone blushes when they talk about them. Is Masturbation healthy? Downsides : Masturbation is not risk free. It is about as dangerous as chewing or walking ( 6 ). Some side effects are irritated skin and ruptured penis, but only if you really, really, really overdo it (Once or twice a day...


Has high frequency trading (HFT) been a net benefit or cost to society?

Various studies have demonstrated the very large and growing influence of high frequency trading (HFT) on the markets. HFT firms are clearly making a great deal of money from somewhere, and it stands to reason that they are making this money at the expense of every other participant in the market. Defenders of HFT will argue that HFT firms provide an essential service to the economy in the form of greater liquidity. What research has been done on the benefits and costs of HFT? Has any study attempted to measure either the benefits or the costs? How would one attempt to measures these benefits and costs? What would be the effect of banning rapidly cancelled limit orders (see follow-up question ), e.g. via a minimum 1-second tick rule? Any references and professional opinions (backed by research) on this topic would be appreciated.

algorithmic-trading research high-frequency market-microstructure

Here couple pointers that may make it clearer: Drift can be replaced by the risk-free rate through a mathematical construct called risk-neutral probability pricing. Why can we get away with that without introducing errors? The reason lies in the ability to setup a hedge portfolio, thus the market will not compensate us for the drift above and beyond the risk free rate under risk-neutral probability pricing. As long as such hedge exists and couple other conditions are met (please look up Girsanov's Theorem) we can introduce a risk-neutral measure so that when applying it to the differential equation and through...

The lead paper in the January 2011 Journal of Finance ( Hendershott, Jones, and Menkveld ) addresses algorithmic trading (AT). In short, they find that AT improves liquidity as measured by bid-offer spreads. Taking the econometrics as correct (it is in the Journal of Finance) the next question is if bid-offer spreads are a sufficient statistic for measuring liquidity (or any other benefits). It is a difficult question to answer because, given current market structure, AT may improve liquidity (as measured by bid-offer spreads), but without data on other market structures, it is hard to say that we wouldn't better...

The minimum variance solution loads up on securities that have low variances and co-variances. Theoretically you are correct that this should have a low expected return profile. However, it turns out - in contradiction to modern portfolio theory - that securities that have low-volatility or low-beta experience higher returns than high-volatility or high-beta stocks. This is well-documented in the literature as the low-volatility anomaly . As a result, many funds and ETFs have been launched in recent years to exploit this phenomenon. There are a couple arguments as to why the anomaly exists. The paper I cite above argues that...

I can think of an application in options pricing. I came across the following paper a long time ago but think it explains FT very eloquently as applied to pricing options under BS: http://maxmatsuda.com/Papers/2004/Matsuda%20Intro%20FT%20Pricing.pdf The fun starts on page 112 but it relies on the 1998 paper by Madan and Carr. What I like about the paper is that it gives a thorough introduction to FT and only when the groundwork is set it applies it to option pricing. Not a bad approach vs many other papers which make a lot of assumption and assume the reader can jump right...


Factor models such as Fama-French or the other ones that are partially summarized here work on the cross-section of asset returns. How are the factors built, how are sensitivities/coefficients estimated? In this context Fama-MacBeth regressions are usually mentioned. How does this method work intuitively? Could anyone give a step-by-step manual? EDIT: Links to papers and manuals have been posted in the two answers - this is great. But can someone provide more intuition in the answer? Say we have a universe of stocks (say MSCI Europe) and we group them by value and size. How can we proceed? How do we construct the factors and how do we construct the sensitivities? Could someone please give a more direct explanation, without a link? thanks!

The standard story (also told by @vonjd) is of "The Drunk and Her Dog". This is based on "A Drunk and Her Dog: An Illustration of Cointegration and Error Correction" (1994). The story is itself based on the standard illustration for a random walk known as the "drunkard's walk". The Dickey-Fuller test is used to check for a unit root . It can be used as part of the general Engle-Granger two-step method (although it isn't the only option). In this case, while the two assets themselves are not stationary, you are able to test if the residuals between a...

Here couple pointers that may make it clearer: Drift can be replaced by the risk-free rate through a mathematical construct called risk-neutral probability pricing. Why can we get away with that without introducing errors? The reason lies in the ability to setup a hedge portfolio, thus the market will not compensate us for the drift above and beyond the risk free rate under risk-neutral probability pricing. As long as such hedge exists and couple other conditions are met (please look up Girsanov's Theorem) we can introduce a risk-neutral measure so that when applying it to the differential equation and through...

I've worked at a hedge fund that allowed GA-derived strategies. For safety, it required that all models be submitted long before production to make sure that they still worked in the backtests. So there could be a delay of up to several months before a model would be allowed to run. It's also helpful to separate the sample universe; use a random half of the possible stocks for GA analysis and the other half for confirmation backtests.

1. Determine Factors Economically, the use of factor models can be either motivated using the ICAPM or the APT . Although there are some theoretical differences between the model, for empirical and practical work these differences are irrelevant. In the end, both models stipulate that returns and expected returns are linear functions of the factors: $$ r_{i,t} = \alpha_i + \sum_j \beta_{i,j} F_{j,t} + \epsilon_{i,t} \quad (1)$$ $$ \mathbb{E}[ r_{i,t}] = \lambda_o + \sum_j \beta_{i,j} \lambda_j \quad\quad\quad(2)$$ where $F_{j,t}$ is the factor surprise of factor $j$ at time $t$ and $\lambda_j $ is the factor risk premium of factor $j$....


What is the necessary level of Econometrics-Know-How for a quant

It seems quants increasingly use econometric models at work. As someone who has sold his soul to probability theory and stochastical analysis I would like to catch up. What are the econometric tools a quant should be able to wield ? As I see it, the answer will be highly dependant on where one works. Thus perhaps it would make sense to distinguish: Buy side Sell side Fixed Income Equity Risk Management and Model Validation Book suggestions that cover the necessary knowledge will be appreciated. Also, if someone feels like it, a list of topics (e.g. ARCH, GARCH etc.) would also be very helpful.

I can only talk about quantitative trading. As a rule of thumb, the lower frequency you work in, the more econometrics is important, whereas for a higher frequency, the more econometrics becomes useless . (I would still recommend a top econometrician for HFT since they have what it takes to succeed, it's just the models aren't out-of-the-box applicable.) But if I was interviewing someone who was educated in econometrics for a quantitative research position, I would hope for (given the relevance to financial time-series): I have tried to put in a legend, ^ is something you should learn later and...

I have worked on this topic extensively (pricing and calculating IV in production) and believe can offer an informed opinion. First of all Mathworks - the company that creates Matlab is not a trading firm so you should probably not rely on their advice so much. There are few closed form options pricing models, and all have practical shortcomings. Barone-Adesi and Whaley (please correct my spelling of last names as I'm typing from memory) model is simple approximation for American options but is unfortunately not very accurate, and does not deal with dividends. Roll-Geske-Whaley deals with dividends, but not very...

There are some cases where you can blend your portfolios using weights directly. One case involves corner portfolios . In this case a linear combination of weights is also efficient. Another case is where you can treat the two separate weights you have produced each as distinct portfolio under the assumption that the correlation between these portfolios is relatively stable. In this scenario, the problem reduces to a two-asset portfolio optimization problem (each asset is simply the linear combination of weights produced via your two methods). The other class of methods involves blending via the expected returns. If you arrived...


Where do you store your personal private GPG key?

So, I want to start using pass , but I need a GPG key for this. This application will store all of my passwords, which means it's very important that I don't lose my private key, once generated. Hard disks break, cloud providers are generally not trusted. Not that I don't trust them to not mess with my key, but their security can be compromised, and all my passwords could be found. So, where can I safely store my GPG private key?

I like to store mine on paper. Using a JavaScript (read: offline) QR code generator, I create an image of my private key in ASCII armoured form, then print this off. Note alongside it the key ID and store it in a physically secure location. Here's some that should work for you no matter what operating system you use, as long as you have a browser that supports JavaScript. For Windows users: Click here to download the JavaScript QR code generator: https://github.com/davidshimjs/qrcodejs/archive/04f46c6a0708418cb7b96fc563eacae0fbf77674.zip Extract the files somewhere, then proceed edit index.html per the instructions below. For MacOS or Unix users: #...

Bcrypt has the best kind of repute that can be achieved for a cryptographic algorithm: it has been around for quite some time, used quite widely, "attracted attention", and yet remains unbroken to date. Why bcrypt is somewhat better than PBKDF2 If you look at the situation in details, you can actually see some points where bcrypt is better than, say, PBKDF2 . Bcrypt is a password hashing function which aims at being slow. To be precise, we want the password hashing function to be as slow as possible for the attacker while not being intolerably slow for the honest...

According to Google , the difference is with handling referrer information when clicking on an ad. After a note from AviD and with the help of Xander we conducted some tests and here are the results 1. Clicking on an ad: https://google.com : Google will take you to an HTTP redirection page where they'd append your search query to the referrer information. https://encrypted.google.com : If the advertiser uses HTTP, Google will not let the advertiser know about your query. If the advertiser uses HTTPS, they will receive the referrer information normally (including your search query). 2. Clicking on a normal...

Best way to distribute your key is by using one of the key servers that are available, such as keyserver.ubuntu.com , pgp.mit.edu or keyserver.pgp.com . If you use Seahorse (default key manager under Ubuntu), it automatically syncs your keys to one of these servers. Users can then look up your key using your email address or keyid. If you wanted to post your public key on LinkedIn or your blog, you can either upload the key to your server or just link to the page for your key on one of the keyservers above. Personally, I would upload it to...


Does an electric vehicle going downhill recover energy?

I have to model the behavior of an electric car. For this, I use these equations and I can observe by "playing" with parameters that, when going downhill at constant speed, the car has a negative consumption (i.e. recovers energy). I was wondering if this is realistic?

Train Brakes The common brakes on trains are air brakes . As the name implies, these work off of air pressure. The braking power isn't controlled in the way that you would immediately think of though. They do not work like car brakes where the harder you press on the brake pedal, the harder the pressure goes through the lines to the brake cylinders. They work the opposite. The less pressure in the line, the more braking force is applied. Fail-safe Rail brakes are designed to be fail-safe . That is, when a failure occurs, the safe operation happens. In...

If I model this as a simply supported beam having load at mid span [...] I suspect that this is where your analysis went awry. First off, you should always model bridges with distributed loads, not a single concentrated load at midspan. The most significant load on a bridge will almost always be its own self-weight; load-trains are heavy but, well, so are bridges. Secondly, I assume you're thinking of the bridge like this: Indeed, we can see here that the bending moment is greater at midspan. However, that's not the bridge we're looking at, it's missing the cantilevers! So...

It depends on how steep the hill is. On a slight hill, the energy added by gravity is still not enough to overcome rolling friction and air resistance, so the car still needs power to maintain speed. On a steeper hill, the two may balance out, so no power is used, and no power is generated. On a hill that's steep enough to require braking to control the speed, the car recovers energy. It's called regenerative braking. If the car is going too fast, applying the brakes turns the motor into a generator and charges the battery.

You have the right concept, but slipped a decimal point. 5 cm = 0.05 m. The gravitational force on your 450 g mass is 4.4 N as you say, so the torque just to keep up with gravity is (4.4 N)(0.05 m) = 0.22 Nm. However, that is the absolute minimum torque just to keep the system in steady state. It leaves nothing for actually accellerating the mass and for overcoming the inevitable friction. To get the real torque required, you have to specify how fast you want to be able to accellerate this mass upwards. For example, let's say...


Everyone has heard the procedure to get sworn in in an American court: Put your hand on a Holy Bible and answer yes to "Do you swear to tell the truth, the whole truth, and nothing but the truth, so help you God?" However swearing on a Holy Bible to God has decidedly Christian roots ( regardless of whether it is actually a Christian practice ) in an official setting in a country with a constitution that explicitly gives freedom of religion. As a non-Christian can you refuse to make such a vow?

This is the Fed (FCC) saying "I'm paying for this, so I get to determine who uses it." The service costs money. It is not automagic speech to text, but rather there is often (usually?) an actual human typing it in. Carriers front the cost, and then get compensation from the Fed. The Federal govt picks up that cost. They don't want people that don't need it due to hearing loss making use of that service and its associated costs. From the FCC : Title IV of the Americans with Disabilities Act (b) Availability of telecommunications relay services: the Commission...

In order to accommodate various objections that have arisen in recent generations, in general: You are allowed to "affirm" instead of "swear" You do not have to say "so help me God" You do not have to place your hand on a Bible or any object These variances are often allowed by statute. A witnessed "solemn affirmation" has the same legal consequences as the traditional swearing on a Bible: I.e., you would be held to the same statutes and rules that apply to sworn statements.

I believe you have just misunderstood what you paid for. Blizzard's End User License Agreement says: Your use of the Platform is licensed, not sold, to you, and you hereby acknowledge that no title or ownership with respect to the Platform or the Games is being transferred or assigned and this Agreement should not be construed as a sale of any rights. It also says: Blizzard may change, modify, suspend, or discontinue any aspect of the Platform or Accounts at any time, including removing items, or revising the effectiveness of items in an effort to balance a Game. Blizzard may...

This aspect (and many others) of contract law is applicable in the US and various countries of the EU. can they renege after the candidate has begun their journey, thus saddling the candidate with the travel cost? No. The company would incur breach of contract. There is no need for a formal contract. The candidate only needs to prove that the company agreed (in writing, orally or clearly through its conduct) to cover or reimburse those expenses and that this elicited a meeting of the minds . The agreement would be void if the candidate incurred the expenses despite knowing...


What is this large steel structure used in excavation?

I keep seeing these large rectangular structures on job sites they put in the ground. I'm guessing something for strengthening the surface structures?

Parked vehicles vs moving vehicles Closely spaced parked (or slow moving) vehicles are definitely more onerous, as stated on page 89, Appendix 2.A, Clause 2.A.1 of the South African bridge design code TMH7 : It is generally accepted and can readily be shown that except in the very small span range, the worst loading condition occurs under congested (bumper to bumper) conditions caused by a traffic blockage and that the dispersion of traffic at speed caused by increased vehicular inter-spacing, more than off-sets the effects of impact. However, this is only true by inspection for an unlimited number of vehicles...

The current limit specification for a wire is limited by the heat that current will produce, and how much heat the wire can dissipate before getting too hot. "Too hot" depends on the circumstances. You will see higher current ratings for the same type of wire in chassis wiring applications than the electrical code allows for home installations, for example. This is mostly due to how hot too hot is. The ultimate limit for extreme applications is that the conductor not melt. Temperatures anywhere near that would be unsafe running along wooden supports inside a wall in a house. As...

It is a trench shield. It gets placed in a trench after the trench is dug to prevent workers from being hurt or killed in the event of a trench collapse. This picture from GMC trench shield shows a partially collapsed trench with a shield installed that would protect the workers installing the blue brute pipe.

At the beginning of my career (1979) as a design engineer at HP, the mechanical engineer created the part design and then rendered it in pencil on paper, and then transferred it onto sheets of vellum paper held onto a huge flat tilting table called a drafting board which had a precision sliding arm on it with which parallel and right angle lines could be drawn anywhere on the sheet. Clever graphical rules were applied to the resulting drawings which permitted auxiliary views of the part to be generated so it could be viewed from any desired angle, as an...