Deadly animal prion disease appears in Europe - <AUTHOR> http://www.nature.com/news/deadly-animal-prion-disease-appears-in-europe-1.19759 <comment><USER2> Prions are a crazy, crazy phenomenon. From wikipedia:

> _A protein as a standalone infectious agent stands in contrast to all other > known infectious agents such as viruses, bacteria, fungi, and parasites, all > of which contain nucleic acids (DNA, RNA, or both)_

In my layman's understanding, they're like this bizarre edge case in the way proteins interact. Of all the myriad way a protien can fold, it happens to find one that _induces the same malformation_ when it interacts with another protein. To me, it almost seems like as much of a mathematical/geometrical problem as a biological one. In any case, very interesting from the perspective of emergent behavior in complex systems.

<comment><USER3> Right--as I understand it, it's not that different than Google's "Meeting Room Hardware Virus":

"I imagine it started with all of the adapters which were thrown around in every meeting room. Everyone with a Macbook of some flavor needed a DVI to VGA adaptor in order to use the projectors, so they were plentiful. Somehow, someone probably damaged one of them and smooshed a couple of pins into places where they should not have gone.

"Then, someone else forced this into their Mac. Perhaps two pins tried to go into just the one socket. At any rate, it would now break the socket and get it all out of whack. That socket, used with another adapter in another room, would then break that adapter. This new broken adapter would then go on to break even more Macbook DVI connectors.

Thus, we had a hardware virus." [1]

[1] [https://rachelbythebay.com/w/2012/09/24/dvi/](https://rachelbythebay.com/w/2012/09/24/dvi/)

<comment><USER4> Similar things happen with PCMCIA cards. The connector design on PCMCIA cards is just awful in that male pins are in the receptacle/PC. If you accidentally clog one of the holes on the PCMCIA cards connector and plug it into a receptacle it will bend the pin over.

<comment><USER5> Male pins on the card would fail just the same way, plus they'd also get more damage from being exposed. The only upside would be easier repair and, in most cases, cheaper replacement.

The correct fix would be pins with a better length/width ratio.

<comment><USER6> Or no pins as at all but rather a PCB edge connector[1].

1\. [https://en.wikipedia.org/wiki/Edge_connector](https://en.wikipedia.org/wiki/Edge_connector)

</comment></comment></comment></comment></comment><comment><USER7> The most terrifying thing about prions is that they are infectious but not _alive_ : they can't be "killed" in the normal sense by sterilization. The proteins must literally be dissolved to neutralize them.

<comment><USER8> I slept through biology class, could you explain how that's not also true for virii, given that they are also not "alive"?

<comment><USER9> > virii

Pet peeve of mine, but it looks like you slept through English class as well. The plural of "virus" in English is "viruses". "virus" in latin is a mass word and has no plural, like "sugar" and "air".

<comment><USER8> Your perscriptivism here seems misguided then, because if virus is a mass word we shouldn't be saying viruses either: just "virus". And anyway, if we absolutely had to express a plurality of virus, it would be "vira".

Anyway, this is _hacker_ news.

For those of us who grew up in internet hacking communities of the early 90's "virii" was the plural form in the lingua franca. As a descriptivist of great habit, I will continue to use that form.

<comment><USER9> I am actually a descriptivist myself, but the prescriptive approach usually works best when trying to convince people how to write. Apparently not so in this case.

How about this argument then: "virii" is f*ckin ugly? No? Darn. :-)

</comment></comment></comment></comment></comment><comment><USER10> Prions: Killer Zombies

"You Can't Kill What's Not Alive: Prions cannot be destroyed by boiling, alcohol, acid, standard autoclaving methods, or radiation. In fact, infected brains that have been sitting in formaldehyde for decades can still transmit spongiform disease. Cooking your burger until it is well done will not destroy the prions!" [http://learn.genetics.utah.edu/content/molecules/prions/](http://learn.genetics.utah.edu/content/molecules/prions/)

"Eating human brains helped Papua New Guinea tribe resist disease, research shows." [https://www.theguardian.com/science/2015/jun/10/brains- helpe...](https://www.theguardian.com/science/2015/jun/10/brains-helped-papua- new-guinea-tribe)

Original name for the prions was "trembling in fear" \- or Kuru: [https://en.m.wikipedia.org/wiki/Kuru_(disease)](https://en.m.wikipedia.org/wiki/Kuru_\(disease\))

<comment><USER11> So there's no cure, no vaccine, and you can't kill them. Terrifying. An outbreak of this thing would have free pass to eradicate entire species, including us.

<comment><USER12> Oh, and the incubation time can be extremely long. A burger you ate 5 years ago could've been infected but it could still be years before you begin showing signs. I remember reading a bit about some connection between prions and dementia in elderly individuals but I don't remember any of the details.

One sci-fi horror series had an episode where the plot was that some mass produced chickens were getting ill because the feed was made from other chickens and they eventually discovered that it involved a prion that was dangerous to humans as well. This was discovered after massive numbers of those chickens had been consumed in large quantities by society.

<comment><USER13> That's literally what happened with the mad cow disease scare if you swap cow for chicken.

</comment></comment></comment></comment><comment><USER14> >>Although the disease is not known to be transmissible to humans

This is not quite correct, the disease is believed to be transmittable to humans, but we're not in the practice of eating deer brains, so there are no confirmed cases. All of the states with CWD have advisories on reducing the risk with consumption. Eg: [http://www.dgif.virginia.gov/wildlife/diseases/cwd/deer- carc...](http://www.dgif.virginia.gov/wildlife/diseases/cwd/deer-carcass- handling/)

Given that we don't really know how CWD is transmitted among animals it is still pretty worrying.

</comment><comment><USER15> Prions are both beautiful and terrifying. One of my favorite science fiction stories is Kim Stanley Robinson's "Aurora". He makes great use of the prion concept, and its consequences for human life, in relation to space exploration. Fascinating read if you're interested in the topic.

<comment><USER16> Thanks for the recommendation! I started reading it, and it's well-written and very interesting.

</comment></comment><comment><USER17> I recently learned that Chronic Wasting Disease was spreading through deer in the United States, there's a map of its spread here: [http://www.ct.gov/deep/cwp/view.asp?a=2700&q=323412](http://www.ct.gov/deep/cwp/view.asp?a=2700&q=323412)

Apparently it's been shown that spiker monkeys can contract it but it hasn't (yet) been shown to be transmitted to humans.

<comment><USER18> How does that work, considering deer are vegetarians? Or are these farmed deer being fed the last generation?

<comment><USER19> From the article linked by GP:

How does CWD spread?

The method of CWD transmission is unknown, however there is strong evidence to suggest that abnormally-shaped proteins called "prions" are responsible. The agent responsible for this disease may spread directly through animal to animal contact or indirectly through soil or other surface to animal contact. It is thought that the most common mode of transmission from an infected animal is via saliva and feces. A recent study confirms that CWD prions can be shed into the enviroment in feces from animals showing no clinical signs of the disease and can contaminate the soil, leading to infection in other animals. CWD can be spread from region to region by the movement of captive deer or through the improper disposal of a harvested deer transported from a CWD infected area.

</comment></comment></comment><comment><USER20> Prions are fucking scary. They survive all regular decontamination procedures - alcohol, boiling, even autoclave. Patients had been infected through the sterilized scalpels and endoscopes.

<comment><USER21> >>Patients had been infected through the sterilized scalpels and endoscopes.

For someone who had an endoscope recently, that's really scary.

<comment><USER22> I mean, people were also at times infected with HIV and Hepatitis C from blood transfusions, but we realized the risk and took steps to mitigate it.

</comment></comment></comment><comment><USER23> Since there are a lot of questions and very good discussions today, I thought I would share a good resource for bio made for comp-sci people: [https://www.cs.cmu.edu/~wcohen/GuideToBiology- sampleChapter-...](https://www.cs.cmu.edu/~wcohen/GuideToBiology- sampleChapter-release1.4.pdf)

If anyone knows any other good resources or intros, please share as well.

</comment><comment><USER24> Could a prion have been the precursor to life? Seems simpler for a protien to accidentally come into existence and start replicating than a string of rna?

Or am I misunderstanding?

<comment><USER25> It's likely that pre-RNA life and prions shared a lot of similarities.

</comment></comment><comment><USER26> Anyone want to learn more about prion related disease Kuru .. should watch this documentary

[https://www.youtube.com/watch?v=vw_tClcS6To](https://www.youtube.com/watch?v=vw_tClcS6To)

<comment><USER27> I do remember reading about this disease and its spread through cannibalism

</comment></comment><comment><USER28> Since when can we reliably test for prions? Could it be that those misfolded proteins have been around forever?

<comment><USER29> Possibly, but the modern age has considerably more vectors for exposure to these misfolded proteins, and the last statement of what logfromblammo said[0], these misfolding proteins don't always affect core processes of the body.

[0] [https://news.ycombinator.com/item?id=11534177](https://news.ycombinator.com/item?id=11534177)

</comment></comment><comment><USER30> To be fair, this doesn't have to have originated via animal-to-animal infection, but could be an example of sporadic CWD.

As far as I know, sporadic CWD is relatively uncommon, but given CWD is caused by the PrP protein, and there are a number of known mutations in PrP which can increase its likelihood of undergoing prion-conversion, I'd hope they're going to sequence this animal's PrP gene to see it it shed's some light on the etiology.

Irrespective, this could still mean that CWD is now endemic in Europe.

>>>

Updated for clarity and extra info/context (thanks pbhjpbhj!)

>>>

CWD: Chronic Wasting Disease (deer-based prion disease - main topic of article)

PrP: The specific prion protein involved here. Note that (confusingly!) prions are both a 'class' of proteins but also refers to a specific protein (PrP).

Prions (class) are proteins which can exist in one of two states. In their soluble form they're happy-go-lucky proteins that are monomeric (i.e. exist as a single unit). However, these soluble-form prions can undergo a conformational change (re-arrange their shape) into a different conformation (the infectious form). The infectious form of the prion can do two specific things: 1) Aggregate (so all the previous soluble prion proteins get stuck into a big wad of protein) 2): Catalyze the conversion of soluble-form prion into the infectious form. Herein lies their infectivity - you get an exponential growth in the number of proteins in the infectious state.

Prions (PrP) is a specific protein found in many higher-order multicellular organisms that is the _SPECIFIC_ protein that causes a range of prion diseases (Creutzfeldt-Jakob Disease (CJD), BSE [mad cow], CWD, Scrapie etc). There are species barriers to these diseases, even though the proteins are pretty similar (i.e. humans cannot catch CWD from deer, even though the PrP protein misfolds in CWD and the same human version misfolds in CJD). These species barriers are convenient (!!) but very poorly understood, which is somewhat concerning.

Finally - it's worth point out prions aren't always bad. Fungi use them as a mechanism to facilitate non-genetic heritability/diversity [1], and we're increasingly finding examples of prion-like mechanisms that facilitate fast and irreversible signalling in cells (e.g. in the inflammation response [2])

[1] True, H. L. & Lindquist, S. L. A yeast prion provides a mechanism for genetic variation and phenotypic diversity. Nature 407, 477–483 (2000).

[2] Cai, X. et al. Prion-like polymerization underlies signal transduction in antiviral immune defense and inflammasome activation. Cell 156, 1207–1222 (2014).

<comment><USER31> So humans can't get a prion disease from eating infected wild game?

Where does alzheimer's disease fit into this? Are there instances where plaque build up is caused by protein misfolding, or are there other causes?

</comment></comment><comment><USER32> Too bad DNA doesn't stick around more than a few million years [1]. It'd be interesting to research the possibility of prions wiping out the dinosaurs from Mad Herbivore Disease.

[1] [https://en.wikipedia.org/wiki/Ancient_DNA](https://en.wikipedia.org/wiki/Ancient_DNA)

<comment><USER33> Why would preserved DNA help us figure this out?

<comment><USER31> Very true. It wouldn't at all would it? You'd need to have actual preserved cells and protein from that era.

</comment></comment></comment><comment><USER34> Has anyone else read this, because it looks really promising?

[http://www.pbs.org/wgbh/nova/next/body/phage-alzheimers- cure...](http://www.pbs.org/wgbh/nova/next/body/phage-alzheimers-cure/)

</comment><comment><USER35> Source: [http://www.vetinst.no/eng/Highlights/The-first-detection- of-...](http://www.vetinst.no/eng/Highlights/The-first-detection-of-Chronic- Wasting-Disease-CWD-in-Europe)

</comment><comment><USER36> Also see the study on aerosol transmission of prions:

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3020930/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3020930/)

</comment><comment><USER37> All I can think of is this now: [https://en.wikipedia.org/wiki/Starfish_wasting_disease](https://en.wikipedia.org/wiki/Starfish_wasting_disease)

</comment><comment><USER38> What does a normal reindeer brain look like?

<comment><USER39> I was thinking exactly the same. Or to be more precise, is it visible in the image the damage caused by the illness?

I'm not feeling lucky: [https://www.google.com/search?q=reindeer+brain&tbm=isch](https://www.google.com/search?q=reindeer+brain&tbm=isch)

</comment></comment><comment><USER40> Off topic, kinda: is anyone else having problems with nature.com not resolving? Firefox and Safari both fail to load it, but for some reason Chrome manages to find the server. OSX, latest.

</comment><comment><USER41> I, for one, welcome our new zombie reindeer overlords.

</comment><comment><USER42> For anyone who may want to know, prion diseases are sciencetific possible causes of a Zombie Apocalypse. That's why this new called my attention.

<comment><USER43> By "zombie apocalypse", you mean slow-walking infected, craving brains and infecting anyone they bite?

Or just, you know, a disease that kills you if you eat brains? Because that's kind of the exact opposite of what zombies do.

<comment><USER44> A prion that infected people rapidly, through saliva-to-blood contact, and had similar symptoms to rabies without the rapid death would be very similar to traditional zombie lore.

The protein would probably also have to effect the olfactory glands, creating an attraction to uninfected humans.</comment></comment></comment>


Why QR codes are on the rise - <AUTHOR> https://www.economist.com/blogs/economist-explains/2017/11/economist-explains-0 <comment><AUTHOR> Apple's iOS11 update allows for direct QR code scanning with the native camera app [1][2].

[1] [https://techcrunch.com/2017/06/05/the-iphones-camera-app- can...](https://techcrunch.com/2017/06/05/the-iphones-camera-app-can-now-read- qr-codes/) [2] [https://blog.qrd.by/2017/09/21/iphone-ios11-qr-code- reading-...](https://blog.qrd.by/2017/09/21/iphone-ios11-qr-code-reading- camera/)

<comment><USER2> Also [3].

[3] [https://www.economist.com/blogs/economist- explains/2017/11/e...](https://www.economist.com/blogs/economist- explains/2017/11/economist-explains-0)

</comment></comment><comment><USER3> Sweet, now we only need a QR code reader app which doesn't need the permission to the contacts, to sent sms, to install other software, which doesn't display add taking half of the screen, and which decodes the QR code _on the client_ i.e. no internet connection necessary (i might be scanning sensitive information).

<comment><USER4> For the no-ad and no-internet-connection requirements: [https://play.google.com/store/apps/details?id=com.google.zxi...](https://play.google.com/store/apps/details?id=com.google.zxing.client.android) \-- You can also install it from F-Droid because it's open-source: [https://github.com/zxing/zxing](https://github.com/zxing/zxing)

I suppose you can use that to compile your own APK that does not request any permissions (besides, obviously, "Use camera").

</comment></comment><comment><USER5> QR Code has literally no barrier of entry, anyone who wants to receive money in China for whatever they are selling, simply print out a QR Code with Printer.

I still do not believe that QR Code is the Holy Grail, as media in China and WeChat like to paint it. For anyone who has been to China, and lived in China for a while will know pretty much everything in China has QR Code.

While I believe it has its use, I still dont think QR Code should be the only way to access, but rather something to argument on. NFC-F _, Felica is still 10 times better in Transport payment where response time is everything, especially in tube /underground like Japan Railway. Unless someone can invent a way where by me showing QR Code and reading it by a Optical Reader is faster then NFC. Which i am not entirely sure if it is possible.

_ If anyone could shine any light as to why something as good as Felica, invented, implemented and used from 20 years ago only make it to a standard body last year.

</comment><comment><USER6> I never understood why QR codes took off in the first place -- by the time people started using them it seemed just looking for URLs in the camera image and letting people click on them with their finger would work as well.

<comment><USER7> Cheapo handheld scanners and poor lighting conditions.

QR codes have a lot of the same contrast benefits that barcodes have, and it's historically been hard to make an OCR-based scanner (for stocking shelves, lets say), with an acceptable retail price. Lots of industrial uses preclude touch surfaces, and lots of industrial areas preclude the kinds of displays you find on normal phones and such. And OCR in random lighting conditions, with random angles, and a little hand-jiggle gets ugly quick.

There are also packaging benefits with QR codes. They are fixed size regardless of content, and have a common appearance. "apple.com/product" is fine to put on a sign, but "www3.hp2.hpe.com/enterprise- cms/na/en/v2/update4/supplierhub/supplier17/product.asmx?&id=BUYTHIS&source=FROMMYSIGN" and the like become a presentation and usability issue ;)

</comment></comment><comment><USER8> The reason I bet on is now Apple made it integrated into the stock Camera app. The QR reader is very clean (as Apple is to do).

</comment><comment><USER9> Shameless plug: with our API ([https://voucherify.io](https://voucherify.io)) you can generate, distribute, and track QR codes

</comment><comment><USER10> Wechat is way ahead on this gang.

<comment><USER10> Whatever.</comment></comment>


Epi Eject: a better designed Epipen for allergy - <AUTHOR> http://www.indiegogo.com/epiinject

<comment><USER2> Maria Pitallano and I, Erin Fong, are industrial designers who teamed up in our last year at California College of the Arts to design two products to help those with food allergies, which is a growing epidemic that can take someone's life within minutes. Allergies affect people socially, mentally, and physically and it is a fear that nobody should have to live with. We are trying to tackle this problem with two new designs for the epinephrine injector that we are trying make into a real product. Please visit our project at www.indiegogo.com/epiinject.</comment>


Revec: Program Rejuvenation Through Revectorization - <AUTHOR> https://github.com/revec/llvm-revec <comment><USER2> > Revec automatically finds equivalences between vector intrinsics across > different instruction generations by enumerating all combinations. > Equivalences are established through randomized and corner case testing

> We adopt a test case fuzzing approach for generating equivalences, with > 18,000 randomly generated inputs and combinatorially generated corner-case > inputs, inspired by test case generation in [6]. ... helped Revec to > significantly reduce erroneous equivalences, and is consistent with the > methodology in [6].

It sounds like an interesting approach. But how hard would it have been to ask an expert to encode this information instead of empirically? And what about instruction side effects, proc/coproc flags/modes etc? Does equivalence consider those?

The llvm-revec fork has the pass, but does it also have the code to reproduce the automated enumeration (and testing)?

</comment><comment><USER3> This paper was mentioned in the _RISC Is Fundamentally Unscalable_ post but with respect to VLIW.

      The problem is that this is really fucking hard to
      compile, and that's what Intel screwed up. Intel
      assumed that compilers in 2001 could extract the
      instruction-level parallelism necessary to make
      VLIW work, but in reality we've only very recently
      figured out how to reliably do that.

The ReVec article/repo doesn't mention VLIW as an application but I can see parallels in the problem. If you compile for an 8-wide vector processor and you get a 16-wide machine, you need to re-vectorize your code to take advantage of the newly available width. That's similar if you change widen a VLIW. Similar, not same. It seems an obvious _possible_ application but the authors didn't mention it.

</comment><comment><USER4> Looks like an abandoned research project.

<comment><USER5> I think abandoned is too strong of a word. Many research projects have an explicit goal of building an MVP (and an explicit non-goal of doing anything beyond that). The research project is only really "dead" when there are no more questions to be asked. Even well-known professors some times have gaps of years or decades when no apparent progress is being made, but may still pick up the problem later and work on it (see e.g. the STOKE project and Alex Aiken's previous superoptimization projects).

<comment><USER4> I don't mean abandoned in a particularly negative sense, exactly because it's normal for research project to be left behind as you describe.

But from the point of view of a potential user, this kind of software is undeveloped, unsupported and rotting away (e.g. about two Clang versions behind): probably useful as a prototype to plunder and reimplement, not as a tool to get things done.</comment></comment></comment>


Windows Command-Line: The Evolution of the Windows Command-Line - <AUTHOR> https://blogs.msdn.microsoft.com/commandline/2018/06/27/windows-command-line-the-evolution-of-the-windows-command-line/ <comment><USER2> > When you build your code in Visual Studio (VS), your build is spawned in a > hidden Console window!

Having to spawn a console window to capture stdout is, at the very least, not a reason to be favorably impressed.</comment>


Hackers account for 90% of login attempts at online retailers - <AUTHOR> https://qz.com/1329961/hackers-account-for-90-of-login-attempts-at-online-retailers/ <comment><USER2> I don't buy these numbers at all. 90% seems stupid high for retail. From the report,

"[...] we rely on data from the Shape Network. Across the US, Shape's customers represent: [..] 40% of Mobile Retail (by in-store payments)."

"We estimated the number of credential stuffing attacks using the total number of credential stuffing attacks observed on Shape's US customers and the total proportion of the US industry our customers represent."

I'm really wracking my brain how they're measuring their marketshare of retail. Mobile retail as measured by in-store payments? Can someone explain that to me?

Bottom line, this data comes from a company whose value proposition is that they sit between your company's servers and your clients and filters bad requests for you.

<comment><USER3> Why would you think 90% is high? That's only 9 in 10. Remember, attackers using dictionary attacks are going to be trying hundreds or thousands of log in attempts, and a real user is only going to try at most a handful of times.

You don't need that many attackers to easily approach 99% or higher. I'd say 90% is likely conservative for some companies.

<comment><USER2> I think 90% is high for a few reasons:

1) Rate limiting of login attempts takes a bite out of the large numbers you're talking about. If we are only looking at retail companies without rate limiting, well, duh, I guess >90% makes sense, but I expect a large portion of the global e-commerce retail segment _does_ employ rate limiting of logins.

2) The report lists, "Averages derived from customers' login traffic before Shape Enterprise Defense was deployed on login applications" \- so this is absolutely a biased sample. These are clients that signed up for help stopping this problem.

3) It bugs me how ambiguous the report is about how they aggregate to 90%. I worry it's a simple [total fraudulent logins] / [total login attempts] across all their client retailers, which will be heavily biased by the retailers that don't have login limiting, and doesn't really describe the situation. A much better number I'd like is the median percentage of fraudulent logins attempts across retailers.

<comment><AUTHOR> 1) Proxies and botnets obscure origin and make attacks appear globally distributed so basic rate limiting has little effect on these attacks.

2) Extrapolated averages on incomplete data are certainly suspect, they are meant to be taken with a grain of salt and are most applicable to people in the affected industries for them to validate against their own data. FWIW The highest percentage of malicious, automated traffic that I've seen has been 99% which, yes, is crazy and should sound unbelievable.

3) Noted, definitely. It is certainly a tough number to nail down because it is very dependent on all the things you mention. I trust our data because we've been at this the longest, were the earliest, and we see a lot of the unadulterated attack traffic that has gotten through many existing defenses so we see the stark difference on day one.

Disclaimer: I contributed to the report in question (but was not consulted or related to the posted article)

<comment><USER4> Most legitimate users will also not have to log in each time they visit, making the ratio even less surprising.

</comment></comment></comment></comment></comment><comment><USER5> I recently joined a website the did away with passwords, the only way to login was to enter your email address and confirm by pressing a link in the email, while this adds a pain point for customers it offloads most security implications onto the email provider.

<comment><USER6> Passwords can already universally be recovered through email. I wish ALL sites had this feature. It's essentially a one time password, that expires.

<comment><USER7> Exactly. The only password that really matters is the one for your email. Everything else just provides additional attack vectors.

<comment><USER8> That only works for services that do not store any sensitive data and employ costumer controller encryption, if your password is used as a cryptographic tool then it's out of the question to use such mechanism.

<comment><USER5> Whatsapp has figured out a solution to this problem. i.e. what is your Whatsapp password?

<comment><USER9> Your telephone number. So instead of something you know (password), they use something you have (phone).

</comment></comment></comment></comment></comment></comment><comment><USER10> This makes sense given how often they'd fail. When I log in it takes me one attempt. When someone is using stolen credentials they might have to make hundreds of attempts before actually logging in.

<comment><USER11> That, and most websites remember your computers forever so you rarely ever need to log back in.

<comment><USER12> I wish. If that were the case, there would be almost zero market for 1Password, Keychain, and a dozen other solutions.

</comment></comment></comment><comment><USER13> My Macy's account was hacked just this week. I got an email that my shipping address changed, and I logged in and saw several hundred dollars worth of pending items in the shopping cart.

</comment><comment><USER14> Any time I start an ssh server for myself on a publicly accessible IP, hackers account for roughly 100% of login attempts. The legit logins are in the noise, and dictionary attacks on username and password fill the logs. With decent passwords, it's not much concern, but nowadays, I disable password logins completely.

<comment><USER15> My experience is the same. I set up a VPN for a coworker, who used it on 3 separate weeks away, connecting in total maybe 30 times. There were several MB of logs detailing illegitimate connection attempts.

It makes me curious what's really going over the wires and airwaves we love to hate for their low capacity and high cost. How much of that traffic is junk?

</comment></comment><comment><USER16> This has to do with affiliate schemes. Payouts for them are quite solid.

Clickfraud people, I think, count on the the fact that for huge e-retailers, it takes months to take action, and they can cashout affiliate payouts faster then they react.

<comment><AUTHOR> It's far more than affiliate schemes. Credential stuffing attacks result in account takeovers for many different types of companies and the value that can be extracted is different for each business.

</comment></comment><comment><USER17> Article doesn't talk about what they're doing to mitigate the problem. Well, except tell the reader to change their passwords. So are online retailers just hoping the problem goes away?

<comment><USER18> They have to balance user attention and user friction. Online retailers want your purchase to be as smooth as possible. There's some studies on how someone won't spend much time on a website if it loads slow. The same can apply to purchase decisions. They need it as impulsive as possible. So annoying things like 2 factor authentication, in their mind, might make a customer give up their purchase.

So things are insecure because that's what customers want to satisfy their relatively low attention spans and impatience. And the retailers optimize for that.

<comment><USER17> Makes sense, nobody like slow pages. However, don't most people have the browser save their password? So couldn't the online retailer have some sort of exponential delay (to a limit) after so many failed attempts? Surely that would affect few real customers.

<comment><USER19> What is being delayed? Just an IP address or the entire account? Neither really work.

</comment></comment></comment></comment><comment><USER20> On our site, for an unknown reason almost 80% of the hacked accounts used are with @outlook, @hotmail, @live, etc domains. Does not look like they got the credentials from a massive leak. Issue with that, is that the hacker deletes our warning/advice emails. Not a funny situation to handle. Any idea about the source?

</comment><comment><USER21> Only 90%?</comment>