Home » Archive by category "Financial" (Page 2)

歐盟對於盜版是否帶來傷害的研究

歐盟在 2014 年做了關於盜版與銷量的研究,結果一直被壓到最近才發表出來 (於是就大概可以猜到結論了...):「EU Piracy Report Suppression Raises Questions Over Transparency」。

“In general, the results do not show robust statistical evidence of displacement of sales by online copyright infringements,” the study notes.

甚至:

The study found that piracy had a slightly positive effect on the videogames industry, suggesting that those who play pirate games eventually become buyers of official content.

另外也描述了現有電影與 TV-series 定價策略偏高:

“Overall, the analysis indicates that for films and TV-series current prices are higher than 80 per cent of the illegal downloaders and streamers are willing to pay,” the study notes.

難怪被壓著...

Stripe 香港開台,以及 Alipay 與 WeChat Pay 的支援

看到 Stripe 的幾個大動作:「Stripe in Hong Kong + Alipay and WeChat Pay globally」。

一個是進入香港的消息:

Today, we’re excited to officially launch Stripe in Hong Kong.

另外一個是 Alipay (支付寶) 以及 WeChat Pay (微信支付) 可以透過 Stripe 在全球使用:

So, today we’re introducing global support for Alipay and WeChat Pay, connecting Stripe businesses in 25+ countries to the hundreds of millions of Chinese consumers that actively use these payment methods.

尤其是後面的消息,對於中國的使用者方便不少...

新墨西哥州禁止因為學童付不起營養午餐,就要求他們以勞力付出

禁止這類變相的羞辱行為:「New Mexico Outlaws School ‘Lunch Shaming’」。

In some schools, children are forced to clean cafeteria tables in front of their peers to pay the debt. Other schools require cafeteria workers to take a child’s hot food and throw it in the trash if he doesn’t have the money to pay for it.

法案包括了所有有接受補助的學校:

On Thursday, Gov. Susana Martinez signed the Hunger-Free Students’ Bill of Rights, which directs schools to work with parents to pay their debts or sign up for federal meal assistance and puts an end to practices meant to embarrass children. It applies to public, private and religious schools that receive federal subsidies for students’ breakfasts and lunches.

紐約市也將禁止雇主詢問薪資

去年麻州立法禁止雇主詢問前工作的薪資 (參考「麻州立法禁止詢問前一份工作的薪資」),而紐約市也要加入這個行列了:「New York City bans employers from asking potential workers about their past salary」。

New York City joined Massachusetts, Puerto Rico, and Philadelphia in banning employers from asking job applicants about their pay at current or past jobs after the city council passed the measure in a vote on Wednesday.

Stripe 對於控制 API 使用量的作法

在「Scaling your API with rate limiters」這篇 StripePaul Tarjan 提到了四種如何保護 API 的作法。

前兩種都是 rate limit。第一種是最標準的「你一分鐘可以用幾次」的方式,這是最容易理解的方式。第二種是「你同時間可以用幾個 API request」,這通常會用在大量消耗資源的 API 上,避免短時間內被打爆。

第三種是拉到整體來看,把 API 分成重要與不重要的,然後直接保留確保重要的 API 有一定的 capacity 可以用:

We always reserve a fraction of our infrastructure for critical requests. If our reservation number is 20%, then any non-critical request over their 80% allocation would be rejected with status code 503.

第四種方式是當過載時的自動化處理,平常就把各種工作排優先順序,當超量的時候自動先將低優先權的拿掉:

Only 100 requests were rejected this month from this rate limiter, but in the past it’s done a lot to help us recover more quickly when we have had load problems. This load shedder limits the impact of incidents that are already happening and provides damage control, while the first three are more preventative.

不過還是有點怪,Stripe 應該是全部都建在 AWS 上面 (AWS Case Study: Stripe),跟 auto scaling 的配合好像都沒提到?

歸類的方式還蠻有條理的,可以學這個方法來規劃...

信用卡的先天缺陷造成盜刷問題

在「Guessing Credit Card Security Details」這邊看到的攻擊手法,基本上無解,除非信用卡的網路交易也全面改成使用晶片...

手法其實很簡單,就是先算出一個合法的卡號,然後分兩階段攻擊取得資訊:

  • 先去找數家只需要「卡號 + 日期」的網站,用暴力法踹出日期 (假設五年就是 60 次)。
  • 再去找數十家需要「卡號 + 日期 + CVV2」的網站,用暴力法踹出 CVV2 (1000 次)。

所以 1060 次就擺平了... 就算所有網站都需要 CVV2,也是 60000 次的嘗試而已 (找數千個網站來踹),算是完全可行的方案。而目前只能靠 workaround 來防止,像是需要多輸入姓名與地址之類的資訊來擋...

Bitmain 的生意愈做愈大了...

Bitmain 做到打算直接弄一座 data center 來挖 Bitcoin:「Chinese firm building 135MW bitcoin data centre」。居然還是用綠色能源來玩出全世界第三大吃電資料中心:

The complex, which will be capable of pulling 135 megawatts of power placing it at #3 of the most powerful data centres in the world, will operate primarily on wind and solar power.

Bitmain 的 AntPool 應該是目前最大的 mining pool:

Bitmain already controls an estimated 18.6% of hashpower worldwide, and many independent miners in the community expressed concern that controlling a massive data centre dedicated to mining bitcoin would give the company too much influence over bitcoin.

關於 AntPool 佔整個 pool 的計算力這邊是寫 18.6%,不過照「Bitcoin Hashrate Distribution」這邊的資料,目前降到 17.4% 了... 而我記得各種攻擊手法中,最低的應該是 25% 的攻擊:「Majority is not Enough: Bitcoin Mining is Vulnerable」,不知道會不會超過...

把 CSC (卡片背面的三碼) 變成 OTP (動態密碼)

把信用卡背面的後三碼 (Card security code) 變成動態密碼,雖然一般只會有三碼,但對於網路消費應該會有不少幫助,不過這樣就不能完全不拿出卡片了...:「This high-tech card is being rolled out by French banks to eliminate fraud」。

產品叫做 MotionCode,會先從法國開始:

Today both Société Générale and Groupe BPCE, two of France’s largest banking groups, are preparing to roll out these cards across all their customers after completing a pilot scheme last year.

然後是波蘭、墨西哥以及英國在規劃:

There are other pilots underway in Poland and Mexico, and Davis is running Oberthur’s UK operation with the hope of getting a pilot or trial started with a UK bank soon.

ING Bank 在羅馬尼亞的機房出事...

ING Bank 在羅馬尼亞的機房發生資料損毀:「A Loud Sound Just Shut Down a Bank's Data Center for 10 Hours」。

不過原因是因為火災測試時噴發的音量太大,導致硬碟故障 XDDD

ING Bank’s main data center in Bucharest, Romania, was severely damaged over the weekend during a fire extinguishing test. In what is a very rare but known phenomenon, it was the loud sound of inert gas being released that destroyed dozens of hard drives. The site is currently offline and the bank relies solely on its backup data center, located within a couple of miles’ proximity.

報導給了個測試影片,示範超大的音量會對硬碟有什麼影響:

Archives