photon12

Here's an interesting paper that looks at blood plasma protein contents and uses bioinformatics processes including learned models to identify plausible biofeedback pathways responsible for protein concentrations deviated from baseline. It's not what you are asking for, but it's the closest thing I've seen to date:

Plasma Proteome of Long-covid Patients Indicates Hypoxia-mediated Vasculo-proliferative Disease With Impact on Brain and Heart Function (Preprint)

https://assets.researchsquare.com/files/rs-2448315/v1/8043bd...

An excerpt:

> In Fig. 7A, hierarchical clustering heatmaps reflect the levels of neurological markers across the patient groups (markers have been curated by OLINK). The values of the PEA expression levels were hierarchically clustered based on Pearson correlation algorithms. Markers selected through the above methodology were investigated for functional annotation using tools from the GSEA platform and MSigDB data positories (Fig. 7B). This latest analysis demonstrated that functional clusters were formed around leukocyte migration, positive immune signals, glial cell differentiation, neurogenesis and MAPK regulatory modules. Taken together, these pathways predict a possible brain-blood barrier dysfunctionality grounded on cell proliferation. Graphs in Fig. 7C illustrate the expression levels of individual markers from the functional groups presented in Fig. 7B. One of the highly expressed markers, was the amyloid precursor protein (APP; Supplementary Fig. 10) which is known to be a pathognomonic marker for both Alzheimer disease and brain inflammation [61–65]. Additional markers for brain dysfunction include JAM2 (endothelial tight junctions protein), SNAPIN (a mediator of neuronal autophagy-lysosomal function in developing neurons), KCNH2 (potassium channel), S100A14 (involved in cell motility adhesion and growth), KIAA0319 (language impairment biomarker), and IROR1 (a receptor tyrosine kinase like orphan receptor 1, which regulates neurites growth in the central nervous system having also WNT-signaling pathway functions, and being crucial for the auditive apparatus maintenance).

There used to be stricter capital requirements and oversight for regional banks, until:

https://www.washingtonpost.com/business/economy/trump-signs-...

See also:

https://www.nbcnews.com/politics/congress/silicon-valley-ban...

These are fair criticisms. Fodder for future studies.

I only added these to say there's enough evidence to be questionable of the null hypothesis with regard to long COVID physiopathology.

Though it is worth noting there is experimental clinical data providing a plausible pathway to suggest long COVID is a result of cell activity dysfunction with plausible biomarkers of dysfunction, and we've known this long enough to know long COVID is a real medical pathology (one distinct from acute infection based on biomarker evidence):

Elevated vascular transformation blood biomarkers in Long-COVID indicate angiogenesis as a key pathophysiological mechanism, https://molmed.biomedcentral.com/articles/10.1186/s10020-022...

Plasma Proteome of Long-covid Patients Indicates Hypoxia-mediated Vasculo-proliferative Disease With Impact on Brain and Heart Function (Preprint), https://assets.researchsquare.com/files/rs-2448315/v1/8043bd...

If you build robust privacy guidance mechanisms into the fabric of your startup from the beginning, your ability to handle risk management around these types of cases can be resourced to scale with the customer expectations of the system you build.

Unfortunately, if you do that, you are going to be outcompeted by the teams that are working to get their first 10,000 paying customers by any means necessary, because privacy planning is less capital efficient.

The companies that do get big enough to overcome their immediate survival constraints often have a harder problem identifying and providing resource needs for privacy assurance because it's less on the minds of the people in charge of making resource decisions because you have other operational scaling issues at the front of mind.

Your engineers and support staff doing dumb things with your data is a risk you can have resources allocated to. But it's not on the critical path to market dominance so it shouldn't be expected to be a priority.

Are they going to put "fired the people who used to enforce our change control procedures" in the post-mortem?

> $80k could easily afford this, which is a low bar for someone with a moderately decent job.

$80k is not a low bar, and this is insulting to really talented people I know stuck in below $40k jobs.

I used to dig ditches in places where excavators couldn't go for a living, and I'm familiar with the contract rate differences for that type of labor and equipment.

My point is that the disparity is such a chasm that my brain can't reconcile it. We aren't talking about ditch digging, we are talking about serving food to the people of Seattle. All the software engineers in Seattle, in my experience, love to frequent dining establishments. Their quality of life is dependent on the labor of people serving them. There's no way I can accept the disparity as "just the way it is." My gut can't take it.

Yes, there is an inconsistency in the amount of effort expended to survive versus the outcomes of that effort. I can't reconcile them in my head. I'm watching my friend trying not to physically deteriorate and have some modicum of comfort while I sit here on my couch living off savings from the job I recently quit. Nothing I do can be so much more valuable than what he does.

> Meanwhile, renters are desperate. They’re begging for housing prices not just to slow, but to fall.

I have a friend who is a head chef at a decently popular bar and restaurant on Broadway in Capitol Hill, Seattle (very trendy part of town if you aren't familiar, steep commercial rent). He lives in a 400 sq ft studio and is barely, barely making it from one paycheck to the next. I am sitting on a 2.6% interest rate mortgage and my prices are set for the next 30 years. I probably work half as hard as he does, if not even less than half. I have a lot of cognitive dissonance associated with that.

Customers who care about their data care that it's protected regardless of the size of the business. They care about availability regardless of the size of business.

If customers could make more informed decisions about these risks, i.e. if they could get access to company intellectual property and privileged information about operations, maybe we wouldn't need to consider this type of of legislation. But customers continue to be on the end of information asymmetry about company operations, so now customers need other ways to find protection. Maybe it's the case that there are economies of scale to resilience, and we have to accept some level of difficulty to disrupt because of that.

The pentesting/consulting job I got right out of college put me in the ER twice. One of those times I was the lead resource on a pentest of a product scheduled to be in the keynote at a major cloud provider's annual conference. The product was not even close to ready, they were refactoring the structure of their APIs during the pentest after we had tested some of their things. They had fundamental, architectural vulnerabilities that had to be papered over with really bad kludges to temporarily mitigate. The management of this product line wouldn't budge on wanting to be in the keynote and ready to launch (they had bonuses on the line), and they kept bringing in more contractors from different firms and slicing up the scope to bail water on coverage of the application. Near the end one day the product team asked me, as a third party consultant, to work on a Saturday because everyone else was already working 18 hour days without weekends. Also, this product was meant to be a key building block in securing other applications end users of the cloud platform were building and operating.

One of those nights on that test I broke down in a phonebooth at the customer's offices. I completely dissociated in the shower that night.

That customer has one of the best funded security programs in the world.

From there, I kept losing more sleep and eventually developed involuntary muscular tics and went into a manic phase where I didn't sleep for many days (5 or 6 maybe)?

That was the first time I went to the ER, I'm getting tired so I won't type out the second time. Also I ended up getting diagnosed with a stomach ulcer at 24 years old.

So many people get ground to dust. Alcoholism in the industry is rampant. I've seen people tasked with 50 parallel security reviews they have some responsibility for. I've seen people fight bureaucracy for years to make no gains.

It pays well. But I'm completely numb to compensation at this point. I'm currently between jobs after leaving a security director role at a startup because the risk I was being asked to assess was beyond my own risk appetite. Thinking about going back into more developer focused roles because my roles have always involved software engineering.

There will be a book akin to The Jungle about how the shittiest parts of risk management flow downhill and crush the people responsible for actually managing it.

Regulation generally is targeted at preventing consumer harm. Self-regulation is the practice of appropriately mitigating consumer harm. I mean mobile subscription providers here by "industry."

This person isn't necessarily an oligarch, but they are a major vendor of market research and VC dollars in the space. This is how important they think the stakes are around fake internet money [1]:

> The Biden Administration is trying to strangle crypto.

> A lot of folks have been trying to stifle that criticism, but the effort to destroy the industry is quiet but pervasive across the exec branch.

> The time to make crypto an issue that wins or loses the Presidency is now.

Investors in my company support that view. It's an example of doing things indistinguishable from what oligarchs want: no questions on their authority, even in the wake of massive consumer harms relating to token speculation and fundamentally unsolvable UX issues for retail consumers.

[1] https://twitter.com/twobitidiot/status/1624563275760279554

Got this message in my Discord message requests, from 13 hours ago:

  Yo!*Welcome to [redacted]!*
 What can we offer you
 We providing quality crypto pumps. *We share the name of target coin in advance.*
 *We are professional cryptotraders*
 And finally, we show you how to beat the market and be ahead of everyone.

  **This is your chance to multiply your investment together with the cryptocurrency market whales**! 
 
 ** The amount of invites is limited! Hurry up to take your place there:** : [redacted]

You can read lots of comments in these threads about the cost/benefit analysis of mitigating the vulnerabilities. And whenever that cost/benefit calculation gets very complex, the default is to not get too worked up about fixing the status quo because "it's complicated."

Also, startups have such an advantage now that there is an ecosystem of COTS and SaaS tooling that can help you do a complete integration strategy. It's arguable MFA regulations would advantage startups because they don't have to deal with the complexity of legacy network piecemeal integration.

I planned and did the roll out of Yubikeys at the last place I worked, before there was a dollar in sales, and the lifecycle could be supported with 2 people (minutes at most out of each day for support) and an integration to our HR platform that automated procurement and mailing of keys.

While normally I would agree wholeheartedly with this, in this very instance I see meaningless abstraction in service of justifying consumer harm. The phishing TTPs outlined in the article can be mitigated with hardware keys, and the places in the corporate network where they must be part of auth workflows can be identified. There are people whose job this is in corporate networks of all levels of piecemeal quagmires. T-Mobile probably has people working on this now.

The TTPs outlined in the article could absolutely be mitigated by use of hardware keys, and this would reduce customer risk. You are right about the liability and support calculation, but that doesn't mean it's OK to shift risk to the customer because it's too expensive. It is a failure to not have implemented a physical key deployment, and it must be treated as a failure.

Lack of knowledge of vulnerability is not the limiting factor in this case. All a "free for all" would do in this case is make more noise in which malicious actors can hide in the logs.

"People" don't need to keep up, the internal controls team needs to keep up, and it's possible to staff such a team with people who know how to mitigate phishing attacks when you are one of the largest corporate targets of phishing by volume on the earth.

I agree completely. I didn't ask why government enforced regulation hasn't happened. I asked why industry self-regulation has failed. I've worked in a regulatory/security role for a major conglomerate before.

I'm not saying I expected self-regulation to work. But, if you are in a position of customers seeing direct harm every day, it's not unreasonable to ask why there is a failure here.

I recently had to leave working for a cryptocurrency adjacent startup because my stomach kept getting into knots about how oligarchs are doing a lot of VC funding in the space, and the reason they are funding it is to cement their authority.

There's enough purported primary source data here that I am inclined to believe this reporting entirely.

I'm not assuming anything, I'm pointing out a failure of self-regulation given the TTPs listed in the original article, which are distinct from fully insider-supported attacks, should not happen.

There is obvious, direct, and destructive customer impact here.

Edit: actually I know people working in security roles for T-Mobile, and I am sure they or their sister teams are trying.

I'm not calling for regulation on general security outcomes. I'm talking specifically about access controls on sensitive and highly privileged systems that have ripple impacts to consumer security, which should already be obvious best practice.

> T-Mobile declined to answer questions about what it may be doing to beef up employee authentication. But Nicholas Weaver, a researcher and lecturer at University of California, Berkeley’s International Computer Science Institute, said T-Mobile and all the major wireless providers should be requiring employees to use physical security keys for that second factor when logging into company resources.

> “These breaches should not happen,” Weaver said. “Because T-Mobile should have long ago issued all employees security keys and switched to security keys for the second factor. And because security keys provably block this style of attack.”

At what point do we consider industry self-regulation on this a total failure? You don't need to make Yubikeys a part of every auth workflow in your corporate enterprise if there are legacy systems/integrations, but you should at least do it for the things that can change customer mobile subscription details and there can't be any excuse.

Smart attackers are already/will add `sleep(SOME_NUMBER_LONGER_THAN_SCAN_SANDBOX_LIFETIME)` before anything that does FS or network access. Not to say that this wouldn't be a welcome addition, but the scanning needs to be understood in the context of the inherent limitations of large scale runtime behavior detection of packages when you have a fixed amount of hardware and time for running those scans.

Have you never known anyone in your life for whom this was a requirement? This is a pretty common occurrence for the less well-off folks I've known as the risk profile for lower-income insurance markets puts the cost analysis toward requiring referrals to "prevent excessive utilization."

The inevitable outcome when you have such segregated risk pools.

Money doesn't matter if you can't attract and retain talent, which is my main point. IDK exactly what you are getting at.