That doesn't really explain why there is a bunch of GitHub repos created as well.
If I remember correctly from Shai-Hulud 2, the attacker extricated creds by posting them in public github repos with minor easily reversible encryption. I believe it was double b64 last time.
I'm assuming the logic there is that every security researcher and company is going to pull and scan those creds for their stuff and their clients' stuff. So the attacker is just 1 of N people downloading it. As opposed to trying to send it to their own machine directly.
Ive used fp-ts, mainly for Either, Option, and Pipe. I tried out Effect for a new project, and have loved it. The initial hurdle was a little intimidating but I was productive with it within 2 days, and it's paid dividends. It's discord community was surprisingly great, and helped me turn an okay module into an amazing one.
Effect is huge, and does seemingly everything, but it probably does the specific thing you want to do now, with the ability to extend to the other stuff as you need/want
> That defeats the entire point of this arrangement, which allows them to investigate in situations where the legal requirements for obtaining a warrant are not met. (Which is the elephant in the room: the entire premise of this system is to bypass established legal thresholds).
This is just 100% false. If im pulling a prescription from a pharmacy its because Doctor Adams told me "I never wrote a prescription for Bill Barnes for percocet, but this state maintained record says that he filled a prescription for percocet at CVS #12345 on main street". That statement alone is enough to get a warrant for said pharmacy records.
> Nope. Invading privacy is invading privacy. Just because something is happening today does not make it okay and acceptable
Thats not what I was trying to say. My point was that the state already has this data, and I've already seen it before I get a copy of the data from the pharmacy. If you're concerned about the privacy of the data, you should consider the root issue of warrantless access to the PMP by investigators. Anything I get from the pharmacy is just a piece of paper that says the same thing that I already had from that
> Here is a wild idea: we have tjis thing called the internet and this other wild thing called PKI. Give the doctor a certificate pair and they digitally sign every prescription. You don't ever need to talk to the doctor, you just need to pull their public certs.
This is a great idea in theory, but currently has some problems. Some of them probably could and should be addressed, some not.
- Old people who dont want to learn. The PMP lets doctors get a list of every prescription filled in their name in a spreadsheet. You can sort and filter by where it was filled, patient name, type of medication, etc. Of the doctors Ive dealt with, maybe 10% knew about this and used it. A few learned about it from me, got excited, figured it out, and used it to its fullest extent. Most just went "yeah okay" and ignored it because spreadsheets are too complicated.
- Where are we storing this? Can only the doctor do it? From only one computer? Can his receptionist call in the prescription? Can anyone else access that computer? Basically is there any way at all for fraud to happen? What if its the doctor whos the one doing it? Ive seen pharmacists say "Were getting a lot of suspicious prescriptons from this one doctor" who was just flat out selling them to people who had no problems. E-scripts are a thing, and ive seen cases where nurses and receptionists hop onto the system to write illegal scripts.
> Since we're doing privacy, give the chumps that need the prescription a cert pair and encrypt their shit
My mom thinks opening chrome dev tools is going to get her arrested for hacking a website. Please dont put the onus of key pair encryption on her in any way
> + make it a crime to store any of their PII at pharmacy level
Im not sure if its a legal/regulatory requirement, or just a moral thing, but Pharmacists are highly trained, with a Doctorate in what they do, and they catch things. Whether its a Doctor wrote the wrong script, or a potentially lethal contraindication between meds. Them having records of what else a person is on is a legitimate medical use case. There may be ways to keep this sort of data without PII, but it would be another concern to address.
> You omitted the end of my sentence in your quote, which is operative in this case.
My apologies. I've re-added it with an edit note.
I think its a reach to say 'the system' was created to exploit 4th amendment loopholes, especially in this case. Again, the patients privacy isn't compromised by the pharmacies at all here. The state has its claim of a vested interest in prescription activity, much like with drivers licenses and vehicle registration, and has a database of said data, much like with licenses and vehicle registration.
If I start running tags to see where someone lives to stalk them, thats bad, and illegal. If I start running prescription data for someone to see what they're on and stalk them, thats bad and illegal.
If a car dealer says "These VINs on the car dont match, we think something was stolen" we can investigate it by accessing the state database. We will likely see some personal information of someone who isnt guilty of anything in the process of this investigation. If a doctor says "This person filled a prescription under my name that I didnt write" we can investigate it by accessing the state database. We will likely see some personal information of someone who isnt guilty of anything in the process of this investigation.
My assertion here isnt "Everything is fine, change nothing". Its "If you're concerned about privacy here, you are looking at the wrong target". Warrant requirements could be reasonable. Whether we get them or not, I think a good start would be auto-redacting Prescription Monitoring Program reports. If Doctor Adams says Bill filled a fraudulent script, because Adams doesnt write for percocet, I shouldnt see every name for every prescription on Adams' report. That should be redacted. Then if I see a script for percocet, which we've established is fraudulent, we then un-redact the "patient" name.
Again, CVS handing me a copy of a prescription that I already know is fake is the least significant issue at hand.
> Now consider states make it illegal to get birth control pills and retroactively go after anyone who has them prescribed. It's according to the law, ain't it?
Are we discussing legality, morality, what should be legal, or what should be moral? I agree that would be bad morally, and shouldn't be legal, and currently isn't. My original comment was regarding how the process currently works, and why. It was also to explain that any concern of privacy regarding prescriptions comes more from the department of health/board of pharmacies than it does from 3rd partys providing documents, as the documents arent invading privacy anymore than what already happens.
> The states should keep their noses out of this and in effect all drugs should be made legal.
The whole "your right to swing your fist ends where someones face begins" thing applies here. The problem with some heavier drugs, and their addictive nature, comes in how it effects others. When something is so addictive that a person would sell their own child to acquire more of it, maybe we should limit access to that thing. Ive known a lot of addicts professionally and personally. They come in various degrees of wanting help. Some are in denial, some would do anything to kick the addiction. Some don't care at all and would fight to refuse any help under any circumstance. Its a super complicated issue, "Just legalize all of it", and "Just criminalize and punish all of it" are both equally shortsighted solutions.
> we should make it trivially easy to get help
I agree 100%
> it should be trivially easy for a pharmacy to check if a doctor did indeed prescribe something without raping the privacy of everyone involved
It is, and they do. They call the doctor, he says "I didnt write this". Then he gives me a list of people who filled prescriptions he didnt write. The biggest invasion of privacy of unaffected people is when we have a confirmed suspect, we see what other doctors he filled a prescription for, and then go through that list with the new doctor to see what is and isnt legit.
So yeah, at some point in a table of a few hundred people I probably saw some names of people who were a doctors patient, and that they have a prescription from him. I've been inside their privacy just as much as the receptionist at the doctor's office and the pharmacy tech at the CVS
> how normalized the process for violating the 4th Amendment and patients' privacy is.
Well thats the rub, isn't it? Right now the courts don't see this as a violating of the 4th amendment. I can see the argument for requiring a warrant. Im not necessarily against the requirement, but this isn't normalizing a 4th amendment violation any more than license checkpoint (which the courts have also ruled isn't a violation)
Yeah, it could. People can also lie on affidavits for warrants, but it does leave more of a paper trail to catch the guy. Honestly I don't think I'd be against a warrant requirement, but I also think we need a way to speed up the warrant process a _lot_. Right now it often involves a 1 hour + drive to a magistrates office, 30-45 minutes of filling out paperwork by hand, plus the hearing, getting the actual warrant printed+signed+logged, then 1 hour + drive back to where you need to be. I think you'd see less pushback of warrants in general if it leveraged the technology we have. We should absolutely be able to file an affidavit electronically, facetime a magistrate, and get a warrant approved/denied that way.
But again, getting records from the pharmacy isn't really the issue. The government already has the records of the doctor that "wrote" the prescription. All the pharmacy is giving you is the physical copy of the record + data of who picked it up.
I used to work in Drug Diversion investigations, which is basically any time a prescription medication gets used from something other than intended bona fide medical use. Sometimes its doctors selling prescription drugs for non-medical use, sometimes its medical staff stealing.
The biggest thing we covered was prescription fraud. People stealing or forging doctor's prescriptions. Some were more subtle about it. Sometimes you'd see a patient filling a 30mg Oxycodone, 90 count.
Leads would come from either the Doctor, or the pharmacy. 30mg Oxycodone/90 is generally a "You are in massive pain and probably dying" prescription. So when a health 20 something year old walks in and has it filled for themself, it raises some eyebrows. They'd either call the Doctor to verify, who'd call us to investigate, or theyd call us and then we'd call the doctor.
But the state already has access to this information. All prescriptions are logged in the Prescription Monitoring Program, which I believe all states how now. Any Doctor can get a spreadsheet of all prescriptions filled in their name over the last N days, who it was prescribed to, what for, and when. It was an invaluable tool. Doctor Adams tells us he never wrote this prescription for Bill. We lookup Bill and see he has filled similar suspicious prescriptions from Doctor Charles and Doctor Daniels. We talk to Charles and Daniels and they tell us that Bill isnt their patient either. We encourage Charles and Daniels to check their PMP report, and they uncover 4 or 5 more suspicious prescriptions, and we just keep pulling at this thread uncovering more and more.
Of course there is potential for abuse and neglect, but we werent (and couldnt, legally) just go into a pharmacy and ask for random documents, or lookup random names on the PMP. We had to have an initial lead, usually a doctor, or a pharmacist, who saw something suspicious. From there, its just checking state records, verifying what we saw with doctors, and getting paper evidence of the stuff we already knew was false. I had maybe 3 cases where we had a red flag, called the doc, and they doc said "Yeah thats legit" and that was the end of the conversation. I don't need to know why this patient is on this narcotic, I just needed to know if it was a fraudulent. If its not, then thats between the doc and the patient.
State law gave us authority to request pharmacy records, i.e. prescriptions and pickup logs, without a warrant. Most pharmacists did it with no hesitation. A few would want to make sure it wasn't a HIPPA violation (it wasnt) and that it was legal (it was).
Concerningly, I did have a_couple instances where I asked for documents and the employee started to provide them before I had a chance to identify myself.
In summary, if we were to blindly look at someones medical history or records without a bona fide articulable suspicion of a crime, it'd be massively illegal. If we did have a reason to look at the records, its because someone in the medical field saw something suspicious and reported it. From there we were mainly looking at records the government already had, and then finally getting medical records from the pharmacy that was just paper evidence of records we already had.
I mean we can see a demonstrable and quantifiable MASSIVE decrease in meth usage and overdose circa 2005 when the Combat Methamphetamine Epidemic Act went into effect.
Also, it's still available without a prescription, last I checked, it was just behind the counter/required an ID to track if you're grabbing a pack from every Walgreens in a 50 mile radius in a single night
Plenty of people kill for no reason. I wouldn't rule out the idea of a non human lifeform doing the same.
I'm not saying I agree with the dark forest. I just wanted to assert that the dark forest idea isn't limited to "we have something they want". It could also include. "They're jerks"
Are you asserting that the caution against shaking babies was intentionally constructed for the sole purpose of the state kidnapping children? For what motivation, to what end? How orchestrated? Who is "the state"? Do they have a hand picked squad of CPS investigators to kidnap children from their targets, or do they just use any CPS investigator? Are the investigators in on it, or are they just thinking they're helping kids? Can you cite references for any of the answers to any of these questions?
Part of the testimony was that there is widespread detection. The claim is that UAPs are often a part of briefings and debriefs. Its also been claimed during the recent UAP related testimonies that a large number of military and civilian pilots have seen stuff, but either had no clear path to report it, reported it and were ignored, or reported and were harassed, or chose to not report it out of fear of harassment.
What does that even mean?! Will this take the Christian path of forgiving our enemies, turning the other cheek, and giving our shirts to people who steal our cloaks?
Is he saying that military AI should specifically target Philistines and the uncircumcised? Will the military AI enslave people but give them the option of freedom or permanent servitude after 7 years?
You can't base something on Judeo-Christian ethics because both the Hebrew bible and new testament are a giant compendium of people disagreeing with G-d and each other on proper ethics.
Fp-ts is one of like, 4 things in life I feel the need to shill for. It's docs are a little rough coming into it for the first time, and I think some of gcanti's tutorials are a little to complex. But I've slipped it into 3 or 4 moderate sized projects. Every time someone goes to touch it there's initial confusion, a 5 minute explanation of Either, 5 minutes of Q and A, and then they love it.
My first thought would be, "What is this? Is it a common chemical?". Then I'd probably call the article click bait even though it says it's common early in the article.
Ok, so I'm not the only one who's noticed the wrestler walk? Like, something in their posture or their gait. Idk what it is, but you can just eyeball a dude and be like, "yeah he knows what a Granby roll is"
IMO this is one of the beautiful things about Judo/BJJ. I'm bad at BJJ. I know that. Yeah I can manhandle a dude my size who's day 1 no experience. Anything more than that is me trying my best and then going easy on me. I passed that purple belts guard but he could've stopped it if he wanred to bad enough.
Then you roll with a legit seasoned black belt, and realize you are even worse than you thought.
And it's not because of the team, or the gear, or someone cheating or lag in a videogame. It's just him being better.
And you either let that beat you up, or you look forward to how high the scale goes, and keep on growing
If I remember correctly from Shai-Hulud 2, the attacker extricated creds by posting them in public github repos with minor easily reversible encryption. I believe it was double b64 last time.
I'm assuming the logic there is that every security researcher and company is going to pull and scan those creds for their stuff and their clients' stuff. So the attacker is just 1 of N people downloading it. As opposed to trying to send it to their own machine directly.