Hacker News new | past | comments | ask | show | jobs | submit | zhongjiewu's comments login

Correction: not arrest. They were summoned and given written warnings. China is quarantine one Province. Travel between other provinces are still not affected. International travel bans is basically as strict as traveling out of Hubei province, stricter than average travel restrictions in China.


That's an arrest. Arrest does not mean you go to jail. You're taken in for questioning for up to 24-48 hours at which point you must be further charged or released.

> International travel bans is basically as strict as traveling out of Hubei province, stricter than average travel restrictions in China.

The Chinese government censured doctors who sounded the alarm, and you want other countries to follow their advice? I'd say exercising more caution than China advises is appropriate given how little we know about this disease.


Honestly I think it is hard job to get an accurate reporting giving the scale of the problem. We are talking about a single digit accuracy at the scale of 10k+. Even in H1N1 outbreaks, the medical visits and death tolls in the US was estimated with a wide band. That being said, the death of un-confirmed patients could be intentionally ignored to make the problem look not so big. But this is not a unique thing to authoritarian governments.


It is not entirely true. This sacrifice entails two things. On one side, without a lockdown, people in Human can seek medical help in other cities and provinces when they get sick. After a lockdown, local medical resources are in severe shortage hence higher death rate. On the other side, it limits the spread of the disease for the good of other provinces and hence the rest of the world. If this isn't sacrifice, I'm not sure what sacrifice is.


> After a lockdown, local medical resources are in severe shortage hence higher death rate

No, this is false. Supplies and doctors still came in after lock down. Lots of them because they were not needed elsewhere.

> On one side, without a lockdown, people in Human can seek medical help in other cities and provinces when they get sick.

This is also false. As soon as they leave they spread the virus any other hospital will become swamped and just the same.

There sacrifice is they don't get to spread the virus and make everyone else as bad as they have it. Not quite true.... They would have it worse since they will lose resources if it spreads. But they do miss the comfort of being the same by not spreading it. That is all.


> Supplies and doctors still came in after lock down. You mean the government get doctors from other cities to Wuhan because they are not needed, regardless if Wuhan is in medical shortage? This is a weird logic that I cannot agree. IMO, mobilizing doctors from hundreds of miles away, which costs a lot money and management effort, is exactly an attempt to solve the shortage issue. There are various video materials showing super crowded hospitals in Wuhan and other Hubei cities. It is also consistent with building not one, but two temporary hospitals with thousands of workers at much pricier cost.

Based on the activity data from TV news, fever related medical visit stays in single digit nationwide. If lock down are not announced and enforced, people in Hunan that are richer will flood to other cities such as Shanghai and Beijing for better medical services, as this happens from several news reports. People would choose to travel since their immediate action will not cause medical shortage elsewhere before they are handled. The idea of seeking medical help elsewhere will make matters worse is correct, but it is a macro level insight and will not change these people's mind to grasp these resources before they are gone.

It is not deniable that without a lockdown, people in Hubei province will on average get medical help in the short run and everybody else is much worse off. This is why it's not a sacrifice.


Ironically, there are aircraft carriers moving around the oceans forcing some countries regarding some agenda.


> Ironically, there are aircraft carriers moving around the oceans forcing some countries regarding some agenda.

What irony are you referencing specifically? The United States' usage of carriers to threaten the PRC? The PRC's usage of carriers to threaten the ROC? Some other countries?


There exercising their "freedom of navigation".


With a literal gun to a figurative head.


I agree, if there is a region with the labor force and good policy for investment plus infra and a few other things. Vietnam is a close enough option, but other options are not abundant, so more than just a few years would be a plausible answer for me.


China for long was a phenomenal combination of size, quality, and a price for workforce you can't find anywhere.

Eastern Europe - mass higher education check, everything else no

India - size yes, but nothing else, and there is "license raj" on top of that. One sweetener is the future domestic market appeal

Vietnam - mini-China, good primary and vocational education check, size OK, industry, some leftovers from pre-privatisation era, check - pretty much same as China was in that regard.

Pakistan... very cheap for sure, existing industry is nonexistent, (though Pakistan once had a backend FAB in late eighties!) and with Rupee hitting the bottom now, you can overlook how poor the logistics will be.


Do you use a three level hiearchy on the image? I assume you guys first down sample to full resolution preview(like 600x400) and a low resolution preview. When editing, filter applys on the low resolution preview and then full resolution preview (1.5second latency). When exporting, you apply all the filters on the original image. Is it the case?


I've been following the development and progress of you guys for the past month (after I saw Tom speak at the Google event) - glad to see the funding has come in. I became very intrigued after that Bitcoin conference, and thank you guys to helping me learn about the industry.

Wish you all best of luck on journey.


This is exactly how it works. And a lot of apps use this JS bridging technic to make their app easy to maintain. Dirty hack becomes technical debt


Please disclose more technical detail


It's a vulnerability on Android Webview component, which supports a "addJavascriptInterface" method. This method allows you to call the Java native method by using a Javascript object inside the webpage. And, there is a trick that can bypass the restriction on classes that JSInterface object could access. You can call any method in any Java class. Such as Java.lang.Runtime.exec. You can google "addJavascriptInterface vulnerability". It's not a new vulnerability, but lots of app haven't fix it yet.


I wouldn't comment on their AntiVirus stuff but I think the vulnerability in the Bing App is real.


Sounds like very dangerous attack and not very difficult to implement.

DNS hijacking:

1. Quicker DNS response than router to pollute the Android's DNS

2. Rouge AP that pretend to be common free public wifi like "att", "starbucks", "cablewifi" or "Free Public WiFi"

3. De-authenticate valid AP connections and force user to try rouge WIFI

MITM attack: 1. ARP spoofing


Correct ;-)


That's a universal network attack though, how is it an exclusive vulnerability to this app?


You would never be able to install an app without user click "install" etc.

This one uses Javascript Bridge vulnerability to execute high privilege code in your Android. The attack code is javascript to be interpreted to Java calls in Android.

You wouldn't be able to do that in iPhone though.


Bit confused as to how this can't happen on iOS "just because," as iOS apps could be targeted in a similar way. Really the message here should be that SSL with certificate-pinning is a must for apps that inherently run in untrusted environments with an inability to easily inspect the security of the network traffic without MITMing it yourself. Wish this was a security feature on the app store -- if, in automated testing or in device logs, an app was entirely secure or insecure with its communication, just as we've padlock icons in browsers today.


iOS apps cannot be targeted in this way because they don't have the JavaScript bridge.


Not exactly. iOS 7+ introduced Cocoa<->Javascript bridging capabilities in the public APIs. Before that, similar iOS APIs had existed as "private" ones (so, very uncommonly used outside of apple's own apps).

iOS doesn't bridge Javascript to _Java_ which is why this particular attack wouldn't work. But the JS<->Cocoa stuff is still pretty young, so wait and see ;)


The JS-Cocoa bridge isn't young at all, it's the same bridge that has been on Mac OS X for years. And it's opt-in -- on the native side you have to specify which classes can be bridged and what methods can be called. It's not the case that any bridged webview exposes all of Cocoa for your JS injection pleasure. You could write an app that specifically exposed some dangerous API, but you'd know you had done so.


> You could write an app that specifically exposed some dangerous API, but you'd know you had done so.

Few people write insecure code on purpose. Of course the same is true of Safari or networking/parsing code. I still maintain certificate pinning is the answer here, to try and defend as much as possible against MITM in the first place.


Thx Zhongjie ;)


Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: