When Your Smart ID Card Reader Comes With Malware

I like playing with data. Rolling averages are simple to do and they are handy at smoothing out weekend spikes. Weekend spikes were a problem in the US because a bunch of people would get tested on the weekend and Monday would show a Spike. People (and Drs) have absolutely used data to lie - but I'm not quite convinced this is an example of "blood on their hands"

>However it also turned out that essential workers were the main spreaders

This is tantological. The people who were active were the ones spreading it. Yes. Fact.

>The military knew everything the Govt was going to announce at least two weeks before it was announced

I like to think that the government was well coordinated. This doesn't seem to be a bad thing. In the US, we had clear disagreement between different gov organizations and I'm not sure that is an improvement over "2 weeks of coordination"

>You could shut down corner shops at their peak times, which has racist elements to it, you could also shut down other businesses during peak time

This sucks. I hadn't anticipated this impact previous to this post and I appreciate you sharing this.

You don’t just burn a vulnerability like that without a target.

I had significant misgivings about the app and it's efficacy. It is those misgivings that mean I don't believe this is an accurate representation.

Firstly, and perhaps most importantly, a positive case report on the app had to be backed by a PCR result, which required a code provided on a positive PCR test. A bad actor as you describe would have only one shot at a malicious shut down (and would actually need to be Covid+ to do it).

Secondly, the exposure limit was... generous. Proximity and duration had to be sufficient to form a close contact that would then be advised to self isolate and seek a test. People walking past a bad actor loitering outside a shopping centre would not meet this criteria. The shop keeper would...

...but shop keepers, retail staff et al by and large did not have the app. Employers were actively preventing their employees from downloading the application to prevent having to close for staff shortages while they were advised to isolate.

Ignoring all of this, you get into the crux of the app with the "check ins". All venues were meant to enforce the "check in" procedure - in actuality, it was pretty much only restaurants that did so. Even if you "checked in" to a venue, _you had no ability to check out_ so that if a positive case was reported on the same day you happened to be at a venue, even hours apart, you would be flagged. This meant that every positive venue ping had to be reviewed by a person, who would be tasked with reviewing which of the contacts in the venue should be contact traced. The criteria for doing so was opaque - and without the knowledge of what time people left vs arrived - and the actual device:device exposure being invisible to the contract tracer - we can only surmise that an element of inference and good old fashioned guess work was at play. And as was publicised at the time - the contract tracers found themselves with very little work to do.

>Should I also mention the Prime Minister was telling everyone to get onto Zoom for their meetings and then later on a zero click zero day exploit in Zoom surface which conveniently had given GCHQ enough time to hoover up data off plenty of systems. LOL

The Prime Minister has repeatedly demonstrated himself to be fundamentally incapable of understanding even the most basic aspects of his job, let alone technology. Hanlon's Razor comes to mind here.

Actually, no. That's not what "rolling average" means at all. It means the average number from the previous seven days. There is no "lag."

It means that on May 9, it is the average from May 2, 3, 4, 5, 6, 7, and 8.

Then on may 10, it is the average from May 3, 4, 5, 6, 7, 8, and 9.

And so on.

Getting something that basic wrong makes me think there are other fundamental flaws in the rest of what you wrote.

Yes, that's what you would need to do if you wanted this.

OpenSSH comes with tooling that will sign arbitrary files, and can use either conventional SSH key files (for which it has a safety rationale, explaining why this can't weaken their security for their original authentication purpose if the signature algorithm works as intended) or a FIDO device.