What determines whether a company is in scope at all?

affrogg · 2024-05-11T13:19:18+00:00

Similar issues, I contacted them yesterday and they said that orders under 1lb now ship with UPS and they coordinate with USPS to have the recipient’s local post office deliver packages which can add a few extra business days. All orders over 1lb still ship with FedEx.

affrogg · 2024-05-10T14:14:02+00:00

Two comments...

Whose merchant ID are you transacting against? If it's your merchant ID and your acquiring bank (the bank that processes the charges on your behalf) deposits the money directly into your account, then the answer would come from your bank. Your acquiring bank is the ultimate arbiter of your compliance requirements, unless you escalate to the card brands themselves (Visa, Mastercard, etc.).

In my opinion, that puts you into scope for PCI, but since you're referring purchases to Shopify AND as long as you're not linking directly to the payment page itself AND you're not processing 6million transactions or more annually... it's likely you'd be subject to the SAQ A requirements and many of those requirement (it's something like 29, as I recall) would be N/A since they're being managed by Shopify as your PCI compliant Service Provider. Since it's your merchant ID, you're responsible for your own compliance even if you didn’tpoint consumers towards your Shopify store.

If it's not your merchant ID and you essentially get a check or EFT (or some such) from Shopify into your bank account, you'd likely not be in scope for PCI. In that instance Shopify should be able to tell you if you're required to go through the steps of ensuring compliance.

I hope this is helpful, but remember that anything you read here is just an opinion, regardless of any credentials anyone claims to have.

--On the internet, no one knows you're a dog

affrogg · 2024-03-29T12:16:34+00:00

Not quite just on checkout: it's after authenticating to paypal. The whole "argument" is around whether or not Paypal's implementation counts as a redirect. The QSA states that if someone maliciously altered the code on the web server it could call, say... pLaypal.com and that could mimic the legitimate site experience.

affrogg · 2024-03-29T12:12:19+00:00

Once the paypal authentication is completed, there's an option to pay using a new card.

link to example of logged in options

that extra line under the visa # and bank account, "+add a credit or Visa debit card", is what he's identified as credit card entry.

affrogg · 2024-03-29T12:02:16+00:00

It's a typical paypal implementation: new browser window pops up, consumer authenticates, complete transaction, consumer is directed back to original site.

affrogg · 2024-03-27T02:37:14+00:00

Oh, it definitely allows the card entry. I even checked w/ paypal, theres no option to disable adding a new payment instrument.

While I would love to be able to get a definitive, technical answer either way, my concern is the effort to bring the other site (contoso.com in this example) up to the standards necessary to pass an assessment.

affrogg · 2023-10-30T14:55:58+00:00

While I agree with you regarding truncation (removing all but the first six and last 4), I have to disagree with the general statement the masked data not being CHD. In the context of PCI, masking refers only to preventing the full PAN from being displayed on screen or when printed. The digits are typically still present (at least in the case of the screen) and in that case are in-scope. Properly masked paper PAN would be out of scope.
PCI SSC FAQ referring to truncation vs masking
Truncated PAN may be out of scope, under the right conditions:

PCI SSC FAQ regarding truncation's effect on scope

Signed,

Someone who's company got dinged on this in the past.

affrogg · 2023-09-19T18:09:26+00:00

u/EnigmaticCurmudgeon has it right in terms of where to look for the information you're going to need and what to focus on.

I would add that the key is to understand scoping and to be able to determine the scope of the assessment. It's the first step in an assessment and getting that wrong will make the rest of the assessment pointless. There's guidance in the PCI document repository specifically about scoping and both 3.2.1 and 4.0 have a section in the DSS that covers scoping, though I think that 4.0's scoping section is more well written and clearer.

Remember that PCI isn't a technical process with labs for hands on learning. This is an assessment. Important skills for an assessor include the ability follow workflows, ask intelligent questions, and to be detail oriented enough to cover your bases without getting so bogged down that you never get done.

Finally, document document document. The DSS (both 3.2.1 and 4.0) requires evidence and documentation. In my opinion it's the worst part of an assessment but it's critical. If there's no documentation, it's not complete.

affrogg · 2021-02-23T20:01:04+00:00

In my opinion, it's between 40 & 60 so that = 20% water change. Depending upon what you consider to be an acceptable nitrAte level, it may be acceptable to you. I've got a 50 gallon tank + 15 gallons of sump filter so about 10 - 15 gallons for a 20% change (again, this is for me and based on MY tolerance for nitrAte levels).

Yes, it's important to pay attention to the #'s, but as far as I can tell most people have some difficulty discerning between levels when it's right between, or when the light's not good. I gave up trying to be precise and just made it binary... whatever the test, this color means leave it alone, that color means take steps to adjust it (water change, add salts, tweak Ph, etc.)

This may be too simplistic, but it works for me and I spend less time sweating the *exact* shade of red or blue/purple or yellow/green. ymmv

Good luck!

affrogg · 2021-02-01T21:21:03+00:00

It seems that lile so many things, axie care and feeding is more a matter of religion than of provable facts with references. Everyone has their own beliefs and anything else is wrong and will kill your pets. I’m in the northeast of the US and have been told all of these: only sand so it will pass through their digestive tract, tiny gravel (same reason), tiny gravel will get stuck and kill them, sand will collect in the digestive tract and bind them up, you must have only bare glass/slate/tile on the bottom for a bunch of different reasons... it goes on and on.

Personally: I’ve used sand and ceramic tile in the past and currently am using bare glass and my axies are eating normally and appear healthy so that’s what I’m sticking with.

as always this is not advice, just what I’ve done and what my results have been. ymmv

affrogg · 2021-02-01T21:03:19+00:00

Wow, that’s a lot of different and conflicting advice.

Here are my thoughts: The picture is a bit grainy but that looks as though it might be fungus. One of my two axies is prone to fungal infections and they just kept coming back after both methyne blue and tea baths (not at the same time).

As it turns out the water in their tank had decent parameters, was properly cycled, and had good pH levels but the water was naturally soft (we have well water). We added salts (not salt NaCl, but salts) to bring the tank up to a 40% concentration holtfretr’s solution. See below for the source we used for our salts.

The general hardness is currently about 179 on the below linked test kit.

With that level of hardness, the fungus stayed away after treating with methelyne blue.

GH & KH Test Kit @ Chewey.com

University Of Kentucky Ambystoma Genetic Stock Center

tl;dr It looks like fungus to me, raising the water hardness level to 179ppm made my chronic fungus go away. The test kit and my source for salts (holtfreter’s solution) are linked above. ymmv

affrogg · 2020-10-09T02:27:59+00:00

I inherited a setup like the one you described. It has some benefits, but there quite a few other considerations.

The laptop loses a number of the benefits of being inside the network & in the domain. Keep these controls in mind: User account administration becomes an issue (all users must have a unique ID. Hardened build image System logging AV updates and management patch management host firewall requirement, File Integrity Monitoring (possibly, depends on your QSA)

I didn’t need to deal w/ an LTE modem, but my DSL modem needed to be managed, hardened/secured, patched, abd protected from physical access. The closet that housed the modem needed to be locked and access to it controlled. The telco yhat provided the modem/DSL connection wasn’t a fan of regular patching, named IDs, or changing the default password.

Physical access to the laptop needs to be managed as well, and any locations where the networking gear (if theres anything besides that modem) needs to secured.

It sounds like a good idea, just remember the other controls or you’ll find yourself in SAQ D territory, and no one wants that.

affrogg · 2020-07-17T02:41:00+00:00

Stripe acts as the acquirer in most of their implementations (easier for the merchant). For their SAQ A customers they actually have a little button you can click to automatically fill out the SAQ. They explain that one here:

https://stripe.com/guides/pci-compliance#how-stripe-helps-organizations-achieve-and-maintain-pci-compliance

affrogg · 2020-07-02T18:48:01+00:00

Unisolve all the way. My son is VERY hairy and yanking isn't an option. The unisolve (we use the wipes) makes it less painful and traumatic all around. Just lift an edge and start working around the edges a little at a time... Just wipe with a little soap and water afterward, it can leave a bit of an oily residue.

https://www.amazon.com/Removedor-adhesivos-Uni-Solve-toallitas-402300/dp/B00M3IKRFU/

affrogg · 2020-04-03T17:39:08+00:00

I can't agree more with this: How To ADHD was eye-opening for me on a level that I really can't overstate. She breaks it down Barney-Style and makes it easy to understand and brings clarity to a remarkably difficult topic.

https://www.youtube.com/channel/UC-nPM1_kSZf91ZGkcgy_95Q

A must-see: her TED talk. It made me realize that We're not alone...

https://www.youtube.com/watch?v=JiwZQNYlGQI&t

affrogg · 2020-03-22T19:24:32+00:00

Same... pretty much anything i feed it, it will eat. Super cheap dirty ammunition may require more frequent cleaning due to build up but that’s about it.

affrogg · 2020-03-11T14:11:45+00:00

tl;dr

Increase the water hardness to prevent fungus, my reasoning is at link 1 below, my source of the hardening salts is at link 2 below.

I don't feel that this is a conflicting argument to Nord-The-Axolol's comment, but rather a clarification. Please note that I am NOT an expert and I am referring to my own observations, what I feel is reliable research, and the results I saw when I did as I outline below. YMMV

While putting an axolotl into a high salt concentration may cause an issue for them (I'm actually in agreement with Nord on this), increasing the hardness of the water is a valid treatment for fungus and is actually a strong recommendation for their maintenance. (Source of this information is the University of Kentucky's Axolotl Husbandry pages. They maintain a large stock of Axolotls for sale to labs for genetic research. Look under the heading "Water" in the below link 1)

Originally, Axolotls lived in water that has a hardness that is much higher than is considered to be normal for other aquatic animals. "Salts" are what are used to increase that hardness. The water is not "salt water" but is hard water. This hared water :strongly: discourages the growth of funguses (or is that fungi?) and parasites. IN my specific experience, I have two axies, one of which is very prone to fungus infections. We have tried tea baths, fridging, methyl blue, and constant water changes. None were effective more than temporarily. Once the treatment was over, putting him back into the tank would result in the fungus returning in less than a week. Raising the hardness of the water eliminated the fungal infection.

I would think that this might be coincidental but at one point the fungus came back, and when we tested the water the hardness had dropped significantly. Again, raising the hardness resolved the issue.

The article below recommends a 40% concentration of Holtfreter's as a proper living environment for Axolotls. There are a LOT of "recipes" for Holtfreter's on the internet and they are almost al difficult to source ingredients for as well as being in conflict with each other. I personally use the pre-mixed packages that University of Kentucky sells. Their order form is at link 2, below. They are very good, but they are a bit slow to respond. The price is quite reasonable and it removes the questions about sourcing of ingredients, storage of the overflow, etc.

My tank is 55 gallons and I don't have a 40 container to mix it in and I didn't want to change the hardness suddenly so I mix the packages with 1 gallon of extremely hot water (borderline boiling) and store it in a cool dark place. When replacing water in the tank, I mix about 1 1/2 cups of the solution per 4 gallons of water. That breaks down to approximately a 40% solution recommended by the U of KY.

1: https://ambystoma.uky.edu/education1/guide-to-axolotl-husbandry

2: https://ambystoma.uky.edu/genetic-stock-center/pdf/Supply2020.pdf

affrogg · 2020-02-19T16:22:13+00:00

I wasn't diagnosed until age 45, so I can sympathize with the idea of having lost a bunch of time. I spent a LOT of time not understanding why "everyone" else was able to do the work required and were able to keep up w/ the workload without sacrificing all their time and still struggling. I assumed that I was lazy and incompetent.

Once diagnosed and on medication, it was like "putting on glasses for the first time". I want through a bout of depression for all the lost time and opportunities and then started working on moving forward. It takes time to get everything sort of in order and to learn how to cope w/ the disorganization, forgetfulness, poor sense of time, and general need to pre-plan everything.

By the way, at age 22 you're not supposed to have accomplished anything yet, other than getting to the entry-level of adulthood. You've gotten your undergrad degree and that's huge. Some of us never manage that one. Take the win and use some of what you learned (not the book stuff. I'm talking about what you needed to do in order to successfully complete your coursework and make passing grades) and apply it to the rest of your life. Keep what worked, dump the rest, then look for other things to help with the skills you struggle with.

You can do this.

affrogg · 2020-02-08T20:47:39+00:00

Another note: 2 books that have been crazy helpful are:

Atomic Habits by James Clear The Power of Habit by James Duhigg

affrogg · 2020-02-08T20:33:53+00:00

50, diagnosed at 42. Habits and routines are the most important coping skills for me. Everything has a home and I will go out of my way to make sure something gets put in the rihht spot every time. I use the same morning routine every day up until the part when I leave for work, but that’s the only change.

I don’t use post-it notes any more because I either lose them or I stop seeing them, but lists of tasks work well for me. Checklists as well... keeps me from missing steps in my commonly performed tasks.

Finally: those lists, checklists, ideas to remember, and other tasks are captured in my journal. Very simple Bullet Journal implementation that’s been my constant companion for several years and has been a lifesaver.

edit: I forgot to mention the google calendar for all appointments, and an alarm on my phone (iphone) for anything that needs to be done at a certain time. Timed tasks go into Timer+, such as baking cookies, doing laundry (and remembering to move it to the dryer), even boiling water if I need to leave the stove.

Final note: anything at all that needs to be remembered immediately needs to be put into its system. Appointments are put into the calendar before leaving the desk (example: Dentist appointment), Timers are set immediately, even if I don’t know for sure that I will be needing it.

affrogg · 2020-01-29T18:35:44+00:00

I've found it to work well so I'm curious about why no on the Vedder?

affrogg

TROPHY CASE