Means nothing, until the expiration of the lockup period (where employees cannot trade stock). That's typically 90 days, or longer.
At which point, the stock is well-traded on the open market and has found a "correct" market price, with no necessary relationship to the valuation at IPO.
I'd be astonished if any of what you wrote above is true.
State regulators do not "surreptitiously test" Schedule I drugs on the public via retail sale. That's just inane.
There is no legal classification for "magic mushrooms", but I am willing to bet that the products for sale are legal, and do not contain psilocybin or psilocin.
They're just some unregulated compound that might have come from mushrooms, but is more likely made in a lab, and may or may not be mildly psychoactive.
And they'll probably add some caffeine and theobromine, which boardwalk denizens will feel the effects of and not know precisely how to categorize.
I get how you could misread it, given his use of the word surreptitiously, but OP is not suggesting that the state is testing the products on consumers, but instead that they occasionally test the products to identify what they contain and what is being sold.
You're right, I definitely misread that part. Apologies!
FWIW, OP's framing is still misleading though. Regulators do not test retail product as part of some kind of surreptitious sting operation, which they then do not bother to follow through on.
The Department of Public Health responds to complaints, and patterns of medical reporting to find a cause and determine whether there are legal or health code violations. The sale of 5-MeO-DMT (or psilocybin or psilocin) would be shut down, and charges filed.
The sale of 4-Aco-DMT would be legal, so instead they issue warnings that amount to "That thing you bought that was sold with claims of similarity to an illegal drug does actually have physiological effects even though it's legal, so be careful.". Which is fair enough!
Having done 4-AcO-DMT and Psilocybin (4-HO-DMT), I would not be able to distinguish them in a blind test.
I actually prefer 4-AcO because it's easier to get a consistent dose with (mushrooms vary in potency) and doesn't cause the nausea that consuming dried mushrooms sometimes causes.
It's almost the same thing. Both psilocybin and 4-aco-dmt are just (?) prodrugs for psilocin which is the psychoactive compound associated with magic mushrooms.
It's not like those horrible synthetic THC analogues we see in Europe that can kill people.
Any exploit might be interactive with a backend component that generates and serves payload components based on interactive responses.
OP (and anyone else who exploits the server) would be able to see the transcript between the backend and the vulnerable server, containing the payload customised for the server, but not the actual code of the backend. This would be useful if it was a 0day vulnerability, but with a disclosed vulnerability getting a payload that doesn't work except on their server, without the code that generated it, might not be that much value over what they already have.
That said, there are other ways to scam by structuring things like the OP (none of this should be taken to imply the OP has actually done this, but rather why this structure as a general approach might be a bad idea):
* This could be a 'stone soup' scam where the OP has the wallet keys (obviously), and puts this up to bait the addition of more funds into the wallet by other interested people. The key might not actually even be on the server, or it might not be vulnerable. Once sufficient other people add funds, the OP could withdraw the funds, recouping their original funds plus anything others added.
* This could be run as a propaganda scam either to falsely sell that it isn't an easily exploitable vulnerability when it is (by making it unreasonably difficult to exploit compared to real-life deployments), or to over-inflate how exploitable it is (by an insider withdrawal from the wallet). Manipulating public opinion could allow an attacker with a working exploit more time, or help to sell services to fix the problem.
I think an alternative scheme that is less vulnerable to scams would be to have a ZKVM (Risc0 or similar) executing vulnerable code, such that the attacker needs to produce a zero knowledge proof transcript of getting the ZKVM into a particular state that would not be possible if they didn't have an exploit. It should also take an Ethereum address as a public input. Then write an Ethereum contract that will allow funds to be transferred to the public input Ethereum address if submitted with a valid proof transcript, and back to the source of funds after some time has passed. Everyone who wants to add to the jackpot could deploy their own version of the contract, so the one proof transcript could claim from all of them, but if unclaimed the funds go back to the source.
Alternatively (avoiding the risk exploits may be so large as to make the cost of producing the proof transcript impractical), they could be built using a public cloud provider's trusted computing offering (e.g. Google Confidential VMs). The person making the challenge could make it so the derivation (NixOS for example) to produce the entire image executing on the cloud provider in a deterministic way (with publicly known source, and hash codes of each stage publicly available). Then, from the code with the known hash, they use the vTPM to generate an attestation that a key was generated while the vTPM PCRs were in a known state (corresponding to the publicly reproducible hashes), and ensure the only way to access the key from the instance is via an exploit. It would also include logic to generate and wrap a Bitcoin wallet key, and emit the public key (with the attestations and a signature linking back via a vTPM attestation to the cloud provider's key). This way, unless the cloud provider is also in on the scam, people could be assured that the OP isn't scamming them.
The cookie use case is just one use case. Another PSL use case is helping browsers decide what part of the FQDN is most important for the user to notice. On firefox I see "ycombinator.com" in bold, with normal font weight on the news subdomain. On smaller screens the URL bar isn't left aligned, it adjusts the view to prioritize showing the relevant domain name. You don't want an attacker to control how the URL is displayed in that security context.
At which point, the stock is well-traded on the open market and has found a "correct" market price, with no necessary relationship to the valuation at IPO.
reply