joelanders

Is there a reason "fork over" and "shell out" can both (roughly) mean "fork and exec a shell" or the seemingly unrelated phrase "pay?"

Stumbled across and started reading A. E. van Vogt's "The World of Null-A" last night.

Super trippy.

https://en.wikipedia.org/wiki/The_World_of_Null-A

http://www.amazon.com/World-Null--E-Van-Vogt/dp/0765300974/

Here's a pretty comprehensive guide:

https://help.riseup.net/en/gpg-best-practices

I just posted this Linux Journal article from 20 years ago, "Linux in Antarctica." We've come a long way.

[0]: http://www.linuxjournal.com/article/2843

[1]: https://news.ycombinator.com/item?id=8571947

Yes, that's my understanding as well; my other comment was sloppy. I'm unsure what was meant by "hook," though. Is that something you set up with the target process running under a debugger? That much privilege wouldn't be available to apps in an app store, right?

See links for a bit of reading about how hard it is to break DRM on Spotify or Netflix. They're doing a lot more than Snapchat. The difference between "you just need to reverse engineer the HTTP API to make a 3rd-party client" and "you need to run IDA Pro and PANDA and whatever else" is significant. The latter exploit would have far less reach.

[1] http://moyix.blogspot.de/2014/07/breaking-spotify-drm-with-p...

[2] https://www.usenix.org/node/182951

There are trusted software client things (Spotify, Netflix, etc.) that seem to work well enough. Snapchat should be able to do better.

I wonder how they "confirm[ed] out of email that the keys we exchanged were not intercepted and replaced by your surveillants." Key exchange is the hardest part.

I think the weak link in the chain is only after decryption, but before uncompression (for lossy formats, so books excluded). See, for example, [1] and [2], where the authors look at randomness and entropy measures of I/O to find where the decrypted-but-compressed buffers are.

[1] http://moyix.blogspot.de/2014/07/breaking-spotify-drm-with-p...

[2] https://www.usenix.org/node/182951

Steven Levy's _Crypto_ (referenced in the article) is quite good (as is everything he writes).

Check out the stuff made by Alphasmart. A larger display would be nice for editing.

I'm going to get downvoted for being a grammar nazi, but this disingenuous "spokesperson" should know the difference between "insure" and "ensure."

Regarding machines and discoverability: I think an interesting comparison to flesh out would be computers vs. cars. Compare how tinkerers in each came to be (opening up their parents' car/computer, for example). Compare how "the average user" treats the thing when it breaks. Etc.

I haven't read this book yet, so I don't know about "triggered" vs. "enabled," but it seems relevant (came up in a talk about American companies providing deep packet inspection / internet censorship tools to, eg., Iran.)

https://en.wikipedia.org/wiki/IBM_and_the_Holocaust

http://www.ibmandtheholocaust.com/

web of trust

There is an awkward period (after clicking past the warning and before verifying the signed SSL certificate fingerprint) which is no more or less safe than HTTP, but which is more cumbersome and might encourage often-bad behavior in some users. After verifying that the certificate is signed by her (which requires trusting her public key--more hoops), you get some benefit.

It's difficult to weigh the cost/benefit, and nobody is denying that PKI can be awkward.

/thread?

ed: ok, i guess we might still debate the cost/benefit of getting a free cert--i don't really know.

The site's audience is going to be technical.

She explains how to check the SSL certificate fingerprint here:

https://blog.patternsinthevoid.net/isis.txt

Once you've whitelisted her self-signed cert, you know from then on that you're not being MITMed (for what that's worth in a blog).

Her.

If you like this, you'll also like Peter Stuge's 30c3 talk: Hardening hardware and choosing a #goodBIOS

"A commodity laptop is analyzed to identify exposed attack surfaces and is then secured on both the hardware and the firmware level against permanent modifications by malicious software as well as quick drive-by hardware attacks by evil maids, ensuring that the machine always powers up to a known good state and significantly raising the bar for an attacker who wants to use the machine against its owner."

http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_...

And this is the best blog post I know of on the above:

https://blog.patternsinthevoid.net/replacing-a-thinkpad-x60-...

I just submitted a blogpost from the Tor Project (Mission Impossible: Hardening Android for Security and Privacy) which covers everything between removing the microphone (from a Nexus 7) and baseband software to recommended apps and configurations.

On HN: https://news.ycombinator.com/item?id=7715041

Original: https://blog.torproject.org/blog/mission-impossible-hardenin...

When we talk about making programming accessible to kids (or anyone new to it), I think of how selling and distributing software is different now than it used to be. Webapps and app stores make it easy to reach thousands or millions of customers, but what's the modern equivalent of a kid writing something in BASIC (or VB) and selling a few copies to friends, parents, local businesses, etc.?

Some kind of Ruby/Tk/SQLite bundle that produced a universal executable (say, mac, win, lin) would be cool, I think.

Another cool piece of mechanics this reminded me of: the Master Lock Speed Dial (https://toool.nl/images/e/e5/The_New_Master_Lock_Combination...). I think there's an animation of the internals somewhere out there, too.