randywaterhouse

Interesting writeup and cool that Mr. Ligh has provided these plugins / tools. On the whole though, doesn't appear to contain much novel information.

Of course, partition-only encryption has weaknesses in that the OS may store data in another partition (i.e. you've encrypted the "D:" drive but Windows just dumps a cached file to "C:", let alone the whole pagefile challenge). So you need to trust your OS to not write the masterkey to disk, which is widely acknowledged. I personally run with no page file, so memory ought not to be written to disk by the OS itself (barring a malicious adversary), although this solution isn't the best for someone on 1GB RAM.

Full-disk encryption would block this attack, i.e. encrypted swap on Linux (crypttab makes this quite easy) or system-drive on Truecrypt. Even if it's dumped to disk, you can't get it, again barring online access to the system. Online access this is all null and void regardless as they could just issue commands to dump memory to disk no matter what you've done!

As the stream opened (just now), the head of enginehere.com just mentioned he was worried about concurrents, specifically saying he thinks 65 concurrent viewers with video is about the max...

Hopefully it works, I'm watching and interested in how this works out! Just wanted to provide that tidbit before we Slashdot the feed.

It seems they must have, unless Facebook brute-forced or otherwise obtained the key which the database used to encrypt (two-way encryption, big no-no) the passwords.

Based on this article it's not immediately obvious how Facebook checked/knew that the password was in the pile, as opposed to just the user's email address. I'd think this means either they were given the encryption key by Adobe, Adobe simply gave them the plaintext keys, or they managed to get the key themselves (if it was weak).

Ninja edit: It appears there are sophisticated ways of figuring out the passwords without getting the key, and this is mentioned briefly in the bottom of the OP article. Also, this is the source for that info [0]

[0] http://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-pass...

Easy to configure, simple functionality, niche-use.

I think it's a pretty cool idea, and definitely might come to use it if I ever get a machine in-house infected with something interesting and I want to just toy with it (/ keep an eye on what it's doing). I'm sure this would be useful for security professionals dealing with all kinds of network-required infections (or not, as all the "BadBIOS" talk suggests).

Pretty cool stuff, I'm wondering if one could simply set this up with a set of iptables rules (on a Linux router, i.e. DD-WRT). Just drop all packets that aren't destined to the open internet, and even control which ports the isolated machine has access to (i.e. cut off port 80 and see if the infection/process tries to reach out on port xyz or something else).

Indeed.

The article is also published in 2011, I'd say this post title merits a (2011). Clearly not a current event, threw me off too.

I believe, personally, and know others who commit to open-source projects on a personal basis (and then those who I only read of on the internet), that many developers who work on these projects don't need monetary compensation in the normal sense.

Working on an OSS project is fulfilling in ways other than money, and some people really enjoy doing it in their spare time, etc. I know some of my friends from college who went off to do work at Facebook, Google, IBM, and they actually all enjoy submitting their code to open source projects for 0 dollars.

So while you're right there is some sort of "idealism" required, it's a common ideal in the culture of programming it seems. Supporting what one thinks is right, simply by nature of believing in it. Then you can go off to your day job at Google and make six figures.

I, for one, applaud the initiative, for which the bitcointalk forum announcement (by this post's submitter) exists here [0].

It's interesting to think of a system to support development of open source software, providing monetary compensation in addition to that feel-good feeling. The other day I was thinking if we could almost have a standardized commit message for developers seeking tips, something like <public bitcoin address><clearsignature of address with developers pgp key>, so that one could do this on a direct basis (and with certainty that their funds reach the dev).

This is NOT to say that I don't trust tip4commit, not at all. Think of the previous paragraph as an aside, a thought on how to tip in a way that guarantees all tips go to developers. If arsenische were less trustworthy there might be a greater argument, but I think people familiar with bitcointalk will know he's cool.

It's great to see an easy, less-painful, automatic way to have this done than simply looking up dev's addresses on an individualized basis (tedious if you like lots of projects).

Cool stuff.

[0] https://bitcointalk.org/index.php?topic=315802

As Peter (sibling) mentioned, the force would not be equal across the surface. If it was propelled straight (i.e. orthogonal to the radius of the Earth), then there'd be some serious eddy effects of airflow around the circular edge (cross-section).

Probably the best thing that could happen from a NOT-deform standpoint would be to have it launched at an angle, i.e. as if a quarter fell on the Earth and landed on it's side (neither face). This would present the smallest and most uniform cross-section possible (as opposed to the face of the quarter looking into space, the rim/edge of the quarter points up skyward).

Also air resistance is extremely tricky at "normal" speeds, let alone at 10km/s+, and I think the real factor would be the currents of air around the edges, massive turbulence = massive amounts of friction/heat on the edges. It would be a mess! Hopefully that makes it a little clearer :)

One would think at a speed that great (on the order of escape velocity, ~11 km/s) there'd be some serious deformation of the plate due to the frictional heat from the air on the plate.

Another piece of space junk? A lost relic to be found in Andromeda by friendly aliens? Only time will tell. Or maybe it basically disintegrated/melted off. But let's hope for a cooler story: it ends up beating Voyager.

Incredulity reflects how people really believe that other people may, in fact, operate in some sort of rational world. When we think of ourselves, for the most part, we tend to think we would make rational decisions in all circumstances we were faced in, especially those we are NOT in.

Irrationality of consumers is great for the retail economy, though, and while it defies years of economic logic, behavioral economics has been in the spotlight for many things these days, more so than simple rational-consumer theory.

(perhaps it's simply the logic of smart poor people in a stupid/deranged society?)

This is interesting, and in my opinion definitely deserving of the prize they got for it.

But I think it's real value (in contrast to "replacing A/C") is in developing markets, where a little wristband could really improve quality of life (in the sense that one isn't sweating to death in their shanty-town hut). Not only could it improve QoL, but it would also be much cheaper to install than a central air unit, and also much more feasible: everyone has a wrist, not everyone has an insulated home with consistent electrical service that could provide the power for a central air unit. Cool stuff!

I've found myself in a similar position, in the past (although not for a few years). SAD is a real thing, and it has actual physical consequences.

I remember when I had it I would change my workout routine (read: go from running daily to running weekly... Maybe... Okay once a month). Which would only further affect me as I experienced the effects of reduced exercise, and those endorphins were seriously missed.

Definitely following some of the advice in the article helps, although I never did any supplements. I've beaten it by surrounding myself with a fun group of people both professionally and personally, and I keep my eye on the prize (whatever project I'm doing for work). Putting my head down and working hard is definitely a great antidote for me, although I know if might not work for everyone (it might make things worse!). I found that with a specific professional goal in mind I could get up easier, go to the gym easier, go to the office earlier, and get through my projects more efficiently.

Make a routine and keep on pushing!

I agree, her thoughts absolutely don't diminish the significance.

The kind of science that isn't on the frontpage today [0] is driven by facts, empirical analysis, and of course theoretical postulation. I, for one, am glad that we can recognize scientists for their contributions to humanity, not taking away from their work by citing curious personal beliefs (as we see here).

So, bravo acqq, just wanted to elaborate my thoughts on your comment :)

[0] https://news.ycombinator.com/item?id=6623830

While I don't wholeheartedly agree with the honeypot allegation, I do agree that you should take most VPN providers with a grain of salt, be it that they are in fact a honeypot, occasionally leak data, or do shady things like actually inspect traffic.

An additional use, and the one I use VPNs for from time to time, is to throw off ad-network information and avoid over-disclosing information about myself.

I'll even just go to LocalBitcoins if I want the anonymity (at a premium, but that's a cost of doing business without a fully FINRA-compliant broker, of course LBC is a marketplace so it has no business being compliant).

And if I don't want the anonymity premium these guys make it sound like it's difficult to do instant trades... Meanwhile I've got Coinbase on Instant Trade up to 10 BTC per day, and other exchanges have similar options (if you choose to verify with ID/Bank Info/etc).

A very interesting read.

The final point is probably the most notable one, that key-generation immediately following a boot up can compromise the PRNG (as we know). Also a cool thought, comparing all those keys. I just compared the few keys I have hanging around (only of order 10, not 4 billion), and none of mine have common factors other than 1. Yay!

Spoofing host keys also sounds like a potential target, so you could spoof the server identity and then decrypt communications without having to deal with the actual key-cracking.

While I think you're right, in the sense that an attacker who can forge your DNS request for ssh.example.com to direct your SSH from 192.168.1.111 to 192.168.1.200 might have the ability to manipulate the TXT entry of your public key signature in the DNS records, it's a matter of who you think your attacker could be.

Security is all relative, but I'm quite sure it would be possible for your to just sign your public key signature (which is what the article covers), and presumably you've kept your private key a real secret, so that isn't forge-able (unless your enemy has cracked your 2046/4096-bit RSA key).