semenko

There was a lot more follow-up later, see e.g. https://lkml.org/lkml/2012/7/5/422

The important commit here is:

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.g...

Excerpted:

Change get_random_bytes() to not use the HW RNG, even if it is avaiable.

The reason for this is that the hw random number generator is fast (if it is present), but it requires that we trust the hardware manufacturer to have not put in a back door. (For example, an increasing counter encrypted by an AES key known to the NSA.)

It's unlikely that Intel (for example) was paid off by the US Government to do this, but it's impossible for them to prove otherwise --- especially since Bull Mountain is documented to use AES as a whitener. Hence, the output of an evil, trojan-horse version of RDRAND is statistically indistinguishable from an RDRAND implemented to the specifications claimed by Intel. Short of using a tunnelling electronic microscope to reverse engineer an Ivy Bridge chip and disassembling and analyzing the CPU microcode, there's no way for us to tell for sure.

Take a look at OwnCloud http://owncloud.org/ and BitTorrent Sync: http://labs.bittorrent.com/experiments/sync.html

DNS aside, Name.com is one of the only registrars I know of with reasonable security practices.

They support two-factor auth (almost no one else does), and have nicely scoped cookies (HTTP only, Secure flag, etc.).

I was also looking to switch out some RV042 (tried the newer RV180 series -- terrible mistake). Finally settled on RouterBoard / MikroTik RB2011L-IN.

The feature base is incredible: http://routerboard.com/RB2011L-IN

Yeah, this piece is a little misleading. The author is referring to a nuanced difference between ethylene carbonate (EC) and propylene carbonate (PC) in the formation of a protective film around anodes.

See this (paywalled) review of electrolyte chemistry: http://pubs.acs.org/doi/abs/10.1021/cr030203g http://www.ncbi.nlm.nih.gov/pubmed/15669157

""" The unique position of EC as a lithium battery electrolyte was established in 1990 when Dahn and co-workers reported the fundamental difference between EC and PC in their effects on the reversibility of lithium ion intercalation/deintercalation with graphitic anodes.36 Despite the seemingly minute difference in molecular structure between the two, EC was found to form an effective protective film (SEI) on a graphitic anode that prevented any sustained electrolyte decomposition on the anode, while this protection could not be realized with PC and the graphene structure eventually disintegrated in a process termed “exfoliation” because of PC cointercalation. The reason for the effectiveness of the SEI has incited a lot of research interest in the past decade but remains an unsolved mystery, although it is generally believed that EC undergoes a reduction process on the carbonaceous anode via a similar path to that shown in Scheme 1. Because of the important role this SEI plays in lithium ion chemistry, the research efforts on this topic will be reviewed in a dedicated section (section 6). """

That may've been TTL-dependent -- though the record was only restored a minute or two ago. Educause is the EDU authoritative host.

It's worse than that:

   $ whois mit.edu
      
   Domain Name: MIT.EDU
   
   Registrant:
      Massachusetts Institute of Technology
      Cambridge, MA 02139
      UNITED STATES
   
   Administrative Contact:
      I got owned
      Massachusetts Institute of Technology
      MIT Room W92-167, 77 Massachusetts Avenue
      Cambridge, MA 02139-4307
      UNITED STATES
      (617) 324-1337
      cunt@mit.edu
   
   Technical Contact:
    OWNED NETWORK OPERATIONS
      ROOT
      US
      DESTROYED, MA 02139-4307
      UNITED STATES
      (617) 253-1337
      owned@mit.edu
   
   Name Servers: 
      FRED.NS.CLOUDFLARE.COM      
      KATE.NS.CLOUDFLARE.COM      
   
   Domain record activated:    23-May-1985
   Domain record last updated: 22-Jan-2013
   Domain expires:             31-Jul-2013

http://whois.educause.net/

I'd be interested to know what people were expecting from MIT (and would also like a public statement).

The dockets (1) suggest MIT made the poor (perhaps incidental?) decision to involve the Secret Service, at which point the evidence became part of a federal investigation.

I think the paragraph about MIT's "tepid" interest in the investigation is telling.

(1) http://tech.mit.edu/V132/N46/swartz/swartz-suppress1.pdf http://tech.mit.edu/V132/N46/swartz/swartz-suppress2.pdf

Just a general plug for the Flask framework: http://flask.pocoo.org/

A lot of you are probably familiar with Flask and its awesome Jinja2 templating system.

There's a well supported, officially approved extension called Frozen-Flask that generates static sites from a Flask/Jinja2 deployment: http://packages.python.org/Frozen-Flask/

"Now you are complaining that your hack stopped working."

Just by comparison, Android supports on-device APN editing (see Settings -> More... [under Wireless and Networks] -> Mobile Networks -> Access Point Names).

T-Mobile actually encourages users to edit their own APNs for IPv6 support, and has run an IPv6 custom APN beta trial for a while: https://sites.google.com/site/tmoipv6/lg-mytouch

See: http://forum.xda-developers.com/showthread.php?t=1419170

The OTA was released this morning (I've flashed my unlocked Galaxy Nexus to 4.2).

"but that's not how Google's services have ever worked."

That's not totally true. A few services (Wallet, Account Activity) require you to re-authorize yourself.

It's unfortunate that most Google products request "Full Account Access" (along with specific services) -- especially as most third party apps request only what they need. See: https://accounts.google.com/b/0/IssuedAuthSubTokens?hl=en

Nothing prevents genocide quite like a good mobile app #slacktivism

Direct link to the Chromium blog post: http://blog.chromium.org/2012/10/pwnium-2-results-and-wrap-u...

The commit that closes the exploit: http://src.chromium.org/viewvc/chrome?view=rev&revision=...

Forget the 3D printer -- you can cut these by hand with a Pak-A-Punch (e.g. http://www.youtube.com/watch?v=kjhZdqCnrZA ).

There's no good reason to suspect these are authentication chips. See, e.g. http://brockerhoff.net/blog/2012/09/23/boom-pins/

Just like Thunderbolt, the chip is most likely used to make the cable adaptive (so that all pins can be used for data, or power, as-needed).

Quoting the author:

  I really see no justification for the “authentication chip” hypothesis, and even 
  their diagram doesn’t show any single “power pin of the Lightning plug”. It’s clear 
  that, once the cable’s type has been negotiated with the device, and the device has 
  checked if there’s a charger, a peripheral or a computer on the other end, the power 
  input from the USB side is switched to however many pins are required to carry the 
  available current.

Agreed. There are a lot of other possible optimizations, from the often-mentioned buffer size settings:

  net.core.rmem_max / net.core.wmem_max
  net.ipv4.tcp_rmem / net.ipv4.tcp_wmem

to metric tunings like:

  net.ipv4.tcp_no_metrics_save / net.ipv4.tcp_moderate_rcvbuf

I've been playing around with these settings on very loaded machines:

  # Retry SYN/ACK only three times, instead of five
  net.ipv4.tcp_synack_retries = 3
  # Try to close things only twice
  net.ipv4.tcp_orphan_retries = 2
  # FIN-WAIT-2 for only 5 seconds
  net.ipv4.tcp_fin_timeout = 5
  # Increase syn socket queue size (default: 512)
  net.ipv4.tcp_max_syn_backlog = 2048
  # One hour keepalive with fewer probes (default: 7200 & 9)
  net.ipv4.tcp_keepalive_time = 3600
  net.ipv4.tcp_keepalive_probes = 5
  # Max packets the input can queue
  net.core.netdev_max_backlog = 2500
  # Keep fragments for 15 sec (default: 30)
  net.ipv4.ipfrag_time = 15
  # Use H-TCP congestion control
  net.ipv4.tcp_congestion_control = htcp

Interesting concept.

The actual 404 pages look like: http://notfound-static.fwebservices.be/404/index.html

I'm 95% sure this bug was fixed between ICS and Jelly Bean.

I'd been using the app Hidden Menus (https://play.google.com/store/apps/details?id=com.lorenx.and...) which stopped working at the ICS -> JB transition. You now need to type USSD/star codes manually.

Perhaps this puts a new face on the Android OS update/fragmentation problem.

To be fair, you can get similar costs in the US, but most people opt for subsidized phones (and the associated contracts).

I have a prepaid mostly-data SIM for $30/month via T-Mobile prepaid (http://prepaid-phones.t-mobile.com/).

Maybe we'll see more consumers move that way around Google's (rumored) November 5th phone launch.

Perhaps Google PageSpeed Service, if they ever launch? https://developers.google.com/speed/pagespeed/service

Unfortunately, that's just WHOIS spam, a known (& annoying) problem.

To clear things up a bit: $ whois =godaddy.com

See: http://superuser.com/questions/37954/how-to-use-command-line...

I probably had the A record cached, after the mail outage ...

Thread on Outages: http://comments.gmane.org/gmane.org.operators.isotf.outages/...

The GoDaddy status page proudly announces "No issues to report": http://support.godaddy.com/system-alerts/

During last week's GoDaddy mail outage, they had no status info posted, even hours after reports on NANOG/Outages: http://comments.gmane.org/gmane.org.operators.isotf.outages/...

Pastebin: http://pastebin.com/1j1yzQ9S

I'm not very familiar with the Bitcoin protocol: Can all users view the values of these two bitcoin accounts -- or BTC in transit?

There are very few journals that do this -- I can't imagine this ever taking off.

Reproducing experiments seems like a costly (and mostly thankless) effort that few PIs would ever take up.

The only journal I know of that completely reproduces results is Organic Syntheses (http://www.orgsyn.org/), which reproduces every reaction before publication and has a Procedure Checklist for authors: http://www.orgsyn.org/AuthorChecklist.pdf

> Myself, I'd place a lot of trust on cperciva

Sure, but you can just compare the two sites' external measures of security, and they're not even close.

Stripe domains:

- Pass optional HTTP security headers (like X-Frame-Options on manage.stripe.com)

- Are pinned to Chrome's HSTS list (http://src.chromium.org/viewvc/chrome?view=rev&revision=...) and pass a Strict-Transport-Security header

It's unfortunate PageSpeed is still a semi-closed beta; I've been trying to get access for some time now.

You'd think a year would be enough to launch a product (or at least accept everyone that enters the beta, if you want to keep things quiet).

I wouldn't be surprised if Google has tried this.

Remember their short-lived QR code-based logon system?

http://www.theverge.com/2012/1/17/2714263/google-experiment-...

http://www.zdnet.com/blog/igeneration/googles-qr-code-log-in...

Very neat service. The Duo Security team also has a similar product with a lot of features: http://www.duosecurity.com/

They make the X-Ray Android vulnerability scanner (http://www.xray.io/)