HNHacker News
TopNewBestAskShowJobs

semenko

1,034 karma · joined April 1, 2011

nick.semenkovich.com / semenko@alum.mit.edu / @semenko

Physician Scientist (MD/PhD) & Infosec Enthusiast

Via MIT EECS / WashU Med / Mass General Brigham

https://meet.hn/city/43.0386475,-87.9090751/Milwaukee

submissionscomments
semenko··on 10-year-old problem in theoretical computer science falls
The paper is in the sidebar: http://xxx.lanl.gov/abs/1207.0550

""" We prove a strong limitation on the ability of entangled provers to collude in a multiplayer game. Our main result is the first nontrivial lower bound on the class MIP* of languages having multi-prover interactive proofs with entangled provers; namely MIP* contains NEXP, the class of languages decidable in non-deterministic exponential time. While Babai, Fortnow, and Lund (Computational Complexity 1991) proved the celebrated equality MIP = NEXP in the absence of entanglement, ever since the introduction of the class MIP* it was open whether shared entanglement between the provers could weaken or strengthen the computational power of multi-prover interactive proofs. Our result shows that it does not weaken their computational power: MIP* contains MIP. At the heart of our result is a proof that Babai, Fortnow, and Lund's multilinearity test is sound even in the presence of entanglement between the provers, and our analysis of this test could be of independent interest. As a byproduct we show that the correlations produced by any entangled strategy which succeeds in the multilinearity test with high probability can always be closely approximated using shared randomness alone, and are thus restricted to being quasi-classical. """

(I have no idea what that means.)

semenko··on How did we come to believe saturated fat and cholesterol are bad for us?
Watching Hacker News try to interpret scientific data is, well, "like Quora without the Questions."
semenko··on The Microsoft Update mechanism has been used to spread malware
The SecureList summary was much more detailed: http://www.securelist.com/en/blog/208193558/Gadget_in_the_mi...

Flame took advantage of WPAD, a little-known magical hostname (http://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protoco...) to do MITM attacks on the Windows Update servers.

Flame then installed 'WuSetupV.exe' with the description "Desktop Gadget Platform" "Allows you to display gadgets on your desktop".

What's amazing is that Windows Update doesn't require explicit validation of an update-only certificate chain. It seems like any certificate from the Microsoft root can certify updates (!).

semenko··on Microsoft Certificate used to sign "Flame"
F-Secure claims that this /would/ allow forgery of Windows Updates (!!): http://www.f-secure.com/weblog/archives/00002377.html

"...Flame has a module which appears to attempt to do a man-in-the-middle attack on the Microsoft Update system..."

semenko··on Microsoft Certificate used to sign "Flame"
Maybe:

1. The certificate appeared to be available to anyone who was looking hard enough. Microsoft provided the misconfigured certificate to anyone activating their Terminal Services product (!). Pretty embarrassing.

2. It's not evident what the signing requirements are for Microsoft Automatic Updates code (at least I can't find them). Presumably they validate an explicit Windows Update chain, but if they don't, this could perhaps enable an attacker to auto-install the Flame virus as an update. I doubt that would be the case, but their security announcements aren't very forthcoming.

semenko··on Know Your Gmail Stats using Gmail Meter
Same, across a few browsers. :(
semenko··on Critical Google Chrome hole plugged in 24 hours
But it's still an open source project -- perhaps the commits are more evident in their git repo? http://git.chromium.org/gitweb/

Certainly if you build Chromium from git/SVN now, the bug is fixed.

I just find it a little strange that their changelog / list of commits in each version is not true.

semenko··on Critical Google Chrome hole plugged in 24 hours
The Chrome Release blog says it's fixed: http://googlechromereleases.blogspot.com/2012/03/chrome-stab...

And that the SVN commit history is available: http://build.chromium.org/f/chromium/perf/dashboard/ui/chang...

But I don't see any commit that look even remotely related to this exploit. What's up?

semenko··on Yale Discovers a Fungus That Eats Plastic
Yep --

The discovery here is an endophytic (living in a plant) fungus that can grow anaerobically, using polyurethane as its sole carbon source.

The authors suggest fungi that digest polyurethane have been known for decades. ("""Enzymatic degradation of PUR has been demonstrated by both fungi (4, 5, 6, 19) and bacteria (14, 17, 23).""")

They cite one reference from 1968, which itself implies polyurethane-degrading fungi had been known long before then:

"Fungal susceptibility of polyurethanes." Darby, R.T, and A.T. Kaplan. 1968. Appl. Microbiol. 16:900–905. http://www.ncbi.nlm.nih.gov/pubmed/16349806

semenko··on Google Music now available to everyone in the US
Boy, the Android Music Market sure has some great pricing options! https://market.android.com/details?id=album-Btvootmxvdamb4jr...

(Googling for it, it's a multi-disc album that appears to have caused some parsing issues. Amazon's copy: http://www.amazon.com/Bird-Complete-Charlie-Parker-Verve/dp/... )

semenko··on Amazon Kindle Fire Teardown
Yep -- this is referred to as Package on Package (PoP).

See: http://en.wikipedia.org/wiki/Package_on_package

semenko··on Show HN: WikiMaze
Whoops - just saw that!

I guess I always figured Google would give AppEngine some separate allocation/reverse DNS like EC2.

semenko··on Show HN: WikiMaze
Is it just me, or is this hosted out of Google?

  $ dig +short wikimaze.me
   216.239.32.21
   216.239.36.21
   216.239.38.21
   216.239.34.21

  $ whois 216.239.32.21
   ...
   GOOGLE, INC
   ...

   $ dig +short -x 216.239.32.21
    any-in-2015.1e100.net.
semenko··on Google Drive coming soon?
+1 for the credit.

"drive.google.com" doesn't resolve (yet)

semenko··on Student project: Use smartphone camera to diagnose malaria, save lives
This is not that useful. It's very easy to identify malaria on a peripheral smear with minimal training (and a much cheaper microscope/lens instead of a smartphone).

There's an even easier malaria rapid antigen test that requires no microscopy: http://www.cdc.gov/malaria/diagnosis_treatment/rdt.html

In many nations with endemic malaria, however, treatment is many times just empiric -- diagnostics are a luxury.

← PreviousPage 4 of 4