willscott

As a recent HMC grad: It's very much not free for everyone. Many of my classmates graduated with fairly hefty loans which will take many years to fully pay off.

Olin is free for everyone, and there's a wave in the elite schools to set up payments so that students don't leave with loans. Mudd has a relatively small endowment, so probably couldn't function under that model.

WPA does not only have 256 keys.

The author decided to show that if he knew all but one character of his network password, he could bruteforce the missing character. To that end, he took all 256 possibilities for that character, and computed the resulting keys. Then tried connecting with those keys.

This shows a connection rate of 30 attempts/2 minutes which is 0.25/second. That is not practical for most attacks.

The video didn't show any evidence of data being transferred off of the phone, besides being logged to the USB logger.

Is it possible that this is simply a tool to allow for USB debugging of the UI? Otherwise, are there details (how often, what) is getting sent back to the carriers or to this company?

That wouldn't protect you in the scenario where someone had limited physical access to your machine.

Edit per the response: I don't think this is a threat model that you would care about in theory, but it seems like a scenario that can come up fairly often in the real world. Especially in family or school settings, someone else will often have short durations of access to your machine. These people aren't often going to be technically literate enough to install key loggers or really mess up your machine, but they may well be able to quickly set up forwarding of your email to their account.

Seems pretty reasonable to expect it to be this code from the apache shindig library:

http://svn.apache.org/repos/asf/shindig/trunk/features/src/m...

From the file: This code implements a safer random() method that is seeded from screen width/height and (presumably random/unguessable) mouse movement, in an effort to create a better seed for random().

Its aim is to solve the problem of gadgets that are relying on secret RPC tokens to validate identity.

You can put people into as many circles as you want.

It's really a shame this isn't XMPP.

I don't get what the motivation is for having another closed system when they could have added interoperability with their desktop client + aol + gmail at a very minimal cost.

Edit: I'm basing this on the keynote comment that it is based on the push notifications stack.

That seems hard to believe. The buttons seem to show up fine on tech crunch and google search.

It's difficult to imagine that Google has been 'slashdotted' due to serving up a javascript widget...

The text of the article is poorly written - with a focus too much on conspiracy theory rather than on actual science. The linked article is from 2007, and only reports on preliminary research.

There's a reason we have the scientific setup that we do, and it is to filer the noise, and protect the authenticity of the science. If these guys from Alberta are able to come back with good results on human trials, then other labs will independently confirm the result. The fact that drug companies aren't picking up research at a preliminary stage on a drug that won't be profitable shouldn't be surprising, but it also doesn't mean that the research won't go forwards.

From the linked paper, the 'trick' here is for the attacker to improperly respond to a tcp connection initiated from the target.

The standard handshake looks like:

Syn ->

<- Syn / Ack

Syn ->

The 'split handshake' looks like:

Syn ->

<- Syn

Syn / Ack ->

<- Ack

As a result, the hypothesis is that the intermediary router could incorrectly flip the roles of client and server, and incorrectly forward untrusted packets from the outside 'client'.

http://www.chromium.org/Home/chromium-security/brag-sheet Presumably flash is sandboxed within chrome, so it isn't susceptible to the same attack vectors as unsandboxed plugins.

This presumably alleviates a lot of the security concerns for that plugin, since it now has the same protection to exploitation as the rest of chrome, and security vulnerabilities might be able to be patched through chrome's auto-update(?)

The Gmail frontend is written in javascript using the closure library.

http://code.google.com/closure/

You can look at the (compiled version) of the code by looking at the scripts tab of the chrome web inspecter. They're there :)

The benefit to Google of the current mode is the ability to rapidly change the code pushed to your browser.

If there was a open source release of the gmail client code, it would force google into maintaining an API for that code for the foreseeable future, which would require additional effort.

The closest to this request that seems remotely likely is a client side API for gmail, so that browser plugins or third party services could extend it. I see a lot of cost to Google to actually release the code, and not a ton of benefit.

The accelerometer interaction hooks into javascript via browser events.

Here's the basic usage for chrome: (for firefox the event is MozOrientation, and values are radians rather than degrees)

  window.addEventListener('deviceorientation', function(evt) {
    var x = evt.gamma, y = evt.beta;
  }, false);

The notifications are allowed to be full webpages - which can then communicate back to the parent window. (or extension)

This will be a reasonable alternative to modal dialogs for chrome extensions initially, and eventually for web apps in general. (if it gets adopted by other browsers)

http://www.html5rocks.com/tutorials/notifications/quick/

While the thought that there's something in this book that is being censored is an appealing story, it's also a less than likely explanation.

My guess is that the chinese publisher didn't want to pay royalties, and this was a convenient way to get a good quality copy of the book for printing without having to share profit.

Couldn't the CDN redirect to a closer node if DNS doesn't bring the user to an optimal pop?

I'm pretty sure we're talking about an HTTP protocol so a 302 redirect ought to work, and it seems like that would give the CDN way more control than trying to distribute traffic using a cached and not reliably localized DNS mechanism.

Edit: foobarbazetc has a good point, but it still feels like the CDN has reasonable ways to work around and do a better job of selecting the correct pop than DNS. Adding a layer of subdomains which force locality (us-ny.host.com) would keep urls readable & virtual hosts intact.

I don't understand this at all.

Is there any reasonable theory for how the choice of DNS changes download speed this dramatically?

I can see it taking longer to resolve the ip address of the download server, but that should only be a one-time thing - and the total impact should be a couple seconds at most. Unless the download is constantly flipping between servers, I don't see how DNS latency is going to make a noticeable difference in the time it takes to download / stream a movie.

The title is very misleading.

The tie is for number impressions served to iOS versus android devices.

Not the total web ad impressions, nor even ads served on the respective platforms, since Google is serving a significant number of ads on iOS.

A big point that the article doesn't bring up is the ongoing upkeep costs that already exist even for smaller organizations. Even if the computers are all running windows 2000, the easiest way for most companies to license the software is by paying a yearly site licence to Microsoft.

If Chrome OS costs less than than that yearly upkeep cost, and comes with perks of low maintenance and remote connectivity, I could see a lot of companies being very tempted to switch.

Chromium is open source - which makes me suspicious of claims that the browser is nefariously tracking your every move without pointing to code.

Here's a search for the 'client_id' that the author was afraid of: http://codesearch.google.com/codesearch?as_q=client_id&v...

It looks like a likely possibility is that the author is syncing his profile to google - in which case it makes sense that some ID needs to be stored in order to figure out which sync updates are coming from which browser.

Presumably on the google website the script is loaded via an xmlhttp request which then strips the initial text and evals the rest. By added the initial throw 1; they prevent other sites from including the script, since it won't do anything.

They were asking for english translations of words in various languages - hoping to determine the demographics of the workers solving the captchas.

I went to a speech by savage earlier this fall. The point that I took away from it is that what captchas do is filter out the bad guys who haven't figured out a business model.

On the klingon point: They theorized that the particular organization was a bunch of PHDs rather than farmed labor - and that it had learned from previous 'example answers' they had submitted. That particular organization, it was noted, was also an order of magnitude more expensive than the others.

Does it work from the iGoogle chat list? What about from a third party client (meebo / a desktop jabber app)?

In defense of this practice, it seems like the fact that ads force themselves above everything else is quite useful in preventing click fraud.

Wouldn't allowing the flash ads to have a non-window wmode make it would be much easier for malicious websites to trick visitors into clicking on ads that they weren't aware were there?

First off, make 3 hours of time, and take the free practice GRE test on the ets website. That will give you a good sense of how well you're going to do.

You say two very different things in your post - that you've only taken two "real" CS classes, and that you know basic algorithms / data structures. A lot of what comes out of an algorithms or data structures class is the vocabulary surrounding those topics, and my experience was that the vocabulary is a significant part of the GRE.

The worst thing that happens is that you're out a hundred dollars for the registration fee, so you might as well find a CS GRE prep book and start studying. It is definitely more doable to cram for the CS GRE than for the Math or Physics tests.

There was something really similar to this (if not the same thing) that came out of University of Chicago recently.

http://blogs.discovermagazine.com/80beats/2010/10/25/a-robot...

Physicists are calling these materials 'granular media' - and there is a ton of research going into that field right now.

As a recent Google hire, I think the article gets this point right, the offer was competitive if not generous. At the new-grad level at least I'm in the high-end of what I was expecting to be making.

I know that the reason I wanted to work at Google was to learn how to solve problems involving scale and massive parallelism. There really isn't anywhere else that can teach you that stuff as well.

I would imagine the appeal is less towards native/fluent speakers at this point, and more for people who are learning or uncomfortable with english grammar.

I have several friends who use Google to as a first editor of their grammar by making sure that phrases they aren't sure are correct return lots of search results. This seems like a convenient way for them to streamline that process.