News for hackers. Stuff that matters.

khrakhen

Re:The limitations of Steven Pinker’s optimism on Sunday February 25, 2018 @09:46PM (#16462681)
Pinker is most certainly Whiggist in his historical outlook.
Re:The limitations of Steven Pinker’s optimism on Sunday February 25, 2018 @09:44PM (#16462673)
We can simply look at /Better Angels of Our Nature/ to know what a hack Pinker is. His thesis is only good for intra-civilizational violence on decline, which is true and fascinating. Not a cause for celebration, but for study -- he should take into account the purpose of study is to study, not celebrate. This failure cripples his work beyond his knowledge area (psychiatry, neuroscience).

Anyhow, /Better Angels/ is the most messed up, sloppily cited, cherry-picked history of human civilization I may have ever read from an academic. There is a certain Eurocentrism deep throughout, but one does not have to read between the lines. His estimates of battle deaths are prima facie ridiculous. Ancient wars always take the highest estimates. It's a wonder humans did not go extinct millenia ago, given how they kept killing a quarter of the population on a regular basis. Modern wars like Iraq, even at his time of writing in 2010-11, had far, far more deaths than he counts.

Maybe he does not want to count anything that isn't a uniformed combat death, but then he would have to admit something happened to cripple typical life expectancy.

I was about to lose my mind at the incredibly racist portion on Polynesians and genetic predispositions to violence and cannibalism. I say "incredibly" literally. I cannot fathom how it got published and praised. I imagine the exorbitant length meant most reviewers stopped a third of the way through.

And Pinker has been the head of the editing panel for the American Heritage Dictionary since the Fifth edition, a serious downgrade from the Fourth, by the way.

Pinker is more than jack of all trades, master of none. He is a charlatan. It would be all the more tolerable if he had a sense of humor.

Re:Technical report on DNC hack [pdf] on Thursday December 29, 2016 @04:52PM (#13280472)
Not just clicking on them. They are entering their details.

I can excuse (sort of) clicking on infected files. Honestly, how many of us are checking unsigned e-mails' headers in the source code? At the very least we should confirm if the displayed From and Reply-to match the originating server.

But we usually don't. And we may be on webmail(!) on someone else's computer. That PDF could have malicious software.

*

Clicking on a suspicious link is one thing. Doing something on that linked site is worse. (instead of re-typing the URL -- I hate internationalized URL domains for making this hard.)

Not checking the URL or even looking for the green padlock or using common sense and then typing in your password??? No excuse.

Would a bank ever send you a postcard asking you write down your PIN and bank balance on the postcard and send it back to them? No. Of course not. For starters, they don't need that information.

Clicking on phishing links and entering personal information is stupidity on a whole new level.

Re:Technical report on DNC hack [pdf] on Thursday December 29, 2016 @04:47PM (#13280432)
Yep. All the more infuriating. They know better.

NGOs, private industry and the US government at most levels there has been a movement away from password length limits and password expiration and SMS as a second factor. (Even OTP and hashes may be replaced by U2F keys someday.)

Then we get this recommendation for password expirations.

Two steps forward, one back -- as always.

Re:Technical report on DNC hack [pdf] on Thursday December 29, 2016 @04:44PM (#13280405)
> I've heard exactly zero claims that the leaked emails were falsified in any way.

Podesta and high-ranking Dems have leveled this very charge.

The extent of the DKIM signatures all being true makes this very unlikely.

RSA1024 and SHA-1 can be beaten, but not easily and not in this volume.

It is not E2E from the people authoring the e-mails, so the server maintainer (often Google) could be forging and signing e-mails.

However, again, doing it the volume it would have had to be done is not likely.

The DNC has backed off from the forgery accusations. Besides the asinine nature of the accusations making them look bad, such accusations weaken their grand thesis: Russia hacked them. If they open up the possibility that most or all of the e-mails could have been fabricated whole cloth, then it undermines the argument that Putin pulled off an ingenuous heist of tens of thousands of e-mails.

Re:Technical report on DNC hack [pdf] on Thursday December 29, 2016 @04:35PM (#13280334)
Great. Password expiration.

Cue everyone recycling a set of 10 unique passwords among devices and/or writing passwords on Post-It notes on work computers at the office.

Only bit of truth in here was the phishing campaign. That could be anyone, however. This is barely more advanced than the Nigerian bank scam e-mails.

Yet the POTUS says it's a sign of the highest levels of Russian government.

We've already been fed lies about e-mails being altered (DKIM signatures disprove this) and now this PDF ignores the insider element in the DNC/Wasserman-Schultz leaks.

What a joke. NIST, NSA, FBI, CIA et alia should be discredited almost entirely at this point.