zorlem

In my country there was a big scandal a few years ago when a couple of radio stations started playing Billboard Hot 100 songs. I guess they couldn't source the new songs in time from reputable sources for some reason (licensing restrictions, logistical failure, no idea...).

So they simply downloaded them from local torrent trackers. The thing blew up, because a guy that was uploading and seeding the albums put his own catchy promotional jingle in the middle of most songs.

[0] http://point-at-infinity.org/ssss/

> An "acceptable" alternative would be to implement an indirect clipboard in which a trusted keyboard application can replay the string for a short duration but that's not going to happen either.

Actually Keepass2Android does just that - it provides an (optional) dedicated keyboard layout that you can install and activate.

> Whats worse is that probably most people who use a PWM on a mobile device choose to have a PIN lock on it after supplying the initial PW which reduces the PW complexity even further.

Some password managers have the option for using a part of your password after the database is unlocked - you get a limited number of tries (configurable) and the database locks if you don't guess the short code.

Even today, after all the development effort put into MySQL and its derivatives, there are still better and more capable databases, but that doesn't prevent MySQL from being one of the top three RDBMS-es (and we can bet it is the most popular FOSS RDBMS).

[1]: http://cr.yp.to/ecdh.html

No properly configured and working ACID compliant RDBMS should lose any data when the server is reset or stopped. If it does, then it is either a problem with the hardware, OS, configuration or the RDBMS itself. The application must also be able to handle the DB disappearing, though. Sadly this is often not the case.

# copy the data in a new table and add code to place it in both tables

# change the code to reference only the new data but still store it in both tables

# rename the old table

# remove the old table

On top of that you have changes that are supposed to be applied before the new code is deployed (eg. creating a table, renaming a table) and after the code is deployed (eg. dropping unused columns).

As somebody else mentions in the comments this is more about Change Control than Versioning, but the two things go together to insure that you have as much idempotent and reversible changes as possible. Of course, if you have the resources you can always adopt a "never delete data" policy, so you're always copying instead of modifying the data, making sure you have a way to retract the changes. Clean-up can be done on regular, distant intervals.

Using ORM doesn't prevent you from doing a review on the changes that are about to be implemented. ActiveRecord for example, could provide you with a SQL file that will be representing your schema after the ORM is done. Usually the ORM schema changes are executed automatically by your CI upon deployment on Dev, QA and possibly Staging environments (you do have at least two of those, don't you? :) and need manual intervention (maybe to control performance degradation of your live env - locks, increased disk I/O, etc). This way you get plenty of testing of any DB changes and you should be able to spot any problems as early as possible.

Who are the people that can recover more than 1 rewrite easily from a modern hard disk drive, do you have any URLs at hand?

You could check Peter Gutmann's research titled "Secure Deletion of Data from Magnetic and Solid-State Memory" [1] from 1996 which is one of the original sources for "35-cycle erase" [2]. In this paper he states that it is possible to recover the data using a specialized microscopy equipment (using Magnetic Force Microscopy or MF Scanning Tunneling Microscopy techniques). These techniques are only applicable for mediums with a much lower magnetic density and much simpler encoding than are used these days (eg. RLL encodings like MFM, PRML, etc.).

How did you arrive at the number 50? In the epilogue of his paper Gutmann states:

In fact performing the full 35-pass overwrite is pointless for any drive since it targets a blend of scenarios involving all types of (normally-used) encoding technology, which covers everything back to 30+-year-old MFM methods (if you don't understand that statement, re-read the paper). If you're using a drive which uses encoding technology X, you only need to perform the passes specific to X, and you never need to perform all 35 passes.

tl;dr: overwriting 35 times is a pointless waste of time and is one of the popular myths that refuses to die. Using shred under GNU/Linux or DBAN to overwrite with some random data is more than sufficient for our purposes.

[1]: https://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html

[2]: http://en.wikipedia.org/wiki/Gutmann_method

This would make sure that distro vendors don't even get a chance to mess initial seeding at boot time. It will also force vendors of embedded or "cloud" distributions (eg. Ubuntu's AWS images) to find a way to pre-seed the images to reduce the initial boot times.

Unfortunately there is such a huge amount of software that depends on this particular difference between /dev/random and /dev/urandom that I don't see the change happening soon.

http://xkcd.com/305/

It can collect detailed memory usage profile of processes and when combined with some smart scripting it has a nice leak detection functionality [1]. Very useful when you run out of memory and want to find which daemon has used all of it.

[0] http://www.atoptool.nl/

[1] http://www.atoptool.nl/download/case_leakage.pdf

edit: formatting

[0] https://stripe.com/

If there is a demand I could try whipping up a CloudFormation template to do it.

I find it strange that none of the prototypes have actually managed to reach a production stage, given that the potential market - military, LE, emergency responders is (supposedly) there. Maybe the price point doesn't make much sense, given the usual (low) prices for fixed-focus camera modules - there is no need for very high resolution here, and the balls better be semi-disposable.

There are a few other designs (and patents associated with the concept) - [2], [3] and [4].

[1] https://news.ycombinator.com/item?id=4757971

[2] http://www.bostonglobe.com/business/2013/01/21/surveillance-...

[3] http://www.serveball.com/

[4] http://jonaspfeil.de/ballcamera (and HN discussion: https://news.ycombinator.com/item?id=3109899)

https://factorable.net/weakkeys12.conference.pdf

https://www.usenix.org/system/files/conference/usenixsecurit...

[0]: https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing

[1]: http://point-at-infinity.org/ssss/