Archive for category news

Adobe Flash, HTML5, x264, YouTube…..

There’s been a lot of talk recently about Apple, the new iPad, and Jobs’ denouncement of Flash.  Supposedly Steve Jobs thinks Adobe has gotten lazy and he believes them to be evil similar to Google.  What does Jobs think he’s doing when designing hardware with proprietary connectors, closed hardware etc?

YouTube has a beta site with HTML5 + h264 (Firefox won’t work yet). An interesting comparison is to view a video with Flash and then view the same video in theirHTML5 beta site.  Open your task manager and watch your processor usage — notice a different?

L0pht: Crack this DARPA!

Mudge (from L0pht) has just been hired as a program manager by DARPA. (I didn’t even know DARPA still existed). Do you remember when L0pht testified before congress that they could bring down the internet in 10 minutes?

Google privacy video’s and privacy podcast

On the way to work this morning I was listening to the Silver Bullet podcast interviewing Dr. Lorrie Cranor (Comp Sci professor at Carnegie Melon).  I recommend listening to this episode if you’re at all interested in privacy in the digital age and how it has been evolving.  Actually, how is society reacting or non-reacting to privacy in a new medium.  There are some interesting studies about how well people can decipher privacy policies and how most companies keep their policies convoluted.  An interesting mention is the idea of having privacy policies follow a “nutritional label” format which would be great for the layman like myself to read :-)

Cranor helped create the P3P Standard: http://www.w3.org/P3P/ It’s been approved by the W3C and has even been supported in IE6-8.  Sadly, I don’t think many webmasters are aware of it.

Dr. Cranor also mentions how Google is making an attempt to clarify their privacy policy as folks start to wonder if Google can reach the point of too much information (Enemy of the State and Minority Report).  Long story short, Google is creating video’s with real people explaining the privacy policies of their different applications.  Kudos to Google on this: http://www.youtube.com/user/googleprivacy

National Security Agency recruiting

I’ve been reading Stephen Levy’s Crypto which gives a nice history of public cryptography (vs. private crypto which has been around much longer) and follows Whit Diffie at least in the chapters I’ve read so far.  I will post a full review once I finish the book.  In the meantime, Levy mentions the NSA’s involvement with creation of the Data Encryption Standard (DES) and pressuring IBM to reduce the key size to 56bits.
The book really has me wondering where and how the NSA is recruiting such top talent (mathematics, scientists, engineers).  I’ve been scouring the web and haven’t been able to find much information.  I find it hard to believe that the NSA sits back and waits for top talent to approach it.  I’m thinking of the usual nerd stereotype: aspergers and introverted.  I just can’t imagine these folks dying to work for the government in a stuffy cubicle from 08:00-17:00.

I came across one well documented account of someone’s experience with the actual NSA interview process: http://www.fas.org/irp/eprint/nsa-interview.pdf Unfortunately, he was not accepted.

I know nowadays the NSA appears at college career fairs and can even be found on facebook.  However, what was the process 50 years ago during the height of the cold war?
Is the NSA secretly recruiting? Monitoring doctoral dissertations and white papers and then approaching the authors? I’ve heard from folks that the three letter agencies have plants on college campuses watching for potential rising stars.

The private sector may be winning over candidates because of the salary gap.  However, the NSA still has the allure of the best technology, biggest budget, and access to the most information (beat that Google!).

Security news, feeds, and alerts

I found a comprehensive list of Security news[letters], feeds, and alerts here: http://www.gideonrasmussen.com/news-alerts.html It’s definitely worth checking out as  I found a few lists that I wasn’t aware of.

FYI – Here’s my personal list of favorites (in no particular order):

Defending Security Theater

You don’t hear this much but there’s an interesting article in defense of security theater.

Happy New Years: The files are coming….and ReCaptcha

We’re working on restoring the original System7 file archive.  You can view what we’ve restored over at Files.System7.  We’ve replaced the user /credit system with the ReCaptcha service.  We don’t want users to register (which no one likes) but we also want to protect ourselves from leechers aka wget’ers.

If you haven’t heard how ReCaptcha works, not only does it block bots & spam but it performs a beneficial community OCR service at the same time.  Every time you complete a captcha you’re also helping decipher a word which couldn’t be understood by a scanner (OCR).  Currently your efforts are being used to aid in digitizing old versions of the New York Times.  Honestly, not sure how that helps the starving children of Africa…

Using ReCaptcha, you’re given 2 words in the captcha phrase, 1 is known and 1 is unknown.  If you type the known word correctly it will assume you also knew the word which OCR could not interpret.  (The unknown word is actually given to multiple people and they must all have the same answer for it to be accepted).  Read more about ReCaptcha here…

Transportation Security Administration: What a joke…

I previously wrote about how you could get a knife on board a plane without first having it in your luggage or on your person.  Now some folks have done a study and tested various “safe” objects and how lethal they are by using a dead pig (stabbing the pig’s neck, measuring blood loss). If that’s not enough, someone leaked a copy of the TSA’s Screening Standard Operating Procedures which is out there on Wikileaks.  There’s a great article titled ‘TSA: Worst Than Useless‘ which I recommend everyone read.

It’s great the TSA employs people.  But why not keep paying them and allow them to just stay at home?  They inconvenience so many people and don’t provide any value; as Schneier says, it’s complete security theatre.  I understand that unemployment is very high today in the United States (> 10%).  Why not create something like the Tennessee Valley Authority and pay folks to work on public projects even if it’s picking up trash or beautifying state parks?

DD-WRT Rollback

I previously wrote about installing and using the alternative linksys firmware, DD-WRT. Well, after running DD-WRT for about 5 months I’ve decided to roll back to the original linksys firmware.  Here’s my reasoning:

  • My linksys wrt54g v8 was only capable of running dd-wrt MICRO.  Micro has the least amount of features of any of the dd-wrt releases (the linksys doesn’t have enough nvram to store any more features/applications)
  • IPtables support was crippled in dd-wrt micro v24 that I was running.  I wanted to setup a span/mirror port which was not possible (at least not for me).  I’ll have to spend a few bucks now and buy a hub (if i can find one anywhere!  No one seems to sell hubs..)
  • The DD-WRT was randomly forgetting all of its settings (port forwardings etc, which was causing me to lose all remote access to my machines).  DD-WRT doesn’t run SSH at the micro level and there’s no way I’m leaving telnet open publicly.
  • DD-WRT was unreliable.  I had to reboot it at least once a month because it would lock up and stop routing packets.

Has anyone tried OpenWRT?

Time Warner Cable – Road Runner DMCA Notice

I recently got slapped with a DMCA notice from my ISP, Time Warner. Below is a copy of the page where all of my traffic was redirected to. All of my requests were hijacked until you acknowledge the notice. Using FireBug I tried altering the javascript to send different return codes back to Time Warner. Unfortunately, they seem to be performing input validation on the return code and nothing was working.  Has anyone else had any success manipulating this?  What kind of workarounds have you tried?  OpenDNS?  Any pirate firmware for the Motorola Surfboards to change the physical address?  How do you get the new MAC address registered on Road Runner’s end?

Road Runner DMCA Violation

Below is an excerpt of the webpage:

    ....

     
.... ? <script language="JavaScript" type="text/JavaScript"> <!-- // Push the window forward if the user goes back... window.history.forward(1); function MM_reloadPage(init) {  //reloads the window if Nav4 resized if (init==true) with (navigator) { if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; } } else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); function RequestRelease(sReasonCode) { document.ReasonForm.ClickedCode.value = sReasonCode; document.ReasonForm.submit(); } //--> </script> <td align="left" background="imgs/index_r2_c2.gif" bgcolor="#ffffff" valign="top"> <form name="ReasonForm" method="post" action="ReasonPg.aspx?[SOME_HASH_KEY_1]" id="ReasonForm"> <input name="__VIEWSTATE" value="[SOME_HASH_KEY_2]" type="hidden"> <input name="ClickedCode" id="ClickedCode" type="hidden"> <td rowspan="5" align="left" valign="top" width="94%"><span><span><a href="Javascript:RequestRelease('[I TRIED DIFFERENT VALUES HERE]')"><b>I am aware of this issue and will take steps to resolve it.<b></b></b></a><b><b><br><br></b></b><pre><b><b>Dear Subscriber: (message here --- see screenshot) Road Runner Customer Care</b></b></pre><b><b><br><br><a href="Javascript:RequestRelease('ABUSE-LEGALCOPY')"><b>I am aware of this issue and will take steps to resolve it.<b></b></b></a></b></b></span>