Blog Archive: October 2013
Tab Sweep: Halloween
Well into Q3 and autumn, and my SAD is already stirring in the back corner of my brain. But any season is Harvest season on the Web. Lyrical cynicism From the Cassandra Does Tokyo blog: Winning The Battle But Losing The War? thoughts provoked by encountering the UKs Fort Halstead. Defies summarization, but worth reading. Fujifilmery I continue my fannish obsession with this stuff, due to my continuing love affair with the X-E1. Mark Schuelers Continuing the Love Affair A Practical Review of the Fujifilm X-E1 is one of the few considerations of the X-series from someone whos also spent considerable time with the Oly OM-D shooters.
NSA Eavesdropping on Google and Yahoo Networks
The Washington Post reported that the NSA is eavesdropping on the Google and Yahoo private networks -- the code name for the program is MUSCULAR. I may write more about this later, but I have some initial comments: It's a measure of how far off the rails the NSA has gone that it's taking its Cold Warera eavesdropping tactics --...
LinkedIn: Somebody wants to link to you
Mail from LinkedIn (yes, really, not spam) today: Who? It doesn't say. It seems to be unimportant, though viewing the profile showed that it was, indeed, somebody that I know. But this was the entire message, apart from my personal details below. Still, documentation is overrated. ACM only downloads articles once.
New VoIP adapter
My new NetComm V210P VoIP adapter arrived today. Why does it have a WAN and a LAN port? It seems to want to be a firewall as well, and it's a little hazy about which port it uses for DNS requests. After a bit of playing around, discovered that it works better with the WAN port connected. But I still can't find a way to create a sensible dial plan. On the one hand it's a lot simpler than the dial plan for the Sipura, but on the other hand it's a lot simpler than the dial plan for the Sipura.
More Radiation Tower activity
They're doing more work on the Radiation Tower: At first I thought it was the electricity, but the heaps of soil don't seem right for that. ACM only downloads articles once. It's possible that this article has changed since being downloaded, but the only way you can find out is by looking at the original article.
FC9: Social Sign-in
This term gets bandied about quite a bit in the Federation Conversation. When it comes up, developers tend to strong emotional reactions: On the one hand We really need social sign-in to make our service work and on the other Ewww, no way; I dont want our users worried about whats being shared. Ive been digging around the subject; sometimes I think theres no there there. Facebook Connect is what started this conversation. The product name has vanished, doesnt even appear in the Facebook Platform Wikipedia article, even though you can still find the blog post announcing it and the launch notice.
Simplifying Mobile App Data Management with DynamoDB's Fine-Grained Access Control
Speed of development, scalability, and simplicity of management are among the critical needs of mobile developers. With the proliferation of mobile devices and users, and small agile teams that are tasked with building successful mobile apps that can grow from 100 users to 1 million users in a few days, scalability of the underlying infrastructure and simplicity of management are more important than ever. We created DynamoDB to make it easy to set up and scale databases so that developers can focus on building great apps without worrying about the muck of managing the database infrastructure. As I have mentioned previously, companies like Crittercism and Dropcam have already built exciting mobile businesses leveraging DynamoDB.
Improved cycle time? What about this technique from the 1990s?
One of the DevOps goals you often hear about is "improved cycle time" for releases. What that means, basically, is speeding up the time from when a developer writes a line of code to when it is in production. The opposite would be writing code for a release that doesn't ship for a year or so (common in shrink-wrapped software). You often hear about teams bring their cycle time from months to days, from days to hours. Etsy brags that they've gotten it down to minutes. The benefits to reducing cycle time are well documented. Well I have a technique that reduces it to a cycle time that is faster than minutes.
The Battle for Power on the Internet
We're in the middle of an epic battle for power in cyberspace. On one side are the traditional, organized, institutional powers such as governments and large multinational corporations. On the other are the distributed and nimble: grassroots movements, dissident groups, hackers, and criminals. Initially, the Internet empowered the second side. It gave them a place to coordinate and communicate efficiently,...
Alternative Android software
My search for a good navigation app for Android has not been very successful. I had expected something better than the Nav N Go software, but so far I haven't found anything that is anywhere near as good. So why not Nav N Go? It clearly has the advantage that I know how to use it. Spent some more time looking around and came across a site that offered it. So I tried to install it. Ended up with a 415 byte file in the Downloads directory, with no explanation of what to do with it. Clearly I had to sign up with Aptoide.
The advantages of dithering
My Android tablet proves to be quite good for reading PDF documents, much better than the E-book reader that I bought last year. That seems to have more to do with the software (dare I say Acrobat reader?) than the hardware, since the resolution isn't very different. A closer looks shows the advantage of dithering: I consider dithering just a substitute for high-resolution displays, but here it does the job quite well. ACM only downloads articles once.
Greetings SpiceWorld 2013 Attendees!
Thanks for coming to SpiceWorld and attending my session! I'll have the slides up on this site totomorrow. If you aren't here at the conference you can sign up for the livestream here: http://www.spiceworks.com/begreat
What the NSA Can and Cannot Do
Good summary from the London Review of Books....
Arguing for NSA-Level Internet Surveillance
Jack Goldsmith argues that we need the NSA to surveil the Internet not for terrorism reasons, but for cyberespionage and cybercrime reasons. Daniel Gallington argues -- the headline has nothing to do with the content -- that the balance between surveillance and privacy is about right....
Simplifying Mobile App Data Management with DynamoDB's Fine-Grained Access Control
Speed of development, scalability, and simplicity of management are among the critical needs of mobile developers. With the proliferation of mobile devices and users, and small agile teams that are tasked with building successful mobile apps that can grow from 100 users to 1 million users in a few days, scalability of the underlying infrastructure and simplicity of management are more important than ever.
MySQL communication failure
After yesterday's panic, I had difficulty accessing the freezer database on dereel. It's using phpMyEdit, which no longer works with modern, backwards incompatible versions of PHP, so I run it on a different, down-rev (virtual) machine. But since the reboot I couldn't access the database. Much checking, not helped by the lack of error reporting. Running wireshark didn't help: I only saw the traffic in one direction, presumably because of the virtual machine. But running mysql directly showed: === root@dereel (/dev/pts/0) /usr/local/www/data/household 16 -> mysql -u grog -h eureka ERROR 1130 (HY000): Host '192.109.197.135' is not allowed to connect to this MySQL server No, I don't have passwords for this database (clearly that will have to change if I go back to direct connect to the Internet).
Reader Q&A: Acquire/release and sequential consistency
Reader Ernie Cohen emailed me this morning to ask a question about one slide in my atomic<> Weapons talk from last year’s C++ and Beyond: In your atomic weapons talk (part 1) (updated 2/15/2013) ,page 18, titled “Sc > Acq/Rel Alone: Some examples”, the first example listed “transitivity/causality”: T0: g = 1; x = 1; […]
This site now available via IPv6
My hosting company has enrolled this site in their beta for IPv6. All I had to do was ask. If you have a hosted site, I highly recommend that you open a ticket asking for your site to be available via IPv6. If they don't offer it, ask for an arrival date and keep them to it. Enroll in any beta tests and so on. The more demand hosting companies see, the better.
Forge Diaries: Episode 2
Forge Diaries: Episode 2
Forge Diaries: Episode 2
Understanding the Threats in Cyberspace
The primary difficulty of cyber security isn't technology -- it's policy. The Internet mirrors real-world society, which makes security policy online as complicated as it is in the real world. Protecting critical infrastructure against cyber-attack is just one of cyberspace's many security challenges, so it's important to understand them all before any one of them can be solved. The list...
VoIP reliability
Years ago I bought two Sipura SPA-3000 VoIP ATAs. After retiring I only needed one of them, but it died two years ago. Today I discovered that the second one had died too. I didn't record the exact symptoms of the death of the last one, but I suspect at least the LEDs still illuminated. This time there was just no power indication, though the power adapter seemed OK. Not a good advertisement for SipuraLinksysCisco. With the upcoming Radiation Tower, time to buy a new one. Saw one (a NetComm V210P) being auctioned on eBay and got it for $9.99. Who can be bothered to fix old hardware when you can get new stuff that cheaply?
Backup data corruption
Yesterday's photo data backup didn't exactly work as planned. Looking at the output, I found lots of: rsync: stat "/photobackup/Photos/grog/www/20080531/small" failed: Bad file descriptor (9) rsync: recv_generator: failed to stat "/photobackup/Photos/grog/www/20080531/small/daisy-bush.jpeg": Not a directory (20) rsync: recv_generator: failed to stat "/photobackup/Photos/grog/www/20080531/small/dam-ne.jpeg": Not a directory (20) Further investigation showed a couple of things: first, the (USB-connected) disk had been detected as a 1 MB/s device: Oct 26 17:04:33 eureka kernel: da2 at umass-sim3 bus 3 scbus11 target 0 lun 0 Oct 26 17:04:33 eureka kernel: da2: <ST ST2000DL003-9VT1 3.00> Fixed Direct Access SCSI-4 device Oct 26 17:04:33 eureka kernel: da2: 1.000MB/s transfers Oct 26 17:04:33 eureka kernel: da2: 1907729MB (3907029168 512 byte sectors: 255H 63S/T 243201C) Normally I'd expect to see ...
Wok Lore
If youre on the Pacific Rim and you cook much, you need a wok. The right kind is the cheap kind; makes it pretty hard to go wrong stir-frying. Wed had various kinds of modern woks with anti-stick coverings and Id generally had trouble getting the hang of it; they were kind of klunky and the coating always started wearing off, so cleaning them became a pain in the butt. But I like stir-fry, so I went to Vancouver institution Ming Wo for advice, and the nice lady said Well, carbon steel of course, round bottom and youll need this ring here to hold it on your burner. Price tag under $50, and I bet the total manufacturing cost was at least $5.
US Government Monitoring Public Internet in Real Time
Here's a demonstration of the US government's capabilities to monitor the public Internet. Former CIA and NSA Director Michael Hayden was on the Acela train between New York and Washington DC, taking press interviews on the phone. Someone nearby overheard the conversation, and started tweeting about it. Within 15 or so minutes, someone somewhere noticed the tweets, and informed someone...
Friday Squid Blogging: Dynamic Biophotonics in Squid
Female squid exhibit sexually dimorphic tunable leucophores and iridocytes. Just so you know. Here's the story in more accessible language. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Radiation Tower close up
The work on the Radiation Tower this week looked like completion, so off to take a closer look. Up to now I have only taken photos from the road, but it looked like time to go in and take a closer look. For some reason they've locked the gates leading to the tower, though that's not the case with the other towers I've seen. In any case, it's easy enough to get in: And clearly the tower isn't complete yet: Still, there's not much to do.
How to compromise ANZ web banking
Despite my complaints about ANZ yesterday, it was clear that I would have to go along with their silly security questions, so I chose some with answers that nobodynot even Icould guess. Then a little later Yvonne came in and told me that she had managed to lock herself out of the web banking servicetyped the correct password three times, and it was rejected each time. Now we had to call 13 33 50 to get it reinstated. How could that happen? Clearly they couldn't have objected to my choice of answers (which, in fact, were less unflattering than usual). Something wrong in their application?
Back-to-Basics Weekend Reading - U-Net: A User-Level Network Interface
Many of you know Thorsten von Eicken as the founder of Rightscale, the company that has helped numerous organizations find their way onto AWS. In what seems almost a previous life by now Thorsten was one of the top young professors in Distributed Systems and I had the great pleasure of working with him at Cornell in the early 90's. What set Thorsten aside from so many other system research academics was his desire to build practical, working systems, a path that I followed as well. In the back to basics readings this week I am re-reading a paper from 1995 about the work that I did together with Thorsten on solving the problem of end-to-end low-latency communication on high-speed networks.
Book Review: Cyber War Will Not Take Place
Thomas Rid, Cyber War Will Not Take Place, Oxford University Press, 2013. Cyber war is possibly the most dangerous buzzword of the Internet era. The fear-inducing rhetoric surrounding it is being used to justify major changes in the way the Internet is organized, governed, and constructed. And in Cyber War Will Not Take Place, Thomas Rid convincingly argues that cyber...
Cognitive Biases About Violence as a Negotiating Tactic
Interesting paper: Max Abrahms, "The Credibility Paradox: Violence as a Double-Edged Sword in International Politics," International Studies Quarterly, 2013: Abstract: Implicit in the rationalist literature on bargaining over the last half-century is the political utility of violence. Given our anarchical international system populated with egoistic actors, violence is thought to promote concessions by lending credibility to their threats. From the...
Back-to-Basics Weekend Reading - U-Net: A User-Level Network Interface
Many of you know Thorsten von Eicken as the founder of Rightscale, the company that has helped numerous organizations find their way onto AWS. In what seems almost a previous life by now Thorsten was one of the top young professors in Distributed Systems and I had the great pleasure of working with him at Cornell in the early 90’s.
Bluetooth keyboard: success
More playing around with the Bluetooth keyboard today. This time it Just Worked, irritatingly while I was trying to get some screen shots of it not working. And once it was there, identifying itself not with a MAC address but with the name of the keyboard's owner (not Chris Bahlo), I couldn't get rid of it. So: how well does it work? There's no problem entering data, but it's still difficult to use: Android isn't really designed for keyboards, and I still need to smear the tablet to navigate the screen. The keyboard is really only useful when doing a lot of text entry with little screen navigation.
Canada Reads Top 40 books including Little Brother!
I just received the delightful news that my novel, Little Brother made it to the CBC's "Canada Reads" list of top 40 Canadian books, and it is in some spectacular company. There's a competitive element to this (you can vote for your top ten here), but the real value of this list is as a … [Read more]
DARPA Contest for Fully-Automated Network Defense
DARPA is looking for a fully-automated network defense system: What if computers had a "check engine" light that could indicate new, novel security problems? What if computers could go one step further and heal security problems before they happen? To find out, the Defense Advanced Research Projects Agency (DARPA) intends to hold the Cyber Grand Challenge (CGC) -- the first-ever...
DNS strangeness
What's my test box called? It's headless, so I need to connect to it before I can find out. But then there's ARP. After booting, it should show up in eureka's ARP table, since it NFS mounts file systems. Took a look: eureka.lemis.com (192.109.197.137) at 00:1f:d0:20:4e:7f on re0 permanent [ethernet] swamp.lemis.com (192.109.197.138) at 00:10:5a:75:8d:ad on re0 expires in 36 seconds [ethernet] dxo.lemis.com (192.109.197.173) at 00:21:86:21:ab:7e on re0 expires in 1190 seconds [ethernet] stable-amd64.lemis.com.197.109.192.in-addr.arpa (192.109.197.192) at 08:00:27:3c:7f:5e on re0 expires in 1005 seconds [ethernet] ? (192.168.1.2) at 00:1f:d0:20:4e:7f on re0 permanent [ethernet] ?
Androids and Bluetooth keyboards
Chris Bahlo came in in the evening with a Bluetooth keyboard to try out on the Android tablet. Not an unqualified success: What's wrong there? And why does it identify itself with something that looks like an Ethernet MAC address? More investigation needed. ACM only downloads articles once.
Code Names for NSA Exploit Tools
This is from a Snowden document released by Le Monde: General Term Descriptions: HIGHLANDS: Collection from Implants VAGRANT: Collection of Computer Screens MAGNETIC: Sensor Collection of Magnetic Emanations MINERALIZE: Collection from LAN Implant OCEAN: Optical Collection System for Raster-Based Computer Screens LIFESAFER: Imaging of the Hard Drive GENIE: Multi-stage operation: jumping the airgap etc. BLACKHEART: Collection from an FBI Implant...
Usenix LISA schedule updated
The schedule of Usenix LISA sessions has been updated with icons that represents categories: DevOps, Cloud System Administration, Coding, Linux, Soft Skills and Women in Advanced Computing. Check it out.
Dry Ice Bombs at LAX
The news story about the guy who left dry ice bombs in restricted areas of LAX is really weird. I can't get worked up over it, though. Dry ice bombs are a harmless prank. I set off a bunch of them when I was in college, although I used liquid nitrogen, because I was impatient -- and they're harmless. I...
More Radiation Tower progress
They're back at work on the Radiation Tower: It looks as if they're connecting up the power, which shouldn't take them too long. Hopefully it'll just be a few days now. So: can I see the tower from my house? Up on the roof to take a look in that direction: Where is it? With the help of Google Maps, established that it's behind the gum trees in the middle of the view: This is from my Internet connection options map.
Ports pain
Some months ago I had a horrible experience: enblend only worked correctly with vigra if it was compiled with a specific version of gcc. I fixed that by ensuring that the correct version was used. But later I started getting error messages by email: From: pkg-[email protected] To: [email protected] Subject: [REL - head-amd64-default][graphics/enblend] Failed for enblend-4.1.1_1 in build You are receiving this mail as a port that you maintain is failing to build on the FreeBSD package build server. Please investigate the failure and submit a PR to fix build.
Can I Be Trusted?
SlashDot asks the question: I'm a big fan of Bruce Schneier, but just to play devil's advocate, let's say, hypothetically, that Schneier is actually in cahoots with the NSA. Who better to reinstate public trust in weakened cryptosystems? As an exercise in security that Schneier himself may find interesting, what methods are available for proving (or at least affirming) that...
Defending Against Crypto Backdoors
We already know the NSA wants to eavesdrop on the Internet. It has secret agreements with telcos to get direct access to bulk Internet traffic. It has massive systems like TUMULT, TURMOIL, and TURBULENCE to sift through it all. And it can identify ciphertext -- encrypted information -- and figure out which programs could have created it. But what the...
Why the Obamacare Website Sucks
Not a great launch. Wonder how many people with serious Web street cred are surprised? Ill tell you: zero. But its amazing how many political commentators are suddenly overflowing with site-building chops. In California, driving down the highway, I put the radio to scan and it pulled in some lively talk show, the man and woman were exchanging amazement over problems at Healthcare.gov. She said Mark Zuckerberg built Facebook basically overnight! Whats wrong with these cretins! And I just about drove off the road; have been holding my breath waiting for someone who knows this biz to explain why it could never have worked, out of the gate.
Interested in doing a lightning talk at LISA?
Talks are no more than 5 minutes with no AV (no slides, no videos, no projector). They can be on any topic though we prefer topics related to System Administration. Please keep the content 'professional' in tone. Sign up here. With only 5 minutes to give the talk it is important that you cut to the chase. I've seen some people make the mistake of spending a lot of time on something inconsequential like how to install the software they're talking about (and the talk wasn't about installation techniques). The best talks I've seen start with a solid explanation of the problem (in terms of the pain being caused) then explain the solution.
The Trajectories of Government and Corporate Surveillance
Historically, surveillance was difficult and expensive. Over the decades, as technology advanced, surveillance became easier and easier. Today, we find ourselves in a world of ubiquitous surveillance, where everything is collected, saved, searched, correlated and analyzed. But while technology allowed for an increase in both corporate and government surveillance, the private and public sectors took very different paths to get...
A Better Air Gap
Bruce Schneier recently published ten rules for setting up an air-gapped computer ; a computer that even the NSA can't hack, because it's not connected to the internet. His rules are practical and make sense, but, given the number of vulnerabilities regularly found in modern operating systems, I think that they need strengthening.
Weather too dry to measure
It's been nearly 4 years since I wrote my weather station software. It's been a fight against the vagaries of the weather station, but in general things seem to be working as well as the device will allow. But today I got a whole set of 0 readings. Further investigation showed that the station wasn't returning valid external humidity information. It was warm and dry, and the last readings had been 10%. Sure enough, as things cooled down, the humidity went up again: So it seems that the station can't report less than 10% humidity.
Friday Squid Blogging: Fiona Apple Wears a Squid as a Hat in New Video
Even I think this is weird....
DevBeat
I normally dont post here any more about events Im speaking at, but DevBeat looks unusual. I mean, follow that link and look at the list of entertainers, which includes RMS, Al3x, DHH, Rasmus, and Mojombo. Who have in common, near as I can tell, exactly nothing. Its a VentureBeat thing so I guess itll be crawling with VCs and people looking for money; Ill try to moderate my general negativity about the current state of VC. But I have to say, its one of the few events where I look at the roster and think That should be interesting.
Things About the X-E1
Seven months ago I got an X-E1, a product of Fujifilm, who announced the X-E2 today; an occasion for going a little deeper on my time with the camera. With a dozen pictures. 18-55mm@34, F5, 1/250 sec, ISO 200 First, the conclusion Its the best camera Ive ever used: Light, wonderful in the hand, perfect controls, astounding lenses, pleasing pictures. So if you were thinking of buying a Serious Camera, this is totally one of the ones you should look at. Or maybe the X-E2; more on that below. Did you say perfect controls ? Yep. The picture shows what you see when you look down at the camera in your hands.
D-Link Router Backdoor
Several versions of D-Link router firmware contain a backdoor. Just set the browser's user agent string to "xmlset_roodkcableoj28840ybtide," and you're in. (Hint, remove the number and read it backwards.) It was probably put there for debugging purposes, but has all sorts of applications for surveillance. Good article on the subject....
Identifying Cell Phones Through Sensor Imperfections
There seems to be a bunch of research into uniquely identifying cell phones through unique analog characteristics of the various embedded sensors. These sorts of things could replace cookies as surveillance tools. Slashdot and MetaFilter threads....
"A Court Order Is an Insider Attack"
Ed Felten makes a strong argument that a court order is exactly the same thing as an insider attack: To see why, consider two companies, which we'll call Lavabit and Guavabit. At Lavabit, an employee, on receiving a court order, copies user data and gives it to an outside party -- in this case, the government. Meanwhile, over at Guavabit,...
NPRs Studio 360 on Disney parks
The NPR Show Studio 360 has released a great episode in its "American Icons" series, this one dealing with the Disney themeparks. I was delighted to be interviewed for it, and they've included our complete, unedited interview with the piece. Generations of Americans have grown up with Walt Disney shaping our imaginations. In 1955, Disney … [Read more]
SecureDrop
SecureDrop is an open-source whistleblower support system, originally written by Aaron Swartz and now run by the Freedom of the Press Foundation. The first instance of this system was named StrongBox and is being run by the New Yorker. To further add to the naming confusion, Aaron Swartz called the system DeadDrop when he wrote the code. I participated in...
Canvas is Easy and Fun
Ive been fooling with a favorite-color app as an Identity-tech testbed, and I wanted to reward people just a little for taking the effort to pick and save and maybe share their own faves. Id seen some of the flashy stuff that the cool kids are doing with HTML5 and even though Im really a server-side guy it looked like fun, so I poked around. What I discovered is that the HTML5 Canvas is easy to learn and easy to program, so Im going to show you a little hack I did, not because theres anything particularly wonderful about it, but just to try help convince anyone who hasnt dived in that maybe they should.
iPhone Sensor Surveillance
The new iPhone has a motion sensor chip, and that opens up new opportunities for surveillance: The M7 coprocessors introduce functionality that some may instinctively identify as "creepy." Even Apples own description hints at eerie omniscience: "M7 knows when youre walking, running, or even driving&" While its quietly implemented within iOS, its not secret for third party apps (which require...
Ads In Front of Things
Theyre bad. I wait feverishly for your ad to finish loading so I can click on the X to dismiss it. The only exception is when I decide my lifes completeness does not depend on the pathetic page behind the awful ad, so I just kill the window. I promise I will never read your stupid ad thats in front of the things that I thought I wanted to see. When I see it, I suspect a broken business model; if you need to inflict this kind of abuse on your readers, a barrels bottom is being scraped. If thats whats up well Im sorry, sucks to be you and I genuinely hope quality publishing finds good business models but Im really fucking sure none of them are floating interstitials.
NSA Harvesting Contact Lists
A new Snowden document shows that the NSA is harvesting contact lists -- e-mail address books, IM buddy lists, etc. -- from Google, Yahoo, Microsoft, Facebook, and others. Unlike PRISM, this unnamed program collects the data from the Internet . This is similar to how the NSA identifies Tor users. They get direct access to the Internet backbone, either through...
New Secure Smart Phone App
It's hard not to poke fun at this press release for Safeslinger, a new cell phone security app from Carnegie Mellon. "SafeSlinger provides you with the confidence that the person you are communicating with is actually the person they have represented themselves to be," said Michael W. Farb, a research programmer at Carnegie Mellon CyLab. "The most important feature is...
Evi Nemeth news...
http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=11140086
Massive MIMO Cryptosystem
New paper: "Physical-Layer Cryptography Through Massive MIMO." Abstract: We propose the new technique of physical-layer cryptography based on using a massive MIMO channel as a key between the sender and desired receiver, which need not be secret. The goal is for low-complexity encoding and decoding by the desired transmitter-receiver pair, whereas decoding by an eavesdropper is hard in terms of...
Android navigators: worth the trouble?
Into town again to see the doctor, and of course took my Android tablet with two navigation programs: Sygic and OsmAnd Maps & Navigation. Things didn't start well: the clinic is at 49 Albert St, Sebastopol. Albert Street is the main street in Sebastopol, but Sygic didn't know it: it proved that it knew it only as Midland Highway , so it directed me to Alfred Street instead. OsmAnd knew Alfred St, but not the number. The building is relatively new, admittedly, but my old GPS navigator knows it. On the whole, a good thing I didn't have to rely on either program.
Insecurities in the Linux /dev/random
New paper: "Security Analysis of Pseudo-Random Number Generators with Input: /dev/random is not Robust, by Yevgeniy Dodis, David Pointcheval, Sylvain Ruhault, Damien Vergnaud, and Daniel Wichs. Abstract: A pseudo-random number generator (PRNG) is a deterministic algorithm that produces numbers whose distribution is indistinguishable from uniform. A formal security model for PRNGs with input was proposed in 2005 by Barak and...
LOPSA-East 14: Call for Volunteers
Evan Pettrey just emailed out the LOPSA-East 14: Call for Volunteers. The next conference is May 2-3, 2014. Mark your calendar and join the volunteer team. It is a great way to get involved in the community and meet new people! Evan's complete letter after the bump.
Starting a new habit by linking it to an existing one
I wrote a lot about habits in Time Management For System Administration. If there is something you need to do a lot, turning it into a habit means you are more likely to do it and less mental effort is required when doing it. To paraphrase the Java (programming language) slogan "Write once, run everywhere": Habits let you "Think once, do always." One tip I realized after finishing the book was the power of linking one habit to another. If you need to add a new habit, linking it to an existing habit helps develop that habit. Here's an example: Problem: I forget to put my wedding ring back on after I shower.
Fingerprinting Burner Phones
In one of the documents recently released by the NSA as a result of an EFF lawsuit, there's discussion of a specific capability of a call records database to identify disposable "burner" phones. Lets consider, then, the very specific data this query tool was designed to return: The times and dates of the first and last call events, but apparently...
Sygic: the weaknesses
One of the reasons I went to town was to try out Sygic in more normal circumstances. A good thing, too: it didn't do well. Going from the Botanical Gardens to the petrol station in Sebastopol took a seriously suboptimal shortest difference: The alternative suggestion to the south-west is just so far from short that it's incomprehensible how it could have come up at all. But the correct way would have been down to the east of Victoria park (triangle at top middle), like every other program chose.
Radiation Tower progress
On the way into town, stopped at the Radiation Tower, of course. They've mounted the S-shaped cable channel: What needs to be done? The cabling, of course, but presumably that's almost only power, which shouldn't take too long. ACM only downloads articles once.
At the Market
Granville Island market I mean, a nice place in Vancouver, particularly on a sunny Sunday in October, Canadian-Thanksgiving weekend. In among the merchants there are buskers, mostly good; this sharp-dressing dude has been singing sentimental tunes in French for years there, not always with a backdrop this good. Inside the Childrens Market, theres a store with kites and stuffies. Here are some more photos of the market in general and the kite store in particular from 2008, taken with my short-lived and difficult Ricoh GX-100 which nonetheless took some good pictures for me. The quality of the produce at the Island is, to be frank, not up there with what you can get at a decent organic-focused supermarket, but the variety and quantity are excellent and you cant beat the visuals.
Humour, then and now
While tidying up my web pages, came across an orphan that has obviously been there for a long time: collected humourous articles from USENET and similar sources, about 20 years old. It's amazing how badly they have aged. ACM only downloads articles once. It's possible that this article has changed since being downloaded, but the only way you can find out is by looking at the original article.
Glove and Boots mirror my NYC post!
You may recall Tom's guide for Tourists Visiting NYC (special Sept 11th anniversary edition). Glove and Boots, one of my... no... my favorite YouTube channels has just done a video that is surprisingly similar. Of course, theirs is a lot funnier (and leaves out the Sept 11 Memorial part, understandable). Check it out:
Still more map errors
Discussed my article about the NBN coverage maps and with Callum Gibson today, and it occurred to us to look at the information from ACMA. They have a search page where you can find all communication towers in the country. So went looking, and sure enough, we came up with information for the Dereel and Cape Clear towersbut not for Rokewood. But Callum did some investigation and found this towerit's the Optus tower that was erected two years ago. And, of course, it's nowhere near where the NBN put it. But more careful investigation showed that the ACMA coordinates are wrong too!
Friday Squid Blogging: 30-Foot Giant Squid Washes Ashore
A 30-foot-long giant squid has washed ashore in Cantabria, Spain. It died at sea, with a broken tentacle. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Stuff I Say
It's a Tumblr feed. Right now there are only six posts, all a year old. Presumably that will change soon. To clarify: I have nothing to do with the feed, and anyone can post stuff to it....
The Ingress Social Network
While I go days at a time without turning on the client, I do still go out on an Ingress level-8 op every week or two; and now I have a couple of purely-social reasons to pitch in now and then. Previously in this series: Ingress, Things About Ingress, Ingress, Month 3, Ingress Weekly, Ingress Tourism, Advanced Ingress, Ingress Chase Scene, and Ingress Ebb and Flow. The first is that my wife started playing. After watching me grind away between November and April, she suddenly asked for an account and quietly worked her way to Level 8 in less than four months; it helps that the portal density near our house is extreme, and also she travels to other big cities.
New Low in Election Fraud
Azerbaijan achieves a new low in voter fraud. They government accidentally publishes the results of the election before the polls open. The mistake came when an electoral commission accidentally published results showing a victory for Ilham Aliyev, the countrys long-standing President, a day before voting. Meydan TV, an online channel critical of the government, released a screenshot from a mobile...
Wrist-watch cell phones
A friend commented to me: Are we really so lazy that we cannot "take the time" to remove a 4 inch device from our pocket to check the next meeting or see who's calling?" A new level of convenience turns something old into something new. Remember the move from dial-up to cable/dsl wasn't so much about speed but the "always on" capability. Wanted to look something up? Your computer was already connected. Friction-free use of the internet made the internet feel more useful. Today can you imagine a 30-60 second delay any time you want to use the internet?
Air Gaps
Since I started working with Snowden's documents, I have been using a number of tools to try to stay secure from the NSA. The advice I shared included using Tor, preferring certain cryptography over others, and using public-domain encryption wherever possible. I also recommended using an air gap, which physically isolates a computer or local network of computers from the...
More NBN tower investigations
Looking more carefully at the NBN rollout map shows that they've put up a number of towers. In this area alone four are marked as being operational: The one in Cape Clear puzzled me: according to Scott Weston, it receives its uplink from the Dereel tower. So I set off to have a look. It seems that every single tower is significantly misplaced, and to actually find any I had to look around in the area. In Cape Clear I was successful, though the tower is over 4 km from where it is claimed to be: Looking at the uplink antennas, it doesn't seem to have anything to do with Dereel.
Video: Why Attend LISA '13?
Usenix has released a video with a number of Usenix attendees explaining why they go to LISA. I make a brief appearance. https://www.youtube.com/watch?v=NBJkB8mp3V4
Book signing at LISA
People often tell me they wanted to ask me to sign a copy of my book but "didn't bring it to the conference because they didn't think I'd want to be bothered". The truth is that (nearly) all authors love to be asked to sign their book. I'll be doing a book signing on Thursday at 1pm in the exhibit hall. Other authors such as Mark Burgess and Diego Zamboni will be there to sign books too. I hope to see you there! Tom
Breaking Taiwan's Digital ID
There's a serious random-number generation flaw in the cryptographic systems used to protect the Taiwanese digital ID. Article and paper....
AWS Activate Supporting Startups on AWS
I am very excited to announce AWS Activate, a program designed to provide startups with the resources they need to build applications on AWS. Startups will forever be a very important customer segment of AWS. They were among our first customers and along the way some amazing businesses have been built by these startups, many of which running for 100% on AWS. Startups operate in a world of high uncertainty and limited capital, so an elastic and on-demand infrastructure at low and variable cost aligns very naturally with their needs. By reducing the cost of failure and democratizing access to infrastructure, the cloud has enabled more startups to build, experiment, and scale.
AWS Activate ? Supporting Startups on AWS
I am very excited to announce AWS Activate, a program designed to provide startups with the resources they need to build applications on AWS. Startups will forever be a very important customer segment of AWS. They were among our first customers and along the way some amazing businesses have been built by these startups, many of which running for 100% on AWS.
NBN delays: explanation?
So yesterday Exetel told me that NBN had rejected my application for a connection. Correct? I also got an automated courtesy call on the phone, telling me that my application for ADSL had been rejected, so a bit of clarity would go a long way. First took a look at the coverage map, which has now been updated: Fixed wireless | Construction commenced - construction commenced in your area on [sic] Aug 2013. It is estimated that the average time from construction beginning to NBN services being available is 12 months What nonsense!
Radiation Tower progress
After yesterday's erection of the Radiation Tower, I was expecting a delay before the next stage, but it seems that they're continuing: My guess is that they're about to pour the concrete base. ACM only downloads articles once.
A New Postal Privacy Product
The idea is basically to use indirection to hide physical addresses. You would get a random number to give to your correspondents, and the post office would use that number to determine your real address. No security against government surveillance, but potentially valuable nonetheless. Here are a bunch of documents. I honestly have no idea what's going on. It seems...
Seating at my Usenix LISA tutorials is limited.
Register ASAP before all the seats are gone. This year my classes are all on Tuesday which is the most popular day to attend. That means the seats will fill up even faster. I've totally revamped my "Advanced Time Management: Team Efficiency" tutorial and my entirely new "Evil Genius 101" class is chock full of DevOps goodness plus a lot of traditional "how to sell your evil plan to management" badness. Register today: https://www.usenix.org/conference/lisa13
IPv6 Flashcards
In IPv4 there are a number of things that every sysadmin knows. I bet you recognize the following: 127.0.0.1 10.0.0.0/8 192.168.0.1 /24 /26 /32 255.255.255.255 255.255.255.0 You probably didn't even have to think hard about most of those. So what are the equivalents in IPv6? I don't mean the direct translations, but what is the list of terms and numbers that sysadmins should know? I recently sat down and came up with such a list. I listed things that Unix and Windows sysadmins should know. WAN/LAN network administrators need to know a lot, lot, more. This just covers common knowledge, a lot like the IPv4 list above.
The NSA's New Risk Analysis
As I recently reported in the Guardian, the NSA has secret servers on the Internet that hack into other computers, codename FOXACID. These servers provide an excellent demonstration of how the NSA approaches risk management, and exposes flaws in how the agency thinks about the secrecy of its own programs. Here are the FOXACID basics: By the time the NSA...
Usenix LISA Early Bird deadline is 1 week away!
The early bird registration and hotel reservation deadlines are both next Tuesday, October 15, 2013. Remember that airfare is a lot cheaper if you book 21 days in advance. If you would like to spread the word about LISA, consider printing this one page flyer and giving it to coworkers. Register today: https://www.usenix.org/conference/lisa13 There are also Facebook, YouTube, Google+, LinkedIn, Lanyrd, and Twitter doohickies to like, plus, follow and so on. SEATS ARE LIMITED for my tutorials. Please sign up ASAP!
Three problems with the DevOps community
People that complain that the enterprise world doesn't get DevOps but don't participate in enterprise conferences. Lack of a "sound bite" definition of DevOps; leads to confusion. I was recently told "DevOps means developers have to carry pagers... that's why our developers don't want anything to do with it." If that's the definition that is getting out, we're in trouble. Engineers thinking that "if something is good, it doesn't need marketing". Tell that to the many inventions of Nikola Tesla that never got turned into products. The "build a better mouse trap and people will beat a path to your door" myth was debunked years ago.
Trying Sygic again
Some weeks ago I tried Sygic on my Android tablet. It was somewhat inconclusive, because I didn't have a windscreen mount for the tablet, and then I discovered that the free app in fact was only a one week free trial, which expired before I could do any more. Now I have a new tablet, but the same account. Can I run another one week trial with it? Surprisingly, yes. And after loading hundreds of megabytes of map data (and surviving a couple of network problems), spent some time looking at the features. On the down side, of course, it's an Android app, which means that there's almost no help available.
Still more unexpected network pain
Even before my current unresolved issues with Internode's sales team, I had decided that I would try Extel for my NBN network connection. Yes, Internode has the best reputationpossibly based mainly on past achievementsbut almost the only issues I've ever had with my network connection have been between the ISP and my premises. And with NBN that's independent of the ISP. On the other hand, Exetel offers higher traffic rates for the same price: 50 GB per month instead of 30 with Internode, and only downlink traffic is counted. Most importantly, though, traffic between 01:00 and 09:00 isn't metered. At 25 Mb/s you can download a theoretical 90 GB of data (video, for example) in a single day during that time.
Radiation Tower erected
Everybody's watching the progress on the Radiation Tower, and today was a milestone: How much longer? Hard to guess. Three weeks? A month? ACM only downloads articles once. It's possible that this article has changed since being downloaded, but the only way you can find out is by looking at the original article.
Me on Surveillance
This is a video of me talking about surveillance and privacy, both relating to the NSA and more generally....
Why It's Important to Publish the NSA Programs
The Guardian recently reported on how the NSA targets Tor users, along with details of how it uses centrally placed servers on the Internet to attack individual computers. This builds on a Brazilian news story from a mid-September that, in part, shows that the NSA is impersonating Google servers to users; a German story on how the NSA is hacking...
Unexpected network pain
I've had enough pain with the services quality of my wireless Internet service, but despite the imminent erection of the Radiation Tower, I needed to increase my traffic allowance in the meantime, hopefully only for one month. I did that last week, but things didn't go as smoothly as I had expected. As I mentioned last Friday, they sent me an invoice for two months' fees, and also stated that billing would start at the latest 7 days after provisioning. And then they didn't answer the mail I sent them. That happened today: In regards to your plan costs, I can confirm that as you've ordered the NodeMobile 9GB plan your monthly service cost will simply be $39.95 per month.
Silk Road Author Arrested Due to Bad Operational Security
Details of how the FBI found the administrator of Silk Road, a popular black market e-commerce site. Despite the elaborate technical underpinnings, however, the complaint portrays Ulbricht as a drug lord who made rookie mistakes. In an October 11, 2011 posting to a Bitcoin Talk forum, for instance, a user called "altoid" advertised he was looking for an "IT pro...
Guest Post: Jennifer Joy's PuppetConf 2013 attendee report
[As you may recall, a few months ago PuppetLabs gave me a few free admission tickets to give away. One of the recipients was Jennifer Joy, who wrote this conference report. -Tom] Conference Report: PuppetConf 2013, by Jennifer Joy It has been a long time since I was in the sysadmin space. Any further clarification would reveal I have been through far too many iterations of technology (I'm pretty sure you can date sysadmins with a swift core sample and counting the rings caused by each swing between centralized and decentralized architectures). The problem of managing large numbers of systems, especially diverse systems, is not new. Having been out of the systems game for over 10 years (ok, now you know, but I'm not telling you when I started!)
How the NSA Attacks Tor/Firefox Users With QUANTUM and FOXACID
The online anonymity network Tor is a high-priority target for the National Security Agency. The work of attacking Tor is done by the NSA's application vulnerabilities branch, which is part of the systems intelligence directorate, or SID. The majority of NSA employees work in SID, which is tasked with collecting data from communications systems around the world. According to a...
New photo processing software?
It's fairly clear that I'm going to buy an Olympus OM-D E-M1 camera. That will require some changes to my photo processing. Currently I'm using DxO Optics Pro , but it only supports specific combinations of camera and lens. The E-M1 is only just appearing on the market, so so far they don't have any support for it, but when it comes it'll almost certainly be only for ¼FT lenses. And I currently have 5 normal FT. Based on past performance, it's fairly clear that DxO will not support those combinations. But what's the alternative? One might be Olympus Viewer, which I tried out earlier this year.
Android streamers: a solution
Yesterday's experiment with streaming audio on Android was less than completely successful, so I went searching further. Why is the toyshop so badly organized? There's no way to search by feature, rating, or number of downloads. Instead I went to Google and found, right at the top, TuneIn Radio. Downloaded that, and it worked. I still don't know why I need a separate app to play this stuff, but it really seems that Android web browsers are so castrated that you can't do much with them. ACM only downloads articles once.
History Mystery
I just finished After Tamerlane by John Darwin, of whom I know nothing. Its a 600-dense-page monster and my impulse-bought-but-unread queue bulges behind it. Its immensely ambitious and I can recommend it for some if not all. Tl;dr: A history of the last 600 years with a strong economics flavor, which asks: Why did Europe come to dominate the globe? Why Europe? The death of Timur (AKA Tamerlane) in the early 15th century makes an interesting jumping-off point because, as Darwin points out in the books central insight, at that point the world had three centers of commerce and civilization: Europe, the South Central Asia, and China, and (here it is) their power and wealth were, at that point, about equivalent.
Playing music on Android
One of the things an Android tablet is good for is playing music, right? Well, that's the idea, anyway. With the promise of more network traffic just round the corner, considered listening to Radio Swiss Classic on the radio instead of ABC: they have a more interesting programme. Just plug the tablet into the Hi-Fi system and we're away. I even found a suitable cable in my assorted junk. That's straightforward enough, right? I have already had problems playing music on Android, but I worked around them by installing firefox. Tried again on the stream. Sorry, can not open file . Why not?
Central PA Open Source Conference (CPOSC), October 19, Lancaster, PA
The Central PA Open Source Conference (CPOSC) is a small, low-cost, one-day conference about all things Open Source. It was started in 2008 by a few of the members of the Central PA Linux User Group and the Central PA Ruby Meetup. For more info: http://lanyrd.com/2013/cposc/ http://cposc.org/
Back-to-Basics Weekend Reading - Tor: The Second-Generation Onion Router
The anonymity routing network Tor is frequently in the news these days, which makes it a good case to read up on the fascinating technologies behind it. Tor stands for The Onion Router as its technology is based on the onion routing principles. These principles were first described by Goldschlag, et al., from the Naval Research Lab, in their 1996 paper on Hiding Routing Information. Almost immediately work started on addressing a number of omissions in the original work in what became known as the second-generation onion router. Tor is the implementation of such a second generation router and has a number of fascinating features.
Friday Squid Blogging: Squid Exhibit at the Monterey Bay Aquarium
Opens spring 2014. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....
Comic about Doctorow/Doctor Who from a ten-year-old artist
David sent me a note and a pic: Claire and I have been happy mutants for several years; and so our 10 year-old son, Joseph, has often seen us chuckle at a Boing Boing posting, marvel at some piece of LEGO engineering or share a piece of Whoviana. Ive read a few of your books, … [Read more]
"Trust the Math"
I like this piece of art. Someone should do T-shirts....
Back-to-Basics Weekend Reading - Tor: The Second-Generation Onion Router
The anonymity routing network Tor is frequently in the news these days, which makes it a good case to read up on the fascinating technologies behind it. Tor stands for The Onion Router as its technology is based on the onion routing principles. These principles were first described by Goldschlag, et al.
Developments in Microphone Technology
What's interesting is that this matchstick-sized microphone can be attached to drones. Conventional microphones work when sound waves make a diaphragm move, creating an electrical signal. Microflown's sensor has no moving parts. It consists of two parallel platinum strips, each just 200 nanometres deep, that are heated to 200° C. Air molecules flowing across the strips cause temperature differences between...
Internode: more decay
I've commented in the past that Internode isn't what it used to be. Buying the second SIM card proved to be relatively simple, but the followup wasn't. It's clear that with the coming of the Radiation Tower I'll only need the card for one, maybe two months, and that's why I bought one with a one month renewal period. But the follow-up emails read: Your Order Reference Number: #1264795/nNodeMobile Data at 47 Kleins Road, DEREEL VIC 3352 * For 1 Month ...
Documentation web sites
My new car has nearly used up a tank full of petrol, which seems surprising. But then, I've done nearly 500 km with it. How big's the tank? That's the sort of thing you'd find in the instruction manual, but mine came without one. That's what the web's for! Went out searching for (ultimately) hyundai elantra 2002 owners manual download, and found lots of links like this one: That looked like just what I wanted, and elsewhere it had claimed to be free.
Tom @ LOPSA-NJ, Thu Oct 3, 2012, Lawrenceville, NJ (near Princeton)
I'll be speaking at LOPSA-NJ's October meeting. The topic will be "Heroes of IT". It is a rehearsal of a talk I'll be giving at another conference later this month. Full information here: http://www.lopsanj.org
More Radiation Tower progress
The weather has been wet recentlyin the last 10 days, we've had nearly 50 mm of rain, and it shows. Heard a report from Wendy, our neighbour across the road, that she had seen a crane bogged down in the paddock where the Radiation Tower is being erected. It sounds plausible: Chris Bahlo told me she saw a crane there this morning, too, so I went by laterthis may be becoming a daily exercise at the moment. There was no crane there, but it's clear that they're assembling the tower in preparation for erection: It's interesting that the uplink antenna already appears to be ...
Trip Report: Fall ISO C++ standards meeting
I just posted my trip report on isocpp.org. Also be sure to read the Current ISO C++ status page. We accomplished a lot last week — thanks to all the volunteers for making this a very productive and successful meeting! Just to visualize everything that’s going on, here’s a copy of the current ISO C++ […]
Tab Sweep
The tabs! They multiply like magnificently miscellaneous maggots! Literature Good Time Crime: Talking With Elmore Leonard in Contrappasso Magazine. For those like Scalzi in general or the Old Mans War series in particular, check out The Sagan Diary over at Subterranean Press. And now for something completely different: Jeremy Wilson, perhaps the leading biographer of T.E. Lawrence ( of Arabia ), observes that there have been many moving-picture takes on his life, and offers T. E. Lawrence alternative drama treatments, which I enjoyed tremendously but then Im a Lawrence nut. Identity Thats right, stuff related to my day job. Nat Sakimura: What to read when you want to build OpenID Connect and Write an OpenID Connect server in three simple steps.
Bugg Synthesis
I was sitting up late; family asleep and work over, scanning around. The New Yorker feed threw up Jake Bugg: From Nottingham to Malibu. He sounded interesting on paper and, hey, the article was full of YouTube links and what with the ChromeCast, I was listening and watching right there and then. Yeah, Jakes good, Id go see him if he came to town. You may never have heard of him but I guarantee youve heard Lightning Bolt. Synthesis? The Internet is one great big fat culture pump, dont you forget it.
Is Cybersecurity a Profession?
A National Academy of Sciences panel says no: Sticking to the quality control aspect of the report, professionalization, it says, has the potential to attract workers and establish long-term paths to improving the work force overall, but measures such as standardized education or requirements for certification, have their disadvantages too. For example, formal education or certification could be helpful to...
On Anonymous
Gabriella Coleman has published an interesting analysis of the hacker group Anonymous: Abstract: Since 2010, digital direct action, including leaks, hacking and mass protest, has become a regular feature of political life on the Internet. The source, strengths and weakness of this activity are considered in this paper through an in-depth analysis of Anonymous, the protest ensemble that has been...
Radiation Tower progress
Yvonne went shopping this morning. She had barely left when I got an excited call They're working on the tower! . And so they were: The truck had an emblem from Task National Pty Ltd, a company that appears to have no web site. But I found references to employees, one of them a telecommunications engineer, so I assume they're doing more than just laying a power cable. ACM only downloads articles once.
Fear, Uncertainty and Desperation
Talking Little Brother on KQEDs The Forum
I was privileged to appear on Michael Krasny's Forum on KQED in San Francisco this morning as part of the San Francisco Public Library's One City/One Book celebrations for my novel Little Brother. The KQED people already have the audio (MP3) up on the Internet, which is pretty zippy production-mojo.
On Secrecy
"When everything is classified, then nothing is classified." I should suppose that moral, political, and practical considerations would dictate that a very first principle of that wisdom would be an insistence upon avoiding secrecy for its own sake. For when everything is classified, then nothing is classified, and the system becomes one to be disregarded by the cynical or the...
"Soft Skills" instruction at Usenix LISA
The best technical skills are useless if you can't understand the people you work with, communicate with them, and manage your own time. Here is a list of "soft skills" presentations at LISA this year. No, they won't turn you into a manager.
My TEDx Talk
I spoke at TEDxCambridge last month on security and power. Here's the video....
Getting more Internet traffic
One of the consequences of the Coursera courses I'm taking is that my Internet traffic has increased dramatically. Last month we barely managed to stay within the 18 GB limit on my wireless broadband connection. Roll on the Radiation Tower! This month doesn't look much better. I'm just under, but a couple of new courses are about to start, and I can't see any hope of staying within the limits. I'd take a tariff plan with more volume if I could, but Internode doesn't offer one. But there's an obvious, if slightly clumsy, workaround: buy another SIM card, though it's a pity I have to do this so shortly before completion of the Radiation Tower.
2013 Nexus 7 with LTE
I bought the top-of-the-line model from the Play store for $349; I was still liking last years model but this is sleeker and prettier and goes faster. The differences are less dramatic than Id expected, but theyre good things. In the hand and pocket Its lighter and thinner and smoother. The first two are good; I think I slightly prefer the textured back of last years 7, but this balances much better in the hand. Its also very slightly taller; just enough to cause problems with one of the pockets Id been parking its predecessor in. But I doubt this will bother most people.
NSA Storing Internet Data, Social Networking Data, on Pretty Much Everybody
Two new stories based on the Snowden documents. This is getting silly. General Alexander just lied about this to Congress last week. The old NSA tactic of hiding behind a shell game of different code names is failing. It used to be they could get away with saying "Project X doesn't do that," knowing full well that Projects Y and...
Will Keccak = SHA-3?
Last year, NIST selected Keccak as the winner of the SHA-3 hash function competition. Yes, I would have rather my own Skein had won, but it was a good choice. But last August, John Kelsey announced some changes to Keccak in a talk (slides 44-48 are relevant). Basically, the security levels were reduced and some internal changes to the algorithm...
WhoIs Privacy and Proxy Service Abuse
ICANN has a draft study that looks at abuse of the Whois database. This study, conducted by the National Physical Laboratory (NPL) in the United Kingdom, analyzes gTLD domain names to measure whether the percentage of privacy/proxy use among domains engaged in illegal or harmful Internet activities is significantly greater than among domain names used for lawful Internet activities. Furthermore,...
OsmAnd Maps & Navigation in practice
The trip to Ballarat also gave me the first opportunity to try out OsmAnd Maps & Navigation in practice. The results were interesting, both good and (unfortunately mainly) bad: The TTS voice output sounds like a caricature of an old (US American) woman. We tried it in German instead, which was barely better, but had the amusing side effect of extreme mispronunciation of street names. I'm sure that can be fixed.