Links for 2016-06-14

Posted in Uncategorized | Comments closed

Links for 2016-06-13

Posted in Uncategorized | Comments closed

Links for 2016-06-08

  • Stop it with short PGP key IDs!

    What happened today? We still don’t really know, but it seems we found a first potentially malicious collision — that is, the first “nonacademic” case. Enrico found two keys sharing the 9F6C6333 short ID, apparently belonging to the same person (as would be the case of Asheesh, mentioned above). After contacting Gustavo, though, he does not know about the second — That is, it can be clearly regarded as an impersonation attempt. Besides, what gave away this attempt are the signatures it has: Both keys are signed by what appears to be the same three keys: B29B232A, F2C850CA and 789038F2. Those three keys are not (yet?) uploaded to the keyservers, though… But we can expect them to appear at any point in the future. We don’t know who is behind this, or what his purpose is. We just know this looks very evil. Now, don’t panic: Gustavo’s key is safe. Same for his certifiers, Marga, Agustín and Maxy. It’s just a 32-bit collision. So, in principle, the only parties that could be cheated to trust the attacker are humans, right? Nope. Enrico tested on the PGP pathfinder & key statistics service, a keyserver that finds trust paths between any two arbitrary keys in the strong set. Surprise: The pathfinder works on the short key IDs, even when supplied full fingerprints. So, it turns out I have three faked trust paths into our impostor.

    (tags: pgp gpg keys collisions hashing security debian)

  • UK at serious risk of over-blocking content online, human rights watchdog warns | Ars Technica UK

    The IWF in the spotlight…

    The blacklist operated by the IWF effectively amounts to censorship. Not only are the blacklist and notices sent to members of the IWF kept secret, but there is no requirement to notify website owners when their site has been added to the blacklist. Even where statutory rules do exist with respect to notice and take-down procedures (namely, the Terrorism Act 2006 and the Defamation (Operators of Websites) Regulations 2013), the provisions are not so concerned with safeguards for the protection of freedom of expression, as with offering an exemption from liability for ISPs.

    (tags: iwf censorship uk filtering coe eu europe)

Posted in Uncategorized | Comments closed

Links for 2016-06-07

Posted in Uncategorized | Comments closed

Links for 2016-06-03

  • FullPageOS Automatically Boots Your Raspberry Pi Into a Full Page Web Kiosk Mode

    set up to boot into a full-screen Chromium window on boot. This means if you’re using your Pi to power an information display, you won’t need to go through the process of disabling screen savers, editing display size, and forcing full-screen mode on your own. All you need to do is install FullPageOS on an SD card, then edit a TXT file to include your Wi-Fi network info and the URL you want it to load up.

    (tags: kiosks raspberry-pi fullpageos chrome chromium web appliances hacks)

  • _Could a Neuroscientist Understand a Microprocessor?_

    ‘There is a popular belief in neuroscience that we are primarily data limited, that producing large, multimodal, and complex datasets will, enabled by data analysis algorithms, lead to fundamental insights into the way the brain processes information. Microprocessors are among those artificial information processing systems that are both complex and that we understand at all levels, from the overall logical flow, via logical gates, to the dynamics of transistors. Here we take a simulated classical microprocessor as a model organism, and use our ability to perform arbitrary experiments on it to see if popular data analysis methods from neuroscience can elucidate the way it processes information. We show that the approaches reveal interesting structure in the data but do not meaningfully describe the hierarchy of information processing in the processor. This suggests that current approaches in neuroscience may fall short of producing meaningful models of the brain.’ via Bryan O’Sullivan.

    (tags: via:bos neuroscience microprocessors 6502 computers hardware wetware brain biology neural-systems)

Posted in Uncategorized | Comments closed

Links for 2016-06-02

Posted in Uncategorized | Comments closed

Links for 2016-06-01

  • ztellman/dirigiste

    ‘centrally-planned object and thread pools’ for java. ‘In the default JVM thread pools, once a thread is created it will only be retired when it hasn’t performed a task in the last minute. In practice, this means that there are as many threads as the peak historical number of concurrent tasks handled by the pool, forever. These thread pools are also poorly instrumented, making it difficult to tune their latency or throughput. Dirigiste provides a fast, richly instrumented version of a java.util.concurrent.ExecutorService, and provides a means to feed that instrumentation into a control mechanism that can grow or shrink the pool as needed. Default implementations that optimize the pool size for thread utilization are provided. It also provides an object pool mechanism that uses a similar feedback mechanism to resize itself, and is significantly simpler than the Apache Commons object pool implementation.’ Great metric support, too.

    (tags: async jvm dirigiste java threadpools concurrency utilization capacity executors object-pools object-pooling latency)

Posted in Uncategorized | Comments closed

Links for 2016-05-31

Posted in Uncategorized | Comments closed

Links for 2016-05-30

  • Green/Blue Deployments with AWS Lambda and CloudFormation – done right

    Basically, use a Lambda to put all instances from an ASG into the ELB, then remove the old ASG

    (tags: asg elb aws lambda deployment ops blue-green-deploys)

  • Six Years of Hacker News Comments about Twilio

    love it.

    (tags: twilio hn hackernews funny tech)

  • fiunchinho/dockerize-me

    ‘Tired of copy/pasting Dockerfiles around? Not sure about best practices for Dockerfiles or Docker entry points? This tool lets you Dockerize your applications using best practices to define your Dockerfile and Docker entry point files.’ The best practices in question are defined here:

    (tags: docker dockerfile images build best-practices alpine containers)

  • grammarly/rocker

    backward compatible replacement for Dockerfile. Yes, you can take any Dockerfile, rename it to Rockerfile and use rocker build instead of docker build. … Rocker aims to solve the following use cases, which are painful with plain Docker: Mount reusable volumes on build stage, so dependency management tools may use cache between builds. Share ssh keys with build (for pulling private repos, etc.), while not leaving them in the resulting image. Build and run application in different images, be able to easily pass an artifact from one image to another, ideally have this logic in a single Dockerfile. Tag/Push images right from Dockerfiles. Pass variables from shell build command so they can be substituted to a Dockerfile. And more. These are the most critical issues that were blocking our adoption of Docker at Grammarly. The most challenging part is caching. While implementing those features seems to be not a big deal, it’s not trivial to do that just by utilising Docker’s image cache (the one that docker build does). Actually, it is the main reason why those features are still not in Docker. With Rocker we achieve this by introducing a set of trade-offs. Search this page for “trade-off” to find out more details.

    (tags: docker rocker build containers dockerfiles)

  • How big an issue is the nausea problem for Virtual Reality products? – Quora

    Sadly (because I want a “holodeck” as much as the next red-blooded geek) – I don’t think it’s possible to make a VR system that both delivers the experience that everyone wants – and doesn’t make a sizeable proportion of the population so sick that they’ll never want to do it again. For the people who can stomach the display – my major concern is that the US Navy studies show that there is some disorientation that might persist long after finishing your game…so driving a car while “under the influence” of post-VR disorientation is probably as dangerous as drunk-driving. If these devices are in pretty much every home – then there are huge problems in store for the industry in terms of product liability. There have been plenty of warnings from the flight simulation industry – there are no excuses for not reading the Wikipedia article on the subject. If people are driving “under the influence” and the VR companies didn’t warn them about that – then they’re in deep trouble. IMHO, these consumer-grade VR devices should be carefully studied and if they do cause possible driving impairment, they should be banned until such time as the problems can be fixed…which may very well be “never”. Sorry to be the bearer of bad news.
    (via Tony Finch)

    (tags: holodeck vr oculus-rift hmds nausea head-mounted-displays biology brain flight-simulation)

  • Why do Selenium-style record/replay tests of web applications break?

    good data! Mostly because of element locations it seems….

    (tags: selenium testing web locators papers qa tests)

  • LinkedIn called me a white supremacist

    Wow. Massive, massive algorithm fail.

    n the morning of May 12, LinkedIn, the networking site devoted to making professionals “more productive and successful,” emailed scores of my contacts and told them I’m a professional racist. It was one of those updates that LinkedIn regularly sends its users, algorithmically assembled missives about their connections’ appearances in the media. This one had the innocent-sounding subject, “News About William Johnson,” but once my connections clicked in, they saw a small photo of my grinning face, right above the headline “Trump put white nationalist on list of delegates.” […..] It turns out that when LinkedIn sends these update emails, people actually read them. So I was getting upset. Not only am I not a Nazi, I’m a Jewish socialist with family members who were imprisoned in concentration camps during World War II. Why was LinkedIn trolling me?

    (tags: ethics fail algorithm linkedin big-data racism libel)

  • [RFE] add a way to run in a new systemd scope automatically · Issue #428 · tmux/tmux

    omgwtfbbq. 1: User reports that their gnome session leaks processes; 2: systemd modifies default session behaviour to kill all processes, including screen/tmux; 3: _everyone_ complains because they break 30 years of UNIX process semantics, then 4: they request that tmux/screen hack their shit to workaround their brokenness. Get fucked, systemd. This is the kind of shit that would finally drive me to BSDland

    (tags: systemd horror linux fail unix gnome tmux bugs omgwtfbbq)

Posted in Uncategorized | Comments closed

Links for 2016-05-27

Posted in Uncategorized | Comments closed

Links for 2016-05-26

  • Anti-Choice Groups Use Smartphone Surveillance to Target ‘Abortion-Minded Women’ During Clinic Visits – Rewire

    Geofencing used for evil:

    What Flynn realized is that he could use [ad targeting] to infer that a woman might be seeking an abortion, and to target her for ads from anti-choice groups [using geofenced advertising]. “We can reach every Planned Parenthood in the U.S.,” he wrote in a PowerPoint display sent to potential clients in February. The Powerpoint included a slide titled “Targets for Pro-Life,” in which Flynn said he could also reach abortion clinics, hospitals, doctors’ offices, colleges, and high schools in the United States and Canada, and then “[d]rill down to age and sex.” “We can gather a tremendous amount of information from the [smartphone] ID,” he wrote. “Some of the break outs include: Gender, age, race, pet owners, Honda owners, online purchases and much more.” Flynn explained that he would then use that data to send anti-choice ads to women “while they’re at the clinic.”

    (tags: geofencing grim-meathook-future abortion phones smartphones pro-choice ads)

  • Live Streaming Security Games

    Rapid Fire is a special event we started hosting at our own in-person CTFs in 2014. The idea is pretty simple: Create several CTF challenges that can be solved in a few minutes each. Set up the challenges on 4 identical computers with some basic tools. Mirror the player’s screens so the audience can watch their actions. Whoever solves the most challenges the fastest wins. This event is interesting for a number of reasons: the players are under intense pressure, as everything they do is being watched by several people; the audience can watch several different approaches to the same problems; and people can follow along fairly easily with what is going on with the challenges.
    With e-sports-style video!

    (tags: gaming hacking security e-sports streaming twitch ctf)

  • Open Sourcing Twitter Heron

    Twitter are open sourcing their Storm replacement, and moving it to an independent open source foundation

    (tags: open-source twitter heron storm streaming architecture lambda-architecture)

  • Why the Very Silly Oracle v. Google Trial Actually Matters

    If it’s illegal to write clean room implementations of APIs, then no one has clean hands. The now-shelved open source project Apache Harmony, like Android, reimplemented Java SE, and tech giant IBM contributed code to that project. Oracle itself built its business off a proprietary implementation of SQL, which was created by IBM. The proposition “Reimplementations of APIs are infringements” creates a recursive rabbit hole of liability that spans across the industry. Even the very 37 Java APIs at issue in this trial contain reimplementations of other APIs. Google witness Joshua Bloch—who, while at Sun Microsystems, wrote many of the Java APIs—testified that specific Java APIs are reimplementations of other APIs from Perl 5 and the C programming language.

    (tags: apis fair-use copyright ip android java google oracle law)

Posted in Uncategorized | Comments closed

Links for 2016-05-24

Posted in Uncategorized | Comments closed

Links for 2016-05-23

  • 100 thieves steal $13m in three hours from cash machines across Japan

    ‘Police believe that as many as 100 people, none of whom have been apprehended, worked together using forged credit cards containing account details illegally obtained from a bank in South Africa. The culprits used the fake cards at 1,400 convenience store automated teller machines on the morning of 15 May, according to police. Each made a single withdrawal of 100,000 yen – the maximum allowed by the cash machines.’ 1,600 forged/stolen credit card credentials from a single bank, then a synchronised attack made possible by the eventually-consistent ledger model of ATM accounting. (via William Gibson)

    (tags: atms banking japan fraud security credit-cards)

  • Revealed: How copyright law is being misused to remove material from the internet

    Automated DMCA takedowns used to fraudulently censor online content.

    In fact, no copyright infringement had occurred at all. Instead, something weirder had happened. At some point after Narey posted her comments on Mumsnet, someone had copied the entire text of one of her posts and pasted it, verbatim, to a spammy blog titled “Home Improvement Tips and Tricks”. The post, headlined “Buildteam interior designers” was backdated to September 14 2015, three months before Narey had written it, and was signed by a “Douglas Bush” of South Bend, Indiana. The website was registered to someone quite different, though: Muhammed Ashraf, from Faisalabad, Pakistan. Quite why Douglas Bush or Muhammed Ashraf would be reviewing a builder based in Clapham is not explained in “his” post. BuildTeam says it has no idea why Narey’s review was reposted, but that it had nothing to do with it. “At no material times have we any knowledge of why this false DCMA take down was filed, nor have we contracted any reputation management firms, or any individual or a group to take such action on our behalf. Finally, and in conjunction to the above, we have never spoken with a ‘Douglas Bush,’ or a ‘Muhammed Ashraf.’”

    (tags: fraud censorship mumsnet dmca takedowns google automation copyright)

  • 3 Reasons AWS Lambda Is Not Ready for Prime Time

    This totally matches my own preconceptions ;)

    When we at Datawire tried to actually use Lambda for a real-world HTTP-based microservice […], we found some uncool things that make Lambda not yet ready for the world we live in: Lambda is a building block, not a tool; Lambda is not well documented; Lambda is terrible at error handling Lung skips these uncool things, which makes sense because they’d make the tutorial collapse under its own weight, but you can’t skip them if you want to work in the real world. (Note that if you’re using Lambda for event handling within the AWS world, your life will be easier. But the really interesting case in the microservice world is Lambda and HTTP.)

    (tags: aws lambda microservices datawire http api-gateway apis https python ops)

  • Machine Bias: There’s Software Used Across the Country to Predict Future Criminals. And it’s Biased Against Blacks. – ProPublica

    holy crap, this is dystopian:

    The first time Paul Zilly heard of his score — and realized how much was riding on it — was during his sentencing hearing on Feb. 15, 2013, in court in Barron County, Wisconsin. Zilly had been convicted of stealing a push lawnmower and some tools. The prosecutor recommended a year in county jail and follow-up supervision that could help Zilly with “staying on the right path.” His lawyer agreed to a plea deal. But Judge James Babler had seen Zilly’s scores. Northpointe’s software had rated Zilly as a high risk for future violent crime and a medium risk for general recidivism. “When I look at the risk assessment,” Babler said in court, “it is about as bad as it could be.” Then Babler overturned the plea deal that had been agreed on by the prosecution and defense and imposed two years in state prison and three years of supervision.

    (tags: dystopia law policing risk risk-assessment northpointe racism fortune-telling crime)

  • Guillermo Del Toro’s Tweetstorm About John Carpenter

    ‘Regarding [John] Carpenter: We all talk about inequalities in film. We can add a huge one: Genre inequality. Horror will always be punk rock!’

    (tags: horror punk john-carpenter movies film guillermo-del-toro)

Posted in Uncategorized | Comments closed

Links for 2016-05-20

Posted in Uncategorized | Comments closed

Links for 2016-05-19

  • PLOS ONE: Tyrannobdella rex N. Gen. N. Sp. and the Evolutionary Origins of Mucosal Leech Infestations

    Today in nose-leech news — the paper!

    Principal Findings: A new genus and species of leech from Perú was found feeding from the nasopharynx of humans. Unlike any other leech previously described, this new taxon has but a single jaw with very large teeth. Phylogenetic analyses of nuclear and mitochondrial genes using parsimony and Bayesian inference demonstrate that the new species belongs among a larger, global clade of leeches, all of which feed from the mucosal surfaces of mammals. Conclusions: This new species, found feeding from the upper respiratory tract of humans in Perú, clarifies an expansion of the family Praobdellidae to include the new species Tyrannobdella rex n. gen. n.sp., along with others in the genera Dinobdella, Myxobdella, Praobdella and Pintobdella. Moreover, the results clarify a single evolutionary origin of a group of leeches that specializes on mucous membranes, thus, posing a distinct threat to human health.

    (tags: leeches nose-leech papers science species tyrannobdella-rex horror)

  • Bike thief reveals tricks of the trade in this shockingly candid interview

    This is an eye-opener:

    A former bicycle thief has revealed the tricks of the trade in an interview, which clearly and shockingly shows the extent that thieves will go to in order to steal a bike. He talks about the motivations behind the theft, the tools used to crack locks and how the bikes were moved around and sold for a significant sum. He also gives tips on how to prevent your bike from being stolen. […] ‘Don’t be fooled by Kryptonite locks, they’re not as tough as made out to be. Also D-bars with tubular locks, never use them, they’re the most easy to pick with a little tool. It’s small and discreet, no noise and it looks like you are just unlocking your bike. With the bolt cutters we would go out on high performance motorbikes, two men on a bike.’

    (tags: bikes locks bike-locks security london theft lockpicking d-locks)

Posted in Uncategorized | Comments closed

Links for 2016-05-18

Posted in Uncategorized | Comments closed

Links for 2016-05-17

Posted in Uncategorized | Comments closed

Links for 2016-05-15

  • Westminster social engineering to blame for ‘Glasgow effect’ mortality rate

    This is quite significant — scientific proof that austerity/social engineering policies cause higher mortality rates:

    Researchers found that the historic effect of overcrowding was an important factor and highlighted the strategies of local government, which prioritised the regeneration of the city centre over investment in the cities housing schemes as having a significant impact on the health of Glaswegians. Data shows that Glasgow authorities spent far less on housing repairs, leaving people’s homes poorly maintained and subject to damp. David Walsh, of the Glasgow Centre for Population Health, said that their work proved that poor health had political causes and could not simply be attributed to individual lifestyle choices.

    (tags: glasgow-effect scotland poverty glasgow lifestyle health mortality housing policies uk)

Posted in Uncategorized | Comments closed

Links for 2016-05-13

Posted in Uncategorized | Comments closed

Links for 2016-05-12

Posted in Uncategorized | Comments closed

Links for 2016-05-11

Posted in Uncategorized | Comments closed

Links for 2016-05-10

Posted in Uncategorized | Comments closed

Links for 2016-05-06

  • plainas/tq

    command line utility that performs an HTML element selection on HTML content passed to the stdin. Using css selectors that everybody knows. Since input comes from stdin and output is sent to stdout, it can easily be used inside traditional UNIX pipelines to extract content from webpages and html files. tq provides extra formating options such as json-encoding or newlines squashing, so it can play nicely with everyones favourite command line tooling.

    (tags: tq linux unix cli command-line html parsing css tools)

Posted in Uncategorized | Comments closed

Links for 2016-05-05

  • Apple Stole My Music. No, Seriously.

    some amazingly terrible product decisions here. Deleting local copies of unreleased WAV files — on the assumption that the user will simply listen to them streamed down from Apple Music — that is astonishingly bad, and it’s amazing they didn’t consider the “freelance composer” use case at all. (via Tony Finch)

    (tags: apple music terrible wav sound copyright streaming apple-music design product fail)

  • Rebel Without A Call.

    Purpose-built in 1898, the telephone exchange in Temple Bar was Dublin’s first automatic telephone exchange. Much like its newer neighbor, Internet House, it stood as a technological beacon shining through the luddite fog. With this in mind the Irish Citizen Army targeted the Telephone Exchange in 1916 as one of the communication hubs for the island. While many of us grew up learning of a history of ‘blood sacrifice’ and the futility of the Easter Rising, the truth is that the attack was meticulously planned both militarily and logistically. Sixty communication points around Dublin were hit in an effort to cut off all contact between British military forces within Ireland and to the ‘mainland’. The hope being that reserves and reinforcements would be delayed or misinformed.[…] Unfortunately for the rebels they could not take the Temple Bar exchange. A failure that would prove disastrous.

    (tags: temple-bar history dublin telephones communications 1916)

Posted in Uncategorized | Comments closed

Links for 2016-05-04

Posted in Uncategorized | Comments closed

Links for 2016-05-03

Posted in Uncategorized | Comments closed

Links for 2016-05-01

  • CoreOS and Prometheus: Building monitoring for the next generation of cluster infrastructure

    Ooh, this is a great plan. :applause:

    Enabling GIFEE — Google Infrastructure for Everyone Else — is a primary mission at CoreOS, and open source is key to that goal. [….] Prometheus was initially created to handle monitoring and alerting in modern microservice architectures. It steadily grew to fit the wider idea of cloud native infrastructure. Though it was not intentional in the original design, Prometheus and Kubernetes conveniently share the key concept of identifying entities by labels, making the semantics of monitoring Kubernetes clusters simple. As we discussed previously on this blog, Prometheus metrics formed the basis of our analysis of Kubernetes scheduler performance, and led directly to improvements in that code. Metrics are essential not just to keep systems running, but also to analyze and improve application behavior. All things considered, Prometheus was an obvious choice for the next open source project CoreOS wanted to support and improve with internal developers committed to the code base.

    (tags: monitoring coreos prometheus metrics clustering ops gifee google kubernetes)

  • Let Them Make Noise: A ‘Dining Club’ Invites Toddlers –

    This is a great idea. I miss eating out, and this is why:

    Throughout our three-hour meal, babies cried, mothers nursed, toddlers shrieked and farro grains flew, but the atmosphere was surprisingly leisurely. There was no reason to be self-conscious about a crying-nursing-dancing child because everyone knew every other parent was in the same boat. Or would be in a few seconds. So we relaxed and ate. This is not fine dining as I once knew it, and that’s O.K. That’s what date night is for. But my daughter got her first lesson in how to behave at a fancy restaurant. And I got to finish a delicious meal while it was still warm, toddler in tow.

    (tags: kids food restaurants eating children toddlers)

  • Image Dithering: Eleven Algorithms and Source Code

    Nice demos

    (tags: algorithms graphics coding dithering floyd-steinberg)

Posted in Uncategorized | Comments closed

Links for 2016-04-29

  • A poem about Silicon Valley, made up of Quora questions about Silicon Valley

    Why do so many startups fail? Why are all the hosts on CouchSurfing male? Are we going to be tweeting for the rest of our lives? Why do Silicon Valley billionaires choose average-looking wives? What makes a startup ecosystem thrive? What do people plan to do once they’re over 35? Is an income of $160K enough to survive? What kind of car does Mark Zuckerberg drive? Are the real estate prices in Palo Alto crazy? Do welfare programs make poor people lazy? What are some of the biggest lies ever told? How do I explain Bitcoin to a 6-year-old? Why is Powdered Alcohol not successful so far? How does UberX handle vomiting in the car? Is being worth $10 million considered ‘rich’? What can be causing my upper lip to twitch? Why has crowdfunding not worked for me? Is it worth pre-ordering a Tesla Model 3? How is Clinkle different from Venmo and Square? Can karma, sometimes, be unfair? Why are successful entrepreneurs stereotypically jerks? Which Silicon Valley company has the best intern perks? What looks easy until you actually try it? How did your excretions change under a full Soylent diet? What are alternatives to online dating? Is living in small apartments debilitating? Why don’t more entrepreneurs focus on solving world hunger? What do you regret not doing when you were younger?

    (tags: funny tech poetry silicon-valley humour bitcoin soylent 2016)

Posted in Uncategorized | Comments closed

Links for 2016-04-28

Posted in Uncategorized | Comments closed

Links for 2016-04-27

Posted in Uncategorized | Comments closed

Links for 2016-04-26

Posted in Uncategorized | Comments closed

Links for 2016-04-25

  • Bots won’t replace apps. Better apps will replace apps

    As I’ll explain, messenger apps’ apparent success in fulfilling such a surprising array of tasks does not owe to the triumph of “conversational UI.” What they’ve achieved can be much more instructively framed as an adept exploitation of Silicon Valley phone OS makers’ growing failure to fully serve users’ needs, particularly in other parts of the world. Chat apps have responded by evolving into “meta-platforms.” Many of the platform-like aspects they’ve taken on to plaster over gaps in the OS actually have little to do with the core chat functionality. Not only is “conversational UI” a red herring, but as we look more closely, we’ll even see places where conversational UI has breached its limits and broken down.

    (tags: apps bots chatops chat ui messaging silicon-valley agents alexa siri phones)

Posted in Uncategorized | Comments closed

Links for 2016-04-22

  • How I Hacked Facebook, and Found Someone’s Backdoor Script

    Great writeup of a practical pen test. Those crappy proprietary appliances that get set up “so the CEO can read his email on the road” etc. are always a weak spot

    (tags: facebook hacking security exploits pen-tests backdoors)

  • Anti-innovation: EU excludes open source from new tech standards

    EC up to its old anti-competitive tricks:

    The European Commission is surprisingly coy about what exactly [‘open’] means in this context. It is only on the penultimate page of the ICT Standardisation Priorities document that we finally read the following key piece of information: “ICT standardisation requires a balanced IPR [intellectual property rights] policy, based on FRAND licensing terms.” It’s no surprise that the Commission was trying to keep that particular detail quiet, because FRAND licensing—the acronym stands for “fair, reasonable, and non-discriminatory”—is incompatible with open source, which will therefore find itself excluded from much of the EU’s grand new Digital Single Market strategy. That’s hardly a “balanced IPR policy.”

    (tags: open-source open frand eu ec)

  • I am Alex St. John’s Daughter, and He is Wrong About Women in Tech — Medium

    Great, great post from Amilia St. John, responding to the offensive sexist crap spewed by her father, Alex St. John

    (tags: sexism career tech amilia-st-john alex-st-john jobs work feminism)

  • The Rise of Pirate Libraries

    The history of this is fascinating:

    Today’s pirate libraries have their roots in the work of Russian academics to digitize texts in the 1990s. Scholars in that part of the world had long had a thriving practice of passing literature and scientific information underground, in opposition to government censorship—part of the samizdat culture, in which banned documents were copied and passed hand to hand through illicit channels. Those first digital collections were passed freely around, but when their creators started running into problems with copyright, their collections “retreated from the public view,” writes Balázs Bodó, a piracy researcher based at the University of Amsterdam. “The text collections were far too valuable to simply delete,” he writes, and instead migrated to “closed, membership-only FTP servers.” [….] There’s always been osmosis within the academic community of copyrighted materials from people with access to scholar without. “Much of the life of a research academic in Kazakhstan or Iran or Malaysia involves this informal diffusion of materials across the gated walls of the top universities,” he says.

    (tags: pirates pirate-libraries libraries archival history russia ussr samizdat samizdata academia papers)

Posted in Uncategorized | Comments closed

Links for 2016-04-21

Posted in Uncategorized | Comments closed

Links for 2016-04-20


    Prepaid talk+text+data or data-only mobile SIM cards, delivered to your home or hotel, prior to visiting the US. great service for temporary US business visits

    (tags: visiting us usa zip-sim sims mobile-phones travel phones mobile travelling data)

  • Detecting the use of “curl | bash” server side


    The better solution is never to pipe untrusted data streams into bash. If you still want to run untrusted bash scripts a better approach is to pipe the contents of URL into a file, review the contents on disk and only then execute it.

    (tags: bash security shell unix curl tcp buffers)

  • The Melancholy Mystery of Lullabies –

    Fascinating article on lullabies:

    One way a mother might bond with a newborn is by sharing her joy; another way is by sharing her grief or frustration. We see this in songs across time. A 200-year-old Arabic lullaby still sung today goes: I am a stranger, and my neighbors are strangers; I have no friends in this world. Winter night and the husband is absent. And an old Spanish lullaby from Asturias, written down by the poet Federico García Lorca, goes: This little boy clinging so Is from a lover, Vitorio, May God, who gave, end my woe, Take this Vitorio clinging so. We assume the sound of these songs is sweet, as no lullaby endures without being effective at putting babies to sleep. Think of ‘‘Rock-a-bye Baby,’’ the way it tenderly describes an infant and its cradle falling to the ground: The singer gets to speak a fear, the baby gets to rest; the singer tries to accommodate herself to a possible loss that has for most of human history been rela­tively common, and the baby gets attentive care. In the Arabic and Spanish lullabies, the singers get to say something to the one being — their new burden, their new love — who can’t and won’t judge or discipline them for saying it. When even relatively happy, well-supported people become the primary caretaker of a very small person, they tend to find themselves eddied out from the world of adults. They are never alone — there is always that tiny person — and yet they are often lonely. Old songs let us feel the fellowship of these other people, across space and time, also holding babies in dark rooms.

    (tags: lullabies songs singing history folk babies children)

  • New Oil-Based Cityscapes Set at Dawn and Dusk by Jeremy Mann

    lovely art via This Is Colossal

    (tags: art pictures cities paintings graphics)

  • Amazon S3 Transfer Acceleration

    The AWS edge network has points of presence in more than 50 locations. Today, it is used to distribute content via Amazon CloudFront and to provide rapid responses to DNS queries made to Amazon Route 53. With today’s announcement, the edge network also helps to accelerate data transfers in to and out of Amazon S3. It will be of particular benefit to you if you are transferring data across or between continents, have a fast Internet connection, use large objects, or have a lot of content to upload. You can think of the edge network as a bridge between your upload point (your desktop or your on-premises data center) and the target bucket. After you enable this feature for a bucket (by checking a checkbox in the AWS Management Console), you simply change the bucket’s endpoint to the form No other configuration changes are necessary! After you do this, your TCP connections will be routed to the best AWS edge location based on latency.  Transfer Acceleration will then send your uploads back to S3 over the AWS-managed backbone network using optimized network protocols, persistent connections from edge to origin, fully-open send and receive windows, and so forth.

    (tags: aws s3 networking infrastructure ops internet cdn)

  • Darts, Dice, and Coins

    Earlier this year, I asked a question on Stack Overflow about a data structure for loaded dice. Specifically, I was interested in answering this question: “You are given an n-sided die where side i has probability pi of being rolled. What is the most efficient data structure for simulating rolls of the die?” This data structure could be used for many purposes. For starters, you could use it to simulate rolls of a fair, six-sided die by assigning probability 1616 to each of the sides of the die, or a to simulate a fair coin by simulating a two-sided die where each side has probability 1212 of coming up. You could also use this data structure to directly simulate the total of two fair six-sided dice being thrown by having an 11-sided die (whose faces were 2, 3, 4, …, 12), where each side was appropriately weighted with the probability that this total would show if you used two fair dice. However, you could also use this data structure to simulate loaded dice. For example, if you were playing craps with dice that you knew weren’t perfectly fair, you might use the data structure to simulate many rolls of the dice to see what the optimal strategy would be. You could also consider simulating an imperfect roulette wheel in the same way. Outside the domain of game-playing, you could also use this data structure in robotics simulations where sensors have known failure rates. For example, if a range sensor has a 95% chance of giving the right value back, a 4% chance of giving back a value that’s too small, and a 1% chance of handing back a value that’s too large, you could use this data structure to simulate readings from the sensor by generating a random outcome and simulating the sensor reading in that case. The answer I received on Stack Overflow impressed me for two reasons. First, the solution pointed me at a powerful technique called the alias method that, under certain reasonable assumptions about the machine model, is capable of simulating rolls of the die in O(1)O(1) time after a simple preprocessing step. Second, and perhaps more surprisingly, this algorithm has been known for decades, but I had not once encountered it! Considering how much processing time is dedicated to simulation, I would have expected this technique to be better- known. A few quick Google searches turned up a wealth of information on the technique, but I couldn’t find a single site that compiled together the intuition and explanation behind the technique.
    (via Marc Brooker)

    (tags: via:marcbrooker algorithms probability algorithm coding data-structures alias dice random)

Posted in Uncategorized | Comments closed

Links for 2016-04-19

Posted in Uncategorized | Comments closed

Links for 2016-04-18

Posted in Uncategorized | Comments closed

Links for 2016-04-15

Posted in Uncategorized | Comments closed

Links for 2016-04-14

  • Google Cloud Status

    Ouch, multi-region outage:

    At 14:50 Pacific Time on April 11th, our engineers removed an unused GCE IP block from our network configuration, and instructed Google’s automated systems to propagate the new configuration across our network. By itself, this sort of change was harmless and had been performed previously without incident. However, on this occasion our network configuration management software detected an inconsistency in the newly supplied configuration. The inconsistency was triggered by a timing quirk in the IP block removal – the IP block had been removed from one configuration file, but this change had not yet propagated to a second configuration file also used in network configuration management. In attempting to resolve this inconsistency the network management software is designed to ‘fail safe’ and revert to its current configuration rather than proceeding with the new configuration. However, in this instance a previously-unseen software bug was triggered, and instead of retaining the previous known good configuration, the management software instead removed all GCE IP blocks from the new configuration and began to push this new, incomplete configuration to the network. One of our core principles at Google is ‘defense in depth’, and Google’s networking systems have a number of safeguards to prevent them from propagating incorrect or invalid configurations in the event of an upstream failure or bug. These safeguards include a canary step where the configuration is deployed at a single site and that site is verified to still be working correctly, and a progressive rollout which makes changes to only a fraction of sites at a time, so that a novel failure can be caught at an early stage before it becomes widespread. In this event, the canary step correctly identified that the new configuration was unsafe. Crucially however, a second software bug in the management software did not propagate the canary step’s conclusion back to the push process, and thus the push system concluded that the new configuration was valid and began its progressive rollout.

    (tags: multi-region outages google ops postmortems gce cloud ip networking cascading-failures bugs)

  • Using jemalloc to get to the bottom of an off-heap Java memory leak

    Good technique

    (tags: debugging java jvm memory jemalloc off-heap)

Posted in Uncategorized | Comments closed

Links for 2016-04-13

Posted in Uncategorized | Comments closed