Links for 2017-07-03

Posted in Uncategorized | Comments closed

Links for 2017-06-30

  • Don’t Settle For Eventual Consistency

    Quite an argument. Not sure I agree, but worth a bookmark anyway…

    With an AP system, you are giving up consistency, and not really gaining anything in terms of effective availability, the type of availability you really care about.  Some might think you can regain strong consistency in an AP system by using strict quorums (where the number of nodes written + number of nodes read > number of replicas).  Cassandra calls this “tunable consistency”.  However, Kleppmann has shown that even with strict quorums, inconsistencies can result.10  So when choosing (algorithmic) availability over consistency, you are giving up consistency for not much in return, as well as gaining complexity in your clients when they have to deal with inconsistencies.

    (tags: cap-theorem databases storage cap consistency cp ap eventual-consistency)

  • Delivering Billions of Messages Exactly Once · Segment Blog

    holy crap, this is exactly the wrong way to build a massive-scale deduplication system — with a monster random-access “is this random UUID in the db” lookup

    (tags: deduping architecture horror segment messaging kafka)

Posted in Uncategorized | Comments closed

Links for 2017-06-28

  • Mozilla Employee Denied Entry to the United States

    Ugh. every non-USian tech worker’s nightmare. curl developer Daniel Stenberg:

    “I can’t think of a single valid reason why they would deny me travel, so what concerns me is that somehow someone did and then I’m worried that I’ll get trouble fixing that issue,” Stenberg said. “I’m a little worried since border crossings are fairly serious matters and getting trouble to visit the US in the future would be a serious blowback for me, both personally with friends and relatives there, and professionally with conferences and events there.”

    (tags: curl travel mozilla esta us-politics usa immigration flying)

Posted in Uncategorized | Comments closed

Links for 2017-06-27

  • RIPE Atlas Probes

    Interesting! We discussed similar ideas in $prevjob, good to see one hitting production globally.

    RIPE Atlas probes form the backbone of the RIPE Atlas infrastructure. Volunteers all over the world host these small hardware devices that actively measure Internet connectivity through ping, traceroute, DNS, SSL/TLS, NTP and HTTP measurements. This data is collected and aggregated by the RIPE NCC, which makes the data publicly available. Network operators, engineers, researchers and even home users have used this data for a wide range of purposes, from investigating network outages to DNS anycasting to testing IPv6 connectivity. Anyone can apply to host a RIPE Atlas probe. If your application is successful (based on your location), we will ship you a probe free of charge. Hosts simply need to plug their probe into their home (or other) network. Probes are USB-powered and are connected to an Ethernet port on the host’s router or switch. They then automatically and continuously perform active measurements about the Internet’s connectivity, and this data is sent to the RIPE NCC, where it is aggregated and made publicly available. We also use this data to create several Internet maps and data visualisations. [….] The hardware of the first and second generation probes is a Lantronix XPort Pro module with custom powering and housing built around it. The third generation probe is a modified TP-Link wireless router (model TL-MR 3020) with a small USB thumb drive in it, but this probe does not support WiFi.
    (via irldexter)

    (tags: via:irldexter ripe ncc probing active-monitoring networking ping traceroute dns testing http ipv6 anycast hardware devices isps)

  • “BBC English” was invented by a small team in the 1920s & 30s

    Excellent twitter thread:

    Today we speak of “BBC English” as a standard form of the language, but this form had to be invented by a small team in the 1920s & 30s. 1/ It turned out even within the upper-class London accent that became the basis for BBC English, many words had competing pronunciations. 2/ Thus in 1926, the BBC’s first managing director John Reith established an “Advisory Committee on Spoken English” to sort things out. 3/ The committee was chaired by Irish playwright George Bernard Shaw, and also included American essayist Logan Pearsall Smith, 4/ novelist Rose Macaulay, lexicographer (and 4th OED editor) C.T. Onions, art critic Kenneth Clark, journalist Alistair Cooke, 5/ ghost story writer Lady Cynthia Asquith, and evolutionary biologist and eugenicist Julian Huxley. 6/ The 20-person committee held fierce debates, and pronunciations now considered standard were often decided by just a few votes.

    (tags: bbc language english history rp received-pronunciation pronunciation john-reith)

Posted in Uncategorized | Comments closed

Links for 2017-06-26

Posted in Uncategorized | Comments closed

Links for 2017-06-24

Posted in Uncategorized | Comments closed

Links for 2017-06-22

Posted in Uncategorized | Comments closed

Links for 2017-06-21

Posted in Uncategorized | Comments closed

Links for 2017-06-20

Posted in Uncategorized | Comments closed

Links for 2017-06-19

Posted in Uncategorized | Comments closed

Links for 2017-06-16

Posted in Uncategorized | Comments closed

Links for 2017-06-15

  • Screen time guidelines need to be built on evidence, not hype | Science | The Guardian

    An open letter signed by about 100 scientists ‘from different countries and academic fields with research expertise and experience in screen time, child development and evidence-based policy.’

    If the government were to implement guidelines on screen-based technology at this point, as the authors of the letter suggest, this would be on the basis of little to no evidence. This risks the implementation of unnecessary, ineffective or even potentially harmful policies. For guidelines to have a meaningful impact, they need to be grounded in robust research evidence and acknowledge that children’s health and wellbeing is a complex issue affected by many other factors, such as socioeconomic status, relational poverty, and family environment – all of which are likely to be more relevant for children’s health and well-being than screens. For example, there is no consistent evidence that more screen time leads to less outdoor play; if anything the evidence indicates that screen time and physical outdoor activity are unrelated, and reductions in average time spent in outdoor play over time seem to be driven by other factors. Policy efforts to increase outdoor play that focus on screen time are therefore likely to be ineffective.
    (via Damien Mulley)

    (tags: via:damienmulley science children psychology screens screen-time childhood development evidence policy health open-letters)

Posted in Uncategorized | Comments closed

Links for 2017-06-14

Posted in Uncategorized | Comments closed

Links for 2017-06-12

Posted in Uncategorized | Comments closed

Links for 2017-06-09

  • How Turla hackers (ab)used satellites to stay under the radar | Ars Technica

    A very nifty hack. DVB-S broadcasts a subset of unencrypted IP traffic across a 600-mile radius:

    The Turla attackers listen for packets coming from a specific IP address in one of these classes. When certain packets—say, a TCP/IP SYN packet—are identified, the hackers spoof a reply to the source using a conventional Internet line. The legitimate user of the link just ignores the spoofed packet, since it goes to an otherwise unopened port, such as port 80 or 10080. With normal Internet connections, if a packet hits a closed port, the end user will normally send the ISP some indication that something went wrong. But satellite links typically use firewalls that drop packets to closed ports. This allows Turla to stealthily hijack the connections. The hack allowed computers infected with Turla spyware to communicate with Turla C&C servers without disclosing their location. Because the Turla attackers had their own satellite dish receiving the piggybacked signal, they could be anywhere within a 600-mile radius. As a result, researchers were largely stopped from shutting down the operation or gaining clues about who was carrying it out. “It’s probably one of the most effective methods of ensuring their operational security, or that nobody will ever find out the physical location of their command and control server,” Tanase told Ars. “I cannot think of a way of identifying the location of a command server. It can be anywhere in the range of the satellite beam.”

    (tags: turla hacks satellite security dvb dvb-s tcpip command-and-control syn)

Posted in Uncategorized | Comments closed

Links for 2017-06-08

Posted in Uncategorized | Comments closed

Links for 2017-06-07

Posted in Uncategorized | Comments closed

Links for 2017-06-06

Posted in Uncategorized | Comments closed

Links for 2017-06-01

Posted in Uncategorized | Comments closed

Links for 2017-05-31

  • EpiBone Grows New Bones Using Stem Cells

    To grow EpiBone, Tandon explained, scientists take a CT scan of the bone they’ll need to engineer. This helps them create a 3D model. Then, from the model, a 3D printer produces a scaffold (this can be made out of protein and collagen from animal bones or synthetic material). After that, they take stem cells from the patient out of their fat, and those cells are put into the scaffold and then incubated. They regenerate, and form around the bone. This process results in a bone that the body will recognize as the patient’s. The crazy part is that it only takes three weeks to grow a bone that’s personalized to the individual patient.

    (tags: stem-cells epibone bone body healing health medicine 3d-printing)

  • WHAT WENT WRONG IN BRITISH AIRWAYS DATACENTER IN MAY 2017?

    A SPOF UPS. There was a similar AZ-wide outage in one of the Amazon DUB datacenters with a similar root cause, if I recall correctly — supposedly redundant dual UPS systems were in fact interdependent, in that case, and power supply switchover wasn’t clean enough to avoid affecting the servers.

    Minutes later power was restored was resumed in what one source described as “uncontrolled fashion.” Instead of gradual restore, all power was restored at once resulting in a power surge.   BA CEO Cruz told BBC Radio this power surge  caused network hardware to fail. Also server hardware was damaged because of the power surge. It seems as if the UPS was the single point of failure for power feed of the IT equipment in Boadicea House . The Times is reporting that the same UPS was powering both Heathrow based datacenters. Which could be a double single point of failure if true (I doubt it is) The broken network  stopped the exchange of messages between different BA systems and application. Without messaging, there is no exchange of information between various applications. BA is using Progress Software’s Sonic [enterprise service bus].
    (via Tony Finch)

    (tags: postmortems ba airlines outages fail via:fanf datacenters ups power progress esb j2ee)

  • GDPR Advisors and Consultants – Data Compliance Europe

    Simon McGarr’s new consultancy:

    Our consultancy helps our clients understand how EU privacy law applies to their organisations; delivers the practical and concrete steps needed to achieve legal compliance; and helps them manage their continuing obligations after GDPR comes into force. Our structured approach to GDPR provides a long-term data compliance framework to minimise the ongoing risk of potential fines for data protection breaches. Our continuing partnership provides regulator liaison, advisory consultancy, and external Data Protection Officer services.

    (tags: gdpr simon-mcgarr law privacy eu europe data-protection regulation data)

Posted in Uncategorized | Comments closed

Links for 2017-05-29

Posted in Uncategorized | Comments closed

Links for 2017-05-26

Posted in Uncategorized | Comments closed

Links for 2017-05-25

  • ‘I’ve Got Nothing to Hide’ and Other Misunderstandings of Privacy by Daniel J. Solove :: SSRN

    In this short essay, written for a symposium in the San Diego Law Review, Professor Daniel Solove examines the nothing to hide argument. When asked about government surveillance and data mining, many people respond by declaring: “I’ve got nothing to hide.” According to the nothing to hide argument, there is no threat to privacy unless the government uncovers unlawful activity, in which case a person has no legitimate justification to claim that it remain private. The nothing to hide argument and its variants are quite prevalent, and thus are worth addressing. In this essay, Solove critiques the nothing to hide argument and exposes its faulty underpinnings.
    Via Fred Logue

    (tags: law philosophy privacy security essay papers daniel-solove surveillance snooping)

  • Enough with the microservices

    Good post!

    Much has been written on the pros and cons of microservices, but unfortunately I’m still seeing them as something being pursued in a cargo cult fashion in the growth-stage startup world. At the risk of rewriting Martin Fowler’s Microservice Premium article, I thought it would be good to write up some thoughts so that I can send them to clients when the topic arises, and hopefully help people avoid some of the mistakes I’ve seen. The mistake of choosing a path towards a given architecture or technology on the basis of so-called best practices articles found online is a costly one, and if I can help a single company avoid it then writing this will have been worth it.

    (tags: architecture design microservices coding devops ops monolith)

Posted in Uncategorized | Comments closed

Links for 2017-05-24

  • Skot Olsen — Blessed Saint Architeuthis

    Classic piece of freaky squid-related art, now purchaseable on giclee for $200! (very tempted)

    Saint Architeuthis is the patron saint of doomed sailors. While the origins of the saint remain unclear, it’s recent history and worship are well documented. Whalers who turned their attention to catching giant squid and sea serpents in the 19th century, began asking Saint Architeuthis for mercy whenever a hunt would go awry, which was fairly frequent. When hunting for such animals, one would sometimes be thrown over board or a boat would sink exposing the men to whatever was in the water at the time. A sailor would ask Saint Architeuthis for the quick and relatively painless death of drowning, rather than the hideous demise of being ripped apart by the beak of the squid or chewed up in the sea serpent’s hideous maw. Often, men would have visions of Saint Architeuthis who would appear before them in the form of a gigantic, yet benevolent squid wearing a bishop’s mitre and carrying tools of the squid hunter’s trade.

    (tags: art squid skot-olsen prints giclees toget weird)

Posted in Uncategorized | Comments closed

Links for 2017-05-23

  • U.S. top court tightens patent suit rules in blow to ‘patent trolls’

    This is excellent news, and a death knell for the East Texas patent troll court (cf https://motherboard.vice.com/en_us/article/the-small-town-judge-who-sees-a-quarter-of-the-nations-patent-cases ):

    The U.S. Supreme Court on Monday tightened rules for where patent lawsuits can be filed in a decision that may make it harder for so-called patent “trolls” to launch sometimes dodgy patent cases in friendly courts, a major irritant for high-tech giants like Apple and Alphabet Inc’s Google. In a decision that upends 27 years of law governing patent infringement cases, the justices sided with beverage flavoring company TC Heartland LLC in its legal battle with food and beverage company Kraft Heinz Co (KHC.O). The justices ruled 8-0 that patent suits can be filed only in courts located in the jurisdiction where the targeted company is incorporated.
    via Brad Fitzgerald

    (tags: via:bradfitz patents swpats east-texas law trolls supreme-court infringement)

Posted in Uncategorized | Comments closed

Links for 2017-05-22

Posted in Uncategorized | Comments closed

Links for 2017-05-20

Posted in Uncategorized | Comments closed

Links for 2017-05-18

  • Spotting a million dollars in your AWS account · Segment Blog

    You can easily split your spend by AWS service per month and call it a day. Ten thousand dollars of EC2, one thousand to S3, five hundred dollars to network traffic, etc. But what’s still missing is a synthesis of which products and engineering teams are dominating your costs.  Then, add in the fact that you may have hundreds of instances and millions of containers that come and go. Soon, what started as simple analysis problem has quickly become unimaginably complex.  In this follow-up post, we’d like to share details on the toolkit we used. Our hope is to offer up a few ideas to help you analyze your AWS spend, no matter whether you’re running only a handful of instances, or tens of thousands.

    (tags: segment money costs billing aws ec2 ecs ops)

Posted in Uncategorized | Comments closed

Links for 2017-05-17

  • Seeking medical abortions online is safe and effective, study finds | World news | The Guardian

    Of the 1,636 women who were sent the drugs between the start of 2010 and the end of 2012, the team were able to analyse self-reported data from 1,000 individuals who confirmed taking the pills. All were less than 10 weeks pregnant. The results reveal that almost 95% of the women successfully ended their pregnancy without the need for surgical intervention. None of the women died, although seven women required a blood transfusion and 26 needed antibiotics. Of the 93 women who experienced symptoms for which the advice was to seek medical attention, 95% did so, going to a hospital or clinic. “When we talk about self-sought, self-induced abortion, people think about coat hangers or they think about tables in back alleys,” said Aiken. “But I think this research really shows that in 2017 self-sourced abortion is a network of people helping and supporting each other through what’s really a safe and effective process in the comfort of their own homes, and I think is a huge step forward in public health.”

    (tags: health medicine abortion pro-choice data women-on-web ireland law repealthe8th)

Posted in Uncategorized | Comments closed

Links for 2017-05-15

  • The World Is Getting Hacked. Why Don’t We Do More to Stop It? – The New York Times

    Zeynep Tufekci is (as usual!) on the money with this op-ed. I strongly agree with the following:

    First, companies like Microsoft should discard the idea that they can abandon people using older software. The money they made from these customers hasn’t expired; neither has their responsibility to fix defects. Besides, Microsoft is sitting on a cash hoard estimated at more than $100 billion (the result of how little tax modern corporations pay and how profitable it is to sell a dominant operating system under monopolistic dynamics with no liability for defects). At a minimum, Microsoft clearly should have provided the critical update in March to all its users, not just those paying extra. Indeed, “pay extra money to us or we will withhold critical security updates” can be seen as its own form of ransomware. In its defense, Microsoft probably could point out that its operating systems have come a long way in security since Windows XP, and it has spent a lot of money updating old software, even above industry norms. However, industry norms are lousy to horrible, and it is reasonable to expect a company with a dominant market position, that made so much money selling software that runs critical infrastructure, to do more. Microsoft should spend more of that $100 billion to help institutions and users upgrade to newer software, especially those who run essential services on it. This has to be through a system that incentivizes institutions and people to upgrade to more secure systems and does not force choosing between privacy and security. Security updates should only update security, and everything else should be optional and unbundled.
    More on this twitter thread: https://twitter.com/zeynep/status/863734133188681732

    (tags: security microsoft upgrades windows windows-xp zeynep-tufekci worms viruses malware updates software)

  • Fireside Chat with Vint Cerf & Marc Andreessen (Google Cloud Next ’17) – YouTube

    In which Vint Cerf calls for regulatory oversight of software engineering. “It’s a serious issue now”

    (tags: vint-cerf gcp regulation oversight politics law reliability systems)

  • don’t use String.intern() in Java

    String.intern is the gateway to native JVM String table, and it comes with caveats: throughput, memory footprint, pause time problems will await the users. Hand-rolled deduplicators/interners to reduce memory footprint are working much more reliably, because they are working on Java side, and also can be thrown away when done. GC-assisted String deduplication does alleviate things even more. In almost every project we were taking care of, removing String.intern from the hotpaths was the very profitable performance optimization. Do not use it without thinking, okay?

    (tags: strings interning java performance tips)

  • Moom removed from sale due to patent violation claim | Hacker News

    Well this sucks. Some scumbag applied for a patent on tiling window management in 2008, and it’s been granted. I use Moom every day :(

    (tags: moom patents bullshit swpat software window-management osx)

  • V2V and the challenge of cooperating technology

    A great deal of effort and attention has gone into a mobile data technology that you may not be aware of. This is “Vehicle to Vehicle” (V2V) communication designed so that cars can send data to other cars. There is special spectrum allocated at 5.9ghz, and a protocol named DSRC, derived from wifi, exists for communications from car-to-car and also between cars and roadside transmitters in the infrastructure, known as V2I. This effort has been going on for some time, but those involved have had trouble finding a compelling application which users would pay for. Unable to find one, advocates hope that various national governments will mandate V2V radios in cars in the coming years for safety reasons. In December 2016, the U.S. Dept. of Transportation proposed just such a mandate. [….] “Connected Autonomous Vehicles — Pick 2.”

    (tags: cars self-driving autonomous-vehicles v2v wireless connectivity networking security)

  • _Amazon Aurora: Design Considerations for High Throughput Cloud-Native Relational Databases_

    ‘Amazon Aurora is a relational database service for OLTP workloads offered as part of Amazon Web Services (AWS). In this paper, we describe the architecture of Aurora and the design considerations leading to that architecture. We believe the central constraint in high throughput data processing has moved from compute and storage to the network. Aurora brings a novel architecture to the relational database to address this constraint, most notably by pushing redo processing to a multi-tenant scale-out storage service, purpose-built for Aurora. We describe how doing so not only reduces network traffic, but also allows for fast crash recovery, failovers to replicas without loss of data, and fault-tolerant, self-healing storage. We then describe how Aurora achieves consensus on durable state across numerous storage nodes using an efficient asynchronous scheme, avoiding expensive and chatty recovery protocols. Finally, having operated Aurora as a production service for over 18 months, we share the lessons we have learnt from our customers on what modern cloud applications expect from databases.’

    (tags: via:rbranson aurora aws amazon databases storage papers architecture)

  • Hello Sandwich Tokyo Guide

    a guide for people who like travelling like a local and visiting hidden places off the beaten track. There are tips on where to rent a bike, the best bike path, the best coffee, the best craft shops, the coolest shops, the cheapest drinks, the most delicious pizza, the best izakaya, the cutest cafes, the best rooftop bar, the coolest hotels (and the cheap and cheerful hotels), the loveliest parks and soooo much more. It’s a list of all of the places I frequent, making it a local insiders guide to Tokyo. Also included in the Hello Sandwich Tokyo Guide are language essentials and travel tips. It’s the bloggers guide to Tokyo and if you’d like to visit the places seen on Hello Sandwich, then this guide is the zine for you.

    (tags: shops tourism japan tokyo guidebooks)

  • jantman/awslimitchecker

    A script and python module to check your AWS service limits and usage, and warn when usage approaches limits. Users building out scalable services in Amazon AWS often run into AWS’ service limits – often at the least convenient time (i.e. mid-deploy or when autoscaling fails). Amazon’s Trusted Advisor can help this, but even the version that comes with Business and Enterprise support only monitors a small subset of AWS limits and only alerts weekly. awslimitchecker provides a command line script and reusable package that queries your current usage of AWS resources and compares it to limits (hard-coded AWS defaults that you can override, API-based limits where available, or data from Trusted Advisor where available), notifying you when you are approaching or at your limits.
    (via This Week in AWS)

    (tags: aws amazon limits scripts ops)

Posted in Uncategorized | Comments closed

Links for 2017-05-13

Posted in Uncategorized | Comments closed

Links for 2017-05-12

Posted in Uncategorized | Comments closed

Links for 2017-05-11

  • Uuni

    “The world’s best portable wood-fired oven”. Fergal has one and loves it. $299

    (tags: uuni pizza oven outdoor food cooking gadgets)

  • Repair and Leasing Scheme – Peter Mc Verry Trust

    Minister Simon Coveney and the Department of Housing have provided funding of €32 million in 2017 for the Repair and Leasing Programme and set a target of 800 units to be delivered this year (2017). A total of €140 million has been allocated to the repair and leasing scheme over the lifetime of Rebuilding Ireland. The Repair and Leasing Scheme at a Glance: Targets Properties Empty or Derelict for 1 Year or more Grants to Property owners of up to €40,000 to get properties back into use Lease Terms of 10, 15 or 20 Years State Guaranteed Rental Income for Duration of Lease Property and Tenants Managed by Approved Housing Bodies [the Peter McVerry Trust in D1, D3, D7 and D9]

    (tags: peter-mcverry homelessness dublin housing repair derelict-buildings homes ireland property)

  • iKydz

    ‘Total Parent Control’ for kids internet access at home. Dublin-based product, dedicated wifi AP with lots of child-oriented filtering capabilities

    (tags: filtering security ikydz kids children internet wifi ap hardware blocking)

  • _Optimal Probabilistic Cache Stampede Prevention_ [pdf]

    ‘When a frequently-accessed cache item expires, multiple requests to that item can trigger a cache miss and start regenerating that same item at the same time. This phenomenon, known as cache stampede, severely limits the performance of databases and web servers. A natural countermeasure to this issue is to let the processes that perform such requests to randomly ask for a regeneration before the expiration time of the item. In this paper we give optimal algorithms for performing such probabilistic early expirations. Our algorithms are theoretically optimal and have much better performances than other solutions used in real-world applications.’ (via Marc Brooker)

    (tags: via:marcbrooker caching caches algorithm probabilistic expiration vldb papers expiry cache-miss stampedes)

Posted in Uncategorized | Comments closed

Links for 2017-05-09

Posted in Uncategorized | Comments closed

Links for 2017-05-08

  • The great British Brexit robbery: how our democracy was hijacked | Technology | The Guardian

    A map shown to the Observer showing the many places in the world where SCL and Cambridge Analytica have worked includes Russia, Lithuania, Latvia, Ukraine, Iran and Moldova. Multiple Cambridge Analytica sources have revealed other links to Russia, including trips to the country, meetings with executives from Russian state-owned companies, and references by SCL employees to working for Russian entities. Article 50 has been triggered. AggregateIQ is outside British jurisdiction. The Electoral Commission is powerless. And another election, with these same rules, is just a month away. It is not that the authorities don’t know there is cause for concern. The Observer has learned that the Crown Prosecution Service did appoint a special prosecutor to assess whether there was a case for a criminal investigation into whether campaign finance laws were broken. The CPS referred it back to the electoral commission. Someone close to the intelligence select committee tells me that “work is being done” on potential Russian interference in the referendum. Gavin Millar, a QC and expert in electoral law, described the situation as “highly disturbing”. He believes the only way to find the truth would be to hold a public inquiry. But a government would need to call it. A government that has just triggered an election specifically to shore up its power base. An election designed to set us into permanent alignment with Trump’s America. [….] This isn’t about Remain or Leave. It goes far beyond party politics. It’s about the first step into a brave, new, increasingly undemocratic world.

    (tags: elections brexit trump cambridge-analytica aggregateiq scary analytics data targeting scl ukip democracy grim-meathook-future)

  • Online security won’t improve until companies stop passing the buck to the customer

    100% agreed!

    Giving good security advice is hard because very often individuals have little or no effective control over their security. The extent to which a customer is at risk of being defrauded largely depends on how good their bank’s security is, something customers cannot know. Similarly, identity fraud is the result of companies doing a poor job at verifying identity. If a criminal can fraudulently take out a loan using another’s name, address, and date of birth from the public record, that’s the fault of the lender – not, as Cifas, a trade organisation for lenders, claims, because customers “don’t take the same care to protect our most important asset – our identities”.

    (tags: cifas uk passwords security regulation banking ncsc riscs advice)

  • Backdooring an AWS account

    eek. Things to look out for on your AWS setup:

    So you’ve pwned an AWS account?—?congratulations?—?now what? You’re eager to get to the data theft, amirite? Not so fast whipper snapper, have you disrupted logging? Do you know what you have? Sweet! Time to get settled in. Maintaining persistence in AWS is only limited by your imagination but there are few obvious and oft used techniques everyone should know and watch for.

    (tags: aws security hacks iam sts)

Posted in Uncategorized | Comments closed

Links for 2017-05-07

Posted in Uncategorized | Comments closed

Links for 2017-05-05

Posted in Uncategorized | Comments closed

Links for 2017-05-04

  • The Dark Secret at the Heart of AI – MIT Technology Review

    ‘The mysterious mind of [NVidia’s self-driving car, driven by machine learning] points to a looming issue with artificial intelligence. The car’s underlying AI technology, known as deep learning, has proved very powerful at solving problems in recent years, and it has been widely deployed for tasks like image captioning, voice recognition, and language translation. There is now hope that the same techniques will be able to diagnose deadly diseases, make million-dollar trading decisions, and do countless other things to transform whole industries. But this won’t happen—or shouldn’t happen—unless we find ways of making techniques like deep learning more understandable to their creators and accountable to their users. Otherwise it will be hard to predict when failures might occur—and it’s inevitable they will. That’s one reason Nvidia’s car is still experimental. Already, mathematical models are being used to help determine who makes parole, who’s approved for a loan, and who gets hired for a job. If you could get access to these mathematical models, it would be possible to understand their reasoning. But banks, the military, employers, and others are now turning their attention to more complex machine-learning approaches that could make automated decision-making altogether inscrutable. Deep learning, the most common of these approaches, represents a fundamentally different way to program computers. “It is a problem that is already relevant, and it’s going to be much more relevant in the future,” says Tommi Jaakkola, a professor at MIT who works on applications of machine learning. “Whether it’s an investment decision, a medical decision, or maybe a military decision, you don’t want to just rely on a ‘black box’ method.”’

    (tags: ai algorithms ml machine-learning legibility explainability deep-learning nvidia)

Posted in Uncategorized | Comments closed

Links for 2017-05-03

  • Prior Exposure Increases Perceived Accuracy of Fake News

    In other words, repeated exposure to fake news renders it believable. Pennycook, Gordon and Cannon, Tyrone D and Rand, David G., _Prior Exposure Increases Perceived Accuracy of Fake News_ (April 30, 2017):

    Collectively, our results indicate familiarity is used heuristically to infer accuracy. Thus, the spread of fake news is supported by persistent low-level cognitive processes that make even highly implausible and partisan claims more believable with repetition. Our results suggest that political echo chambers not only isolate one from opposing views, but also help to create incubation chambers for blatantly false (but highly salient and politicized) fake news stories.
    (via Zeynep Tufekci) See also: http://www.rand.org/content/dam/rand/pubs/perspectives/PE100/PE198/RAND_PE198.pdf , _The Russian “Firehose of Falsehood” Propaganda Model_, from RAND.

    (tags: propaganda psychology fake-news belief facebook echo-chambers lies truth media)

  • How your selfie could affect your life insurance

    Noping so hard. Imagine the levels of algorithmic discrimination inherent in this shit.

    “Your face is something you wear all your life, and it tells a very unique story about you,” says Karl Ricanek Jr., co-founder and chief data scientist at Lapetus Solutions Inc. in Wilmington, N.C. Several life insurance companies are testing Lapetus technology that uses facial analytics and other data to estimate life expectancy, he says. (Lapetus would not disclose the names of companies testing its product.) Insurers use life expectancy estimates to make policy approval and pricing decisions. Lapetus says its product, Chronos, would enable a customer to buy life insurance online in as little as 10 minutes without taking a life insurance medical exam.

    (tags: discrimination computer-says-no algorithms selfies face lapetus photos life-insurance life-expectancy)

  • After years of warnings, mobile network hackers exploit SS7 flaws to drain bank accounts • The Register

    Experts have been warning for years about security blunders in the Signaling System 7 protocol – the magic glue used by cellphone networks to communicate with each other. […] O2-Telefonica in Germany has confirmed to Süddeutsche Zeitung that some of its customers have had their bank accounts drained using a two-stage attack that exploits SS7. In other words, thieves exploited SS7 to intercept two-factor authentication codes sent to online banking customers, allowing them to empty their accounts. The thefts occurred over the past few months, according to multiple sources.

    (tags: o2 telefonica germany ss7 mobile 2fa security hacks cellphones)

Posted in Uncategorized | Comments closed

Links for 2017-05-02

  • explainshell.com

    This is pretty excellent work — paste a UNIX command line and it’ll contextually inline manual page snippets to match, highlighting the matching part of the command line.

    (tags: cli unix documentation explainshell shell scripting syntax manual-pages)

  • Sufjan Stevens – Carrie & Lowell Live on Vimeo

    the entire concert set. This was the highlight concert for me in 2015

    (tags: music video sufjan-stevens concerts 2015)

  • Exclusive: The Leaked Fyre Festival Pitch Deck Is Beyond Parody | Vanity Fair

    This is the worst future ever.

    As the pitch deck claims, within the first 48 hours of the social-media blitz, the Fyre Starters had reached “300 million social impressions”—impressions being the kind of dumb synonym one uses instead of the word “people,” in the same way someone at a bar tries to sound smart by saying he is “inebriated” instead of “drunk.” (And to be fair, an impression isn’t even a sentient person. It’s essentially reaching a person when they aren’t paying attention.) To pull off the 300 million impressions, McFarland and Ja Rule partnered with a P.R. agency, a creative agency, and Elliot Tebele, a once-random nobody who has created a social-media empire by siphoning other people’s jokes into the Instagram account @FuckJerry. One of the biggest deceits of the entire media campaign was that almost all of the 400 influencers who shared the promotional videos and photos never noted they were actually advertising something for someone else, which the Federal Trade Commission requires. This kind of advertising has been going on for years, and while the F.T.C. has threatened to crack down on online celebrities and influencers deceitfully failing to disclose that they are paid to post sponsorships, so far those threats have been completely ignored.

    (tags: fyre fail grim influencers instagram ftc pr advertising festivals)

  • Towards true continuous integration – Netflix TechBlog – Medium

    Netflix discuss how they handle the eternal dependency-management problem which arises with lots of microservices:

    Using the monorepo as our requirements specification, we began exploring alternative approaches to achieving the same benefits. What are the core problems that a monorepo approach strives to solve? Can we develop a solution that works within the confines of a traditional binary integration world, where code is shared? Our approach, while still experimental, can be distilled into three key features: Publisher feedback?—?provide the owner of shared code fast feedback as to which of their consumers they just broke, both direct and transitive. Also, allow teams to block releases based on downstream breakages. Currently, our engineering culture puts sole responsibility on consumers to resolve these issues. By giving library owners feedback on the impact they have to the rest of Netflix, we expect them to take on additional responsibility. Managed source?—?provide consumers with a means to safely increment library versions automatically as new versions are released. Since we are already testing each new library release against all downstreams, why not bump consumer versions and accelerate version adoption, safely. Distributed refactoring?—?provide owners of shared code a means to quickly find and globally refactor consumers of their API. We have started by issuing pull requests en masse to all Git repositories containing a consumer of a particular Java API. We’ve run some early experiments and expect to invest more in this area going forward.
    What I find interesting is that Amazon dealt effectively with the first two many years ago, in the form of their “Brazil” build system, and Google do the latter (with Refaster?). It would be amazing to see such a system released into an open source form, but maybe it’s just too heavyweight for anyone other than a giant software company on the scale of a Google, Netflix or Amazon.

    (tags: brazil amazon build microservices dependencies coding monorepo netflix google refaster)

  • acksin/seespot: AWS Spot instance health check with termination and clean up support

    When a Spot Instance is about to terminate there is a 2 minute window before the termination actually happens. SeeSpot is a utility for AWS Spot instances that handles the health check. If used with an AWS ELB it also handles cleanup of the instance when a Spot Termination notice is sent.

    (tags: aws elb spot-instances health-checks golang lifecycle ops)

  • cristim/autospotting: Pay up to 10 times less on EC2 by automatically replacing on-demand AutoScaling group members with similar or larger identically configured spot instances.

    A simple and easy to use tool designed to significantly lower your Amazon AWS costs by automating the use of the spot market. Once enabled on an existing on-demand AutoScaling group, it launches an EC2 spot instance that is cheaper, at least as large and configured identically to your current on-demand instances. As soon as the new instance is ready, it is added to the group and an on-demand instance is detached from the group and terminated. It continuously applies this process, gradually replacing any on-demand instances with spot instances until the group only consists of spot instances, but it can also be configured to keep some on-demand instances running.

    (tags: aws golang ec2 autoscaling asg spot-instances ops)

  • Rule by Nobody

    ‘Algorithms update bureaucracy’s long-standing strategy for evasion.’

    The need to optimize yourself for a network of opaque algorithms induces a sort of existential torture. In The Utopia of Rules: On Technology, Stupidity, and the Secret Joys of Bureaucracy, anthropologist David Graeber suggests a fundamental law of power dynamics: “Those on the bottom of the heap have to spend a great deal of imaginative energy trying to understand the social dynamics that surround them — including having to imagine the perspectives of those on top — while the latter can wander about largely oblivious to much of what is going on around them. That is, the powerless not only end up doing most of the actual, physical labor required to keep society running, they also do most of the interpretive labor as well.” This dynamic, Graeber argues, is built into all bureaucratic structures. He describes bureaucracies as “ways of organizing stupidity” — that is, of managing and reproducing these “extremely unequal structures of imagination” in which the powerful can disregard the perspectives of those beneath them in various social and economic hierarchies. Employees need to anticipate the needs of bosses; bosses need not reciprocate. People of color are forced to learn to accommodate and anticipate the ignorance and hostility of white people. Women need to be acutely aware of men’s intentions and feelings. And so on. Even benevolent-seeming bureaucracies, in Graeber’s view, have the effect of reinforcing “the highly schematized, minimal, blinkered perspectives typical of the powerful” and their privileges of ignorance and indifference toward those positioned as below them.

    (tags: algorithms bureaucracy democracy life society via:raycorrigan technology power)

  • Reverse engineering the 76477 “Space Invaders” sound effect chip from die photos

    Now _this_ is reversing:

    Remember the old video game Space Invaders? Some of its sound effects were provided by a chip called the 76477 Complex Sound Generation chip. While the sound effects1 produced by this 1978 chip seem primitive today, it was used in many video games, pinball games. But what’s inside this chip and how does it work internally? By reverse-engineering the chip from die photos, we can find out. (Photos courtesy of Sean Riddle.) In this article, I explain how the analog circuits of this chip works and show how the hundreds of transistors on the silicon die form the circuits of this complex chip.

    (tags: space-invaders games history reverse-engineering chips analog sound-effects)

Posted in Uncategorized | Comments closed