alex1

There should be recalls from more manufacturers. Someone I know purchased a surveillance camera with a major brand name (Samsung) from Costco [0] just a few weeks ago that gave me a root shell by simply telneting in as root with no password and no way to reliably set a root password or disable telnet. It was returned the following day. Last I checked, Costco is still selling it. This problem isn't confined to cheap Chinese cameras you can buy online. Vulnerable devices are being sold at major American retailers and they are still on the shelves.

[0] http://www.costco.com/Samsung-SmartCam-HD-Plus-1080p-Wi-Fi-I...

probably the more likely scenario is that some insider leak some of the distributors private keys which would allow certain releases to be cracked - but would likely also trigger key roll over.

It could also be the case that someone leaked the plaintext symmetric key(s) for this specific movie's DCP. If someone gained access to private/secret keys on a compromised DCP player somewhere, it'd be smarter to leak symmetric keys for individual movies to avoid detection.

I think that's because OCI currently only has a specification for the runtime, not the distributable image. But it seems like as of a few weeks ago, work is underway to standardize the distributable image as well: https://github.com/opencontainers/image-spec

Yep, I agree and that's where I install stuff on everything other than OS X. One distinction though, I think, is that most of the stuff I install on OS X I don't want to be available system-wide. I'm (typically) not using Homebrew to install daemons that run all the time or things that serve critical system/network functions, so I've never seen a reason to make them available to the entire system. I agree that goes against the Unix way but I started preferring this way of using Homebrew after I had similar problems upgrading and even updating OS X.

Also, what if for some reason a single machine is shared by two people and they need different versions of some programs installed with Homebrew? Installing everything in /usr/local isn't going to look like a good idea then.

Mostly because of my (perhaps irrational) OCD in not wanting to touch global system paths or files, even though under FHS /usr/local is where you're supposed to install manually-managed libraries and binaries. I believe Homebrew likes to have its path owned by you instead of root, so I think it makes more sense to have stuff that's going to be owned by me to be in my home folder rather than /usr/local.

I'm curious to know if there's a reason everyone installs Homebrew in /usr/local (other than it being the default installation path). I've always chosen to install it in ~/.homebrew and haven't had any problems. Everything I install with Homebrew seems to handle an alternative prefix without issue.

Why did Stellar decide on using Facebook accounts to enforce the one account per person rule, instead of something better like mobile numbers? There are more people with cell phones than there are with Facebook accounts. Acquiring large batches of phone numbers to game the system is harder since it costs money and is more easily detectable.

Even if this guy isn't gaming the system with fake Facebook accounts, I'm sure others already are.

Sure, they wouldn't be able to proxy all HTTP requests through their own servers like they're doing now, but they'd still be able to do MITM attacks at the IP level. They're already messing with routes to Google Public DNS IPs so they could just as easily mess with routes to YouTube's IPs. I don't think DNSSEC is the solution in cases like this. Somehow getting everyone to use SSL for everything is a much better solution in my opinion.

You're right. Maybe if they turned on and required SSL for everyone visiting www.youtube.com and added www.youtube.com to Chrome's preloaded HSTS list and somehow got everyone to use Chrome. Sadly, this probably won't happen, but DNSSEC adoption probably won't happen either. Even with DNSSEC, they could still do deep packet inspection on HTTP traffic going to YouTube IPs and initiate MITM attacks that way.

Yeah, looks like they're mucking with the routes for Google Public DNS anycast IPs.

EDIT: More evidence that this is what's happening (they're doing to same to OpenDNS's anycast addresses): https://twitter.com/esesci/status/449902883933126659

Can you do a traceroute to 8.8.4.4? If it's actually reaching Google's network, then yeah, they're doing deep packet inspection on DNS traffic. If not, they're probably just routing 8.8.4.4 to a DNS server they control.

If their goal is to manipulate traffic to www.youtube.com (probably to block access to certain videos), another solution would be for YouTube to require SSL for all connections coming from Turkish IPs. Of course, this wouldn't work if they got some Turkish (or other) CA to sign a bogus www.youtube.com certificate.

EDIT: As lawl points out, trying to require SSL on www.youtube.com won't work either, since they could just do an sslstrip type attack.

EDIT 2: Proof that they are in fact messing with routes to Google Public DNS anycast addresses (they're doing to same to OpenDNS): https://twitter.com/esesci/status/449902883933126659

Good point. I just checked that file ever since it was open-sourced in 10.8 and it stays exactly the same throughout all of 10.8.x (10.8 - 10.8.5) and only changes in 10.9. (You can check for yourself here: http://opensource.apple.com/)

It doesn't seem like what you said is the case here but obviously we're still missing changesets that may have been committed between 10.8.5 (Security-55179.13) and 10.9 (Security-55471). It'd be really interesting to do a git-blame on that file.

EDIT: Nevermind, that file wasn't open-sourced in 10.8. It's actually really old. (Look for directories starting with libsecurity_ssl in pre-10.8 OS X versions.) Didn't find anything particularly interesting in the old versions though.

Here's a diff of that file from OS X 10.8.5 (Security-55179.13) to 10.9 (Security-55471): https://gist.github.com/alexyakoubian/9151610/revisions

Check line 631. Appears seemingly out of nowhere.

FWIW, here's what I got on an Ubuntu 12.04.3 server running on my LAN. It looks like we should be fine with the defaults on Ubuntu at least. (Obviously always a good idea to use ufw/iptables to block everything you don't need exposed so you don't have to worry about stuff like this).

Before installing ntp (from another host on my LAN):

  $ ntpdc -n -c monlist 192.168.1.50
  ntpdc: read: Connection refused

  $ ntpdc -n -c monlist 192.168.1.50
  192.168.1.50: timed out, nothing received
  ***Request timed out

  $ ntpdc -n -c monlist localhost
  remote address          port local address      count m ver rstr avgint  lstint
  ===============================================================================
  91.189.94.4              123 192.168.1.50         1 4 4    1d0     54      54
  ...

Also, web servers might want to consult NTP servers now and again.

CloudFlare doesn't host web servers for their customers. They forward HTTP/HTTPS requests to origin servers outside of their network (or serve from their cache). I don't think the DDoS traffic actually hit any of their customers' origin servers (assuming origin server IPs are not known by the attackers). But yeah, it still means CloudFlare's incoming pipes being hit with 400Gbps of traffic before they're able to filter anything.

Looks like those credentials were disclosed in April of last year: http://turtle.dereferenced.org/~nenolod/linode/linode-abridg...

Something doesn't add up here. Surely Linode can't be that careless.

Facebook looks shady?

Just made a Facebook group for this year. Coordinate rideshares, lodging, etc: https://www.facebook.com/groups/705664592796188/

Last year a bunch of people coordinated rideshares on a Facebook group. Someone should set up a new one for this year.

EDIT: Just made one for 2013, join up: https://www.facebook.com/groups/705664592796188/

The summarization tech isn't owned by Summly. It's owned by SRI International and was licensed to Summly. Maybe a large chunk of the reported $30 million was actually used to acquire that technology from SRI?

It did. His slides were also marked "Confidential / Do not distribute" so I don't think any recording of his talk will be released.

I think I just found an easter egg in Siri in tribute to Steve: http://i.imgur.com/Ptz47.png

It's pretty disappointing to see this at the top of HN. Some of the comments here do have some merit but I feel there's a disproportionate amount of hating and anger. There was a comment made by pg a couple days ago that I think definitely belongs here so I'm going to paste it:

I think they're not so much dense as bitter. There's a subset of HN readers who regard startups as a whole as a sort of con game, and are angry that the participants get so much attention. There may not be that many of them, but their anger makes them disproportionately active as commenters and voters.[1]

[1] http://news.ycombinator.com/item?id=4293786

> Y Combinator gave a chance to people who would never have a chance at seed investors or Angle investors.

Do you really believe this? I think most, if not all, YC founders are capable of raising a seed round and making connections in the Valley with or without YC. YC just expedites this process.

Actually, it means differential.

The site says the hole has been patched but I was just able to change my own status with this:

  curl -A "WhatsApp/2.6.7 iPhone_OS/5.0.1 Device/iPhone_4" --header "Accept-Language: en-us" --header "Accept-Encoding: gzip, deflate" --header "Connection: keep-alive" -d "cc=1&me=%2B1{10_DIGIT_NUMBER}&s={URL_ENCODED_STATUS}" https://s.whatsapp.net/client/iphone/u.php

> People graduating with a degree from Stanford can be presumed to look for full time work at a salary sufficient to pay off student loans.

I just wanted to point out that Stanford has a no-loan policy. Most Stanford graduates owe either nothing or very little in student loans (anecdotal evidence so correct me if I'm wrong).

School.

If you're in college right now, and especially a top-tier university, try to meet as many people as possible. Don't miss this opportunity; your network will be invaluable once you're done with school. College is a great place to step out of your bubble and college admissions committees usually do a good job of putting a diverse group of interesting people in one place. Meet people from different backgrounds, countries, and majors. Even though you may not realize it now, you will one day need most of the people that you meet in school.

I didn't mean to paint a rosy economic picture. Sorry if it came out like that.

I just thought people should know the difference between a songwriting royalty and a recording royalty, and what that means for songwriters and recording artists. I also want people to have an idea of exactly how big of a cut publishing companies and record labels take.

I didn't see any mention of songwriting royalties, which can be very significant if they also write their own music.

The songwriter/composer of a song (not a recording of a song, but the actual melody, lyrics) gets a performance royalty each time a song is played in "public" (internet and broadcast radio, in the elevator, at a bar, etc). This is the royalty BMI, ASCAP, and SESAC collect. If the song is recorded and sold by someone, the songwriter gets mechanical royalties for each unit sold. If memory serves me correctly, the compulsory rate right now is 8 cents per unit sold. If the song in any form (recorded, sung by a drunk dude, etc) is used in something like a movie or a TV show, the songwriter gets a synchronization royalty. I've seen sync royalties range from $5,000 to $250,000. Songwriters are usually signed to publishing companies. Publishing companies are mostly owned by record labels themselves (or their parent companies). Publishing companies take a cut of the songwriters' royalties, but not as big as the cut record labels take from recording artists. I've seen rates ranging from 10% to 30%.

On the other hand, the recording artist gets pretty much whatever the record label decides to give them as described in the recording contract. The label will own the song recordings, not the artist. Recording artists (and record labels) do not get any royalties for public performance. Yes, when a song is played on FM radio, the record label doesn't get a penny. The only exception to this is when the song is played on "interactive" services on the Internet. This is the royalty Sound Exchange collects. In those cases, both the songwriter and whoever owns the copyright to the sound recording (the record label) get royalties. The main sources of revenue for the label are from these royalties, and from selling the sound recording in stores and online. They take a large chunk (60-70%) of this and distribute the rest to the song's recording artist, producer, etc.