alexkus

The recent attempt to decriminalise non-payment of the license fee failed:-

http://www.bbc.co.uk/news/uk-politics-31151821

Sky rep lies about basis of security feature? Could be.

If you cancelled out the cyclical/reciprocal debts then you'd still have the same amount of working capital as you'd pay back $X but also get $X back as a creditor.

Mikefax anyone?

(Ha, seems I've mentioned Mikefax a while ago... https://news.ycombinator.com/item?id=4687527 )

Indeed. It's .ch because that's the initialism of the Latin name for Switzerland: Confoederatio Helvetica.

The Latin name is used to avoid favouring any one of the four official languages (German, French, Italian, Romansch).

How RAM Scrapers Work

Once on a targeted system, RAM scrapers work by examining the list of processes that are running on the system and inspecting the memory for data that matches the structure of credit card data, such as the account number, expiration date, and other information stored on a card’s magnetic stripe.

No hooking, sounds exactly like they're looking through the memory assigned to each process looking for the right looking data.

Occasionally, usually over zealous stripping back of machines in very controlled environments[1].

1. I don't do much work with these kinds of customers any more as I chose not to go for security clearance (on purpose, as this is a convenient way of avoiding these kinds of customers).

I just can't get excited about vim plugins (no matter how good they are, no matter how much I love vi/vim - and no disrespect to their authors). I can imagine how they could increase my productivity (to some extent) but...

I'm old school, I work happily with vi, many of the customers I dealt with going back to the mid-90s never gave me a choice. SunOS 4.1.3U5 (ugh). AIX 3. Heady days of Solaris 2.5. Bog standard vi. vim is a bonus, but I'm far from lost when it's just vi. I love macros, but I can still get stuff done if they aren't available. If there's no vi then I'm not lost either, I can work around stuff with awk/sed/etc.

Fundamentally I don't want to have to ever install a bunch of stuff in multiple places to create a common environment for myself. That's a big problem that hasn't been solved yet. I just want it to be the same everywhere, which is why I don't rely on zsh or even ksh, and I just go for the bare minimum.

I've been to too many customers to know that not being able to do stuff within someone else's environment is really not a good thing. I've seen people escorted off customer sites because they've been ineffectual.

But, the biggest takeway is that I've seen too many new employees/interns that are lost without their expected favoured environment, and it's not getting better. vim plugins aside, there's a growing lack of adaptability.

http://www.live-footballontv.com/

Is where I got for football fixtures for the UK, albeit not JSON.

Indeed. The biggest weakness is that users aren't well trained in ensuring that the page they're typing their username/password into (to access one of the public access points) may not be genuine.

I know I've seen some faked BT Openzone login pages in the UK, luckily the BT Wifi App is clever enough only to attempt to login to the real webpage.

Not quite, the difference between the two situations is the difference between accuracy and precision.

E.g. http://academics.wellesley.edu/Chemistry/Chem105manual/Appen...

The Chinese Street maps are very precise but consitently inaccurate (the skew). The GPS tracks shown are relatively precise and accurate.

The change to the GPS signals (by not encrypting as much of the timestamp data) improved precision.

Thanks for the clarification. I know Strava takes the issue of privacy seriously!

Can't remember the terminology they use but Strava allows you to define privacy areas (within a configurable radius of a point) where no points are shown on your individual routes. Exactly to stop someone working out where you live/work from browsing your history.

Either they haven't honoured this when calculating the global heatmap or, more likely (and harder to fix), such locations are given away by friends uploads (who don't have the same privacy areas defined).

Oops.

One of the last things I'd want is lots of drivers near me to be even more distracted saying "Hello? Hello?" into their phone and repeatedly looking at it to see if they're still connected or still have a signal.

Also, good luck if you're in an accident as no-one nearby can call the emergency services.

Can't put in words how much better I sleep after moving to decaffeinated coffee.

I do like a nice coffee but I'm content with instant[1] decaf (and even if I have 10 cups a day it's not more caffeine than the equivalent of a single cup of caffeinated coffee).

Not spending £3/$5 a day on coffee helps too. It means I'll pay my mortgage off 2 years early.

1. A lot more prevalent here in the UK: http://www.bbc.co.uk/news/blogs-magazine-monitor-26869244

From the original post:

This patch is a variant of what we've been using to help protect customer keys for a decade.

So it protects keys against heartbleed, but not other HTTP related data (urls, cookies, headers, etc).

And who runs their webserver as root? (Or who changes the permissions on /etc/shadow to allow it be read by a non-root process).

Having to be root to be able to bind to a TCP port <1024 is no longer necessary on a modern OS.

You now know the two primes (p,q) which multiply together to make n (the public key modulus). We also know e (the public key exponent).

d (the private key) is:-

    d = e^-1 mod ((p-1)(q-1))

This is why you need to know the factorisation of n=(p*q). You can't compute d (the private key) with just the composite n.

It shouldn't be about it eventually being overwritten, sensitive information like that (which isn't needed for runtime) should be actively scrubbed before the block of memory is freed.

You can't, however, get away with not having the private key modulus in memory (in some form) all the time.

Didn't have any spare time to have a go at this, here's how I was going to do it:-

1) Create a VM with the same version of Linux, nginx, openssl.

2) Create a self-signed SSL certificate for the server

3) Verify that the HTTPS server is vulnerable to heartbleed

4) Run a few HTTPS requests against the server

5) Use gcore (or just send SIGABRT) to get a core file of the nginx process

6) Write a tool to check the memory image for remnants of the private key (since I know what it looks like). This may be encoded in several forms: as is from the ssl key file, hex encoded modulus, binary encoded modulus, however the BigNum stuff in OpenSSL stores the modulus, intermediate values used in calculations, etc. I can also check for partial matches since I know what the full key looks like.

7) Run the heartbleed client against the site to extract some chunks of memory, there are various strategies for this:-

a) Repeatedly grab the largest (65535) bytes of memory each time

b) Repeatedly grab different sizes (8KB, 16KB, etc) depending on the bucket sizes for OpenSSL's freelist wrapper around malloc.

c) Vary the request size (lots more headers, etc) to try and get different chunks of memory returned.

d) Occasionally restart nginx

8) Once I can reliably (for whatever value of reliably that is) get the key from my own server, I then modify the test for success from a comparison against the known private key, to a test which involves decrypting a string that was the result of encrypting some known plaintext with the known public key. That'll be slower, but still possible.

9) Run that analysis against real data retreived from the challenge server. The data (using the various strategies in #7) can be obtained in the background whilst I'm developing #1-#8. You can't rely on having sole access to the server so whatever strategy you use may be perturbed by other people performing requests.

10) Repeat #1-#8 for Apache and any other web server that is vulnerable to heartbleed.

This does work on the assumption that the key (in whatever form it is in) will be returned as a contiguous block of memory. Trying to patch together chunks of memory to look for the key will be much much harder unless there's significant overlap and it's easy to detect what/where a key is somehow.

Irony would be such a patch leaking information about the state of any random number generator leading to more easily guessable session keys or the like.

(Of course, creating suitable fake data with a separate PNRG to avoid this would be pretty easy.)

You give a URL that exists on an HTTPS webserver you control that you've patched to send SSL Heartbeats that have a payload size much greater than the real payload.

If the client code (at whatever site you are targeting) is vulnerable then each heartbeat response you get from the client site may give you up to 64KB of its memory contents.

Slow and steady.

At 2Mbps upload it's only about 12 days.

Capistrano

how Would you explain all this stuff about averages to the daughter of the man whose bike got ran over by a truck

The greatly increased chances of seeing any grandchildren I may end up having is way more important, to me anyway, than the tiny increase in risk that I may not see my children reach adulthood (or even their teenage years).

My manager will chase me up if my vacation time is going unused (e.g. I get 1/2 way through the year with less than 1/4 of my vacation used) and ask me what my plans are for using it.

Getting to the end of the year without using it all up is considered poor planning by the employee and poor management by the manager.

I get 27 days (on top of the UK public holidays). So I try and have a week per quarter, plus an extra week around Christmas/New Year.

This is in the UK, but I had the same thing with an enlightened manager when I was US based.

IPFreely?

That's not quite the same thing.

You could replace the IBM CEO every week for many years to come with someone who has been at the company for 30+ years.

.org

Old school.

Were bitelabs.io or bitelabs.ly already taken?

Sounds just like me at 16. Wasn't very motivated despite studying the A-Levels I wanted to (Maths, Physics, Computing). Spent all my spare time stealing Internet access at the local University (this was back in 1992/1993). I got decent grades (AAB) and got into my first choice University, but the motivation to do well still wasn't there. Ended up getting a 2:2 where everyone expected me to get a 1st. After that I was lucky and ended up in a good job where degree result didn't matter.

Looking back I wish I'd talked to someone (not my parents) about it at the time. So I'd recommend finding someone to talk to at your college; your form tutor (depends, I didn't get on with mine), careers advisor, pastoral care reps, etc. Just remember that they should be there to help you do your best, not bollock you for not putting your full effort in.