chainsaw10

I’m intrigued by this course. However I’m also curious about its prerequisite:

Machine Learning (e.g. CS221, CS229, CS230, CS124, CS224N) You should be comfortable with the basics of machine learning and deep learning.

Anyone have a good implementation-heavy self-study resource for those topics, or experience with the recorded lectures for those Stanford courses?

From my reading, it looks they're considering this for only non HTTPS downloads initiated from an HTTPS page

Relevant quotes:

... we will likely start by treating certain high-risk downloads initiated from secure contexts as active mixed content and block them.

We're not planning to focus on non-secure downloads initiated from non-secure contexts at the moment, because users at least see the "Not Secure" omnibox badge on those pages.

If someone does that with one of my (custom domain) addresses, it won’t work, here’s what I implemented: https://zackorndorff.com/2015/03/10/disposable-email-address...

(To save you a click, they look like aa_COMPANY+SHORTHASH@mydomain.com, with shorthash being based on COMPANY and a secret)

Downside is the address ends up absurdly long, and I’ve had to manually create some aliases for companies that won’t accept the plus.

I don’t recommend this setup, it’s kind of a pain to maintain, but I wish one of the mainstream providers would implement something similar.

Locally-installed root CAs are allowed by HSTS, so if you added the HTTPS proxy to the root store, this would work without warning, unless you manually checked the certificate.

Of course, this only works on machines you're the admin of, which is why it's allowed.

So what happens if a hacker hacks company A and uses their server as a jump box to hack company B? Is company B allowed to hack A since their machine was used in an attack?

Or even worse, what if company B is mistaken as to who attacked them? If they "hack back" as advocated, but against the wrong target, are they liable?

log in with some criteria more than just a username/password

The problem there is that captive portals don't add any extra link-layer security. The network is open, so literally anyone can sniff packets.

It's uncommon, but a network using WPA2-Enterprise and user/pass uses different keys for each person (not sure if per device or per user), so you don't have to trust everyone in the room.

Very well said.

To directly answer GP's question:

I took a differential equations class last semester, where the easy part of quite a few problems was to solve a quadratic equation. And it was easy, because my algebra classes had correctly required me to practice that skill (and memorize the quadratic formula).

So, you say, I'm never going to take differential equations. And you very well might not. I have two responses to that:

1) That's true, you might not, but the guy sitting next to you will, and he doesn't even know it yet. If you were allowed to opt out of that subject, you both would, and he wouldn't even have a chance to make up for it later.

2) There are plenty of other subjects where the easy part is an algebra concept, and it's only easy because you practiced it years before.

computer security Nobel prize

While they're not as big of a deal AFAIK, we do have the Pwnie Awards: https://pwnies.com/

You can do something similar with bash. If you set PROMPT_COMMAND='history -a', it'll append to the history file right after the command completes (because the prompt command is run as the prompt is printed).

radare2 is a disassembler, not a decompiler.

Disassembly is a much easier task than decompilation, since it's a mostly mechanical process. Decompilation requires you to undo the optimizations/transformations the compiler did as it generated the binary, which is much harder.

That said radare2 is still cool, and a GUI (Cutter) is in the works.

Have you gotten Windows to work well as a guest?

I could never get it to work as well as it does with VirtualBox.

Ah, okay, that makes more sense.

I guess maybe it was to enable touch on some websites?

I'm curious as to what good reason there is to have the Android user-agent string contain "Mobile Safari"...

The rest of it looks like fairly standard user-agent string antics.

It doesn't compile though -- I hope.

I'm pretty sure C keywords require a space on either side...

Also, somewhere in GNOME settings, there's a setting to enable "emacs mode", which lets you use ^a, ^e, ^k, ^y in normal textboxes.

Which would work if licenses and copyrights didn't exist.

I don't think it would.

Dynamic linking allows a library to be patched once and have the patch apply to all the programs using it. If every program was statically linked, you would have to update each one individually.

Not to mention the waste of space.

I'm guessing much of that is moot these days, but IMHO it's still something to aim for.

I feel like just having a browser extension is a major security hole for any password manager. Yes it's more usable and prevents domain spoofing, but it makes the attack surface huge.

Whereas to exploit a desktop app that doesn't interface with the browser (written in a decent way), you'd need code execution already.

Thoughts?

reversing commit hashes back into their contents

Somewhat off topic, but is this actually possible?

Given hashing is inherently lossy, I'm inclined to assume it's not possible for anything must longer than a password, but commits are text, which I suppose is low entropy per character, so I don't know.

The bug is in bad js authored by CF

No, the bug is definitely in the browser. Web code is untrusted and should not be able to adversely affect the browser.

Why not standardize?

You can't. These apps don't federate, and not everyone uses all of them.

As I wrote this comment, I realized I use more apps than I thought.

I use SMS for some folks, Messenger for others, and Slack, Hangouts, and GroupMe for specific groups.

If I'm in a 5+ person group chat, I can't really ask everyone to move to something else. And I want to hear what's going on, so I keep the app around.

I'm curious: what do you use to enter insert mode then?

Some recent distros will actually let you run that as yourself, without root, if you're physically present at the machine. It's convenient for personal machines.

IIRC that meta tag is also used for verification for Google Webmaster Tools

I don't suppose there's a way to do this from a non-OS X platform, is there?

I'd assume no, but I'm wondering if anyone's found a way.

to explicitly lie about it.

Maybe I'm dense or naive, but I don't think there's any precedent for that. A gag order is one thing (and there are certainly places for it), but forcing someone to lie would hopefully violate the First Amendment.

I think he's abbreviating "internet protocols" to "IPs".

He's asking why we have human-readable/text based protocols vs a binary protocol.

My feelings are mixed on this.

On FB, I'm usually glad that links open in a new tab (well, I middle click them anyway, but sometimes I forget) because if they didn't, I'd have the huge problem of trying to infinite scroll my way back to where I was.

On just some random business website, OTOH, I usually take it to mean the business owner (or developer) thought their site was so important, it should make me keep it open while I go to another link.

I usually middle-click on HN anyway, but I feel like it's sort of nicer in a way, to be in control of that. Maybe HN feels like more of a page than an application to me because it doesn't use infinite scroll / a ton of custom Javascript behavior?

I'm inclined to agree that web _applications_ should open external links in a new tab, but I'm not sure it's best for HN.

So, apparently they created an app with an enterprise certificate that has a transparent icon in the newsstand app.

The enterprise certificate (now revoked) bypasses the App Store review, as is well understood.

However, the app still needs permissions. It asks for permissions. So, if I'm reading correctly, it would require physical access to activate.

Not quite as scary as the title would show. I'd say "install" rather than "infect" because there seemingly, unless I missed something (which it's possible I did) there's no actual exploit involved.

If you let someone else run software on your device, and allow them to grant permissions, then obviously they can steal your data. The only reasons that make this notable are the enterprise certificate and transparent icon. (And of course the source)

So read the article, but the title is a tad misleading.

EDIT: Thinking about it some more, I should point out that the article is fairly well written. Also, we consider computer spyware that doesn't use an exploit an "infection", so I guess it's valid, but still misleading. Great and informative article though.

I am not a lawyer, so I'm probably wrong on some of the finer points here, but I'm going to postulate an analogy here.

Why can't we equate the software inside a computer inside a vehicle with the mechanical equivalent? What then would our rights be?

It obviously doesn't require permission to move a valve or a gear around. Therefore, it shouldn't require permission to move a few bits.

It also doesn't require permission to draw a diagram of your changes and tell your neighbor what you did.

On the further extreme, one could potentially draw a diagram of the entire vehicle. At some point you're copying the entire idea, and the lawyers can fill in how this is protected. In this analogy, the computer code replacing it should then be protected the same way?

Anyone know whether there's an easy way to get root?

Is there a Terminal app with a local shell?

I'm in the US, so I can't get this one, but these are what I'm hoping for when it gets here.