Skip to content

Justin's Linklog Posts

Links for 2017-09-18

Published September 18, 2017

  • Native Memory Tracking

    Java 8 HotSpot feature to monitor and diagnose native memory leaks

    (tags: java jvm memory native-memory malloc debugging coding nmt java-8 jcmd)

  • This Heroic Captain Defied His Orders and Stopped America From Starting World War III

    Captain William Bassett, a USAF officer stationed at Okinawa on October 28, 1962, can now be added alongside Stanislav Petrov to the list of people who have saved the world from WWIII:

    By [John] Bordne’s account, at the height of the Cuban Missile Crisis, Air Force crews on Okinawa were ordered to launch 32 missiles, each carrying a large nuclear warhead. […] The Captain told Missile Operations Center over the phone that he either needed to hear that the threat level had been raised to DEFCON 1 and that he should fire the nukes, or that he should stand down. We don’t know exactly what the Missile Operations Center told Captain Bassett, but they finally received confirmation that they should not launch their nukes. After the crisis had passed Bassett reportedly told his men: “None of us will discuss anything that happened here tonight, and I mean anything. No discussions at the barracks, in a bar, or even here at the launch site. You do not even write home about this. Am I making myself perfectly clear on this subject?”

    (tags: wwiii history nukes cuban-missile-crisis 1960s usaf okinawa missiles william-bassett)

  • malware piggybacking on CCleaner

    On September 13, 2017 while conducting customer beta testing of our new exploit detection technology, Cisco Talos identified a specific executable which was triggering our advanced malware protection systems. Upon closer inspection, the executable in question was the installer for CCleaner v5.33, which was being delivered to endpoints by the legitimate CCleaner download servers. Talos began initial analysis to determine what was causing this technology to flag CCleaner. We identified that even though the downloaded installation executable was signed using a valid digital signature issued to Piriform, CCleaner was not the only application that came with the download. During the installation of CCleaner 5.33, the 32-bit CCleaner binary that was included also contained a malicious payload that featured a Domain Generation Algorithm (DGA) as well as hardcoded Command and Control (C2) functionality. We confirmed that this malicious version of CCleaner was being hosted directly on CCleaner’s download server as recently as September 11, 2017.

    (tags: ccleaner malware avast piriform windows security)

Links for 2017-09-15

Published September 15, 2017

  • Malicious typosquatting packages in PyPI

    skcsirt-sa-20170909-pypi vulnerability announcement from SK-CSIRT:

    SK-CSIRT identified malicious software libraries in the official Python package repository, PyPI, posing as well known libraries. A prominent example is a fake package urllib-1.21.1.tar.gz, based upon a well known package urllib3-1.21.1.tar.gz. Such packages may have been downloaded by unwitting developer or administrator by various means, including the popular “pip” utility (pip install urllib). There is evidence that the fake packages have indeed been downloaded and incorporated into software multiple times between June 2017 and September 2017.

    (tags: pypi python typos urllib security malware)

Links for 2017-09-14

Published September 14, 2017

  • London police’s use of AFR facial recognition falls flat on its face

    A “top-of-the-line” automated facial recognition (AFR) system trialled for the second year in a row at London’s Notting Hill Carnival couldn’t even tell the difference between a young woman and a balding man, according to a rights group worker invited to view it in action. Because yes, of course they did it again: London’s Met police used controversial, inaccurate, largely unregulated automated facial recognition (AFR) technology to spot troublemakers. And once again, it did more harm than good. Last year, it proved useless. This year, it proved worse than useless: it blew up in their faces, with 35 false matches and one wrongful arrest of somebody erroneously tagged as being wanted on a warrant for a rioting offense. […] During a recent, scathing US House oversight committee hearing on the FBI’s use of the technology, it emerged that 80% of the people in the FBI database don’t have any sort of arrest record. Yet the system’s recognition algorithm inaccurately identifies them during criminal searches 15% of the time, with black women most often being misidentified.

    (tags: face-recognition afr london notting-hill-carnival police liberty met-police privacy data-privacy algorithms)

Links for 2017-09-13

Published September 13, 2017

Links for 2017-09-12

Published September 12, 2017

  • “You Can’t Stay Here: The Efficacy of Reddit’s 2015 Ban Examined Through Hate Speech”

    In 2015, Reddit closed several subreddits—foremost among them r/fatpeoplehate and r/CoonTown—due to violations of Reddit’s anti-harassment policy. However, the effectiveness of banning as a moderation approach remains unclear: banning might diminish hateful behavior, or it may relocate such behavior to different parts of the site. We study the ban of r/fatpeoplehate and r/CoonTown in terms of its effect on both participating users and affected subreddits. Working from over 100M Reddit posts and comments, we generate hate speech lexicons to examine variations in hate speech usage via causal inference methods. We find that the ban worked for Reddit. More accounts than expected discontinued using the site; those that stayed drastically decreased their hate speech usage—by at least 80%. Though many subreddits saw an influx of r/fatpeoplehate and r/CoonTown “migrants,” those subreddits saw no significant changes in hate speech usage. In other words, other subreddits did not inherit the problem. We conclude by reflecting on the apparent success of the ban, discussing implications for online moderation, Reddit and internet communities more broadly.
    (Via Anil Dash)

    (tags: abuse reddit research hate-speech community moderation racism internet)

  • The Immortal Myths About Online Abuse – Humane Tech – Medium

    After building online communities for two decades, we’ve learned how to fight abuse. It’s a solvable problem. We just have to stop repeating the same myths as excuses not to fix things.
    Here are the 8 myths Anil Dash picks out: 1. False: You can’t fix abusive behavior online. 2. False: Fighting abuse hurts free speech! 3. False: Software can detect abuse using simple rules. 4. False: Most people say “abuse” when they just mean criticism. 5. False: We just need everybody to use their “real” name. 6. False: Just charge a dollar to comment and that’ll fix things. 7. False: You can call the cops! If it’s not illegal, it’s not harmful. 8. False: Abuse can be fixed without dedicated resources.

    (tags: abuse comments community harassment racism reddit anil-dash free-speech)

  • ‘Let’s all survive the GDPR’

    Simon McGarr and John Looney’s slides from their SRECon ’17 presentation

    (tags: simon-mcgarr data-privacy privacy data-protection gdpr slides presentations)

Links for 2017-09-11

Published September 11, 2017

  • The React license for founders and CTOs – James Ide – Medium

    Decent explanation of _why_ Facebook came up with the BSD+Patents license: “Facebook’s patent grant is about sharing its code while preserving its ability to defend itself against patent lawsuits.”

    The difficulty of open sourcing code at Facebook, including React in 2013, was one of the reasons the company’s open-source contributions used to be a fraction of what they are today. It didn’t use to have a strong reputation as an open-source contributor to front-end technologies. Facebook wanted to open source code, though; when it grew communities for projects like React, core contributors emerged to help out and interview candidates often cited React and other Facebook open source as one of the reasons they were interested in applying. People at Facebook wanted to make it easier to open source code and not worry as much about patents. Facebook’s solution was the Facebook BSD+Patents license.

    (tags: facebook bsd licenses licensing asf patents swpats react license software-patents open-source rocksdb)

  • HN thread on the new Network Load Balancer AWS product

    looks like @colmmacc works on it. Lots and lots of good details here

    (tags: nlb aws load-balancing ops architecture lbs tcp ip)

  • Java Flame Graphs Introduction: Fire For Everyone!

    lots of good detail on flame graph usage in Java, and the Honest Profiler (honest because it’s safepoint-free)

    (tags: profiling java safepoints jvm flame-graphs perf measurement benchmarking testing)

  • Teaching Students to Code – What Works

    Lynn Langit describing her work as part of Microsoft Digigirlz and TKP to teach thousands of kids worldwide to code. Describes a curriculum from “K” (4-6-year olds) learning computational thinking with a block-based programming environment like Scratch, up to University level, solving problems with public clouds like AWS’ free tier.

    (tags: education learning coding teaching tkp lynn-langit scratch kids)

  • So much for that Voynich manuscript “solution”

    boo.

    The idea that the book is a medical treatise on women’s health, however, might turn out to be correct. But that wasn’t Gibbs’ discovery. Many scholars and amateur sleuths had already reached that conclusion, using the same evidence that Gibbs did. Essentially, Gibbs rolled together a bunch of already-existing scholarship and did a highly speculative translation, without even consulting the librarians at the institute where the book resides. Gibbs said in the TLS article that he did his research for an unnamed “television network.” Given that Gibbs’ main claim to fame before this article was a series of books about how to write and sell television screenplays, it seems that his goal in this research was probably to sell a television screenplay of his own. In 2015, Gibbs did an interview where he said that in five years, “I would like to think I could have a returnable series up and running.” Considering the dubious accuracy of many History Channel “documentaries,” he might just get his wish.

    (tags: crypto history voynich-manuscript historians tls)

  • How to Optimize Garbage Collection in Go

    In this post, we’ll share a few powerful optimizations that mitigate many of the performance problems common to Go’s garbage collection (we will cover “fun with deadlocks” in a follow-up). In particular, we’ll share how embedding structs, using sync.Pool, and reusing backing arrays can minimize memory allocations and reduce garbage collection overhead.

    (tags: garbage performance gc golang go coding)

Links for 2017-09-09

Published September 9, 2017

  • Firms involved in biometric database in India contracted by Irish government

    Two tech firms – one owned by businessman Dermot Desmond – involved in the creation of a controversial biometric database in India, are providing services for the Government’s public services card and passports. Known as the Aadhaar project, the Indian scheme is the world’s largest ever biometric database involving 1.2 billion citizens. Initially voluntary, it became mandatory for obtaining state services, for paying taxes and for opening a bank account. […] Dermot Casey, a former chief technology officer of Storyful, said that if the Daon system was used to store the data and carry out the facial matching then the Government “appears to have purchased a biometric database system which can be extended to include voice, fingerprint and iris identification at a moment’s notice”. Katherine O’Keefe, a data protection consultant with Castlebridge, said if the departments were using images of people’s faces to single out or identify an individual, they were “by legal definition processing biometric data”.

    (tags: biometrics databases aadhar id-cards ireland psc daon morpho)

Links for 2017-09-08

Published September 8, 2017

Links for 2017-08-30

Published August 30, 2017

  • Comment: ‘Mandatory but not compulsory’ – what exactly is the justification for the Public Services Card? – Independent.ie

    TJ McIntyre nails the problem here:

    ‘Mandatory but not compulsory”. This ill-judged hair-splitting seems likely to stick to Social Protection Minister Regina Doherty in the same way that “an Irish solution to an Irish problem” and “on mature recollection” did to politicians before her. The minister used that phrase to defend against the criticism that the public services card (PSC) is being rolled out as a national ID card by stealth, without any clear legal basis or public debate. She went on to say that the PSC is not compulsory as “nobody will drag you kicking and screaming to have a card”. This is correct, but irrelevant. The Government’s strategy is one of making the PSC effectively rather than legally compulsory – by cutting off benefits such as pensions and refusing driving licences and passports unless a person registers. Whether or not the PSC is required by law is immaterial if you cannot function in society without it.

    (tags: psc id-cards ireland social-welfare id privacy data-protection)

Links for 2017-08-28

Published August 28, 2017

Links for 2017-08-24

Published August 24, 2017

Links for 2017-08-21

Published August 21, 2017

  • 48 Hours In Dublin

    good set of tourist tips for a foodie Dublin weekender

    (tags: dublin tourism food eating dining restaurants tips weekend)

  • Linux Load Averages: Solving the Mystery

    Nice bit of OS archaeology by Brendan Gregg.

    In 1993, a Linux engineer found a nonintuitive case with load averages, and with a three-line patch changed them forever from “CPU load averages” to what one might call “system load averages.” His change included tasks in the uninterruptible state, so that load averages reflected demand for disk resources and not just CPUs. These system load averages count the number of threads working and waiting to work, and are summarized as a triplet of exponentially-damped moving sum averages that use 1, 5, and 15 minutes as constants in an equation. This triplet of numbers lets you see if load is increasing or decreasing, and their greatest value may be for relative comparisons with themselves.

    (tags: load monitoring linux unix performance ops brendan-gregg history cpu)

  • Distilled Identity

    Gabriel recently bought a distillery in Barbados, where he says the majority of his team is of African descent. “The sugar industry is a painful past for them, but my understanding, from my team, is that they do see it as the past,” Gabriel explained. “There was great suffering, but their take is like, ‘We built this island.’ They are reclaiming it, and we are seeing that in efforts to preserve farming land and not let it all go to tourism.” I rather liked this narrative, or at least the potential of it. Slavery was appalling across the board, but countries and cultures throughout the African Diaspora have managed their paths forward in ways that don’t mimic the American aftermath. A plurality of narratives was possible here, which was thrilling to me. I am often disappointed by the mainstream perception of one-note blackness. One could easily argue the root of colonization is far from removed in the Caribbean. But if I understood Gabriel, and if he accurately captured the sentiments of his Barbadian colleagues, plantation sugarcane offered career opportunities to some, and was perhaps not solely a distressing connection to a shared global history. We chewed on this thought, together, in silence.

    (tags: history distilling rum barbados african-diaspora slavery american-history booze language etymology)

  • cristim/autospotting

    ‘Easy to use tool that automatically replaces some or even all on-demand AutoScaling group members with similar or larger identically configured spot instances in order to generate significant cost savings on AWS EC2, behaving much like an AutoScaling-backed spot fleet.’

    (tags: asg autoscaling ec2 aws spot-fleet spot-instances cost-saving scaling)

  • Going Multi-Cloud with AWS and GCP: Lessons Learned at Scale

    Metamarkets splits across AWS and GCP, going into heavy detail here

    (tags: aws gcp google ops hosting multi-cloud)

Links for 2017-08-20

Published August 20, 2017

Links for 2017-08-17

Published August 17, 2017

  • NASA’s Sound Suppression Water System

    If you’ve ever watched a rocket launch, you’ve probably noticed the billowing clouds around the launch pad during lift-off. What you’re seeing is not actually the rocket’s exhaust but the result of a launch pad and vehicle protection system known in NASA parlance as the Sound Suppression Water System. Exhaust gases from a rocket typically exit at a pressure higher than the ambient atmosphere, which generates shock waves and lots of turbulent mixing between the exhaust and the air. Put differently, launch ignition is incredibly loud, loud enough to cause structural damage to the launchpad and, via reflection, the vehicle and its contents. To mitigate this problem, launch operators use a massive water injection system that pours about 3.5 times as much water as rocket propellant per second. This significantly reduces the noise levels on the launchpad and vehicle and also helps protect the infrastructure from heat damage.

    (tags: water rockets launch nasa space sound-suppression sound science)

  • The White Lies of Craft Culture – Eater

    Besides field laborers, [Southern US] planter and urban communities both depended on proficient carpenters, blacksmiths, gardeners, stable hands, seamstresses, and cooks; the America of the 1700s and 1800s was literally crafted by people of color. Part of this hidden history includes the revelation that six slaves were critical to the operation of George Washington’s distillery, and that the eponymous Jack Daniel learned to make whiskey from an enslaved black man named Nathan “Nearest” Green. As Clay Risen reported for the New York Times last year, contrary to the predominant narrative that views whiskey as an ever “lily-white affair,” black men were the minds and hands behind American whiskey production. “In the same way that white cookbook authors often appropriated recipes from their black cooks, white distillery owners took credit for the whiskey,” he writes. Described as “the best whiskey maker that I know of” by his master, Dan Call, Green taught young Jack Daniel how to run a whiskey still. When Daniel later opened his own distillery, he hired two of Green’s sons. The popular image of moonshine is a product of the white cultural monopoly on all things ‘country’ Over time, that legacy was forgotten, creating a gap in knowledge about American distilling traditions — while English, German, Scottish, and Irish influences exist, that combination alone cannot explain the entirely of American distilling. As bourbon historian Michael Veach suggests, slave culture pieces together an otherwise puzzling intellectual history.

    (tags: history craft-beer craft-culture food drink whiskey distilling black-history jack-daniels nathan-nearest-green)

  • Meet the Espresso Tonic, Iced Coffee’s Bubbly New Cousin

    Bit late on this one but YUM

    To make the drink, Box Kite baristas simply load a glass with ice, fill it about three quarters of the way with chilled tonic, and then top it off with an espresso shot — typically from roasters like Madcap (MI) and Ritual (SF). Often, baristas pull the espresso shot directly on top of the tonic and ice mixture, forgoing the process of first pulling it into a cup and then pouring the espresso from cup to glass.

    (tags: tonic-water recipes espresso coffee drinks cocktails)

Links for 2017-08-16

Published August 16, 2017

  • Fsq.io

    Foursquare’s open source repo, where they extract reusable components for open sourcing — I like the approach of using a separate top level module path for OSS bits

    (tags: open-source oss foursquare libraries maintainance coding git monorepos)

  • GTK+ switches build from Autotools to Meson

    ‘The main change is that now GTK+ takes about ? of the time to build compared to the Autotools build, with likely bigger wins on older/less powerful hardware; the Visual Studio support on Windows should be at least a couple of orders of magnitude easier (shout out to Fan Chun-wei for having spent so, so many hours ensuring that we could even build on Windows with Visual Studio and MSVC); and maintaining the build system should be equally easier for everyone on any platform we currently support.’ Looking at http://mesonbuild.com/ it appears to be Python-based and AL2-licensed open source. On the downside, though, the Meson file is basically a Python script, which is something I’m really not fond of :( more details at http://taint.org/2011/02/18/001527a.html .

    (tags: meson build coding dev autotools gtk+ python)

  • Matt Haughey ???????? on Twitter: “high quality LED light tape for bikes and wheels is ridiculously cheap these days”

    good thread on fitting out a bike with crazy LED light tape; see also EL string. Apparently it’ll run off a 4.5V (3xAAA) battery pack nowadays which makes it pretty viable!

    (tags: bikes cycling safety led-lights el-tape led-tape hacks via:mathowie)

  • M00N

    a beautifully-glitched photo of the moon by Giacomo Carmagnola; more on his art at http://www.bleaq.com/2015/giacomo-carmagnola . (Via Archillect)

    (tags: via:archillect art giacomo-carmagnola glitch-art moon glitch images)

  • How to shop on AliExpress

    From the aptly-named Aliholic.com. Thanks, Elliot — the last thing I needed was something to feed my addiction to cheap tat from China!

    (tags: china aliexpress dealextreme gearbest gadgets buying tat aliholic stuff)

  • TIL you shouldn’t use conditioner if you get nuked

    If you shower carefully with soap and shampoo, Karam says [Andrew Karam, radiation expert], the radioactive dust should wash right out. But hair conditioner has particular compounds called cationic surfactants and polymers. If radioactive particles have drifted underneath damaged scales of hair protein, these compounds can pull those scales down to create a smooth strand of hair. “That can trap particles of contamination inside of the scale,” Karam says. These conditioner compounds are also oily and have a positive charge on one end that will make them stick to negatively charged sections of a strand of hair, says Perry Romanowski, a cosmetics chemist who has developed personal hygiene formulas and now hosts “The Beauty Brains” podcast on cosmetics chemistry. “Unlike shampoo, conditioners are meant to stay behind on your hair,” Romanowski says. If the conditioner comes into contact with radioactive material, these sticky, oily compounds can gum radioactive dust into your hair, he says.

    (tags: factoids conditioner surfactants nuclear-bombs fallout hair bizarre til via:boingboing)

Links for 2017-08-15

Published August 15, 2017

  • Allen curve – Wikipedia

    During the late 1970s, [Professor Thomas J.] Allen undertook a project to determine how the distance between engineers’ offices affects the frequency of technical communication between them. The result of that research, produced what is now known as the Allen Curve, revealed that there is a strong negative correlation between physical distance and the frequency of communication between work stations. The finding also revealed the critical distance of 50 meters for weekly technical communication. With the fast advancement of internet and sharp drop of telecommunication cost, some wonder the observation of Allen Curve in today’s corporate environment. In his recently co-authored book, Allen examined this question and the same still holds true. He says[2] “For example, rather than finding that the probability of telephone communication increases with distance, as face-to-face probability decays, our data show a decay in the use of all communication media with distance (following a “near-field” rise).” [p. 58]
    Apparently a few years back in Google, some staff mined the promotion data, and were able to show a Allen-like curve that proved a strong correlation between distance from Jeff Dean’s desk, and time to getting promoted.

    (tags: jeff-dean google history allen-curve work communication distance offices workplace teleworking remote-work)

  • Arq Backs Up To B2!

    Arq backup for OSX now supports B2 (as well as S3) as a storage backend. “it’s a super-cheap option ($.005/GB per month) for storing your backups.” (that is less than half the price of $0.0125/GB for S3’s Infrequent Access class)

    (tags: s3 storage b2 backblaze backups arq macosx ops)

  • After Charlottesville, I Asked My Dad About Selma

    Dad told me that he didn’t think I was going to have to go through what he went through, but now he can see that he was wrong. “This fight is a never-ending fight,” he said. “There’s no end to it. I think after the ‘60s, the whole black revolution, Martin Luther King, H. Rap Brown, Stokely Carmichael and all the rest of the people, after that happened, people went to sleep,” he said. “They thought, ‘this is over.’”

    (tags: selma charlottesville racism nazis america race history civil-rights 1960s)

Links for 2017-08-14

Published August 14, 2017

Links for 2017-08-13

Published August 13, 2017

Links for 2017-08-12

Published August 12, 2017

  • Hyperscan

    a high-performance multiple regex matching library. It follows the regular expression syntax of the commonly-used libpcre library, yet functions as a standalone library with its own API written in C. Hyperscan uses hybrid automata techniques to allow simultaneous matching of large numbers (up to tens of thousands) of regular expressions, as well as matching of regular expressions across streams of data. Hyperscan is typically used in a DPI library stack. Hyperscan began in 2008, and evolved from a commercial closed-source product 2009-2015. First developed at Sensory Networks Incorporated, and later acquired and released as open source software by Intel in October 2015.  Hyperscan is under a 3-clause BSD license. We welcome outside contributors.
    This is really impressive — state of the art in parallel regexp matching has improved quite a lot since I was last looking at it. (via Tony Finch)

    (tags: via:fanf regexps regular-expressions text matching pattern-matching intel open-source bsd c dpi scanning sensory-networks)

Links for 2017-08-08

Published August 8, 2017

  • Beard vs Taleb: Scientism and the Nature of Historical Inquiry

    The most interesting aspect of this Twitter war is that it is representative of a malaise that has stricken a good chunk of academics (mostly scientists, with a peppering of philosophers) and an increasing portion of the general public: scientism. I have co-edited an entire book, due out soon, on the topic, which features authors who are pro, con, and somewhere in the middle. Scientism is defined as the belief that the assumptions, methods of research, etc., of the natural sciences are the only ways to gather valuable knowledge or to answer meaningful questions. Everything else, to paraphrase Taleb, is bullshit. Does Taleb engage in scientism? Indubitably. I have already mentioned above his generalization from what one particular historian (Beard) said to “historians” tout court. But there is more, from his Twitter feed: “there is this absence of intellectual rigor in humanities.” “Are historians idiots? Let’s be polite and say that they are in the majority no rocket scientists and operate under a structural bias. It looks like an empirically rigorous view of historiography is missing.”

    (tags: history science scientism nassim-taleb argument debate proof romans britain mary-beard)

  • Google’s Response to Employee’s Anti-Diversity Manifesto Ignores Workplace Discrimination Law – Medium

    A workplace-discrimination lawyer writes:

    Stray remarks are not enough. But a widespread workplace discussion of whether women engineers are biologically capable of performing at the same level as their male counterparts could suffice to create a hostile work environment. As another example, envision the racial hostility of a workplace where employees, as Google put it, “feel safe” to espouse their “alternative view” that their African-American colleagues are not well-represented in management positions because they are not genetically predisposed for leadership roles. In short, a workplace where people “feel safe sharing opinions” based on gender (or racial, ethnic or religious) stereotypes may become so offensive that it legally amounts to actionable discrimination.

    (tags: employment sexism workplace discrimination racism misogyny women beliefs)

  • a list of all the nuclear war scenarios stored in the W.O.P.R. computer

    For fans of the movie WARGAMES: a list of all the nuclear war scenarios stored in the W.O.P.R. computer. (self.movies)
    (via burritojustice)

    (tags: via:burritojustice wargames movies wopr global-thermonuclear-war wwiii)

  • Nextflow – A DSL for parallel and scalable computational pipelines

    Data-driven computational pipelines Nextflow enables scalable and reproducible scientific workflows using software containers. It allows the adaptation of pipelines written in the most common scripting languages. Its fluent DSL simplifies the implementation and the deployment of complex parallel and reactive workflows on clouds and clusters.
    GPLv3 licensed, open source

    (tags: computation workflows pipelines batch docker ops open-source)

Links for 2017-08-02

Published August 2, 2017

  • Malicious packages in npm

    The node.js packaging system is being exploited by bad guys to steal auth tokens at build time. This is the best advice they can come up with:

    Always check the name of packages you’re installing. You can look at the downloads number: if a package is popular but the downloads number is low, something is wrong.
    :facepalm: What a mess. Security needs to become a priority….

    (tags: javascript security npm node packaging packages fail)

Links for 2017-08-01

Published August 1, 2017

  • Air Canada near-miss: Air traffic controllers make split-second decisions in a culture of “psychological safety” — Quartz

    “’Just culture’ as a term emerged from air traffic control in the late 1990s, as concern was mounting that air traffic controllers were unfairly cited or prosecuted for incidents that happened to them while they were on the job,” Sidney Dekker, a professor, writer, and director of the Safety Science Innovation Lab at Griffith University in Australia, explains to Quartz in an email. Eurocontrol, the intergovernmental organization that focuses on the safety of airspace across Europe, has “adopted a harmonized ‘just culture’ that it encourages all member countries and others to apply to their air traffic control organizations.” […] One tragic example of what can happen when companies don’t create a culture where employees feel empowered to raise questions or admit mistakes came to light in 2014, when an investigation into a faulty ignition switch that caused more than 100 deaths at GM Motors revealed a toxic culture of denying errors and deflecting blame within the firm. The problem was later attributed to one engineer who had not disclosed an obvious issue with the flawed switch, but many employees spoke of extreme pressure to put costs and delivery times before all other considerations, and to hide large and small concerns.
    (via JG)

    (tags: just-culture atc air-traffic-control management post-mortems outages reliability air-canada disasters accidents learning psychological-safety work)

  • Dark forces, Brexit and Irexit

    The EU have made it clear, as they have to, that there will be no frictionless borders between the union and the UK. Brexit will be dislocative.  As smaller irish companies start to go to the wall post Brexit expect the calls for “something to be done” to start to include Irexit [an Irish exit from the EU a la Brexit]. But this way madness lies. […] we export more in education services than in beverages ; we exportthree times or more manufactured goods than food; we export six times more in chemicals and related; value added by industry or by distribution and transport is more than 10 times that of agriculture. Seeking Irexit on the basis that it would be good for agribusiness is seeking to amputate a hand for a broken finger.

    (tags: agribusiness ireland irexit brexit economics eu politics)

  • APOLLO 13 EARTH ORBITAL CHART | Artsy

    Some nice catalogue details around this Apollo 13 AEO:

    Apollo Earth Orbit Chart (AEO), Apollo Mission 13 for April 1970 Launch Date. March 3, 1970. Color Earth map, first edition. 13 by 42 inches. From the Catalogue: SIGNED and INSCRIBED: “JAMES LOVELL, Apollo 13 CDR and FRED HAISE, Apollo 13 LMP.” Additionally INSCRIBED by HAISE with mission events: “Launch at 2:13 pm EST, April 11, 1970” and “Splash – April 17, 1970.” He has marked the splashdown area with an “X.” Circular plots in black represent the ground station communication coverage areas with the red circle being the tracking ship Vanguard in the Atlantic Ocean. Orbital paths show the full launch range azimuths of 72 to 108 degrees. The first orbit is plotted in light blue with the second orbit in dark blue. The planned TLI (TransLunar Injection) burn occurred on time during the mission and is plotted with a red dashed line. The point above the Earth as Apollo 13 headed toward the Moon is shown with a brown line and continues for 24 hours of mission elapsed time. This line moves over the Pacific Ocean and into the continental United States. Then it moves backwards (relative to the Earth’s rotation) over the Pacific Ocean and ends near the west coast of Africa. The Service Module explosion occurred some 32 hours after end point of the TLI brown line tracking plot.

    (tags: aeo apollo history spaceflight collectibles antiques james-lovell fred-haise 1970 apollo-13 charts)

Links for 2017-07-27

Published July 27, 2017

Links for 2017-07-26

Published July 26, 2017

Links for 2017-07-24

Published July 24, 2017

Links for 2017-07-21

Published July 21, 2017

  • awslabs/aws-ec2rescue-linux

    Amazon Web Services Elastic Compute Cloud (EC2) Rescue for Linux is a python-based tool that allows for the automatic diagnosis of common problems found on EC2 Linux instances.
    Most of the modules appear to be log-greppers looking for common kernel issues.

    (tags: ec2 aws kernel linux ec2rl ops)

Links for 2017-07-20

Published July 20, 2017

Links for 2017-07-17

Published July 17, 2017

Links for 2017-07-13

Published July 13, 2017

  • Novartis CAR-T immunotherapy strongly endorsed by FDA advisory panel

    This is very exciting stuff, cytokine release syndrome risks notwithstanding.

    The new treatment is known as CAR-T cell immunotherapy. It works by removing key immune system cells known as T cells from the patient so scientists can genetically modify them to seek out and attack only cancer cells. That’s why some scientists refer to this as a “living drug.” Doctors then infuse millions of the genetically modified T cells back into the patient’s body so they can try to obliterate the cancer cells and hopefully leave healthy tissue unscathed. “It’s truly a paradigm shift,” said Dr. David Lebwohl, who heads the CAR-T Franchise Global Program at the drug company Novartis, which is seeking the FDA’s approval for the treatment. “It represents a new hope for patients.” The drug endorsed by the advisory panel is known as CTL019 or tisagenlecleucel. It was developed to treat children and young adults ages 3 to 25 who have relapsed after undergoing standard treatment for B cell acute lymphoblastic leukemia, which is the most common childhood cancer in the United States. While this blood cell cancer can be highly curable, some patients fail to respond to standard treatments; and a significant proportion of patients experience relapses that don’t respond to follow-up therapies. “There is a major unmet medical need for treatment options” for these patients, Dr. Stephen Hunger, who helped study at the Children’s Hospital of Philadelphia, told the committee. In the main study that the company submitted as evidence in seeking FDA approval, doctors at 25 sites in 11 countries administered the treatment to 88 patients. The patients, ages 3 to 23, had failed standard treatment or experienced relapses and failed to respond to follow-up standard treatment. CTL019 produced remissions in 83 percent of patients, the company told the committee.

    (tags: car-t immunotherapy cancer novartis trials fda drugs t-cells immune-system medicine leukemia ctl019)

  • Chris’s Wiki :: blog/sysadmin/UnderstandingIODNSIssue

    On the ns-a1.io security screwup for the .io CCTLD:

    Using data from glue records instead of looking things up yourself is common but not mandatory, and there are various reasons why a resolver would not do so. Some recursive DNS servers will deliberately try to check glue record information as a security measure; for example, Unbound has the harden-referral-path option (via Tony Finch). Since the original article reported seeing real .io DNS queries being directed to Bryant’s DNS server, we know that a decent number of clients were not using the root zone glue records. Probably a lot more clients were still using the glue records, through.
    (via Tony Finch)

    (tags: via:fanf dns security dot-io cctlds glue-records delegation)

Links for 2017-07-12

Published July 12, 2017

  • DoppioJVM

    ‘A Java Virtual Machine written in 100% JavaScript.’ Wrapping outbound TCP traffic in websockets, mad stuff

    (tags: jvm java javascript js hacks browser emulation websockets)

  • One Man’s Plan to Make Sure Gene Editing Doesn’t Go Haywire – The Atlantic

    Open science – radical transparency where gene-editing and CRISPR is involved. Sounds great.

    “For gene drive, the closed-door model is morally unacceptable. You don’t have the right to go into your lab and build something that is ineluctably designed to affect entire ecosystems. If it escapes into the wild, it would be expected to spread and affect people’s lives in unknown ways. Doing that in secret denies people a voice.”
    Also this is a little scary:
    in 2015, he was shocked to read a paper, due to be published in … Science, in which Californian researchers had inadvertently created a gene drive in fruit flies, without knowing what gene drives are. They developed it as a research tool for spreading a trait among lab populations, and had no ambitions to alter wild animals. And yet, if any of their insects had escaped, that’s what would have happened.

    (tags: science openness open-source visibility transparency crispr gene-editing mice nantucket gene-drive)

Links for 2017-07-11

Published July 11, 2017

Links for 2017-07-10

Published July 10, 2017

Links for 2017-07-06

Published July 6, 2017

  • The Guardian view on patient data: we need a better approach | Editorial | Opinion | The Guardian

    The use of privacy law to curb the tech giants in this instance, or of competition law in the case of the EU’s dispute with Google, both feel slightly maladapted. They do not address the real worry. It is not enough to say that the algorithms DeepMind develops will benefit patients and save lives. What matters is that they will belong to a private monopoly which developed them using public resources. If software promises to save lives on the scale that drugs now can, big data may be expected to behave as big pharma has done. We are still at the beginning of this revolution and small choices now may turn out to have gigantic consequences later. A long struggle will be needed to avoid a future of digital feudalism. Dame Elizabeth’s report is a welcome start.
    Hear hear.

    (tags: privacy law uk nhs data google deepmind healthcare tech open-source)

  • Why People With Brain Implants Are Afraid to Go Through Automatic Doors

    In 2009, Gary Olhoeft walked into a Best Buy to buy some DVDs. He walked out with his whole body twitching and convulsing. Olhoeft has a brain implant, tiny bits of microelectronic circuitry that deliver electrical impulses to his motor cortex in order to control the debilitating tremors he suffers as a symptom of Parkinson’s disease. It had been working fine. So, what happened when he passed through those double wide doors into consumer electronics paradise? He thinks the theft-prevention system interfered with his implant and turned it off. Olhoeft’s experience isn’t unique. According to the Food and Drug Administration’s MAUDE database of medical device reports, over the past five years there have been at least 374 cases where electromagnetic interference was reportedly a factor in an injury involving medical devices including neural implants, pacemakers and insulin pumps. In those reports, people detailed experiencing problems with their devices when going through airport security, using massagers or simply being near electrical sources like microwaves, cordless drills or “church sound boards.”

    (tags: internet-of-things iot best-buy implants parkinsons-disease emi healthcare devices interference)

  • Undefined Behavior in 2017

    This is an extremely detailed post on the state of dynamic checkers in C/C++ (via the inimitable Marc Brooker):

    Recently we’ve heard a few people imply that problems stemming from undefined behaviors (UB) in C and C++ are largely solved due to ubiquitous availability of dynamic checking tools such as ASan, UBSan, MSan, and TSan. We are here to state the obvious — that, despite the many excellent advances in tooling over the last few years, UB-related problems are far from solved — and to look at the current situation in detail.

    (tags: via:marc-brooker c c++ coding testing debugging dynamic-analysis valgrind asan ubsan tsan)

  • Talos Intelligence review of Nyetya and the M.E.Doc compromise

    Our Threat Intelligence and Interdiction team is concerned that the actor in question burned a significant capability in this attack.  They have now compromised both their backdoor in the M.E.Doc software and their ability to manipulate the server configuration in the update server. In short, the actor has given up the ability to deliver arbitrary code to the 80% of UA businesses that use M.E.Doc as their accounting software, along with any multinational corporations that leveraged the software.  This is a significant loss in operational capability, and the Threat Intelligence and Interdiction team assesses with moderate confidence that it is unlikely that they would have expended this capability without confidence that they now have or can easily obtain similar capability in target networks of highest priority to the threat actor.

    (tags: security malware nyetya notpetya medoc talos ransomware)

  • Use AWS WAF to Mitigate OWASP’s Top 10 Web Application Vulnerabilities

    ‘describes how you can use AWS WAF, a web application firewall, to address the top application security flaws as named by the Open Web Application Security Project (OWASP). Using AWS WAF, you can write rules to match patterns of exploitation attempts in HTTP requests and block requests from reaching your web servers. This whitepaper discusses manifestations of these security vulnerabilities, AWS WAF–based mitigation strategies, and other AWS services or solutions that can help address these threats.’

    (tags: security waf aws http owasp filtering)

  • welcome datacomp

    Some Mac third party keyboards used to (or maybe still do for all I know) have a little feature where if you didn’t type anything for a while they would themselves type ‘welcome datacomp’.
    (via RobS)

    (tags: via:rsynnott funny welcome-datacomp keyboards hardware fail ghost-typing haunted)

  • La història del gran tauró blanc de Tossa de Mar

    Amazing pic and newspaper report regarding a great white shark which washed up on the beach at Tossa de Mar in the Costa Brava in the 1980s

    (tags: tossa-de-mar costa-brava spain sharks nature great-white-shark 1980s history photos wildlife)