A critical analysis of the Legacy Verified SSL/TLS proposal by CloudFlare & Facebook
The history of real-world CA-based PKI is pretty awful
Incredibly Rare Underwater Footage of a Stray Giant Squid Swimming Around Toyama Bay in Japan
wow, this is great footage
(tags: giant-squid squid cephalopods japan video youtube)
Justin's Linklog Posts
-
hooray, Docker registry here at last
How to inspect SSL/TLS traffic with Wireshark 2
turns out it’s easy enough — Mozilla standardised a debugging SSL session-key logging file format which Wireshark and Chrome support
ImperialViolet – Juniper: recording some Twitter conversations
Adam Langley on the Juniper VPN-snooping security hole:
… if it wasn’t the NSA who did this, we have a case where a US government backdoor effort (Dual-EC) laid the groundwork for someone else to attack US interests. Certainly this attack would be a lot easier given the presence of a backdoor-friendly RNG already in place. And I’ve not even discussed the SSH backdoor. […]
(tags: primes ecc security juniper holes exploits dual-ec-drbg vpn networking crypto prngs)
Excellent post from Matthew Green on the Juniper backdoor
For the past several years, it appears that Juniper NetScreen devices have incorporated a potentially backdoored random number generator, based on the NSA’s Dual_EC_DRBG algorithm. At some point in 2012, the NetScreen code was further subverted by some unknown party, so that the very same backdoor could be used to eavesdrop on NetScreen connections. While this alteration was not authorized by Juniper, it’s important to note that the attacker made no major code changes to the encryption mechanism — they only changed parameters. This means that the systems were potentially vulnerable to other parties, even beforehand. Worse, the nature of this vulnerability is particularly insidious and generally messed up. [….] The end result was a period in which someone — maybe a foreign government — was able to decrypt Juniper traffic in the U.S. and around the world. And all because Juniper had already paved the road. One of the most serious concerns we raise during [anti-law-enforcement-backdoor] meetings is the possibility that encryption backdoors could be subverted. Specifically, that a back door intended for law enforcement could somehow become a backdoor for people who we don’t trust to read our messages. Normally when we talk about this, we’re concerned about failures in storage of things like escrow keys. What this Juniper vulnerability illustrates is that the danger is much broader and more serious than that. The problem with cryptographic backdoors is not that they’re the only way that an attacker can break intro our cryptographic systems. It’s merely that they’re one of the best. They take care of the hard work, the laying of plumbing and electrical wiring, so attackers can simply walk in and change the drapes.
(via Tony Finch)(tags: via:fanf crypto backdoors politics juniper dual-ec-drbg netscreen vpn)
-
good thread of AWS’ shortcomings — so many services still don’t handle VPC for instance
Big Brother is born. And we find out 15 years too late to stop him – The Register
During the passage of RIPA, and in many debates since 2000, Parliament was asked to consider and require data retention by telephone companies, claiming that the information was vital to fighting crime and terrorism. But Prime Minister Tony Blair and successive Home Secretaries David Blunkett and Jack Straw never revealed to Parliament that at the same time, the government was constantly siphoning up and storing all telephone call records at NTAC. As a result, MPs and peers spent months arguing about a pretence, and in ignorance of the cost and human rights implications of what successive governments were doing in secret.
(tags: ripa big-brother surveillance preston uk gchq mi5 law snooping)
How to host Hugo static website generator on AWS Lambda
seriously, AWS. editing JSON files in a browser text box is an awful, awful user experience
-
A German bank offering a worldwide(?) bank account, using your smartphone (with push notifications etc.) as the main UI
The mystery of the power bank phone taking over Ghana
tl;dr: it’s being used as a cheap, portable power bank
(tags: africa ghana battery phones power recharging gadgets)
Gardai find 70 stolen bikes in one house being readied for export
The Limerick Leader quoted other unnamed gardai who said they believed those who had stolen the bikes were selling them to a third party for shipment abroad, most likely to another country in Europe. “It would seem that he has his own network on the Continent and has a lucrative market for the bikes he sends on,” said one of the sources quoted in the report. “Some of the racing bikes would fetch large sums of money on the Continent.” Trucks were seen arriving and departing the house in Castletroy where the find was made. And while it was unclear exactly how gardai were informed of the suspicious activity, when a team of officers went to search the property they found the bikes in the back garden.
(tags: bikes theft limerick crime bike-theft ireland castletroy)
-
“Statistical regression to the mean predicts that patients selected for abnormalcy will, on the average, tend to improve. We argue that most improvements attributed to the placebo effect are actually instances of statistical regression.”
(tags: medicine science statistics placebo evidence via:hn regression-to-the-mean)
League of Legends win-rates vs latency analysed
It appears that more mechanically intensive champions are more affected by latency, while tankier champions or those with point-and-click abilities are less affected by latency.
(via Nelson)(tags: games league-of-legends latency ping gaming internet via:nelson)
-
via Tony Finch. ‘In this post I will demonstrate how to do reservoir sampling orders of magnitude faster than the traditional “naive” reservoir sampling algorithm, using a fast high-fidelity approximation to the reservoir sampling-gap distribution.’
(tags: statistics reservoir-sampling sampling algorithms poisson bernoulli performance)
The Moral Failure of Computer Scientists – The Atlantic
Phillip Rogaway, a professor of CS at UC Davis, contends that computer scientists should stand up against the construction of surveillance states built using their work:
Waddell: In your paper, you compare the debate over nuclear science in the 1950s to the current debate over cryptography. Nuclear weapons are one of the most obvious threats to humanity today — do you think surveillance presents a similar type of danger? Rogaway: I do. It’s of a different nature, obviously. The threat is more indirect and more subtle. So with nuclear warfare, there was this visually compelling and frightening risk of going up in a mushroom cloud. And with the transition to a state of total surveillance, what we have is just the slow forfeiture of democracy.
(tags: ethics cryptography crypto surveillance politics phillip-rogaway morals speaking-out government)
-
This is basically terrifying. A catalog of race conditions and reliability horrors around the POSIX filesystem abstraction in Linux — it’s a wonder anything works. ‘Where’s this documented? Oh, in some mailing list post 6-8 years ago (which makes it 12-14 years from today). The fs devs whose posts I’ve read are quite polite compared to LKML’s reputation, and they generously spend a lot of time responding to basic questions, but it’s hard for outsiders to troll [sic] through a decade and a half of mailing list postings to figure out which ones are still valid and which ones have been obsoleted! I don’t mean to pick on filesystem devs. In their OSDI 2014 talk, the authors of the paper we’re discussing noted that when they reported bugs they’d found, developers would often respond “POSIX doesn’t let filesystems do that”, without being able to point to any specific POSIX documentation to support their statement. If you’ve followed Kyle Kingsbury’s Jepsen work, this may sound familiar, except devs respond with “filesystems don’t do that” instead of “networks don’t do that”.I think this is understandable, given how much misinformation is out there. Not being a filesystem dev myself, I’d be a bit surprised if I don’t have at least one bug in this post.’
(tags: filesystems linux unix files operating-systems posix fsync osdi papers reliability)
[LUCENE-6917] Deprecate and rename NumericField/RangeQuery to LegacyNumeric – ASF JIRA
Interesting performance-related tweak going into Lucene — based on the Bkd-Tree I think: https://users.cs.duke.edu/~pankaj/publications/papers/bkd-sstd.pdf . Being used for all numeric index types, not just multidimensional ones?
(tags: lucene performance algorithms patches bkd-trees geodata numeric indexing)
Kevin Lyda’s mega pension post
Cutting and pasting from Facebook for posterity… there are some really solid tips in here. ‘Some people plan their lives out and then there are people like me who randomly do things and suddenly, in retrospect, it looks like a grand plan has come together. In reality it’s more like my subconscious pulls in useful info and pokes me to go learn things as required. If you live/work in Ireland, the following “grand plan” might be useful. This year has apparently been “figure out how to retire” year. It started late last year with finally organising all my private Irish pensions (2 from employers, 1 personal). In the process I learned the following: * Many Irish pension plans allow you to start drawing down from them at age 50. There are downsides to this, but if you have several of them it allows you more room to avoid stock market downturns when you purchase annuities. * You can get 25% of each pension as a tax-free lump sum. I also learned a few property things. The key thing is that if you have a buy-to-let property you should *not* pay off its mortgage early. You can deduct 75% of the interest you pay against the taxes you’d owe for rental income. That means the interest you pay will essentially be close to or even under the rate of inflation. A residential mortgage might have a lower interest rate nominally, but the effective interest rate is higher. The Irish state pension is changing. If you are 68 after 2020 the rules have changed – and they’re now much simpler. Work for 10 years and you get the minimum state pension (1/3 of a full pension). Work for 20, you get 2/3 of of a state pension. Work for 30, you get a full pension. But you can’t collect it till you’re 68 and remember that Irish employers can apparently force you to “retire” at 65 (ageism is legal). So you need to bridge those 3 years (or hope they change the law to stop employers from doing that). When I “retired” I kept a part time job for a number of reasons, but one was because I suspected I needed more PRSI credits for a pension. And it turns out this was correct. Part-time work counts as long as you make more than €38/week. And self-employment counts as long as you make more than €5,000/year. You can also make voluntary PRSI contributions (around €500/year but very situation dependent). If you’ve worked in Europe or the US or Canada or a few other countries, you can get credits for social welfare payments in those countries. But if you have enough here and you have enough for some pension in the other country, you can draw a pension from both. Lastly most people I’ve talked to about retirement this year have used the analogy of legs on a stool. Every source of post-retirement income is a leg on the stool – the more legs, the more secure your retirement. There are lots of options for legs: * Rental income. This is a little wobbly as legs go at least for me. But if you have more than one rental property – and better yet some commercial rental property – this leg firms up a bit. Still, it’s a bit more work than most. * Savings. This isn’t very tax-efficient, but it can help fill in blank spots some legs have (like rental income or age restrictions) or maximise another legs value (weathering downturns for stock-based legs). And in retirement you can even build savings up. Sell a house, the private pension lump sum, etc. But remember you’re retired, go have fun. Savings won’t do you much good when you’re dead. * Stocks. I’ve cashed all mine in, but some friends have been more restrained in cashing in stocks they might have gotten from employers. This is a volatile leg, but it can pay off rather well if you know what you’re doing. But be honest with yourself. I know I absolutely don’t know what I’m doing on this so stayed away. * Government pension. This is generally a reliable source of income in retirement. It’s usually not a lot, but it does tend to last from retirement to death and it shows up every month. You apply once and then it just shows up each month. If you’ve worked in multiple countries, you can hedge some bets by taking a pension in each country you qualify from. You did pay into them after all. * Private pension. This can also give you a solid source of income but you need to pay into it. And paying in during your 20s and 30s really pays off later. But you need to make your investments less risky as you get into your late 50s – so make sure to start looking at them then. And you need to provide yourself some flexibility for starting to draw it down in order to survive market drops. The crash in 2007 didn’t fully recover until 2012 – that’s 5 years. * Your home. Pay off your mortgage and your home can be a leg. Not having to pay rent/mortgage is a large expense removed and makes the other legs more effective. You can also “sell down” or look into things like reverse mortgages, but the former can take time and has costs while the latter usually seems to have a lot of fine print you should read up on. * Part-time work. I know a number of people who took part-time jobs when they retired. If you can find something that doesn’t take a huge amount of time that you’d enjoy doing and that people will pay you for, fantastic! Do that. And it gets you out of the house and keeping active. For friends who are geeks and in my age cohort, I note that it will be 2037 around the time we hit 65. If you know why that matters, ka-ching!’ Another particularly useful page about the state pension: “Six things every woman needs to know about the State pension”, Irish Times, Dec 1 2015, https://www.irishtimes.com/business/personal-finance/six-things-every-woman-needs-to-know-about-the-state-pension-1.2448981 , which links to this page to get your state pension contribution record: http://www.welfare.ie/en/pages/secure/ RequestSIContributionRecord.aspx
(tags: pensions money life via:klyda stocks savings shares property ireland old-age retirement)
-
As Glynn Moody noted, if UK police, intelligence agencies, HMRC and others call all legally hack phones and computers, that also means that digital evidence can be easily and invisibly planted. This will undermine future court cases in the UK, which seems like a significant own goal…
(tags: hmrc police gchq uk hacking security law-enforcement evidence law)
Why We Chose Kubernetes Over ECS
3 months ago when we, at nanit.com, came to evaluate which Docker orchestration framework to use, we gave ECS the first priority. We were already familiar with AWS services, and since we already had our whole infrastructure there, it was the default choice. After testing the service for a while we had the feeling it was not mature enough and missing some key features we needed (more on that later), so we went to test another orchestration framework: Kubernetes. We were glad to discover that Kubernetes is far more comprehensive and had almost all the features we required. For us, Kubernetes won ECS on ECS’s home court, which is AWS.
(tags: kubernetes ecs docker containers aws ec2 ops)
Beachbum Berry — Latitude 29 Formula Orgeat
The legendary Jeff “Beachbum” Berry, tiki-cocktail wizard, has partnered with a Brooklyn-based orgeat maker to provide the key ingredient for an original Trader-Vic-style Mai Tai. may be a bit tricky to ship to Ireland though!
How to Spot Bitcoin Inventor Satoshi Nakamoto | MIT Technology Review
Emin Gün Sirer pours cold water on the “Craig Wright is Satoshi Nakamoto” theory
(tags: satoshi-nakamoto bitcoin anonymous nom-de-guerre crypto)
Dr TJ McIntyre: Fight against cybercrime needs funding, not more words – Independent.ie
Is the Irish policing system capable of tackling computer crime? A report this week from the Garda Inspectorate makes it clear that the answer is no. There is no Garda cybercrime unit, which is of serious concern given the threat posed by cybercrime to key national infrastructure such as energy, transport and telecommunications systems. […] A combination of inadequate resources and increased workload have swamped the [Computer Crime Investigation Unit]. Today, almost every crime is a computer crime, in the sense that mobile phones, laptops and even devices such as game consoles are likely to contain evidence. The need to forensically inspect all these devices – using outdated equipment – has resulted in several-year delays and seem to have forced the unit into a position where it is running to stand still rather than responding to new developments.
(tags: via:tjmcintyre ireland cybercrime law policing hacking)
-
I keep having to google this, so here’s a good one which works — unlike Wolfram Alpha!
(tags: birthday birthday-paradox birthday-problem hashes hash-collision attacks security collisions calculators probability statistcs)
-
‘At least for Europe it is obvious: All roads lead to Rome! You can reach the eternal city on almost 500.000 routes from all across the continent. Which road would you take? To approach one of the biggest unsolved quests of mobility, the first question we asked ourselves was: Where do you start, when you want to know every road to Rome? We aligned starting points in a 26.503.452 km² grid covering all of Europe. Every cell of this grid contains the starting point to one of our journeys to Rome. Now that we have our 486.713 starting points we need to find out how we could reach Rome as our destination. For this we created a algorithm that calculates one route for every trip. The more often a single street segment is used, the stronger it is drawn on the map. The maps as outcome of this project is somewhere between information visualization and data art, unveiling mobility and a very large scale.’ Beautiful! Decent-sized prints available for 26 euros too.
Tools for debugging, testing and using HTTP/2
excellent, extensive list from Cloudflare
(tags: http http2 cloudflare tools cli ops testing debugging spdy)
AWS Api Gateway for Fun and Profit
good worked-through example of an API Gateway rewriting system
(tags: api-gateway aws api http services ops alerting alarming opsgenie signalfx)
EU counter-terror bill is ‘indiscriminate’ data sweep
“To identify if someone is travelling outside the EU, we don’t need an EU PNR. This data are already easily available in the airline reservation system,” [Giovanni Buttarelli, the European data protection supervisor] said. EU governments want more information in the belief it will help law enforcement in tracking down terrorists and are demanding access to information, such as travel dates, travel itinerary, ticket information, contact details, baggage information, and payment information of anyone flying in or out of the EU. … EU PNR data would be retained for up to five years
(tags: pnr eu law privacy data-protection europe counter-terrorism travel air-travel)
Fast Forward Labs: Fashion Goes Deep: Data Science at Lyst
this is more than just data science really — this is proper machine learning, with deep learning and a convolutional neural network. serious business
(tags: lyst machine-learning data-science ml neural-networks supervised-learning unsupervised-learning deep-learning)
Why Percentiles Don’t Work the Way you Think
Baron Schwartz on metrics, percentiles, and aggregation. +1, although as a HN commenter noted, quantile digests are probably the better fix
(tags: performance percentiles quantiles statistics metrics monitoring baron-schwartz vividcortex)
-
Spotify wrote their own metrics store on ElasticSearch and Cassandra. Sounds very similar to Prometheus
(tags: cassandra elasticsearch spotify monitoring metrics heroic)
ELS: latency based load balancer, part 1
ELS measures the following things: Success latency and success rate of each machine; Number of outstanding requests between the load balancer and each machine. These are the requests that have been sent out but we haven’t yet received a reply; Fast failures are better than slow failures, so we also measure failure latency for each machine. Since users care a lot about latency, we prefer machines that are expected to answer quicker. ELS therefore converts all the measured metrics into expected latency from the client’s perspective.[…] In short, the formula ensures that slower machines get less traffic and failing machines get much less traffic. Slower and failing machines still get some traffic, because we need to be able to detect when they come back up again.
(tags: latency spotify proxies load-balancing els algorithms c3 round-robin load-balancers routing)
Low-latency journalling file write latency on Linux
great research from LMAX: xfs/ext4 are the best choices, and they explain why in detail, referring to the code
(tags: linux xfs ext3 ext4 filesystems lmax performance latency journalling ops)
-
nice 3D printed maps from this Irish company
-
“Irish police have no cybercrime unit, and 1/3 of police have no email.” ffs!
(tags: cybercrime policing ireland gardai fraud privacy phishing hacking internet law)
A Gulp Workflow for Amazon Lambda
‘any nontrivial development of Lambda functions will require a simple, automated build/deploy process that also fills a couple of Lambda’s gaps such as the use of node modules and environment variables.’ See also https://medium.com/@AdamRNeary/developing-and-testing-amazon-lambda-functions-e590fac85df4#.mz0a4qk3j : ‘I am psyched about Amazon’s new Lambda service for asynchronous task processing, but the ideal development and testing cycle is really left to the engineer. While Amazon provides a web-based console, I prefer an approach that uses Mocha. Below you will find the gritty details using Kinesis events as a sample input.’
(tags: lambda aws services testing deployment ops mocha gulp javascript)
“Hidden Technical Debt in Machine-Learning Systems” [pdf]
Another great paper about from Google, talking about the tradeoffs that must be considered in practice over the long term with running a complex ML system in production.
(tags: technical-debt ml machine-learning ops software production papers pdf google)
Introducing Netty-HTTP from Cask
netty-http library solves [Netty usability issues] by using JAX-RS annotations to build a HTTP path routing layer on top of netty. In addition, the library implements a guava service to manage the HTTP service. netty-http allows users of the library to just focus on writing the business logic in HTTP handlers without having to worry about the complexities of path routing or learning netty pipeline internals to build the HTTP service.
We’ve written something very similar, although I didn’t even bother supporting JAX-RS annotations — just a simple code-level DSL.The Locals Xmas Gift Guide 2015
some nice local gift suggestions from small businesses around Dublin. I’d love to get some of these, but I guess I’ll have to settle for giving them instead ;)
(tags: gifts dublin ireland shopping xmas christmas the-locals)
Topics in High-Performance Messaging
‘We have worked together in the field of high-performance messaging for many years, and in that time, have seen some messaging systems that worked well and some that didn’t. Successful deployment of a messaging system requires background information that is not easily available; most of what we know, we had to learn in the school of hard knocks. To save others a knock or two, we have collected here the essential background information and commentary on some of the issues involved in successful deployments. This information is organized as a series of topics around which there seems to be confusion or uncertainty. Please contact us if you have questions or comments.’
(tags: messaging scalability scaling performance udp tcp protocols multicast latency)
Intercom Engineering Insights – Scale and Reliability 2015
next Intercom hiring^Wevent coming up, Dec 10th in Dublin, talking about how they scale and ops their ElasticSearch and Mongo clusters
(tags: elasticsearch mongodb intercom engineering talks dublin)
Control theory meets machine learning
‘DB: Is there a difference between how control theorists and machine learning researchers think about robustness and error? BR: In machine learning, we almost always model our errors as being random rather than worst-case. In some sense, random errors are actually much more benign than worst-case errors. […] In machine learning, by assuming average-case performance, rather than worst-case, we can design predictive algorithms by averaging out the errors over large data sets. We want to be robust to fluctuations in the data, but only on average. This is much less restrictive than the worst-case restrictions in controls. DB: So control theory is model-based and concerned with worst case. Machine learning is data based and concerned with average case. Is there a middle ground? BR: I think there is! And I think there’s an exciting opportunity here to understand how to combine robust control and reinforcement learning. Being able to build systems from data alone simplifies the engineering process, and has had several recent promising results. Guaranteeing that these systems won’t behave catastrophically will enable us to actually deploy machine learning systems in a variety of applications with major impacts on our lives. It might enable safe autonomous vehicles that can navigate complex terrains. Or could assist us in diagnostics and treatments in health care. There are a lot of exciting possibilities, and that’s why I’m excited about how to find a bridge between these two viewpoints.’
(tags: control-theory interviews machine-learning ml worst-case self-driving-cars cs)
-
This is my bet: the age of dynamic languages is over. There will be no new successful ones. Indeed we have learned a lot from them. We’ve learned that library code should be extendable by the programmer (mixins and meta-programming), that we want to control the structure (macros), that we disdain verbosity. And above all, we’ve learned that we want our languages to be enjoyable. But it’s time to move on. We will see a flourishing of languages that feel like you’re writing in a Clojure, but typed. Included will be a suite of powerful tools that we’ve never seen before, tools so convincing that only ascetics will ignore.
(tags: programming scala clojure coding types strong-types dynamic-languages languages)
-
‘IRC without netsplits’ using Raft consensus
(tags: raft irc netsplits resilience fault-tolerance)
Inside China’s Memefacturing Factories, Where The Hottest New Gadgets Are Made – BuzzFeed News
On a humid afternoon, Zhou went shopping for some of those very parts at a Bao An market. As he pulled his maroon minivan into a crowded parking lot, the full scale of Depu Electronics came into view: a three-story concrete behemoth roughly bigger than a Costco and roughly smaller than the Pentagon. Inside, it looked like the world’s largest Radio Shack going out of business sale: an endless series of booths with cables and circuit boards and plugs and ports and buttons and machines piled so high on tables that the faces of the clerks who were selling them were hidden from view. Each booth seemed to argue: We have exactly what you want and we have enough of it for all of your customers. Short of motorized wheels and molding, the market offered nearly everything an ambitious factory owner would need to build a hoverboard, just waiting to be bought, assembled, and shipped.
(tags: hoverboards memes china manufacturing future gadgets tat bao-an electronics)
One of the Largest Hacks Yet Exposes Data on Hundreds of Thousands of Kids | Motherboard
VTech got hacked, and millions of parents and 200,000 kids had their privacy breached as a result. Bottom line is summed up by this quote from one affected parent:
“Why do you need know my address, why do you need to know all this information just so I can download a couple of free books for my kid on this silly pad thing? Why did they have all this information?”
Quite. Better off simply not to have the data in the first place!(tags: vtech privacy data-protection data hacks)
Senior Anglo bondholders revealed in department note
In case you were wondering who Ireland’s economy was wiped out for:
Among the major holders were a Dutch pension fund, ABP; another Dutch fund, PGGM; LGPI in Finland, which manages local government pensions; and a Swiss public entities pension. A number of major asset managers were also named, including JP Morgan in London; DeKA and ADIG, two German investment managers; and Robeco from the Netherlands. Big insurance companies, including Munich Re, Llmarinen from Finland and German giant Axa were also named, along with big banks such as BNP, SocGen, ING and Deutsche.
(tags: bondholders anglo economy ireland politics eu senior-bondholders)
-
a bunch of metrics for Dublin xmas-shopping capacity
re:Work – The five keys to a successful Google team
We learned that there are five key dynamics that set successful teams apart from other teams at Google: Psychological safety: Can we take risks on this team without feeling insecure or embarrassed? Dependability: Can we count on each other to do high quality work on time? Structure & clarity: Are goals, roles, and execution plans on our team clear? Meaning of work: Are we working on something that is personally important for each of us? Impact of work: Do we fundamentally believe that the work we’re doing matters?
(tags: teams google culture work management productivity hr)
-
75%. This is really quite tricky!
Art Meets Cartography: The 15,000-Year History of a River in Oregon Rendered in Data
this is really beautiful. Available as a printable, 17″ x 38″ PDF from http://www.oregongeology.org/pubs/ll/p-poster-willamette.htm
(tags: art data mapping geodata oregon rivers willamette-river history lidar)
Accretion Disc Series – Clint Fulkerson
available as prints — vector art with a hint of the bacterial
(tags: algorithms art graphics vector bacteria petri-dish clint-fulkerson)
John Nagle on delayed ACKs and his algorithm
love it when things like this show up
(tags: networking performance scalability nagle tcp ip)
-
She thought they were a normal couple until she found a passport in a glovebox – and then her world shattered. Now she is finally getting compensation and a police apology for that surreal, state-sponsored deception. But she still lies awake and wonders: did he ever really love me?
I can’t believe this was going on in the 2000s!(tags: surveillance police uk undercover scandals policing environmentalism greens)
Just use /dev/urandom to generate random numbers
Using SHA-1 [to generate random numbers] in this way, with a random seed and a counter, is just building a (perfectly sound) CSPRNG with, I believe, an 80-bit security level. If you trust the source of the random seed, e.g. /dev/urandom, you may as well just use /dev/urandom itself. If you don’t, you’re already in trouble. And if you somehow need a userspace PRNG, the usual advice about not rolling your own crypto unless you know what you’re doing applies. (Especially for database IDs, the risk of collisions should be considered a security problem, ergo this should be considered crypto, until proven otherwise.) In this case, using BLAKE2 instead of SHA-1 would get you a higher security level and faster hashing. Or, in tptacek’s words: http://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/
(tags: random randomness urandom uuids tptacek hackernews prng)
Authenticated app packages on Sandstorm with PGP and Keybase
Nice approach to package authentication UX using Keybase/PGP.
When you go to install a package, Sandstorm verifies that the package is correctly signed by the Ed25519 key. It looks for a PGP signature in the metadata, and verifies that the PGP-signed assertion is for the correct app ID and the email address specified in the metadata. It queries the Keybase API to see what accounts the packager has proven ownership of, and lists them with their links on the app install page.
(tags: authentication auth packages sandstorm keybase pgp gpg security)
-
Floating car data (FCD), also known as floating cellular data, is a method to determine the traffic speed on the road network. It is based on the collection of localization data, speed, direction of travel and time information from mobile phones in vehicles that are being driven. These data are the essential source for traffic information and for most intelligent transportation systems (ITS). This means that every vehicle with an active mobile phone acts as a sensor for the road network. Based on these data, traffic congestion can be identified, travel times can be calculated, and traffic reports can be rapidly generated. In contrast to traffic cameras, number plate recognition systems, and induction loops embedded in the roadway, no additional hardware on the road network is necessary.
(tags: surveillance cars driving mobile-phones phones travel gsm monitoring anpr alpr traffic)
CiteSeerX — The Confounding Effect of Class Size on the Validity of Object-oriented Metrics
A lovely cite from @conor. Turns out the sheer size of an OO class is itself a solid fault-proneness metric
(tags: metrics coding static-analysis error-detection faults via:conor oo)
How a group of neighbors created their own Internet service | Ars Technica
Orcas Island, WA. impressive stuff
(tags: community diy internet wa wireless networking orcas-island)
Report: Everyone Should Get a Security Freeze
“Whether your personal information has been stolen or not, your best protection against someone opening new credit accounts in your name is the security freeze (also known as the credit freeze), not the often-offered, under-achieving credit monitoring. Paid credit monitoring services in particular are not necessary because federal law requires each of the three major credit bureaus to provide a free credit report every year to all customers who request one. You can use those free reports as a form of do-it-yourself credit monitoring.”
(tags: us credit credit-freeze security phishing brian-krebs)
Even the LastPass Will be Stolen, Deal with It
ugh, quite a long list of LastPass security issues
(tags: lastpass hacking security via:securitay exploits passwords)
Signs Point to Unencrypted Communications Between Terror Suspects
News emerging from Paris — as well as evidence from a Belgian ISIS raid in January — suggests that the ISIS terror networks involved were communicating in the clear, and that the data on their smartphones was not encrypted.
(tags: paris terrorism crypto via:schneier isis smartphones)
Global Continuous Delivery with Spinnaker
Netflix’ CD platform, post-Atlas. looks interesting
(tags: continuous-delivery aws netflix cd devops ops atlas spinnaker)
-
by reordering items to optimize locality. Via aphyr’s dad!
(tags: caches cache-friendly optimization data-locality performance coding algorithms)
Reporting Error Leads To Speculation That Terrorists Used PS4s To Plan Paris Attacks
lol. Nice work, Forbes
(tags: forbes fail ps4 crypto terrorism reporting msm speculation hysteria)
Did you know that Dublin Airport is recording your phone’s data? – Newstalk
Ugh. Queue tracking using secret MAC address tracking in Dublin Airport:
“I think the fundamental issue is one of consent. Dublin Airport have been tracking individual MAC addresses since 2012 and there doesn’t appear to be anywhere in the airport where they warn passengers that this is this occurring. “If they have to signpost CCTV, then mobile phone tracking should at a very minimum be sign-posted for passengers,” he continues.
And how long are MAC addresses retained for, I wonder?(tags: mac-addresses dublin-airport travel privacy surveillance tracking wifi phones cctv consent)
Pinboard on the Next Economy Conference (with tweets)
Maciej Ceglowski went to an O’Reilly SV-boosterish conference and produced these excellent tweets
(tags: twitter conferences oreilly silicon-valley new-economy future lyft uber unions maciej-ceglowski)
Our Generation Ships Will Sink / Boing Boing
Kim Stanley Robinson on the feasibility of interstellar colonization: ‘There is no Planet B! Earth is our only possible home!’
(tags: earth future kim-stanley-robinson sf space)
The impact of Docker containers on the performance of genomic pipelines [PeerJ]
In this paper, we have assessed the impact of Docker containers technology on the performance of genomic pipelines, showing that container “virtualization” has a negligible overhead on pipeline performance when it is composed of medium/long running tasks, which is the most common scenario in computational genomic pipelines. Interestingly for these tasks the observed standard deviation is smaller when running with Docker. This suggests that the execution with containers is more “homogeneous,” presumably due to the isolation provided by the container environment. The performance degradation is more significant for pipelines where most of the tasks have a fine or very fine granularity (a few seconds or milliseconds). In this case, the container instantiation time, though small, cannot be ignored and produces a perceptible loss of performance.
(tags: performance docker ops genomics papers)
Three quarters of cars stolen in France ‘electronically hacked’ – Telegraph
The astonishing figures come two months after computer scientists in the UK warned that thousands of cars – including high-end brands such as Porsches and Maseratis – are at risk of electronic hacking. Their research was suppressed for two years by a court injunction for fear it would help thieves steal vehicles to order. The kit required to carry out such “mouse jacking”, as the French have coined the practice, can be freely purchased on the internet for around £700 and the theft of a range of models can be pulled off “within minutes,” motor experts warn.
(tags: hacking security security-through-obscurity mouse-jacking cars safety theft crime france smart-cars)
-
Awesome new mock DynamoDB implementation:
An implementation of Amazon’s DynamoDB, focussed on correctness and performance, and built on LevelDB (well, @rvagg’s awesome LevelUP to be precise). This project aims to match the live DynamoDB instances as closely as possible (and is tested against them in various regions), including all limits and error messages. Why not Amazon’s DynamoDB Local? Because it’s too buggy! And it differs too much from the live instances in a number of key areas.
We use DynamoDBLocal in our tests — the availability of that tool is one of the key reasons we have adopted Dynamo so heavily, since we can safely test our code properly with it. This looks even better.(tags: dynamodb testing unit-tests integration-testing tests ops dynalite aws leveldb)
Alarm design: From nuclear power to WebOps
Imagine you are an operator in a nuclear power control room. An accident has started to unfold. During the first few minutes, more than 100 alarms go off, and there is no system for suppressing the unimportant signals so that you can concentrate on the significant alarms. Information is not presented clearly; for example, although the pressure and temperature within the reactor coolant system are shown, there is no direct indication that the combination of pressure and temperature mean that the cooling water is turning into steam. There are over 50 alarms lit in the control room, and the computer printer registering alarms is running more than 2 hours behind the events. This was the basic scenario facing the control room operators during the Three Mile Island (TMI) partial nuclear meltdown in 1979. The Report of the President’s Commission stated that, “Overall, little attention had been paid to the interaction between human beings and machines under the rapidly changing and confusing circumstances of an accident” (p. 11). The TMI control room operator on the day, Craig Faust, recalled for the Commission his reaction to the incessant alarms: “I would have liked to have thrown away the alarm panel. It wasn’t giving us any useful information”. It was the first major illustration of the alarm problem, and the accident triggered a flurry of human factors/ergonomics (HF/E) activity.
A familiar topic for this ex-member of the Amazon network monitoring team…(tags: ergonomics human-factors ui ux alarms alerts alerting three-mile-island nuclear-power safety outages ops)
An Analysis of Reshipping Mule Scams
We observed that the vast majority of the re-shipped packages end up in the Moscow, Russia area, and that the goods purchased with stolen credit cards span multiple categories, from expensive electronics such as Apple products, to designer clothes, to DSLR cameras and even weapon accessories. Given the amount of goods shipped by the reshipping mule sites that we analysed, the annual revenue generated from such operations can span between 1.8 and 7.3 million US dollars. The overall losses are much higher though: the online merchant loses an expensive item from its inventory and typically has to refund the owner of the stolen credit card. In addition, the rogue goods typically travel labeled as “second hand goods” and therefore custom taxes are also evaded. Once the items purchased with stolen credit cards reach their destination they will be sold on the black market by cybercriminals. […] When applying for the job, people are usually required to send the operator copies of their ID cards and passport. After they are hired, mules are promised to be paid at the end of their first month of employment. However, from our data it is clear that mules are usually never paid. After their first month expires, they are never contacted back by the operator, who just moves on and hires new mules. In other words, the mules become victims of this scam themselves, by never seeing a penny. Moreover, because they sent copies of their documents to the criminals, mules can potentially become victims of identity theft.
(tags: crime law cybercrime mules shipping-scams identity-theft russia moscow scams papers)
No Harm, No Fowl: Chicken Farm Inappropriate Choice for Data Disposal
That’s a lesson that Spruce Manor Special Care Home in Saskatchewan had to learn the hard way (as surprising as that might sound). As a trustee with custody of personal health information, Spruce Manor was required under section 17(2) of the Saskatchewan Health Information Protection Act to dispose of its patient records in a way that protected patient privacy. So, when Spruce Manor chose a chicken farm for the job, it found itself the subject of an investigation by the Saskatchewan Information and Privacy Commissioner. In what is probably one of the least surprising findings ever, the commissioner wrote in his final report that “I recommend that Spruce Manor […] no longer use [a] chicken farm to destroy records”, and then for good measure added “I find using a chicken farm to destroy records unacceptable.”
(tags: data law privacy funny chickens farming via:pinboard data-protection health medical-records)
Caffeine cache adopts Window TinyLfu eviction policy
‘Caffeine is a Java 8 rewrite of Guava’s cache. In this version we focused on improving the hit rate by evaluating alternatives to the classic least-recenty-used (LRU) eviction policy. In collaboration with researchers at Israel’s Technion, we developed a new algorithm that matches or exceeds the hit rate of the best alternatives (ARC, LIRS). A paper of our work is being prepared for publication.’ Specifically:
W-TinyLfu uses a small admission LRU that evicts to a large Segmented LRU if accepted by the TinyLfu admission policy. TinyLfu relies on a frequency sketch to probabilistically estimate the historic usage of an entry. The window allows the policy to have a high hit rate when entries exhibit a high temporal / low frequency access pattern which would otherwise be rejected. The configuration enables the cache to estimate the frequency and recency of an entry with low overhead. This implementation uses a 4-bit CountMinSketch, growing at 8 bytes per cache entry to be accurate. Unlike ARC and LIRS, this policy does not retain non-resident keys.
(tags: tinylfu caches caching cache-eviction java8 guava caffeine lru count-min sketching algorithms)
-
The ever-shitty Java serialization creates a security hole
(tags: java serialization security exploits jenkins)
-
Danish glassware artist making wonderful Wunderkammers — cabinets of curiosities — entirely from glass. Seeing as one of his works sold for UKP50,000 last year, I suspect these are a bit out of my league, sadly
(tags: art glassware steffen-dam wunderkammers museums)
London garden bridge users to have mobile phone signals tracked
If it goes ahead, people’s progress across the structure would be tracked by monitors detecting the Wi-Fi signals from their phones, which show up the device’s Mac address, or unique identifying code. The Garden Bridge Trust says it will not store any of this data and is only tracking phones to count numbers and prevent overcrowding.
(tags: london surveillance mobile-phones mac-trackers tracking)
Red lines and no-go zones – the coming surveillance debate
The Anderson Report to the House of Lords in the UK on RIPA introduces a concept of a “red line”:
“Firm limits must also be written into the law: not merely safeguards, but red lines that may not be crossed.” … “Some might find comfort in a world in which our every interaction and movement could be recorded, viewed in real time and indefinitely retained for possible future use by the authorities. Crime fighting, security, safety or public health justifications are never hard to find.” [13.19] The Report then gives examples, such as a perpetual video feed from every room in every house, the police undertaking to view the record only on receipt of a complaint; blanket drone-based surveillance; licensed service providers, required as a condition of the licence to retain within the jurisdiction a complete plain-text version of every communication to be made available to the authorities on request; a constant data feed from vehicles, domestic appliances and health-monitoring personal devices; fitting of facial recognition software to every CCTV camera and the insertion of a location-tracking chip under every individual’s skin. It goes on: “The impact of such powers on the innocent could be mitigated by the usual apparatus of safeguards, regulators and Codes of Practice. But a country constructed on such a basis would surely be intolerable to many of its inhabitants. A state that enjoyed all those powers would be truly totalitarian, even if the authorities had the best interests of its people at heart.” [13.20] … “The crucial objection is that of principle. Such a society would have gone beyond Bentham’s Panopticon (whose inmates did not know they were being watched) into a world where constant surveillance was a certainty and quiescence the inevitable result. There must surely come a point (though it comes at different places for different people) where the escalation of intrusive powers becomes too high a price to pay for a safer and more law abiding environment.” [13.21]
(tags: panopticon jeremy-bentham law uk dripa ripa surveillance spying police drones facial-recognition future tracking cctv crime)
Dublin is a medium-density city
Comparable to Copenhagen or Amsterdam, albeit without sufficient cycling/public-transport infrastructural investment
(tags: infrastructure density housing dublin ireland cities travel commuting cycling)
-
I’m tired of this shit. Full stop tired. It’s 2015 and these turds who grope their way around conferences and the like can make allegations like this, get a hand wave and an, “Oh, that’s just crazy Raymond!” Fuck that. Fuck it from here to hell and back. Here’s a man who really hasn’t done anything all that special, is a totally crazy gun-toting misogynist of the highest order and, yet, he remains mostly unchallenged after the tempest dies down, time after time. […] I’m sure ESR will still be haunting conferences when your daughters reach their professional years unless you get serious about outing the assholes like him and making the community a lot less toxic than it is now.?
Amen to that.(tags: esr toxic harassment conferences sexism misogyny culture)
User data plundering by Android and iOS apps is as rampant as you suspected
An app from Drugs.com, meanwhile, sent the medical search terms “herpes” and “interferon” to five domains, including doubleclick.net, googlesyndication.com, intellitxt.com, quantserve.com, and scorecardresearch.com, although those domains didn’t receive other personal information.
(tags: privacy security google tracking mobile phones search pii)
Volkswagen emissions cheating was technical debt
Is this the first case of tech debt costing $18 billion?
“Perhaps the engineers told themselves that the cheat was a stopgap, and they’d address it later. If so, they didn’t.”
(tags: tech-debt vw volkswagen management prioritisation planning)
Nobody Loves Graphite Anymore – VividCortex
Graphite has a place in our current monitoring stack, and together with StatsD will always have a special place in the hearts of DevOps practitioners everywhere, but it’s not representative of state-of-the-art in the last few years. Graphite is where the puck was in 2010. If you’re skating there, you’re missing the benefits of modern monitoring infrastructure. The future I foresee is one where time series capabilities (the raw power needed, which I described in my time series requirements blog post, for example) are within everyone’s reach. That will be considered table stakes, whereas now it’s pretty revolutionary.
Like I’ve been saying — we need Time Series As A Service! This should be undifferentiated heavy lifting.(tags: graphite tsd time-series vividcortex statsd ops monitoring metrics)
-
PICO-8 is a fantasy console for making, sharing and playing tiny games and other computer programs. When you turn it on, the machine greets you with a shell for typing in Lua commands and provides simple built-in tools for creating your own cartridges.
So cute! See also Voxatron, something similar for voxel-oriented 3D gaming Why Static Website Generators Are The Next Big Thing
Now _this_ makes me feel old. Alternative title: “why static website generators have been a good idea since WebMake, 15 years ago”. WebMake does pretty well on the checklist of “key features of the modern static website generator”, which are: 1. Templating (check); 2. Markdown support (well, EtText, which predated Markdown by several years); 3. Metadata (check); and 4. Javascript asset pipeline (didn’t support this one, since complex front-end DHTML JS wasn’t really a thing at the turn of the century. But I would have if it had ;). So I guess I was on the right track!
(tags: web html history webmake static-sites bake-dont-fry site-generators cms)
Food Trucks Are Great Incubators. Why Don’t We Have More?
So is that kind of thriving food-truck scene something the city should work to encourage? Theresa Hernandez, one of the owners of K Chido Mexico, thinks so. “There’s a whole market there for a new culture,” she says. “There’s no doubt about it, the appetite is there. It’s just a matter for somebody who is innovative enough in Dublin City Council to say: ‘Right, let’s do this.’”
Amen to that.wangle/Codel.h at master · facebook/wangle
Facebook’s open-source implementation of the CoDel queue management algorithm applied to server request-handling capacity in their C++ service bootstrap library, Wangle.
(tags: wangle facebook codel services capacity reliability queueing)
-
Despite its overarching abstractions, it is semantically non-uniform and its complicated transaction and job scheduling heuristics ordered around a dependently networked object system create pathological failure cases with little debugging context that would otherwise not necessarily occur on systems with less layers of indirection. The use of bus APIs complicate communication with the service manager and lead to duplication of the object model for little gain. Further, the unit file options often carry implicit state or are not sufficiently expressive. There is an imbalance with regards to features of an eager service manager and that of a lazy loading service manager, having rusty edge cases of both with non-generic, manager-specific facilities. The approach to logging and the circularly dependent architecture seem to imply that lots of prior art has been ignored or understudied.
(tags: analysis systemd linux unix ops init critiques software logging)
-
Great paper from Ben Maurer of Facebook in ACM Queue.
A “move-fast” mentality does not have to be at odds with reliability. To make these philosophies compatible, Facebook’s infrastructure provides safety valves.
This is full of interesting techniques. * Rapidly deployed configuration changes: Make everybody use a common configuration system; Statically validate configuration changes; Run a canary; Hold on to good configurations; Make it easy to revert. * Hard dependencies on core services: Cache data from core services. Provide hardened APIs. Run fire drills. * Increased latency and resource exhaustion: Controlled Delay (based on the anti-bufferbloat CoDel algorithm — this is really cool); Adaptive LIFO (last-in, first-out) for queue busting; Concurrency Control (essentially a form of circuit breaker). * Tools that Help Diagnose Failures: High-Density Dashboards with Cubism (horizon charts); What just changed? * Learning from Failure: the DERP (!) methodology,(tags: ben-maurer facebook reliability algorithms codel circuit-breakers derp failure ops cubism horizon-charts charts dependencies soa microservices uptime deployment configuration change-management)
Tesla Autopilot mode is learning
This is really impressive, but also a little scary. Drivers driving the Tesla Model S are “phoning home” training data as they drive:
A Model S owner by the username Khatsalano kept a count of how many times he had to “rescue” (meaning taking control after an alert) his Model S while using the Autopilot on his daily commute. He counted 6 “rescues” on his first day, by the fourth day of using the system on his 23.5 miles commute, he only had to take control over once. Musk said that Model S owners could add ~1 million miles of new data every day, which is helping the company create “high precision maps”.
Wonder if the data protection/privacy implications have been considered for EU use.(tags: autopilot tesla maps mapping training machine-learning eu privacy data-protection)
-
For requesting a copy of an article that was legally obtained by a colleague from a paywalled source, Pazsowski found himself hit with around US$10,000-worth of damages. This completely disproportionate punishment for what is at most a minor case of copyright infringement is a perfect demonstration of where the anti-circumvention madness leads.
(tags: circumvention tpm copyright paywalls techdirt law canada)
-
Add another one to the “yay for DST” pile. (also yay for AWS using PST/PDT as default internal timezone instead of UTC…)
(tags: utc timezones fail bugs aws aws-cli dst daylight-savings time)
Google Cloud Platform HTTP/HTTPS Load Balancing
GCE’s LB product is pretty nice — HTTP/2 support, and a built-in URL mapping feature (presumably based on how Google approach that problem internally, I understand they take that approach). I’m hoping AWS are taking notes for the next generation of ELB, if that ever happens
(tags: elb gce google load-balancing http https spdy http2 urls request-routing ops architecture cloud)
It’s an Emulator, Not a Petting Zoo: Emu and Lambda
a Lambda emulator in Python, suitable for unit testing lambdas
(tags: lambda aws coding unit-tests dev)
Google tears Symantec a new one on its CA failure
Symantec are getting a crash course in how to conduct an incident post-mortem to boot:
More immediately, we are requesting of Symantec that they further update their public incident report with: A post-mortem analysis that details why they did not detect the additional certificates that we found. Details of each of the failures to uphold the relevant Baseline Requirements and EV Guidelines and what they believe the individual root cause was for each failure. We are also requesting that Symantec provide us with a detailed set of steps they will take to correct and prevent each of the identified failures, as well as a timeline for when they expect to complete such work. Symantec may consider this latter information to be confidential and so we are not requesting that this be made public.
(tags: google symantec ev ssl certificates ca security postmortems ops)
Google is Maven Central’s New Best Friend
google now mirroring Maven Central.
(tags: google maven maven-central jars hosting java packages build)
Apache Kafka, Purgatory, and Hierarchical Timing Wheels
In the new design, we use Hierarchical Timing Wheels for the timeout timer and DelayQueue of timer buckets to advance the clock on demand. Completed requests are removed from the timer queue immediately with O(1) cost. The buckets remain in the delay queue, however, the number of buckets is bounded. And, in a healthy system, most of the requests are satisfied before timeout, and many of the buckets become empty before pulled out of the delay queue. Thus, the timer should rarely have the buckets of the lower interval. The advantage of this design is that the number of requests in the timer queue is the number of pending requests exactly at any time. This allows us to estimate the number of requests need to be purged. We can avoid unnecessary purge operation of the watcher lists. As the result we achieve a higher scalability in terms of request rate with much better CPU usage.
(tags: algorithms timers kafka scheduling timing-wheels delayqueue queueing)
Open-sourcing PalDB, a lightweight companion for storing side data
a new LinkedIn open source data store, for write-once/read-mainly side data, java, Apache licensed. RocksDB discussion: https://www.facebook.com/groups/rocksdb.dev/permalink/834956096602906/
(tags: linkedin open-source storage side-data data config paldb java apache databases)
Twins denied driver’s permit because DMV can’t tell them apart
“The computer can recognize faces, a feature that comes in handy if somebody’s is trying to get an illegal ID. It apparently is not programmed to detect twins.” As Hilary Mason put it: “You do not want to be an edge case in this future we are building.”
(tags: future grim bugs twins edge-cases coding fail dmv software via:hmason)