[syndicated profile] bruce_schneier_feed

Posted by schneier

This is interesting research::

Whilst the fridge implements SSL, it FAILS to validate SSL certificates, thereby enabling man-in-the-middle attacks against most connections. This includes those made to Google's servers to download Gmail calendar information for the on-screen display.

So, MITM the victim's fridge from next door, or on the road outside and you can potentially steal their Google credentials.

The notable exception to the rule above is when the terminal connects to the update server -- we were able to isolate the URL https://www.samsungotn.net which is the same used by TVs, etc. We generated a set of certificates with the exact same contents as those on the real website (fake server cert + fake CA signing cert) in the hope that the validation was weak but it failed.

The terminal must have a copy of the CA and is making sure that the server's cert is signed against that one. We can't hack this without access to the file system where we could replace the CA it is validating against. Long story short we couldn't intercept communications between the fridge terminal and the update server.

When I think about the security implications of the Internet of things, this is one of my primary worries. As we connect things to each other, vulnerabilities on one of them affect the security of another. And because so many of the things we connect to the Internet will be poorly designed, and low cost, there will be lots of vulnerabilities in them. Expect a lot more of this kind of thing as we move forward.

rfmcdonald: (Default)
[personal profile] rfmcdonald
Over at Reddit's Daystrom Institute forum, one poster made an unsettling post relating to the Fermi paradox in the Star Trek setting.

We know it's possible, even with 21st century technology, to make observations of worlds on the far side of the galaxy. By the 24th century, it would stand to figure that any number of expansive interstellar civilizations, including the Federation, would be able to make far more detailed observations of the galaxy's world and beyond. We also know that any number of devastating events, including the destruction of planets and the detonation of stars, occur with some frequency in the setting. If we can potentially detect catastrophic events like these with foreseeable technology, what about the Star Trek universe? What does knowing of these catastrophes do to even optimists?

[I]t's interesting to consider that a big space faring culture, like the Federation, with its MIDAS Array and all the rest, in addition to spying on questionable Romulans and observing the weirdnesses of negative space wedgies, is also, apparently, receiving a steady static crackle composed of acts of ancient and distant violence, frequently of genocidal proportions. A starship heading into an unexplored sector might not know much beyond the locations of its constituent stars and planets- and that a hundred years ago, there was a fierce exchange of torpedo fire that resulted in the warp core breaches of a dozen ships- a fact made clear when the light from those incidents finally crossed the Federation frontier. A star on the opposing rim of the galaxy goes supernova, and bears the telltale spectral marks of trilithium- what happens to the public mood when the first thing the Federation learns about a distant civilization is that it died badly? Does it further their commitment to peace, when the wages of violence are so apparent across the galaxy? Are they afraid of assailants wholly unknown but for the echoes of their weapons across the ages- echoes that Starfleet might seek to copy, or prepare against, or seek to legislate with its antagonists to ban before they "exist"? What does it mean for a Federation crew to go seeking out what they know to be the graveyard of a species that died to the last soul within hours of each other from mutagenic weapons? Is there a wreath-laying ceremony for the cultures they never got to know, save for their final spectroscopic scream?

My comment there suggested that, perhaps, this might be one critical factor encouraging known civilizations to behave responsibly and not use metaweapons. No one wants their civilization to become a long-range telescopic footnote in some distant civilization's explanation of the Fermi paradox.

(I shudder to think of real-world applications of this.)
turlough: Gerard Way & Bob Bryar, 23 August 2007 ((mcr) bob/gerard were my downfall)
[personal profile] turlough
The more he thought about it, about Bob, the more Gerard was convinced that some of the fucked up shit he thought he'd hallucinated when Bob was teching was real. Like last summer's Warped stopover someplace in Texas, when Bert had sworn to Gerard that 'Bob was breathing fire, Gerard, seriously'.

Or the time in England when Bob'd been arguing with Otter about something stupid and he'd stomped off, smoke from his cigarette trailing behind him.

Except they'd all run out of cigarettes an hour before.

Or when Gerard had been passed out in the van somewhere in the ass end of Germany while everyone else explored the ruins on the other side of the small strip of forest lining the highway. He remembered clawing his way through the darkness in his mind for a moment and rolling his head enough to see the ruins silhouetted against the winter-bright sky through the van window. A flash of something had caught his eye and just for a moment he saw something moving sinuously through the trees.

Something huge.

Something unreal.

He'd closed his eyes and then it was Bob heading towards him, tripping over the exposed roots and slapping at the low-hanging branches. Nothing weird, just Bob.

- [archiveofourown.org profile] carleton97's Crunchy and Taste Good With Ketchup

Things I recently watched and read

Aug. 31st, 2015 09:04 pm
schneefink: River walking among trees, from "Safe" (Default)
[personal profile] schneefink
The Lego Movie: I saw this one on the bus to Prague, and I was surprised how much I enjoyed it. Entertaining and not too stupid.

Student of the Year: [personal profile] tanndell promised a completely over-the-top ~dramatic movie and it did not disappoint. Extreme idfic in movie form. It was entertaining; I'm not sure how much I would have enjoyed it on my own, but with company it was great.

Princess Mononoke: I love "Spirited Away" and I'd been planning to watch Princess Mononoke for years. Unfortunately I didn't like it as much. Spoilers )

The 100, episodes 1-7: I made the tactical mistake to watch them together with DD. On the one hand it's fun to watch it together, on the other hand now it means I have to wait until we both have time to continue… On a related note, it's been almost three months since we last watched Bab5 -.-
I was warned that the first few episodes are less good, so I had low expectations, but I liked them. Episode 7 was the first one that really annoyed me.Spoilers" )

Simon Kirby-Jones mysteries by Dean James: DD recommended these to me as the only vampire books that she likes. They're good 10pm-books: entertaining and very easy to read, I enjoyed them. Spoilers )

Handcuffed to the Bear by Lauren Esker: Supernatural romance, not usually something I look for. Okay, not quite true, I read a lot of it, but usually all fanfic. Because I already know how to find what I want, and it's free and convenient. But this one is by [personal profile] sholio, one of my favorite fic writers who I know writes excellent h/c and lost-in-the-wilderness stories, and she had a promotion, so I decided to check it out despite the to me not at all appealing blurb. (And despite the fact that I don't have a Kindle. I now have a PC app because amazon didn't let me just download the file. Stupid.)
I'm glad I did! The book has the same good stuff I loved in her fic, with a bonus romance that (apart from one moment early on where I couldn't help but think that now was really not the moment to think about her gorgeous eyes) felt quite natural. I liked the worldbuilding, though it does require suspension of disbelief similarly to many urban fantasy books - seriously, shifters have been around for centuries, there's an official government agency even, and the general public doesn't know about them?
She also did a great job introducing the main character for the sequel, and I'm looking forward to that as well.

(no subject)

Aug. 31st, 2015 02:46 pm
twistedchick: mountains, Jackson Brown quote: You do what you can to keep your love alive -- try not to confuse this with what you do  (love alive)
[personal profile] twistedchick
I'm not sure it would be possible to set aside half the earth for rewilding. What about those of us who don't really like living in cities? And where would the food come from?

Religion, racism and the consequences of Republican policies in vivid graphs and maps.

An easy Daily Kos guide to the conservatives in one handy chart.

Oliver Sacks, the doctor.

When Bobby Kennedy was shot at the Ambassador Hotel, where he had just finished making a speech, he walked into the kitchen to greet the people who had cooked the food. He reached out to shake hands with a 17-year-old busboy -- and collapsed into his arms. It has taken decades for Juan Romero to come to terms with holding his dying hero in his arms.

What happened to investigative journalism? It morphed.

let's plant a tree

Aug. 31st, 2015 01:42 pm
sasha_feather: white woman in space suit (Astronaut)
[personal profile] sasha_feather
My breathing was crappy yesterday due to wildfire smoke coming in from the West. The sky was gray and hazy at 5 pm and the sun was orange. Today seems a bit better.

The internet still randomly cuts out on me, but the good news is the upstairs neighbor wants to share so at least it isn't costing us as much.

Trees are being cut down in our neighborhood; I think they are Ash trees, at risk from Emerald Ash borer.

Have a Teen Wolf Rec!

Electricity in the Contact by ladyblahblah

Derek/Stiles, Pretend Relationship, 27K.

One thing I loved about this story is that in their pretend relationship-- which is for the benefit of making Derek appear less vulnerable at a werewolf event-- Derek and Stile have safe words which they use to express their discomfort with something in front of others who are not in the loop. Then they go away in private and discuss the thing. It's a very healthy approach to a pretend relationship! Heh. I loved this story.

Therapy in an hour!

Aug. 31st, 2015 01:32 pm
syntaxofthings: Death Fae from the Fey Tarot (Default)
[personal profile] syntaxofthings
Gott sei Dank.
[syndicated profile] velveteenrabbi_feed

Posted by rbarenblat@gmail.com (Velveteen Rabbi)



We have set up a circle of chairs behind the synagogue, surrounded by mountains and wetland and field. At the beginning of morning prayer the air is chill, but by the time we reach the bar'chu, the formal call to prayer, some of our folks have scooted their chairs into the patch of shade beside the small cement wall. When they turn east, they turn to face the wall -- and suddenly our little cement wall becomes the Kotel, the Western Wall, in Jerusalem. (It even has little finger-sized holes in it where one could place kvitlach, petitionary prayers!) I will never see that wall the same way again.



During the Amidah, the standing prayer which is central to every Jewish service, there is a place (called the Kedusha) where the prayer calls us to imitate the choirs of angels singing "Holy, holy, holy." There is a custom of rising on our tiptoes with every repetition of the word kadosh, holy. As I am singing the Kedusha, a wee plane begins to take off from the tiny North Adams airport in the meadow behind the shul, rising into the sky precisely as we are lifting up onto our tiptoes. It is as though the plane is an angel, being buoyed by our prayers. It is as though we are angels, singing praise up into the sky.



We sing Mi Chamocha -- the prayer which our ancestors sang after crossing the Sea of Reeds -- to the melody of "The Water Is Wide," and we intersperse the Hebrew with the words of that folk song. This is a tradition which Rabbi David brings from his synagogue on City Island, and it has become my favorite way to sing that prayer, especially when we're together and can sing it in harmony. The water is wide; I cannot get o'er. But when I know that God is with me -- when I know that I am loved by an unending love -- then whatever comes, whatever life brings, I know I won't have to cross the waters alone.


bluemeridian: Chloe from Smallville, with coffee and a sideways look. (Default)
[personal profile] bluemeridian
I actually watched the a television episode on live TV, all by myself. *beams* I did realize it's a good thing I haven't been trying to watch Hannibal live all along though as our old TV has gotten so bad about dark scenes that much of the episode was hard to see and the last five minutes were essentially almost all black - the show is dark but it's not that dark. Fortunately, I love a good spoiler and I'd already devoured what'd shown up via the Canadian broadcast, so I knew what was going on besides just the dialogue. The television's days are numbered, though, and I don't just mean because you have to operate it with a pencil if you lose the remote and the converter box (it's doesn't do digital signals on its own) is going to go once and for all at some point.

Wrath of the Lamb Spoilers All the Way Down )

Fic: Hunger Hurts 2/5

Aug. 31st, 2015 06:55 pm
wildestranger: (Default)
[personal profile] wildestranger
I have written another chapter of Hunger Hurts. It only took eight months.

The next one will probably (hopefully) take less.


News Post: Thirty-Seven Hour Energy

Aug. 31st, 2015 04:44 pm
[syndicated profile] pennyarcade_feed
Tycho: I couldn’t get my mouse to work on the desk in the hotel, but I saw a little glossy advertisement for Hiveswap my son had been delighted by, and that is now my Mousepad.  So!  Thank you, Hiveswap, even if I find your subject matter indistinguishable from an lunar apocalypse cult.  I’m still getting used to the idea that there is a post I need to write during the show.  Like crossing the metaphorical streams, trying to stop this hurtling contraption at any point before its conclusion seems like a super bad idea.  That said, there have been three solid days…

Working with the kernel keyring

Aug. 31st, 2015 01:18 pm
[personal profile] mjg59
The Linux kernel keyring is effectively a mechanism to allow shoving blobs of data into the kernel and then setting access controls on them. It's convenient for a couple of reasons: the first is that these blobs are available to the kernel itself (so it can use them for things like NFSv4 authentication or module signing keys), and the second is that once they're locked down there's no way for even root to modify them.

But there's a corner case that can be somewhat confusing here, and it's one that I managed to crash into multiple times when I was implementing some code that works with this. Keys can be "possessed" by a process, and have permissions that are granted to the possessor orthogonally to any permissions granted to the user or group that owns the key. This is important because it allows for the creation of keyrings that are only visible to specific processes - if my userspace keyring manager is using the kernel keyring as a backing store for decrypted material, I don't want any arbitrary process running as me to be able to obtain those keys[1]. As described in keyrings(7), keyrings exist at the session, process and thread levels of granularity.

This is absolutely fine in the normal case, but gets confusing when you start using sudo. sudo by default doesn't create a new login session - when you're working with sudo, you're still working with key posession that's tied to the original user. This makes sense when you consider that you often want applications you run with sudo to have access to the keys that you own, but it becomes a pain when you're trying to work with keys that need to be accessible to a user no matter whether that user owns the login session or not.

I spent a while talking to David Howells about this and he explained the easiest way to handle this. If you do something like the following:
$ sudo keyctl add user testkey testdata @u
a new key will be created and added to UID 0's user keyring (indicated by @u). This is possible because the keyring defaults to 0x3f3f0000 permissions, giving both the possessor and the user read/write access to the keyring. But if you then try to do something like:
$ sudo keyctl setperm 678913344 0x3f3f0000
where 678913344 is the ID of the key we created in the previous command, you'll get permission denied. This is because the default permissions on a key are 0x3f010000, meaning that the possessor has permission to do anything to the key but the user only has permission to view its attributes. The cause of this confusion is that although we have permission to write to UID 0's keyring (because the permissions are 0x3f3f0000), we don't possess it - the only permissions we have for this key are the user ones, and the default state for user permissions on new keys only gives us permission to view the attributes, not change them.

But! There's a way around this. If we instead do:
$ sudo keyctl add user testkey testdata @s
then the key is added to the current session keyring (@s). Because the session keyring belongs to us, we possess any keys within it and so we have permission to modify the permissions further. We can then do:
$ sudo keyctl setperm 678913344 0x3f3f0000
and it works. Hurrah! Except that if we log in as root, we'll be part of another session and won't be able to see that key. Boo. So, after setting the permissions, we should:
$ sudo keyctl link 678913344 @u
which ties it to UID 0's user keyring. Someone who logs in as root will then be able to see the key, as will any processes running as root via sudo. But we probably also want to remove it from the unprivileged user's session keyring, because that's readable/writable by the unprivileged user - they'd be able to revoke the key from underneath us!
$ sudo keyctl unlink 678913344 @s
will achieve this, and now the key is configured appropriately - UID 0 can read, modify and delete the key, other users can't.

This is part of our ongoing work at CoreOS to make rkt more secure. Moving the signing keys into the kernel is the first step towards rkt no longer having to trust the local writable filesystem[2]. Once keys have been enrolled the keyring can be locked down - rkt will then refuse to run any images unless they're signed with one of these keys, and even root will be unable to alter them.

[1] (obviously it should also be impossible to ptrace() my userspace keyring manager)
[2] Part of our Secure Boot work has been the integration of dm-verity into CoreOS. Once deployed this will mean that the /usr partition is cryptographically verified by the kernel at runtime, making it impossible for anybody to modify it underneath the kernel. / remains writable in order to permit local configuration and to act as a data store, and right now rkt stores its trusted keys there.

Rest In Peace, Wes Craven

Aug. 31st, 2015 11:30 am
calliopes_pen: (kcscribbler Holmes Watson travel friends)
[personal profile] calliopes_pen
Wes Craven passed away yesterday, at the age of 76, following a battle with brain cancer. May he rest in peace. Even if I haven’t seen nearly enough of his films, I did enjoy Wes Craven’s New Nightmare (1994), (which, coincidentally, Syfy aired once more this last Saturday) along with The Serpent And The Rainbow (1988). Deadly Friend was weird, but worth watching once I tracked it down. I loved the opening (Drew Barrymore’s scene) of Scream.

In honor of him, I’ll finally get around to watching one of these: The Hills Have Eyes (1977), Deadly Blessing (1981), or Red Eye (2005).
[syndicated profile] smbc_comics_feed

Hovertext: Parsimony is for wimps.

New comic!
Today's News:

 Yes indeed! And we've already sold half the tickets for BAHFest East, so please buy soon to lock a spot!


Aug. 31st, 2015 09:01 am
oracne: turtle (Default)
[personal profile] oracne
This weekend, I succeeded in visiting the hospital, writing a review, and doing laundry. Go me.

NFE is up!

Aug. 31st, 2015 08:30 am
transposable_element: (Default)
[personal profile] transposable_element
First, everybody should go read the story gifted to me:

Ten Lashes (1385 words) by Anonymous
Chapters: 1/1
Fandom: Chronicles of Narnia
Rating: Teen And Up Audiences
Warnings: No Archive Warnings Apply
Characters: Aravis

Aslan gave Aravis ten wounds, one for each of the lashes inflicted upon a slave girl in her childhood home. This is the story of Mufiyah, whose drugged sleep facilitated the young Tarkheena's ride to freedom, and who paid the price for her mistress's escape.


It's harrowing. And really gorgeous.

Also....I have a pretty good idea who wrote it. If I'm right, it explains why she didn't take me up on my offer to beta her story. ;-)

I will no doubt have more recommendations later, after I've read more.

Not tea but linkspam

Aug. 31st, 2015 11:01 pm
vass: Jon Stewart reading a dictionary (books)
[personal profile] vass
A Vegetable Love That Would Certainly Not Suit Me
Oedipus with vegetables: a short (8'33 minutes) movie. Amazing production values. Worth watching the credits to the end. (Content notes: knives, trypophobia, dubious relationship to mythology.)


How To Write A Musical: an interview with Lisa Kron, the lyricist of Fun Home the musical. I just want to hug this quote to myself: "When you’re making a work of art, it feels like it will kill you. It won’t kill you. But you feel like it will."

The Loud Hands Project video. (tw: child abuse, ableism. But that's what what it's about. It's about pride.)

Clippy the Microsoft Office Assistant is the Patriarchy's Fault

In Iraq I Raided Insurgents. In Virginia, the Police Raided Me. (Obviously this is a white guy. You can tell this because he survived to tell the story. Meanwhile here in Australia we have just as much of a black deaths in custody problem as the US, and recently police have been using very strong pepper spray on anti-racist protesters while high-fiving white supremacists at a rally... and then last Friday the Australian Border Force announced they were going to go around Melbourne randomly checking people's visa status. What I'm saying is, current police stuff and its racist and nationalist elements scares me a lot.)

An interview with Miss Major on the Stonewall movie

Words To Live By
Page 64 of Shades After, because I can't stop thinking about what Anwar tells JD here, after they come out to him as genderqueer.

AO3 tag generator. If you're on Tumblr you've probably already seen this, but not everyone's on Tumblr. It randomly generates things people tagged their stories with on Archive Of Our Own.

Corduroy, age 26, is the oldest living cat in the world.


snippy: Lego me holding book (Default)

April 2015

26272829 30  

Most Popular Tags

Style Credit

Expand Cut Tags

No cut tags
Page generated Aug. 31st, 2015 07:44 pm
Powered by Dreamwidth Studios