JimmaDaRustla

Didn't it land, then fall over and explode?

Also, didn't this portion of the rocket land before the satellite was deployed?

Wow, thanks for this!

I currently have 100gb of photos on Glacier. I am going to be finding another hosting provider now.

I came here to ask exactly this, and also why this feature isn't documented. Sounds like a nice little exploit.

There is a sentinel character on the mag stripe which identifies the card as chip and pin. As mentioned in the README of this repo, it can be disabled - for the purposes of backwards compatibility, this is a necessary evil.

Fortunately, it is easy to detect! The terminal will send the magstripe data online when authorizing the transaction, and the backend systems will identify the corruption in magstripe data and identify it as fraud.

It mentions "disabling chip and pin", meaning it will convert the sentinel character on the magnetic stripe which tells the terminal that it is a chip card. By disabling the sentinel character and using this on a chip enabled terminal, the financial institute (BASE24) SHOULD decline the transaction because the Track 2 data will be incorrect.

Edit: I meant on an EMV compliant terminal.

Edit: Also, that is considered fraud and your best not testing it, unless you like the prison environment.

  couple of countermeasures

In CDA, the responses are encrypted by the card, which means a they can no longer be spoofed.

The only lingering possibility of this type of attack occurring is in regions where offline transactions are still permitted, and if you can find a terminal which still does not have CDA capabilities or if you have a card which doesn't have CDA. Totally possible, but the opportunities are diminishing rapidly as the issued has been RESOLVED.

Edit: Found a decent write up on the CDA differences over DDA: http://www.infonomics-society.org/IJICR/Fraud%20Reduction%20...

The CDA cards have this advantage over the DDA cards, in that the message signed by the ICC which includes an additional Application Cryptogram (AC), which is used to protect and validate the specific transaction messages (amount, time, etc) generated during the transaction. The ICC uses the AC Session Keys (derived from the ICC AC Master Key, shared only between the ICC and the card issuer) to place this MAC on the transaction details.

Well, this article only applies to point of sale transactions, so it is either online or offline.

Offline transaction, meaning "authorized within the acquirer domain (at acceptance device, or at the acquirer host)". In other words, the transaction does not hit the issuer's system.

Edit: Even in an online transaction, offline pin is still performed, but the online would fail.

This is technically old news - as the article states, it has since been resolved. Edit: I guess they're shedding new light on how they performed the hack.

Another thing, in context of USA, is that the authentication being done isn't much of a vulnerability as this only applies to offline chip transactions. In the USA (I believe) and here in Canada, all transactions are online, which means the pin will be rejected by your financial institute's back end systems in these scenarios.

These types of hacks have since been corrected using what is called CDA (Combined Data Authentication). Blurb on SDA/DDA/CDA here: http://www.cryptomathic.com/hubfs/docs/cryptomathic_white_pa...

Edit: Many Canadian financial institutes still use the weakest data authentication (SDA) because all transactions go online - spoofing a card PIN verification response doesn't fool the back-end system. Visa and Mastercard both have mandates to have newly issued cards be provisioned on chips with CDA (I believe, could be DDA which would still be susceptible to this attack).

Edit 2: When I say "offline", I mean at a point of sale machine - the POS does not reach out to the payment network to perform an "online" transaction where the PIN and card are validated by the back-end systems.

Edit 3: The article doesn't give EMVCo any credit for actually solving the issue before any real world hack was known to exist.

Um...so you have a choice and lower price point?

Edit: The phone comes with both the charger you linked, and a type-c to type-c cable. No type-c to type-a cable however.

Mediocre phones today should be better than mediocre phones from two years ago.

Canadian prices suck, they're higher than what our terrible exchange rate equates to when compared to USD prices. Also sounds like they're going to be locked to carriers? Nexus phones aren't the easy choice anymore.

"signs of life" versus "life", big difference.

Windows 7 was the turning point I remember, when Gates came back to make up for Vista and they took every piece of feedback possible.

Ya, I don't know what he is talking about either...Office has always had complete and fully functional features in every release - you never got a product which didn't have features of it's predecessor (maybe aside clipart/wordart or gimmicky stuff like that), nor partially implemented features.

Exactly.

I made some ignorant comments about the legitimacy of how much pollution is actually caused by these cars considering "tailpipe" emissions tests are a thing where the test is segregated from the car's computer system entirely, and we haven't heard much about these types of tests failing.

The real question I have is, if the vehicles are actually producing less emissions during the test, how come they can't use the same method to produce less emissions during normal operation? If the "defeat device" had some adverse effects on the car's operation, which I imagine it does, I would also think that it would be apparent when running the test. "Sounds like this car is running on 2 cylinders at 75 RPM..."

Edit: I'm just going to wait for the videos, someone will eventually detail what's going on.

In Canada, we used to only ever do tailpipe tests, meaning a defeat device wouldn't be able to fool the testing. Apparently I'm wrong though - turns out Canada doesn't do tailpipe tests on cars newer than 1998 (this is news to me), meaning the defeat device is the exact reason why I hadn't heard about any cases of cars failing the emissions test.

I was speaking in terms of Canadian testing. Turns out, I was still wrong - I assumed Canada was strictly performing tailpipe tests, not ODB instrument testing. Turns out they don't do tailpipe tests on cars newer than 1998 (this is news to me), meaning the defeat device is the exact reason why I hadn't heard about any cases of cars failing the emissions test.

There have been zero reports, that I'm aware of, that any of these cars would have failed the emissions test without the "defeat device". Still waiting to hear.

Edit: Easy guys, in Canada there is no known impact yet as it is being investigated. I forgot I was on the internet where everyone keeps their pitchforks in their back pocket. http://www.cbc.ca/news/business/volkswagen-emissions-rigging...

We do ACTUAL emissions tests in Canada (Ontario at least) - it sounds like USA is different in how it works (probably differs by state?), but we have machines to actually grade pollution. The 2009 model VWs will be emissiosn tested this year as they are 7 years old, so why this hasn't been news yet in Canada is very interesting, which is why I say I'm waiting to hear how all of these cars fair in upcoming tests. http://www.ontario.ca/page/drive-clean

Edit 2: I'm wrong, we don't do tailpipe emissions test on cars newer than 1998! So the defeat device is the exact reason why I hadn't heard about any vehicles actually failing emissions testing here.

Lately? Like, as in like, since their inception?

I'm sorry, why did the most ignorant thing here "had to be said"?

https://fixubuntu.com/

Now we need instructions for iOS and Android...No clue about OSX though.

Ubuntu uses aptitude and will prompt you when there are conflicting files and creates .dpkg-new for diffing: https://raphaelhertzog.com/2010/09/21/debian-conffile-config...

Arch (pacman) creates .pacnew files for diffing later.

RPM creates .rpmnew files, not sure if you're prompted or not at the time of updating.

Some of those look like they'd be used to upgrade to Win10? Compatibility checking, diagnostics, etc.

Nothing seems malicious, but you never know.

The backlash is a bit of an overreaction, although justified due to the lack of total transparency of what's being sent. This is no different than any other cloud oriented services offered by Google/Apple, etc. Edit: blog.laptopmag.com/windows-10-privacy-issues-exaggerated

The phoning home isn't new, is it? Licensing validation was done every few months on Windows 7.

The only thing Microsoft is guilty of SO FAR that I'm aware of, is providing slightly better transparency over the data it sends to its' and third parties' servers, and now they're getting called out for it.

True. I don't use Edge, and have disabled Flash as well.

When I updated to Win10, I decided to never install Flash on the fresh install. So far so good, any site still requiring flash is now behind the times.

Win10 is working great on my gaming machine, pretty big improvement over Win7 in terms of performance so far.

When I read the #1 comment here by someone I can't depict other than George Orwell himself, I started shouting "THE SKY IS FALLING! THE SKY IS FALLING!"

The situation that illegal torrent sites are ambiguously banning Windows 10 users?

What kind of response do you expect from them?

Don't forget, system updating typically isn't straight forward depending on distro. I was explaining to my brother the other day the need to perform diffs on system configuration files after performing a system update. His eyes kind of glazed over as his brain understood the concept, but refused to accept that major linux distros hadn't evolved past it.

I use 10 at home, works perfect. Some people have issues with GPU driver support (old Nvidia card in my bro's case), and 100% cpu issue, also sounded like driver/software related.

I wouldn't update on a work machine however - no need to put your time at risk.