Puts

Apparently this is 1947-tech: https://en.wikipedia.org/wiki/Laser_microphone

I even remember there where schematics for a laser-microphone circulating on the early 2000s internet that could translate the vibrations of windows into sound.

Has anybody else noticed that when walking in a group of more than 3 you end up in a really uncomfortable tempo? It's like everybody tries to adjust to the slowest, but nobody knows who the slowest is so you end up in a really weird and slow tempo that really no one ever would walk in normally?

I tend to think that this even happens mentally to groups. We start to think slower when we are in a group of other people. I guess this is why discussions on social events also ends up on subjects like celebrities and sports rather than abstract philosophical topics.

I think the use of stored procedures is underrated. Create a stored procedure to verify the password and only grant permission for the web application-user to run this procedure, nothing more. No one but the database itself needs, or can ever access the hash-column this way. This way you still keep the application separate from the data. I would even argue that we need to get back to the time where there was a DBA handling the data. The dev-ops thinking of mixing application logic and data has introduced a lot of unnecessary security issues.

If you let Github become a single point of failure, maybe you are using git wrong? It's named "Distributed version-control" for a reason. I can really recommend this talk by Linus Torvalds about how git is more of a way of working than a piece of software: https://www.youtube.com/watch?v=4XpnKHJAok8

It's actually interesting that a lot of countries has laws regulating gambling because of how destructive it can be for an individuals economy, life and general health. Yet, it's still possible for rich people to gamble using thousands of peoples homes and jobs as insert on the stock-market.

If she had 30-40 insurance policies as it says in the article, maybe she was able to get each ticket refunded 30-40 times? And then did this with each of her 20 identities.

Maybe depends on how you define safest. Where I live in Sweden, there are parts of the country where it's still not safe to hunt and eat wild boar because of a nuclear accident over 30 years ago 3000 kilometers away.

If you just divide the number of meltdowns (5) with the number of active power reactors in the world (449) we learn that statistically 1% of reactors will have a core meltdown.

https://en.wikipedia.org/wiki/List_of_nuclear_power_accident...

Some more shadiness from this company. The Zoom.us-website is explicitly allowing the browser with its content security policy-headers to load scripts from these domains:

https://*.50million.club

https://apiurl.org

https://secure.myshopcouponmac.com

https://serve2.cheqzone.com

https://ad.lkqd.net

Doing a fast google for these domains shows they are mostly known for being associated with malware...

Might be something in to this. My mind always feels refreshed by a good thunderstorm.

The why I think is quite clear from an evolutionary standpoint. Whithout self consciousness all our actions would only be triggered by surrounding events, hungry - eat, tired - sleep and so on. But with the ability to reason about our self we can for example find and cure diseases long before we feel any pain which is an evolutionary benefit.

We are heading into an interesting future. The NSO Groups biggest owner Francisco Partners has both Software and Semiconductor companies in its portfolio, like Dell Software. Should I be worried about the firmware in my Dell computer? When everything becomes entangled like this it's impossible to know who to trust. And in the end it doesn't really matter what intent you have if people don't trust you.

But as it is now the Economy class tickets are a fourth of the price of the business class, and the only thing you get is more of everything. Where is the alternative to pay 25% more for the ticket, yet skip the extra stuff, but just get a nicer smoother experience?

Why is it in all these stories about people being detained by law enforcement or border security that any questions about whats happening are just being ignored. I almost get the feeling that they willfully want to make people uneasy. Anyone can see that if you make people feel helpless in this way it's the prefect recipe for panic.

Maybe looking for the reason we sleep is the wrong way to look at it? What if being asleep is the default state for any organism?

Sleeping require much less energy. The only reason to be awake is to eat and reproduce. For any animal there is probably an optimal ratio between sleep and hunt/reproduction where sleep is the most favorable.

> Remember that SSL encrypts network traffic, but does not supply authentication. SSL is also not a replacement for 2FA.

False and false.

Could this be a reason people don't trust "experts" any more?

http://www.forbes.com/sites/davidthier/2012/07/18/how-this-g...

Related TED talk: https://www.youtube.com/watch?v=e2Zq2VWvmW4

Wait? Didn't I see this exact same thing in 2005?

https://www.theguardian.com/science/2005/feb/24/5

What happened to VIA and their x86 CPUs and mini-itx platform people used to build media PCs on? Wouldn't that be a viable option if you really want to avoid ME?

First of all, this pattern is not exclusive to password hashes. There are lots of situation when handling customer data where you simply don't need the ability for the client to query the whole data-set, and if that's the case, allowing it is just bad hygiene.

Now if you make a good set of prepared statements as an interface for your database, this could be viewed as a "micro service" in it self.

I think this talk misses one of the most important security patterns of PostgreSQL and SQL-databases in general. If you for example have a table with hashed passwords. Why would any user except admin need to be able to make a select on that table? Make a function to validate the user and only grant permission to run this function.

I'm kind of tired of the "Security is hard, every one gets hacked eventually and we are just victims" mentality. This is not true. Why don't we see peoples banking information plastered over the web every month? That if something would be a high value target. No, it's always these Web 2.0 services this happens to. Now, you could argue that a small SAAS service can not possibly afford security as rigorous as a bank, but guess what, if you are going to handle peoples information, and don't have the assets to protect it, then maybe your business is not viable enough?

"we've always taken security very seriously since day 1"

No you have not because then this would not have happened. The only one who should be able to query passwords from the database should be the DBA. Everyone else should only be able to validate against it. So either it's an inside job by your DBA, or you thought your users security was less important then avoiding the friction such high security standards would have introduced in your workflow.

> Nobody ever outsources Profit Centers.

The ironic part is that for every engineer being outsourced there's a new project manager being hired. And managers aren't any profit centers either. So why is this then?

I sincerely do believe that as technology has become more accessible and more "normal" people get into the industry, this has lead to things being more about politics and less about solving problems. Sometimes I even think that ordinary people like arguing and drama and willingly misunderstands each other just to not get bored. True aspie-nerds don't need this, they have other interesting things to fill their head with.

When you hear about someone jail breaking an iphone trough the browser, this is how. The fact that the browser works as a window to all tcp-sockets running on a device, it's the perfect way to exploit buffert overflows on a device that lacks a terminal.

Also remember this with all your IoT appliances running on your local network. Even if it has a local IP-address, as long as you have a computer with a browser on the same network, you might as well consider your devices being publicly accessible from the rest of the internet.

It's not a security hole and it's not a bug. Wget even prints out all the things that are happening. Everybody seems to be grasping at straws right now just to be able to make the next branded vulnerability.

A lot of times IoT is just a remote control. Bluetooth would be perfectly fine for this, instead of adding WiFi-access points to everything.

Targeting is very much possible, just as with magazines. If you have a recipes site you could have ads for kitchen tools. If you have a music site you have ads for local events. If you have lifestyle magazine you have clothing and interior ads. I would even go as far and say that this type of targeting is better then now when you go to a webshop, search for a product and suddenly starts seeing that product plastered all over the web, often even after you actually already bought the freaking product.

Yes, the vetting part is also important. As it is now renowned newspapers are serving ads that are border fraudulent, and I don't really understand how they are putting their reputation at risk this way by letting third parties publish non-vetted content on their site.

It's strange that the most simple and elegant solution to ad-blocking, self hosted ads are not considered by anyone. Magazines and papers have always done this in print. Yes there is overhead, because you have to handle the content manually and it's hard, even tough not impossible to measure impressions. But with print it's always been this way and now the media industry wants to both have the cake and eat it, because they don't want to handle ads but they want the revenue.

And maybe I should clarify, how does self-hosted ads solve the problem?

- It's hard to block ads on the same domain as the main content.

- Just loading an image with an ad is not as much of an performance hit as javascript loaded tracking ads and thus should not annoy users as much.

- More secure, because you can not hack one single ad service and distribute mallware to thousands of sites. Besides, the solution is less complex, and complexity always leads to bad security.