fukusa

But you're talking about government spending (public money) that is a financial disaster. That can't be denied. But that 1100 million Euros in arms sales did not go to the government, it went to the defence industry. Don't you see what's happening? The defence industry is reaping the benefits of the wars while the people suffer (both in Germany because they have to pay for the refugees and wherever the weapons have been used).

All terrorists are humans. That's a correlation just like all terrorists are Muslims. Maybe you should continue narrowing it down to a more specific cause/group instead of spreading this hatred against Muslims in general.

To anybody with basic reasoning capabilities. There are millions of Muslims in France. You could try to make it look like Islam is the cause of all this, but that would be hard to prove.

We're getting close. How many Muslims live in France? How many commit terrorist attacks?

Well if they have reported it, why did it still happen? You are asking me to prove that the NSA hasn't foiled any attacks instead of asking the agency conducting mass surveillance to provide evidence? Just to give you an idea most terrorist attacks on US soil, foiled or not, have been directed by the FBI. Source is The Intercept.

Or could it be that they are just completely desperate brainwashed youth rejected by society? Makes more sense.

So why didn't the NSA report this suspicious activity to the French authorities?

Apple is committed to destroy Google, not to protect user privacy.

Author: GRIFFIN, Richard (LGL/TLU) is all I could find.

Not sure if you're being sarcastic but yes you could apply the same logic to homeless people. But minimal output? You can't prove that.

I guess that makes him human. Or would you settle for the worst paying job with bad career prospects? Because otherwise you'd be guilty of job-hopping. Why are you judging people who are trying to make the most out of life?

AngularJS is maintained by Google.

Not sure if you have ever paid attention to politics but what politicians say is not what they usually do. Especially the claim: "Tax reform that wants to stop corporate inversion and bring money back to USA (Google, Apple, etc.)" is very unlikely as he himself is part of that system and so are his friends and stakeholders.

With all due respect, he is not a hero. He is just the CEO of Apple. And Apple, even though it produces great products, profits from exploiting factory workers in countries where workers have less rights and where labour is cheap. If he was actively fighting this system of exploitation, that would probably make him a hero. Instead, he profits from it. That makes him not a hero but just another businessman. Furthermore, he is defending privacy only because it strengthens his business and weakens that of Google et al.

Would it harm national security if they published a list of former security agency employees who are now employed by the security industry? It think it's safe to assume that a very high percentage of former security agency employees end up working in this industry as it is in their area of expertise and the industry could use their connections to the agencies. With all of this in mind, would it not make sense to assume that the terrorism threat could be highly exaggerated or even fabricated?

You seem to forget that it's a 14 year old kid.

I'm calling bullshit.

Why do they have to call it a human tsunami? It's very disrespectful to the people fleeing from war zones.

I look at it from the following perspective. There are two intertwined economies. The formal economy and the underground economy. Because of the war on drugs, the underground economy is booming. It's counter-intuitive because you'd expect it to shrink because of the war on drugs. Except the war on drugs moved drug trade from the formal economy to the underground economy. Add to that the fact that when drugs became illegal it made them more scarce and as a result more expensive. Most (if not all) incarcerated people took part in this underground economy, willingly or unwillingly, by faith or by choice. Human trafficking, prostitution, drug abuse, and violence are all part of the underground economy and they are increasing because this economy is growing, enabled by the war on drugs.

That's correct. I don't think we should blame the PDF.js devs either.

Thanks, also have a look at: https://news.ycombinator.com/item?id=10047010

The list of affected sites is in the article, the only site that's not mentioned is: http://www.themoscowtimes.com/

It was disguised as an ad, not served through ad networks. In other cases it was disguised as a file from a CDN.

Now that this has been disclosed, one of the affected websites that has not been listed is: http://www.themoscowtimes.com/. I was a victim of the exploit myself, so if you have visited that website before August 8, you might have been as well. The attempt to load a PDF was visible in the browser in 2 ways.

1.) Displaying a message that the PDF may not be displayed correctly, which looked like this: https://support.cdn.mozilla.net/media/uploads/images/2013-03... except for the PDF of course, because it was loaded in a hidden iframe.

2.) In my case the exploit tried to open one of my public keys (with the .pub file extension) but because the browser determined this was an executable file (because of the mime-type) that should not be displayed by the browser it triggered a file dialog asking me to open the file with some other program. This is what alarmed me and that way I discovered this 0-day. I must say however that other versions of the exploit have surfaced that do no longer target the public key file (maybe for this reason?) so the file theft may not be noticed.

Please have a look at the following comments: https://bugzilla.mozilla.org/show_bug.cgi?id=965003#c5 and https://bugzilla.mozilla.org/show_bug.cgi?id=965003#c7

As far as I understand PDF.js used the 'PlayPreview' feature (Playpreview is the overlay you get to see to confirm you want to activate a plugin) as a 'hack' to inject PDF.js HTML content (resource://pdf.js/web/viewer.html) into the page because the plugin architecture was not flexible enough. So, even though technically PlayPreview is not part of PDF.js, the combination of PDF.js and PlayPreview specifically made it possible to inject content into PlayPreview and bypass the CSP.

Update: I played around with the exploit some more to find out what exactly triggered the file dialog. Turns out my OS (Ubuntu 15.04) actually saved me.

When you try to open a file with Firefox it will first try to map the file to a mimetype using the ExternalHelperAppService (https://developer.mozilla.org/en-US/docs/How_Mozilla_determi...). In case a mimetype is found, a file dialog is shown so you can open the file with the right application, in case it is not, the contents of the file will be displayed in the browser. In this case my OS provided the ExternalHelperAppService with a mimetype for one of my public keys with the .pub file extension: application/vnd.ms-publisher. Of course that's not the correct mimetype for the public key file, but that's basically what saved me by showing a file dialog because it found a mimetype. All other files had no file extension so no mimetype was found.

I also discovered that my private keys were all encrypted with a passphrase so even though they have been compromised it was not as bad as I initially believed.

I'm not a security expert. If you have a bug report you'd better report it to Mozilla here: https://bugzilla.mozilla.org/

As far as I understand with this exploit it was only possible to read files, not write to them or compromise the targets in some other way. With that in mind, it makes sense to target keys. Because the keys are an indirect way to compromise new targets.

Done.

It would have stopped it. Js has to be active for the exploit script to run.