geographomics

Which generation is this? I live in the UK and I don't see this at all. Some people are dependent on government assistance, but typically with good reason: disability making them unfit for work, high unemployment / economic decline in their area, being too old to work, being a child in a poor family, and so on.

It's not a "leftist idea", it's official UK government policy.

Privacy issues aside - after all, these programmes have scant interest in the average citizen - these look like fascinating projects to work on from a technical point of view, compared to most software development jobs. And it's surely a more ethical pursuit than, say, writing control software for missile targeting systems.

There used to be a rather negligent backdoor in some 3COM products - you could log in with username 'debug' and password 'synnet' to get a full admin shell with extra debugging commands. IIRC it wasn't printed in the user manuals, but was fairly obvious from poking around in the firmware updates. Fortunately the password could be changed, so it wasn't a completely irreparable security hole.

Not exactly what you mentioned, but reminded me of this: https://www.reddit.com/r/glitch_art/comments/1buu5k/this_jpe...

Related to this, an interesting read on the philosophy of embodied cognition: http://plato.stanford.edu/entries/embodied-cognition/

This seems to be the report referred to in the linked article: https://public.gdatasoftware.com/Presse/Publikationen/Malwar...

It would be interesting to try. There's a sequence number in the CTL which could prevent this type of attack, but I don't know if it's actually checked against that which is currently stored.

They are transmitted over an unencrypted channel, but the CTL files themselves (authroot.stl and disallowedcert.stl) are signed by Microsoft so it's fine. Any modification in transit can be detected and presumably will cause them not to be updated.

It can be added to the disallowed certificate store, which takes precedence over any trusted stores.

For example, using the root discussed in the article:

1. Download the root cert from http://ctldl.windowsupdate.com/msdownload/update/v3/static/t... (or save it from the browser's certificate viewer)

2. Open certmgr and import it into 'Untrusted Certificates'.

(This just adds it for the current user's store. Could also import into the computer store by running mmc, adding the Certificates snap-in, and specifying 'Computer account' as the target.)

3. Restart browser. Go to https://certplusrootcag1-test.opentrust.com/ - it should say the certificate is revoked.

This only works for browsers like IE and Chrome, that use the Windows certificate store. Firefox has its own so would have to be done separately.

You can also use certutil to grab all the trusted root certificates from the Windows Update server:

    certutil -generateSSTFromWU roots.sst

Then open roots.sst (which defaults to viewing in certmgr) and it will show the whole lot. Or use certutil -syncWithWU to get all the certs individually.

Alternatively: download http://ctldl.windowsupdate.com/msdownload/update/v3/static/t... [1], extract the authroot.stl file (which is in PKCS#7 format), use 'certutil -dump' to list all the subject key identifiers therein, and then download them from the same location as authrootstl.cab by appending ".crt" to the identifier.

Windows is not lying about anything, you just need to look in the right place.

Also, if you want to examine the CTL list that Windows is currently using - which should be identical to the one above unless it's brand new or there has been a problem downloading it - this will extract it from the registry:

    powershell -Command "[IO.File]::WriteAllBytes('authroot-local.stl',(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate').EncodedCtl)"

Then use 'certinfo -dump' or whatever you like, it's exactly the same format as the downloaded authroot.stl. This is the same registry data that the OP's CTLInfo tool examines.

[1] as specified in https://support.microsoft.com/en-us/kb/2677070

Looks like they've blocked it now. Searching via Google still works though: https://www.google.com/search?q=site%3Agithub.com+inurl%3Aid...

Does it work against intentionally obfuscated binary code? Anti-piracy measures and suchlike.

Just to let you know, as you're using a throwaway account here, the whois information for your domain contains what I assume is your full name, postal address, and email: http://whois.domaintools.com/ladoctura.com

If you wish to mask this from the general public, your registrar has instructions here: https://uk.godaddy.com/help/add-private-registration-420

Perhaps, but it wouldn't be the only UK law to do so, for example section 2 the Criminal Justice Act 1987 requires disclosure to investigations by the Serious Fraud Office, and schedule 7 of the Terrorism Act 2000 also compels the detainee to answer any question asked. Both of these also under penalty of imprisonment and/or fine.

You're correct, I had the "city of London" in mind rather than the "City of London".

According to this writeup, that may be worked around by resetting the device after every few attempts: http://www.zdziarski.com/blog/?p=5106 (penultimate paragraph)

London is huge, there's nowhere near total surveillance. There's an abundance of CCTV in many areas of central London, and throughout the tube network, but it's very patchy elsewhere in the city.

In the UK they've sidestepped this concern by making the refusal to decrypt an imprisonable offence: https://wiki.openrightsgroup.org/wiki/Regulation_of_Investig...

Though of course it doesn't help if the owner of the device is unknown, as alluded to in the linked article.

Useful to know, thanks. I was quite surprised by the furore as in the UK it's typically not deemed quite so offensive.

What a curious turn of events. Is "retard" particularly offensive in some cultures? I wasn't aware it had such inflammatory power behind it.

At its core, this article isn't so much about reddit, rather it's reflecting on the benefits of harm reduction via an altruistic, personal narrative of recovery from opiate dependence. Reddit is just the communications medium.

Not much, according to this article, as there are many firmware blobs that are still entirely opaque: http://blogs.coreboot.org/blog/2015/02/23/the-truth-about-pu...

I also get coredumps from openssl, ssh-keygen, and smtpctl on the first boot. The common factor for all of these is the XGETBV instruction - unfortunately it looks like DigitalOcean's setup of KVM doesn't support it.

This was just on amd64 though - installing OpenBSD for i386 seems to work okay, apart from sometimes hanging on boot (not sure why this is).

I was sent this document a while ago from an acquaintance who dabbles in nootropics; it may be of interest to those looking to try something new: https://bit.ly/1CHzody

Agreed, it's a most frustrating website to use on mobile and tablet. If it helps, here are mirrors of the content:

[pdf] https://bitstampincidentreport.files.wordpress.com/2015/07/2...

[docx] https://bitstampincidentreport.files.wordpress.com/2015/07/2...

Same drugs but with different intent. Assisted suicide is a compassionate medical treatment for end stage incurable diseases, with full consent of the person being treated. Execution by the state is a coercive, non-medical procedure that deliberately causes harm.

Surely that message must be a parody of the overzealous Linux user? I find it hard to believe that the author is serious there.

My university blocks access to sci-hub on the claim that it has previously hosted malware. Apparently it attempted to infiltrate the visiting computer and act as a proxy server and/or grab the user's institutional login credentials, in order to access otherwise pay walled literature. At least, that's what I was told when I complained it was blocked.

Fortunately, they left libgen (http://gen.lib.rus.ec/) unblocked - as they weren't concerned about copyright issues, only malware threats - which has an entire searchable mirror of all papers and books downloaded via sci-hub. It's a fantastic, incredibly useful resource and I hope it continues to operate unscathed.

Could this be worked around by using a pseudonym, registering a PO Box address, and using the number from a pay-as-you-go SIM card? Not false information as such, but not particularly revealing either.

Alternatively, one could enter information that looks plausibly valid but is in fact completely invented. How often does one receive articles in the mail or phone calls to the whois contact points anyway? As far as I've experienced, any communication is to the email address. I suppose it depends what the penalties are if you're somehow found out.