mh_

I posted a version of this solution too: https://twitter.com/haroonmeer/status/307473218057433089 :)

Did you read the full article? I'm pretty sure it included incidents documented by the EU where US hacking was aimed at economic benefit.

I'm not sure what you find "fast and loose" with that fact. Stuxnet was claimed by politicians from USA/Israel.

I see lots of Assange dislike from people, and i'm constantly reminded of misappropriated quote: "You want someone who does what i do, but you want him to behave like you."

It takes a certain type of personality (and a certain type of mania/insanity) to run against the odds/world like he did.. We should accept that if it comes with some rough edges, thats kinda the price for it.

Even if there are arguments over wether or not he is "a great man", it is clear that he has achieved great things, and sometimes the people who do also have great flaws..

That question is pretty hard to parse correctly, but if it means: "how do I keep up with all the interesting research out there in my field?" (and if your field == Information Security) then you should look into a subscription to ThinkstScapes (http://thinkst.com/thinkstscapes/)

Agree 100%. In fact in 2010 I wrote a post titled:Cargo Cult startups on exactly this: http://blog.thinkst.com/2010/04/cargo-cult-startups.html

What gets me.. is that i did this poll and it just dropped! http://news.ycombinator.com/item?id=3781723

I mentioned on twitter, that the reason for the big outcry over this, is in part because the employers did it so badly..

ie.. if they built a facebook app that accepted uploaded CV's, they could have sneakily taken this data (like so many other facebook apps) :>

The "hacked in n-minutes" meme around these sorts of contests is really horrible (and needs to die). Researchers work on the exploit for months ahead of time.. The amount of time taken to click "launch exploit" really makes little difference..

You guys should checkout: http://thinkst.com/tools/cr-gpg/ We do the some thing, but hook into the DOM to blend it into the interface. (we have users across win/linux/osx so its been doing pretty well considering its hacky birth)

Nothing to hide, nothing to fear is a pretty well understood fallacy (http://www.computerweekly.com/blogs/the-data-trust-blog/2009...) (which im kinda sad to see on HN).

As for patterns and keywords, your "guarantee" is pretty shallow and baseless. A reasonable time i guess to quote Niemöller: First they came for the communists, and I didn't speak out because I wasn't a communist.

Then they came for the trade unionists, and I didn't speak out because I wasn't a trade unionist.

Then they came for the Jews, and I didn't speak out because I wasn't a Jew.

Then they came for me and there was no one left to speak out for me.

The OP reminds me of O'Reillys 2003 piece (buy where you shop) http://tim.oreilly.com/articles/buy_where_shop.html

In his piece Tim OReilly warned against people who browsed at bookstores, but only shopped online.

I suspect the same is true here.. if you use $service regularly, and $service exists through advertising, then maybe whitelisting their ads is a reasonable trade-off to make..

It's worth checking out how many of Jobs' "failures" eventually came to pass. Crazy ideas like the stability of Unix with an Apple GUI..

Not (intentionally) spammy (or a dupe). The last version lacked auto-update. The new version includes it (and some quick fixes)(including running only on mail.google.com)

The plugin has 2 quick updates: a) It's now site restricted to mail.google.com b) Will make use of chromes update feature in the future.

Please grab the new version from http://thinkst.com/tools/cr-gpg/

-nod- an attack with full access to chromes address space would grab the password in memory.

I'm guessing someone with that sort of threat model isn't using gmail for comms. (I guess even then, it could be useful to verify signatures (when gmail doesn't break the mail) without risking your private key)

Link to the src has been added to the site. (sorry we included it when we mailed the gpg mail list, but didn't add it to the page)

Direct Link: https://github.com/RC1140/cr-gpg

We don't store the password in the DOM. When you choose to sign/encrypt, the password is passed to gpg (via the plugin) and promptly goes out of scope. (It means you have to enter your password every time you want to sign/encrypt, but this seems safer)

Also: > Great leaders are like surfers riding a big wave. > It's easy to get distracted by the surfer and forget that the wave is really the important part.

Erm.. no.. The same wave rolls in for everyone. It's the skilled, hardworking (sometimes lucky) surfer who makes it a world class ride..

Google: skype share options

Agree completely, in fact i've just added this link: http://risky.biz/haroon (Lulzsec, Ranum and I Told You So!)

The logic has flaws indeed. Despite the suggested economic incentive the big companies may have, its also obvious that the big companies are a juicier target, since it is clear that the data collects at those points. This is well understood, and explains why Google was attacked with the now famous Aurora attacks.. The simple truth is that people who care should turn to encryption

OWASP (The Open Web Application Security Project) has a host of resources (local & linked) Try: http://www.owasp.org and: https://www.owasp.org/index.php/Category:OWASP_Java_Project

Related HBGary, Anonymous post: http://news.ycombinator.com/item?id=2311067

(What we learn about Cyber War from the incident)

Checkout http://www.searchlores.org/ Ignore the horrible looking HTML. Fravia+ was a legend in reverse engineering circles and dedicated the last bit of his life to searchlores. There's gold in them thar hills.

Check my comment earlier with shameless self plug for iTried (http://bit.ly/hEDJTw) :)

I just recently submitted an app called iTried to the Mac app store which was kinda built for this (http://bit.ly/hEDJTw)

iTried listens for screensaver stopped events, and then takes the picture. I disabled tweetpic'ing the picture when submitting to the app store, but will re-enable in an update.

I know it's fashionable to hate Calacanis, but must confess to not finding too much wrong with the paragraph. I have worked with quite a few people who wondered "is my name in lights yet?", while wanting work/life balance at the same time. My personal thought on it was: "we are trying to make a dent in the world, and it takes something extra, and you have to really want it, cause it's hard (and tiring), and if you would rather have work/life balance now, then maybe another job would be better".

Moving to an elastic infrastructure in the face of an attack that aims to increase usage, seems like a recipe for a huge bill.. The wikileaks guys are obviously uber smart and have thought through the pros and cons of the move, but it seems an unusual choice..

I blogged earlier this year about companies that try to copy the beanbags, but miss the point (cargo cult startups)

http://blog.thinkst.com/2010/04/cargo-cult-startups.html