realkitkat

Well, that makes up for an interesting ransomware - you have 48h to pay up 4 btc or your shiny new mbp hardware will get borked.

Same here. Working / easy screen sharing is what I need. And would be happy to switch from Webex / GTM / others to here if that were to work. Nice job otherwise!

Out of curiosity, why is this called Blacknurse? I couldn't make a connection from ICMP Destination Unreachable / port unreachable packet to the BlackNurse? (not that it matters, I am merely curious).

Also - PoC is for IPv4; does anyone know if systems fail in a similar manner if ICMP6 Destination Unreachable / Port unreachable (ICMP6 T:3, C:4) is being used? (https://tools.ietf.org/html/rfc4443#section-3.1)

If JSON is comparable to minefield, then I guess XML and ASN.1 are nothing short of nuclear Armageddon in complexity and ones ability to shoot themselves into the leg ;-)

#FirstJobsMatter! Based on my subjective, statistically unsound observations, when it comes to bad, obnoxious, and intimidating work place behavior there are people who cannot be helped and are equal opportunity offenders, and then the vast majority who appear to have picked up poor behavioral habits from their old bosses, peers and companies that they were unlucky to be associated with early on in their careers. I would assert that very few of us are resilient enough to truly differentiate between good or bad workplace behavior [in an early stages] of our careers - especially when you scored a job in one of the many respected companies with a track record of success. No matter how toxic the culture - it must be right since company is doing good, right? And then as we move forward in our careers we take these ‘learnings’ with us. As a recent observation, this seems to apply to all phases of peoples careers where I witnessed an outstanding R&D manager / director turned into monstrous VP, who in reflection is just putting into action same management practices that were used by a pre-acquisition start up CEO he used to work for. And then of course there are those golden people that really make it worthwhile to come to the office and that you just love working with/for - sort of like the project lead described in the story here.

Although it does mention some risks of using 3rd party code/components in passing under 'Understanding and Controlling Dependencies' (835-), I would have expected them to make a stronger case for OWASP 2013-TOP10-A09: 'using components with known vulnerabilities'[1] type of analysis. This applies to almost any kind of modern application, not just web apps, but especially to those written in native languages (C/C++/...) as we increasingly build our applications by bringing in varying amounts of 3rd party code; open source or commercial. Like traditional static code analysis, more or less mature tooling exists in open source[2][3][4] and commercial capacity to perform static binary and source code analysis to discover and track 'offending' 3rd party code, which does make it practical to include this kind of analysis to sdl/sdlc/devops workflows.

[1] https://www.owasp.org/index.php/Top_10_2013-A9-Using_Compone... [2] http://www.binaryanalysis.org/en/home [3] https://www.owasp.org/index.php/OWASP_Dependency_Check [4] https://github.com/OWASP/SafeNuGet

There are similar (research) projects going on in Europe as well. One in Finland is also drilling to get about 4 miles deep[1]. I believe some recent news (that I couldn't find) have said that the project has been progressing ok.

URL: http://www.st1.eu/news/st1s-geothermal-heating-project-appro...

Oldie but goodie - Robert Heinleins 'Moon is a harsh mistress' gives anyone interested a nice introduction into coups, cells and other things conspiracy.

DayDream BBS used to have a copy protection mechanism where when it detected being a pirated copy, it silently enabled 'shell' command for all the BBS users. I imagine that gave a pause to a few Sysops! :)

AFL for Windows: https://github.com/ivanfratric/winafl

>> DB is completely freeware it will stay freeware forever.

Thank You! :) And special Kudos for a nice and clean API and not going with [ horrors such as ] SCAP[1]. Will most certainly give it a go!

[1] http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublic...

This looks really nice service! Couple of questions that I couldn't find answer from the website: 1) who is behind this(e.g. will it be around in few years if I implement some of their APIs now)? And 2) what's the license for using APIs and data? (e.g. is it free for what ever, or do you need commercial license for certain uses)?

Any discussion about Green Cards or permanent US residency should always mention eventual exit tax[1]: "...to deter tax avoidance by abandonment of citizenship, the United States imposes an expatriation tax on some of those who give up U.S. citizenship. The tax also applies to green-card holders who abandon U.S. residency after having held a green card for at least 8 of the last 15 tax years."

[1] https://en.wikipedia.org/wiki/Expatriation_tax#United_States

Ditto. If only we could next rationalize and overhaul our property tax system / prop-13[1] of 1978. Then we might have a fighting chance of [ more ] affordable housing.

Maybe instead of paying linear tax based on purchase price, we could implement a reverse logarithmic scale for property tax % based on state / national / something average sales prices / sqft that would be re-assessed yearly. And then either apply that to all new home purchases, and when enacted, allow existing home owners to opt-in ( recent buyers ), or opt-out.

[1] http://www.californiataxdata.com/pdf/Prop13.pdf

7-zips track record of lack of vulnerabilities [1] would imply something entirely different to me. Only 2 CVEs ( and now this ) in a heck of a long time. 7z being used in quite a variety of places it seems like a lucrative attack vector, so I would expect that ample amount of fuzzing and other techniques has gone into trying to break it over the years. Which obviously doesn't mean, as these findings highlight, that it would be in any way infallible either. But to say they don't take security seriously sounds little unfair to me.

[1] https://www.cvedetails.com/vulnerability-list/vendor_id-9220...

URL: https://ahmia.fi/

There are search engine(s) specialized for TOR. As per Wikipedia[1]: 'Ahmia is a clearnet search engine for Tor's hidden services'. It was part of Google summer of code in 2014[2].

[1] https://en.wikipedia.org/wiki/Ahmia [2] https://blog.torproject.org/category/tags/gsoc-2014

Just a thoight, but in all likelihood it will be the exact opposite. With the eventual proliferation of functional VR tech that is available for everyone, we're likely to see every surface turn into an advertisement space. Every surface being re-painted in interior designs, and other content from the future VR advertisement conglomerates. Thus, with adblocked augmented reality, we may indeed be looking at a dystopian future of a world of plain and clean [morphing] surfaces that only exist to be augmented.

Here are some example cases that have ended up to courts of law [linksys][busybox][fortinet][vmware]. [linksys] http://tinyurl.com/l9zd7qo [busybox] http://arstechnica.com/information-technology/2010/08/court-... [fortinet] http://gpl-violations.org/news/20050414-fortinet/ [vmware] https://sfconservancy.org/copyleft-compliance/vmware-lawsuit...

This. But then again, when you join a VC funded start-up, end game should be pretty obvious.

+1. I am a willing test subject. where do I sign-up? That said - given the cost of living here in CA, I would assume that in the eventuality of becoming unemployed for an extended period of time, I couldn't support myself with the basic income only and would need to look into moving to some less expensive areas. In fact, this is what was suggested in some discussion ( couldn't find a link ) I remember reading relative to Finnish basic income experiment cited in some posts here. E.g. unless basic income would vary based on cost of living in your region, it would effectively result as people relying solely on it having to abandon living in more expensive cities and areas. Which seemingly is a notion few politicians would want to put forward when introducing basic income. But when you introduce regional differences in level of income, you open a can of worms that seemingly leads to all kinds of potential abuse, managing which then prevents dismantling of bureaucracy that was the whole idea to begin with.

And what guarantees we have that when they ( or any number of other OSS vendors ) include OpenSSH into their product, it isn't some boopytrapped variant? Oh wait, it's open source, so we can go and find out? Anyone?