Administrator
|
Worth knowing about:
Pretty serious crypto flaw. -- Owen ============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
So the folks who compromised your home router are looking forward to
quite a harvest when you upgrade all your passwords at once,
including those you don't normally use.
Herding buffalo towards the cliff. On 4/9/14, 9:23 PM, Owen Densmore
wrote:
============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
Administrator
|
For those of us using Twitter, #Heartbleed is getting heavy use, and oddly, there are some good conversations.
On Wed, Apr 9, 2014 at 10:10 PM, Carl Tollander <[hidden email]> wrote:
============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
In reply to this post by Owen Densmore
It is a major PITA. Certificates on affected servers (which include
Amazon EC2 Linus servers) may have had their private keys exposed, so certificates have to be reissued with different keys. This is, apparently, a major bottleneck. —Barry On 9 Apr 2014, at 21:23, Owen Densmore wrote: > Worth knowing about: > > http://www.washingtonpost.com/news/morning-mix/wp/2014/04/09/major-bug-called-heartbleed-exposes-data-across-the-internet/ > > Pretty serious crypto flaw. > > [image: Inline image 1] > -- Owen > > [image.png] > ============================================================ > FRIAM Applied Complexity Group listserv > Meets Fridays 9a-11:30 at cafe at St. John's College > to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com ============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
Administrator
|
Hi Barry. How would the private keys be exposed? The pub/priv computation is done locally, right?
BTW: All node servers are secure due to their ssl config turning off the "heartbeat" option. NodeWeekly:
-- Owen
On Thu, Apr 10, 2014 at 9:51 AM, Barry MacKichan <[hidden email]> wrote: It is a major PITA. Certificates on affected servers (which include Amazon EC2 Linus servers) may have had their private keys exposed, so certificates have to be reissued with different keys. This is, apparently, a major bottleneck. ============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
Administrator
|
Fairly useful scanner software created to test for vulnerability. -- Owen On Thu, Apr 10, 2014 at 10:05 AM, Owen Densmore <[hidden email]> wrote:
============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
In reply to this post by Barry MacKichan
And some fundamental "truths" about
information entropy are even being questioned:
http://newsoffice.mit.edu/2013/encryption-is-less-secure-than-we-thought-0814And a "new" method offered for generating keys which is reputed to not be vulnerable to brute-force attacks, based on coupled systems: http://journals.aps.org/prx/abstract/10.1103/PhysRevX.4.011026 It is a major PITA. Certificates on affected servers (which include Amazon EC2 Linus servers) may have had their private keys exposed, so certificates have to be reissued with different keys. This is, apparently, a major bottleneck. ============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
In reply to this post by Owen Densmore
according to —joshua On Apr 10, 2014, at 10:05 AM, Owen Densmore <[hidden email]> wrote:
============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
Yes. That is my understanding.
We could put our web store back on line with the old certificate, but it is theoretically possible* that someone has been able to find the private key. Right now, we are playing it safe. It it takes several days for our re-issued certificate to get signed, well... —Barry *But unlikely considering that any hackers have several million other honeypots to hack. On 10 Apr 2014, at 10:20, Joshua Thorp wrote: > according to > [https://www.schneier.com/blog/archives/2014/04/heartbleed.html](https://www.schneier.com/blog/archives/2014/04/heartbleed.html) > [http://security.stackexchange.com/questions/55382/heartbleed-read-only-the-next-64k-and-hyping-the-threat](http://security.stackexchange.com/questions/55382/heartbleed-read-only-the-next-64k-and-hyping-the-threat) > > > apparently the bug gives access to 64K chunk of ram on the server. > The private key might be in that chunk, but probably won’t be… > however you will get different chunks over time so if you wait long > enough you might end up with a chunk that has a private key or > someone’s password. > > > —joshua > > > On Apr 10, 2014, at 10:05 AM, Owen Densmore > <[[hidden email]](mailto:[hidden email])> wrote: > >> Hi Barry. How would the private keys be exposed? The pub/priv >> computation is done locally, right? ============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
In reply to this post by Owen Densmore
http://filippo.io/Heartbleed/ has been invaluable.
—Barry Our vulnerable servers are all Linux Drupal machines on Amazon's EC2. On 10 Apr 2014, at 10:12, Owen Densmore wrote: > Fairly useful scanner software created to test for vulnerability. > [https://github.com/musalbas/heartbleed-masstest/blob/master/top10000.txt](https://github.com/musalbas/heartbleed-masstest/blob/master/top10000.txt) > > > > -- Owen ============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
In reply to this post by Owen Densmore
Of course, after our certificate is renewed, we will need to revoke our
current certificate. See this link for some of the consequences of having millions of certificates revoked at the same time: http://arstechnica.com/security/2014/04/critical-crypto-bug-exposes-yahoo-mail-passwords-russian-roulette-style/?comments=1&post=26612193#comment-26612193 —Barry ============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
Administrator
|
In reply to this post by joshua@stigmergic.net
The follow-on links are pretty good too. -- Owen On Thu, Apr 10, 2014 at 10:20 AM, Joshua Thorp <[hidden email]> wrote:
============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
Is now a bad time to sugest this might be a 'internet wargames test'? On Thu, Apr 10, 2014 at 10:47 AM, Owen Densmore <[hidden email]> wrote:
============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
In reply to this post by joshua@stigmergic.net
On Thu, 2014-04-10 at 10:20 -0600, Joshua Thorp wrote:
> according to > https://www.schneier.com/blog/archives/2014/04/heartbleed.html > http://security.stackexchange.com/questions/55382/heartbleed-read-only-the-next-64k-and-hyping-the-threat > > > apparently the bug gives access to 64K chunk of ram on the server. > The private key might be in that chunk, but probably won’t be… > however you will get different chunks over time so if you wait long > enough you might end up with a chunk that has a private key or > someone’s password. > Not just fraud or identity theft are risks, but lives could be at risk too... https://blog.torproject.org/ ============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
In reply to this post by Barry MacKichan
This recent essay
by Astra Taylor, with an introduction written by Rebecca Solnit has
a decidedly feminist perspective. Given the huge asymmetry on our
own (FRIAM) demographic, I thought this article might be interesting
to some here.
She asserts that: “open” in no way means “equal.” "While the Internet may create space for many voices, it also reflects and often amplifies real-world inequities in striking ways." Astra makes direct reference to the power-law-distributed nature of web *traffic* with hubs and links which alludes to the general consequences of preferential attachment networks, and other similar systems known to yield power-law distributions (e.g. erosion channels, etc.). Despite my own allergic response to strong rhetoric where the "white male" always plays the ultimate villain, I continue to be interested in the topic of gender/racial inequality as a practical matter (I have a wife, two daughters and a granddaughter, and my friends are as likely to be hispanic or native american as lily white). In parallel, I am also interested in the analysis of social networks as dynamical systems, both in the activity registered on the network and in the formation and evolution *of* the network. Astra's point that the internet "reflects and amplifies" real-world inequities was very poignant to me, and I think the core of the point. The digital communication network adjusts various constants regarding time, distance and cost-of-delivery in extreme ways, which in turn can make otherwise relatively *stable* systems relatively *unstable*, or at least out of the time-scales of the human moderators who might have been acting as dynamic balancing elements in the system. It is not surprising that the WWW was often referred to as the Wild Wild Web in the early days because it did offer many of the same "freedoms" and "hazards" as the US western "frontier" of post Civil War expansion across the continent. I'm not a fan of regulation for it's own sake, nor of quotas, nor censorship, or any of the other obvious "knee jerk" responses to some of the consequences of the inequities which I think I agree come with this kind of open-ness, but that is not to say that I like the inequities even if they are superficially in my favor. I'm curious if others here have ideas, opinions or other references that discuss this progressively both as a social phenomenon and perhaps in the abstract as dynamic network form and function? - Steve ============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
Astra Taylor writes:
``Those women who do fight their way into the industry often end up leaving -- their attrition rate is 56%, or double that of men -- and sexism is a big part of what pushes them out. “I no longer touch code because I couldn't deal with the constant dismissing and undermining of even my most basic work by the ‘brogramming’ gulag I worked for,” wrote one woman in a roundup of answers to the question: Why there are so few female engineers?'' Women form cliques too. I'm all for prohibiting all of this (coalition formation and politics) from the work place, but that's not likely to happen. Make it as taboo as sexual harassment. Some people believe that this is all part of what gives a team good morale and communication. I think that's nonsense. A good team is made of people that are engaged in the technical work, and not each other. My experience is that, in the world of software engineering, women are often easier to work with then men. Often they have better listening skills and better impulse control -- and so there is less of the Not Invented Here syndrome which plagues so many projects. But only so many `family oriented' people will work 12-16 hour days. Marcus ============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
Marcus -
Well observed, as usual. You state: "My experience is that, in the world of software engineering, women are often easier to work with then men. Often they have better listening skills and better impulse control -- and so there is less of the Not Invented Here syndrome which plagues so many projects. But only so many `family oriented' people will work 12-16 hour days." When I entered the professional work world, women were already significantly represented at all levels of Systems/Software Engineering except maybe management. During my mid career, many women entered middle and upper management. In general I experienced the same things (better listening skills, impulse control, and other ego-barriers) compared to men, although, by that time I had mostly arranged to work with people (men and women) who had transcended most of that, at least in the context of my teams. I found women as direct supervisors to be much easier to communicate with and negotiate the complexities of my own role as team/project/small-group leader/manager. While they *could* make the "hard decisions", they did not seem to feel the need to prove it by making arbitrary "hard decisions" as some of my male supervisors seemed compelled to do. Mine is a very small sample set in a very unique (National Laboratory) environment, so has little if any more than anecdotal value. I'm not so sure about your specific statement: "I think that's nonsense. A good team is made of people that are engaged in the technical work, and not each other." I do agree that strong cliques may neither be sufficient nor necessary but anecdotally they do seem to provide some useful side-effects that support intra-team communication and cooperation. More than anything, I find that a "healthy" team can help a new member find resonance with the teams values and habits (work ethic, quality work product, open communication, etc.) while an "unhealthy" one can undermine an individual's natural instincts or choices. The teams that formed "by circumstance" were often the most effective and "healthy", the ones formed by "fiat" often never had a chance (remember the HS habit of making us work in "teams" where there was always at least one slacker/bozo?). In a larger pool of individuals with solid technical skills, a reasonable work ethic, and a modest sense of quality, I believe that, as I think you imply, teams can form as needed, independent of any specific "identity". I have seen this in action and in at least one case, watched subteams form and morph effectively and fluidly from that pool. I'm not sure what that critical mass is, but it *was* one of the "holy grails" of SFX, to establish such a pool that could respond to opportunities quickly, effectively and fluidly. Of course the work (and the ability to land it) was also required. The paradox of chickens and eggs. - Steve > Astra Taylor writes: > > ``Those women who do fight their way into the industry often end up > leaving -- their attrition rate is 56%, or double that of men -- and > sexism is a big part of what pushes them out. “I no longer touch code > because I couldn't deal with the constant dismissing and undermining of > even my most basic work by the ‘brogramming’ gulag I worked for,” wrote > one woman in a roundup of answers to the question: Why there are so few > female engineers?'' > > Women form cliques too. I'm all for prohibiting all of this (coalition > formation and politics) from the work place, but that's not likely to > happen. Make it as taboo as sexual harassment. Some people believe > that this is all part of what gives a team good morale and > communication. I think that's nonsense. A good team is made of people > that are engaged in the technical work, and not each other. > > My experience is that, in the world of software engineering, women are > often easier to work with then men. Often they have better listening > skills and better impulse control -- and so there is less of the Not > Invented Here syndrome which plagues so many projects. But only so many > `family oriented' people will work 12-16 hour days. > > Marcus > > > > > > ============================================================ > FRIAM Applied Complexity Group listserv > Meets Fridays 9a-11:30 at cafe at St. John's College > to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com > ============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
In reply to this post by Marcus G. Daniels
So, what's the question here? You think maybe that the predominance of straight white men in technology is innately right? That other genders and races aren't capable of doing the job, so all those white male losers and assholes that we have to deal with are objectively the best people for the jobs they hold?
Or are you thinking that maybe all those white male losers got their skills and jobs through some sort of structural inequity that tilted the competition in their favor? That a kind of in-group altruism is operating here, where white men give each other a pass while agreeing to allow the jerks among them to beat up the women, persons of color, and non-normative gender identities so those uppity not male, not white, not straight competitors have to wade through piles of shit that straight white men never meet?
If you grant that the competition has been tilted in the past and is still tilted the present, by whatever mysterious mechanisms there might be that help some while hindering others, then it's hard to argue that the same mysterious mechanisms won't find their way into the future.
-- rec -- On Thu, Apr 10, 2014 at 12:38 PM, Marcus G. Daniels <[hidden email]> wrote: Astra Taylor writes: ============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
In reply to this post by Steve Smith
Steve writes:
> More than anything, I > find that a "healthy" team can help a new member find resonance with the > teams values and habits (work ethic, quality work product, open > communication, etc.) while an "unhealthy" one can undermine an > individual's natural instincts or choices. I argue that "team values" tend to be an unhealthy concept. The team has a goal, and that goal needs to be recognized and pursued -- a contract or a milestone, etc. Work toward the goal, don't take undue advantage or put special burden of particular people to get it done. Putting aside fairness and responsibility issues, other values or affinities (race, gender, recreational preferences) are things that just distinctions that will create in-group and out-groups, and that (in my opinion) does more harm that good. Doing this will increase diversity of the team, whereas playing the blacker/whiter/americaner than thou card does the opposite. What you do is what should matter, not who you are. Marcus ============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
In reply to this post by Roger Critchlow-2
On Thu, 2014-04-10 at 15:25 -0600, Roger Critchlow wrote:
> So, what's the question here? [..] > Or are you thinking that maybe all those white male losers got their > skills and jobs through some sort of structural inequity that tilted > the competition in their favor? There's a third possibility, which is that while there is inequity, the stereotypical silicon valley brogrammer is actually good at their jobs, in spite of having this defect. I would say it is (relative) privilege that gave them the opportunity to develop the skills they have. Mostly what makes software engineers valuable is skill, judgment, and literacy, and that mostly comes from lots of practice -- which is to say, starting young. Being especially intelligent helps, but I think does not fully replace experience. > That a kind of in-group altruism is operating here, where white men > give each other a pass while agreeing to allow the jerks among them to > beat up the women, persons of color, and non-normative gender > identities so those uppity not male, not white, not straight > competitors have to wade through piles of shit that straight white men > never meet? So, if you buy the argument above, then a selection criteria for who to put in your company is to select someone like yourself: Someone you understand. Not for altruistic reasons, but for selfish reasons. While perhaps egotistical, it would be a crude way to model how they would work out. Credentials like open source experience or education add to that, but there to there is inequity inherent in those experiences too. In contrast, doing something unfamiliar could seem riskier. Marcus ============================================================ FRIAM Applied Complexity Group listserv Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com |
Free forum by Nabble | Edit this page |