Sunday, January 19, 2014

"OpenBSD will shut down if we do not have the funding"

http://www.osnews.com/story/27519/_quot_OpenBSD_will_shut_down_if_we_do_not_have_the_funding_quot_

posted by Thom Holwerda on Thu 16th Jan 2014 23:08 UTC, submitted by jz
Icon

See the email thread on the misc list for more details.

In light of shrinking funding, we do need to look for a source to cover project expenses. If need be the OpenBSD Foundation can be involved in receiving donations to cover project electrical costs.

But the fact is right now, OpenBSD will shut down if we do not have the funding to keep the lights on.

If you or a company you know are able to assist us, it would be greatly appreciated, but right now we are looking at a significant funding shortfall for the upcoming year - Meaning the project won't be able to cover 20 thousand dollars in electrical expenses before being able to use money for other things. That sort of situation is not sustainable.

The OpenBSD project is the incubator for a number of other projects including OpenSSH and OpenSMTPD. If you use these or just want the project to survive, consider making a donation.


Thursday, December 19, 2013

RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis

http://www.cs.tau.ac.il/~tromer/acoustic/

Summary

eavesdrop on computer
Many computers emit a high-pitched noise during operation, due to vibration in some of their electronic components. These acoustic emanations are more than a nuisance: they can convey information about the software running on the computer and, in particular, leak sensitive information about security-related computations. In a preliminary presentation, we have shown that different RSA keys induce different sound patterns, but it was not clear how to extract individual key bits. The main problem was the very low bandwidth of the acoustic side channel (under 20 kHz using common microphones, and a few hundred kHz using ultrasound microphones), many orders of magnitude below the GHz-scale clock rates of the attacked computers.

Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG's current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts. We experimentally demonstrate that such attacks can be carried out, using either a plain mobile phone placed next to the computer, or a more sensitive microphone placed 4 meters away.

Beyond acoustics, we demonstrate that a similar low-bandwidth attack can be performed by measuring the electric potential of a computer chassis. A suitably-equipped attacker need merely touch the target computer with his bare hand, or get the required leakage information from the ground wires at the remote end of VGA, USB or Ethernet cables.

Thursday, December 12, 2013

Google Brings AmigaOS to Chrome Via Native Client Emulation

http://m.slashdot.org/story/195515

Google Brings AmigaOS to Chrome Via Native Client Emulation

from the time-machine-always-comes-last dept.
First time accepted submitter LibbyMC writesGoogle's approach to bringing older C software to the browser is demonstrated in bringing the '80s-era AmigaOS to Chrome. 'The Native Client technology runs software written to run on a particular processor at close to the speeds that native software runs. The approach gives software more direct access to a computer's hardware , but it also adds security restrictions to prevent people from downloading malware from the Web that would take advantage of that power.'Chrome users can go straight to the demo.

Looks Like Nobody Is Winning This Console War | TIME.com

http://business.time.com/2013/12/12/looks-like-nobody-is-winning-this-console-war/

Wednesday, November 27, 2013

ControlByWeb Ethernet I/O

ControlByWeb Ethernet I/O products provide an easy and reliable way to monitor & control devices over a network.


http://www.controlbyweb.com/








There are a few other alternate products you can check out too:

http://www.controlanything.com/Relay/Relay/ETHERNET_KEY_FOB

There used to be 6bit.com but it looks like they've gone out of business.


Tuesday, October 15, 2013

How To Develop Unmaintainable Software




How To Develop Unmaintainable Software

"Greg Jorgensen specializes in debugging, fixing, maintaining, and extending legacy software systems. His typical client has a web site or internal application that works, more or less, but the original developer isn't available. Greg lists some things you can do in your own software projects to keep him in business. In summary, the list goes as follows: Customize your development environment a lot, don't make it easy for the next programmer to start working on the code. Create an elaborate build and deployment environment and remember to leave out the documentation. Don't bother with a testing/staging server but instead have secret logins and backdoor URLs to test new features, and mix test data with real data in your database. Don't bother with a well-understood framework, write everything from scratch instead. Add dependencies to specific versions of libraries and resources, but don't protect or document those dependencies. For the icing of the cake, use the coolest mix of cutting-edge programming languages."

BBC News - Snapchat hack secretly saves images using app

http://mobile.bbc.co.uk/news/technology-24533919

Monday, September 23, 2013

Platform Connectors



5. Platform Connectors

Automation is the future of convenience. Fortunately, the devices and tools that we depend on are continually getting smarter and more connected. As more of these tools openly provide access to their data through methods like application programming interfaces (APIs), increasing levels of automation can be accomplished that can save us minutes, and in some cases hours, each day.

Using tools like IFTTT, Zapier and others, I can automate many of my daily personal and professional tasks. From automatically posting a 'Happy Birthday' message to my Facebook friend on their birthday to automatically adding contacts to my CRM when I receive an email from a potential client, I can streamline many of the tasks that require my incremental attention.

This becomes increasingly interesting when you consider the tens of dozens of websites, social tools and hardwares that are supported by these platforms. Things like automatically turning the house lights on or off at a certain time to things like automatically copying photos from Facebook to Dropbox, the concept of streamlined automation can get exciting.

For clarification, I consider this a significant innovation because many of the tools and platforms we use have historically had their data in a silo, preventing certain degrees of automation. Now, with platforms being able to communicate with one another, there is an opportunity to take our technology to the next level by letting the automation do the heavy lifting of the small day-to-day duties. The larger opportunities are truly endless and unrealized.

So how does your list compare?

As stated previously, this list is in no particular order and consists of things derived from my interests and areas that I'm familiar with. Only time will dictate how these things will truly pan out. Part of the reason that envelope-pushing innovations haven't become wildly known is because some are still being hacked on and tweaked within the proverbial garages of todays smartest people. Entrepreneur and angel investor Chris Dixon wrote about this paradigm as well, citing that activities that begin as tinkering and hobbies often take ten or more years to become practical utilities for normal people.




Sent from my iPad

Wednesday, September 18, 2013

Unlocking Phones Again, With Help From the White House - Businessweek

http://mobile.businessweek.com/articles/2013-09-18/phone-unlocking-will-be-legal-again-with-help-from-the-white-house

New Operating System Seeks To Replace Linux In the Cloud



New Operating System Seeks To Replace Linux In the Cloud

Posted by Soulskill  
from the chasing-the-penguins-out-of-the-sky dept.
New submitter urdak writes"At CloudOpen in New Orleans, KVM veterans Avi Kivity and Dor Laorrevealed their latest venture, a new open-source (BSD license) operating system named OSv. OSv can run existing Linux programs and runtime environments such as a JVM, but unlike Linux, OSv was designed from the ground up to run efficiently on virtual machines. For example, OSv avoids the traditional (but slow) userspace-kernel isolation, as on the cloud VMs normally run a single application. OSv is also much smaller than Linux, and breaks away from tradition by being written in C++11 (the language choice is explained in in this post)."

Saturday, September 07, 2013

The US government has betrayed the internet. We need to take it back


The US government has betrayed the internet. We need to take it back

The NSA has undermined a fundamental social contract. We engineers built the internet – and now we have to fix it

• Explaining the latest NSA revelations – Q&A



Government and industry have betrayed the internet, and us.

By subverting the internet at every level to make it a vast, multi-layered and robust surveillance platform, the NSA has undermined a fundamental social contract. The companies that build and manage our internet infrastructure, the companies that create and sell us our hardware and software, or the companies that host our data: we can no longer trust them to be ethical internet stewards.

This is not the internet the world needs, or the internet its creators envisioned. We need to take it back.

And by we, I mean the engineering community.

Yes, this is primarily a political problem, a policy matter that requires political intervention.

But this is also an engineering problem, and there are several things engineers can – and should – do.

One, we should expose. If you do not have a security clearance, and if you have not received a National Security Letter, you are not bound by a federal confidentially requirements or a gag order. If you have been contacted by the NSA to subvert a product or protocol, you need to come forward with your story. Your employer obligations don't cover illegal or unethical activity. If you work with classified data and are truly brave, expose what you know. We need whistleblowers.

We need to know how exactly how the NSA and other agencies are subverting routers, switches, the internet backbone, encryption technologies and cloud systems. I already have five stories from people like you, and I've just started collecting. I want 50. There's safety in numbers, and this form of civil disobedience is the moral thing to do.

Two, we can design. We need to figure out how to re-engineer the internet to prevent this kind of wholesale spying. We need new techniques to prevent communications intermediaries from leaking private information.

We can make surveillance expensive again. In particular, we need open protocols, open implementations, open systems – these will be harder for the NSA to subvert.

The Internet Engineering Task Force, the group that defines the standards that make the internet run, has a meeting planned for early November in Vancouver. This group needs to dedicate its next meeting to this task. This is an emergency, and demands an emergency response.

Three, we can influence governance. I have resisted saying this up to now, and I am saddened to say it, but the US has proved to be an unethical steward of the internet. The UK is no better. The NSA's actions are legitimizing the internet abuses by China, Russia, Iran and others. We need to figure out new means of internet governance, ones that makes it harder for powerful tech countries to monitor everything. For example, we need to demand transparency, oversight, and accountability from our governments and corporations.

Unfortunately, this is going play directly into the hands of totalitarian governments that want to control their country's internet for even more extreme forms of surveillance. We need to figure out how to prevent that, too. We need to avoid the mistakes of the International Telecommunications Union, which has become a forum to legitimize bad government behavior, and create truly international governance that can't be dominated or abused by any one country.

Generations from now, when people look back on these early decades of the internet, I hope they will not be disappointed in us. We can ensure that they don't only if each of us makes this a priority, and engages in the debate. We have a moral duty to do this, and we have no time to lose.

Dismantling the surveillance state won't be easy. Has any country that engaged in mass surveillance of its own citizens voluntarily given up that capability? Has any mass surveillance country avoided becoming totalitarian? Whatever happens, we're going to be breaking new ground.

Again, the politics of this is a bigger task than the engineering, but the engineering is critical. We need to demand that real technologists be involved in any key government decision making on these issues. We've had enough of lawyers and politicians not fully understanding technology; we need technologists at the table when we build tech policy.

To the engineers, I say this: we built the internet, and some of us have helped to subvert it. Now, those of us who love liberty have to fix it.

• Bruce Schneier writes about security, technology, and people. His latest book is Liars and Outliers: Enabling the Trust That Society Needs to Thrive. He is working for the Guardian on other NSA stories

Chrome's Native-Like Packaged Apps Come Out Of Dev Preview And Head To The Desktop, Now Called “Chrome Apps” - TechCrunch

http://m.techcrunch.com/2013/09/05/chromes-native-like-packaged-apps-come-out-of-dev-preview-and-head-to-desktop-now-called-chrome-apps/

Sunday, August 11, 2013

Writing Hello World Bootloader Tutorial

http://viralpatel.net/taj/tutorial/hello_world_bootloader.php

Apparently part of a:

TAJ OS may be an answer. It is a first operating system developed in India which is totally based on object oriented concept. C++ is the first thing that comes to mind when we hear the word object oriented. And yes, TAJ OS is totally developed in C++, which removes all drawbacks of C language. (sic)

Features of TAJ Operating System

  • 32-bit Protected mode Operating System
  • Paging enable
  • Secure Exception handling
  • Interrupt management system
  • Work with different kinds of CPU (80386 onwards).
  • Fully functional built in keyboard driver
  • Total DMA control
  • Floppy driver
  • Mouse driver
  • Fat file system driver
  • Multitasking
  • Multithreading
  • Multiuser

Monday, August 05, 2013

Project HiJack

Project HiJack

Hijacking power and bandwidth from the mobile phone's audio interface. 
Creating a cubic-inch peripheral sensor ecosystem for the mobile phone.

http://web.eecs.umich.edu/~prabal/projects/hijack/

Hendy’s Law (pixels per dollar)






Pixels per dollar. Similarly, Barry Hendy of Kodak Australia has plotted the "pixels per dollar" as a basic measure of value for a digital camera, demonstrating the historical linearity (on a log scale) of this market and the opportunity to predict the future trend of digital camera price, LCD and LED screens and resolution.



Feds are Suspects in New Malware That Attacks Tor Anonymity | Threat Level | Wired.com

http://www.wired.com/threatlevel/2013/08/freedom-hosting/

Friday, August 02, 2013

Sajak's law of technology marketing

http://outsideinmarketing.wordpress.com/2009/02/11/sajaks-law-of-technology-marketing/

 Sajak's Law states that the time it takes technology vendors to embrace new buzzwords in their marketing literature is cut in half every year. 

Following the introduction of a new concept such as SOA by industry thought leaders, there is a mad rush by technology vendors to adopt the new terminology into their messaging and positioning.  In an effort to be viewed as the leader in the latest trend, vendors begin bombarding their customers with aggressive promotions around the latest buzzword terms.  The process happens so quickly that few customers actually have time to filter the noise to determine the true meaning of new terms.  After a few months, the terms cease to have any value, because every vendor claims to have adopted the principles.