Show Notes: linuxactionnews.com/165

The post Linux Action News 165 first appeared on Jupiter Broadcasting.

Show Notes/Links: https://www.bsdnow.tv/334

The post Distrowatch Running FreeBSD | BSD Now 334 first appeared on Jupiter Broadcasting.

Show Notes: techsnap.systems/408

The post Apollo's ARC | TechSNAP 408 first appeared on Jupiter Broadcasting.

Show Notes: techsnap.systems/406

The post SACK Attack | TechSNAP 406 first appeared on Jupiter Broadcasting.

We’ll tell you about the VMware flaw so bad, the solution is to just turn the service off & we now have more details on a major Windows flaw.

Plus new research discovers that up to 81% of Tor users could be de-anonymized, a great batch of your networking questions & much, much more!

Thanks to:

• Get Paid to Write for DigitalOcean

Become a supporter on Patreon:

— Show Notes: —

Why the VMWare TPS flaw is a big deal

• VMWare recently disclosed a vulnerability in its line of virtualization products (vSphere, ESXi, etc)
• VMWare has a feature called TPS (“Transparent Page Sharing”), which basically provides deduplication of memory between virtual machines
• When two or more virtual machines have an identical 4k block of memory, only 1 block of physical memory on the host is actually used
• VMs may have many common blocks if they are running the same OS and Applications, especially if the VMs are clones of each other
• “Experimental implementations show that using this method, it is possible to run over 50 Windows XP VMs with 1GB of RAM each on a physical machine with just 16GB of RAM”
• VMWare Whitepapers of TPS for ESXi 3 and vSphere 5
• The TPS feature is not new, it has shipped in VMWare since 2006, and is on by default
• “Why is this a big deal? Because a virtualized architecture demands VM isolation, this is the most important security requirement for virtualization. Each VM guest running on a host must not be allowed in any way to access another VM guest. They must be kept in separate locked rooms with only the hypervisor possessing the keys to access all of them”
• “VMware appears to be down-playing it as it obviously exposes a chink in their virtual armor, they have issued a KB article describing the vulnerability and giving guidance on how customers can disable TPS on their hosts. VMware doesn’t name the specific source that found the vulnerability in the KB article, they simply refer to it as “an academic paper””
• THE “Academic Paper” — Wait a minute! A fast, Cross-VM attack on AES
• “This work exploits resource sharing in virtualization software to build a powerful cache-based attack on AES. We demonstrate the vulnerability by mounting Cross-VM Flush+Reload cache attacks in VMware VMs to recover the AES keys of OpenSSL 1.0.1 running inside the victim VM. Furthermore, the attack works in a realistic setting where different VMs are located on separate cores. The modified flush+reload attack we present, takes only in the order of seconds to minutes to succeed in a cross-VM setting. Therefore long term co-location, as required by other fine grain attacks in the literature, are not needed. The results of this study show that there is a great security risk to OpenSSL AES implementation running on VMware cloud services when the deduplication is not disabled.”
• The paper describes a technique in which an attacker with access to a VM on the same physical machine, even if it is not on the same CPU Core, could recover the SSL/TLS private key from a web server running Apache+OpenSSL in a victim VM
• This would then allow the attacker to impersonate that site, possibly allowing them to successfully phish or otherwise gain sensitive information from end users
• “All versions of vSphere back to VI3 are vulnerable to the exploit but VMware is only patching the 5.x versions of vSphere as the 4.x versions are no longer officially supported as of May 2014”. “Note these patches only disable TPS which is currently enable by default, they do nothing to fix the vulnerability, it will most likely take VMware some time to figure out how to make TPS work in a way that cannot be exploited”

WinShock – What that Microsoft SChannel vulnerability was

• SChannel is Microsofts tool similar to OpenSSL. “SChannel is used by anything leveraging built-in SSL and TLS this includes IIS, Active Directory, OWA, Exchange, Internet Explorer, and Windows Update.”
• The vulnerability allows remote code execution, so it especially severe, and users should patch immediately if they have not already done so
• An attacker can send specially crafted malicious packets, which are not properly checked for validity, and the victim machine may execute commands included in that message, allowing the attacker to take full control of the machine
• Rapid7 Blog: Is MS14-066 another Red alert?
• Rapid7 takes pains to clarify that this is not on the same level as Heartbleed, Shellshock, Poodle, or other recent vulnerabilities of that scale, mostly because this was privately disclosed to Microsoft, and is not being actively exploited in the wild
• No one knows the details of the problem yet, and there are no proof-of-concept exploits
• “Details surrounding the vulnerability are vague, but Microsoft has indicated that there are no known exploits in the wild and the development of exploit code will be challenging. This vulnerability is reported to affect all Windows servers and clients, and while it’s unlikely to be exploited today, it should be patched as soon as possible given the possibility of remote code execution.”

New research discovers that up to 81% of tor users could be de-anonymized by new traffic analysis techniques

• “Research undertaken between 2008 and 2014 suggests that more than 81% of Tor clients can be ‘de-anonymised’ – their originating IP addresses revealed – by exploiting the ‘Netflow’ technology that Cisco has built into its router protocols, and similar traffic analysis software running by default in the hardware of other manufacturers.”
• “The technique depends on injecting a repeating traffic pattern – such as HTML files, the same kind of traffic of which most Tor browsing consists – into the TCP connection that it sees originating in the target exit node, and then comparing the server’s exit traffic for the Tor clients, as derived from the router’s flow records, to facilitate client identification.”
• “To achieve acceptable quality of service, [Tor attempts] to preserve packet interarrival characteristics, such as inter-packet delay. Consequently, a powerful adversary can mount traffic analysis attacks by observing similar traffic patterns at various point
• “Traffic analysis of this kind does not involve the enormous expense and infrastructural effort that the NSA put into their FoxAcid Tor redirects, but it benefits from running one or more high-bandwidth, high-performance, high-uptime Tor relays”
• The technical involves getting the user to download a file, large enough that it takes a few minutes over which the flow of data can be manipulated and observed (this could be as easy as injecting an oversized images into a website, where the user does not see it)
• By having the server that is sending the image modulate the bandwidth of the TCP connection in question, shifting every 20 seconds between 1 mbit (about the max you would expect to be able to get over tor), 50 kbit, 300 kbit, and then 100 kbit, it created a unique enough pattern of traffic, that tor preserved, that the same pattern could be observed on the entry node that the tor user was connected to
• By collecting Netflow type data (start and end time, source and destination ip, number of packets, number of bytes), from the source (or exit node) and the entry node (or a router in front of the entry node or the end user), and correlated the data, researchers were able to identify the real ip address of the tor user that connected to their server

Feedback:

• How to prevent a “man-in-the-browser attack” to my lastpass account ?

• pfSense and vlans

• Masque attack

• Looking for some DDOS protection tool, what do you use, how did you configured it?

Round Up:

• Let’s Encrypt
• WhatsApp adds end-to-end encryption using TextSecure
• Apple Disables Trim Support On 3rd Party SSDs In OS X
• The upside of accidently hiring a hacker
• SUSE Linux Enterprise Live Patching Now Available
• Government Employees and Contractors responsible for most government data breaches
• FTC shuts down massive “PC cleaner” scam
• The problem with Android on big tablets
• Amnesty, EFF, Privacy International Put Out Free Anti-Surveillance Tool
• New York to roll out gigabit wifi and touch screen ‘information stations’ in place of old pay phones

The post Tor Vibrations | TechSNAP 190 first appeared on Jupiter Broadcasting.

Pre-crime is here, with technology that lets you predicting a hack before it happens. We’ll tell you how. Google’s project zero goes to war, we get real about virtualization.

And then its a great batch of your questions, our answers & much more!

Thanks to:

Become a supporter on Patreon:

— Show Notes: —

Predicting which sites will get hacked, before it happens

• Researchers from Carnegie Mellon University have developed a tool that can help predict if a website is likely to become compromised or malicious in the future
• Using the Archive.org “Wayback Machine” they looked at websites before they were hacked, and tried to identify trends and other information that may be predictors
• “The classifier correctly predicted 66 percent of future hacks in a one-year period with a false positive rate of 17 percent”
• “The classifier is focused on Web server malware or, put more simply, the hacking and hijacking of a website that is then used to attack all its visitors”
• The tool looks at the server software, outdated versions of Apache and PHP can be good indicators of future vulnerabilities
• It also looks at how the website is laid out, how often it is updated, what applications it runs (outdated wordpress is a good hacking target)
• It also compares the sites to sites that have been compromised. If a site is very like another, and that other was compromised, there is an increased probability that the first site will also be compromised
• The classifier looks at many other factors as well: “For instance, if a certain website suddenly sees a change in popularity, it could mean that it became used as part of a [malicious] redirection campaign,”
• The most common marker for a hackable website: The presence of the ‘generator’ meta tag with a value of ‘Wordpress 3.2.1’ or ‘Wordpress 3.3.1’
• Research PDF from USENIX
• There are tools like those from Norse, that analyze network traffic and attempt to detect new 0-day exploits before they are known

Google’s Project Zero exploits the unexploitable bug

• Well over a month ago Google’s Project Zero reported a bug in glibc, however there was much skepticism about the exploitability of the bug, so it was not fixed
• However, this week the Google researchers were able to create a working exploit for the bug, including an ASLR bypass for 32bit OSs
• The blog post details the process the Project Zero team went through to develop the exploit and gain root privileges
• The blog post also details an interesting (accidental) mitigation found in Ubuntu, they caused the researchers to target Fedora to more easily develop the exploit
• The blog also discusses a workaround for other issues they ran into. Once they had exploited the set-uid binary, they found that running: system(“/bin/bash”) started the shell with their original privileges, rather than as root. Instead, they called chroot() on a directory they had setup to contain their own /bin/sh that calls setuid(0) and then executes a real shell as the system root user.
• The path they used to get a root shell relies on a memory leak in the setuid binary pkexec, which they recommend be fixed as well as the original glibc bug
• “The ability to lower ASLR strength by running setuid binaries with carefully chosen ulimits is unwanted behavior. Ideally, setuid programs would not be subject to attacker-chosen ulimit values”
• “The exploit would have been complicated significantly if the malloc main linked listed hardening was also applied to the secondary linked list for large chunks”
• The glibc bug has since been fixed

Secret Service warns over 1000 businesses hit by Backoff Point-of-Sales terminal malware

• The Secret Service and DHS have released an advisory warning businesses about the POS (Point-of-Sales terminal) malware that has been going around for a while
• Advisory
• “The Department of Homeland Security (DHS) encourages organizations, regardless of size, to proactively check for possible Point of Sale (PoS) malware infections. One particular family of malware, which was detected in October 2013 and was not recognized by antivirus software solutions until August 2014, has likely infected many victims who are unaware that they have been compromised”
• “Seven PoS system providers/vendors have confirmed that they have had multiple clients affected“
• “Backoff has experts concerned because it’s effective in swiping customer credit card data from businesses using a variety of exfiltration tools, including memory, or RAM scraping, techniques, keyloggers and injections into running processes”
• “A report from US-CERT said attackers use Backoff to steal payment card information once they’ve breached a remote desktop or administration application, especially ones that are using weak or default credentials”
• “Backoff is then installed on a point-of-sale device and injects code into the explorer.exe process that scrapes memory from running processes in order to steal credit card numbers before they’re encrypted on the device and sent to a payment processor. “
• “Keylogging functionality is also present in most recent variants of ‘Backoff’. Additionally, the malware has a C2 component that is responsible for uploading discovered data, updating the malware, downloading/executing further malware, and uninstalling the malware,”
• US-CERT Advisory
• Krebs reports that Dairy Queen may also be a victim of this attack
• “Dairy Queen says it has no indication of a card breach at any of its thousands of locations, but the company also acknowledges that nearly all stores are franchises and that there is no established company process or requirement that franchisees communicate security issues or card breaches to Dairy Queen headquarters”

Feedback:

• HVAC remote access protection fear.

• Deconstruct malware?

• Virtualisation

• Metric for success of an attack campaign

Round Up:

• Chromecast software vulnerability paves way for another root exploit
• Netflix releases two of their internal threat monitoring tools, used to detect origanization of attacks against their networks
• FBI, Secret Service investigate reports of cyber attacks on U.S. banks
• Seagate ships worlds first 8TB hard drive, with “Enhanced Rotational Vibration (RV) tolerance for reliable performance in multi-drive environments”, allowing more drives to stuffed in a single chassis
• Feds warn first responders of dangerous hacking tool: Google Search
• UK Ministry of Justice fined 180,000 GBP for not encrypting data. Data was being backed up to an external hard drive that was then lost, potentially exposing data on almost 3000 prisoners. The external drive supported some type of ‘encryption’, but it was not enabled
• 300 oil companies hacked in Norway
• Google, Facebook, and others did not read the Apple Documentation. In iOS, clicking a tel:// link in Safari prompts the user to confirm they want to place the call. However in native apps, it is left up to the app to check for permission, to allow apps to initiate calls at the users request, without the user having to confirm it a 2nd time. Apple’s docs state that the app should confirm that the user wants to place the call, but they do not. Using javascript or server-side redirects, a malicious attacker can have your phone place calls without your permission when you click a link in a Facebook, Gmail or G+ message on iOS.
• CouchSurfing email system compromised, many users sent AirBnB prank message
• Browsers will be removing 1024 bit CA certificates from the trust chain in the latest NSS, which will ship in FireFox 32, due for release September 2nd. Even though these certificates have not expired, they will no longer be trusted because of their low security
• Comcast training material leaked, shows how employees are directed to upsell customers during support calls
• Krebs: new razor think ATM insert skimmer goes inside the card slot, nearly impossible to spot. Most skimmers now use hidden cameras to capture your PIN number, rather than a pinpad overlay. Krebs recommends covering the keypad with your free hand while entering your pin number

The post Project Zero Goes To War | TechSNAP 177 first appeared on Jupiter Broadcasting.

The first big release of LXQt is out, and we give it our first look. Where does this minimal desktop fit? And is it taking a direct shot at XFCE’s crown?

Plus the community demonstrates their passion to Unreal, FireFox OS news AND do YOU trust Btrfs?

All this week on, The Linux Action Show!

Thanks to:

Download:

HD Video | Mobile Video | WebM Torrent | MP3 Audio | Ogg Audio | YouTube | HD Torrent

RSS Feeds:

HD Video Feed | Large Video Feed | Mobile Video Feed | MP3 Feed | Ogg Feed | iTunes Feeds | Torrent Feed

— Show Notes: —

LXQt First Look:

Brought to you by: System76

Stefan Wrote in: LXQt, the next Generation???

It has been almost a year since the Razor-qt project and the LXDE-Qt
project decided to merge. Since then, the LXQt desktop has been under
active development by 13 developers and dozens of contributors and
translators.

Aaron Seigo wrote

[with LXQt focus on low system requirements KDE is] able to focus on Plasma as a full-featured, multi-device offering, it shows how collaboration can bring great rewards. How much more exciting than Yet Another Fork with little to no chance of long term survival!”

• LXDE, Razor-Qt merge to create awesome LXQt project | Muktware

• The inclusion of PCManFM-Qt, the Qt port of LXDE\’s desktop and file manager

• An all-new modular architecture, allowing users and maintainers to
  easily swap out components of the desktop for third party apps.

• Ongoing work on Qt 5 compatibility. Most of our components already
  build on Qt 5!

• Ongoing work on Wayland support. Some components, including
  PCManFM-Qt, can run on Wayland if QtWayland is available.

• Several performance improvements

• Experimental Raspberry Pi support

• Partial FreeBSD support

Some Numbers About LXQt for Those Who Are Curious | LXDE Blog

Test environment is the latest Debian stable installed in VirtualBox with 512 MB of RAM and 1 CPU core assigned. After cold boot, the memory usage is as follows.

• Plain Openbox only: 58 MB
• XFCE: 89 MB (with default configuration of Debian)
• LXDE (gtk+ 2 version): 78 MB (add 20 MB to openbox)
• LXQt: 95 MB (add 37 MB to openbox)

Next-Gen Linux Desktop \’LXQt\’ Available to Test on Ubuntu Through PPA

Bright Future:

Jerome Leclanche writes

“The KDE Project has, in their efforts in building the modular KDE Frameworks, opened new doors for Qt developers working with desktop libraries. KF5 libraries may soon power some LXQt components!

Though it’s not a GTK Holy War

It does not really matter for users what toolkit you’re using given the final result works. Let’s save some time not arguing which is better and focus on what we can do with them.

• Siduction LXQt Dev Release

The released image, that is only available for 64-bit for now is a snapshot of Debian unstable, that also goes by the name of Sid, from 2014-05-08. They are enhanced with the lightweight LXQt desktop environment, some useful packages and scripts, our own installer and a custom patched version of the linux-kernel 3.14-3, accompanied by X-Server 1.15.1.

— Picks —

Runs Linux

Flying 3D printer, Runs Linux

Desktop App Pick

Atom

Atom is an open source \”hackable text editor for the 21st Century\” developed by GitHub, which is currently in beta.

• Atom under MIT

Today, we\’re excited to announce that we are open-sourcing Atom under the
MIT License.

• Install Atom Text Editor In Ubuntu Via PPA
• AUR (en) – atom-editor

Weekly Spotlight

KaOS | A lean KDE Distribution

KaOS is a build from scratch distribution, every package in every repository is build by and for KaOS. By July 2013 the initial goal of about 1500 packages was reached.

— NEWS —

New Unreal Tournament Game Will Be Available For Linux, Free

It also goes to show how they also believe in Linux to release their engine and new flagship game on Linux.

They want to involve the community in it as much as possible and see what people want from it. They have asked you to go to their forum and let rip on what you want.

Speaking on cost they said it themselves that it will be free. It\’s not \”free 2 play\”, it\’s just 100% free (and no I don\’t mean open-source). That\’s absolutely crazy to have a game as high calibre as Unreal Tournament being free.

They mentioned they will start with Deathmatch and that the game has only started today, so it\’s a long way off.

• The Future of Unreal Tournament Begins Today

From the very first line of code, the very first art created and design decision made, development will happen in the open, as a collaboration between Epic, UT fans and UE4 developers. We\’ll be using forums for discussion, and Twitch streams for regular updates.

Development will be focused on Windows, Mac and Linux.

• Community ports UE4 Linux editor before Epic can

• Epic Games Unreal Engine 4 DEMO! – Inside Gaming GDC 2013 – YouTube

GNOME Wayland Is Approved For Fedora 21

The Wayland change for Fedora 21 is about better supporting GNOME Wayland sessions. Fedora 20 already brought experimental GNOME Shell Wayland support while Fedora 21 is building upon more polished support thanks to upstream improvements landing with GNOME 3.14 due out in September.

It\’s not for sure yet that a Wayland-based environment would replace the X.Org Server by default for Fedora 21, but at least the support will be in good standing.

In time for Fedora 21 will also be X.Org Server 1.16 which integrates basic XWayland support for running X11 applications atop Wayland without requiring separate X.Org patches.

XBMC 13.0 Gotham Released

• Linux: XBMC now cooperates nicely with the pulseaudio server and provides real pulseaudio support;
  • Linux: Improved VAAPI and VDPAU support;
  • Linux: added VA-API (libva) support for decoding videos with larger resolutions than 1080p (such as 4K resolution);

ZTE Starts Sales of Open C Firefox OS Phone on eBay

ZTE announced today that sales of the ZTE Open C Firefox OS phone have started on eBay. Targeted at first time smartphone users and early adopters wanting to try out Firefox OS, the Open C offers a 3MP camera and 4-inch WVGA screen, and is the first commercially available phone running the latest version of Firefox OS.

• First Phone with Firefox OS 1.3 Hits Ebay Priced at $100

The ZTE Open C boasts:

• 4-inch 800 x 480 touchscreen display
• A dual-core 1.2 GHz CPU
• 512 MB of RAM
• 3-megapixel camera
• 4 GB of on board storage

— Feedback —

• Celebrate Coder Radio Episode 100

• MS Office Coming to Linux?

• BTRFS Experiment

• Straw Poll: Do you trust critical data to Btrfs?

— Chris\’ Stash —

• jupiterbroadcasting on Instagram

Hang in our chat room:

irc.geekshed.net #jupiterbroadcasting

— What’s Matt Doin? —

• Check out LINUX Unplugged

• Should You Upgrade to Ubuntu 14.04?

• Fez – Part 2 | Geek And The Gamer

— Find us on Google+ —

• Chris
• Matt Hartley
• Jupiter Broadcasting’s Page

— Find us on Twitter —

• Chris – ChrisLAS
• Matt – matthartley

— Follow the network on Facebook: —

• Jupiter Broadcasting on Facebook

— Catch the show LIVE Sunday 10am Pacific / 1pm Eastern / 6pm UTC: —

• https://jblive.tv
• Network Calendar

The post LXQt the Xfce Killer? | LAS 312 first appeared on Jupiter Broadcasting.

RAM Prices are getting hot, we’ll tell you why.

Plus the router flaw you need to know about, a pfSense disaster, your questions our answers, and much much more.

On this week’s TechSNAP!

Thanks to:

— Show Notes: —

Hynix factory in China suffers damage in Fire. RAM prices shoot up

• The factory in Wuxi, China is responsible for 40 – 50% of Hynix’s output and 12 – 15% of all DRAM manufacturing capacity around the globe
• The fire started at 07:50 GMT and was extinguished at 09:20 GMT
• The fire apparently started while Hynix was installing some new equipment
• There was only one minor injury during the file
• Hynix has suspended operations at the plant while it evaluates the damage and makes repairs
• “Following news of the shutdown all memory suppliers have apparently stopped quoting prices”
• Reuters followup article
• Hynix reports that the damage is not as bad as initially reported, the huge plumes of black smoke were caused by the fact that the fire was in the air purification system
• Shares in Hynix’s competitors rose sharply, but then slackened off once it was reported that the damage was not severe. Micron shares were up 4 percent to $14.615 at midday Thursday, after surging almost 9 percent at one point. Sandisk was up 2.3 percent at $56.60, after climbing 6 percent at its peak.
• Samsung had 32.7 percent of the global DRAM market in the second quarter, Hynix 30 percent and Micron owned 12.9 percent
• Hynix has published a statement: \”Currently, there is no material damage to the fab equipment in the clean room, thus we expect to resume operations in a short time period so that overall production and supply volume would not be materially affected\”
• DRAM chip prices nearly doubled in the first six months of this year due to tight supply during the summer, prices had been starting to return to normal but this event will undoubtedly keep them inflated for some time to come

Amazon looking to hire 100 IT staff who can get Top Secret security clearance to work on CIA private cloud

• After IBM won a lawsuit to restart the bidding to decide who would build the CIA’s private cloud, Amazon has started a new recruiting drive
• The job openings include: software developers, operations managers and cloud support engineers, among others
• Candidates must meet all requirements to get a Top Secret security clearance, including passing a federally administered polygraph exam
• “Amazon\’s hiring effort includes an invitation-only recruiting event for systems support engineers at its Herndon, Va., facility on Sept. 24 and 25. “
• In filings, Amazon is claiming that it is uniquely qualified to deliver ‘cloud computing’, while analysts have responded by saying that Cloud computing \”simply describes one approach to data center asset provisioning, one that has been around and been practiced by vendors including IBM for many years\”
• The government originally accepted Amazon’s bid at $148 million over the IBM bid at $93 million
• Part of the problem was the way the government wrote the original RFP
• “The vendors were required to address hypothetical scenarios. In one instance, it involved the processing of 100 terabytes of data. But the scenario was ambiguous, and the vendors priced it in different ways, making it impossible to compare prices”
• Analysts also said that the CIA \”too casually brush off Amazon\’s outages\” when considering their bid
• Amazon\’s effort to get government cloud work includes being certified by the U.S. under its Federal Risk and Authorization Program, or FEDRAMP.

Kingcope finds vulnerabilities in Mikrotik routerOS sshd

• Mikrotik RouterOS uses ROSSSH rather than OpenSSH
• Kingcope found that ROSSSH is vulnerable to a remote pre-authentication heap corruption
• ShodanHQ shows that there are nearly 300,000 devices running ROSSSH
• There is an undocumented built-in user account, you can login as ‘devel’ using the admin password, if the file /etc/devel-login exists
• By sending a login name consisting of the letter A 100,000 times, you can crash the ssh daemon
• Exploitation of this vulnerability will allow full access to the router device

Feedback:

• FreeBSD 10\’s removal of GNU

  • Why FreeBSD Deprecated GCC

• pfsense goes down in flames

• IP Leak Follow up

• Hard drive diagnostics before installing FreeNAS ?

• Setting up your own private certificate authority?

• Create a Public Key Infrastructure Using the easy-rsa Scripts – ArchWiki

• Data Recovery business

• Linux Drive Recovery | LAS s27e10

Round up:

• Security researcher releases MegaPWN, displays your Mega private master key and RSA exponent – Just as Mega announces new email service to replace Lavabit and SilentCircle
• The search engine was invented 20 years ago
• Hilariously bad video about the power of IP KVM
• Building a VNC client in 200 lines of javascript (node.js)
• Unusual TOR growth continues, over 1 million new clients, important updates released to try to help the network scale
• NetworkWorld tries out Huawei’s first enterprise managed switch for the North American market – Good power consumption and acceptable performance, but a few rough spots
• The NSA hacks other countries by buying millions of dollars’ worth of computer vulnerabilities
• Godaddy sysadmin blog explains why you shouldn’t cluster your database based on GUIDs
• MyOpenID service shutting down due to lack of adoption
• Intel launches new i7 4690X extreme edition processor. 6x 3.6ghz with turbo up to 4.0ghz – confusingly named, other i7 4*** series are the new Haswell, which features better single core performance at the same clock speeds
• Thoughts on Snowden from a Counterintelligence Agent

The post Random Access Fires | TechSNAP 126 first appeared on Jupiter Broadcasting.

Mike and Chris take a walk down a dangerous and controversial road — the state of Javascript in modern web development.

Plus a frank look at TypeScript, blaming developers, your emails, and much more.

Direct Download:

MP3 Audio | OGG Audio | Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | Video Feed | Torrent Feed | iTunes Audio | iTunes Video

Show Notes:

Feedback

• Jay wants to know how the Android update cycle and the device manufacturers’ different versions of Android affect developers.
• Carlo’s email
• Isak asks what we think about Typescript
• Charles writes in with some more info on Haskell
• Matt shares an interesting article about Adobe
• Matt (diff Matt?) is working on an iOS app that will have a server backend component and is wondering how to make a profit on the app — given the hosting costs over time.

This Week’s Dev World Hoopla

• NCEES licensing exam for Software Engineers
• Windows Phone 8 SDK oddness
• TypeScript / The Javascript Problem

The Language Itself

• No classical inheritance.
• Too loose

Developers

• Too stupid / lazy??
• Too sloppy??

Tool of the Week

• Typescript

Book of the Week

• Basic Category Theory

The post The Javascript Problem | CR 18 first appeared on Jupiter Broadcasting.

We take a look at a scientific excuse to eat chocolate, shifting plate tectonics, measuring a black hole, a possible new element, comet’s, statue’s, updates on Google Maps, crowdsourcing science, spacecraft and Curiosity updates, and as always take a peek back into history and up in the sky this week.

Direct Download:

MP3 Download | Ogg Download | Video | YouTube

RSS Feeds:

MP3 Feed | Ogg Feed | iTunes Feed | Video Feed

Support the Show:

[asa]080508858X[/asa]