sysadmin – Jupiter Broadcasting

developers had left the private keys for both the “wildcard” certificate for all the company’s Web domains and the keys to cloud storage accounts on Amazon Web Services exposed publicly in code posted to GitHub
Findings of developer: Why I walked away from
$30,000 of DJI bounty money – PDF
But as Finisterre worked to document the bug with the company, he got increasing pushback—including a threat of charges under the Computer Fraud and Abuse Act (CFAA).
“At one point… DJI even offered to hire me directly to consult with them on their security,” Finisterre wrote.
Ultimately, Finisterre received an e-mail containing an agreement contract that he said “did not offer researchers any sort of protection. For me personally, the wording put my right to work at risk, and posed a direct conflict of interest to many things including my freedom of speech.” It seemed clear to Finisterre that “the entire ‘Bug Bounty’ program was rushed based on this alone,” he wrote.

how can I prevent myself from getting hacked?

not everyone agrees with Motherboard so see also Basic security precautions for non-profits and journalists in the United States, mid-2017. but to be fair, Bruce say’s it’s pretty good
see also other Motherboard guides
Do you want to stop criminals from getting into your Gmail or Facebook account? Are you worried about the cops spying on you? We have all the answers on how to protect yourself.
The Electronic Frontier Foundation guide to Assessing Your Risks
… if you come away with one lesson from this guide is: update, update, update, or patch, patch, patch.
Use a password manager
Two factor authentication: You should, if the website allows it, use another 2FA option that isn’t SMS-based, such as an authentication app on your smartphone (for example, Google Authenticator, DUO Mobile, or Authy), or a physical token. If that option is available to you, it’s great idea to use it.
use an ad blocker (e.g. uBlock Origin). Why? A great deal of malware comes through ads.
Get an iPhone and don’t jailbreak it
Use Signal instead of WhatsApp
Even if you keep your privacy settings on lockdown, social media companies are subject to subpoenas, court orders, and data requests for your information. And often times, they’ll fork over the information without ever notifying the user that it’s happening. For the purposes of social media, assume that everything you post is public. This doesn’t mean you should stop using social media, it just means you have to be mindful of how you use it.

Feedback

Tape Drives and Jails – FreeNAS jails
From Samir, based on question from Episode 346 : Linux Containers vs Virtual Machines
Jonathan Davis mentioned Schrodingers Backup Mug
I will Miss you Mr. Dan
Reverse SSH as Poor-Man’s VPN

Round Up:

Potential impact of the Intel ME vulnerability
Mostly for ZFS: Policy-driven snapshot management and replication tools. & see also zfstools : OpenSolaris-compatible auto snapshotting for ZFS
The strongest KASLR, ever?
Better Random Number Generation for OpenSSL, libc, and Linux Mainline – But what’s really exciting for us is that, in the course of working on libc, we were also able to get traction on another important change, in Linux itself. Last year, we suggested a new madvise() option for the Linux kernel. Based on OpenBSD’s MINHERIT_ZERO, the option marks memory regions as WIPEONFORK, which means that those regions are zeroed in a child process immediately after a fork() call.
How a single PostgreSQL config change improved slow query performance by 50x
Troy Hunt testifies before Congress and you should be able to watch it live here
A minimalist guide to tmux
Top SSL Issuers

The post A Farewell to Dan | TechSNAP 347 first appeared on Jupiter Broadcasting.

Neutral Nets | TechSNAP 346

chris — Mon, 20 Nov 2017 17:55:56 +0000

RSS Feeds:

HD Video Feed | MP3 Audio Feed | iTunes Feed | Torrent Feed

Become a supporter on Patreon:

Show Notes:

Net Neutrality – mail your Congressional Reps and Senators & state

governor – do not email or fax them. Put it in the mail.

Security Alerts from GitHub

define dependencies in one of the supported manifest file types, like package.json or Gemfile.
similar to FreeBSD vuxml database – uses dependencies already listed in each FreeBSD port

here are over a billion outdated Android devices in use

It’s common knowledge that Android device tend to be more out of date than iOS devices, but what does this actually mean?
People sometimes compare Android to Windows XP because there are a large number of both in the wild and in both cases, most devices will not get security updates. However, this is tremendously unfair to Windows XP, which was released on 10/2001 and got security updates until 4/2014, twelve and a half years later.
Another difference between Android and Windows is that Android’s scale is unprecedented in the desktop world. The were roughly 200 million PCs sold in 2017. Samsung alone has been selling that many mobile devices per year since 2008.
If we look at the newest Android release (8.0, 8/2017), it looks like you’re quite lucky if you have a two year old device that will get the latest update. The oldest “Google” phone supported is the Nexus 6P (9/2015), giving it just under two years of support.
But even with the data we have, we can take a guess at how many outdated devices are in use. In May 2017, Google announced that there are over two billion active Android devices. If we look at the latest stats (the far right edge), we can see that nearly half of these devices are two years out of date. At this point, we should expect that there are more than one billion devices that are two years out of date! Given Android’s update model, we should expect approximately 0% of those devices to ever get updated to a modern version of Android.
Project Treble

Flight rules for git

A guide for astronauts (now, programmers using git) about what to do when things go wrong.

Flight Rules are the hard-earned body of knowledge recorded in manuals that list, step-by-step, what to do if X occurs, and why. Essentially, they are extremely detailed, scenario-specific standard operating procedures. […]
NASA has been capturing our missteps, disasters and solutions since the early 1960s, when Mercury-era ground teams first started gathering “lessons learned” into a compendium that now lists thousands of problematic situations, from engine failure to busted hatch handles to computer glitches, and their solutions.
What did I just commit?
I wrote the wrong thing in a commit message
I committed with the wrong name and email configured
I want to remove a file from a commit

Feedback

Dan announces he is leaving the show.
postgres and shared memory
containers vs VM

Round Up:

The post Neutral Nets | TechSNAP 346 first appeared on Jupiter Broadcasting.

Back From the DevFest | CR 283

chris — Thu, 16 Nov 2017 16:03:48 +0000

RSS Feeds:

MP3 Feed | Video Feed | Torrent Feed | iTunes Audio | iTunes Video

Become a supporter on Patreon:

— Show Notes: —

Feedback

Mike gets the community bug, and its a feature!

I had a great time at @DevFestFL yesterday at Disney World and it reminded me how many great #dev / #tech community events there are all around. I’m going to make a commitment for the rest of this year to either go to or host a community event once per month. #CoderRadio listeners, I’m looking for you to guide me on where to go. I live in FL but am very comfortable traveling to NYC or elsewhere if it makes sense. Who’s with me?

I made a JSON api for jupiterbroadcasting shows

Just wanted to share this simple project that I feel is ready to see some users. Github link: https://github.com/rangeroob/jupiterbroadcasting-api

Hoopla

Kotlin/Native v0.4 released: Objective-C interop, WebAssembly and more

We’re happy to announce the release of Kotlin/Native v0.4, KotlinConf 2017 edition! This release adds support for accessing Objective-C APIs on iOS and macOS, WebAssembly target platform, as well as introduces major changes making app development in Kotlin/Native way easier.

What is technical debt? And why does almost every startup have it?

Technical debt is any code added now that will take more work to fix at a later time — typically with the purpose of achieving rapid gains.

DevFest Florida

Florida’s biggest Google technology conference. Organized by three Google Developer Groups in the central Florida area: Space Coast, Central Florida, and Tampa Bay

Pick of the Week

Code together in real time with Teletype for Atom

Teletype for Atom wires the keystrokes of remote collaborators directly into your programming environment, enabling conflict-free, low-latency collaborative editing for any file you can open in Atom.

sysadmin – Jupiter Broadcasting

Too Nixy for My Shirt | LINUX Unplugged 465

Our Linux Regrets | LINUX Unplugged 456

Liberty Leaks and Lies | LINUX Unplugged 442

Space for Theming | LINUX Unplugged 424

Real People Are Out There | LINUX Unplugged 420

And the Answer is… | LINUX Unplugged 407

No PRs Please | LINUX Unplugged 399

Brunch with Brent: Elizabeth K. Joseph | Jupiter Extras 63

Apollo’s ARC | TechSNAP 408

Old School Outages | TechSNAP 407

Prefork Pitfalls | TechSNAP 404

The Future of HTTP | TechSNAP 389

The One About eBPF | TechSNAP 388

Private Cloud Building Blocks | TechSNAP 387

Interplanetary Peers | TechSNAP 384

The Power of Shame | TechSNAP 383

A Farewell to Dan | TechSNAP 347

RSS Feeds:

Become a supporter on Patreon:

Show Notes:

Feedback

Round Up:

Neutral Nets | TechSNAP 346

RSS Feeds:

Become a supporter on Patreon:

Show Notes:

Net Neutrality – mail your Congressional Reps and Senators & state

Feedback

Round Up:

Back From the DevFest | CR 283

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

Feedback

Hoopla

Pick of the Week

SSL Strippers | TechSNAP 344

RSS Feeds:

Become a supporter on Patreon:

Show Notes:

Feedback

Round Up: