Tesla – Jupiter Broadcasting

When a responsible person discovers a security issue, disclosing it properly is difficult
Uses Tesla’s policy as a good example of how companies should do this
“This is not hard stuff and it basically amounts to text on a page. Consider whether your own organisation has something to this effect and is actually ready to handle disclosure by those who attempt to do so ethically. Listen to these people and be thankful they exist; there’s a whole bunch of others out there who are far less charitable and by the time you hear from those guys, it’s already too late.”

RedHat deprecates Btrfs

The Btrfs file system has been in Technology Preview state since the initial release of Red Hat Enterprise Linux 6. Red Hat will not be moving Btrfs to a fully supported feature and it will be removed in a future major release of Red Hat Enterprise Linux.
The Btrfs file system did receive numerous updates from the upstream in Red Hat Enterprise Linux 7.4 and will remain available in the Red Hat Enterprise Linux 7 series. However, this is the last planned update to this feature.

320 Million Freely Downloadable Pwned Password hashes

NOTE: these are SHA-1 hashes, not the raw passwords: 320,335,236 to be precise
Password checking page – that same URL has links for downloading the hashes
To unzip the files, you need p7zip. Command to extract is: 7z x pwned-passwords-update-1.txt.7z
to generate a sha1 hash, Dan used: ‘sha1 -s TechSNAP’ – SHA1 (“TechSNAP”) = c6586a62febc8706d814fe28fe397e9dca146992. Use “tr ‘[a-z]’ ‘[A-Z]'” to upper case.
takes about 0.176ms to locate a hash on a PostgreSQL 9.6 database
Example query construction
Passwords Evolved: Authentication Guidance for the Modern Era
API for using Troy’s service
Troy’s donation page

Feedback

Round Up:

The post BTRFS is Toast | TechSNAP 331 first appeared on Jupiter Broadcasting.

Summer of GitHub | CR 262

chris — Thu, 22 Jun 2017 16:38:56 +0000

RSS Feeds:

MP3 Feed | Video Feed | Torrent Feed | iTunes Audio | iTunes Video

Become a supporter on Patreon:

— Show Notes: —

Hoopla

Swift creator departs Tesla after just six months

Six months later, he announced on Twitter that he was leaving the car company. “Turns out that Tesla isn’t a good fit for me after all,” he said. Lattner doesn’t have a new job in mind just yet.

Turns out that Tesla isn't a good fit for me after all. I'm interested to hear about interesting roles for a seasoned engineering leader!

— Chris Lattner (@clattner_llvm) June 21, 2017

Stripe refocuses European effort with 6 new markets and expanded payments platform

Stripe serves as the technical and banking infrastructure that allows businesses and individuals to accept online payments. The company has garnered more than $400 million in equity financing from big-name backers since its inception back in 2010, including CapitalG (Google), Sequoia Capital, Andreessen Horowitz, American Express, and Elon Musk. For many, the company is a prime candidate to go public, but Stripe CEO Patrick Collison stated recently that he has no intentions of pursuing an IPO anytime soon.

Blockchain raises $40 million from Lakestar and Google’s venture arm

European venture capital fund Lakestar and GV, Google’s venture capital arm, both led the round. Nokota Management and Digital Currency Group also took part in the investment, as did Blockchain’s existing investors Lightspeed Venture Partners, Mosaic Venture Partners, Prudence Holdings, Virgin, and Sir Richard Branson.

Inside Microsoft’s Artificial Intelligence Comeback

“We don’t want one or two companies, which I will not name, to be the only big players in town for AI,” he says

The post Summer of GitHub | CR 262 first appeared on Jupiter Broadcasting.

Daily Keyboard Regime | User Error 11

chris — Fri, 02 Jun 2017 18:00:36 +0000

RSS Feeds:

MP3 Feed | Video Feed | iTunes Feed

Become a supporter on Patreon:

Links

The post Daily Keyboard Regime | User Error 11 first appeared on Jupiter Broadcasting.

Air Gap Vulnerability | TTT 256

chris — Mon, 15 Aug 2016 19:05:05 +0000

RSS Feeds:

Become a supporter on Patreon

Show Notes:

Kickstarter of the Week:

Put2Go: Car Mount with Wireless Charging, Ultra Convenient by Put2Go.com — Kickstarter

The post Air Gap Vulnerability | TTT 256 first appeared on Jupiter Broadcasting.

Atomic Memory | TTT 252

chris — Mon, 18 Jul 2016 17:35:19 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Atom-sized storage could change the face of data and memory, Opera gets sold, Tesla is in some hot water, Netflix beams up Star Trek, hackers claim to have gone after Pokémon Go servers & more!

Direct Download:

RSS Feeds:

Become a supporter on Patreon

Show Notes:

Links:

The post Atomic Memory | TTT 252 first appeared on Jupiter Broadcasting.

Signed by Sony | TechSNAP 192

chris — Thu, 11 Dec 2014 18:48:06 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

If we could rebuild the Internet from scratch, what would we change? It’s more than just a thought experiment. We’ll share the details about real world research being done today!

Plus we dig through the Sony hack, answer a ton of great question & a rocking roundup!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

Reinventing Computers And The Internet From Scratch, For The Sake Of Security

DARPA funded research is looking at how we might design the Internet if we had to do it over again
Many decisions that were made 30 and 40 years ago when UNIX and TCP/IP were designed, may be done differently today
The overall project has a number of sub-projects:
- CRASH – Clean-Slate Design of Resilient, Adaptive, Secure Hosts
- MRC – Mission-Oriented Resilient Clouds
- CTSRD – Clean Slate Trustworthy Secure Research and Development (Custard)
BERI: Bluespec Extensible RISC Implementation: a open-source hardware-software research and teaching platform: a 64-bit RISC processor implemented in the high-level Bluespec hardware description language (HDL), along with compiler, operating system, and applications
CHERI: capability hardware enhanced RISC instructions: hardware-accelerated in-process memory protection and sandboxing model based on a hybrid capability model
TESLA: temporally enforced security logic assertions: compiler-generated runtime instrumentation continuously validating temporal security properties
SOAAP: security-oriented analysis of application programs: automated program analysis and transformation techniques to help software authors utilize Capsicum and CHERI features
The goal is to design newer secure hosts and networks, without having to maintain backwards compatibility with legacy systems, the biggest problem with changing anything on the Internet
This is why there are still things like SSLv3 (instead of just TLS 1.2+), why we have not switched to IPv6, and why spam is still such a large problem
I for one would definitely like to replaced SMTP, but no one has yet devised a plan for a system that the world could transition to without breaking legacy email while we wait for the rest of the world to upgrade
“Corporations are elevating security experts to senior roles and increasing their budgets. At Facebook, the former mantra “move fast and break things” has been replaced. It is now “move slowly and fix things.””
For performance reasons, when hardware and programming languages were designed 30 and 40 years ago, it was decided that security would be left up to the programmer
The CHERI project aim to change this, by implementing ‘Capabilities’, a sandboxing and security mechanism into the hardware, allowing the hardware rather than the software to enforce protections, preventing unauthorized access or modification of various regions of memory by malicious or compromised applications.
CHERI, and the software side of the project, Capsicum, are based on FreeBSD, but are also being ported to Linux, where Google plans to make extensive use of it in its Chrome and Chromium browsers.
Additional Coverage

Sony Internal Network Hacked

No, this is not Episode 3 of TechSNAP, Sony was hacked, again
Hackers identifying the selves as Guardians of Peace (GOP) claim to have stolen as much as 100TB of data from Sony
One questions how they managed to exfiltrate such a huge amount of data without being noticed. A full 1 GBPS internet connection would have to run at full capacity for 10 days to move that much data. It seems a lot of the data was likely compressible, but unreleased movies etc would not be
At this point, only about 40GB of data has been leaked, mostly internal documents
“The data dump includes employee criminal background checks, salary negotiations, and doctors’ letters explaining the medical rationale for leaves of absence. There are spreadsheets containing the salaries of 6,800 global employees, along with Social Security numbers for 3,500 U.S. staff. And there is extensive documentation of the company’s operations, ranging from the script for an unreleased pilot written by Breaking Bad creator Vince Gilligan to the results of sales meetings with local TV executives.”
When will companies learn that a spread sheet is not a secure place to store sensitive information
In a memo to Employees Sony Pictures Entertainment chiefs Michael Lynton and Amy Pascal said “While we are not yet sure of the full scope of information that the attackers have or might release, we unfortunately have to ask you to assume that information about you in the possession of the company might be in their possession,”
Additional Coverage – CNET – 47,000 Social Security Numbers leaked, Celebrity Data included
Additional Coverage – Sony Employees receive email threats: “your family will be in danger”
Additional Coverage – BuzzFeed – Inside the Sony Data
Additional Coverage – Gizmodo – Sony hack worse than thought
Additional Coverage – Washington Post
Additional Coverage – Edgadget
Additional Coverage – The Verge
George Clooney predicted the Sony Hack in December (in a now leaked email)
Additional Coverage – BitDefender – Take Aways from the Sony Hack
Additional Coverage – ArsTechnica – Attackers also stole certificates to sign malware

Feedback:

Jupiter Dev Summit on Monday the 15th
Remotely activate/disable firewall rules?
AuthPF (works, especially remotely)
FreeNAS/ZFS Filesystem Relationships
Screenshot
Naming software bugs like storms
[ways to use as much bandwidth a possible? ](https://www.reddit.com/r/techsnap/comments/2oftzo/ways_to_use_as_much_bandwidth_a_p
ossible/)
Malware Authorship Language
31C3 – The 31st Chaos Communication Congress Who will be there?

Round Up:

The post Signed by Sony | TechSNAP 192 first appeared on Jupiter Broadcasting.

Not So Smart Watches | Tech Talk Today 30

chris — Tue, 22 Jul 2014 08:01:26 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Are you excited about Smart Watches? Or does the current crop fall to far below expectations to be a serious item? Plus a look at how hackers remotely owned a Tesla, and the broader ramifications as computer systems are further integrated into our cars.

Plus the interesting secret buried in Google’s quarterly results & more!

Direct Download:

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Torrent Feed

Become a supporter on Patreon:

Show Notes:

Tesla Model S hack reportedly controls locks, horn, headlights while in motion | Ars Technica

The hacks were carried out at the Syscan 360 security conference in Beijing, an article published by Bloomberg News reported. The report cited a brief post on Chinese social media site Weibo from a representative of China-based Qihoo 360 Technology Co., which said the experiment was carried out by members of the company’s information technology department.

Tesla Motors officials vowed to investigate reports that its Model S sedan is susceptible to hacks that can remotely control the car’s locks, horn, headlights, and skylight while the car is in motion, according to a published report.

Google beats Q2 2014 revenue estimates with $15.96 billion, misses on EPS | Ars Technica

Google announced its earnings for Q2 2014 today. The company reported $15.96 billion in revenue, a 22 percent increase over last quarter, and earnings of $6.08 per share. This is a mixed bag compared to what Wall Street was expecting, which was a net revenue of about $15.62 billion and earnings of $6.25 a share.

Selling hardware and apps on the Play Store now makes up 10 percent of Google’s revenues, up 53 percent over last year for 1.60 billion in revenue.

Google reports strong revenue growth but misses profit expectations, ad rates still falling

CPC was down 7 percent in the quarter, but for network sites it was down almost twice as much at 13 percent. The growth of mobile usage has been a big part of this decline, since mobile ads tend to cost less.

Continued erosion of the CPC number (down 2% Q2Q, 6% y/y) so for those who haven’t been following this like I have here are the last fourteen quarters:

Paid Clicks Cost Per Click Paid Distribution Q-2-Q Y-A-Q Q-2-Q Y-A-Q In $M 2011Q1 18 4 8 -1 337 2011Q2 18 -2 6 12 355 2011Q3 13 28 -5 5 383 2011Q4 17 34 -8 -8 442 2012Q1 7 39 -6 -12 468 2012Q2 1 42 1 -16 507 2012Q3 6 33 -3 -15 556 2012Q4 9 24 -2 -6 634 2013Q1 3 20 -4 -4 680 2013Q2 4 23 -2 -6 706 2013Q3 8 26 -4 -8 755 2013Q4 13 31 -2 -11 824 2014Q1 1 26 0 -9 845 2014Q2 2 25 -2 -6 893

Cost per click is the money that Google gets per click, it keeps going down suggesting to me that the “value” of this advertising is going down.

Not slowing down at all, Google spent $2.65B on data centers in Q2 — Tech News and Analysis

Google’s quarterly infrastructure spending has been skyrocketing for several quarters now, and the past three months were no exception. Google spent nearly $2.65 billion on data centers during the second quarter — more than $1 billion over last year’s second quarter and more than triple what it spent two years ago.

Does Anyone Even Want a Smartwatch?

Fewer than half of the respondents to a recent Accenture survey said they would consider buying a smartwatch, and even the most optimistic experts predict only 20 million smartwatch sales this year, a pittance compared with phone and tablet sales.

To understand the smartwatch hype, it helps to know that the consumer-tech world is going through an identity crisis. Smartphones and their affiliated apps have powered Silicon Valley’s profit engines for years, but growth in the phone market is slowing as more people make do with the devices they already have. (Research firm IDC expects smartphone growth to fall to single digits by 2018.)

Since at the moment smartwatches need to be tethered to your phone’s data connection in order to work properly, they actually don’t allow you to streamline at all. And while it was convenient not to have to reach into my pocket every time I got a Facebook message, Twitter reply, or email, the constant buzzing raised my stress level considerably. Then there’s the matter of having a $300 gadget strapped to my wrist, which creates anxiety of its own.

Android Wear Review: Putting the Smartphone on Your Wrist – YouTube

WSJ Personal Tech columnist Joanna Stern reviews the first truly “smart” watches.

The post Not So Smart Watches | Tech Talk Today 30 first appeared on Jupiter Broadcasting.