Important work can be done while daydreaming - <AUTHOR> http://www.boston.com/bostonglobe/ideas/articles/2008/08/31/daydream_achiever/?page=full Something for the first day of school: a retort to all of my teachers who adminished me to stop daydreaming.... <comment><USER2> When I embark upon a project, work or fun, I always spend a good deal of time up front just daydreaming about it. Sometimes I do this for months before I get anything down on paper. Over the years I have perfected the skill of prototyping in my head - thinking through use cases, what-if scenarios etc. The advantage of this is that it is much faster than anything else - but you have to be able to juggle a lot of stuff in your head at once. The result of this is that I can slowly build a complete mental model of the project in my head so that when I actually start the project I know exactly what I want to make, how I want to make it, what problems I will run into and how to solve them.

Work-wise this is sometimes a problem because co-workers seem to think that I often just sit and stare out the window, but when at last I get going they can't believe how fast I get things done.

</comment><comment><USER3> Of course, great discoveries are often made while daydreaming. I bring to your attention this quote from Nietzsche:

"Not that one is the first to see something new, but that one sees as new what is old, long familiar, seen and overlooked by everybody, is what distinguishes the truly original minds. _The first discoverer is ordinarily that wholly common creature, devoid of spirit and addicted to fantasy - accident_."

</comment><comment><USER4> When I've done work on music arrangements, I've found the best approach is to get away from instruments... go into a quiet room with a pad of paper, and imagine in my mind what the music ought to sound like.

Trying to hack it out on a keyboard results only in what I already know how to play, not what I really want it to sound like.

<comment><USER5> Perhaps this is why the deaf Beethoven was one of our greatest composers, because he was not limited by his own hearing to that which was already possible and achievable?

</comment></comment><comment><USER6> Daydreaming is a part of just creative thinking, using your right side of the brain. You can say its even a form of meditation,</comment>


An implementation of Fully Homomorphic Encryption - <AUTHOR> https://github.com/coron/fhe

<comment><USER2> Perhaps I missed it in the description, but are there any timing results that you could share?

<comment><AUTHOR> see Table 3 in <http://eprint.iacr.org/2011/440.pdf></comment></comment>


Layoffs result as consumers think twice about DNA testing - <AUTHOR> https://www.latimes.com/business/story/2020-02-10/newsletter-dna-testing <comment><USER2> I know that I regret being talked into doing one of these DNA tests (my concern is privacy-based). I have since requested that my data be deleted and have opted out of everything that I could opt out of, but I'd be a lot more comfortable if I had simply never done it.

When people ask me what I think of these tests, I advise great caution and that they think hard about the cost/benefit tradeoff that they're making.

<comment><AUTHOR> Concur. I strongly discourage people who ask me (I'm a retired neurosurgical anesthesiologist) about getting one.</comment></comment>


Ask HN: Graduate Java developer, should I get into iOS development? - <AUTHOR>

I have just obtained my B.Sc in Computer Science however I've spent most of my time with Java. I'm currently looking for jobs and wondered whether I should try to get into iOS development (via internship or similar) or to try and find a job with Java development.
Personally, I would prefer to be involved in something new. However as far as I know, most internships pay very little and I'm concerned how I will get by with all the different expenditures (as well as being in debt with a student loan, though that's only 2% or something from your pay-check providing you earn more than 20k per year).
What do you guys think? Is iOS development still growing or is it "too late" to jump into that game? I have some minor Android development too but I haven't found a company for that yet in the regions (Geneva-Lausanne, Switzerland) that I've been looking. <comment><USER2> It could be a useful addition to your repertoire of languages (most employers will recognise the benefit of having experience of some different languages even if they're employing for just one). However personally, I would play to your strengths and if anything concentrate on improving your knowledge of Android, this will likely help consolidate your existing Java knowledge. Even now there are still much more jobs looking for core language experience than mobile.

Java skills are very much in demand, and you are in a good position if you have decent experience of the language - if you do go down that route I would make sure you have some knowledge of Java EE, infrastructure frameworks like Spring and Hibernate and front-end web frameworks like GWT, JSF etc.

You don't say where you are from but I'm guessing the UK - There are usually a few Java jobs to be found in London and Cambridge as well as the M4 corridor areas.

<comment><AUTHOR> I'm actually only looking for jobs between Geneva and Lausanne. My French is quite good but not fluent though I'm able (and have already) to do interviews in French.

Though I'm from London and know there's plenty jobs around here, but not as many in Suisse Romande.

</comment></comment><comment><USER3> Well, if you want to go back to London, there are plenty of Java jobs there. The entire financial industry runs on Java (well, mostly, among other things). So, Java definitely is the safer bet.

Having said that, iOS development might be more fun. So also consider your own interests and aspirations!

</comment><comment><USER4> It's probably too late to write that 'killer app' on iOS (at least without a lot of false starts and near misses), but I know anecdotally that there is still a very high demand for programmers who can write for iOS.</comment>


Xerox PARC Alto filesystem archive - <AUTHOR> http://xeroxalto.computerhistory.org/index.html

<comment><USER2> Hmmm, some of the files in [Ivy]<Poppy> are owned by Rivest -- did he work at PARC? His own Biography and Wikipedia don't say much.

<comment><USER2> Aha! he at least spent a summer there at one point...

</comment></comment><comment><USER3> This is awesome! I love looking at old code like this.</comment>


Digg Warns of Updates - <AUTHOR> http://highfade.com/2008/12/30/digg-warns-of-updates/ <comment><USER2> Maybe they'll finally get OpenID, like they've been claiming for years now.</comment>


Yahoo Hacked - <AUTHOR> http://webcache.googleusercontent.com/search?q=cache:I8s8KmZhwXMJ:www.futuresouth.us/yahoo_hacked.html+&cd=1&hl=en&ct=clnk&client=firefox-a <comment><USER2> Howdy, Hacker News. I'm the CISO of Yahoo and I wanted to clear up some misconceptions.

Earlier today, we reported that we isolated a handful of servers that were detected to have been impacted by a security flaw. After investigating the situation fully, it turns out that the servers were in fact not affected by Shellshock.

Three of our Sports API servers had malicious code executed on them this weekend by attackers looking for vulnerable Shellshock servers. These attackers had mutated their exploit, likely with the goal of bypassing IDS/IDP or WAF filters. This mutation happened to exactly fit a command injection bug in a monitoring script our Sports team was using at that moment to parse and debug their web logs.

Regardless of the cause our course of action remained the same: to isolate the servers at risk and protect our users' data. The affected API servers are used to provide live game streaming data to our Sports front-end and do not store user data. At this time we have found no evidence that the attackers compromised any other machines or that any user data was affected. This flaw was specific to a small number of machines and has been fixed, and we have added this pattern to our CI/CD code scanners to catch future issues.

As you can imagine this episode caused some confusion in our team, since the servers in question had been successfully patched (twice!!) immediately after the Bash issue became public. Once we ensured that the impacted servers were isolated from the network, we conducted a comprehensive trace of the attack code through our entire stack which revealed the root cause: not Shellshock. Let this be a lesson to defenders and attackers alike: just because exploit code works doesn't mean it triggered the bug you expected!

I also want to address another issue: Yahoo takes external security reports seriously and we strive to respond immediately to credible tips. We monitor our Bug Bounty (bugbounty.yahoo.com) and security aliases (email@example.com) 24x7, and our records show no attempt by this researcher to contact us using those means. Within an hour of our CEO being emailed directly we had isolated these systems and begun our investigation. We run one of the most successful Bug Bounty programs in the world and I hope everybody here will participate and help us keep our users safe.

We're always looking for people who want to keep nearly a billion users safe at scale. email@example.com

<comment><USER3> Patched twice? There are 7 known shellshock exploits (and 30 patches) so far.. [https://shellshocker.net/](https://shellshocker.net/)

Not knocking on you or anything, just more interested to know if all exploits have been patched against, more than the # of patches applied.

<comment><USER4> Before Yahoo poached him to be their CISO, Alex was one of the principals behind iSEC Partners, our former arch-competitor and now sister company. He knows what he's talking about. If he says they're on top of shellshock, my money would be on him being right.

His team also recently poached Chris Rohlf, from his own company no less!, and Chris is probably one of the best vulnerability researchers working.

(I have no affiliation whatsoever with Yahoo and while I like Alex fine, we're not close friends. I'm pretty biased about Chris, though.)

This is more "vote of confidence" than your comment asked for; I'm just heading off a potentially unproductive thread at the pass. :)

<comment><USER5> This all sounds good - especially given your reputation for infosec.

However, genuine question - how does the laymen (like myself) rate infosec specialists? Imagine for a second I'm a senior exec at Target and IBN (IBM's fake arch-competitor) comes to me and says "no worries about security, we use 256-bit encryption, bank grade security, etc etc". Do I believe him?

I feel like infosec is a "I don't know what I don't know" industry and the consequences could be potentially dire.

<comment><USER4> If I knew, I'd be a lot wealthier. :|

<comment><USER6> How much are e.g. SANS certifications worth? I subscribe to their vulnerablity emails but they push the certification programs so hard it smells a little like University of Phoenix.

<comment><USER4> I'm not a fan of any security certification.

<comment><USER7> You make hiring decisions off of a home-grown security "course", right? You've found that valuable -- would others?

<comment><USER4> That's not an accurate summary of how we hire. We don't make decisions based on the crypto challenges or Microcorruption; we use them to find people to talk to. We have a whole process that actively evaluates candidates.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> This writeup doesn't really get to the point so, the tl;dr

He was looking for places to exploit shellshock by googling for cgi scripts. Most of the ones he did find had already been hit by someone using a perl script that made them join an irc channel that was being used as CnC. He also joined it and monitored it. A bunch of different yahoo boxes were in the channel and he saw some of them get rooted.

<comment><USER9> Thanks.

This guy writes a lot of text but it takes him forever to get to the point.

<comment><USER10> The point was already in the article title and opening line.

</comment></comment></comment><comment><USER11> Not mentioned in the title, but important:

Winzip.com has been hacked as well. Do not trust their binaries.

Either this will be headline news tomorrow, or it will be suppressed in its entirety. The OP will probably go to prison, unfortunately, as they will not differentiate between this and black hat intrusion - the case will be judged by someone who saw his nephew using a computer, once, and they _will_ go after him, because they know who he is, and will not have any joy identifying the actual intruders, and this will just go further to demonstrate that the spy agency dragnets are as useful as a chocolate teapot in preventing and acting against actual crime.

I hope he contacted a great defence attorney and the ACLU at the same time as Yahoo and the FBI.

<comment><USER12> Contrary to his claim, OP is clearly not a white hat "ethical hacker", since he does not have consent from the owners of any of these systems.

> they will not differentiate between this and black hat intrusion

Should they? This reads like textbook unauthorized access to a computer system,

> A quick `ps aux` on the box yielded...

This isn't just poking at web servers to see what secrets they freely reveal, this is trespass.

<comment><USER13> Trespassing is a good analogy. Neither all laws or violations of laws are equal.

On one hand, there are the vandals, or outright criminals, who are using and abusing my property for their gain to my detriment.

On the other hand, there's a passerby who knows about the criminals in the area, knows no one else is looking for them, and trespasses my property because the trail led him onto it.

Now that guy willingly alerts me to the criminals, offers an explanation of what he did on my property and how he found the criminals -- what should my response be?

I know that technically he broke the law, and there are those who want to see anyone and everyone pay for their deeds, but in this situation, wouldn't a reasonable person possibly consider tracking down the criminals first before crying "trespassing!"

<comment><USER14> It doesn't sound like this person trespassed at all, but merely traversed your land during his investigation. He didn't do any damage or remove anything, so what was the trespass?

<comment><USER15> Trespass to land doesn't require damage, all it requires is the willful, unauthorized, entry onto land in another's exclusive possession. Vandalism requires that there by some property damage.

<comment><USER16> This isn't true. You're overestimating the strength of property rights to land. You should follow the link provided elsewhere in this branch of the discussion - [http://www.shouselaw.com/trespass.html](http://www.shouselaw.com/trespass.html)

<comment><USER14> It's amazing how many people think that traversing and trespassing are the same thing. Sadly, in many states, they are the same under the law.

I wish there were stronger free-to-roam laws. I don't think anybody has the right to tell another person they can't traverse land so long as they don't enter any structures, do any damage, take anything, disturb any wildlife, etc.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> Frick. A .pl CGI script on a production box?

All the yapache & yphp security fixes and is all undone by a a .pl with +ExeCGI.

They used to run "crack days" where all of us used to get kicks out of breaking & entering prod, whatever means available.

Was a fun way to weed through such low-hanging issues, by a highly motivated (i.e otherwise bored) crowd.

I wonder if they still have them.

<comment><USER18> Golly. Who was this "they" and "all of us"?

<comment><USER19> People who use the word "frick" or "frickin'".

</comment></comment></comment><comment><USER20> Am I the only one that thinks this kind of thing would be cool to see? I've seen logs of attacks, but I've never watched a botnet irc live. that would be crazy for me. Not really moving the conversation forward, but is this so commonplace that I'm the odd man for marveling?

<comment><USER21> :) You're not the only one.

First, read this. Note the date. [http://www.crime- research.org/library/grcdos.pdf](http://www.crime- research.org/library/grcdos.pdf)

I read that shortly after it was originally published. And I thought to myself: COOL!

I was seventeen. I had a spare Windows 95c (or was it 98se?) box laying around, and some experience with inctrl5, a linux box which could operate as a router, and some basic knowledge of tcpdump(1). Importantly, I could also script the behavior of an IRC client.

At the time I was a channel operator in a relatively popular IRC channel on EFnet... "Don't ask to ask!" :) Users would come in and request assistance with malware all the time, so I was already roughly familiar with the mechanisms of infection and CnC.

This is a long story that I must cut short: I ended up in the same CnC room as Gibson did. Not the same type--the same one. I met some of the people in the story. :D

<comment><USER22> Do you still idle in that help channel?

<comment><USER21> Not for a while. I'm Sebboh. :)

</comment></comment></comment></comment><comment><USER23> Mirror of the response, since the site is loading really slow:

[http://cl.ly/image/2E3D2H2B2d2t](http://cl.ly/image/2E3D2H2B2d2t)

<comment><USER24> Classic. "Thanks for pointing out this insanely serious issue, which is unfortunately not eligible for our bug bounty program." Maybe they'll send him a free hat.

<comment><USER25> Embarrassing. People should just sell their zero-days on the black market for BTC until these companies wise up on paying out on "non-qualifying" bugs. Facebook has done this too.

</comment></comment></comment><comment><USER26> "Though the FBI seemed intrigued by this, in my opinion, they aren't moving with any form of haste."

I am doubtful that FBI would share their plans and/or actions with OP.

<comment><USER27> Exactly. It's not like they're going to call up the OP to give him status updates.

</comment></comment><comment><USER28> This guy works in the security industry and yet he couldn't google "yahoo security" to find their security contact email address (second result for me)? He was also unaware that Yahoo runs a Bug Bounty Program?

<comment><USER29> According to this[1] article about the current issue:

"Before releasing this information, Hall emailed Yahoo and tweeted at its engineering team and CEO Marissa Mayer.

It was confirmed to him that its servers had been infiltrated but Yahoo refused to pay him for alerting them as it was not part of the company's bug bounty programme."

[1]: [http://www.independent.co.uk/life-style/gadgets-and- tech/new...](http://www.independent.co.uk/life-style/gadgets-and- tech/news/shellshock-romanian-hackers-are-accessing-yahoo-servers-claims- security-expert-9777753.html)

EDIT: The quote previously included "Yahoo is notorious for its disregard of bug bounty hunters, having last year rewarded one such hacker who identified three bugs in Yahoo's servers with a $25 voucher for company merchandise." but I moved it here as it caused confusion regarding which issue the article was referencing.

<comment><USER30> Please read the follow up:

[http://yahoodevelopers.tumblr.com/post/62953984019/so-im- the...](http://yahoodevelopers.tumblr.com/post/62953984019/so-im-the-guy-who- sent-the-t-shirt-out-as-a-thank-you)

(and HN discussion: [https://news.ycombinator.com/item?id=6488897](https://news.ycombinator.com/item?id=6488897))

</comment></comment></comment><comment><USER31> This is a courageous disclosure since the OP risks to be in some trouble for his "ethical probing".

<comment><USER21> In the winzip email, he rambles about his mother.

Which makes his signature line pretty interesting. :)

> _A fool learns only from himself. A wise man will learn from the fool._

So he's got this 'honest fool' thing going for him. If he can marry that with meticulous record keeping, maybe he'll be OK.

Of course, IANAL.

But ffs, I'm sick of this world where the defense "Wait, you misunderstand-- I'm the GOOD guy!" isn't good enough. Why isn't it?

<comment><USER32> Well, mostly because if it was good enough, it would be the first thing out of the mouth of every blackhat that was caught...

Or to put it in a slightly more nuanced fashion, as a blackhat I could compromise your system, and then turn around and inform you that your system was being compromised _whilst at the same time profiting from any data I had already stolen_. If the company being contacted does not personally know the person contacting them, it is not altogether unreasonable to treat the person with great suspicion.

That said, people that _do_ have a public reputation for white-hat work probably deserve to get a pass. This of course raises the question of how you go about getting a whitehat reputation, because most whitehats get their rep by doing the same things the blackhats do, without the profit motive.

<comment><USER33> > Or to put it in a slightly more nuanced fashion, as a blackhat I could > compromise your system, and then turn around and inform you that your system > was being compromised _whilst at the same time profiting from any data I had > already stolen_.

Which provides a perfectly reasonable way to distinguish the white hat from the black hat. The black hat is the one making fraudulent charges to stolen credit cards, or selling social security numbers, etc.

<comment><USER32> " a perfectly reasonable way to distinguish "

Well no, not really. After all, the blackhat isn't telling you that they're also busy selling your data to someone. And even if you are aware that the data is being sold, the blackhat can claim that it must be another intruder using the same flaw, and geez, you really should fix that!

<comment><USER33> If the data "is being sold" then go arrest whoever is selling it. This is basic police work. Someone is making fraudulent credit card charges? Go nab the guy when he goes to pick up the merchandize, then turn him against whoever provided the credit card numbers (if it wasn't the same person).

Doesn't that make a lot more sense than charging anyone who cuts across your lawn with grand theft just because someone engaged in grand theft might cut across your lawn?

</comment></comment></comment></comment></comment></comment><comment><USER34> Mass scanning using ping back for shell shock was controversial. Starting a remote shell would seem to cross the line.

</comment><comment><USER35> Is this a new phenomenon? I always felt that Yahoo's systems weren't secure. Until I shut down my Yahoo accounts, it would be a semi-regular occurrence for both my Yahoo email and IM to send out spam to everyone in my Yahoo contacts list. Am I wrong? I've since shut down my account since I got sick of dealing with it.

<comment><USER36> That's not a Yahoo hack though. When that happens it is almost always your local machine that has been breached by a virus which simply reads the locally stored contact list. And to answer your question, no, it is not a regular occurrence for Yahoo, or any of the major players, to have their servers hacked.

<comment><USER35> To my knowledge, my machine is secure. It wasn't Windows and I had both anti- virus and a firewall active. For one thing, what made this strange was that I haven't even logged into Yahoo for months (probably close to a year) when this happened, repeatedly.

<comment><USER37> Another possible explanation is password reuse on a site that was breached.

<comment><USER35> I don't reuse my passwords.

</comment></comment></comment></comment></comment><comment><USER38> [http://webcache.googleusercontent.com/search?q=cache:I8s8KmZ...](http://webcache.googleusercontent.com/search?q=cache:I8s8KmZhwXMJ:www.futuresouth.us/yahoo_hacked.html+&cd=1&hl=en&ct=clnk&client=firefox-a)

futuresouth.us got Hacker News'd this morning.

</comment><comment><USER39> Here's a much shorter version that explains things in a less technical way... [http://milankragujevic.com/post/65](http://milankragujevic.com/post/65)

</comment><comment><USER40> A pretty interesting read, despite the occasionally challenging style. If the email to Mayer had been a little more focused then perhaps it might have punched through. But in any case, kudos to the author for doing the work and writing it up. I learned a few things. But at the same time, no kudos for using what might be the most unfortunate metaphor ever. I suggest avoiding any future attempts at picturesque description.

</comment><comment><USER41> Server seems to be having trouble keeping up with all the requests, so in the meantime please use the Google's Cache[1] of the page

[1]: [http://webcache.googleusercontent.com/search?q=cache:http://...](http://webcache.googleusercontent.com/search?q=cache:http://www.futuresouth.us/yahoo_hacked.html)

</comment><comment><USER42> I wonder what best practice is for consumer websites which have domains like yahoo.com which has mostly customers, and yahoo-inc.com for corporate, for things like security@ addresses. It's reasonable someone wouldn't know about yahoo-inc.com.

<comment><USER43> BCP is for domains to have abuse@, which for Yahoo.com should be tied into their corporate security and intelligence group.

[https://www.ietf.org/rfc/rfc2142.txt](https://www.ietf.org/rfc/rfc2142.txt)

</comment></comment><comment><USER44> Why didn't he use Shellshock to update bash on the vulnerable servers?

<comment><USER45> That would be illegal, unfortunately. If we could do that the internet would be a much cleaner place for sure.

<comment><USER46> What he's been doing is illegal too anyway...

</comment></comment></comment><comment><USER47> Why is this a link to a cached version of the website?

<comment><USER47> Ah nevermind, found the answer below. The site had problems handling HN traffic earlier.

</comment></comment><comment><USER48> Wow, Lycos is still around?

</comment><comment><USER49> So when is Marissa Mayer's getting fired?

</comment><comment><USER50> They got owned by shellschock? Common Yahoo, really?</comment>


Why Write Python in Visual Studio? - <AUTHOR> http://blogs.msdn.com/b/visualstudio/archive/2015/08/03/why-write-python-in-visual-studio.aspx <comment><USER3> I write Python professionally, and it will be pretty hard to get me away from PyCharm. I don't see anything in the blog post that indicates a feature PyCharm doesn't already have.

<comment><USER4> > a feature PyCharm doesn't already have

It's free.

I'm sure there are a lot of Python developers who already have a full-featured IDE they love, but then there are also people (like me) who sometimes write Python and just use Sublime Text or Vim. Or even Eclipse.

<comment><USER5> JetBrains released a free community version:

[https://www.jetbrains.com/pycharm/download/](https://www.jetbrains.com/pycharm/download/)

<comment><USER6> They also provide a free 1 year educational license for all of their products to students.

<comment><USER7> As well as discounts if you're a student. IIRC I paid like 25$/year when I was still a student. Easy money to pay with such an awesome product!

</comment></comment></comment></comment></comment><comment><USER8> I've been using PTVS for about two weeks now. Previously I just used Spyder which shipped with the Anaconda distribution.

Some things that annoy me:

\- Reading intellisense python documentation in the mouse over window is really tedious. There is an object window that can display documentation for your classes, but not from libraries.

\- Rendered docs are much easier to read. Spyder did this very well. With PTVS I'm looking at the docs online for numpy and matplotlib. With spyder I just ctrl+I and it displays using sphinx very nicely.

\- I was not able to get IPython to cooperate with displaying plots in separate windows in executing scripts as easy in PTVS compared to Spyder.

\- Being able to commit and push to github is a great feature.

\- Spyder had superior debugging features in terms of examining array data throughout the debug process. Make plots just by right clicking the object in the variables window. Very useful for making sure a step for a scientific algorithm is doing what I intended.

I'm hoping more features like the above will be added over time. However I'm looking at going back to Spyder + some git plugin or tool, or switching to PyCharm.

<comment><USER9> I am Chris Wilcox, one of the developers on Python Tools for Visual Studio. I am happy you have tried the product and glad you took the time to provide some feedback. We have some pretty decent GitHub support built in to Visual Studio and our tooling. With Visual Studio 2015 we also have a nifty 'Open in Visual Studio' button added to all GitHub pages.

As for the other things they aren't complete yet but they are definitely very valid suggestions. If you would file issues on [http://github.com/Microsoft/PTVS](http://github.com/Microsoft/PTVS) we can track them and hopefully keep you posted on the progress to getting them into the product.

<comment><USER10> Any chance to change the license over to GPL?

<comment><USER9> Short Answer: No. Longer Answer: We are currently licensed as Apache 2.0 and are satisfied with the constraints of that license. Virtually all products released at Microsoft as OSS are released under MIT or Apache 2.0. We haven't had issues with the license we are using and have no plans to change it.

Thanks for your feedback! Also, I hope you enjoyed PyData Seattle! (just came across your Twitter handle and noticed a few photos)

</comment></comment></comment></comment><comment><USER11> I've met Steve and his team mates at the last PyCon - the team is very knowledgeable, approachable, and most of all enthusiastic about their project.

Having been using Python professionally for about 8 years now, i've been playing with PTVS and finally think its ready for public consumption - <USER2> you've tried it more than 9 months ago, be sure to try again - it is lightyears better, especially when it comes to things like remote debugging and managing venvs.

Documentation is still a bit lacking here and there when it comes to getting PTVS to play nicely with other debuggers like pdb and werzkeug, but overall, i cant wait to see the project and the team continue on this effort.

</comment><comment><USER12> I'm a .NET developer so to me this is a slam dunk. How does the Python crowd feel though? I'd guess the majority tend to be Microsoft-adverse. Why wouldn't you use VS when it seems to be so ahead of the competition?

<comment><USER13> IntelliSense is pretty good, sure, but emacs is a superior development environment in nearly every other aspect.

<comment><USER12> I've never used emacs so am completely ignorant. What makes emacs superior? All I know is the speed that can come with keyboard shortcuts.

<comment><USER14> That, and the fact that it's very easy to extend it with Emacs Lisp. I know that it's possible to write extensions for most of the IDEs or text editors out there, but the degree of customization is higher with emacs, mainly because emacs is basically couple of primitive functions written in C + a lisp interpreter (also written in C) and the rest is written in lisp, so you have access to everything emacs has to offer if you want to customize it.

<comment><USER15> Its way easier to extend Eclipse by adding one of the plugins.

<comment><USER14> Emacs has also plugins, and I would argue that it's way easier to write your own plugins for emacs than for eclipse.

</comment></comment></comment></comment></comment></comment><comment><USER16> For those who have used this:

\- Does it perform better than PyCharm?

\- How is Windows working for you as an OS (to develop Python on)?

<comment><USER17> I've not used this, but about the second bit:

I've developed a few pieces of software on Windows and by far, the most painful thing I had to do install Visual Studio Express to compile some of the C extensions. I used Pycharm on Windows, so it pretty much abstracted away tasks like making virtualenvs, setting up environment variables, etc.

<comment><USER18> You're definitely right, sometimes you do need to install odd stuff on Windows to get certain Python packages to work.

It has seemed to get better lately. I usually use Windows, and I've been getting along great lately with Python dev work.

</comment></comment></comment><comment><USER19> I work at a .Net shop and wanted to build a developer tool with python for my colleagues. None of them have a python interpreter so it needs to compile to an .exe I've googled for hours on how to do this with IronPython but the information is incredibly sparse and outdated. Is there any way to do this currently?

<comment><AUTHOR> Perhaps this will point you in the right direction: [http://www.decalage.info/en/python/py2exe](http://www.decalage.info/en/python/py2exe)

<comment><USER19> Thanks, I'd like to integrate with .net though, maybe with WPF. That's why I'd like to use IronPython.

Any MS / Python people?

</comment></comment></comment><comment><USER20> If you want to get a feel for what PTVS is like, you can watch these short videos:

[https://www.youtube.com/playlist?list=PLReL099Y5nRdLgGAdrb_Y...](https://www.youtube.com/playlist?list=PLReL099Y5nRdLgGAdrb_YeTdEnd23s6Ff)

10k foot view web page: [https://www.visualstudio.com/en-us/features/python- vs](https://www.visualstudio.com/en-us/features/python-vs)

if you want to get a feel for an advanced feature, try:

[https://www.youtube.com/watch?v=wvJaKQ94lBY](https://www.youtube.com/watch?v=wvJaKQ94lBY)

</comment><comment><USER21> I was going to write a little client library for a REST API my city's transport system exposes, and I think I'll try this out on my gaming PC, rather than my intended plan of writing it on my Macbook.

My worry is it's going to create VS-specific files, which I'm adamantly opposed to (or any IDE-specific files, for that matter). We'll see, though. I guess I tolerate the .idea directory already, I just don't want to _depend_ on the VS files, similarly to how I have a .gitignore line for .idea currently.

I can't be sure if it's because I already had cygwin installed on my PC prior to my upgrade to 10, but I'm very pleased with the updated cmd.exe. I _think_ I recall ctrl C/P working as expected too!

Right now I'm dealing with a weird encoding issue when I SSH to my Ubuntu box from CMD.exe, but I'm sure it's just a setting somewhere I've got to tweak.

<comment><USER9> I am a developer on PTVS.

TL;DR - We do have project files but are working to remove that necessity.

First, we do have some VS specific files, namely SLN and PYPROJ files. These are unfortunately needed for us to manage your project. We do hope to not need these in the future but we currently need them due to the project system we use in Visual Studio. We do hope to replace this with a different solution eventually.

The good news is these files are easily generated and do not need to be saved. If you go to File>New>Project>Python>From Existing Python Code you can generate these by giving a folder.

Second, As for the SSH troubles, CMD has been given an overhaul for Win10 and I suspect you are seeing the effect of that. I know they handle encodings differently now so that is probably the issue. I know I have seen some things render a bit strange since my transition to Win10 last week.

</comment></comment><comment><USER22> Prior to Python I used to work with Visual Studio (C# and VB) and loved it - especially the ease of designing great-looking GUIs and ease of access to API documentation.

But the half-baked integration of VS with Python or IronPython, and the slow/clunky evolution of PTVS has put me off Microsoft tooling for good. Python is a great language for nimble development - locking yourself in to Microsoft's whim messes up with that, unfortunately.

</comment><comment><USER23> I like VS but is this fundamentally better than PyDev? I've become accustomed to Eclipse so I get auto-complete and full interactive debugging already.

<comment><USER12> In my experience (C# & Java), Eclipse's autocomplete doesn't even come close to Intellisense. Not sure if that gap is any different with Python.

</comment></comment><comment><USER24> Fantastic. I was on the fence about lookng at Python in my spare time. Now I'm bound to do it at some point. VS is amazing.

</comment><comment><USER25> Last time I tested PTVS, running any simple script was 100x slower than running it within Wing IDE (professional) which I was I used 99% of the time. This pretty much killed the idea of using Python in VS, unfortunately (for me anyways).

<comment><USER20> hi smortaz, project lead for PTVS. i'd love to get a pointer to the script (or repro). this should definitely not be the case! sorry about your experience.

</comment></comment><comment><USER26> I have two questions in my head:

1.) Is the foundational work that has gone into this going to be used to help support intellisense in other languages in the future?

2.) Will any of this make it into Visual Studio Code?

<comment><USER27> Python had intellisense support both officially (through MSFT) and non- officially through community addins since VS2003, MSFT has support since 2005 with working examples.

VS Code doesn't really have "intellisense" it's a nice fork of ATOM but considering just how much of an amazing development environment VS is i feel like having Code under the same brand devalues it quite a bit.

Visual Studio also has support for Ruby, Node and virtually every other language out there from LoLCode to Scala the only real downside of VS is that it's not multi-platform, but outside of Silicon Valley you won't find that many software houses that develop on Mac's or Linux machines that often either.

<comment><USER28> >but outside of Silicon Valley you won't find that many software houses that develop on Mac's or Linux machines that often either.

That's patently untrue - Linux is extremely, extremely popular all over India. All major laptop manufacturers (Dell, Lenovo, Asus, Acer) sell laptops with pre-installed Linux.

Unfortunately, Macs are getting pretty popular here - even though they are double in cost.

</comment></comment></comment><comment><USER10> And one really great reason not to use it, the license. At any point they can yank it away from you, why invest time into learning something like that?

<comment><USER29> They have made at least two attempts to do that in the past as well with dropping the cheap versions of visual c# 2003 and then trying to yank the desktop version of visual studio 2013 express so a fair observation.

Plus I think you have to sign in now to maintain your license in community edition and the SDK is no longer standalone.

</comment></comment><comment><USER30> Indeed - Why??

IronPython. Might trick me once... won' let u trick me twice.

<comment><USER31> I hadn't really gotten into Python in the heyday of IronPython. Can you explain why you don't like it?

<comment><USER30> No bumpy, version lag, win only. Basically incomplete.

<comment><USER30> sorry meant "Numpy" there. don't know why it came out "bumpy". Probably my mobile keyboard.

</comment></comment></comment></comment><comment><USER32> I don't want to be forced to login to software before I use it. Also, Microsoft can't be trusted. Look at the keylogger in Windows 10, for example.

PyCharm is a good Python IDE. You can get a lot of these features in Emacs (or try Spacemacs), or Vim, or Sublime (with plugins).

<comment><USER33> You mean the "keylogger" than only tracks search queries & auto-correct to better optimize algorithms, which Google and Apple both do. Sure.

You also don't -have- to sign in. So your post is just nonsense.

<comment><USER32> You don't have to sign in to use Visual Studio? I've downloaded it twice and didn't see a way to use it without signing in. If it's there, it's hidden.

Windows 10 sends your typed text to remote servers. That's a keylogger. You can opt out, but most users won't. Other companies do it and I criticize them too.

<comment><USER34> If I'm using Windows 10 and I type my credit card number in to a text input field, is that sent to MS?

Or, as partiallypro says, are they only sending the contents of e.g. browser search fields?

If the answer to the first question is yes, then this is a keylogger. If partiallypro is correct, then calling it a keylogger is disingenuous. By that logic you could call my mail client a keylogger, because it saves drafts to a folder on an IMAP server.

<comment><USER32> If I type something into my computer, and I do not explicitly opt-in for that data to be sent to a remote server, it is keylogging.

If a company records my keystrokes (even if just in part of the software, excluding credit card numbers) and sends my input to a remote server in order "to help serve you better, show you ads, and share with our trusted partners", words like keylogger and spyware are appropriate.

<comment><USER34> I think this approach dilutes the meaning of the term keylogger.

For example, Google sends your keystrokes as soon as you start typing in the search box, and uses this for autocomplete. Presumably you didn't read the full T&Cs before you started typing your search query, so by your logic this is a keylogger. But I think most people would make a distinction between this and a "traditional" keylogger.

Just for the record - I'm not condoning this behaviour or arguing that it is desirable.</comment></comment></comment></comment></comment></comment>


It's Impossible to Prove Your Laptop Hasn't Been Hacked - <AUTHOR> https://theintercept.com/2018/04/28/computer-malware-tampering/ <comment><USER2> If you're a target of a major intelligence agency, I think that you have to assume that all of your computers are irretrievably compromised. From Vault 7, we know that the CIA has long developed implants to infect both the EFI and hard drive firmware that load before any potential code that could detect them. These could be made arbitrarily hard to detect without physically opening the computer and dumping these flash devices and comparing them against a known good image. Who knows what other embedded processors with a little bit of flash lurk in various peripherals in your laptop that they've figured out how to wheedle their way into... If the flash is integrated into the microcontroller itself, there may not even be an easy way of reliably dumping its contents.

<comment><USER3> I think you are absolutely correct with your assessment. I recall Alan Cox (welsh bloke, big beard, Linux kernel hacker (well: simply hacker in general will do)) posting on G+ about someone booting enough Linux on a hard disc to get a prompt. No not the disc itself, off the firmware on the controller.

You may also like to consider that nearly all modern server systems have an iLO/iDRAC or whatever that can do all sorts of things, and at least one internal USB interface. PCs can have the Intel ME and other horrors. The best you can hope for is that it is only your local intel. agency that potentially have routine access to your system.

<comment><USER4> [http://spritesmods.com/?art=hddhack&page=1](http://spritesmods.com/?art=hddhack&page=1)

<comment><USER3> Thanks for that. Its always nice to read up on a really good hack or be reacquainted with one and this is a belter.

</comment></comment></comment></comment><comment><USER5> If you care about this, then put the laptop in a tamper-evident bag. Those are necessarily imperfect too; but there's work making tamper-evident seals to resist up to state-level attacks, since that's relevant in stuff like enforcement of nuclear weapons treaties. That succeeds to the extent that you can find a physical effect that's easy to create and measure, but hard to recreate deterministically. (In concept, dump a pile of glitter over your thing. The effort to dump the glitter, take two pictures, and compare is small. The effort to recreate a given glitter distribution flake by flake is large. Likewise for laser speckle from random rough surfaces, and many other effects.)

You could check a laptop for malware later by reading out literally every bit of nonvolatile state, including the BIOS and stuff, and confirming that all changes had expected form (to files you meant to work on, etc.). Of course, then you have to trust the equipment you use for that...

A little weird that he ran the experiment. Did he really suspect that malware was routinely getting installed by attackers with physical access to laptops during business travel? If yes, then why didn't someone notice it calling home or whatever?

<comment><USER6> > If you care about this, then put the laptop in a tamper-evident bag.

How does this procedure work for multiday evil maid situations? The first day while you're out the maid replaces your collection of plastic disposable tamper-evident bags with faulty ones that open with a particular chemical but otherwise look identical. The second day the maid tampers with your laptop and you don't notice. Do you just have to take the whole box of additional bags with you everyday? That seems prohibitively inconvenient.

<comment><USER5> If this were a job interview, then I'd say "put the spare bags in with the laptop"...

Or the "bag" can be the laptop's existing case. You can put seals (stickers, or the sparkly nail polish trick mentioned below) over all the fasteners and seams of the laptop, fill all the non-power ports with epoxy, etc. None of these make tampering impossible, but they can make it uneconomic.

I don't think anyone at serious risk of these kinds of attacks lets computers out of their physical control. I've seen agencies that do the seals/epoxy even for computers inside their secure facilities, presumably to give their guards more time to catch an inside tamperer.

</comment></comment></comment><comment><USER7> An excellent companion-read to the linked article is: [http://ansuz.sooke.bc.ca/entry/23](http://ansuz.sooke.bc.ca/entry/23)

It builds up a concept of "Colour" as describing information _about_ a thing (distinct from metadata / tagging) which is not necessarily derivable from the thing itself. Most frequently it uses the term to describe _provenance_ , but is careful not to limit the concept. To quote the ansuz' essay above in relation to the linked article:

 _When we use Colour like that to protect ourselves against viruses or malicious input, we 're using the Colour to conservatively approximate a difficult or impossible to compute function of the bits. Either our operating system is infected, or it is not. A given sequence of bits either is an infected file or isn't, and the same sequence of bits will always be either infected or not. Disinfecting a file changes the bits. Infected or not is a function, not a Colour. The trouble is that because any of our files might be infected including the tools we would use to test for infection, we can't reliably compute the "is infected" function, so we use Colour to approximate "is infected" with something that we can compute and manage - namely "might be infected". Note that "might be infected" is not a function; the same file can be "might be infected" or "not (might be infected)" depending on where it came from. That is a Colour._

Once you've left your computer alone with a potential adversary, it has the might-be-compromised Colour. Proving whether it definitely has or has not been compromised is easy for devices which do not have this Colour, but as described in the linked-to article, very difficult or impossible once it has this Colour.

</comment><comment><USER8> I'm calling this a bad test in general.

Let's be honest here. None of the more cutting edge attacks are going to be risked by attacking. as hard a target as this guy. The level of sophistication of attack the author is starting to reach is going to be reserved for state- level persons-of-interest.

Espionage is a game of judging capabilities, and cracking some security researcher's laptop telegraphs to the rest of the world that you can. As a national actor you don't actually WANT to flex your spy muscles in obvious ways unless the payoff is JUST THAT CRITICAL. It removes the veil of the unknown, and gives potential adversaries/persons-of-interest that much better a chance of successfully applying tradecraft to hide what you actually want to monitor because they have more accurate knowledge of what your capabilities are. Contrary to popular belief, most organiztions capable of pulling an evil maid attack simply won't because of the revelation of capability already mentioned, and the PRISM problem. Too much information/access in general lends itself to becoming useless due to the difficulty of separating the tasty bits from the mundane.

Kudos to the guy for actually trying the experiment, but it doesn't really tell anyone anything we didn't already know 20 years ago.

Computers are inherently insecure. Every form of "security" is insecure at some point. Computers haven't changed anything except for making a person's computer a juicy target to get some juicy financial information/passwords for non-state actors, or making surveillance potentialities so much more horrifying on account of the ubiquity of networked cameras, sensors, and microphones on the ground waiting to be exploited.

Forget about laptop evil maid attacks. Start thinking about the ticking time bomb of 'poisoned' hardware rife with 'tailored access' whereby state actors can push a button and have every device with a camera/microphone within a certain set of GPS coordinates start silently acting as an input sensor. Combine that data stream with the right neural networks, and you'll see a world that no one in their right mind wants, but is well within our manufacturing capabilities to create.

Or stop worrying, go outside, and make a friend. It's way better for your mental health.

<comment><USER9> Yeah, have fun, ball til you fall, go all out, maximize the moment - and give thanks.

</comment></comment><comment><USER10> While this is focused on hardware and physical access, it would seem that it's the same for software. You don't know if someone has control over it remotely, through any number of means (browser, downloaded software, installed professional software with backdoors, software with unreleased vulnerabilities, etc.). Even airgapped machines can be compromised (Stuxnet, TEMPEST).

Even if you built all the binaries from scratch from the official repos, you'd still be at risk of security bugs like heartbleed, or a compromised compiler.

In the end, I think security is always a numbers game. Someone can always get to your protected resources, it's just a matter of how much the attacker wants it.

It's easier to attack a resource than defend it.

[https://en.wikipedia.org/wiki/Stuxnet](https://en.wikipedia.org/wiki/Stuxnet) [https://en.wikipedia.org/wiki/Tempest_(codename)](https://en.wikipedia.org/wiki/Tempest_\(codename\)) [https://en.wikipedia.org/wiki/Heartbleed](https://en.wikipedia.org/wiki/Heartbleed)

</comment><comment><USER11> "But given that current defenses against detecting processor-level backdoors wouldn't spot their A2 attack, they argue that a new method is required: Specifically, they say that modern chips need to have a trusted component that constantly checks that programs haven't been granted inappropriate operating- system-level privileges. Ensuring the security of that component, perhaps by building it in secure facilities or making sure the design isn't tampered with before fabrication, would be far easier than ensuring the same level of trust for the entire chip."

They admit that implementing their fix could take time and money. But without it, their proof-of-concept is intended to show how deeply and undetectably a computer's security could be corrupted before it's ever sold. "I want this paper to start a dialogue between designers and fabricators about how we establish trust in our manufactured hardware," says Austin. "We need to establish trust in our manufacturing, or something very bad will happen."

[https://www.wired.com/2016/06/demonically-clever-backdoor- hi...](https://www.wired.com/2016/06/demonically-clever-backdoor-hides-inside- computer-chip/)

<comment><USER12> It seems that you posted your comment on the wrong article.

</comment></comment><comment><USER13> Thesis: it is possible that someone may access your laptop without you knowing if you leave it unattended.

Experiment: after having gone through a number of - some meaningless[1] - attempts to be able to proof that this happened, there was no evidence it happened.

Doubt: did it happen nonetheless without leaving any trace ot it din't actually happened at all?

Bonus: the experimenter learned that NVRAM exists in the stupid UEFI firmware

Conclusion: None worth mentioning, but be very aware of what the terrible evil maids can do, and do use the recommended Android app to defend against them.

[1] Hashing a whole hard disk is only a "positive" proof, if the hashes correspond nothing changed, but it is very possible that the hashes change because of _any_ filesystem or disk issue if the system is used, so the method is pointless in the real world, where people bring with them a laptop in order to use it.

<comment><USER14> >Thesis: it is possible that someone may access your laptop without you knowing if you leave it unattended.

This is known to be true, this experiment was about seeing if anyone would access this laptop. Which also addresses what you view as meaningless, real world scenarios are trying to avoid their laptop being compromised while the author was hoping that it would.

<comment><USER13> I know that it is true, it is actually a truism.

The "experiment" has too few data points to be meaningful, and the proposed way to verify remains meaningless, two simple cases:

1) the evil maid simply makes a forensic image of the disk

2) a sector in the hard disk goes bad

Case 1: there was an intrusion, all the data was stolen, but the hashes do not show that (false negative)

Case 2: there was NOT any intrusion, but the hashes show that there was a change (false positive)

<comment><USER14> >The "experiment" has too few data points to be meaningful, and the proposed way to verify remains meaningless, two simple cases:

This isn't science, we know this is possible and the "experiment" was to try and find examples of it happening.

A false negative is always assumed, it is impossible to know you haven't been compromised. A false positive is meaningless as finding a change is only the first step. You then need to analyze what the change is, and if you can't pin down what has been compromised you're just back to the default state of unaware.

This is a honeypot. If you leave your honeypot and return to an empty one, you're pretty sure a bear is around but can't do anything. If you find a bear with their paws in the pot, you don't need to run the experiment again to prove there's a bear.

</comment></comment></comment></comment><comment><USER15> I run a dual-boot Debian + Windows 7 laptop, but my default position is to assume the Windows partition is exploitable, so for secure activities I boot Debian.

That boots using an unencrypted /boot partition, but everything else running on luks (one big partition, LVM'd down). I have a VeraCrypt partition which is for files that I want to work on from both operating systems. Works really well, crypted disks doesn't materially impact performance, and gives peace of mind.

The most likely scenario for theft is someone after the hardware, and they'll not spend much effort trying to break into the file system.

I'd be wary if the machine was stolen and then returned, but restoring mbr & /boot partition should be sufficient in that instance.

I've travelled to regions that I considered dubious, if not especially technically sophisticated. I haven't done this, however research suggested the best way of confirming your laptop hasn't been opened is to use a sparkling nail varnish. Dab a small amount on some or all of the case screws, take a close-up photo, store that photo somewhere safe. After the event, take photos of the screws again, and compare. The random patterns are effectively impossible to replicate.

Combined with disabling USB booting, and BIOS admin password, and keeping the OS in sleep -- it _should_ be possible to prove your laptop hasn't been hacked via physical intrusion.

<comment><USER16> > but my default position is to assume the Windows partition is exploitable

In reality, as the article explains, the windows partition is basically invulnerable to this class of attacks if you take the 5 minutes to enable bitlocker. OTOH Linux systems have no effective defense.

<comment><USER17> BitLocker stores your encryption keys on a Microsoft server [1] and is a closed-source software, therefore by definition it cannot be trusted for encrypting anything important. (It is wrong even if your adversary is not a state, because that way you are getting used to a false sense of security that you don't actually have.)

[1] [https://theintercept.com/2015/12/28/recently-bought-a- window...](https://theintercept.com/2015/12/28/recently-bought-a-windows- computer-microsoft-probably-has-your-encryption-key/)

<comment><USER18> It's an option to store your keys on their server, but not a requirement. At least not the last time I set up BitLocker. In fact that computer didn't even have the on board Secure Storage thing that it prefers, so I had to make a note of the recovery key on paper.

</comment></comment></comment></comment><comment><USER19> QubesOS Anti Evil Maid: [https://blog.invisiblethings.org/2011/09/07/anti- evil-maid.h...](https://blog.invisiblethings.org/2011/09/07/anti-evil- maid.html)

 _> The adjective trusted, in trusted boot, means that the goal of the mechanism is to somehow attest to a user that only desired (trusted) components have been loaded and executed during the system boot. It's a common mistake to confuse it with what is sometimes called secure boot, whose purpose is to prevent any unauthorized component from executing._

</comment><comment><USER3> _Computers that support "secure boot" or "verified boot," such as Chromebooks and Windows laptops with BitLocker, aren't vulnerable to this. The BIOS can detect if the unencrypted part of your disk has been tampered with, and if it has, it will refuse to boot. MacBooks and laptops that run Linux could potentially be attacked in this way._

Really?

(Search terms used: "secure boot linux" and "secure boot macbook")

[https://www.linuxjournal.com/content/take-control-your-pc- ue...](https://www.linuxjournal.com/content/take-control-your-pc-uefi-secure- boot)

[https://www.macworld.com/article/3246208/macs/how-apples- sta...](https://www.macworld.com/article/3246208/macs/how-apples-startup- security-utility-and-secure-boot-works.html)

<comment><USER20> Also curious about Linux vulnerabilities to this particular attack - any Linux wizards in thread?

<comment><USER21> Not a Linux wizard but as a long time user, I remembered this 2012 news from Canonical: [http://blog.canonical.com/2012/06/22/an-update-on-ubuntu- and...](http://blog.canonical.com/2012/06/22/an-update-on-ubuntu-and-secure- boot/)

Perhaps the author meant there was no 'universal' Linux implementation, however it's been available for a while in certain distros.

</comment></comment></comment><comment><USER22> Had to register to share this oldie but goodie:

[https://spritesmods.com/?art=hddhack](https://spritesmods.com/?art=hddhack)

</comment><comment><USER23> The first company that makes a truly open source, security vetted computer will be very rich. When I say open source, I mean open source circuit design, bootloader, OS etc. The complete stack. The surveillance state is here and we need the tools to fight it!

Right now every national "security" agency(usa, china, uk) is racing to create a truly comprehensive suite of tools to monitor its citizens en masse[0][1]. Exploits for every router, iphone built in backdoor, etc. Pretty much anything that would give the government access to the most intimate details of your life. With the current political climate it's just going to get worst.

If you care about your privacy AND security, become informed and vote for privacy advocates. Visit fightforthefuture.org and eff.org to learn more.

DISCLAIMER: I am in no way affiliated with either of these foundations or their members.

[0]: [https://www.theverge.com/2018/4/5/17203806/china-chinese- qin...](https://www.theverge.com/2018/4/5/17203806/china-chinese-qingdao- police-shops-restaurants-government-wifi-routers)

[1]: [https://wikileaks.org/ciav7p1/](https://wikileaks.org/ciav7p1/)

</comment><comment><USER24> The best defense is being someone too uninteresting to bother. Once you're interesting so some resourceful adversary, it's very hard to avoid devices being hacked, and virtually impossible to determine if they've been hacked.

<comment><USER25> It's effectively feasible to monitor everyone, and to make determinations of interest after the fact.

So that's not a particularly viable option.

<comment><USER24> Monitor, sure. But I don't believe that _anyone_ has enough resources to backdoor everyone's machines.

<comment><USER25> That depends where in the design, manufacture, and provisioning stage this occurs, and by whom. It's quite possible Micah was looking at the wrong signifiers.

(Difficult to prove, natch, but possible.)

<comment><USER24> Sure, it's possible.

We know that the NSA intercepts machines for modification. And it's possible that hardware is generally backdoored. Maybe even by Chinese manufacturers.

But what can one do, if everything is pwned? It's not practical to build machines from transistors etc. There are dreams of open-source hardware. But how could that even be done securely? The NSA can plant agents anywhere, in theory.

<comment><USER25> I wasn't addressing this. Only the first of your assumptions, that it is somehow possible to escape surveillance.

I'm increasingly of the view that it's not, at least not through individual action.

My interest is, for first strokes, painting an accurate picture of the landscape. Which means discarding inaccurate models and frames.

Among those: that laying low is possible, or a positive (that's precisely the objective of the Panopticon, and self-censorship abd -reegulation are the most efficient), or that individual rather than collective action is appropriate.

It also seems that surveillance itself faces various realities and economies, which can be directly attacked.

</comment></comment></comment></comment></comment></comment><comment><USER26> A simple thing to make evil maids job harder is to just apply plenty of instant glue. This way it takes much more effort to open the laptop or switch components. Also fill in ports you don't need.

For practical security it is also important to have some physical things on the laptop body that allow you to identify your hardware. Otherwise somebody will just replace it with their own hardware to collect your password. Obviously pretty much anything can be replicated, but absolute security is anyways impossible to achieve so you can only try to make things harder for them.

</comment><comment><USER27> . . . so, you either leave your laptop at home (assuming you've a sufficient degree of certainty it won't be hacked there) or you keep it with you at all times, with all wireless technologies disabled.

With regards to my checked luggage - no electronics there - when traveling to/from/in the US, I always save those 'Inspected by TSA' placards, and place one prominently atop my clothes prior to closing and locking my bag.

Based on various physical telltales I utilize, the success rate of placing a used 'Inspected by TSA' placard in one's bag to deter searches is 100%, at least in my experience.

Since I started doing this, I haven't received any new 'Inspected by TSA' placards, either. So, that's another indicator of the technique's probable success rate.

</comment><comment><USER28> I thought it was impossible to prove a negative, generally?

<comment><USER3> I think you have got a bit confused here. For example Fermat's Last Theorem is effectively "a negative": _" no three positive integers a, b, and c satisfy the equation an + bn = cn for any integer value of n greater than 2"_

<comment><USER29> That phrase applies basically everywhere else except math. It's only possible to prove a negative in mathematics because it's a fully logical system.

On a side note Fermat's Last Theorem isn't a good counterexample because it hasn't been proven yet either.

<comment><USER30> It's proven:

[https://www.theguardian.com/science/2016/mar/15/british- math...](https://www.theguardian.com/science/2016/mar/15/british- mathematician-andrew-wiles-abel-prize-fermats-last-theorem-proof)

[https://en.wikipedia.org/wiki/Wiles%27s_proof_of_Fermat%27s_...](https://en.wikipedia.org/wiki/Wiles%27s_proof_of_Fermat%27s_Last_Theorem)

</comment></comment></comment></comment><comment><USER31> > But due to various time-consuming and annoying issues related to Windows > updates, I eventually chose to abandon Windows altogether and just run > Debian on my honeypot laptop

You know things are bad when people are annoyed by an operating system they dont even use!

</comment><comment><USER32> I could never work in security. I worry enough as it is, without it being my job to worry.

</comment><comment><USER33> I sometimes think there may be a gap for simpler technology where it's easier to ensure nothing's hacked. Like if you have a raspberry pi zero with software on a flash drive and check the hash on all the stuff in the flash drive.

</comment><comment><USER34> I wonder if it's practical to make a laptop suitcase where all external edges are touch sensitive? Have a serial number etched into each surface as well.

Edit-the case could have additional logic and wireless charging for power.

<comment><USER35> Just get one of those fancy metal attaché cases, attach a capacitive sensor to it with some sort of ground plane inside the case, and wire it to some logging microcontroller. Add a gyro chip to boot. Honestly the embedded gyro should be enough, the MEMS chips in phones are CRAZY sensitive, and would easily detect being shifted by a cm.

</comment></comment><comment><USER36> Hardware tampering is't performed on a mass scale. It's always a targeted attack.

What the author actually forgot to do was to add some honey into the honeypot. I.e. become an attractive target.

<comment><USER14> He's a board member of the Freedom of the Press Foundation, a position also held by Edward Snowden and Daniel Ellsberg. Additionally, he has helped develop SecureDrop and various other tools to enable the anonymous spread of information. Finally, he works for The Intercept, an organization that has a history of receiving leaked information. Seems like a plausible target to me.

<comment><USER37> But was there any specific thing during the course of his trial run that would have enticed an attacker? And given the fact that a supposed attacker would ostensibly be able to detect the existence of honey before the attack, would they not also be able to detect the absence of it? (And perhaps its simultaneous absence during the course of the trial)

Seems like an experimental bias to me

<comment><USER14> This is a journalistic experiment not a scientific experiment. Experimental bias isn't a large concern, they're trying to record something happening not prove something.

</comment></comment></comment></comment><comment><USER38> If your security model relies exclusively on the integrity of information processing systems, it's going to fail. Failure is only a function of how much interest there is, and thus investment in, breaking that security. Therefore any decent security model will rely heavily on non-technological methodologies for preserving security compartmentation and protection of vital assets.

</comment><comment><USER39> I believe it might be possible to replace the HD firmware that will effectively hide code, even in the HD firmware itself, that can only be accessed via a backdoor. For all we know, it comes that way from the factory. Just thinking, while we're being all paranoid here :)

</comment><comment><USER40> I would think a fully encrypted OS partition would be harder to sneak a backdoor into? Now infecting everything before the OS boots is outside my scope of knowledge, but if you have your partition unencrypted it's definitely much much easier to hijack your OS with physical access.

<comment><USER41> Before your "real" encrypted partition boots, you must decrypt it, and the system that decrypts it isn't encrypted itself, because you must run it somehow.

On most Linux setups, that system is the initramfs--if you've ever installed Arch or similar, this is what the `mkinitcpio` step generates--and if you peek in your boot partition, it'll probably be named something like `initramfs- linux.img`.

The initramfs is a (often gzip compressed) ramdisk image for a full-blown tiny Linux system, complete with its own set of coreutils (if you want to see what it contains, run `lsinitcpio -x` on it). It's what handles your boot process, like setting up your keymaps, mounting disks, and of course, decrypting encrypted partitions.

By unpacking, modifying, and repacking the initramfs, it's possible--even trivial--to run whatever code you want as root, or intercept the user's encryption password when they type it in to do the type of conventional unencrypted backdooring you have in mind.

<comment><USER24> True.

But after doing a standard LUKS install, you can move /boot to an SD card. You can also backup the LUKS header to the SD card, and wipe it from the system.

Now the machine cannot be booted without the SD card. After restoring the LUKS header. And even if an adversary creates a new /boot on the machine, you can check for that, and nuke it before booting from the SD card.

If you're detained, you can just chew up the SD card and swallow it. Maybe a little hard on the teeth, but hey.

But of course, that SD card must never leave your body. Except that you probably want to hide copies somewhere. In case you lose it, or whatever.

<comment><USER42> So put malware in the BIOS itself, or one of the other chips or ROMs available.

I think I remember reading a story recently about Thunderbolt or maybe USB being connected to an Option ROM over PCIe (must have been Thunderbolt I guess) that allowed an attacker to simply plug in a USB stick and permanently and irrevocably pwn the system - right down to securing the flaw that allowed flashing of the ROM over the PCIe connection. I think the malware overwrote some bit that allowed any further writing, so even attaching physical chip flashing device to the ROM wouldn't clear the malware. The machine was effectively permanently compromised and could only be thrown away.

<comment><USER24> Yes, it was Thunderbolt.[0] Firewire had the same issue. As does PCIe. But maybe USB 2.0 can be secured. If so, just fill other ports with epoxy. And use metal-flake nail polish to tamper protect seams. If USB isn't securable, give up, I guess.

0) [https://news.ycombinator.com/item?id=12383130](https://news.ycombinator.com/item?id=12383130)

<comment><USER43> That's the great thing about USB-C - If you epoxy the ports, you now can't charge.. _sigh_

<comment><USER24> Maybe have multiple batteries, and use a dumb charger?

<comment><USER43> My MacBook has only one port and a sealed battery compartment, which is not helping :(

<comment><USER24> Damn. So is USB-C securable?

<comment><USER43> Sure! __*

 __*Probably not, going by history.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER44> My Linux laptop is fully encrypted and I've signed and enrolled my own secure boot keys. Just following best practices and now wondering where this leaves me vulnerable. I think it should prevent tampering with the bootloader but not sure about hdd/net Firmware etc.

<comment><USER45> Get some physical tamper detection on opening the case. Something like the old spy trick of 'leaving a hear on the door-handle'.

There are some nice tips here on spray glitter on a seal and nail-polishing it, then taking a photo. That way, anyone that breaks the seal has to reproduce the same glitter pattern.

</comment></comment><comment><USER46> Why would an attacker black bag a laptop containing a pre-owned vendor BIOS, by the author's own suggestion? This exercise makes no sense.

</comment><comment><USER46> Why would an attacker black bag a laptop with a pre-owned vendor BIOS, by the author's own suggestion? This exercise makes no sense.

</comment><comment><USER47> In other news : You can't prove a negative.

<comment><USER48> Here is a (wrong) statement:

* [the sum S of two even numbers A1 and A2] is an odd number

Here is its negation:

* [the sum S of two even numbers A1 and A2] is not an odd number

or alternatively:

* [the sum S of two even numbers A1 and A2] is an even number.

Let's "you can't prove the negative":

* A1 is even => there exists an integer a1 such that A1 = 2 _a1

_ A2 is even => there exists an integer a1 such that A2 = 2 _a2

_ by substitution the sum (A1+A2) = (2 _a1 + 2_ a2)

* by distributivity: (A1+A2)=2 _(a1+a2)

_ sum s of integers a1,a2 is an integer: a1 + a2 = s integer

* substitution (A1+A2)=2 _s with s integer

_ S=(A1+A2)=2 _s, hence S is even

_ an even number is not odd

* hence [the sum S of two even numbers A1 and A2] is not odd

We proved a theorem that was also a negation of a statement!!

</comment></comment><comment><USER49> Why not put a bounty of bitcoins on your laptop? If it's large enough it becomes worth taking even though that will alert you.

<comment><USER3> I think you are advocating something like putting a diamond ring on view behind one of your house's windows.

If the ring gets stolen by someone breaking in via the window then you know it has gone but you do not know whether the thief say changed the locks in some way. Now they can come and go with impunity.

<comment><USER49> Well if you're really paranoid that's the point where you get a new laptop.

</comment></comment></comment><comment><USER50> True, but things like reproducible builds can help prevent your laptop then being used to hack others.

</comment><comment><USER51> Can't prove a negative, after all...

</comment><comment><USER52> So guys laptop doesnt get hacked and he writes a story about how it could have been hacked but probbably wasnt. Thats some CNN level stuff right there

<comment><USER53> It's an article attempting to discuss how you would tell if your laptop had been hacked.

If you find some media that rises to this level, please let me know about it, because I thought it was excellent.</comment></comment>


Show HN: Arcade – Play retro games streamed inside a browser - <AUTHOR> http://www.arcadeup.io <comment><USER3> Cool project! The latency is a little high for a lot of games (not sure WC3 is the best choice with high latency), but it seemed smooth and responsive. After a while, I got stuck on the desktop instead of in the game (that's kind of a big security problem).

It would be nice if the site gave a little more info, maybe it should go to a landing page rather than jumping right into the app.

</comment><comment><USER4> Amazing, so this could be the remote desktop in browser, with lower latency, totally allow corporations to use this instead the original remote desktop app that Windows have right now...

I think AWS allows you to interact with remote Windows as well, right?

Regardless, great job! Love the idea and the implementation...maybe League or Legend or Dota2 in the future? This means ppl can play Dota2 at work in browser lol

</comment><comment><USER5> I strongly object to Warcraft III being called "retro" \- and an expansion no less. It makes me feel old.

<comment><USER6> Ha, yeah. Warcraft III is a long way from being retro. It was released in 2002 (expansion in 2003).

<comment><USER7> Really? That was 12-13 years ago.

For comparison's sake, I feel like in 2002, I was thinking of games like the Sierra point-and-clicks (Leisure Suit Larry, King's Quest, Space Quest, Police Quest, Conquests of the Longbow, et al) as retro and most of those would have been in that age bracket.

<comment><USER8> Not even close to that age bracket. Those Sierra classics were relased from 24-31 years ago, at least twice as old as WC3.

Leisure Suit Larry in the Land of the Lounge Lizards - 1987 King's Quest: Quest for the Crown - 1984 Space Quest: The Sarien Encounter - 1986 Police Quest: In Pursuit of the Death Angel - 1987 Conquests of the Longbow: The Legend of Robin Hood - <USER2>

<comment><USER7> > For comparison's sake, I feel like in 2002

Counting from the viewpoint of 2002, not 2015.

Also, you're using the first games when I was thinking of the later ones in the series (say, King's Quest V era); they definitely came across as retro to me and my peers in 2002.

</comment></comment></comment></comment></comment><comment><USER9> Is it intended to be able to drop down to the desktop just by quitting WC3?

</comment><comment><USER10> How does one get to anything besides Warcraft?

<comment><USER11> The idea is "one application per virtual machine", and to leave multi-tasking to the browser. Right now the only application we have is Warcraft.

The fact that you can interact with Windows outside the context of the intended application is a side-effect of Windows 8 Assigned Access only working for "Windows Apps" (ie- not "legacy" applications). Otherwise we would have gone for this type of "kiosk" experience which attempts to hide the underlying desktop environment / os.

</comment></comment><comment><USER12> Okay, I changed the wallpaper and removed the start-up program, and shut the computer down, does this affect everybody?

<comment><USER11> We give every new session a freshly cloned VM. Changes you make will remain for your session but be reverted over when the machine is reclaimed for the next user.

<comment><USER13> What's the maximum number of users you can support at any given time?

<comment><USER11> 96 as of now.

</comment></comment></comment></comment><comment><USER14> What is the expected latency? Would this work with an FPS? Looks like its using Broadway.js?

<comment><USER11> I've haven't gotten around to measuring it yet, but back of the envelope calculation is "between 100ms-200ms" delay from input event sent to h264 frame rendered. This is assuming virtually no network delay, so you'd be doing well with ~300ms end-to-end latency from your browser currently.

This would not work for an FPS, especially when you look at the variance in latency. There are lots of ways to shave milliseconds and stabilize latency though, so that statement is definitely not future-proof.

Yes, Broadway.js ;) Highly recommend though the documentation can be a bit "terse"

</comment></comment><comment><USER13> This is beyond awesome. How did you do it?

<comment><USER11> h264 frames/opus packets over websockets. Broadway.js is doing the video decoding, something similar to (EDIT: opus.js) for the audio.

All decode loops are in webworkers, separate websocket connection for each data stream (video,audio,input). Broadway has a lovely option to use WebGL for pushing the pixels to a canvas as well, which really helps free up the CPU.

Put it all together, and you'd be surprised how close you can push an (up-to- date) browser towards realtime sans plugin.

</comment></comment><comment><USER15> Ah, using -ap after a loooong time!

</comment><comment><USER16> I can't press enter in my iPad's browser, so it's entirely useless.

<comment><USER17> You can just click, but you're gonna have more problems than that on a tablet.

<comment><USER16> I tried that, but it did not work for me.</comment></comment></comment>


Japan Venture Capital Funds Face Mergers as IPOs Fade  - <AUTHOR> http://www.bloomberg.com/apps/news?pid=20601109&sid=afpWYmx_Xp.0&refer=home

<comment> barry-cotter _Only 49 companies went public last year, the fewest since 1992, depriving venture firms of the source of 45 percent of revenue and 90 percent of profits, based on data from 2007.

Japanese funds, which together manage 1.04 trillion yen ($10.6 billion), get more than twice as much revenue from IPOs as U.S. and European firms, according to Venture Enterprise._

From 5 minutes googling the firms mentioned as the largest Japanese VC funds they appear to be more along the lines of exchange traded funds, or at leat they appear to be actual companies themsleves that are traded on a stock exchange, not something I think you can do in the US (SEC rules etc., must have mucho money to be an accredited investor) This means they can't go "Right, so we'll sit on our money for two years then" like a consistently profitable, but not Sequoia or Kleiner Perkins level fund could in the US. They're vulnerable to the stupidities of the quarterly results driven market, and could theoretically be bought up for market cap and the individual components sold off at a profit[1].

This screams money to be made to me. Not by me, unfortunately, but if someone had fluent Japanese and English and was enough of a hacker to do a proper appraisal on some of these companies could get together with someone with VC experience, IPO and M&A experience they could do an analysis on portfolio companies and make offers.

Summary: With a Japanese-English bilingual team, Techs capable of doing technical due diligence, and finance people with domain expertise, assets could be bought for very good value.

[1] I have no idea if this is likely to happen to any of these companies or not. It's mainly illustrative. Also, sometimes having a market cap lower than book value is sometimes correct. GM has been in that situation since the 70s.</comment>


You need to outthink your lazy brain (2013) - <AUTHOR> https://bigthink.com/in-their-own-words/explanation-freeze-sometimes-you-need-to-outhink-your-lazy-brain <comment><USER2> I really hated all the ads and fancy layout of the page. And I don't think there was a lot to read.</comment>