Skip to main content

Home/ Future of the Web/ Group items matching "just" in title, tags, annotations or url

Group items matching
in title, tags, annotations or url

Sort By: Relevance | Date Filter: All | Bookmarks | Topics Simple Middle
Paul Merrell

He Was a Hacker for the NSA and He Was Willing to Talk. I Was Willing to Listen. - 2 views

theintercept.com/...o-talk-i-was-willing-to-listen

surveillance state NSA-hacker-interview

shared by Paul Merrell on 03 Jul 16 - No Cached
  • he message arrived at night and consisted of three words: “Good evening sir!” The sender was a hacker who had written a series of provocative memos at the National Security Agency. His secret memos had explained — with an earthy use of slang and emojis that was unusual for an operative of the largest eavesdropping organization in the world — how the NSA breaks into the digital accounts of people who manage computer networks, and how it tries to unmask people who use Tor to browse the web anonymously. Outlining some of the NSA’s most sensitive activities, the memos were leaked by Edward Snowden, and I had written about a few of them for The Intercept. There is no Miss Manners for exchanging pleasantries with a man the government has trained to be the digital equivalent of a Navy SEAL. Though I had initiated the contact, I was wary of how he might respond. The hacker had publicly expressed a visceral dislike for Snowden and had accused The Intercept of jeopardizing lives by publishing classified information. One of his memos outlined the ways the NSA reroutes (or “shapes”) the internet traffic of entire countries, and another memo was titled “I Hunt Sysadmins.” I felt sure he could hack anyone’s computer, including mine. Good evening sir!
  • The sender was a hacker who had written a series of provocative memos at the National Security Agency. His secret memos had explained — with an earthy use of slang and emojis that was unusual for an operative of the largest eavesdropping organization in the world — how the NSA breaks into the digital accounts of people who manage computer networks, and how it tries to unmask people who use Tor to browse the web anonymously. Outlining some of the NSA’s most sensitive activities, the memos were leaked by Edward Snowden, and I had written about a few of them for The Intercept. There is no Miss Manners for exchanging pleasantries with a man the government has trained to be the digital equivalent of a Navy SEAL. Though I had initiated the contact, I was wary of how he might respond. The hacker had publicly expressed a visceral dislike for Snowden and had accused The Intercept of jeopardizing lives by publishing classified information. One of his memos outlined the ways the NSA reroutes (or “shapes”) the internet traffic of entire countries, and another memo was titled “I Hunt Sysadmins.” I felt sure he could hack anyone’s computer, including mine.
  • I got lucky with the hacker, because he recently left the agency for the cybersecurity industry; it would be his choice to talk, not the NSA’s. Fortunately, speaking out is his second nature.
  • ...7 more annotations...
  • He agreed to a video chat that turned into a three-hour discussion sprawling from the ethics of surveillance to the downsides of home improvements and the difficulty of securing your laptop.
  • In recent years, two developments have helped make hacking for the government a lot more attractive than hacking for yourself. First, the Department of Justice has cracked down on freelance hacking, whether it be altruistic or malignant. If the DOJ doesn’t like the way you hack, you are going to jail. Meanwhile, hackers have been warmly invited to deploy their transgressive impulses in service to the homeland, because the NSA and other federal agencies have turned themselves into licensed hives of breaking into other people’s computers. For many, it’s a techno sandbox of irresistible delights, according to Gabriella Coleman, a professor at McGill University who studies hackers. “The NSA is a very exciting place for hackers because you have unlimited resources, you have some of the best talent in the world, whether it’s cryptographers or mathematicians or hackers,” she said. “It is Just too intellectually exciting not to go there.”
  • The Lamb’s memos on cool ways to hunt sysadmins triggered a strong reaction when I wrote about them in 2014 with my colleague Ryan Gallagher. The memos explained how the NSA tracks down the email and Facebook accounts of systems administrators who oversee computer networks. After plundering their accounts, the NSA can impersonate the admins to get into their computer networks and pilfer the data flowing through them. As the Lamb wrote, “sys admins generally are not my end target. My end target is the extremist/terrorist or government official that happens to be using the network … who better to target than the person that already has the ‘keys to the kingdom’?” Another of his NSA memos, “Network Shaping 101,” used Yemen as a theoretical case study for secretly redirecting the entirety of a country’s internet traffic to NSA servers.
  • “If I turn the tables on you,” I asked the Lamb, “and say, OK, you’re a target for all kinds of people for all kinds of reasons. How do you feel about being a target and that kind of justification being used to justify getting all of your credentials and the keys to your kingdom?” The Lamb smiled. “There is no real safe, sacred ground on the internet,” he replied. “Whatever you do on the internet is an attack surface of some sort and is just something that you live with. Any time that I do something on the internet, yeah, that is on the back of my mind. Anyone from a script kiddie to some random hacker to some other foreign intelligence service, each with their different capabilities — what could they be doing to me?”
  • “You know, the situation is what it is,” he said. “There are protocols that were designed years ago before anybody had any care about security, because when they were developed, nobody was foreseeing that they would be taken advantage of. … A lot of people on the internet seem to approach the problem [with the attitude of] ‘I’m just going to walk naked outside of my house and hope that nobody looks at me.’ From a security perspective, is that a good way to go about thinking? No, horrible … There are good ways to be more secure on the internet. But do most people use Tor? No. Do most people use Signal? No. Do most people use insecure things that most people can hack? Yes. Is that a bash against the intelligence community that people use stuff that’s easily exploitable? That’s a hard argument for me to make.”
  • I mentioned that lots of people, including Snowden, are now working on the problem of how to make the internet more secure, yet he seemed to do the opposite at the NSA by trying to find ways to track and identify people who use Tor and other anonymizers. Would he consider working on the other side of things? He wouldn’t rule it out, he said, but dismally suggested the game was over as far as having a liberating and safe internet, because our laptops and smartphones will betray us no matter what we do with them. “There’s the old adage that the only secure computer is one that is turned off, buried in a box ten feet underground, and never turned on,” he said. “From a user perspective, someone trying to find holes by day and then just live on the internet by night, there’s the expectation [that] if somebody wants to have access to your computer bad enough, they’re going to get it. Whether that’s an intelligence agency or a cybercrimes syndicate, whoever that is, it’s probably going to happen.”
  • There are precautions one can take, and I did that with the Lamb. When we had our video chat, I used a computer that had been wiped clean of everything except its operating system and essential applications. Afterward, it was wiped clean again. My concern was that the Lamb might use the session to obtain data from or about the computer I was using; there are a lot of things he might have tried, if he was in a scheming mood. At the end of our three hours together, I mentioned to him that I had taken these precautions—and he approved. “That’s fair,” he said. “I’m glad you have that appreciation. … From a perspective of a journalist who has access to classified information, it would be remiss to think you’re not a target of foreign intelligence services.” He was telling me the U.S. government should be the least of my worries. He was trying to help me. Documents published with this article: Tracking Targets Through Proxies & Anonymizers Network Shaping 101 Shaping Diagram I Hunt Sys Admins (first published in 2014)
Paul Merrell

We finally gave Congress email addresses - Sunlight Foundation Blog - 0 views

sunlightfoundation.com/...-gave-congress-email-addresses

U.S. Congress email

shared by Paul Merrell on 18 Jun 14 - No Cached
  • On OpenCongress, you can now email your representatives and senators just as easily as you would a friend or colleague. We've added a new feature to OpenCongress. It's not flashy. It doesn't use D3 or integrate with social media. But we still think it's pretty cool. You might've already heard of it. Email. This may not sound like a big deal, but it's been a long time coming. A lot of people are surprised to learn that Congress doesn't have publicly available email addresses. It's the number one feature request that we hear from users of our APIs. Until recently, we didn't have a good response. That's because members of Congress typically put their feedback mechanisms behind captchas and zip code requirements. Sometimes these forms break; sometimes their requirements improperly lock out actual constituents. And they always make it harder to email your congressional delegation than it should be.
  • This is a real problem. According to the Congressional Management Foundation, 88% of Capitol Hill staffers agree that electronic messages from constituents influence their bosses' decisions. We think that it's inappropriate to erect technical barriers around such an essential democratic mechanism. Congress itself is addressing the problem. That effort has just entered its second decade, and people are feeling optimistic that a launch to a closed set of partners might be coming soon. But we weren't content to wait. So when the Electronic Frontier Foundation (EFF) approached us about this problem, we were excited to really make some progress. Building on groundwork first done by the Participatory Politics Foundation and more recent work within Sunlight, a network of 150 volunteers collected the data we needed from congressional websites in just two days. That information is now on Github, available to all who want to build the next generation of constituent communication tools. The EFF is already working on some exciting things to that end.
  • But we just wanted to be able to email our representatives like normal people. So now, if you visit a legislator's page on OpenCongress, you'll see an email address in the right-hand sidebar that looks like Sen.Reid@opencongress.org or Rep.Boehner@opencongress.org. You can also email myreps@opencongress.org to email both of your senators and your House representatives at once. The first time we get an email from you, we'll send one back asking for some additional details. This is necessary because our code submits your message by navigating those aforementioned congressional webforms, and we don't want to enter incorrect information. But for emails after the first one, all you'll have to do is click a link that says, "Yes, I meant to send that email."
  • ...1 more annotation...
  • One more thing: For now, our system will only let you email your own representatives. A lot of people dislike this. We do, too. In an age of increasing polarization, party discipline means that congressional leaders must be accountable to citizens outside their districts. But the unfortunate truth is that Congress typically won't bother reading messages from non-constituents — that's why those zip code requirements exist in the first place. Until that changes, we don't want our users to waste their time. So that's it. If it seems simple, it's because it is. But we think that unbreaking how Congress connects to the Internet is important. You should be able to send a call to action in a tweet, easily forward a listserv message to your representative and interact with your government using the tools you use to interact with everyone else.
Gonzalo San Gil, PhD.

| Grooveshark Faces a $736,050,000.00 Hammer…Digital Music News - 0 views

www.digitalmusicnews.com/...rk-faces-a-736050000-00-hammer

shared by Gonzalo San Gil, PhD. on 26 Apr 15 - No Cached
    • Gonzalo San Gil, PhD.
      Gonzalo San Gil, PhD. on 26 Apr 15
       
      what a nonsense, call 'legal jihad' -with all its negative connotations- to a (supposedly) 'democratic' 'IP Protection' action... # ! :( (Another identification of sharing with terrorism... not The Faith...)
  • Gonzalo San Gil, PhD. on 26 Apr 15
     
    When Universal Music Group declared 'legal jihad' against Grooveshark, it turns out they actually meant it. Now, after flattening Grooveshark and its principals on grounds of willful copyright infringement, the parties enter the phase of figuring out just how brutal this punishment will be. [# ! It's just a matter of culture flow -thought, socialization, VALUES- control...]
Gary Edwards

» 21 Facts About NSA Snooping That Every American Should Know Alex Jones' Infowars: There's a war on for your mind! - 0 views

www.infowars.com/hat-every-american-should-know

NSA-Patriot-Act-NDAA NSA-Whistleblower PRISM Echelon-SIGINT

shared by Gary Edwards on 19 Jun 13 - No Cached
  • Gary Edwards on 19 Jun 13
     
    NSA-PRISM-Echelon in a nutshell.  The list below is a short sample.  Each fact is documented, and well worth the time reading. "The following are 21 facts about NSA snooping that every American should know…" #1 According to CNET, the NSA told Congress during a recent classified briefing that it does not need court authorization to listen to domestic phone calls… #2 According to U.S. Representative Loretta Sanchez, members of Congress learned "significantly more than what is out in the media today" about NSA snooping during that classified briefing. #3 The content of all of our phone calls is being recorded and stored.  The following is a from a transcript of an exchange between Erin Burnett of CNN and former FBI counterterrorism agent Tim Clemente which took place just last month… #4 The chief technology officer at the CIA, Gus Hunt, made the following statement back in March… "We fundamentally try to collect everything and hang onto it forever." #5 During a Senate Judiciary Oversight Committee hearing in March 2011, FBI Director Robert Mueller admitted that the intelligence community has the ability to access emails "as they come in"… #6 Back in 2007, Director of National Intelligence Michael McConnell told Congress that the president has the "constitutional authority" to authorize domestic spying without warrants no matter when the law says. #7 The Director Of National Intelligence James Clapper recently told Congress that the NSA was not collecting any information about American citizens.  When the media confronted him about his lie, he explained that he "responded in what I thought was the most truthful, or least untruthful manner". #8 The Washington Post is reporting that the NSA has four primary data collection systems… MAINWAY, MARINA, METADATA, PRISM #9 The NSA knows pretty much everything that you are doing on the Internet.  The following is a short excerpt from a recent Yahoo article… #10 The NSA is suppose
Gonzalo San Gil, PhD.

TTIP Transparency in Practice | SumOfUs.org - 0 views

act.sumofus.org/...ttip_transparency_infographic

TTIP transparency practice

shared by Gonzalo San Gil, PhD. on 03 Sep 15 - No Cached
  • Gonzalo San Gil, PhD. on 03 Sep 15
     
    "TTIP or no TTIP -- our representatives in the European Parliament (MEPs) will play a crucial role when it comes to deciding whether this historic trade deal between the US and EU will become reality. With our democracy on the line and our health and environmental standards up for negotiation -- it couldn't be more vital for our MEPs to know exactly what they'll have to decide on. EU Commissioners say they're giving access to MEPs, but we know it's just not true. Share this infographic to make sure people all over Europe understand just how undemocratic this trade deal is."
Gonzalo San Gil, PhD.

Microsoft Just Took Android's Future Out of Google's Hands | WIRED [# Check] - 2 views

www.wired.com/...microsoft-google-cyanogen

microsoft takes android from google thru Cyanogen open source perversion let's help Tizen real GNU_Linux mobile system

shared by Gonzalo San Gil, PhD. on 21 May 15 - No Cached
  • Gonzalo San Gil, PhD. on 21 May 15
     
    "With the announcement that Microsoft would partner with the truly open-source, Android-based Cyanogen OS to provide a bundled suite of apps, both companies made one thing very clear: Android's not just for Google anymore. " [https://cyngn.com/press/cyanogen-announces-strategic-partnership-with-microsoft]
  • Gonzalo San Gil, PhD. on 21 May 15
     
    "With the announcement that Microsoft would partner with the truly open-source, Android-based Cyanogen OS to provide a bundled suite of apps, both companies made one thing very clear: Android's not just for Google anymore. "
Gonzalo San Gil, PhD.

DIASPORA* - 2 views

joindiaspora.com

Open Source Social Networking Red Social Código Abierto

shared by Gonzalo San Gil, PhD. on 28 Nov 10 - No Cached
  • Gonzalo San Gil, PhD. on 28 Nov 10
     
    [Sus promotores abren un tiempo de pruebas.- El proyecto, de código abierto, quiere ser una alternativa a Facebook, pero dando el control de los datos al internauta http://www.elpais.com/articulo/tecnologia/red/social/Diaspora/invita/primeros/miembros/elpeputec/20101125elpeputec_2/Tes] [ Share what you want, with whom you want. Choice Diaspora lets you sort your connections into groups called aspects. Unique to Diaspora, aspects ensure that your photos, stories and jokes are shared only with the people you intend. Ownership You own your pictures, and you shouldn't have to give that up just to share them. You maintain ownership of everything you share on Diaspora, giving you full control over how it's distributed. Simplicity Diaspora makes sharing clean and easy - and this goes for privacy too. Inherently private, Diaspora doesn't make you wade through pages of settings and options just to keep your profile secure. ]
Gary Edwards

Flash Wars: The Many Enemies and Obstacles of Flash [Part 2 of 3] - AppleInsider Comments - 0 views

forums.appleinsider.com/showthread.php

apple flash javascript ria sproutcore webkit

shared by Gary Edwards on 18 Jun 08 - Cached
  • Throughout 2007, Apple stripped nearly every vestige of Flash from its corporate site and other products, and began recommending that developers use open standards instead. As noted in Gone in a Flash: More on Apple’s iPhone Web Plans, last summer Apple published a document titled "Optimizing Web Applications and Content for iPhone," which not only listed Flash as the single bullet point item under a listing of "unsupported technologies," but went on to explicitly encourage developers to "stick with standards," and use CSS, JavaScript, and Ajax instead.
  • Microsoft has already begun leveraging its Windows and Office monopolies to distribute Silverlight as a Flash-killer on both the Windows PC desktop and on the Mac. When Microsoft releases a Mac product, it can only mean one thing: it's working hard to kill a cross platform threat to Windows.
  • the new Cocoa iPhone/iPod Touch SDK not only offers Adobe insufficient means to develop a Flash plugin, but also clearly forbids the development of runtimes designed to advance competing platforms on top of the native Cocoa environment, whether Flash, Silverlight, or Java.
  • ...2 more annotations...
  • Apple is fighting for control of media distribution with open standards! What is it you do not get about Mpeg4, AAC, MP3 and H.264?
  • Silverlight will just not play H264 content : as usual, microsoft has adopted a look alike, incompatible video format : VC1. About why Quicktime is better that Flash when it comes to serious H264 usage, you may want to have a look at the following note/demonstration of a quicktime+javascript player : http://blog.vrarchitect.net/post/200...ter-than-Flash In short : Quicktime can reach any frame of a video. Flash just reach the I-Frames. So if you have a GOP/keyframing of 250 for instance, you can see only one frame every 10s of video (to be honest, most classical gop implies a frame every one or two seconds)
  • Gary Edwards on 18 Jun 08
     
    Excellent comment focused on the clash between Flash and Apple. Apple promotes JavaScript, CSS and AJAX: the WebKit- SproutCore recipe
  • anonymous on 28 Sep 13
     
    Live Roulette from Australia, Fun and Free! Now you can play Real "www.funlivecasino.com.au" Live Roulette for Fun in Australia on a brand new website, FunLiveCasino.com.au. Using the latest internet streaming technologies, Fun Live Casino lets you join a real game happening on a real table in a real casino, all broadcast Live! You can see other real players in the casino betting on the same results you do giving you ultimate trust in the results as they are not generated 'just for you', like other casino gaming products such as 'live studios' or computer generated games. Its amazing to think next time your really in the casino that you might be on camera, and people online might be watching! The future is scary! Imagine that one day soon this will be the only way people would gamble online because the internet is full of scams, you have to be super careful, and why would you play Online Roulette any other way except from a Real Casino you can visit, see, hear and trust! Amazingly this site is completely Free and has no registration process, no spam, no clicks and no fuss. just Instant Fun "www.funlivecasino.com.au" Free Live Roulette! Give it a try, its worth checking out! "www.funlivecasino.com.au" Australia's Online Fun Live Casino! Backlink created from http://fiverr.com/radjaseotea/making-best-156654-backlink-high-pr
Gary Edwards

Cisco buys PostPath: WebEx to compete with Exchange, Outlook, Office? | Between the Lines | ZDNet.com - 0 views

blogs.zdnet.com/BTL

cisco collaboration microsoft webex

shared by Gary Edwards on 27 Aug 08 - Cached
  • Gary Edwards on 27 Aug 08
     
    Once you add in better email and calendar support WebEx could become more appealing to the enterprise. PostPath has a Linux based collaboration system built on an AJAX client that doesn't need a browser. Cisco added that the company's strategy is to develop "an integrated collaboration platform designed for how we work today and into the future. And better yet: PostPath's pitch is that it is an Exchange alternative and a "Linux-based corporate email server." Let's read between the lines: Doesn't this sound a lot like an end-run around Microsoft Office, Outlook and Exchange just like Google is trying to do with Google Apps? Cisco probably has no desire to compete head on with Microsoft (or at least admit it), but the company obviously sees something here and coupling PostPath with WebEx could be a threat to Redmond. In fact, Cisco could be a bigger threat to Microsoft in the enterprise than Google. Why? Cisco already sells enterprises a lot of stuff. Isn't a collaboration suite really just an extension of the network?
Gary Edwards

Zoho Blogs » Firefox 3.1 & Google Chrome: Javascript Wins, Flash/Silverlight Lose - 0 views

blogs.zoho.com/...ipt-wins-flashsilverlight-lose

chrome ria silverlight webkit zoho

shared by Gary Edwards on 08 Sep 08 - Cached
  • Gary Edwards on 08 Sep 08
     
    ZOHO Speaks about Chrome: "The biggest losers in Google's announcement are not really competing browsers, but competing rich client engines like Flash and Silverlight. As Javascript advances rapidly, it inevitably encroaches on the territory currently held by Flash. Native browser video is likely the last nail in the coffin - and Google needs native browser based video for its own YouTube, so we can be confident Google Chrome and Firefox will both have native video support, with Javascript-accessible VOM (video object model) APIs for web applications to manipuate video. As for Silverlight, let me just say that if Silverlight is the future of web computing, companies like us might as well find another line of work - and I suspect Google and Yahoo probably see it the same way too. More speculatively, I believe we will witness the emergence of Javascript as the dominant language of computing, as it sweeps the client side and starts encroaching on the server. The server landscape today is split between "enterprise" platforms like Java and .NET on the one side (we ourselves are in the Java camp on the server side), and "scripting" languages like PHP, Python, Ruby on the other, with Javascript firmly entrenched on the client. Languages like Ruby promise tremendous dynamism and flexibility to the developer, but their relatively weak execution environments have held them back. It is telling that both Java and .NET come with state of the art just-in-time compilers, while none of the major scripting languages do......" Interestingly, ZOHO already has a prototype running on Chrome! Solves tons of performance problems for them, as well as givign them an on-line / off-line story (Gears). The success of Chrome depends on Chrome "killer apps"; Not browser surfing features! And we already have a number of killer apps that will immediately take advantage of Chrome: gMail, gReader, gMaps and Google Docs! ZOHO will no doubt use Chrome to put themselves squarely i
Gary Edwards

Why Google Isn't Enough - Forbes.com - 0 views

www.forbes.com/...tech-cio-cx_dw_0922search.html

google metadata rdf search webkit wikiword

shared by Gary Edwards on 23 Sep 08 - Cached
  • There are three key ways that successful implementations of enterprise search differ from the search we use on the Web: richer user interfaces, business process context and heterogeneous content.
  • Gary Edwards on 23 Sep 08
     
    One key refrain that expresses this trend is heard in companies around the world: "Why can't we have a Google inside the four walls of our company?" While at first this seems like a good idea, the problem of using search inside a company is much more complicated than just indexing documents, throwing up a search box and asking people if they feel lucky. This week, JargonSpy explores just what "enterprise search" means and why it is a complicated challenge that is becoming increasingly urgent for most companies to solve.
Paul Merrell

Microsoft, Intel join the ODF Technical Committee - 0 views

www.oasis-open.org/...tc_home.php

intel members microsoft odf odf tc opendocument standards

shared by Paul Merrell on 12 Jun 08 - Cached
  • Adobe Systems Google Inc.* IBM Intel Corporation Microsoft Corporation Novell* Sun Microsystems
  • Paul Merrell on 12 Jun 08
     
    The ODF TC home page just changed its list of "OASIS Sponsor-level members who have reperesentatives serving on this TC." Microsoft and Intel have just joined the ODF party. Let the party begin!
  • anonymous on 27 Sep 13
     
    Visit News www.killdo.de.gg. How to make the 1000 visitor from PR9 backlinks. Buy cheap service www.fiverr.com/radjaseotea/making-best-super-backlink-143445
Joelle Nebbe-Mornod

Intro - flattr.com - 4 views

flattr.com/intro

donations online micropayment

shared by Joelle Nebbe-Mornod on 19 Feb 11 - No Cached
  • Joelle Nebbe-Mornod on 19 Feb 11
     
    Flattr solves this issue. When you're registered to flattr, you pay a small monthly fee. You set the amount yourself. At the end of the month, that fee is divided between all the things you flattered. You're always logged in to the account. That means that giving someone some flattr-love is just a button away. And you should! Clicking one more button doesn't add to your fee, it just divides the fee between more people! Flattr tries to encourage people to share. Not only pieces of content, but also some money to support the people who created them. With love! Flattr has no different user types. We know that everybody that create also uses other content. And vice versa. In order to have a button on your page, you need to have an active account as well, where you share your monthly fee as everybody else. We make no difference between people.
Paul Merrell

Inside Google Desktop: Google Desktop Update - 0 views

googledesktop.blogspot.com/...google-desktop-update.html

Google Google Desktop search desktop search

shared by Paul Merrell on 10 Oct 11 - No Cached
  • Paul Merrell on 10 Oct 11
     
    Google throws in the towel on desktop search, just as Microsoft somehow reached into my WinXP Pro (which never runs with automatic updates turned on) and killed the file search functionality, replaced by a message that file search is no longer supported in Explorer 6, with an invitation to upgrade MSIE or use Bing. As though I would ever let MSIE outside my firewall! Somehow, the ability to search the cloud just isn't enough for me.  
Gary Edwards

Mashups turn into an industry as offerings mature | Hinchcliffe Enterprise Web 2.0 | ZDNet.com - 0 views

blogs.zdnet.com/Hinchcliffe

OpenWeb mashup enterprise20 web20 dion-hinchcliffe

shared by Gary Edwards on 14 Apr 09 - Cached
  • Gary Edwards on 14 Apr 09
     
    Dion has lots to say about the recent Web 2.0 Conference. In this article he covers nine significant announcements from companies specializing in Web based mashups and the related tools for building ad hoc Web applications. This years Web 2.0 was filled with Web developer oriented services, but my favorite was MindTouch. Perhaps because their focus was that of directly engaging end users in the customization of business processes. Yes, the creation of data objects is clearly in the realm of trained developers. And for sure many tools were announced at Web 2.0 to further the much needed wiring of data objects. But once wired and available, services like MindTouch i think will become the way end users interact and create new business productivity methods. Great coverage.

    "...... For awareness and understanding of the fast-growing world of mashups are significant challenges as IT practitioners, business strategists, and software vendors attempt to grapple with what's facing up to be the biggest challenge of all: The habits and expectations of the larger part of a generation of workers who don't yet realize mashups are poised to change many things about the software landscape on the Web and in the workplace. Generational changes can be difficult for businesses to embrace successfully, and while evidence that mashups are remaking the business world are still very much emerging, they certainly hold the promise..."

    ".... while the life of the average Web developer has been greatly improved by the availability of a wide variety of useful open APIs, the average user of the Web hasn't been a direct beneficiary except through the increase in Web apps that are built on the mashup model. And that's because the tools that empower users to weave together existing Web parts and open APIs into the exact solutions they need are just now becoming easy enough and robust enough to readily enable these scenarios. And that doesn't include the variety of
Paul Merrell

NSA contractors use LinkedIn profiles to cash in on national security | Al Jazeera America - 0 views

america.aljazeera.com/...tractors-linkedinprofiles.html

surveillance state NSA NSA-methods spying-on-spies

shared by Paul Merrell on 30 May 14 - No Cached
  • NSA spies need jobs, too. And that is why many covert programs could be hiding in plain sight. Job websites such as LinkedIn and Indeed.com contain hundreds of profiles that reference classified NSA efforts, posted by everyone from career government employees to low-level IT workers who served in Iraq or Afghanistan. They offer a rare glimpse into the intelligence community's projects and how they operate. Now some researchers are using the same kinds of big-data tools employed by the NSA to scrape public LinkedIn profiles for classified programs. But the presence of so much classified information in public view raises serious concerns about security — and about the intelligence industry as a whole. “I’ve spent the past couple of years searching LinkedIn profiles for NSA programs,” said Christopher Soghoian, the principal technologist with the American Civil Liberties Union’s Speech, Privacy and Technology Project.
  • On Aug. 3, The Wall Street Journal published a story about the FBI’s growing use of hacking to monitor suspects, based on information Soghoian provided. The next day, Soghoian spoke at the Defcon hacking conference about how he uncovered the existence of the FBI’s hacking team, known as the Remote Operations Unit (ROU), using the LinkedIn profiles of two employees at James Bimen Associates, with which the FBI contracts for hacking operations. “Had it not been for the sloppy actions of a few contractors updating their LinkedIn profiles, we would have never known about this,” Soghoian said in his Defcon talk. Those two contractors were not the only ones being sloppy.
  • And there are many more. A quick search of Indeed.com using three code names unlikely to return false positives — Dishfire, XKeyscore and Pinwale — turned up 323 résumés. The same search on LinkedIn turned up 48 profiles mentioning Dishfire, 18 mentioning XKeyscore and 74 mentioning Pinwale. Almost all these people appear to work in the intelligence industry. Network-mapping the data Fabio Pietrosanti of the Hermes Center for Transparency and Digital Human Rights noticed all the code names on LinkedIn last December. While sitting with M.C. McGrath at the Chaos Communication Congress in Hamburg, Germany, Pietrosanti began searching the website for classified program names — and getting serious results. McGrath was already developing Transparency Toolkit, a Web application for investigative research, and knew he could improve on Pietrosanti’s off-the-cuff methods.
  • ...2 more annotations...
  • “I was, like, huh, maybe there’s more we can do with this — actually get a list of all these profiles that have these results and use that to analyze the structure of which companies are helping with which programs, which people are helping with which programs, try to figure out in what capacity, and learn more about things that we might not know about,” McGrath said. He set up a computer program called a scraper to search LinkedIn for public profiles that mention known NSA programs, contractors or jargon — such as SIGINT, the agency’s term for “signals intelligence” gleaned from intercepted communications. Once the scraper found the name of an NSA program, it searched nearby for other words in all caps. That allowed McGrath to find the names of unknown programs, too. Once McGrath had the raw data — thousands of profiles in all, with 70 to 80 different program names — he created a network graph that showed the relationships between specific government agencies, contractors and intelligence programs. Of course, the data are limited to what people are posting on their LinkedIn profiles. Still, the network graph gives a sense of which contractors work on several NSA programs, which ones work on just one or two, and even which programs military units in Iraq and Afghanistan are using. And that is just the beginning.
  • Click on the image to view an interactive network illustration of the relationships between specific national security surveillance programs in red, and government organizations or private contractors in blue.
  • Paul Merrell on 30 May 14
     
    What a giggle, public spying on NSA and its contractors using Big Data. The interactive network graph with its sidebar display of relevant data derived from LinkedIn profiles is just too delightful. 
Gonzalo San Gil, PhD.

Putin: Pirate Site Blocking Has Failed to End Piracy | TorrentFreak - 0 views

torrentfreak.com/as-failed-to-end-piracy-140329

pirate site blocking failed piracy already suggested time listen people

shared by Gonzalo San Gil, PhD. on 29 Mar 14 - No Cached
  • Gonzalo San Gil, PhD. on 29 Mar 14
     
    " Andy on March 29, 2014 C: 6 Breaking It was supposed to be the world's toughest anti-piracy regime but Russia's site blocking legislation just isn't working. That's not just the opinion of irate movie and music companies either, but comments from Vladimir Putin himself." [* #Time for a #New #Approach... as #continuously #suggested]
Paul Merrell

Why the Sony hack is unlikely to be the work of North Korea. | Marc's Security Ramblings - 0 views

marcrogers.org/...-to-be-the-work-of-north-korea

Sony-hack North-Korea false-flag FBI Obama

shared by Paul Merrell on 25 Dec 14 - No Cached
  • Everyone seems to be eager to pin the blame for the Sony hack on North Korea. However, I think it’s unlikely. Here’s why:1. The broken English looks deliberately bad and doesn’t exhibit any of the classic comprehension mistakes you actually expect to see in “Konglish”. i.e it reads to me like an English speaker pretending to be bad at writing English. 2. The fact that the code was written on a PC with Korean locale & language actually makes it less likely to be North Korea. Not least because they don’t speak traditional “Korean” in North Korea, they speak their own dialect and traditional Korean is forbidden. This is one of the key things that has made communication with North Korean refugees difficult. I would find the presence of Chinese far more plausible.
  • 3. It’s clear from the hard-coded paths and passwords in the malware that whoever wrote it had extensive knowledge of Sony’s internal architecture and access to key passwords. While it’s plausible that an attacker could have built up this knowledge over time and then used it to make the malware, Occam’s razor suggests the simpler explanation of an insider. It also fits with the pure revenge tact that this started out as. 4. Whoever did this is in it for revenge. The info and access they had could have easily been used to cash out, yet, instead, they are making every effort to burn Sony down. Just think what they could have done with passwords to all of Sony’s financial accounts? With the competitive intelligence in their business documents? From simple theft, to the sale of intellectual property, or even extortion – the attackers had many ways to become rich. Yet, instead, they chose to dump the data, rendering it useless. Likewise, I find it hard to believe that a “Nation State” which lives by propaganda would be so willing to Just throw away such an unprecedented level of access to the beating heart of Hollywood itself.
  • 5. The attackers only latched onto “The Interview” after the media did – the film was never mentioned by GOP right at the start of their campaign. It was only after a few people started speculating in the media that this and the communication from DPRK “might be linked” that suddenly it became linked. I think the attackers both saw this as an opportunity for “lulz” and as a way to misdirect everyone into thinking it was a nation state. After all, if everyone believes it’s a nation state, then the criminal investigation will likely die.
  • ...4 more annotations...
  • 6. Whoever is doing this is VERY net and social media savvy. That, and the sophistication of the operation, do not match with the profile of DPRK up until now. Grugq did an excellent analysis of this aspect his findings are here – http://0paste.com/6875#md 7. Finally, blaming North Korea is the easy way out for a number of folks, including the security vendors and Sony management who are under the microscope for this. Let’s face it – most of today’s so-called “cutting edge” security defenses are either so specific, or so brittle, that they really don’t offer much meaningful protection against a sophisticated attacker or group of attackers.
  • 8. It probably also suits a number of political agendas to have something that justifies sabre-rattling at North Korea, which is why I’m not that surprised to see politicians starting to point their fingers at the DPRK also. 9. It’s clear from the leaked data that Sony has a culture which doesn’t take security very seriously. From plaintext password files, to using “password” as the password in business critical certificates, through to just the shear volume of aging unclassified yet highly sensitive data left out in the open. This isn’t a simple slip-up or a “weak link in the chain” – this is a serious organization-wide failure to implement anything like a reasonable security architecture.
  • The reality is, as things stand, Sony has little choice but to burn everything down and start again. Every password, every key, every certificate is tainted now and that’s a terrifying place for an organization to find itself. This hack should be used as the definitive lesson in why security matters and just how bad things can get if you don’t take it seriously. 10. Who do I think is behind this? My money is on a disgruntled (possibly ex) employee of Sony.
  • EDIT: This appears (at least in part) to be substantiated by a conversation the Verge had with one of the alleged hackers – http://www.theverge.com/2014/11/25/7281097/sony-pictures-hackers-say-they-want-equality-worked-with-staff-to-break-in Finally for an EXCELLENT blow by blow analysis of the breach and the events that followed, read the following post by my friends from Risk Based Security – https://www.riskbasedsecurity.com/2014/12/a-breakdown-and-analysis-of-the-december-2014-sony-hack EDIT: Also make sure you read my good friend Krypt3ia’s post on the hack – http://krypt3ia.wordpress.com/2014/12/18/sony-hack-winners-and-losers/
  • Paul Merrell on 25 Dec 14
     
    Seems that the FBI overlooked a few clues before it told Obama to go ahead and declare war against North Korea. 
Gonzalo San Gil, PhD.

Getting started with Docker | Opensource.com - 0 views

opensource.com/...guide-docker

getting started docker containers

shared by Gonzalo San Gil, PhD. on 20 Aug 14 - No Cached
  • Gonzalo San Gil, PhD. on 20 Aug 14
     
    "It doesn't matter whether it is pianos or teddy bears, containers provide consistency that manufacturers and transporters can rely on. Just as shipping containers have revolutionized the import/export industry, you've heard that Docker is doing the same in tech."
  • Gonzalo San Gil, PhD. on 20 Aug 14
     
    "It doesn't matter whether it is pianos or teddy bears, containers provide consistency that manufacturers and transporters can rely on. Just as shipping containers have revolutionized the import/export industry, you've heard that Docker is doing the same in tech."
  • Gonzalo San Gil, PhD. on 20 Aug 14
     
    "It doesn't matter whether it is pianos or teddy bears, containers provide consistency that manufacturers and transporters can rely on. Just as shipping containers have revolutionized the import/export industry, you've heard that Docker is doing the same in tech."
Paul Merrell

The Latest Rules on How Long NSA Can Keep Americans' Encrypted Data Look Too Familiar | Just Security - 0 views

justsecurity.org/...s-hold-encrypted-data-familiar

surveillance state NSA IAA-2015 Sect-309 legislation

shared by Paul Merrell on 26 Jan 15 - No Cached
  • Does the National Security Agency (NSA) have the authority to collect and keep all encrypted Internet traffic for as long as is necessary to decrypt that traffic? That was a question first raised in June 2013, after the minimization procedures governing telephone and Internet records collected under Section 702 of the Foreign Intelligence Surveillance Act were disclosed by Edward Snowden. The issue quickly receded into the background, however, as the world struggled to keep up with the deluge of surveillance disclosures. The Intelligence Authorization Act of 2015, which passed Congress this last December, should bring the question back to the fore. It established retention guidelines for communications collected under Executive Order 12333 and included an exception that allows NSA to keep ‘incidentally’ collected encrypted communications for an indefinite period of time. This creates a massive loophole in the guidelines. NSA’s retention of encrypted communications deserves further consideration today, now that these retention guidelines have been written into law. It has become increasingly clear over the last year that surveillance reform will be driven by technological change—specifically by the growing use of encryption technologies. Therefore, any legislation touching on encryption should receive close scrutiny.
  • Section 309 of the intel authorization bill describes “procedures for the retention of incidentally acquired communications.” It establishes retention guidelines for surveillance programs that are “reasonably anticipated to result in the acquisition of [telephone or electronic communications] to or from a United States person.” Communications to or from a United States person are ‘incidentally’ collected because the U.S. person is not the actual target of the collection. Section 309 states that these incidentally collected communications must be deleted after five years unless they meet a number of exceptions. One of these exceptions is that “the communication is enciphered or reasonably believed to have a secret meaning.” This exception appears to be directly lifted from NSA’s minimization procedures for data collected under Section 702 of FISA, which were declassified in 2013. 
  • While Section 309 specifically applies to collection taking place under E.O. 12333, not FISA, several of the exceptions described in Section 309 closely match exceptions in the FISA minimization procedures. That includes the exception for “enciphered” communications. Those minimization procedures almost certainly served as a model for these retention guidelines and will likely shape how this new language is interpreted by the Executive Branch. Section 309 also asks the heads of each relevant member of the intelligence community to develop procedures to ensure compliance with new retention requirements. I expect those procedures to look a lot like the FISA minimization guidelines.
  • ...6 more annotations...
  • This language is broad, circular, and technically incoherent, so it takes some effort to parse appropriately. When the minimization procedures were disclosed in 2013, this language was interpreted by outside commentators to mean that NSA may keep all encrypted data that has been incidentally collected under Section 702 for at least as long as is necessary to decrypt that data. Is this the correct interpretation? I think so. It is important to realize that the language above isn’t just broad. It seems purposefully broad. The part regarding relevance seems to mirror the rationale NSA has used to justify its bulk phone records collection program. Under that program, all phone records were relevant because some of those records could be valuable to terrorism investigations and (allegedly) it isn’t possible to collect only those valuable records. This is the “to find a needle a haystack, you first have to have the haystack” argument. The same argument could be applied to encrypted data and might be at play here.
  • This exception doesn’t just apply to encrypted data that might be relevant to a current foreign intelligence investigation. It also applies to cases in which the encrypted data is likely to become relevant to a future intelligence requirement. This is some remarkably generous language. It seems one could justify keeping any type of encrypted data under this exception. Upon close reading, it is difficult to avoid the conclusion that these procedures were written carefully to allow NSA to collect and keep a broad category of encrypted data under the rationale that this data might contain the communications of NSA targets and that it might be decrypted in the future. If NSA isn’t doing this today, then whoever wrote these minimization procedures wanted to at least ensure that NSA has the authority to do this tomorrow.
  • There are a few additional observations that are worth making regarding these nominally new retention guidelines and Section 702 collection. First, the concept of incidental collection as it has typically been used makes very little sense when applied to encrypted data. The way that NSA’s Section 702 upstream “about” collection is understood to work is that technology installed on the network does some sort of pattern match on Internet traffic; say that an NSA target uses example@gmail.com to communicate. NSA would then search content of emails for references to example@gmail.com. This could notionally result in a lot of incidental collection of U.S. persons’ communications whenever the email that references example@gmail.com is somehow mixed together with emails that have nothing to do with the target. This type of incidental collection isn’t possible when the data is encrypted because it won’t be possible to search and find example@gmail.com in the body of an email. Instead, example@gmail.com will have been turned into some alternative, indecipherable string of bits on the network. Incidental collection shouldn’t occur because the pattern match can’t occur in the first place. This demonstrates that, when communications are encrypted, it will be much harder for NSA to search Internet traffic for a unique ID associated with a specific target.
  • This lends further credence to the conclusion above: rather than doing targeted collection against specific individuals, NSA is collecting, or plans to collect, a broad class of data that is encrypted. For example, NSA might collect all PGP encrypted emails or all Tor traffic. In those cases, NSA could search Internet traffic for patterns associated with specific types of communications, rather than specific individuals’ communications. This would technically meet the definition of incidental collection because such activity would result in the collection of communications of U.S. persons who aren’t the actual targets of surveillance. Collection of all Tor traffic would entail a lot of this “incidental” collection because the communications of NSA targets would be mixed with the communications of a large number of non-target U.S. persons. However, this “incidental” collection is inconsistent with how the term is typically used, which is to refer to over-collection resulting from targeted surveillance programs. If NSA were collecting all Tor traffic, that activity wouldn’t actually be targeted, and so any resulting over-collection wouldn’t actually be incidental. Moreover, greater use of encryption by the general public would result in an ever-growing amount of this type of incidental collection.
  • This type of collection would also be inconsistent with representations of Section 702 upstream collection that have been made to the public and to Congress. Intelligence officials have repeatedly suggested that search terms used as part of this program have a high degree of specificity. They have also argued that the program is an example of targeted rather than bulk collection. ODNI General Counsel Robert Litt, in a March 2014 meeting before the Privacy and Civil Liberties Oversight Board, stated that “there is either a misconception or a mischaracterization commonly repeated that Section 702 is a form of bulk collection. It is not bulk collection. It is targeted collection based on selectors such as telephone numbers or email addresses where there’s reason to believe that the selector is relevant to a foreign intelligence purpose.” The collection of Internet traffic based on patterns associated with types of communications would be bulk collection; more akin to NSA’s collection of phone records en mass than it is to targeted collection focused on specific individuals. Moreover, this type of collection would certainly fall within the definition of bulk collection provided just last week by the National Academy of Sciences: “collection in which a significant portion of the retained data pertains to identifiers that are not targets at the time of collection.”
  • The Section 702 minimization procedures, which will serve as a template for any new retention guidelines established for E.O. 12333 collection, create a large loophole for encrypted communications. With everything from email to Internet browsing to real-time communications moving to encrypted formats, an ever-growing amount of Internet traffic will fall within this loophole.
  • Paul Merrell on 26 Jan 15
     
    Tucked into a budget authorization act in December without press notice. Section 309 (the Act is linked from the article) appears to be very broad authority for the NSA to intercept any form of telephone or other electronic information in bulk. There are far more exceptions from the five-year retention limitation than the encrypted information exception. When reading this, keep in mind that the U.S. intelligence community plays semantic games to obfuscate what it does. One of its word plays is that communications are not "collected" until an analyst looks at or listens to partiuclar data, even though the data will be searched to find information countless times before it becomes "collected." That searching was the major basis for a decision by the U.S. District Court in Washington, D.C. that bulk collection of telephone communications was unconstitutional: Under the Fourth Amendment, a "search" or "seizure" requiring a judicial warrant occurs no later than when the information is intercepted. That case is on appeal, has been briefed and argued, and a decision could come any time now. Similar cases are pending in two other courts of appeals. Also, an important definition from the new Intelligence Authorization Act: "(a) DEFINITIONS.-In this section: (1) COVERED COMMUNICATION.-The term ''covered communication'' means any nonpublic telephone or electronic communication acquired without the consent of a person who is a party to the communication, including communications in electronic storage."       
‹ Previous 21 - 40 of 445 Next › Last »
Showing 20▼ items per page