Happy Easter! Software caught making bad router firmware

According to ARS and Slashdot, this software provider for router makers gave us a nasty Easter Egg

When confronted, they patched it with something that obfuscated but not closed it

Science Magazine performs sting on Open Access Scientific Journals

I guess there are a lot of problems with this open access model

Who's Afraid of Peer Review?

John Bohannon

A spoof paper concocted by Science reveals little or no scrutiny at many open-access journals. 

On 4 July, good news arrived in the inbox of Ocorrafoo Cobange, a biologist at the Wassee Institute of Medicine in Asmara. It was the official letter of acceptance for a paper he had submitted 2 months earlier to the Journal of Natural Pharmaceuticals, describing the anticancer properties of a chemical that Cobange had extracted from a lichen. 

In fact, it should have been promptly rejected. Any reviewer with more than a high-school knowledge of chemistry and the ability to understand a basic data plot should have spotted the paper's short-comings immediately. Its experiments are so hopelessly flawed that the results are meaningless. 

I know because I wrote the paper. Ocorrafoo Cobange does not exist, nor does the Wassee Institute of Medicine. Over the past 10 months, I have submitted 304 versions of the wonder drug paper to open-access journals. More than half of the journals accepted the paper, failing to notice its fatal flaws. Beyond that headline result, the data from this sting operation reveal the contours of an emerging Wild West in academic publishing.

Tor Servers crackable, according to ARS

Majority of Tor crypto keys could be broken, researcher says

 Rob Graham, CEO of penetration testing firm Errata Security, arrived at that conclusion by running his own "hostile" exit node on Tor and surveying the encryption algorithms established by incoming connections. About 76 percent of the 22,920 connections he polled used some form of 1024-bit Diffie-Hellman key.

...

He went on to cite official Tor statistics to observe that only 10 percent of Tor servers are using version 2.4 of the software. That's the only Tor release that implements elliptical curve Diffie-Hellman crypto, which cryptographers believe is much harder to break. The remaining versions use keys that are presumed to be weaker.

Ad Blocking Illegal? Well, let me see...

The (bad word) president of the Interactive Advertising Bureau thinks blocking third party cookies and ads might be illegal.  Apparently so does a writer at CNET.

While I'm not a lawyer (IANAL).   I do understand that the the Computer Fraud and Abuse act criminalizes:

" (a) Whoever ... (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—...(C) information from any protected computer;"

 Can I put a message into my browsing header that creates my own terms of service that states:

"This computer browser is accessing a web site to collect public information and images in HTML format published by the owner of the web server site.  For reasons of data privacy and security, the policy of the owner of the browsing computer prohibits execution of any computer programming code such as, but not limited to, Javascript, Oracle Java, Microsoft ActiveX, and others without explicit permission, and has automated policies set to block execution of this code.  Sites that use technical measures to bypass these protections are considered attackers of the browsing computer, and may be blocked and/or prosecuted under Computer Fraud and Abuse act of the United States of America.

If this policy conflicts with your web site, please block your information from being sent to the browser.  If you would like our policy to change, indicate your own policy, and we will determine whether our policy can be temporarily modified. "

I suspect this is way to long to put in the browser headers, but I could certainly put in a link to my cloud site, and save the logs of the sites that access the policy.  It could certainly be part of the web browser.

Like I've Been Sayin' - you don't need a full OS in the cloud

From Slashdot 24-Mar-2013:

 "Virtual servers in the future may stop using OSes entirely. As recently demonstrated OS-less platforms may change our understanding of how long does it take to bring a server up. A demo server gets created, booted up, configured, runs an application and shuts down in under 1 second. ... The demo uses a new Erlang runtime system capable of running directly on Xen hypervisor."

In a nutshell, what is Erlang?
Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Erlang is available as open source from http://www.erlang.org.

Here is the demo screen for "Zerg", an example of an application the starts an instance of a server in the cloud, using Erlang on Xen, which sends a page and deletes itself, in .6 seconds.  Compare that to 5 minutes for the same thing on Amazon EC2

P

Important- Do you let your Web browser save passwords for you? Read This.

Both Internet Explorer and Firefox offer to save a password every time you type one in. If you think about it, you probably realize it isn't a great idea, but it's SO convenient.

Remember this: For the browser to type the password, it needs to be readable, so anyone with access to your computer can see the passwords under certain conditions.

1. Firefox: All your remembered passwords can be viewed unless you set a master password. Go to Tools->Options-> Security and set a master password. This will encrypt the passwords. It isn't perfect, but it's a start.

2. Internet Explorer. Don't let it remember passwords. It's too easy for another person on your machine or a piece of malware to get them. If you don't believe me, go to nirsoft and see IE Passview