Cluster-f*ck! Etcd DBs spaff passwords, cloud keys to world by default

Found on The Register on Wednesday, 21 March 2018
Browse Software

Software called etcd, used for storing data across clusters of containers, has a problem – it does not implement authentication by default and so poses a security risk if deployed without further fiddling.

Troy Mursch, a security researcher with Bad Packets Report, said in an email to The Register, said, "I've independently verified [this issue] and confirmed it's a serious concern for anyone running etcd open to the internet."

You would think that after the issues with open Memcached and MongoDB servers, developers and admins would know better.

Future Windows updates will take longer to install, but it’ll feel quicker

Found on Ars Technica on Tuesday, 20 March 2018
Browse Software

Thanks to a new upgrade process, the next update—expected to be released in April—should result in substantially less downtime. The install process is split into two portions: the "online" portion, during which your PC is still usable, and the "offline" portion after the reboot, during which your PC is a spinning percentage counter.

Microsoft estimates that the Creators Update, released almost a year ago, would take about 82 minutes on average during the offline phase. Improvements made in the Fall Creators Update cut that to about 51 minutes, and the next update (which still hasn't actually been blessed with an official name) will cut this further still, to just 30 minutes.

At the same time, you can do a major update in Linux within 5-10 minutes at most, including an optional reboot (what is not a bad idea after a kernel or glibc update). You could even invest another 5 seconds to create a LVM snapshot of your root volume to roll back in case anything goes wrong. It's just baffling how much MS has screwed up here and annoyed its userbase. Forced updates and reboots are simply not an option.

Anyone fancy testing the 'unlimited' drive writes claim on Nimbus Data's 100TB whopper SSD?

Found on The Register on Monday, 19 March 2018
Browse Hardware

The 100TB ExaDrive has a 3.5-inch enclosure, a SATA interface, and is built from MLC (2bits/cell) 3D NAND. It has, Nimbus claims, the lowest power/TB rating, down to 0.1W/TB, 85 per cent lower than Micron's 5100 drive.

Savings offered by the ExaDrive over these drives are physical space and power. A theoretical 100PB constructed from 3,264 Samsung PM1643 SSDs would need 6 x 45U racks, according to Nimbus, and around 50kW of power.

The same ExaDrive-sourced capacity would need one rack, 990 drives and draw about 16kW.

At 500MB/s write speed, that 100TB drive could be loaded with roughly 41TB per day. Other manufacturers give a warranty for up to 10 complete drive writes per day. So basically Nimbus just makes drives slower so that they last longer; no magic.

'They'll squash you like a bug': how Silicon Valley keeps a lid on leakers

Found on The Guardian on Sunday, 18 March 2018
Browse Internet

“It’s horrifying how much they know,” he told the Guardian, on the condition of anonymity. “You go into Facebook and it has this warm, fuzzy feeling of ‘we’re changing the world’ and ‘we care about things’. But you get on their bad side and all of a sudden you are face to face with [Facebook CEO] Mark Zuckerberg’s secret police.”

It’s a similar story at Google. Staff use an internal version of Google Plus and thousands of mailing lists to discuss everything from homeownership to items for sale, as well as social issues like neoconservatism and diversity.

One European Facebook content moderator signed a contract, seen by the Guardian, which granted the company the right to monitor and record his social media activities, including his personal Facebook account, as well as emails, phone calls and internet use. He also agreed to random personal searches of his belongings including bags, briefcases and car while on company premises.

Just say no and don't work there.

Revealed: 50 million Facebook profiles harvested for Cambridge Analytica in major data breach

Found on The Guardian on Saturday, 17 March 2018
Browse Various

The data analytics firm that worked with Donald Trump’s election team and the winning Brexit campaign harvested millions of Facebook profiles of US voters, in one of the tech giant’s biggest ever data breaches, and used them to build a powerful software program to predict and influence choices at the ballot box.

The discovery of the unprecedented data harvesting, and the use to which it was put, raises urgent new questions about Facebook’s role in targeting voters in the US presidential election.

There's not much difference between harvesting personal information from Facebook, or Facebook selling that information.

Whois? More like WHOWAS: Domain database on verge of collapse over EU privacy

Found on The Register on Friday, 16 March 2018
Browse Internet

Industry insiders fear that, without agreement, the Whois service, which publicly lists full contact details of domain-name registrants, will effectively shut down in order to avoid fines and possible lawsuits under the Euro rules.

That would leave law enforcement and intellectual property lawyers, among others, unable to access registrant details, and potentially give cybercriminals a larger window to carry out crimes.

Criminals use their real identity to register domains? That is kinda hard to believe. The only thing you get from the whois is spam.

Thursday briefing: Novichok and the case against Russia

Found on The Guardian on Thursday, 15 March 2018
Browse Various

Russia has been condemned at the UN security council for the Salisbury nerve agent attack, with allies lining up to back Britain’s assessment that Moscow bears responsibility.

Nikki Haley, striking a contrast to her strangely equivocal president, told the UN security council: “The United States believes that Russia is responsible for the attack on two people in the United Kingdom using a military-grade nerve agent … The credibility of this council will not survive if we fail to hold Russia accountable.”

The United States also once believed that Saddam Hussein was mass-producing biological weapons to justify a first strike that brought chaos to the middle east. Russia is by far not innocent, but in those spy vs spy games, truth and honesty is always left outside.

Stephen Hawking: Visionary physicist dies aged 76

Found on BBC News on Wednesday, 14 March 2018
Browse Science

The British scientist was famed for his work with black holes and relativity, and wrote several popular science books including A Brief History of Time.

They praised his "courage and persistence" and said his "brilliance and humour" inspired people across the world.

He's one of the few people everybody has heard about; although it's been rather quiet about him lately.

This Common And Preventable Factor Could Be Increasing Your Risk Of Depression

Found on IFL Science on Tuesday, 13 March 2018
Browse Various

Japanese scientists have found that even the slightest slither of light when trying to sleep could be linked to a heightened risk of depression, according to a new study published in The American Journal of Epidemiology.

The modern world is beaming with almost constant exposure to artificial light. Light at night (LAN) in a bedroom – even a flash of a digital clock or streetlight creeping in from a crack in the curtains – could screw with our natural sleep/wake cycle.

Fun news for those who love to sleep with ambient light effects that turn your room into some sort of disco.

Google Chrome to Flag Untrusted Symantec Certificates as Unsafe

Found on eWEEK on Monday, 12 March 2018
Browse Internet

Starting with the April 17 release of Google's Chrome 66 browser, all SSL/TLS certificates that Symantec issued prior to June 1, 2016, will be flagged by Chrome as unsafe, as well as those issued by Symantec-owned brands such as Verisign, Thawte and Equifax.

Starting with Chrome 70, all websites with SSL/TLS certificates that Symantec issued after June 1, 2016, will be impacted in the same way. Google will release the First Canary of Chrome 70 on July 20.

That will hit a few webmasters who are not paying attention to their certificates.