Java vs. Node.js: An epic battle for developer mind share

Found on Infoworld on Wednesday, 18 February 2015
Browse Software

Yes, Java has glitches and bugs, but relatively speaking, it's the Rock of Gibraltar. The same faith in Node.js is many years off. In fact, it may be decades before the JavaScript crew writes nearly as many regression tests as Sun/Oracle developed to test the Java Virtual Machine.

The debate whether to use Java or Node.js on your servers can and will go on for years. As opposed to most debates, however, we can have it both ways.

Java is a pain. Just don't install it.

NSA planted surveillance software on hard drives, report says

Found on CNet News on Tuesday, 17 February 2015
Browse Technology

In a new report, Kaspersky revealed the existence of a group dubbed The Equation Group capable of directly accessing the firmware of hard drives from Western Digital, Seagate, Toshiba, IBM, Micron, Samsung and other drive makers. As such, the group has been able to implant spyware on hard drives to conduct surveillance on computers around the world.

Kaspersky's analysis was right, a former NSA employee told Reuters, adding that the agency valued this type of spyware as highly as Stuxnet. Another "former intelligence operative" said that the NSA developed this method of embedding spyware in hard drives but said he didn't know which surveillance efforts used it.

In the past the US said that any form of hacking can be considered an act of war and they could respond accordingly. With all the details that have been exposed in the past months and years, it makes you wonder who the real threat is.

Pot Could Save Your Life: 4 Ways Cannabis is Good for Your Brain

Found on Alternet on Monday, 16 February 2015
Browse Science

Now there is no doubt that cannabinoids cause new brain cells to grow in the hippocampus. This helps explain previous research showing that cannabinoids effectively treat mood disorders like depression, anxiety and stress – they are all related to a lack of adult neurogenesis.

Several recent studies have found that cannabinoids protect the brain from permanent damage after trauma or stroke.

The medicinal benefits of cannabis and cannabinoids are immense, and it’s time everyone is allowed full access to this amazing healing herb.

It's pretty simple: leave the decision to the people. After all the government has no issues allowing other drugs such as tobacco and alcohol which have a basically lethal effect in the long run.

Should We Really Try to Teach Everyone to Code?

Found on Wired on Sunday, 15 February 2015
Browse Various

If businesses truly want to truly become innovative app companies, they need to turn every department into an IT department and make every employee part of the innovation process. If someone in marketing or finance or HR has an idea for a new app, they should be able to take matters in their own hands.

In order to empower everyone to build apps, we need to focus on bringing greater abstraction and automation to the app development process. We need to remove code — and all its complexity — from the equation.

Not everything is an "App". You don't throw around some cool sounding words and magically look great. In the past Apps were just called what they are: software; and you do not want everybody to be able to write software because the vast majority will fail to avoid even the most obvious security and privacy issues which will turn those programs into a nightmare.

Bank Hackers Steal Millions via Malware

Found on NY Times on Saturday, 14 February 2015
Browse Various

Kaspersky Lab says that the scope of this attack on more than 100 banks and other financial institutions in 30 nations could make it one of the largest bank thefts ever — and one conducted without the usual signs of robbery.

Kaspersky Lab says it has seen evidence of $300 million in theft through clients, and believes the total could be triple that.

The silence around the investigation appears motivated in part by the reluctance of banks to concede that their systems were so easily penetrated, and in part by the fact that the attacks appear to be continuing.

This is exactly why the IoT isn't a brilliant idea. You would think that banks who move around millions each day put a lot of effort into security. Yet they got successfully attacked. Now when it comes to the IoT, most of the "things" won't even see a fraction of the security attention which banks use. The results of a breach could be similar to this, if not even worse.

Facebook bug could have ERASED the ENTIRE WORLD

Found on The Register on Friday, 13 February 2015
Browse Internet

Software engineer Laxman Muthiyah has reported a dangerous vulnerability capable of deleting any photo from Facebook, prompting The Social NetworkTM to patch the hole within two hours and issue one of its biggest bug-spotting cheques ever.

Muthiyah published a proof of concept video detailing the vulnerability and received praise from industry for finding the bug.

You might wonder how big the "biggest bug-spotting cheques ever" was: $12,500 USD. He could have easily sold it for 10-100x the amount on underground markets. For something as critical as this, FB got lucky in exchange for some pocket change.

Live Patching Now Available For Linux

Found on Slashdot on Thursday, 12 February 2015
Browse Software

"You may never have to reboot your Linux machine ever again, even for kernel patching," and excerpts from the long (and nicely human-readable) description of newly merged kernel code that does what Ksplice has for quite a while (namely, offer live updating for Linux systems, no downtime required), but without Oracle's control.

Great news. Now we can get rid of this abomination called systemd which promised faster boot times before it started to take over everything it can.

Pwned in 7 seconds: Hackers use Flash and IE to target Forbes visitors

Found on Ars Technica on Wednesday, 11 February 2015
Browse Internet

Hackers strung together zero-day vulnerabilities in Flash and Internet Explorer and then compromised Forbes.com so that the attacks would compromise financial services and defense contractor employees visiting the site, researchers said.

"Given the highly trafficked Forbes.com website, the exploit could have been used to infect massive numbers of visitors." Instead, only visitors from US Defense and financial services firms were hacked.

Flash again. This plugin is nothing but a collection of holes. It's somewhat amazing how bug ridden this single piece of software is.

Microsoft Patches 41 Internet Explorer Vulnerabilities

Found on eWEEK on Tuesday, 10 February 2015
Browse Software

Microsoft's first Patch Tuesday of 2015 did not patch a single Internet Explorer flaw. Today's February Patch Tuesday update is a very different story, with Microsoft patching a staggering 41 vulnerabilities in IE. In total, Microsoft patched 56 vulnerabilities spread across nine security bulletins.

"I cannot remember when a single Microsoft patch included 41 CVEs, let alone an IE update so large," Andrew Storms, vice president of Security Services at New Context, told eWEEK. "If you consider that all of the Microsoft patches in 2014 added up to 343 CVEs, then we are well on our way already to surpass that number in 2015."

IE is always the biggest update. Pretty annoying especially if you do not use IE at all since it is impossible to remove it completely from a Windows system thanks to its deep integration in the OS.

Internet providers lobby against backup power rules for phone lines

Found on Ars Technica on Monday, 09 February 2015
Browse Technology

The Federal Communications Commission is considering whether to impose backup power requirements on Internet providers that offer phone service, but cable companies and telcos don’t want to be required to keep customers connected through long power outages.

Not surprisingly, voice providers don’t want to face any new requirements. They argue that consumers have willingly switched from copper landlines to VoIP service despite carriers being required to inform customers of the power limitations. Customers are also increasingly using cellular service instead of landlines to make voice calls, they note.

Unfortunately, providers are jumping on the VoIP train just like cows running to the water. For them, VoIP makes it cheaper to provide a service if they are willing to cut off some features. The strict separation between Internet and phone lines adds another layer of security. Plus, there are still a lot of use cases for powered phone lines, like emergency call systems in case the elevator gets stuck due to a power outage and you don't want to be trapped in there for hours or days. Also many home alarm systems are hooked onto the phone line. Adding a UPS and GSM device won't help much if there's an IMSI catcher powered on nearby before breaking in.