"the claim that this can work against all Microsoft Wireless Keyboards is 100% BS, and has been since 2007, when the issue was first uncovered; covered in depth by Schneier, and remedied in all versions of the Microsoft Wireless Keyboard created since then, which use at minimum 128-bit AES; NOT XOR."

The only meaningful hits on 'schneier microsoft wireless keyboard' is just a few broken links to a Dreamlab study: http://www.google.com/search?q...,

Those were using a 27 MHz transmitter (near field, i suppose) and an association process that at least uses a different xor key each time. TFA claims that the newer 2.4 GHz keyboards always use the same xor key, 0xCD. TFA mentions at least two recent keyboard models that use this protocol. (Maybe I overlooked other ones)

It seems that there is only the MS "2000 AES for business" keyboard that is explicitly marketed as using AES. http://www.microsoft.com/hardw...

"Turkey -- 99.8% Muslim"

Where did you get that number? Walk around in a big city and you will see less than 50% of the local women wearing head scarves, in most neighborhoods. In some places, it's less than 10%.

Turkey does register most citizens as "muslim" as a default value, unless they are christian or jewish, but it has little to do with the beliefs of those citizens. Many Turks are atheistic (and utterly despise the present muslim government).

Source: my Turkish S.O., who has "Islam" in her passport despite coming from a family that has been secular for several generations.

TFA: "... RC4 are broken. Again, no need to wait for them to become even weaker, disable them now."

Is that really so? I think RC4/arcfour is only known to leak secret data in the first 2 KB of the cipher stream, and for that reason SSH will simply feed it 2 KB or so of garbage data before encrypting the actual payliad. Or am I mistaken?

RC4 has a big advantage: it is by far the fastest cipher, which is relevant if you want to do large file transfers over slowish hardware (home-grade NAS, Raspberry Pi, old Atom CPU, etc.).

The mistake he made was not understanding the tools he was using. (...) Signing up for a service and then using it without reading the documentation is foolish.

I assume that you also blame the subprime borrowers for signing a contract that they didn't fully understand without putting most of the blame on the banks that knew damn well what they were doing?

The fact that one person can be blamed for a mistake due to lack of experience does not mean that there is not someone else (i.e., Amazon and the people who actually abused the keys) who deserves a lot more blame.

I knew my API key needed to be safe, so I installed the Figaro gem (a rails API key security gem, which typically works great), and trusted it to keep my API key off of git when I pushed. (...) deleted all traces from GitHub. I was able to clean it up within about 5 minutes (...) After a close call, I went to bed.

Surely it is not that unreasonable to (1) realize that those keys will be scraped within 5 minutes after uploading to an obscure project, and (2) not realize that an S3 key in a free trial subscription wouldn't allow racking up $2375 in EC charges within 10 hours?

Repeat guests? C'mon, really? You shop for hotels the same way the rest of us do - Either your employer tells you "you will stay here", or you use a price search and pick the lowest place that doesn't mention rats in the toilet.

Would you book a place that mentions complaints along the lines of "The bathroom is clean, but cell phones of any provider don't work here and the room phone is 2 dollars per minute?"

As for the employer: the travel offices of big companies who regularly have their people work on site at major customer or other offices will consider putting their employees somewhere else if they all complain about a particular hotel. The repeat customer is not the individual person, but the employer.

"the carriers and phone makers are all REQUIRED by calea (in the US) to have backdoors on anything that has a 'network' aspect to it."

Citation needed.

"they have magic usb cables that get into your phone"

I think I saw a website of a company that claims to have such a device, but I had the distinct impression that it mostly helps with booting into recovery mode (android phones); it will tell you which combo of power/volume up/down to press during boot. Some phones don't have a locked bootloader or have a bootloader that allows installing software to the "ROM" from the bootloader. (I've seen this on low-end Samsungs and the popular Clockworkmod bootloader for Cyanogenmod allows this).

For phones that are switched on, it will.check for usb debugging and mass storage access.

Essentially, it has collected the known procedures for rooting for a lot of phones. Guess what, a lot of phones cannot be rooted without either having unlocked the screen or wiping all user data.

"Unless they have changed their stance since CM7, the privacy manager sucks compared to XPrivacy because XPrivacy will allow spoofing of data. If a permission is flatly blocked instead of spoofed then many apps will force close"

Well, they did. CM11 has a privacy manager that will allow you to block access to contacts and so on, without making apps crash. I have set it up such that it will notify me whenever an app tries to access contacts, sms, calendar, location and it is surprising how few suspicious popups I get. One weird thing: wifi related apps need location access in order to show access points. Makes some sense, but it took me a while to realize why those apps weren't working.

"You need it backed up on at least 4 pieces of media, of at least 3 different types, in at least 2 different cities, in at least 1 different state; bumping each of those numbers up by 1 is not unreasonable."

At least 2 different cities means two or more cities.
At least 1 different state means one or more states.

Well, at least, you don't store it in zero states.

"[Conventional plants] also produce so much more power that merely sending somebody by once a year to glance that the greed led is still softly glowing is more maintenance per watt."

That could be an interesting hypothesis, but if you put it down like a hard fact, you should also provide some data to support it so that we can have a meaningful discussion about it.

That is 0.50 $/Wh. You can buy USB powerbanks for EUR 7 per 2600 mAh, which is about 0.70 EUR/Wh or 0.85 $/Wh and includes a USB cable, fancy colored shell, USB connectors, charging circuits, and status LEDs.

I'm surprised that the economy of scale makes so little difference.

In LaTeX (and Word for that matter), I always prefix my notes with @@@ because that is a string that nnever occurs in normal text (easoly searchable) and that sticks out visually like a sore thumb.

Percent-sign-prefixed comments ("this needs an update") are much easier to overlook, or even guaranteed to be overlooked during proofreading. At least, I don't proofread my LaTeX markup, but rather the typeset document.

"It's called the F5 - From what I can gather, somewhere along the line they had to "enhance" the F ratings to get more f4's and ef 5's."

Not quite. From Wikipedia:

It was revised to reflect better examinations of tornado damage surveys, so as to align wind speeds more closely with associated storm damage. Better standardizing and elucidating what was previously subjective and ambiguous, it also adds more types of structures and vegetation, expands degrees of damage, and better accounts for variables such as differences in construction quality.
(...)
Since the new system still uses actual tornado damage and similar degrees of damage for each category to estimate the storm's wind speed, the National Weather Service states that the new scale will likely not lead to an increase in a number of tornadoes classified as EF5.

http://en.m.wikipedia.org/wiki...