Comment Re:They won't stop until apps can only use the clo (Score 1) 27
> it will back up most but not all of the data on your phone automatically.
And count the transfer against your data limits/bill, no doubt.
Submission + - Configuration Snafu Exposes Passwords For Two Million Marijuana Growers (zdnet.com)
An anonymous reader writes: GrowDiaries, an online community where marijuana growers can blog about their plants and interact with other farmers, has suffered a security breach in September this year. The breach occurred after the company left two Kibana apps exposed on the internet without administrative passwords. Kibana apps are normally used by a company's IT and development staff, as the app allows programmers to manage Elasticsearch databases via a simple web-based visual interface. Due to its native features, securing Kibana apps is just as important as securing the databases themselves.
But in a report published today on LinkedIn, Bob Diachenko, a security researcher known for discovering and reporting unsecured databases, said GrowDiaries failed to secure two of its Kibana apps, which appear to have been left exposed online without a password since September 22, 2020. Diachenko says these two Kibana apps granted attackers access to two sets of Elasticsearch databases, with one storing 1.4 million user records and the second holding more than two million user data points. The first exposed usernames, email addresses, and IP addresses, while the second database also exposed user articles posted on the GrowDiaries site and users' account passwords. While the passwords were stored in a hashed format, Diachenko said the format was MD5, a hashing function known to be insecure and crackable (allowing threat actors to determine the cleartext version of each password).
But in a report published today on LinkedIn, Bob Diachenko, a security researcher known for discovering and reporting unsecured databases, said GrowDiaries failed to secure two of its Kibana apps, which appear to have been left exposed online without a password since September 22, 2020. Diachenko says these two Kibana apps granted attackers access to two sets of Elasticsearch databases, with one storing 1.4 million user records and the second holding more than two million user data points. The first exposed usernames, email addresses, and IP addresses, while the second database also exposed user articles posted on the GrowDiaries site and users' account passwords. While the passwords were stored in a hashed format, Diachenko said the format was MD5, a hashing function known to be insecure and crackable (allowing threat actors to determine the cleartext version of each password).
Submission + - SPAM: China is blocking the WHO from investigating the origins of the coronavirus 2
schwit1 writes: The coronavirus was first reported to have originated at an animal market in Wuhan, China, however numerous observers have already questioned this account of the virus’s origins. Among other issues, the original host animal—a species of bat—was not sold at the particular animal market, and the city of Wuhan is home to virology labs where coronaviruses were studied.
While an investigation into the origins of the coronavirus could help prevent future pandemics, China is not allowing the W.H.O. to conduct an independent probe of the matter, according to internal documents and interviews by the Times .
“It was an absolute whitewash,” Lawrence O. Gostin, a professor of global health law at Georgetown University, told the Times regarding the agency’s investigation. “But the answer was, that was the best they could negotiate with Xi Jinping.”
The Trump administration has reacted furiously to China’s failure to prevent the coronavirus from spreading. President Trump has moved to cut U.S. funding to the W.H.O., blaming the organization for parroting Chinese propaganda regarding the country’s response.
Link to Original Source
While an investigation into the origins of the coronavirus could help prevent future pandemics, China is not allowing the W.H.O. to conduct an independent probe of the matter, according to internal documents and interviews by the Times
“It was an absolute whitewash,” Lawrence O. Gostin, a professor of global health law at Georgetown University, told the Times regarding the agency’s investigation. “But the answer was, that was the best they could negotiate with Xi Jinping.”
The Trump administration has reacted furiously to China’s failure to prevent the coronavirus from spreading. President Trump has moved to cut U.S. funding to the W.H.O., blaming the organization for parroting Chinese propaganda regarding the country’s response.
Link to Original Source
Submission + - Police Will Pilot a Program To Live-Stream Amazon Ring Cameras (eff.org)
An anonymous reader writes: This is not a drill. Red alert: The police surveillance center in Jackson, Mississippi, will be conducting a 45-day pilot program to live stream the Amazon Ring cameras of participating residents. Now, our worst fears have been confirmed. Police in Jackson, Mississippi, have started a pilot program that would allow Ring owners to patch the camera streams from their front doors directly to a police Real Time Crime Center. The footage from your front door includes you coming and going from your house, your neighbors taking out the trash, and the dog walkers and delivery people who do their jobs in your street. In Jackson, this footage can now be live streamed directly onto a dozen monitors scrutinized by police around the clock. Even if you refuse to allow your footage to be used that way, your neighbor’s camera pointed at your house may still be transmitting directly to the police.
Only a few months ago, Jackson stood up for its residents, becoming the first city in the southern United States to ban police use of face recognition technology. Clearly, this is a city that understands invasive surveillance technology when it sees it, and knows when police have overstepped their ability to invade privacy. If police want to build a surveillance camera network, they should only do so in ways that are transparent and accountable, and ensure active resident participation in the process. If residents say “no” to spy cameras, then police must not deploy them. The choices you and your neighbors make as consumers should not be hijacked by police to roll out surveillance technologies. The decision making process must be left to communities.
Only a few months ago, Jackson stood up for its residents, becoming the first city in the southern United States to ban police use of face recognition technology. Clearly, this is a city that understands invasive surveillance technology when it sees it, and knows when police have overstepped their ability to invade privacy. If police want to build a surveillance camera network, they should only do so in ways that are transparent and accountable, and ensure active resident participation in the process. If residents say “no” to spy cameras, then police must not deploy them. The choices you and your neighbors make as consumers should not be hijacked by police to roll out surveillance technologies. The decision making process must be left to communities.
Submission + - Another project goes private: Amara stops being developed as Open Source
northar writes: Subtitling project Amara closes its repository as focus is shifting. Blog post. https://blog.amara.org/2020/01... . We have seen a few examples of projects that were Open Source changing their license to something else than an OSI approved license. Amara was AGPL up until going private. While future improvements to the code base from PCF will not be public, a copy of the last public code base has been preserved at Gitlab, should anyone be interested in the work done up until now. https://gitlab.com/hanklank/am... Note that no support is given from PCF for this code.
Comment A duplication of effort (Score 0) 84
This sounds like a severe case of "Not Invented Here" syndrome. We already have a fantastic image archival and replication system in http://clonezilla.org/ , any budding developers would better serve by contributing to the various projects that make it up.
Submission + - The NSA Is Being Sued for Keeping Keith Alexander's Financial History Secret (vice.com)
Daniel_Stuckey writes: Now the NSA has yet another dilemma on its hands: Investigative journalist Jason Leopold is suing the agency for denying him the release of financial disclosure statements attributable to its former director. According to a report by Bloomberg , prospective clients of Alexander's, namely large banks, will be billed $1 million a month for his cyber-consulting services. Recode.net quipped that for an extra million, Alexander would show them the back door (state-installed spyware mechanisms) that the NSA put in consumer routers.
Submission + - Programmers: Why Haven't You Joined The ACM? (itworld.com) 1
jfruh writes: The Association for Computing Machinery is a storied professional group for computer programmers, but its membership hasn't grown in recent years to keep pace with the industry. Vint Cerf, who recently concluded his term as ACM president, asked developers what was keeping them from signing up. Their answers: paywalled content, lack of information relevant to non-academics, and code that wasn't freely available.
Submission + - Bird flocks resemble liquid helium (sciencemag.org)
sciencehabit writes: A flock of starlings flies as one, a spectacular display in which each bird flits about as if in a well-choreographed dance. Everyone seems to know exactly when and where to turn. Now, for the first time, researchers have measured how that knowledge moves through the flock—a behavior that mirrors certain quantum phenomena of liquid helium. Some of the more interesting findings: Tracking data showed that the message for a flock to turn started from a handful of birds and swept through the flock at a constant speed between 20 and 40 meters per second. That means that for a group of 400 birds, it takes just a little more than a half-second for the whole flock to turn.
Comment Avast and Abaft, maties, heave! (Score 1) 231
I'm sure there's a Kernel of Truth in this article and if I found it I'd run it on my old Laptop Of Doom. But if Avast told me the sun was shining I'd have to take a walk to the nearest window before believing it. Seriously. This just reads like exaggerated marketing FUD for their Android app.
Submission + - Linksys Routers Exploited by "TheMoon" (sans.edu)
UnderAttack writes: A vulnerability in many Linksys routers, allowing for unauthenticated code execution, is used to mass-exploit various Linksys routers right now. Infected routers will start scanning for vulnerable systems themselves, leading to a very fast spread of this "worm".
Comment Re:Unity was Canonical's suicide note (Score 1) 685
What Arrogant Bastard said. This was more like vandalism than an "upgrade". My best-working systems are the ones that have been left alone, and the ones that were "upgraded" have given me nothing but frustration and a poor user experience since. As many have said, offering a new UI is fine; throwing it in everyones faces was childish and extremely ill-considered. Major Fail, Ubuntu.
Comment Re:Maybe a punishment? (Score 1) 14
I agree; the treatment given this person could easily have been insulting treatment of a pariah rather than acceptance of a gay person. Assuming we understand the message and motive just because we see the action is an insupportable connection in this case. It is indeed very interesting but does not lend itself to a definite conclusion about the attitudes of the people who conducted the burial. Let's say for example... maybe he killed a woman, and her body was unrecoverable for some reason, but they knew who had done it. The family told him they were going to have a burial for her whether she could be recovered or not, and he was invited to stand in for her.
Comment Satisfying the Victim/Customer, Chinese Style (Score 1) 347
I got my education on this issue early on, in the 80's. I was running a popular BBS and had a boner for one of those new-fangled ripping-fast 1200 baud modems. I just knew my life would be better if I could get one, but couldn't afford the prices. Then I went to a computer show and saw it in its plain white box: a Genuine "Hi-Fidelity" brand 1200 baud internal modem for no more than 80 or 90 bucks. Well Now! I went home that night and slipped it into an ISA slot on my Wells-American 12MHz '286 and It Worked! I was thrilled, until I started trying to tie it into the BBS software. Everything ran without a complaint, until it was time for the modem to actually behave as it was being told to do; setting for auto-answer, how many rings to wait before answering, setting a particular baud rate, anything of that sort that went beyond ATDT or ATA (dial a number or answer a call) just didn't seem to be working out.
I stayed up for hours into the night trying to figure out what I could possibly be doing wrong, issuing Hayes commands from a terminal, seeing them accepted and tearing my hair out while the system acted as if I had done none of the "right" things to make everything work. Around 2 or 3am with the beer and my patience running out, I sat down in front of the terminal and typed "ATFUCKYOU" and hit . The damnable thing answered back "OK" and I realized I had been had.
It would answer "OK" to -any- string as long as it had an AT in front of it. Us round-eye devils wanted Hayes command set compatibility and they'd give it to us... on their terms, and run away with the money. It was an expensive (in 1984 or so dollars) lesson in the psychology of Chinese technology vendors that I have never forgotten. Don't trust them, don't trust even what you see unless you can confirm it all the way to the end of the test chain, and then don't assume the next one out of the box is going to act anything like the one you just tested.
Comment Re:FS isn't an ordinary "game" (Score 1) 162
> I was quite disappointed when SubLogic sold out to MS.
Amen. Bruce Artwick, where are you when we need you?
Slashdot Top Deals
"Don't discount flying pigs before you have good air defense." -- jvh@clinet.FI
