firehose

A Swiss engineer known as Mr. Gerdes designed this monowheel. It is pictured here, ridden by a man who may or may not be Mr. Gerdes, apparently on a trip to Spain in 1931.

Well sir, there's nothing on earth like a genuine, bona fide, electrified, six-foot monowheel. It's on our list of ideas from early 20th century gearheads that we wish had caught on, if only because they look so cool (definitely not because they're safe).

The monowheel became something of a trend between world wars, when excited visions of the future seemed to spring from the joy that there even would be a future. Although dozens of varieties rolled out over the years since the 1860s, you're unlikely to see one. They now exist mostly in patent applications, magazine covers, and a handful of garages. Unsurprisingly, they've made plenty of appearances in sci-fi flicks, adding a measure of cool to otherwise mediocre movies.

The basic principle of the monowheel is easy to understand: Build a big enough wheel, and you can put a rider insider of it along with a motor to move the whole works forward. Early versions featured various combinations of motors (gas, electric, pedal-powered) and gear assemblies and are said to have reached speeds up to 93mph—though their manufacturers were known to claim ludicrous speeds. Some versions were refined into relatively practical, not-totally-guaranteed-to-kill-you ways of getting around, if you're brave enough to hop in.

Aurich Lawson / Thinkstock

By now everyone knows about the OpenSSL Heartbleed vulnerability: a missing bounds check in one of the most popular TLS implementations has made millions of Web servers (and more) leak all sorts of sensitive information from memory. This can leak login credentials, authentication cookies, and Web traffic to attackers. But could it be used to recover the site’s TLS private key? This would enable complete decryption of previously-recorded traffic if perfect forward secrecy was not negotiated at the time and otherwise Man-in-The-Middle attacks to all future TLS sessions.

Since this would be a much more serious consequence of Heartbleed, I decided to investigate. The results were positive: I was able to extract private keys from a test Nginx server after a few days' work. Later I applied my techniques to solve the CloudFlare Challenge. Along with a few other security researchers, we independently demonstrated that RSA private keys are indeed at risk. Let's go through the details on how to extract the private key and why the attack is possible.

How to extract the private key

Readers not familiar with RSA can read about it here. To simplify things a bit, a large (2048 bits) number N is constructed by multiplying together two large randomly generated prime numbers p and q. N is made public while p and q are kept secret. Finding p or q allows recovery of the private key. A generic attack is just factorizing N, but this is believed to be difficult. However, with a vulnerability like Heartbleed, the attack is much simpler: since the Web server needs the private key in memory to sign the TLS handshake, p and q must live in memory and we can try to obtain them with Heartbleed packets. The problem simply becomes how to identify them in the returned data. This is easy, as we know p and q are 1024 bits (128 bytes) long, and OpenSSL represents big numbers little-endian in memory. A brute-force approach treating every 128 consecutive bytes in the Heartbleed packets as little-endian numbers and testing if it divides N is sufficient to spot potential leaks. This is how most people solved the CloudFlare challenge.

More from our team sites

If you're still using a 12-year-old operating system, a new security flaw discovered in Internet Explorer should cause you quite a bit of consternation. Microsoft published a security advisory today warning its customers that a vulnerability in all versions of Internet Explorer (6 through 11) could let hackers gain full user permissions over your computer, allowing them to install programs, view and delete data, and much more simply by visiting a website.

That's not good, but at least anyone using Internet Explorer on a modern version of Windows will likely see a patch within a couple weeks' time. Since Microsoft finally ended support for Windows XP on April 8th, it will not receive an update. This is the first known security flaw since that support deadline passed, and it bears true the warnings voiced by the tech community. Windows XP is no longer secure, and it's time to move on.

Security firm FireEye, which revealed the flaw to Microsoft, says that there's evidence of an active exploit targeting Internet Explorer 9 through 11 and Adobe Flash. All Internet Explorer users, regardless of operating system, have a few choices for avoiding this exploit. The easiest method is to use another browser, like Chrome or Firefox (both of which are currently still supported for Windows XP). If you need to stick with Internet Explorer, Microsoft has published some more advanced methods alongside its service advisory. Regardless of what you do, it's a good a idea to take some action to make sure you're safe from the exploit.

OpenSSL is a key security backbone for untold thousands of websites to make sure strangers can't see what you're doing. But as the Heartbleed bug as revealed, this essential tool is in dire need of support; the hodgepodge team in charge of upkeep for the open source protocol is severely understaffed and underpaid. Buzzfeed has published a wonderful feature story on the two men who have been primarily responsible for OpenSSL for more than a decade, and it provides a look into just how a simple flaw like Heartbleed could have made it into the code. Thankfully, if one good thing has come out of this massive security breach, it's that OpenSSL may get some of the attention that it needs — there are already efforts to secure more funding for the project, and BuzzFeed reports that the team plans on bringing in a second full-time developer soon.

ctron164:

sizvideos:

How to Tell Black People Apart by David Alan Grier - Video

X____X