a match manufactured in heaven

Bad things happen when we don't repeat the obvious.

It's 9pm and I'm writing a post for the company engineering blog. Every sentence is a slog. Not because I'm exacting and conciseness isn't my strong suit. My writing is slow because every word is obvious, almost patronizing.

Obvious realities bear repetition, and so must you. Common sense is not so common. The majority of ideas floating around try too hard. They're designed to confuse, seduce, and sell. Press releases and ads push to the forefront, while reviewed articles and texts sit on shelves and in queues.

Repeat the obvious, so we stay on the same page. The ways we rush people into technology leaves little time for foundations. Software is so new and developers so in-demand, every wave brings more fresh minds than the last. Developers are arriving faster than knowledge can diffuse.

Repeat the obvious, to keep perspective. Technology may favor the new, but fundamentals do exist. Without reminders, time buries working technologies in the dust of silence.

Repeat the obvious, to avoid bizarre dark ages. Take functional programming's disappearance in the 1990s/2000s, cast aside in favor of object orientated hype. Or that one time when not enough programmers talked about and taught event-driven servers programming and Frankenstein was cast as revolutionary.

So I hope you'll forgive the repetition. It hurts me more than it hurts you, and believe me when I say it helps many. Documentation does not equal disussion. The modern media landscape demands a technology have both docs and discourse to remain useful.

Until we live in a world where reference rules over repetition, you can help by writing about something painfully obvious to you. Bad things happen when we don't repeat the obvious.

151104

"Don't buy a barrel of oil," the broker said. "It'll kill you."

Oil may be king of the commodities, but its physical form is tough to come by for a retail investor. Mom and pop can buy gold and silver. They can gather aluminum cans, grow soybeans, and strip copper wiring, if they choose, but oil remains elusive -- and for very good reason. Oil, as I would soon discover, is practically useless in its unrefined form. It is also highly toxic, very difficult to store, and it smells bad. [...]

"Could a barrel of crude really kill me?" I asked a petrochemical engineer captive to my persistent, doubtlessly annoying questions. It absolutely can, he said. Hydrogen sulfide gas -- H2S, for short -- has a terrible propensity to evaporate from crude, knock out your olfactory capabilities, and slowly suffocate you to death. [...] "If you inhale ethyl alcohol vapors in a concentration of 1,000 ppm (0.1 percent by volume) for eight hours, you may get drunk. If you inhale hydrogen sulfide in a concentration of 1,000 ppm (0.1 percent by volume) for only a few seconds, you will be dead." [...]

"That [is] all good and well until you learn it's not Bakken but Kurdish oil, under strict embargo. Well done [for] supporting ISIS," the consultant replied by e-mail. Adding insult, the consultant informed me that the glass bottle was worth more than the oil inside it, anyway.

Previously, previously, previously.

Handcrafted.

The sales pitch sent out by Airbnb promises anyone who feels compelled to shell out $500 to $750 the opportunity to engage in one of three "handcrafted trips." Locally the options include the aforementioned Mission tour, a nature tour (think Lands End day hikes), and a foodie tour. [...]

Unsurprisingly, the email highlights beautiful and iconic San Francisco locations like Dolores Park. What is perhaps surprising, on the other hand, is the email's marketing copy which seems to suggest that the "big shifts" in the "rapidly changing" Mission District are entertainment -- or just another sight to be consumed by the curious traveler.

Previously, previously, previously.

Twitch crowd-controlled installation hijacked by Gentoo botnet, wrecked by fiber cut

Vid Hundreds of people are trying to install Arch Linux on a machine at the same time in the same terminal, using a voting system to decide the next keypress.…

CBS plans new subscription-only series to debut in 2017

Star Trek will return in a new series in 2017, but the venerable program will quickly disappear from screens other than those subscribed to US broadcaster CBS' "All Access" video-on-demand platform.…

Se la tenía jurada hace tiempo.

PayPal is hiring for a full-time senior staff position for a unique role: working on Python that powers the core of PayPal's security.

This is not your typical "full-stack" position. We're seeking a dynamic engineer specializing in the fundamentals: networks, operating systems, and cryptography. All with Python of course.

The role includes work on high-performance, high-security Python in an enterprise context. Our flagship product reaches billions of service requests per day with submillisecond response times. In addition to that work, there are many opportunities to contribute to and support our Python community within PayPal, as well as contribute your work back to open-source. We began with patches to our open-source dependencies, like gevent, and eventually released our own server framework, SuPPort. Of course there are also full benefits and many workplace perks.

In June 2015, Trustwave issued an organisation-validated certificate for paypal-office.com, myaccount-paypal.com and paypal-sign.com that was used on a PayPal phishing site. The certificate was issued to an individual in India, Asha Shaikh, who may be the fraudster behind the phishing site, or perhaps one of the fraudster's victims. The phishing attack is now offline, but the certificate has yet to be revoked by Trustwave at the time of writing.

Rendered contents of phishing site found on www.paypal-office.com. The error message visible at the top of the page is a giveaway: the geo-location of the visitor's IP address failed, and it reveals the location of the files used to power the phishing site.

Certificate authorities typically sell certificates in three broad categories of assurance: domain-validated certificates simply validate control over a domain name; organisation-validated certificates include the identity of the organisation; and Extended Validation certificates increase the level of identity checking done to meet a recognised industry standard.

The difference between DV, OV, and EV certificates is sometimes subtle — many sources of consumer advice do not make the distinction between certificates that provide further identity information and those that only validate domain name ownership. For example, Google Chrome's help page states: "You can tell if a site is real if it has a valid TLS/SSL certificate".

Most certificates with deceptive domain names are domain-validated, though some appear to be organisation-validated. Many of the SSL certificates associated with CloudFlare's "Universal SSL" programme are ostensibly organisation-validated; however, the organisation being validated in this case is CloudFlare itself and not each individual customer.

An organisation-validated certificate for paypal-office.com shown in the Windows certificate viewer.

Rather than be processed automatically, as is possible with domain-validated certificates, most higher-assurance certificate requests will be reviewed by a human prior to issuance. This additional level of validation makes it all the more surprising that a request for a certificate containing "paypal" wasn't considered a high risk request, and consequently rejected after being subjected to increased scrutiny.

Trustwave offers a Relying Party warranty with its certificates, covering fraudulent credit card charges made by a Trustwave certificate holder. However, the warranty does not cover other types of fraud, meaning phishing for credentials or fraudulent payments using other payment methods are not covered. As a result, victims of this phishing attack will not be able to claim on this warranty, despite having their PayPal credentials stolen by a fraudster using a Trustwave certificate.

In just one month, certificate authorities have issued hundreds of SSL certificates for deceptive domain names used in phishing attacks. SSL certificates lend an additional air of authenticity to phishing sites, causing the victims' browsers to display a padlock icon to indicate a secure connection. Despite industry requirements for increased vetting of high-risk requests, many fraudsters slip through the net, obtaining SSL certificates for domain names such as banskfamerica.com (issued by Comodo), ssl-paypai-inc.com (issued by Symantec), and paypwil.com (issued by GoDaddy).

CloudFlare, a content delivery network that provides free "Universal SSL" to its customers, is a hotspot for deceptive certificates, accounting for 40% of SSL certificates used by phishing attacks with deceptive domain names during August 2015. CloudFlare's Universal SSL certificates are provided in partnership with Comodo, and CloudFlare also use GlobalSign certificates for some of its customers. CloudFlare's flexible SSL option also appeals to fraudsters, offering a padlock in victims' browsers without the need for attackers to set up SSL on their web servers.

A screenshot of a PayPal phishing site using a widely trusted SSL certificate valid for www.pay-pal.co.com. The certificate is a CloudFlare Universal SSL certificate issued by Comodo. The certificate has not been revoked; however, the phishing site is no longer available.

Websites that use TLS (the successor to SSL) are marketed as being trustworthy and operated by legitimate organisations. Consumers have been trained to "look for the padlock" in their browser before submitting sensitive information to websites, such as passwords and credit card numbers. While the reality is more nuanced, the data submitted to a phishing site using TLS is protected from eavesdroppers. However, a displayed padlock alone does not imply that a site using TLS can be trusted, or is operated by a legitimate organisation.

A screenshot of a NatWest phishing site using a widely trusted SSL certificate valid for natwestnwolb.co.uk. (nwolb stands for NatWest online banking. The legitimate NatWest online banking service is available at www.nwolb.com.)

A screenshot of a Bank of America phishing site using a widely trusted SSL certificate valid for banskfamerica.com.

The following table lists some examples of deceptive SSL certificates that have been used to conduct phishing attacks, along with their Domain Registration Risk scores:

* The certificates that CloudFlare issues to its customers are ostensibly organisation-validated, as they contain CloudFlare's company name and address. However, the customer domains themselves are only domain-validated.

The CA/Browser Forum's Baseline Requirements – a set of rules that publicly-trusted certificate authorities are expected to follow – require that high-risk domain names that may be used for fraud or phishing are subjected to additional verification:

High Risk Certificate Request: A Request that the CA flags for additional scrutiny by reference to internal criteria and databases maintained by the CA, which may include names at higher risk for phishing or other fraudulent usage.

The CA SHALL develop, maintain, and implement documented procedures that identify and require additional verification activity for High Risk Certificate Requests prior to the Certificate’s approval.

Despite this requirement, many major certificate authorities issue SSL certificates for deceptive domains used in phishing attacks. Notable exceptions include DigiCert and Entrust, neither of which issue domain-validated certificates.

A pie chart showing SSL certificates containing a deceptive domain name that were used in phishing attacks during August 2015, split by certificate authority. CloudFlare and non-CloudFlare certificates are shown separately.

Certificate authorities commonly provide SSL certificates at three different levels of assurance:

• Domain validated (DV)
  Certificate authorities only have to check that the certificate's applicant controls the domain name contained in a DV certificate. These certificates are typically the cheapest option, and can be had for free or be purchased for less than $10. Let's Encrypt is planning to offer free, automatically-issued DV certificates starting later in 2015.
• Organisation validated (OV)
  In addition to validating the domain name in the certificate, the identity of the person or organisation applying for an OV certificate is also verified by the certificate authority and included in the certificate. Most browsers do not treat OV certificates any differently to DV certificates.
• Extended validation (EV)
  Like OV certificates, the identity of the organisation applying for an EV certificate is verified by the certificate authority. However, the verification is more stringent. EV certificates also receive different treatment in major web browsers – the address bar is either partially or completely coloured green and the requesting organisation's name and country are displayed next to the padlock. The requirements for EV certificates in Chrome are changing, with many certificate authorities caught out by recent changes to require Certificate Transparency.

The requirement to perform additional verification of high risk certificate requests applies to all levels of assurance. However, DV certificates are often issued completely automatically within minutes, making it easy for fraudsters to obtain DV certificates for deceptive domain names.

Several certificate authorities offer free trial certificates with shorter validity periods. For example, Comodo offers free 90 day certificates, which have been used by a number of SSL phishing attacks. Symantec also offers free 30 day certificates through its GeoTrust brand. The short validity periods are ideal for fraudsters as phishing attacks themselves typically have short lifetimes.

Netcraft's Domain Registration Risk service automatically identifies deceptive domain names constructed using such tricks. The service calculates a risk score between 0 (low risk) and 10 (high risk) for each domain name, which represents the likelihood that the domain name will be used to carry out a phishing attack. Certificate authorities can make use of the service to determine if a domain name is likely to be used for fraudulent purposes before issuing the certificate.

The service can be provided as an API that mimics a Certificate Transparency log server for ease of integration with your existing certificate issuance process. The same API can also be used with Netcraft's certificate compliance checking service, which can identify certificates before they are issued that do not conform with the CA/B Forum's Baseline Requirements or its EV Guidelines.

Number 5 on Jonny Lieberman’s list of “13 Cool Facts About the 2017 Porsche 911” for Motortrend:

So much for “Do No Evil.” There’s no technological reason the 991/2 doesn’t have Android Auto playing through its massively upgraded PCM system. But there is an ethical one. As part of the agreement an automaker would have to enter with Google, certain pieces of data must be collected and mailed back to Mountain View, California. Stuff like vehicle speed, throttle position, coolant and oil temp, engine revs — basically Google wants a complete OBD2 dump whenever someone activates Android Auto. Not kosher, says Porsche. Obviously, this is “off the record,” but Porsche feels info like that is the secret sauce that makes its cars special. Moreover, giving such data to a multi-billion dollar corporation that’s actively building a car, well, that ain’t good, either. Apple, by way of stark contrast, only wants to know if the car is moving while Apple Play is in use. Makes you wonder about all the other OEMs who have agreed to Google’s requests/demands, no?

Yes, it does.

Update: Google responds. I would call it a non-denial denial, but you be the judge.

There is literally no chance that doing what they want is in your best interest, unless you are on their board.

The Top 9 People and Companies Cashing in on Airbnb's $8 Million Campaign

Airbnb's jawdropping $8 million expenditure to defeat the ballot measure that would strictly regulate short-term rentals in San Francisco has the No on Proposition F campaign on track to become one of the most expensive in San Francisco history. With five weeks to go, Airbnb trails only the American Beverage Association ($9.2 million to defeat the soda tax in 2014) and PG&E ($10.8 million in 2008 to defeat public power).

Airbnb's $8 million far outstrips the $5.6 million that all 14 mayoral candidates combined spent in the 2011 election.

You may have read an astroturf blog post against Prop F; read this instead.

Previously, previously, previously, previously, previously, previously, previously.