There’s a few reasons for this. First, the Tarsnap client-server protocol does not use TLS

I was also lucky: The Tarsnap webserver happens to be running an older version of OpenSSL which never had the vulnerable code

http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartbleed-here.html

For those who are curious about the protocol that Tarsnap uses : it’s explained here

So, I’ve learned about Fourier every year in my bachelor of Mathematics and I’m learning about the efficient algorithm dealing with the Fourier Transform in my class of Algebra right now.

I found a really nice video explaining really quick what it is, concretely.

Here’s wikipedia way of showing that made by LucasVB, this crazy guy doing all those math gifs you’ve probably seen before :) more here

There’s also a visualization in d3.js here: http://bl.ocks.org/jinroh/7524988

I remember reading about how the newly facebook chat was made using long pollings, years ago. Now with HTML5 with have sockets and webhooks made easy. I wonder if they’re still using long polling now…

Anyway, Zapier. A start up that is making APIs easy, is writing a lot of interesting tutorials these last few months. Their new Chapter 7 was released and it’s about polling and web hooks. And as usual it’s great!

https://zapier.com/learn/apis/chapter-7-real-time-communication

After messing around with this code for about a month I decided to write this up for the tubes in the hope that I can save some souls. I have come to the conclusion that OpenSSL is equivalent to monkeys throwing feces at the wall. It is, bar none, the worst library I have ever worked with. I can not believe that the internet is running on such a ridiculous complex and gratuitously stupid piece of code. Since circa 1998 the whole world has been trusting their secure communications to this impenetrable morass that calls itself the “OpenSSL” project. I bet that the doctors that work on that shitshow can not prescribe anything useful either!

worrying essay, read it here: https://www.peereboom.us/assl/assl/html/openssl.html

We have tested some of our own services from attacker’s perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.

A pretty bad bug has been found in open SSL during the Codenomicon. more info here: http://heartbleed.com/

List of vulnerable websites from the Alexa top 10,000 websites: https://gist.github.com/dberkholz/10169691

You can test a website here: http://filippo.io/Heartbleed/

And also, if you have a lot of time to waste, this random dude seems to know a lot about it :D

A great article from AskAmathematician about true randomness.

The question is actually geared towards physicists and the tl;dr is: true randomness exists. Take that causality believers.

And as I expected, the experience to prove this is done with photons:

http://www.askamathematician.com/2009/12/q-do-physicists-really-believe-in-true-randomness/

I just gave a talk about bitcoins at my uni, here are the slides

Some people from Stanford are planning to build an anonymous market place. As Silk Road as shown, such a project can only fall with time unless it is decentralized. With all the new ideas and technologies coming into place (in protocols such as bitcoins, namecoins (for dns)), they are thinking of applying them for a decentralized market place as well.

More info here: https://mailman.stanford.edu/pipermail/liberationtech/2014-March/013304.html

And a new github repo to watch out for!

https://github.com/goshakkk/decentralized-anonymous-marketplace-concept

They say that this wireless security system might now be breached with relative ease by a malicious attack on a network. They suggest that it is now a matter of urgency that security experts and programmers work together to remove the vulnerabilities in WPA2

it is the de-authentication step in the wireless setup that represents a much more accessible entry point for an intruder with the appropriate hacking tools. As part of their purported security protocols routers using WPA2 must reconnect and re-authenticate devices periodically and share a new key each time.

In the meantime, users should continue to use the strongest encryption protocol available with the most complex password and to limit access to known devices via MAC address.

http://sciencespot.co.uk/wpa2-wireless-security-cracked.html

1. they allowed “file://” to be fetched from their servers when they should have restricted it to “http(s)://”

2. they were using servers that were part of a network to do some private stuff, didn’t filter those ips, people on the same network could perform those tasks.

http://engineering.prezi.com/blog/2014/03/24/prezi-got-pwned-a-tale-of-responsible-disclosure/