Monthly Archives: September 2020

Why there is no speed limit in the superfluid universe – Newswise

Posted on by

Newswise Physicists from Lancaster University have established why objects moving through superfluid helium-3 lack a speed limit in a continuation of earlier Lancaster research.

Helium-3 is a rare isotope of helium, in which one neutron is missing. It becomes superfluid at extremely low temperatures, enabling unusual properties such as a lack of friction for moving objects.

It was thought that the speed of objects moving through superfluid helium-3 was fundamentally limited to the critical Landau velocity, and that exceeding this speed limit would destroy the superfluid. Prior experiments in Lancaster have found that it is not a strict rule and objects can move at much greater speeds without destroying the fragile superfluid state.

Now scientists from Lancaster University have found the reason for the absence of the speed limit: exotic particles that stick to all surfaces in the superfluid.

The discovery may guide applications in quantum technology, even quantum computing, where multiple research groups already aim to make use of these unusual particles.

To shake the bound particles into sight, the researchers cooled superfluid helium-3 to within one ten thousandth of a degree from absolute zero (0.0001K or -273.15C). They then moved a wire through the superfluid at a high speed, and measured how much force was needed to move the wire. Apart from an extremely small force related to moving the bound particles around when the wire starts to move, the measured force was zero.

Lead author Dr Samuli Autti said: "Superfluid helium-3 feels like vacuum to a rod moving through it, although it is a relatively dense liquid. There is no resistance, none at all. I find this very intriguing."

PhD student Ash Jennings added: "By making the rod change its direction of motion we were able to conclude that the rod will be hidden from the superfluid by the bound particles covering it, even when its speed is very high." "The bound particles initially need to move around to achieve this, and that exerts a tiny force on the rod, but once this is done, the force just completely disappears", said Dr Dmitry Zmeev, who supervised the project.

###

The Lancaster researchers included Samuli Autti, Sean Ahlstrom, Richard Haley, Ash Jennings, George Pickett, Malcolm Poole, Roch Schanen, Viktor Tsepelin, Jakub Vonka, Tom Wilcox, Andrew Woods and Dmitry Zmeev. The results are published inNature Communications.

View post:
Why there is no speed limit in the superfluid universe - Newswise

Hash, Salt and Pepper: How cooking your password makes it safer – Gearbrain

Posted on by

Data breaches are a nearly daily occurrence, with passwords and other personal data captured by hackers from the companies where you shop, eat and bank. Often, though, the password you diligently remember when you order groceries for the week, has been stored in a way that protects you fairly well. That process is called hashing, with a second step, called salting, and a third called peppering. All three can be used together often they're not but even one step one can help to lock down your special word, phrase or string of characters even more.

Here are the differences between the three, and most keenly why you should want to make sure that the companies you entrust with your business, also take steps to protect your information too. Even if you use a password manager to securely store your own credentials, hopefully the places where you go online are taking these security measures too.

Hashing transforms your password from plain text to a new outputGetty Images/iStock

What is Hashing?

Hashing is a way of transforming your password into a unique identifier and fingerprint that are hard to invert and essentially reverse. Basically you're mincing up your data, and creating a fixed output. Why would you want to use a hash? If a password is just stored as plain text, then if a hacker gained access to that data they would have the keys to your account and potentially others if you've reused that password in other places.

"If you use the more simple implementation, and not have [passwords] hashed at all, and a password data base is breached, everyone's password is fairly accessible," Arve Kjoelen, chief information security officer at McAfee told GearBrain.

So that's why many companies will say, if they've been breached, that while their database was captured, it contained hashed passwords. Think of these then as phrases that have been encoded into a secret language. You really can't reverse engineer a hash. But intrepid hackers can try and find the secret language, pushing a slew of words through coding, and then compare those results with hashed passwords. They may not know the hash a company has used, but they can just compare their hashed collection to a company's and try to match the hashes together. If they find a match they can then figure out the password.

And that's exactly what some hackers do, Jim Miller at Trail of Bits told GearBrain.

"An attack called a rainbow table can generate a giant value where they compute the hash of those passwords," said Miller, a serious security engineer for Trail of Bits' cryptography team. "And so an attacker can compare those values against the table and easily identify a password in a database."

Not great. So that's why many companies then take a second extra step called salting.

Salting adds another layer of security, attaching a new random character to your passwordGetty Images/iStock

What is Salting?

Salting works a little bit as it sounds. Just like the way people add salt to their food, salting in cryptography adds another element to your password, designed to make it just that much harder to crack or guess.

The way a salt works, a random character is assigned to your password the same random character each time but you, nor even the company, knows what it is. Then, your new password, what you think of as your password plus the added salt, is hashed. And voila, you have something that is pretty hard to decipher.

"You can find a rainbow table online," said Miller. "But you can't predict what the salt value will be, and so that makes the table useless."

You never see this process when you're logging on to buy those books for class. Instead, you're just entering your password, and the system is looking up the salt for you, and then the hash. And that happens in less than a second. It does cost more to add this second, salting step, but it's that extra step that helps locks down a consumer's information and protects a company's reputation too.

"You don't have to salt passwords to be more secure, but it's the right thing to do," Dave Hatter, a cybersecurity consultant in Cincinnati, Ohio told GearBrain.

Peppering takes your security to another level, assigning another value and storing that away from the original password Getty Images/iStockphoto

What about Peppering?

Peppering takes the whole salting concept another step further, and assigns a second random value to the password but this value is never stored with the salt nor the password.

You could think of a pepper is just an extra salt. But the pepper is a not only a secret key that only shows up when a customer is logging into a site, it also has to be stored in a separate location so it actually remains a secret.

You may be able to guess the hash, and even get into the salt, but if the pepper is somewhere physically elsewhere, a hacker would have to have access to both databases to really make any headway.

"Peppering improves the security of a salt and hash because without the pepper value, an attacker cannot crack a single hash," Hatter said.

So what should I do to protect myself?

First, you should make sure you're doing the basic security steps to protect your password and secure your digital life. That includes basic things from changing the default password that comes on your new device to not using your child's name as your across the web. (Please.) These are actions you can take on your own and they're free.

Then, you wouldn't be wrong to check to see how the company you're working with, whether that's your financial institution or the online grocery store where you regularly shop, is securing your personal data including your password.

You don't have to be a coder to understand whether a company is encrypting data you enter into their web site. You just have to be willing to make a decision on whether you want to work with those firms who are trying to protect your accounts, or not. That's a step many people should consider taking.

"I think consumers should be aware of the various ways of storing their passwords," said McAfee's Kjoelen. "And if it's not stored securely, when there is a breach, those passwords could potentially be cracked."

Link:
Hash, Salt and Pepper: How cooking your password makes it safer - Gearbrain

How breakthroughs in privacy-enhancing technologies enable the future of biometric authentication – IFSEC Global

Posted on by

London Tech Week

The first virtual London Tech Week took place in early September, providing attendees with unmissable content from a range of experts discussing the latest innovations in tech and its impact on businesses. Security featured in several discussions, including in one seminar where Fabian Eberle explored how breakthroughs in privacy-enhancing technologies were enabling the future of biometric authentication. Olaf Jensen reports.

Passwords have been around for around 60 years, but they no longer provide the protection from cyberthreats they once did, and new alternatives have emerged that may yet supplant them.

Indeed, Fabian Eberle, COO and Founder of cybersecurity firm Keyless speaking at London Tech Weeks digital conference earlier this month, sees it as an ambition to eliminate the humble password. He can do this, he says, through a combination of machine learning and multimodal biometric authentication that he believes will revolutionise how people are identified and authenticated.

The need to replace passwords is particularly pressing because they are notoriously insecure. It may come as no surprise that an astonishing 2.3 billion credentials were stolen by hackers and cybercriminals in 2017 alone.

Why? Because nobody follows best practice when it comes to password security. Even IT leaders are not immune: around 55% of them reuse the same password across multiple services in fact, 51% of all passwords are reused. All this means that around half of all helpdesk calls are for password resets, and passwords cause approximately 80% of all data breaches.

There are typically three factors of authentication used today: inherence, such as physical characteristics used in biometric security like our face or fingerprints; possession, as in something we carry that generates a pin code; and knowledge, which covers anything we have to remember like a PIN or a password.

Each has benefits and drawbacks. For instance, while passwords are quite secure in theory, remembering them can be difficult and once they are compromised, they offer no additional security, and a centralised database of passwords attracts the attention of hackers. Biometrics, meanwhile, are unique to us, meaning theres nothing for us to forget, but it is sensitive data and storing it is a burden for businesses they also cannot be changed.

The main challenge is to balance the trade-off between security and privacy on one hand, and convenience and user experience on the other. Which of these matters most is extremely dependent on context: users consistently rank security above convenience when it comes to, for instance, a banking app, while prioritising convenience for social media.

COVID-19 has arguably highlighted the need for what Eberle calls a password-less paradigm. Greater digitalisation and an increasingly mobile or homeworking workforce has made the password more cumbersome. Indeed, data suggests that the average worker spends around 24 hours entering passwords each year.

Biometric security is set to play a big role. A demand for a better customer experience, the growing threat of cyberfraud there has been a 600% rise in phishing attacks during the coronavirus pandemic and more stringent data protection regulations such as GDPR have driven the adoption of biometric authentication. Its convenient, already familiar from our smartphones, and requires the use of something we always carry around with us, such as our face and fingerprints. But its not fool proof, and still needs an extra layer of protection.

The solution, explains Eberle, is to combine multiple authentication factors, such as a one-time, generated pin code and a fingerprint scan. This is known as two-factor authentication and is increasingly recommended to individuals as well as businesses as the best line of defence against cybercriminals. To Eberle, multi-factor security should be baked into a system by design.

Eberles Keyless software is just one of a new generation of security providers that combine multiple security measures. In this case, that means machine learning, cryptography and biometrics. It lacks a centralised database, making it less of a target for hackers, and features anti-spoofing software that means photographs wont fool the biometric sensor. In the future, the system may even measure behavioural characteristics such as keystrokes or the precise way the user holds their phone.

A greater consumer awareness of privacy and security means firms will increasingly seek to give users personal control over their data. Services like Keyless are the start of that process, because they do not centralise control of their users data in one place. But the humble password, stored centrally or dependent on the users memory, may have no place in that future.

Find out more about the topics under discussion at London Tech Week.

Enjoy the latest fire and security news, updates and expert opinions sent straight to your inbox with IFSEC Global's essential weekly newsletter. Subscribe today to make sure you're never left behind by the fast-evolving industry landscape.

Sign up now!

How breakthroughs in privacy-enhancing technologies enable the future of biometric authenticationOlaf Jensen reports from London Tech Week, this time a digital event for the first time, where privacy-enhancing technologies to improve biometric security was on the discussion table.

Olaf Jensen

Biometric security systems: a guide to devices, fingerprint scanners and facial recognition access control

Use of automated facial recognition by South Wales Police deemed unlawful, court rules

Inner Range announces updates to Inception

Continued here:
How breakthroughs in privacy-enhancing technologies enable the future of biometric authentication - IFSEC Global

Feds Yell PATCH NOW over Windows AD Zerologon Vuln – Security Boulevard

Posted on by

CISA sent an unusual warning late last week. The federal cybersecurity agency instructed government IT departments to drop everything and patch their Windows servers.

The source of all their fears? The Zerologon vulnerability, disclosed last week. Augusts patch Tuesday fixed the bug, but its feared many organizations will have delayed installing it on their AD domain controllers.

The thing is,Zerologon rates a perfect 10 on the CVSS scale. In todays SBBlogwatch, we run and hide.

Your humble blogwatchercurated these bloggy bits for your entertainment. Not to mention:Maiden Goes To Hollywood.

Whats the craic, Zack?Mister Whittaker reportsHomeland Security issues rare emergency alert:

The Cybersecurity and Infrastructure Security Agency, better known as CISA, [is] requiring all federal departments and agencies to immediately patch any Windows servers vulnerable to the so-called Zerologon attackciting an unacceptable risk to government networks. Rated the maximum 10.0 in severity, [it] could allow an attacker to take control of any or all computers on a vulnerable network, including domain controllers.The bug was appropriately called Zerologon, because an attacker doesnt need to steal or use any network passwords to gain access to the domain controllers. With complete access to a network, an attacker could deploy malware, ransomware, or steal sensitive internal files.Although the CISA alert only applies to federal government networks, the agency said it strongly urges companies and consumers to patch their systems as soon as possible if not already.

AndDan Goodin addsAgencies that dont update must disconnect all domain controllers:

Microsoft published a patch last Tuesday. No later than 11:59pm EDT on Wednesday, agencies are to submit a completion report attesting the update has been applied to all affected servers or provide assurance that newly provisioned or previously disconnected servers will be patched.Its possible for attackers to exploit the vulnerability over the Internet [if] organizations expose their domain controllers. [Or, if they] have exposed Server Message Blockor Remote Procedure Call, [it] may be exploitable. Queries using the Binary Edge search service show that almost 30,000 domain controllers are viewable and another 1.3 million servers have RPC exposed.Zerologon is tracked as CVE-2020-1472. Further raising that stakes was the release by multiple researchers of proof-of-concept exploit code that could provide a roadmap for malicious hackers.Researchers continue to find evidence that people are actively developing attack code. Given the stakes and the amount of publicly available information about the vulnerability, it wouldnt be surprising to see in-the-wild exploits emerge in the coming days.

Feeling smug because you dont use Windows?Stop that, say Sambas Andrew Bartlett and Douglas Bagnall:

Installations running Samba asthe Active Directory DC [or] the classic/NT4-style DC [are] vulnerable. However, since version 4.8the default behaviour of Samba has been to insist on a secure netlogon channelequivalent to having server schannel = yes in the smb.conf.Versions 4.8 and above are not vulnerable unless they have the smb.conf lines server schannel = no or server schannel = auto. Samba versions 4.7 and below are vulnerable unless they have server schannel = yes. Each domain controller needs the correct settings in its smb.conf.Samba 4.10.18, 4.11.13, and 4.12.7 have been issued as security releases to correct the defect. Samba administrators are advised to upgrade to these releases or apply the patch as soon as possible.Our Code, Our Bugs, Our Responsibility.

Wait. Pause.?Why havent these IT people already done the job? v1 cant understand whats taking them so long:

The CVE was initially released on August 11. Funny theyre just now in a hurry to patch a severity-10 thats been out now for six weeks.Granted, it took Microsoft until last Tuesday to publish a patch, but any competent admin would have looked at that and said that goes on now and has already closed that barn door. Sure, tell the idiots to get it done immediately, then review the completion reports and fire everyone that waited until they were ordered to patch their servers, and hire competent replacements.

Butacdha reckons it aint that simple:

Youre missing the biggest reason: enterprise IT shops with strict change management processes and, especially in government, years of austerity budgets cutting resources for both sysadmins and rigorous testing.If you have a charge management process which takes a month to approve updates, the problem is not the sysadmin. If years of skimping means that the operators are afraid to patch because theyll be punished if it breaks things and they dont have a robust testing process, the problem is not the sysadmin.This is more expensive than people like to admit. You either need to accept lower security/reliability or spend more on staff, capacity, and licenses. Lots of places try to cut that corner and itll seem to work until, as Warren Buffet likes to say, the tide goes out.This is a really tricky problem in government because the pay scales can be very hard to change. Historically the higher-level positions were senior and relatively limited, so its not like you can just effortlessly bump all of your developer positions up to the highest grade without hitting budget caps. That probably means youre hiring people at lower levels which are more like entry level pay.

AndDeputy Cartmans been there done that bought the T-shirt:

Once organizations reach a certain size, they seem to instill a very very strong sense of Dont rock the boat if you dont have to mindset. You want to be proactive and apply a patch? Well what if it breaks something!? Just sit on your ***, keep looking at Tik-Tok, and counting down the days for your pension.Fix **** after the duct tape breaks, and move on with your life. Im already starting to feel this way at my defense company job due to its size. Fixing all the **** Im seeing thats pants-on-head stupid would go about as well as punching a concrete wall until my fists are hamburger.Just roll your eyes, take your time with that 8th cup of coffee, and just do what you can.

What went wrong, anyway?With a neat precis, heres tialaramex:

This is an amazing bug. What happens is, youre supposed to fill out a bunch of bytes as proof of who you are, and then a bunch of bytes that represent stuff like seconds since the start of the Unix epoch. If you cant do this, NetLogon figures you arent really who you say you are.The exploit is: Fill everything out with all zeroes. This will succeed one time in 256 on average.[It] isnt a bug in the code, its a design mistake: If you implement exactly what Microsofts design document says for NetLogon, one time in 256 all zeroes lets you in. By design. Stupid stupid design.It stands out how terrible Microsoft is at cryptographic design. Microsoft does this over and over.

IT people deserve blame too.Coppercloud dreams up the best simile:

Wait, people have domain controllers present on the public internet? Like, no firewall, port forwarded or no NAT, no VPN? Just out there?This is plugging a hole in a leaky chicken fence and hoping it floats.

Cue:the inevitable conspiracy theory. jiggawatts approaches 88 mph:

I am now convinced that Microsoft is purposefully degrading the quality of the cryptography at the behest of the NSA. Microsoft products have all of the following current cryptographic problems: There is no support for TLS 1.3. HSTS is very hit and miss. Until very recently, youd have to jump through hoops to enable TLS 1.1 and 1.2. Across a forest trust, RC4 is the default cipher. If you try to enforce AES ciphers youll break some forms of single-sign-on from Azure AD. If you use ECC certificates, youre stuck with the handful of now very thoroughly legacy curves. You cant have elliptic curve certificates with: NDES, AD FS, SQL Server, SCCM until very recently, and in fact just about every Microsoft product except for IIS. Which I remind you still cant do TLS 1.3. Azure Key Vault cant issue anything but RSA certificates from third-party CAs. The NSA does exist. They do degrade cryptographic algorithms, either through national security letters or simply bribery. The Dual_EC_DRBG fiasco happened. It really happened. Private United States based organisations do cooperate with these programs, either willingly or because they are forced to.Its one thing to accuse a neighbour randomly of murder. Its entirely another thing if you see them putting a shockingly large and heavy rolled up carpet in the boot of their car.

Meanwhile,kaur thinks a thought experiment:

Every country in the world is [asking] questions: Why do we use a consumer OS built by an US company? Can we trust USA to be our ally and not abuse its power over Microsoft? Can we trust USA to stay our ally in the forseeable future?

Maiden Goes To Hollywood

Previously in And Finally

You have been readingSBBlogwatchbyRichiJennings. Richi curates the best bloggy bits, finest forums, and weirdest websites so you dont have to. Hate mail may be directed to@RiCHiorsbbw@richi.uk. Ask your doctor before reading. Your mileage may vary. E&OE. 30.

Image sauce: Ryan McGuire (via Pixabay)

Recent Articles By Author

Link:
Feds Yell PATCH NOW over Windows AD Zerologon Vuln - Security Boulevard

Early Edition: September 22, 2020 – Just Security

Posted on by

Signup to receive the Early Edition in your inboxhere.

A curated guide to major national security news and developments over the past 24 hours. Heres todays news.

RUSSIAN INTERFERENCE IN US PRESIDENTIAL ELECTIONS

A top-secret CIA assessment has concluded that Russian President Vladimir Putin and his tops aides are probably directing a Russian interference operation aimed at denigrating Democratic presidential nomineeJoe Biden and supporting President Trump ahead of the 2020 presidential election, the first line of the assessment states. The documents also set out the CIAs assessments of Ukrainian lawmakerAndriy Derkach, who has previously been linked to Trumps lawyer Rudy Giulianis efforts to discredit Biden however, it does not go as far as to name Giuliani, who has now been working with Derkach publicly for months, instead stating Derkach had interacted with a prominent person linked to Trump. Josh Rogin writes in an op-ed for the Washington Post.

Andrew Weissmann, a former deputy on Special Counsel Robert Muellers team that investigated Russian interference in the 2016 election, says Muellers team could have done more to hold Trump accountable and uncover the truth, his new book, Where Law Ends: Inside the Mueller Investigation, states, which Random House will publish next week. Weissmanns book criticizes Muellers top deputy, Aaron Zebley,for halting deeper investigations into Trumps finances, which might have established a source of Russian leverage over Trump. It also makes clear that Mueller had enough evidence to conclude that Trump obstructed justice, charges which could rear their head if Trump leaves office in November as he would lose immunity from criminal prosecution. Weissmann also charges Attorney General William Barr of betraying both friend and country. Matt Zapotosky and Spencer S. Hsu report for the Washington Post.

US DEVELOPMENTS

The office of Manhattan District Attorney Cyrus Vance Jr., which is currently in a contentious legal battle with President Trump over obtaining eight years of his tax returns and related records, suggested yesterday for the first time specific criminal charges that may follow, including tax and insurance fraud and falsifying business records, citing news reports and public testimony that accused Trump of misconduct as justification for the grand jury investigation into possible criminal charges, court filings made yesterday by Vances legal team have revealed. The offices investigation into Trump started over two years ago and is looking into alleged hush-money payments he made in 2016 to two women who claimed they had had an affair with the president, and also a variety of business transactions, Carey Dunne, the offices general counsel said. Benjamin Weiser and William K. Rashbaum report for the New York Times.

The Trump administration yesterday announced an executive order and new unilateral sanctions against Iran which aim to reimpose an indefinite international arms embargo on the country, bypassing strong opposition from world leaders who dismiss the move as unlawful and ineffective.The new executive order gives the administration a new and powerful tool to enforce the U.N. arms embargo and hold those who seek to evade U.N. sanctions accountable, Secretary of State Mike Pompeo said, adding that its first targets include Irans Ministry of Defense and Armed Forces Logistics, Irans Defense Industries Organization and its director, Mehrdad Akhlaghi-Ketabchi, many associated with the Atomic Energy Organization of Iran, and also Venezuelan President Nicols Maduro. Quint Forgey reports for POLITICO.

Whistleblower Edward Snowden, the former CIA contractor who was charged with espionage after releasing classified National Security Agency (NSA) documents related to US surveillance programs in 2013,has agreed to forfeit over $5 million he earned from his tell-all book, Permanent Record,according to court records. Snowdens book was published last year without approval from government, breaching contracts he signed with the CIA and NSA. The judge agreed with the Department of Justice (DOJ)s lawsuit and ruled that Snowden must pay back the financial gains he received. A forfeiture plan has yet to be approved by the judge. Katelyn Polantz reports for CNN.

Update: After publication, Snowden disputed the CNN reports characterization of these developments, and replied to Just Security on Twitter noting he disagreement.

A New York Police Department (NYPD) officer was yesterday charged with acting as a spy for the Chinese government to provide information on the New York Tibetan community, according to a criminal complaint filed, which accused Baimadajie Angwang, 33, of working at the direction and control of Chinese officials at the consulate in New York. Prosecutors have charged him with acting as a foreign agent without notifying American authorities, wire fraud and making false statements, according to the complaint. Sonia Moghe reports for CNN.

District Judge Victor Marrero yesterday ruled that the US Postal Service must ensure it processes election mail on time for the November presidential election, a 87-page ruling has revealed, in which Marrero stressed that, the right to vote is too vital a value in our democracy to be left in a state of suspense in the minds of voters weeks before a presidential election. Marreros judgment follows a decision by District Judge Stanley Bastian in Yakima, Washington, last week that ordered the USPS to end practices that were slowing down mail deliveries. In his judgement, Marrero said that: the Postal Service must treat all election mail as First Class Mail; the alleged reversal of highly-criticized operational changes were either unenforced and not yet fully implemented or possibly insincere; and that Trump, Postmaster General Louis DeJoy and the Postal Service had not provided trusted assurance and comfort that citizens will be able to cast ballots with full confidence that their votes would be timely collected and counted. Marrero gave those involved in the case until Friday to settle their issues in a manner that was in-line with his findings and ruling. AP reporting.

The House yesterday unanimously approved the Defending the Integrity of Voting Systems Act which would make hacking federal voting system as a federal crime. The Act received approval by the Senate last year July, and would make hacking any federal voting infrastructure a criminal offence under the Computer Fraud and Abuse Act, which the DOJ often uses to prosecute hackers. The bipartisan bill will now make its way to Trump for his approval. Maggie Miller reports for The Hill.

The Justice Department yesterday threatened to stop federal funding to New York, Portland, OR, and Seattle because of the cities handling of violence and unrest during protests over racial injustice and police brutality, which follows a memo sent earlier this month by the White House instructing the DOJ to identify jurisdictions it argued Democrats had permitted anarchy to persist. Attorney General William Barr said in a statement: We cannot allow federal tax dollars to be wasted when the safety of the citizenry hangs in the balance, adding that he hopes the three cities would reverse course and become serious about performing the basic function of government and start protecting their own citizens. Sadie Gurman reports for the Wall Street Journal.

House Democrats stopgap spending bill includes a provision for $1.6 billion for the Navy to enter into a contract, beginning with fiscal year 2021, for the procurement of up to two Columbia class submarines, the continuing resolution (CR) released yesterday revealed. The bill also grants the Navy authority to incrementally fund the new submarines. However, the bill is unlikely to make it through the Senate, with many Republicans expressing disdain for the bills silence on aid for farmers affected by the coronavirus pandemic. Rebecca Kheel reports for The Hill.

The Royal Canadian Mounted Police has started an investigation into an envelope sent to the White House, addressed to Trump, that reportedly contained the highly poisonous substance ricin. The police departments Chemical, Biological, Radiological, Nuclear, Explosives team is reportedly leading the operation, the police force said in a post on Twitter yesterday. Andy Blatchford reports for POLITICO.

Trump will announce his Supreme Court nomination by the end of this week, he said in an interview yesterday on Fox & Friends, adding that he is currently considering four or five women to potentially replace the late Justice Ruth Bader Ginsburg,who sadly passed Friday. Quint Forgey and Anita Kumar report for POLITICO.

CORONAVIRUS

The novel coronavirus has infected over 6.85 million and killed almost 200,000 people in the United States,according to data compiled by Johns Hopkins University. Globally, there is close to 31.35 million confirmed coronavirus cases and over 965,000 deaths. Sergio Hernandez, Sean OKey, Amanda Watts, Byron Manley and Henrik Pettersson report forCNN.

When Congress passed the Cares Act earlier this year it gave the Pentagon $1 billion to prevent, prepare for, and respond to coronavirus by building medical equipment however, the majority of this money was redirected to defense contractors and used to fund making new jet engine parts, body armor and dress uniforms. Even defense contractors who were protected under the Paycheck Protection Program were given some of the money, it has been revealed. Aaron Gress and Yeganeh Torbati report for the Washington Post.

The Centers for Disease Control and Prevention (CDC) suddenly removed yesterday guidance it published Friday that said that air transmission of the coronavirus might be one of the most common ways to spread the virus. The agency said that Fridays guidelines were a draft and posted in error, although it did say it was updating its recommendations regarding airborne transmission, which will be reposted online once reviewed and finalized. Apoorva Madavilli reports for the New York Times.

A map and analysis of all confirmed cases of the virus in the US is available at the New York Times.

US and worldwide maps tracking the spread of the pandemic are available at theWashington Post.

A state-by-state guide to lockdown measures and reopenings is provided by the New York Times.

Latest updates on the pandemicatThe Guardian.

OTHER DEVELOPMENTS

Afghan forces and the Taliban saw the worst night of clashes Sunday since peace negotiations between the two warring sides began in Qatar over a week ago, with at least 57 members of the Afghan security forces and 80 Taliban fighters reportedly killed across Afghanistan. The clashes took place in central province of Uruzgan, although casualties were also reported in the provinces of Baghlan, Takhar, Helmand, Kapisa, Balkh, Maidan Wardak and Kunduz, provincial officials have said. Al Jazeera reporting.

Here is the original post:
Early Edition: September 22, 2020 - Just Security

As Joe Rogan’s Platform Grows, So Does the Media and Liberal Backlash. Why? – The Intercept – First Look Media

Posted on by

Todays SYSTEM UPDATE examining this topic with guest Shant Mesrobian, former Obama 2008 strategist and author of a recent viral thread on the liberal contempt for Rogan can be viewed onThe Intercepts YouTube channel.

Joe Rogan has amassed one of the largest and most influential media platforms in U.S. politics, if not the single most influential. The value of his program was quantified in May when the streaming service Spotify paid a reported $100 million for the exclusive rights to broadcast hispodcast.

As one illustrative example of his reach, NSA whistleblower Edward Snowden appeared on Rogans program six days ago, and the episode has already been viewed more than 5 million times on YouTube alone. The first time Snowden appeared on his programwas last October, and that episode, just on YouTube, has more than 16 million views. To put that in perspective: The top-rated cable news programs are the Fox News shows hosted by Tucker Carlson and Sean Hannity, and theyaverage between 4 to 5 million viewers, or one-fourth the number of views Rogans discussion with Snowdengenerated.

Rogan is rarely discussed in mainstream political and media circles, which raises its own questions. Why does someone who packs such a big punch in terms of audience size and influence receive so much less media attention than, say, cable news hosts with audience sizes far smaller than his? Presidential candidates certainly recognize Rogans importance: All of the major Democratic candidates, according to him, requested to appear on his show. (The only ones he invited on were Bernie Sanders, Tulsi Gabbard, and Andrew Yang.)

Joe Rogan interviews Sen. Bernie Sanders on Aug. 6, 2019.

Photo: YouTube

Rogan was in the news this week after President Donald Trump favorably responded to a guests suggestion that Rogan host a four-hour, sit-down presidential debate between the two candidates. The mere suggestion that someone like Rogan could host as prestigious and high-minded an event as a presidential debate prompted condescending scorn from establishment media precincts.

Prior to that, one of the few times Rogan was discussed in mainstream political circles was when outrage among establishment Democratsensued after Sanders touted a quasi-endorsement from Rogan.The argument wasthat Rogans views are sorepellent, bigoted, and anathema to liberalism that no Democratic candidate should be associated with him (this anger was shared by some of Sanders own supporters including, reportedly,Rep. Alexandria Ocasio-Cortez).

What is it, by the standards of U.S. political and media orthodoxy, that makes Rogan so radioactive? In March, billionaire and former NYC mayor Michael Bloomberg who spoke at the 2004 GOP Convention in the middle of the Iraq War and war on terror to urge the reelection of George W. Bush and Dick Cheney, and who presided over and repeatedly defended the racially disparate stop and frisk police practice endorsed Joe Biden for president, and Biden not only accepted butcelebrated the endorsement, praising Bloomberg in the process:

What are the standards that make Michael Bloomberg an acceptable endorsement to tout but not Joe Rogan, given that thebillionaire three-term mayor and former Republicanhas taken far worse positions and done far more damage to far more people than the podcaster could ever dream of doing?

That question is even more compelling when it comes to the Biden/Harris campaigns touting of the endorsement of former Republican Gov. Rick Snyder of Michigan, widely blamed for the criminally negligent lack of clean drinking water which plagued primarily African American residents of Flint, Michigan, for many years. Not only did the Biden campaign accept Snyders endorsement, but they issued a press release trumpeting it:

What makes all of this more confounding is that Rogan is a fairly basic political liberal on almost every issue: He believes in the need for greater social spending for the nations poor and working class, opposes war and militarism, favors drug legalization, is adamantly pro-choice and pro-LGBT rights, and generally adheres to liberal orthodoxies on standard political debates. That is why he was so fond of Bernie Sanders and Tulsi Gabbard, and why Andrew Yang whose signature issue was the universal basic income was one of the few candidates he deemed worth talking to.

The objectionstypically raised to Rogan concern his questioning of some of the very recent changes brought about by trans visibility and equality, particularly asking whether it is fair for trans women who have lived their entire lives and entered puberty as biological men to compete against cis women in professional sports (a question also asked and even answered in the negative by LGBT sports pioneer Martina Navratilova, among many others), and whether young children are emotionally and psychologically equipped to make permanent choices about gender reassignment therapies and gender dysphoria.

If embracing and never questioning the full panoply of trans advocacy is a prerequisite to being permitted in decent society, I seriously doubtmany prominent Democratic politicians will pass that test (even Kamala Harris, from San Francisco and the very blue state of California, has a very mixed record on trans rights). Moreover, though polling data is sparse, thedata that is available show that there is still much work to do in this area: Onlya small minority of Americans believe it is fair to allow trans women to participate in female professional sports.

If the standard is that anyone who even entertains debates over the maximalist and most controversialquestions in this very new and evolving social movement is to be cast out as radioactive, liberalism and the Democratic Party will be a very small group. It will also have to proceed without the vast majority of political leaders whom they currently follow. Even on this issue of trans rights, Rogans views are in accord with the standard Democratic Party view: He advocates full legal protection and dignity for the right of trans people to livewith theirgender respected.

The other critique centers on Rogans willingness to invite on his show various pundits with far-right views. Thats a bizarre criticism of someone who purposely hosts a program designed to foster dialogue with people across the political spectrum. After all, if one employs the blatantly irrational tactic of attributing to Rogan the views of all his guests, he would be simultaneously everything and nothing.

But again, this is a standard which few if any Democratic Party leaders could meet. Barack Obama, Hillary Clinton, and Bernie Sanders all went on Bill OReillys Fox News show, while Rep. Adam Schiff has appeared on Tucker Carlsons program. Speaking with people with differing views is called politics and journalism, and if one is decreed radioactive for interacting with people with bad views, few will survive that standard. (Liberals also point to the fact that Rogan said he could not vote for Biden over Trump, but that was not on ideological grounds but based on the same narrative that Democratic political and media elites spent all of last year disseminating: namely, that Bidens cognitive decline makes him unfit for the job.)

While Rogan is politically liberal, he is argues former Obama 2008 campaign strategist and Rogan listener Shant Mesrobianculturally conservative, by which he does not mean that Rogan holds conservative views on social issues (again, he is pro-choice and pro-LGBT rights). He means that Rogan exudes culturally conservative signals: He likes MMA fighting, makes crude jokes, hunts, and just generally fails to speak in the lingo of the professional managerial class and coastal elites. And it is those cultural standards, rather than political ones, that make Rogan anathema to elite liberal culture because, Mesrobian argued in a viral Twitter thread, liberals care far more about proper culturesignaling than they do about the much harder and more consequential work of actual politics.

As Rogans platform grows, it is worthwhile to understand his appeal, his audience, and what he is doing that is new and different to attract such a large following. But it is also very worth examining the reaction to him by the political and media class because in that reaction, one finds many revealing attributes about how they think, what they value, and the priorities that they actually venerate. Todays SYSTEM UPDATEon The Intercepts You Tube channelwith Mesrobian as my guest is devoted to examining those questions, or it can be viewed on the player below:

Read the rest here:
As Joe Rogan's Platform Grows, So Does the Media and Liberal Backlash. Why? - The Intercept - First Look Media

Russia wants to outlaw TLS 1.3, ESNI, DNS over HTTPS, and DNS over TLS – Privacy News Online

Posted on by

The Russian Ministry of Digital Development, Communications, and Mass Media has released a draft law which outlines plans to outlaw TLS 1.3, ESNI, DNS over HTTPS, and DNS over TLS. The draft law (text in Russian) bans the use of encryption protocols allowing for hiding the name (identifier) of a web page or Internet site on the territory of the Russian Federation. This is supposed to help the Roskomnadzor in their job as Russias censor. If a site is found to be using these encryption tools, they can be blocked by the Roskmonadzor within a day. Meduza, reporting on the news noted:

Experts point out that a number of large Internet companies, including the Russian Internet giant Yandex, currently rely on these technologies and underscore that this new initiative could lead to another mass block of IP addresses belonging to major providers like Amazon Web Services and Cloudflare, the hosts behind many sites.

The Russian government had previously blocked a large portion of the internet in their since halted attempts to block access to Telegram. Russia has banned a lot of things like certain types of VPN use in its day, and some of the bans have been more efficacious than others.

The Roskomnadzors job used to be easy. Dmitry Belyavsky, an encrypted systems developer, explained to Meduza:

Once upon a time, all of the addresses of sites and pages on the Internet were transmitted in plain text, not encrypted, so when the Roskomnadzor blocking system [first] began working in Russia, it was assumed that the filter would work according to URL, that is, the addresses of individual pages on Internet sites. However, one year after [its] implementation, largely under the influence of Edward Snowdens revelations, the whole world began rapidly switching to using HTTPS a protocol that provides encryption between the site and the users device. For this reason, its impossible to block the individual pages of sites that are using HTTPS according to URL.

Since then, the Roskomnadzor has turned to blocking based on hostnames and thats where these new technologies that are finally being implemented across the web stand in the way. The draft law explained the rationale behind the ban:

The use of the algorithms and encryption methods listed has the capacity to reduce the effectiveness of using existing filtration systems [for Internet traffic], which, in turn, significantly complicates the identification of resources available on the Internet, which contain information that is restricted or prohibited for distribution in the Russian Federation.

Those are well known features of TLS 1.3, ESNI, DNS over HTTPS, and DNS over TLS and for a whole government to seek to outlaw these technologies by name is a vote in favor of their efficacy. The official Russian solution is for websites to use state approved Russian cryptographic algorithms Magma and Kuznechik and a state issued SSL certificate. Whether this draft law passes remains to be seen, but what is clear is that Russia is still barrelling headlong towards the establishment of a Russian internet (coined RuNet) that may eventually put the infamous Great Firewall of China to the south to shame.

See the original post:
Russia wants to outlaw TLS 1.3, ESNI, DNS over HTTPS, and DNS over TLS - Privacy News Online

Trump implicated in plans to prosecute Assange over war leaks – ComputerWeekly.com

Posted on by

The White House was behind the removal of WikiLeaks founder Julian Assange from the Ecuadorian Embassy in London before his arrest, a court heard on 21 September.

US journalist and Trump supporter Cassandra Fairbanks claimed that she had been told by a Republican party supporter close to the president about plans for Assanges arrest months before it happened.

In a witness statement read out in court today, Fairbanks said she had been given advanced details during a phone call from Arthur Schwartz, a wealthy donor to the Republican party, of US government plans to arrest Assange.

Schwartz gave Fairbanks advanced warning that Assange would be charged over the 2010 Chelsea Manning leaks, that the US would be going into the Ecuadorian Embassy to arrest Assange, and would be going after Chelsea Manning.

Both of these predictions came true just months later, she said. Schwartz could only have received the information on Assange from official sources, the court heard.

Joel Smith, representing the US government, dismissed Fairbanks claims, arguing that the truth of what Ms Fairbanks was told by Arthur Schwartz was not in her knowledge.

Smith said that the prosecution would also question the partiality of the witness, who acknowledges she is a supporter of WikiLeaks.

The court heard Schwartz was an informal adviser to Donald Trump Junior and worked for the US ambassador to Germany, Richard Grenell, who it later emerged had been behind Assanges expulsion from the US Embassy, the court heard.

Fairbanks, a Trump supporter, worked for Washington-based news organisation Gateway Pundit, which she described as a pro-Trump organisation.

She was part of a message group that included multiple people who worked for or were close to president Trump, including Schwartz and Grenell, she said in a witness statement.

Schwartz phoned Fairbanks on 30 October 2018 after she had posted an interview with Assanges mother on the chat group, hoping that someone would see it and be moved to help.

Arthur Schwartz was extremely angry, she said. He told her that people would have been able to overlook her previous support of WikiLeaks, but they would not be so forgiving now that she was more informed.

He brought up my nine-year-old child during these comments, which I perceived as an intimidation tactic, she said in the witness statement.

Schwartz repeatedly told Fairbanks to stop advocating for WikiLeaks and Assange, saying that a pardon isnt going to f***ing happen.

He knew very specific details about a future prosecution against Assange that were later made public, and that only those very close to the situation then would have been aware of, she said.

Schwartz told Fairbanks that Assange would be charged over the Chelsea Manning leaks, but would not be charged with publishing the Vault 7 documents which exposed the CIAs capability to conduct surveillance and cyber warfare or the DNC leaks.

He also told Fairbanks that they would be going after Chelsea Manning and it would be done before Christmas. Both of these predictions came true just months later, she said.

The US government would be going into the embassy to get Assange, Schwartz said.

I responded that entering the embassy of a sovereign nation and kidnapping a political refugee would be an act of war, and he responded, Not if they let us, Fairbanks said in the witness statement.

I did not know at that time that ambassador Grenell had that very month, October 2018, worked out a deal with the Ecuadorian government, she said.

Manning leaked nearly 750,000 classified and sensitive military and diplomatic documents to WikiLeaks, including the Afghan war logs.

In January 2019, although she was shaken by the phone call from Arthur Schwartz, Fairbanks visited Assange in the Ecuadorian Embassy and informed him of everything I had been told, she said, adding: I also met with Chelsea Manning in person and told her that I feared they might come after her again.

When Assange was charged with publishing Chelsea Mannings leaks in 2010 and Manning was put in front of a grand jury, Fairbanks said: I understood that the information Schwartz had, had come from accurate and official sources.

She visited Assange again on 25 March 2019 and said she was treated very differently. She was locked in a cold waiting room for an hour while embassy staff demanded Assange be subject to a full body scan with a metal detector. They only had two minutes to speak.

She messaged Schwartz on 29 March 2019. Schwartz called Fairbanks and told her that he knew she had shared the contents of their previous conversation with Assange.

Schwartz told her there was now an investigation into who leaked Fairbanks the information that she given to Assange in person in October 2018.

Assange and Fairbanks had communicated by passing notes and Assange had played a radio during the meeting to avoid surveillance. Apparently those measures were not enough to ensure that my conversation was private, she said.

Schwartz told Fairbanks that he could no longer trust her with information relating to WikiLeaks.

It was obvious that the US had been involved, including the State Department, and that Schwartz had been made a party to the information, said Fairbanks.

Soon after Assange was arrested on 11 April 2019, ABC News reported that ambassador Grenell had been involved in the deal to arrest Assange back in October when I first got the call from Schwartz.

When Fairbanks tweeted the ABC story, ambassador Grenell messaged Fairbankss boss and tried to persuade her boss to get her to delete the tweet. I refused, said Fairbanks.

In September 2019, Trump announced that he had fired his National Security adviser John Bolton and Grenells name was being floated everywhere as a likely candidate to replace Bolton, said Fairbanks in her statement.

Within hours of posting a tweet on Twitter that Grenell was involved in Assanges arrest and had attempted to get Fairbanks fired for it, she received another phone call from Schwartz.

This time he was frantic. He was ranting and raving that he could go to jail and that I was tweeting classified information, she said.

Schwartz informed me that in coordinating for Assange to be removed from the embassy, ambassador Grenell had done so on direct orders from the president, said Fairbanks.

She recorded the call which will form part of the evidence in this hearing. It has not been played in court.

She said that she now believed that embassy staff took extreme steps in her second meeting with Assange because the contents of her earlier meeting with Assange had been fed back to the US authorities and those with close connections to them, including Arthur Schwartz.

Edward Fitzgerald QC, representing Assange, told the court: We say what Schwartz told her is a good indication of the government at the highest level.

The case continues.

See the original post:
Trump implicated in plans to prosecute Assange over war leaks - ComputerWeekly.com

Best 5 programming languages to learn in 2020 for every confused beginner ever – Stanford Arts Review

Posted on by

There is a huge demand for programming languages right now. And also in the future. Do not know where to start? Confused?

Do not worry. Here are some of the programming languages you can learn and enhance your skills in them.

Developed by Guido van Rossum in 1990, Python is most popular and in-demand programming language right now. It is a dynamic, user-friendly and an open source programming language. Plus, it is easy to learn and code. Also, it has GUI support and has extensible features. Above all, it supports Object Oriented Programming (OOP) concepts.

Python has many applications and a huge scope in the IT industry. Some of its amazing capabilities can be seen in the field of Data Science, Artificial Intelligence and Web Development.

The client-side programming language, JavaScript is a must for every web developer ever. It is used for creating responsive and interactive pages. Also, some of the well-known websites like Facebook, Twitter, YouTube etc, use JavaScript to create their interactive web pages. Furthermore, it is popular for its wide array of frameworks and is used by many programmers.

Moreover, there are many applications of JS. Mobile app development, Back-end development and Browser game development are some of the many examples.

Owned by Oracle Corporation, Java is one of the most old and versatile programming languages. The language is a general-purpose programming language and widely supports Object-Oriented Programming concepts. It has been maintaining its popularity for the last 10 to 15 years. It shall definitely continue to do so in the future too.

Moreover, Java developers are sought after by many companies. It is a portable, easy-to-learn and secure.

Big Data, Web Development and Mobile App Development are some of the fields in which Java is widely applied.

Designed by Google, Go programming language is efficient, convenient to use and also provides cross platform support. Right now you might not see many people babbling about Go like they do about Java or Python. Yet, it is one of those languages which will have a huge demand in the near future. So if you learn it right now, you might find it handy afterwards. Some important features of Golang include in-built currency and platform compatibility.

Go is mostly used in Internet of Things, Distributed Systems and Big Data.

Used to develop iOS applications, Swift is becoming rapidly popular. Backed by Apple, it is inter-operable with objective C and is very fast in contrast to other programming languages. Also, the code sharing and the process is faster in both front-end and back-end development.

We can scale cloud services and develop mobile and desktop applications using Swift.

There are many more choices available to you out there in the world. Try these out and feel free to explore other options too!

Here is the original post:
Best 5 programming languages to learn in 2020 for every confused beginner ever - Stanford Arts Review

What’s that smell? OpenJDK 15 lands with hidden classes, more garbage collection DEVCLASS – DevClass

Posted on by

Java developers with a taste for adventure can now get their hands on the latest open source implementation of the Java Platform Standard Edition, OpenJDK 15. The release includes new security and productivity functionalities and provides users with some preview features so they can kick the tires before finalisation.

One of these preliminary features are the so-called sealed classes, which allow class authors to restrict which other classes may extend or implement the class in question. The addition is meant to provide a more declarative way than access modifiers to restrict the use of a superclass and help with future pattern matching efforts.

Pattern matching is still a hot topic in Java circles, though the only effort visible in OpenJDK 15 is a new preview of pattern-matching for instanceof, which was first introduced in JDK 14. Other features included for feedback are reworked records classes, a kind of transparent carrier for immutable data fitted with data-driven methods such as equals, and an improved API to access foreign memory outside the Java heap.

Devs who like their features stable can take a look at the newly added Edwards-Curve Digital Signature Algorithm for cryptographic signatures, and hidden classes. The latter is a replacement of sorts for the sun.misc.Unsafe::defineAnonymousClass and aims to give framework creators a way of defining classes that cannot be linked against or discovered by other classes.

Meanwhile low-latency garbage collector ZGC got its final seal of approval and is now ready for production along with low-pause-time garbage collector Shenandoah, and multi-line string literal text blocks.

With the release of OpenJDK 15, the platform said goodbye to field java.management.rmi.RMIConnectorServer.CREDENTIAL_TYPES, and constructors java.lang.invoke.ConstantBootstraps. and java.lang.reflect.Modifier.. Other than that JavaScript engine Nashorn was removed and the java.rmi.activation package as well as biased locking were deprecated.

Java 15 will be supported until March 2021. Those whod prefer jumping on a version that will be looked after for a longer time will have to wait until next year, since this is when long term support version 17 is planned to land.

In the meantime, work on OpenJDK 16 is in full swing. After having moved the codebase to GitHub and switching to Git for version control, the team is now focusing on internal improvements and a couple of new features. These include a first version of an incubator module for expressing vector computations, and elastic metaspace to reduce HotSpot class-metadatas notorious memory usage. The final result will supersede Java 15 in March 2021.

Java is a programming language which made its first public appearance in 1995. The project was started at Sun Microsystems, which was acquired by Oracle in 2010. 25 years in, Java has made itself at home in the top 5 of most popular programming languages in various analyst lists.

Despite being an open source project, Oracle still provides most of the OpenJDK contributions as director Java SE product management Sharat Chander points out in an announcement blog. Other committing organisations include Red Hat, SAP, Arm, and Amazon. OpenJDK 15 is also the first version that saw Microsoft adding to the codebase, which is at least noteworthy, given the companys at times rocky, lawsuit-involving history with Java.

See more here:
What's that smell? OpenJDK 15 lands with hidden classes, more garbage collection DEVCLASS - DevClass