Hacker Newsnew | past | comments | ask | show | jobs | submit | more zorlem's commentslogin

The only sensible long-term solution for Linux seems to be to adopt FreeBSD's way of /dev/random operation - block once until enough entropy is gathered and then never block.

This would make sure that distro vendors don't even get a chance to mess initial seeding at boot time. It will also force vendors of embedded or "cloud" distributions (eg. Ubuntu's AWS images) to find a way to pre-seed the images to reduce the initial boot times.

Unfortunately there is such a huge amount of software that depends on this particular difference between /dev/random and /dev/urandom that I don't see the change happening soon.


I wouldn't bet hard money that it doesn't exist, there is always Rule #34.

http://xkcd.com/305/


In addition (or even instead of) to htop I strongly recommend atop [0]. This tool has been of an invaluable help to me during a lot of diagnostic sessions.

It can collect detailed memory usage profile of processes and when combined with some smart scripting it has a nice leak detection functionality [1]. Very useful when you run out of memory and want to find which daemon has used all of it.

[0] http://www.atoptool.nl/

[1] http://www.atoptool.nl/download/case_leakage.pdf

edit: formatting


The poster says in the first sentence of his post that it is Stripe [0] (his payment processor), not him, that stores the CC info.

[0] https://stripe.com/


The way I can think of is using IAM credentials to allow modification of a Route53 record using the AWS CLI from the newly spun server. You will need to write a short script that you could push to the new instance either through EC2 MetaData or UserData fields.

If there is a demand I could try whipping up a CloudFormation template to do it.


This idea (a throwable ball with imaging and other sensors) and several prototypes have appeared on HN before, the first one around 2 years ago. This exact product has reached the HN front page in the beginning of 2013 [1].

I find it strange that none of the prototypes have actually managed to reach a production stage, given that the potential market - military, LE, emergency responders is (supposedly) there. Maybe the price point doesn't make much sense, given the usual (low) prices for fixed-focus camera modules - there is no need for very high resolution here, and the balls better be semi-disposable.

There are a few other designs (and patents associated with the concept) - [2], [3] and [4].

[1] https://news.ycombinator.com/item?id=4757971

[2] http://www.bostonglobe.com/business/2013/01/21/surveillance-...

[3] http://www.serveball.com/

[4] http://jonaspfeil.de/ballcamera (and HN discussion: https://news.ycombinator.com/item?id=3109899)


My opinion is that it's significantly more difficult for a startup to sell to military/fire departments/etc than to the general public. What could likely happen is that some big company with "good connections" will end up developing a similar product and get the market.


Selling to the government is no easy task.


I wonder if the recently discovered problems with non-unique key parameters could be the result of the cooperation of particular network gear vendors with NSA.

https://factorable.net/weakkeys12.conference.pdf

https://www.usenix.org/system/files/conference/usenixsecurit...


This is one of the best (simple) explanations of Shamir's Secret Sharing Scheme [0] which has a solid working implementation [1]

[0]: https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing

[1]: http://point-at-infinity.org/ssss/


You need a capable sysadmin anyways. It makes sense to pay her/him to design and scale your "platform" properly, especially if you're making any money from it.


A clever scam with the land-line call.

I wonder where the fraudsters have got all his personal info (including his land-line phone number) from. Even if they got a hold of his receipt that shouldn't contain enough info to get all the other details.


The government doesn't make much of an effort to keep your personal information secure. Let's see an example:

http://wireless2.fcc.gov/UlsApp/UlsSearch/license.jsp?licKey...

Yup, that's my home address!


Apparently you don't make much of an effort yourself ;)


he doesn't have much of a choice if he want to have his ham radio license.


The FCC (and a bunch of other government agencies in the U.S.) will happily take a post office box as an address. That's the official address on my ham ticket.


The GP did use a PO box, and even if you use a PO box you still now know someones name, state and general area pretty much unless you are willing to drive far away for some remote box.


You can be my roommate at the Post Office: http://wireless2.fcc.gov/UlsApp/UlsSearch/license.jsp?licKey...

(Thanks for making me realize that I'll need to renew my license in a few months, I quite possibly would have forgotten.)


Love the WWV suffix! I'll be looking for you on the internationally allocated standard carrier frequencies.


Back when I was actually active, I was constantly asked by others what the time was. =)

Most assumed that it was a vanity callsign but it's actually what the FCC assigned to me nearly 20 years ago.


  > whois jrock.us
Yep, that's... a whole lot more info, actually.


I used my employer's address there, since .us demands that you be able to receive their physical mail. Kind of pointless with my ham radio information on the web, though.


You have to realize that we do not hear about all the other cases where they cased someone but did not learn enough info in the end.


He says they cloned his card, so they probably either had a card skimmer installed on top of the ATM's card slot or a tiny hidden camera to photograph the card. Now they have his name and account number. They then followed him home to get his address. Then they looked him up in the phone directory to get his land-line number.


That's not what the article said. It said that the initial fraudulent call claimed that they had cloned it.

Getting a name and phone number is easy. After you've followed the person home, poke through their waste paper bin until you find a letter/bill with the info. If the person is listed in the phonebook (often the default) then you just need the surname from the bin and the town/village of the house you're stood in front of.


Date of birth would be a bit harder to get. Not on the average bill or in a phone book. I guess someone could go through social media once they had your name, but it might not work for everyone.


I'm in the US. Online, I've obtained birth and death dates and lists of mailing addresses of specific persons. In one case, I started with the subject's name and county where they died (the goal was to find the burial plot of a relative). Other cases I started with a name and current city of residence (ie, googling myself and family members). I didn't search social networks. Iirc, most of my success came from online county records.


That doesn't match what the article said. Also, if they already had his card then there would be no need to send a courier to his place and pick it up, that only increases their exposure and the risk of getting caught.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: