@LeeteqXV

(https://hypothes.is/blog/working-with-wikipedia-articles/ + Neuroscience Wiki Project ) - Hypothesis is exploring the use of on-line annotation to provide review and enhancement of Wikipedia articles. The Neuroscience Wiki Project encourages the neuroscience community to improve the accuracy and robustness of neuroscience articles by directly editing Wikipedia.  While that approach is still best, many researchers may not have time or be unsure of proper protocols for adding or changing information directly on Wikipedia.   With Hypothesis, you can add suggestions and additions as an overlay on current content easily and quickly.  For example, you can provide proper citations or additional information on a topic, note grammatical errors or factual inaccuracies. Experienced Wikipedia editors can then follow up and work with you to add your recommendations to the article.  All contributions will be acknowledged on the contributors page.

('Linux.Wifatch' seemingly hardens the security of IoT devices by infecting routers and such...  - Article) "Update – October 5, 2015: The creators of Linux.Wifatch responds to our blog posting explaining the reasons for their actions.  The following story could well work as the script of a Hollywood movie or superhero comic. Let me introduce you to Linux.Wifatch, one of the latest pieces of code infecting Internet of Things (IoT) devices. We first heard of Wifatch back in 2014, when an independent security researcher noticed something unusual happening on his home router. The researcher identified running processes that didn’t seem to be part of the legitimate router software and decided to investigate further. During his analysis he discovered a sophisticated piece of code that had turned his home router into a zombie connected to a peer-to-peer network of infected devices. Lately we’ve seen that home routers, and IoT devices in general, are becoming more interesting to cyber crooks; these devices may not hold a lot of interesting data but under the control of criminals they have proven to be quite useful, for instance, to articulate distributed denial-of-service (DDoS) attacks. As well as this, it’s difficult for the average user to detect if one of these devices has become infected and so most infections go unnoticed. In April of this year, we were provided with some additional information on Wifatch. At first sight there was nothing unusual about it—as part of Symantec’s efforts to identify malware targeting embedded devices we run a large network of honeypots that collect many samples and Wifatch seemed to be just another of these threats. However, after a closer look, this particular piece of code looked somewhat more sophisticated than the average embedded threat we usually spot in the wild. A force for good or a force for evil?" (Article continues...)

(Linux GIMP addon - G'MIC - article extract) "In fact, you should see G’MIC listed in the menu structure. If you click that entry, you’ll see G’MIC listed, but it’s grayed out. That is because G'MIC can only open when you’re actually working on an image (remember, this is a set of predefined filters that act on an image, not create an image). With that said, open up an image and then click G’MIC > G’MIC. A new window will open (Figure 2) showing the abundance of filters and effects available to you. The first thing you need to know is the Input/Output section (bottom left corner). Here you can decide, first, what G’MIC is working on. For example, you can tell G’MIC to use the currently active layer for Input but to output to a brand new layer. This can sometimes be handy so you’re not changing the current working layer (you might not want to do destructive editing on something you’ve spent hours on). If you like what G’MIC did with the layer, you can then move it into place and delete (or hide) the original layer."

(Wordpress UpdraftPlus to Amazon S3 - ONLY allow new backups, NOT the deletion of old backups:...) What is the most secure possible setup? - Since UpdraftPlus needs to store an S3 API key and secret to upload your backups to S3, there is a potential point of weakness. If a hacker breaks into your site, then he can steal that API key + secret, and use it to access your backups. Ideally, the hacker should not be able to delete or change your backups – you want to know that backups taken before hackers break-in are “clean” and can be deployed without fear. To accomplish this with an Amazon S3 setup, implement these recommendations. They involve more complexity, but given the securest possible setup: 1. Do not use your “master” API key + secret (which can access all your S3 data). Instead, set up a separate IAM user (which will thus have its own API key and secret). (Note – this is an IAM policy, not a bucket policy. You will need to switch back and forth in the Amazon AWS console between S3 to IAM a few times during these steps.) 2. (Read more...)

WordPress UpdraftPlus: below the “intervals” (scheduling) [] one new little link “Add an additional RETENTION rule…”, as in this screenshot: Just click on it, and you can set up as many rules as you like. Here’s a screenshot implementing the example rules described in our imaginary feature request above:

Firefox outperformed other browsers in recent independent tests to be named the “speed king.”

(Google Chrome browser extension) The Ethical Ad Blocker by Darius Kazemi, Sep 15, 2015 "People in media have been hand-wringing over ad blockers for many years now, but it's been back in the news recently because iOS9 now allows ad blocking in Safari. The issues remain the same, though: Ads are terrible. They drain mobile batteries and slow down the browsing experience. They're aesthetically annoying and sometimes use dark UX patterns to trick the user into clicking. Ads are also the only really viable way to make money if your business model isn't "sell a discrete item to people in exchange for cash." Subscription models and other alternatives have so far mostly failed, at least at the large scale that newspapers and similar operate at. When a user blocks ads, they hurt the publications that provide the content the user wants by denying them their income. They are (sort of) stealing content. Fortunately I've developed a simple solution. The Ethical Ad Blocker is a Chrome extension that, when it detects advertising on a website, blocks the entire website. This way, the user doesn't experience ads, but they also don't leech free content. Everybody wins. Download it today! https://chrome.google.com/webstore/detail/the-ethical-ad-blocker/chpijkaobnoplgnjpjilbdcklmmpgfla (The Ethical Ad Blocker is a fork of the open source project Adblock Plus. I had to put its code online for GPLv3 compliance reasons. I'm sorry in advance.)"

(Update 2015-09-21 - cPanel Feature Request Status change: 'Planned' (Two-factor authentication confirmed)) - Two-factor authentication is a must We really need two-factor authentication at least for WHM login. A lot of sites are already implementing this to protect from unauthorized login.

Virtualization series intro: Qubes-OS (operating system) I will be posting many small, opinionated posts related to virtualization, while also maintaining articles with more structured, objective summary. Keep in mind that I mostly interested in how to help non-technical, normal people to master technology "logically", not technically, as is the purpose of my "Master-Of-My-Own-Computing" work project. First out related to Virtualization is the Qubes-OS (www.qubes-os.org). I will be posting lots of short experiences, observations and opinions here while I am working on the related "main article" (which is also publicly visible already in its "draft stage"). Some teasers: (...)

(Privacy advocate Caspar Bowden dies.) “Combative and prickly, Caspar was also unfailingly kind and generous,” said Ray Corrigan, senior lecturer in technology at the Open University. “Caspar was a big believer in a Rawlsian model of justice, a stickler when it came to the universality of human rights and was unstinting in his criticism of corporate or government entities or agents who sought to undermine those rights and principles.” Bowden was an advocate for the establishment of a pan-European privacy rights organisation and practiced what he preached. Disillusioned by what he saw as an inability of European law to protect personal privacy he turned to technology, sitting on the board of directors for the Tor anonymising service and advocating the use of the Qubes OS secure operating system.

The following applications officially support MariaDB: - Drupal(.org) - ERP5 - Kajona - MediaWiki - Moodle - MONyog - ownCloud - Plone - WordPress - Yii Framework - Zend Framework

(OpenID - Wikipedia.org description) Published in February 2014 by the OpenID Foundation, the third generation of OpenID technology, OpenID Connect, is an authentication layer that sits on top of the OAuth 2.0 authorization framework.[78] OpenID Connect delivers a more API-friendly way of performing many of the same tasks as OpenID 2.0. OpenID Connect was also designed to be more usable by native and mobile applications. Optional mechanisms for robust signing and encryption are also defined by OpenID Connect. Unlike OpenID 2.0, OpenID Connect integrates OAuth 2.0 capabilities with the protocol itself, and does not need an extension.

(On Digital Signatures and Key Verification - What Digital Signatures Can and Cannot Prove.) "Most people – even programmers – are confused about the basic concepts underlying digital signatures. Therefore, most people should read this section, even if it looks trivial at first sight. Digital signatures can prove both authenticity and integrity to a reasonable degree of certainty. Authenticity ensures that a given file was indeed created by the person who signed it (i.e., that it was not forged by a third party). Integrity ensures that the contents of the file have not been tampered with (i.e., that a third party has not undetectably altered its contents en route). Digital signatures cannot prove any other property, e.g., that the signed file is not malicious. In fact, there is nothing that could stop someone from signing a malicious program (and it happens from time to time in reality)."

(2014 article) The problem is, fingerprints are not particularly reliable — they can produce false positives, false negatives, and multiple readings of the same print can give different results. Fingerprints (for biometrics and forensics) are better than nothing, but there is a reason that both the security and forensic communities are moving away from them towards more reliable and valid techniques. DNA sequencing is a far better option when it comes to forensic identification, and “living” biometrics such as vein matching and gait analysis are better options for access control.

(OS X - Mac keychain permissions vulnerability comments - ArsTechnica.com) - Most people should see a window informing them that they need to give the app control of the system, along with a button to go to System Preferences to do exactly that. It makes it easy to go in and grant control... but also should raise some red flags that will prevent most users from doing so. Thus, this AppleScript issue is less concerning, except for the fact that it shows that the full contents of that window are completely revealed and accessible to anyone who cares to go looking. In the case of the Genieo installer, they didn't use AppleScript, so this wasn't an issue for them. They just found the button's location and simulated a click on it, using CGCreateMouseEvent and CGEventPost. -Thomas Reed

(Wearable Computing Research: Body used as 'wifi' device for magnetic communication.) San Diego, Calif., August 31, 2015 -- Electrical engineers at the University of California, San Diego demonstrated a new wireless communication technique that works by sending magnetic signals through the human body. The new technology could offer a lower power and more secure way to communicate information between wearable electronic devices, providing an improved alternative to existing wireless communication systems, researchers said. They presented their findings Aug. 26 at the 37th Annual International Conference of the IEEE Engineering in Medicine and Biology Society in Milan, Italy. While this work is still a proof-of-concept demonstration, researchers envision developing it into an ultra low power wireless system that can easily transmit information around the human body. An application of this technology would be a wireless sensor network for full-body health monitoring. “In the future, people are going to be wearing more electronics, such as smart watches, fitness trackers and health monitors. All of these devices will need to communicate information with each other. Currently, these devices transmit information using Bluetooth radios, which use a lot of power to communicate. We’re trying to find new ways to communicate information around the human body that use much less power,” said Patrick Mercier, a professor in the Department of Electrical and Computer Engineering at UC San Diego who led the study. Mercier also serves as the co-director of the UC San Diego Center for Wearable Sensors.