Thousands of iOS apps infected by XcodeGhost

The impact of iOS app developers unknowingly using a rogue version of the Xcode development tool is turning out to be greater than initially thought: early reports listed just 39 apps that had been trojanized with the tool, but security researchers have since identified thousands more.On Friday, security research firm Palo Alto Networks reported that 39 apps found in the App Store had been compromised after their developers -- most of them located in China -- used a rogue version of Xcode that had been distributed on forums. Xcode is a development tool for iOS and OS X apps provided by Apple.To read this article in full or to leave a comment, please click here

Reaction: Interoperate or Die

the-point-fred-wolf-1Ethan has an excellent post up on Interoperate or Die. Herewith, a few thoughts in response.

From my perspective, the importance of open standards in the world of network engineering can hardly be overstated. As networks become more complicated (or complex, depending on what word you want to use), having consistent interfaces will become increasingly important. Think of the old IP model — every transport runs on top of IP, and IP runs on top of every physical/link layer. Using IP as a “choke point” built a “wasp waist,” a single API everyone on both sides of the narrow point in the protocol layer could talk to.

in recent years, we’ve forgotten the wasp waist. We’ve built everything over HTTP, and everything over Ethernet over IP, and everything over GRE over IP, and… The entire stack, above IP, is a hornet’s nest of convoluted caverns and side halls pointing, apparently, everywhere at once (like the guy from the forest in The Point, above).

If you think of IP as an API (which is really what it is), the point is to have a single layer API between any two interacting systems. This creates a clean interaction surface that helps you to Continue reading

VSAN: As Always, Latency Is the Real Killer

When I wrote my stretched VSAN post, I thought VSAN uses asynchronous replication across WAN. Duncan Epping quickly pointed out that it uses synchronous replication, and I fixed the blog post.

The “What about latency?” question immediately arose somewhere in my subconscious, but before I could add that thought to the blog post (because travel), Anders Henke wrote a lengthy comment that totally captured what I was thinking, so I’m including it in its entirety:

Read more ...

Cisco said to plan China partnership to boost market access

Following in the footsteps of some other U.S. companies like Hewlett-Packard and Intel, Cisco Systems is planning to tie up with a Chinese partner for joint development and better access to the local market, according to a newspaper report.The networking equipment company is planning to announce a partnership with server maker Inspur Group during Chinese President Xi Jinping's visit to Seattle on Wednesday, The Wall Street Journal reported on Tuesday.Cisco said Tuesday it declined to comment on rumors related to any specific announcements or companies. Company spokesman Nigel Glennie said the company is optimistic about the opportunities for its China team, and is open to local partnerships playing a role in its future strategy. The company has done business in China for over 20 years and learned the importance of having the right relationships, he added.To read this article in full or to leave a comment, please click here

Cisco said to plan China partnership to boost market access

Following in the footsteps of some other U.S. companies like Hewlett-Packard and Intel, Cisco Systems is planning to tie up with a Chinese partner for joint development and better access to the local market, according to a newspaper report.The networking equipment company is planning to announce a partnership with server maker Inspur Group during Chinese President Xi Jinping's visit to Seattle on Wednesday, The Wall Street Journal reported on Tuesday.Cisco said Tuesday it declined to comment on rumors related to any specific announcements or companies. Company spokesman Nigel Glennie said the company is optimistic about the opportunities for its China team, and is open to local partnerships playing a role in its future strategy. The company has done business in China for over 20 years and learned the importance of having the right relationships, he added.To read this article in full or to leave a comment, please click here

I gave $10 to every presidential candidate

What happens when your candidate drops out of the 2016 presidential race? What do they do with the roughly million names of donors they've collected?

I've decided that somebody needs to answer this question, so I've donated $10 to each of the roughly ~25 current presidential candidates (yes, even the hateful ones like Trump and Lessig). By donating money, I've put myself on the list of suckers who they can tap again for more donations. After the election next year, we'll be able to figure out how each candidate has used (or misused) the email addresses I gave them.

For most candidates, the first two pieces of information they ask of your is #1 your email address and #2 your zip code. They need the zip code so that when there is a local rally in your area, they can contact you to get your to turn out. But as a side effect, it means being able to extract favors from local politicians. 

Therefore, to do this right, I'd have to make a donation from every congressional/senate district in the country. I suspect one use of this information is when one Representative goes to another and says "If you Continue reading

Python and IPython

I recently came across IPython while reading some Python development blogs.  IPython is an alternative to the standard Python shell that offers some additional features.  When I first read about IPython, I was a little confused because many people refer to it as the ‘Python interactive shell’.  While IPython is an interactive shell, it is not the Python interactive shell.  For instance, we can enter the Python interactive shell just by typing ‘python’ on our Python development box…

image
So, what we really did here was invoke the Python interpreter in interactive mode.  In this mode, commands can be read from the TTY and directly interpreted.  So for example, we can do something like this…

image
The Python code we type is directly interpreted and we get the output we would expect.  So instead of using the Python interpreter to run a .py script, we could do it all directly from the interpreter.  So the example from our Python up and running post works just as well in interactive mode as it did when run as a script…

image
So that’s Python interactive mode.  Now, let’s talk about IPython.  The first thing we Continue reading

iOS 9 — How did the launch really go?

On September 16 2015 at 10:00AM PST, Apple released their latest update to the iPhone: iOS 9. For several days after the announcement, ISPs and customers reported problems downloading iOS 9 due to overloaded servers. Obviously, the demand for iOS 9 was higher than even Apple anticipated, but how much higher? Few organizations outside of Apple have any idea what the actual iOS 9 adoption rates look like.

By analyzing the user agent strings of requests passing through the CloudFlare network, we were able to piece together a pretty good picture of iOS 9 uptake. Here’s an hour-by-hour look at requests from iOS 8 devices (blue) and iOS 9 devices (orange) for the first 24 hours after the announcement.

iOS 9 vs iOS 8 traffic during official launch

We started seeing small amounts of iOS 9 usage before it was officially released, followed by a spike immediately after the launch (times are shown in UTC, so the 10:00AM announcement shows up as hour 18). You can also see a second spike at 10:00 UTC when Europe started waking up.

What about iOS 9.1?

Even though the official release was for iOS 9.0, we also found beta iOS 9.1 in the wild. Curious about the comparative traffic Continue reading

Google Plus Is Mouldering

A quick search for “Google Plus is dead” reveals a number of recent articles about the pending death of the social media platform. It’s not fair to say it’s dead as yet. But it’s certainly mouldering. I took an informal survey on Twitter, LinkedIn, and Slack, asking folks if they were still using […]

HP adds protection against firmware attacks to enterprise printers

Researchers have been demonstrating attacks against printers for years. Now, Hewlett-Packard has started building defenses directly into its printers' firmware instead of just patching individual vulnerabilities.The company's new M506, M527 and M577 series of LaserJet Enterprise printers, set to go on sale in October and November, will have built-in detection for unauthorized BIOS and firmware modifications.HP refers to this capability as "self-healing security," but it's actually a set of code integrity checking mechanisms that security researchers have asked embedded systems manufacturers to implement for years.One of the new features, called HP Sure Start, validates the integrity of the BIOS code at boot time and if any modification is detected, it reboots the device and loads a clean copy. This is based on a similar feature that HP's Elite line of PCs have had since 2013.To read this article in full or to leave a comment, please click here

1 … 3,310 3,311 3,312 3,313 3,314 … 3,840