I was thinking recently about developers wanting to be able to exploit future bugs in systems like the iPhone (and even in windows media player and the like) to gain access to locked content, features or.  I was thinking about how this means they are not reporting security bugs but keep them secret.  Which seems to be an overall negative _for the platform_ since they have created a market through their own actions that thrives on finding and keeping bugs secret.  Not all those who use such vulnerabilities are good guys trying to get their fair use rights back for sure and that is where the danger lies.

I made the west seattle blog!  West Seattle Blog… » Non-snow news: Neighborhood radio test - talk about timely!

Actually, lots of browsers get poor marks overall for how the password management systems function and protect you against malicious attacks.

Funny, especially in light of watching the season premiere of “24” where Jack shoots out a video camera, which draws the people out to check on it, leaving them vulnerable to attack.  Add social engineering to that and you have a nice attack.

A very interesting research paper to read up on.  I’m most curious how they baited the RIAA/MPAA into thinking that printers had been downloading files over bittorrent.

So, I’m listening to this story on NPR yesterday and the CEO of the company that brings you the Sham-Wow, Pedi-Paws, Ped Egg, and other cruft for $19.95 was on.  I rarely watch commercials anymore because I don’t watch live TV and skip through them.  So why is it that I know of so many TeleBrands products? – Spam.

Now, a proof-of-concept showing that the long-known MD5 vulnerabilities can be actually used to fake a CA certificate.  This could be really bad if done by a bad guy.  And it has long been known that to hedge your bets, your certs should use either both MD5 and SHA-1 or just SHA and drop MD5 altogether.  But apparently some ridiculous CAs didn’t get that message and should not be in the business they are in IMO because of such a collossal error.  Equifax Secure Global eBusiness CA-1 is one of the certificates shown to use md5rsa.  From the slashdot discussion, here is a reposting of other CAs still using MD5:

I’ve heard lots of information about BPA in plastics (aka Bisphenol-A), and a little misinformation. So I figured that it was time to crosscheck these concerns against the other chain-email-brand hysteria about plastics that I have debunked before.

But you have to be a believer or it won’t work.  Well, even then it won’t work.

attle