Newly discovered flaw undermines HTTPS connections for almost 1,000 sites

Encrypted connections established by at least 949 of the top 1 million websites are leaking potentially sensitive data because of a recently discovered software vulnerability in appliances that stabilize and secure Internet traffic, a security researcher said Thursday.

The bug resides in a wide range of firewalls and load balancers marketed under the F5 BIG-IP name. By sending specially crafted packets to vulnerable sites, an attacker can obtain small chunks of data residing in the memory of connected Web servers. The risk is that by stringing together enough requests, an attacker could obtain cryptographic keys or other secrets used to secure HTTPS sessions end users have established with the sites, security researcher Filippo Valsorda told Ars. He didn’t identify the sites that tested positive in his scans, but results returned by a publicly available tool included with his vulnerability disclosure included the following:

  • www.adnxs.com
  • www.aktuality.sk
  • www.ancestry.com
  • www.ancestry.co.uk
  • www.blesk.cz
  • www.clarin.com
  • www.findagrave.com
  • http://ift.tt/ua88fu
  • http://ift.tt/NYCAW0
  • http://ift.tt/nEUVCj
  • http://ift.tt/PUci8d
  • http://ift.tt/LxUxKh
  • http://ift.tt/HuxBab
  • www.netteller.com
  • www.paychex.com

The threat stems from a vulnerability in F5 code that implements a transport layer security feature known as session tickets. Session tickets can speed up encrypted transactions by allowing previously established HTTPS connections without a key having to be renegotiated all over again. Sites that use the vulnerable F5 appliances and have session tickets enabled are vulnerable.

It’s not yet clear precisely what kind of data can be extracted by exploiting the bug. Valsorda, who is a cryptography engineer for content delivery network Cloudflare, said he discovered the flaw by chance as he and a colleague helped troubleshoot error messages received by customer using an F5 load balancer (Valsorda has more details here). So far, Valsorda has observed the bug returning other users’ session IDs, which by themselves isn’t particularly sensitive.

Remember Heartbleed?

from Ars Technica http://ift.tt/2k80tmV
via IFTTT

Here’s why a commercial space group endorsed NASA’s SLS rocket

Why did a commercial organization endorse the SLS rocket?

NASA

This week, the Commercial Spaceflight Federation, which counts rocket builders SpaceX and Blue Origin among its executive members, made news by declaring its support for NASA’s Space Launch System rocket. The organization’s new chairman, Alan Stern, announced during a conference that “we see many benefits in the development of NASA’s SLS.” This caused a stir in the commercial space community.

Later, during an interview with Ars, Stern explained that the commercial space organization has, in the past, engaged in a “bruising battle” over the government’s massive rocket and its influential prime contractor Boeing. The commercial space industry group (of which Boeing is not a member) contended the private sector could deliver the same capability as the SLS for far less than the $2 billion NASA has spent annually this decade to develop the rocket. The SLS will initially be able to heft 70 metric tons to low Earth orbit, but that could grow to 130 metric tons by the late 2020s.

from Ars Technica http://ift.tt/2ly8OfH
via IFTTT

Humans must become cyborgs to survive, says Elon Musk

Wired

Humans must become cyborgs and develop a direct high-bandwidth connection with machines, or risk irrelevance and obsolescence, says Tesla and SpaceX founder Elon Musk.

Musk’s latest cheery thoughts were imparted at the World Government Summit in the UAE. “Over time I think we will probably see a closer merger of biological intelligence and digital intelligence,” Musk said, according to CNBC.

The main thrust of Musk’s argument seems to hinge on the limited bandwidth and processing power of a single human being. Computers can ingest, transfer, and process gigabytes of data per second, every second, forever. Meatbags, however, are severely limited by an input/output rate—talking, typing, listening—that’s best measured in bits per second. Thus, to risk being replaced by a robot or artificial intelligence, we need to become machines.

from Ars Technica http://ift.tt/2lLyir2
via IFTTT

70-Fold Price Increase Puts Drug at $89,000

Marathon Pharmaceuticals LLC says it will charge $89,000 annually in the U.S. for a decades-old steroidal drug that was approved for U.S. sale for the first time on Thursday, a price that is as much as 70 times higher than drug’s price overseas.

The U.S. Food and Drug Administration approved the drug, called deflazacort, on Thursday to treat a rare type of muscular dystrophy that affects some 12,000 boys in the U.S., most of whom die in their 20s and 30s. The drug isn’t a cure, but it has been shown to improve muscle…

from WSJ.com: What’s News US http://ift.tt/2kAjCfF
via IFTTT

Kellyanne Conway Tells Americans To Buy Ivanka Trump’s Products

A worker cleaned the windows of the Ivanka Trump Collection in the lobby of Trump Tower in New York last month.

Andrew Harnik/AP


hide caption

toggle caption

Andrew Harnik/AP

A worker cleaned the windows of the Ivanka Trump Collection in the lobby of Trump Tower in New York last month.

Andrew Harnik/AP

Kellyanne Conway, a top adviser to President Trump, may have violated federal ethics rules today when she urged shoppers to buy Ivanka Trump’s retail brand, in the wake of the decision by several retail companies to drop the line because of poor sales.

“Go buy Ivanka’s stuff, is what I was [saying] — I hate shopping and I’m going to go get some myself today,” Conway said in an interview on Fox & Friends.

“This is just [a] wonderful line,” she added. “I’m going to give a free commercial here. Go buy it today, everybody. You can find it online.”

White House press secretary Sean Spicer said Thursday that Conway had been “counseled” over her remarks.

Federal ethics rules bar executive branch employees from profiting off their positions, but the statute exempts the president.

Conway, however, is a White House employee, and her comments urging people to buy the products appear to violate the rules, says Kathleen Clark, professor of law at Washington University in St. Louis.

“The ethics regulation says government employees must not endorse any product, service or enterprise,” Clark told NPR in an interview. She added:

“The broader rule is that government employees shouldn’t use public office for private gain. They shouldn’t use it for their own personal private gain or for somebody else’s private gain. Public office should be used for the good of the public, for the good of the country, for the good of the government, rather than singling out her boss’ daughter’s enterprise and encouraging people to shop Ivanka.”

Clark also noted that Trump’s tweet Wednesday about his daughter was retweeted by someone from the official White House account @POTUS.

“That was a violation of the ethics regulation if it was done by anybody other than the president or the vice president. But even if the president himself did that, it was improper, because there he is using a government resource for his own personal vendetta,” she said.

Meanwhile, the progressive group Public Citizen urged the U.S. Office of Government Ethics to investigate whether Conway’s comments violated the rules.

“Anyone harboring illusions that there was some separation between the Trump administration and the Trump family businesses has had their fantasy shattered,” said Robert Weissman, the organization’s president.

“Kellyanne Conway’s self-proclaimed advertisement for the Ivanka Trump fashion line demonstrates again what anyone with common sense already knew: President Trump and the Trump administration will use the government apparatus to advance the interests of the family businesses.”

In the Fox interview, Conway suggested retailers are dropping the line because of politics.

“They’re using her, who’s been a champion for women in power and women in the workplace to get to him. I think people can see through that,” she said.

T.J. Maxx and Marshalls told employees last week to stop using signs promoting Ivanka Trump’s brand and mix in her products with others the store sells in order to make them less prominent.

Nordstrom has also that it would no longer sell Ivanka Trump jewelry and clothing because sales have been disappointing. Neither the company nor Ivanka Trump’s brand released any sales figures.

The line is still carried by other retailers.

After Nordstrom’s decision, President Trump himself tweeted that his daughter “has been treated so unfairly” by the chain, and his son Donald retweeted an article today about angry store customers cutting up their credit cards.

It’s not clear how shoppers will react to the clothing controversy.

Outside a Marshalls store in Washington, D.C., a housewife from Argentina wasn’t impressed by all the controversy.

“If I like it, I buy it. If I don’t, I don’t,” said Andrea Ponzio, 47. “It doesn’t mean I wouldn’t buy it because of any politics.”

NPR intern Lucia Maffei contributed to this report.

from NPR Topics: News http://ift.tt/2loUsSR
via IFTTT

The self-balancing motorcycle is such a Soichiro Honda solution to a problem

You might remember the

Riding Assist Motorcycle concept

, a self-balancing bike that debuted at CES. At first blush a self-balancing motorcycle that doesn’t use gyroscopes to level itself – instead using automated steering inputs and a variable-geometry front fork, the particulars of which are explained in the great video by

Engineering Explained

host Jason Fenske above – you might not be so shocked. “Gyros are heavy,” you might think, “and expensive. Of course it makes sense to ditch ’em. Why didn’t anyone think of this sooner?”

You’ve seen bicyclists doing “track stands”, balancing at a stop light either for practical reasons (they’re clipped into the pedals) or less so (it looks cool). That’s the same idea at play here, except to get a motorcycle to do this on its own you’ve got to add some serious complexity. Honda’s solution is emulate what a skilled bicyclist does during a track stand: move the wheels around. To do this, you need to utilize indirect steering; it’s steer-by-wire, with a motor actually providing the front wheel movement, just like cars with electric steering racks. There’s a motor that changes the rake of the front fork, changing the trail. To provide more stability at low speeds, the Riding Assist Motorcycle removes trail to make the wheelbase longer at low speeds.

honda s360

It’s the sort of elegant, slightly unexpected solution to a problem that at one point was the hallmark of Soichiro Honda’s company. He was famously an unconventional thinker. Honda was originally a motorcycle manufacturer, and the company’s very first car, the S360 roadster seen above, used wildly exotic features like a crankshaft that spun on needle-roller bearings, dual overhead cams, and quad carburetors – one for each cylinder. It was tiny – 354 cubic centimeters – but it represented cutting edge, race-derived technology. It was a very Soichiro debut.

From there, things got weirder and more wonderful. There was the oval-piston NR500 racing motorcycle of 1979, which was about as different as it could possibly be from everything it raced against. It was a four-stroke when everyone else was using light, powerful two-strokes. The creative engineering got around a rigid issue: the rules only allowed four cylinders. To make the engine competitive, the engineers wanted to double the number of valves. There simply wasn’t enough room above round pistons to do this, so why not oval pistons? It worked, although Honda ended up shelving it after coming close to resolving its teething problems. While not a success on the track, it was a powerful demonstration of Honda’s philosophy.

Honda’s history page

has the whole story, if you want to know more.

Not to say Soichiro or his company were faultless. The Honda 1300, a predecessor to the Accord, clung to air-cooling and lost the plot. It focused on fancy engineering, not consumer desires. But there were more successes than failures, somehow. The CVCC engine, which met 1970s emissions standards without an expensive catalytic converter. Or VTEC, which probably doesn’t need any introduction.

So it is with the Riding Assist Motorcycle. Soichiro Honda died in 1991, but his influence remains (in a diminished form, certainly) in the spirit to which Honda’s engineering staff will still explore unconventional solutions when less-than-ideal, conventional ones would suffice. Incidentally, the last car he approved personally was the Beat, a quirky roadster that embodies a lot of what he believed about cars and echoing his first vehicle, the Honda S360 discussed above. One of them is owned by our Editor-in-Chief, Michael Austin,

whose drawn-out ordeal

to bring the car into this country and fondness for it’s esoteric charms serves as a reminder of the fascination Soichiro Honda’s creations hold for some car enthusiasts.

The Riding Assist Motorcycle is only a concept, but if it goes into production will it engender the same sort of geeky charm that Mike’s Beat does for him? Who knows, but hopefully whoever buys one will appreciate the philosophy behind its wonderfully different approach.

Related Video:

from Autoblog http://ift.tt/2lJ5qQ5
via IFTTT

A Forgotten Group Of Grains Might Help Indian Farmers – And Improve Diets, Too

A woman farmers harvests pearl millet in Andhra Pradesh, India. Millets were once a steady part of Indians’ diets until the Green Revolution, which encouraged farmers to grow wheat and rice. Now, the grains are slowly making a comeback.

Courtesy of L.Vidyasagar


hide caption

toggle caption

Courtesy of L.Vidyasagar

A woman farmers harvests pearl millet in Andhra Pradesh, India. Millets were once a steady part of Indians’ diets until the Green Revolution, which encouraged farmers to grow wheat and rice. Now, the grains are slowly making a comeback.

Courtesy of L.Vidyasagar

Getting people to change what they eat is tough. Changing a whole farming system is even tougher. The southern Indian state of Karnataka is quietly trying to do both, with a group of cereals that was once a staple in the state: millet.

Until about 40 years ago, like most of India, the people of Karnataka regularly ate a variety of millets, from finger millet (or ragi) to foxtail millet. They made rotis with it, ate it with rice, and slurped it up at breakfast as porridge.

In the sixties, the Green Revolution – a national program that led to the widespread use of high yielding crop varieties, irrigation, fertilizers and pesticides – led to a dramatic increase in food grain production in India. But it also focused on two main crops – rice and wheat – which guzzle water.

“Crops that survived on rain rather than irrigation, and were far more sustainable, were forgotten,” explains Dinesh Kumar, who runs Earth 360, a non-profit organization in the neighboring southern state of Andhra Pradesh that helps popularize millets and train farmers to grow them. “Millets began to be seen as food for the poor,” says Kumar. “Rice was aspirational. White became right, brown became wrong.” These days, millets are used mostly for animal fodder.

Now, after nearly four decades of intensive farming (and growing urban populations which use a lot of water), most of India is facing severe water crises. So, many states are trying to come up with a more sustainable way to farm. And Karnataka is leading the way with its efforts with millets.

There are many factors that make millets more sustainable as crops. Compare the amount of water needed to grow rice with that for millets. One rice plant requires nearly 2.5 times the amount of water required by a single millet plant of most varieties, according to the International Crops Research Institute for the Semi-Arid (ICRISAT), a global research organization helping to make millets more popular. That’s why millets are primarily grown in arid regions of Asia, Africa and Latin America.

Millets can also withstand higher temperatures. “Crops like rice and wheat cannot tolerate temperatures more than 38 degrees Centigrade (100.4 Fahrenheit), while millets can tolerate temperatures of more than 46 degrees C (115 F),” says S.K Gupta, the principal scientist at the pearl millet breeding program at ICRISAT. “They can also grow in saline soil.” Millets could therefore be an important solution for farmers grappling with climate change – sea level rise (which can cause soil salinity to increase), heat waves, droughts and floods.

Millets are also more nutritious than rice or wheat. They are rich in protein, fibers and micronutrients like iron, zinc and calcium, and thus hold immense promise for India’s malnourished, especially those with micronutrient deficiencies.

Millets have a lower glycemic index (a measure of how fast our body converts food into sugar) than rice, which is thought to be one of the main factors contributing to the rise in rates of diabetes in India. Some scientists think eating millets could help Indians reduce their risk of this disease.

Switching to millets then should be easy. Or is it? A massive hurdle is that crops like rice, wheat and sugarcane are still way more profitable. “Unless millets match up to other crops, we can’t force farmers to grow them,” says Krishna Byre Gowda, Karnataka’s Minister for Agriculture. “We are not trying to replace rice or wheat entirely. We are simply trying to supplement them with more sustainable crops.”

Pearl millet ear head.

Courtesy of L. Vidyasagar


hide caption

toggle caption

Courtesy of L. Vidyasagar

Pearl millet ear head.

Courtesy of L. Vidyasagar

To make millets more attractive, his government has introduced a series of incentives. It offers farmers more than the minimum support price it pays for other crops, gives subsidies on seeds, and has made millets a part of the public distribution system: a country wide network that distributes cheap grains to the poor.

There’s much lost ground to make up, because millets still don’t have an efficient value chain. “Millets are coarse and need more processing than other crops, but the machines for these have not reached the farmer yet, and thus production remains low,” says Gupta.

Narasimha Reddy, a farmer on the outskirts of Bangalore, recently switched from growing maize to ragi. “Ragi is much hardier than maize; it can endure for a month without any water,” he says. Many farmers in his area are switching back to maize, because ragi costs far more to harvest, but Reddy plans to continue growing ragi. “Demand is slowly picking up in the city, and I think it will improve further now people know of the health benefits,” he says. “There’s no choice but to grow ragi if water levels deplete further. But we need more machines for quick harvesting, and better quality seeds.”

The state government has partnered with research institutions to develop higher yield seeds and better ways to process seeds. All this is in line with recommendations made by a recent report by the Global Panel On Agriculture and Food Systems Nutrition, which found that people’s diets are worsening as countries like India urbanize. That’s because it is now easier and more affordable to buy unhealthy, processed foods and sodas than healthy foods. The authors of the report recommend that countries should invest more money into making healthy foods like millets, fruits and vegetables more affordable and easily available, rather than rice and wheat. “More and more villagers are migrating to the cities in search of work,” says Gupta. “When they do, they lose their traditional food habits. We need to give those back to them.”

But it may be impossible to bring back traditional millet-based foods that have fallen out of fashion. “You can’t force people to go back to the food habits of their grandfathers – rotis, ragi balls and so forth – but you can get them to eat millet foods in tune with their new eating habits: breakfast cereals, cakes, pasta, baked products and ready to cook products,” says Byregowda.

The government is partnering with research institutions and food companies to develop new food products. It is introducing these products at fairs, where the public is also educated about the benefits of eating millets. At a recent fair, products displayed included everything from millet pastas, chips and cakes to more traditional Indian dishes. Meanwhile, many hotels have introduced millets in breakfast buffets, millet pizzas, and millet biryanis.

The government is also approaching influencers – food writers, chefs, doctors, and the media – to help sell millet to the newly affluent, quinoa- and chia-seed-eating, health conscious Indian customer. “If you can eat imported quinoa, why can’t you eat millet?” asks Joanna Kane-Potaka, ICRISAT’s director of communications.

Why not indeed? As a child I used to eat ragi porridge, but I haven’t eaten it in decades. So I try some new millet products to reacquaint myself with the grain. A ragi cereal turned out to be about as edible as pulverized doormats. But another product from the same company, chocolate ragi puffs, was almost as good as Kelloggs’s Cocopops, if still heavy on the sugar.

Ragi digestive cookies from a big company were too chewy, but those from a small neighborhood bakery turned out to be surprisingly good and child-pleasing. A couple of handfuls of ragi batter in dosas (Indian style rice pancakes) was almost indistinguishable in taste, and I threw some into banana bread with the same result.

For most of us, returning to millets may involve some trial and error. But as Kumar points out, even a few handfuls of millet in your everyday foods is better for you than none. Besides, by 2050, India will need to feed 1.7 billion people. And millets could help make that happen.


from NPR Topics: News http://ift.tt/2loUomh
via IFTTT