Quantcast
Channel: Hacker News 50
Viewing all 9433 articles
Browse latest View live

Verizon says it received over 321,000 legal orders for user data in 2013 | Ars Technica

$
0
0

Comments:"Verizon says it received over 321,000 legal orders for user data in 2013 | Ars Technica"

URL:http://arstechnica.com/tech-policy/2014/01/verizon-says-it-received-over-321000-legal-orders-for-user-data-in-2013/


"Can you hear me now?" Aurich Lawson

Joining the parade of technology companies that are releasing "transparency reports" as a window into government legal pressure, Verizon announced on Wednesday that it received over 321,000 total orders from various American law enforcement agencies in 2013. It is the first major telecom to publish such a report. (Virtual network operator Credo Mobile did so earlier this month.)

"We do not release customer information unless authorized by law, such as a valid law enforcement demand or an appropriate request in an emergency involving the danger of death or serious physical injury," the company wrote.

However, between 2001 and 2004, Verizon and other telcos did hand over massive amounts of data to American government agencies under no statutory or other legal authority.

In October 2012, the Supreme Court declined to review a lower court ruling in a case that challenged a Bush-era law (the FISA Amendments Act) retroactively giving telecommunications firms—including Verizon, Sprint, and AT&T—legal immunity after performing warrantless wiretapping at the government’s request. By letting the lower court ruling stand, the Supreme Court effectively wiped out related cases pending against Verizon pertaining to user data handover. The court affirmed the legality of the retroactive immunity statute.

Of requests in 2013, Verizon now says that over 6,000 included "pen register or trap and trace orders," which compel carriers to hand over metadata in real-time.

As Verizon describes it: "With a pen register order we must afford real-time access to the numbers that a customer dials (or IP addresses that a customer visits); with a trap and trace order we must afford real-time access to the numbers that call a customer. Such orders do not authorize law enforcement to obtain the contents of any communication."

Additionally, Verizon said that it received 1,000 to 2,000 National Security Letters, which are under gag order by default and have been increasingly challenged in court. As the company added:

Our Report reflects the fact that telecom providers receive more government demands than companies in perhaps any other industry. Information about individuals’ use of their communications equipment has become a uniquely important tool for law enforcement to protect citizens and bring wrongdoers to justice. As such, it should come as no surprise that the number of government demands directed to the major telecom providers is much greater than the number of demands directed to companies that do not offer the same communications services. Overall, we saw an increase in the number of demands we received in 2013, as compared to 2012.

The Verizon report has drawn some praise from the civil libertarian crowd so far.

"With this report, Verizon has set a strong precedent for transparency within the telecommunications industry," said Harley Geiger, of the Center for Democracy and Technology, in a statement. "The report has a level of detail that should be followed by other companies—including statistics on requests for location data, content, phone records, and cell tower dumps, as well as specifying the legal authorities used.

"Verizon consistently telling government agents to get a warrant to compel disclosure of customers’ communications content is a crucial customer privacy protection. As Verizon noted, however, the US government restricts transparency regarding national security requests. We believe the government should authorize detailed company reporting on these requests, and we support Verizon’s pledge to provide more information if reforms are made."


Payments Startup Stripe Valued at $1.75 Billion - WSJ.com

We recently awarded our biggest bug... - Facebook Bug Bounty | Facebook

$
0
0

Comments:"We recently awarded our biggest bug... - Facebook Bug Bounty | Facebook"

URL:https://www.facebook.com/BugBounty/posts/778897822124446?stream_ref=10


We recently awarded our biggest bug bounty payout ever, and since it's a great validation of the program we've been building and running since 2011, we thought we'd take a few minutes to describe the issue and our response.

In November, we were reading through incoming bug reports and came across a claim we wanted to investigate right away: arbitrary file reads. The report was well written and included proof of concept code, so we were able to reproduce the issue easily. After running the proof of concept to verify the issue, we filed an urgent task—triggering notifications to our on-call employees.

Reginaldo Silva explains in the post linked below that the issue was an XML external entities vulnerability on https://www.facebook.com/openid/receiver.php which could have allowed someone to read arbitrary files on the webserver. Immediately, we implemented a fix by flipping a flag to cause our XML parsing library to disallow the resolution of external entities. This initial fix was simple enough to fit on one line: libxml_disable_entity_loader(true);.

After patching the issue, we had to decide how to get the fix out to all of our webservers. We use a tool called Takedown for this sort of task because it runs at a low level, before much of the request processing happens. It allows engineers to define rules to block, log and modify requests. Takedown helped us ensure this line of code ran before anything else for any requests hitting /openid/receiver.php. This was our immediate short term fix.

Only 3.5 hours after Reginaldo hit send on his report the short term fix was live. The next step was to to better understand the issue: how it came about, whether it existed anywhere else in the codebase and any other steps we wanted to take. This part of the process is exciting because there's potential to find related issues or other areas to investigate.

After debugging, we concluded that libxml_disable_entity_loader(true) was indeed the correct final fix. Because we want to leave the code in a better state than we found it (rewrite old code, write tests, etc), writing the long term fix is often the step in the lifecycle of a bug that takes the longest. We wanted this line to run before anything else, so we put it in the lowest level of the callstack in our request initialization code. In the process, we came across another endpoint using the vulnerable code and ensured it was protected by the same Takedown rule we deployed previously, as well as our permanent fix. In parallel, other members of the Security team investigated the logs corresponding to this issue and confirmed that it had not been previously exploited or used maliciously.

At this point, we wrote back to Reginaldo to applaud him for his file read vulnerability. We discussed the matter further, and due to a valid scenario he theorized involving an administrative feature we are scheduled to deprecate soon, we decided to re-classify the issue as a potential RCE bug. We knew we wanted to pay out a lot because of the severity of the issue, so we decided to average the payout recommendations across a group of our program administrators. As always, we design our payouts to reward the hard work of researchers who are already inclined to do the right thing and report bugs to the affected vendors.

Check out Reginaldo's writeup at http://www.ubercomp.com/posts/2014-01-16_facebook_remote_code_execution

How I found a Remote Code Execution bug affecting Facebook's servers

$
0
0

Comments:"How I found a Remote Code Execution bug affecting Facebook's servers"

URL:http://www.ubercomp.com/posts/2014-01-16_facebook_remote_code_execution


XXE in OpenID: one bug to rule them all, or how I found a Remote Code Execution flaw affecting Facebook's servers

Today I want to share a tale about how I found a Remote Code Execution bug affecting Facebook. Like all good tales, the beginning was a long time ago (actually, just over a year, but I count using Internet Time, so bear with me). If you find this interesting and want to hire me to do a security focused review or penetration testing in your own (or your company's) code, don't hesitate to send me an email.

September 22nd, 2012 was a very special day for me, because it was the day I found a XML External Entity Expansion bug affecting the part of Drupal that handled OpenID. XXEs are very nice. They allow you to read any files on the filesystem, make arbitrary network connections, and just for the kicks you can also DoS the server with the billion laughs attack.

I was so naive at the time that I didn't even bother to check if anyone else was vulnerable. I reported it immediately. I wanted to start putting CVEs on my resume as soon as possible, and this would be the first (it eventually gotCVE-2012-4554 assigned to it). Only five days later it occurred to me that OpenID was pretty heavily used and so maybe other places were vulnerable as well. I decided to check the StackOverflow login form. Indeed, it was vulnerable to the whole thing (file reading and all).

Then I decided to try to find OpenID handling code running inside Google's servers. I wasn't able to read files or open network connections, but both App Engine and Blogger were vulnerable to DoS. This is how I got my first bounty from Google, by the way. It was a US$ 500 bounty.

After reporting the bug to Google, I ran some more tests and eventually noticed that the bug I had in my hands was affecting a lot of implementations. I won't enumerate the libraries here, but let me just say that this single bug affected, in one way or another, libraries implemented in Java, C#, PHP, Ruby, Python, Perl, and then more... The only reason I'm not publishing the PoC here is that there are a lot of servers who are still vulnerable out there. Of course, the people who know about security will just read OpenID and XXE and then write an exploit in about 5 minutes, but I digress.

So after contacting (or trying to contact) every OpenID library author out there, I decided to write to the member-only security list hosted at the OpenID foundation an email titled "One bug to rule them all: many implementations of OpenID are vulnerable to XXE" to share my findings. I figured most library authors would be members of that list and so patches would be released for everyone very soon. I was right, but only partially.

The persistent readers who are still with me by now are thinking: what does a Facebook Remote Code Execution bug has to do with all this? Well, I knew Facebook allowed OpenID login in the past. However, when I first found the OpenID bug in 2012 I couldn't find any endpoint that would allow me to enter an arbitrary OpenID URL. From a Google search I knew that in the past you could do something like https://www.facebook.com/openid/consumer_helper.php?openid.mode=checkid_setup&user_claimed_id=YOUR_CLAIMED_ID_HERE&context=link&request_id=0&no_extensions=false&third_party_login=false, but now the consumer_helper.php endpoint is gone. So for more than a year I thought Facebook was not vulnerable at all, until one day I was testing Facebook's Forgot your password? functionality and saw a request to https://www.facebook.com/openid/receiver.php.

That's when I began to suspect that Facebook was indeed vulnerable to that same XXE I had found out more than a year ago. I had to work a lot to confirm this suspicion, though. Long story short, when you forget your password, one of the ways you can prove to Facebook that you own an @gmail.com account is to log into your Gmail and authorize Facebook to get your basic information (such as email and name). The way this works is you're actually logging into Facebook using your Gmail account, and this login happens over OpenID. So far, so good, but this is where I got stuck. I knew that, for my bug to work, the OpenID Relying Party (RP - Facebook) has to make a Yadis discovery request to an OpenID Provider (OP) under the attacker's control. Let's say http://www.ubercomp.com/. Then my malicious OP will send a response with the rogue XML that will then be parsed by the RP, and the XXE attack will work.

Since the initial OpenID request (a redirect from Facebook to Google) happens without my intervention, there was no place for me to actually enter an URL under my control that was my OpenID identifier and have Facebook send a Yadis Discover request to that URL. So I thought the bug would not be triggered at all, unless I could somehow get Google to send Facebook a malicious XML, which was very unlikely. Fortunately, I was wrong. After a more careful reading of theOpenID 2.0 Specification, I found this nice gem in session 11.2 - Verifying Discovered Information:

"If the Claimed Identifier was not previously discovered by the Relying Party (the "openid.identity" in the request was "http://specs.openid.net/auth/2.0/identifier_select" or a different Identifier, or if the OP is sending an unsolicited positive assertion), the Relying Party MUST perform discovery on the Claimed Identifier in the response to make sure that the OP is authorized to make assertions about the Claimed Identifier".

I checked and, indeed, the openid.identity in the request washttp://specs.openid.net/auth/2.0/identifier_select. This is a very common practice, actually. So indeed after a few minutes I was able to make a request to https://www.facebook.com/openid/receiver.php that caused Facebook to perform a Yadis discovery on a URL under my control, and the response to that request would contain malicious XML. I knew I had a XXE because when I told Facebook's server to open /dev/random, the response would never come and eventually a request killer would kick in after a few minutes. But I still couldn't read any file contents. I tried everything on the XXE back of tricks (including weird combinations involving parameter entities, but nothing. I then realized I had a subtle bug on my exploit that, fixed that, and then...

$ bash exploit.sh
* About to connect() to www.facebook.com port 80 (#0)
* Trying 31.13.75.1... connected
* Connected to www.facebook.com (31.13.75.1) port 80 (#0)> GET /openid/receiver.php?provider_id=1010459756371&context=account_recovery&protocol=http&request_id=1&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.mode=id_res&openid.op_endpoint=...(redacted)... HTTP/1.1> Host: www.facebook.com> Accept: */*> User-Agent: Chrome>

That's right, the response contained Facebook's /etc/passwd. Now we were going somewhere. By then I knew I had found the keys to the kingdom. After all, having the ability to read (almost) any file and open arbitrary network connections through the point of view of the Facebook server, and which don't go through any kind of proxy was surely something Facebook wanted to avoid at any cost. But I wanted more. I wanted to escalate this to a full Remote Execution.

A lot of bug bounty programs around the web have a rule that I think is very sensible: whenever you find a bug, don't linger on messing around. Report the bug right away and the security team will consider the worst case scenario and pay accordingly. However, I didn't have much experience with the security team at Facebook and didn't know if they would consider my bug as a Remote Code Execution or not. I Since I didn't want to cause the wrong impressions, I decided I would report the bug right away, ask for permission to try to escalate it to a RCE and then work on it while it was being fixed. I figured that would be ok because most bugs take a long time to be processed, and so I had plenty of time to try to escalate to an RCE while still keeping the nice imaginary white hat I have on my head. So after writing the bug report I decided to go out and have lunch, and the plan was to continue working when I came back.

However, I was wrong again. Since this was a very critical bug, when I got back home from lunch, a quick fix was already in place. Less than two hours after the initial report was sent. Needless to say, I was very impressed and disappointed at the same time, but since I knew just how I would escalate that attack to a Remote Code Execution bug, I decided to tell the security team what I'd do to escalate my access and trust them to be honest when they tested to see if the attack I had in my mind worked or not. I'm glad I did that. After a few back and forth emails, the security team confirmed that my attack was sound and that I had indeed found a RCE affecting their servers.

So this is how the first high impact bug I ever found was the entry point for an attack that probably got one of the highest payouts of any web security bug bounty program. Nice, huh?

Timeline

All timestamps are in GMT. I omitted a few unimportant interactions about the acknowledgements page and such.

  • 2013-11-19 3:51 pm: Initial report
  • 2013-11-19 5:37 pm: Bug acknowledged by security team member Godot
  • 2013-11-19 5:46 pm: I replied by sending a PoC to read arbitrary files
  • 2013-11-19 7:31 pm: Security team member Emrakul informed me that a short term fix was already in place and would be live in approximately 30 minutes
  • 2013-11-19 8:27 pm: I replied confirming that the bug was patched.
  • 2013-11-21 8:03 pm: Payout set. The security team informed me it was their biggest bounty payout to date.
  • 2013-11-22 2:13 am: I sent an email asking whether the security team had already considered the bug as RCE or just as a file disclosure.
  • 2013-11-23 1:17 am: Security team replied that they did not considered the attack could be escalated to RCE.
  • 2013-11-23 7:54 pm: I sent an email explaining exactly how the attack could be escalated to an RCE (with file paths, example requests and all).
  • 2013-11-24 9:23 pm: Facebook replied that my attack worked and they'd have to work around it.
  • 2013-12-03 4:45 am: Facebook informed me that the longer term fix was in place and that they'd soon have a meeting to discuss a new bounty amount
  • 2013-12-03 7:14 pm: I thanked them and said I'd cross my fingers
  • 2013-12-13 1:04 pm: I found a Bloomberg article quoting Ryan McGeehan, who managed Facebook's incident response unit, saying that "If there's a million dollar bug, we will pay it out" and asked if there was any news.
  • 2013-12-30 4:45 am: Facebook informed me that, since the bug was now considered to be RCE, the payout would be higher. I won't disclose the amount, but if you have any comments about how much you think this should be worth, please share them. Unfortunately, I didn't get even close to the one-million dollar payout cited above.

Balanced Will Release an API to Push Money to Debit Cards » Balanced: Blog

$
0
0

Comments:"Balanced Will Release an API to Push Money to Debit Cards » Balanced: Blog"

URL:http://blog.balancedpayments.com/push-to-cards/


Balanced Will Release an API to Push Money to Debit Cards posted by: Matin Tamizi

22 Jan

Balanced launched acrowdfunding campaign yesterday to gauge interest in building an API that gives marketplaces the ability to pay sellers using only a seller’s debit card number and expiration date. In 25 hours, we reached our goal of $50k with our biggest backers being Raise,Wanderable,Crowdtilt, andInstantCab. I don’t think it would have been possible to take this approach to product validation prior to a white-labeled crowdfunding platform like Crowdhoster or without taking an open approach to building a business and communicating with customers. This post talks about our reasoning and approach towards developing a new product.

We don’t have the flexibility to try out functionality in our API. We either release and support it forever, or we never build it at all. It’s just not possible to rip something out once your customers depend on it to run their business.

We struggled with that challenge a year ago forACH debits. After a lot of research, we decided that it didn’t make sense to move forward, but it was a public discussion, and we operate as anopen company. I had to explain why.

In the end, there was so much demand and a push from our customers to pay even more than what we thought they would pay. The public conversation changed everything.

There was also a public conversation for Balanced to build an API topush money to cards. We did the research, realized it was in fact possible, but it wasn’t enough of a priority. It wasn’t clear whether there was enough demand, so we took a different approach this time by running a crowdfunding campaign on Crowdhoster to ask our customers to put their money where their mouth is. If you really want this, show us … and they did.

The Main Backers

Raise jumped in right away with a $20,000 contribution becoming the largest backer, and one of our primary partners to make this happen. Raise is a marketplace for gift cards. George, the Founder/CEO, and Angelo who runs payments at Raise immediately got it.

It all became clear when I had dinner Monday night with George, Angelo, and George’s girlfriend who is also Angelo’s sister :-). I asked her about having to enter her account number and routing number into a site. She explained that she’d prefer not to share her bank account information and would have to call her bank to even find out what her bank account information was. Raise wants anyone to be able to sell their gift cards online, and that means making it as simple as possible to do so.

What’s interesting is that Raise wasn’t a customer of Balanced prior to the campaign. They just saw the value to innovate and be an early and, thus far, the largest backer.

Wanderable is a free wedding registry for honeymoon destinations. As a current Balanced customer, we’ve worked with them to manage couples mistyping their bank account number. It’s not possible to validate a bank account number in real-time, so Wanderable would have to ask the couple to come back days later. Paying a couple using their debit card number solves that problem.

Crowdtilt lets you crowdfund anything. They are the company behind Crowdhoster–the platform that powers our crowdfunding campaign. Crowdtilt is also a current Balanced customer. James and Khaled, the co-founders of Crowdtilt, have shared with me on numerous occasions how annoying it was for their customers to have to hunt down their bank account information. Their iPhone app lets you launch a crowdfunding campaign in under a minute. Now, they’re going to reduce the friction even further.

InstantCab competes with Uber and Lyft to provide an amazing service to get a ride. Aarjav started pinging meon Twitter asking about more information. He shared with me last night that they had challenges with drivers mistyping their bank account number, and that is was easier to just ask them for a check to verify the driver’s bank account information. That’s a painful operations challenge that they’re now going to solve.

Next Steps

It’s clear now that we have to move forward, and our community has shown us that there’s real demand. We’re going to continue the campaign to provide backers with early access and a discount. All of the contribution will go towards the transaction fees for the service.

I’m incredibly excited to build something I’ve wanted to exist for a long time and support companies that enable new forms of commerce.

Comments and discussion on Hacker News

The RedMonk Programming Language Rankings: January 2014 – tecosystems

$
0
0

Comments:"The RedMonk Programming Language Rankings: January 2014 – tecosystems"

URL:http://redmonk.com/sogrady/2014/01/22/language-rankings-1-14/


As long as we have been doing our programming language rankings here at RedMonk, dating back to the original publication by Drew Conway and John Myles White, we have been trying to find the correct timing. Should it be monthly? Quarterly? Annually? While the appetite for up to date numbers is strong, the truth is that historically changes from snapshot to snapshot have been minimal. This is in part the justification for the shift from quarterly to bi-annual rankings. Although we snapshot the data approximately monthly, there is little perceived benefit to cranking out essentially the same numbers month after month. There are more volatile ranking systems that reflect more ephemeral, day-to-day metrics, but how much more or less popular can a programming language realistically become in a month, or even two? The aspect of these rankings that most interests us is the trajectories they may record: which languages are trending up? Which are in decline? Given that and the adoption curve for languages in general, the most reliable approach would seem to be one that measures performance over multi-month periods at a minimum.

This month’s ranking, however, may call that approach into question. From Q113 to Q313, for example, only two languages in our Top 10 experienced any change – Java and JavaScript briefly swapped places. Between Q313 and this Q114 snapshot, however, six spots have new owners. Now it’s important to emphasize, as the caveats below note, that the practical significance of moving from one rank to another is very slight: no one is going to use one language or drop another because it’s fifth rather than sixth, for example. And it is necessary to note that the way these rankings are conducted has changed for the first time since their inception, due to a change on GitHub’s part.

Previously, GitHub’s Explore page ranked their top programming languages – theoretically by repository – and we simply leveraged those rankings in our plot. For reasons that are not clear, this provided ranking has been retired by GitHub and is thus no longer available for our rankings. Instead, this plot attempts to duplicate those rankings by querying the GitHub Archive on Google’s BigQuery. We select and count repository languages, excluding forks, for the Top 100 languages on GitHub. Without knowing precisely how GitHub produced their own rankings, however, we can’t be sure we’re duplicating their methods exactly. And there is some evidence to suggest that the new method is an imperfect replica. Previous iterations have produced correlations between GitHub’s rankings and Stack Overflow’s as high as .82 but never one lower than .78. This quarter’s iteration is the lowest yet at .75. It’s possible, of course, that this is reflective of nothing more than a natural divergence between the two communities. But it’s equally possible that our new method is slightly different, and therefore producing slightly distinct results, than in previous iterations. Until and unless GitHub decides to resume publishing of their own rankings, however, this is the best method available to us. This must be kept in mind when comparing these results against previous iterations.

Besides that notable caveat, there are a few others to reiterate here before we get to the plot and rankings.

  • To be included in this analysis, a language must be observable within both GitHub and Stack Overflow.
  • No claims are made here that these rankings are representative of general usage more broadly. They are nothing more or less than an examination of the correlation between two populations we believe to be predictive of future use, hence their value.
  • There are many potential communities that could be surveyed for this analysis. GitHub and Stack Overflow are used here first because of their size and second because of their public exposure of the data necessary for the analysis. We encourage, however, interested parties to perform their own analyses using other sources.
  • All numerical rankings should be taken with a grain of salt. We rank by numbers here strictly for the sake of interest. In general, the numerical ranking is substantially less relevant than the language’s tier or grouping. In many cases, one spot on the list is not distinuishable from the next. The separation between language tiers on the plot, however, is generally representative of substantial differences in relative popularity.
  • In addition, the further down the rankings one goes, the less data available to rank languages by. Beyond the top 20 to 30 languages, depending on the snapshot, the amount of data to assess is minute, and the actual placement of languages becomes less reliable the further down the list one proceeds.

With that, here is the first quarter plot for 2014.

(embiggen the chart by clicking on it)

Because the plot doesn’t lend itself well to understanding precisely how languages are performing relative to one another, we also produce the following list of the Top 20 languages by combined ranking. The change in rank from our last snapshot is in parentheses.

JavaScript (+1) Java (-1) PHP C# (+2) Python (-1) C++ (+1) Ruby (-2) C Objective-C CSS (new) Perl Shell (-2) Scala (-1) Haskell R (1) Matlab (+3) Clojure (+5) CoffeeScript (-1) Visual Basic (+1) Groovy (-2)

A few observations of larger trends:

  • Java and JavaScript: It’s fundamentally less important that JavaScript resumed its rein atop our charts after a brief one snapshot dethroning by Java than the fact that these are collectively and consistently the two highest ranking languages surveyed. In spite of their vast differences in design and usage, they are the focal point for enormous communities of development.
  • The Solidity of PHP: PHP is, as far as these rankings go, a bit boring. It finishes third behind Java and JavaScript like clockwork. While the language has its share of notable critics, investments from Facebook (notably HHVM), Zend and the like along with ubiquitously popular projects such as WordPress are apparently more than sufficient to sustain a robust market position.
  • Gains for C++/C# / Losses for Python/Ruby: It’s tough to say which was more odd from the result set: the slight gains from the compiled languages or the slight declines from the interpreted alternatives. To be clear, it’s dangerous to read much into the wider popularity of any of these runtimes based on these results. Ohloh, for one, does not concur with the trajectories implied.

    But they do represent a change at least within this result set – which has been relatively static. There are some who are – anecdotally, at least – arguing that a C++ renaissance is underway. Until we see more hard data, it’s probably safest to chalk the small change in fortunes here up to statistical noise, but we’ll be watching compiled language trends closely and looking to test the hypothesis wherever possible.

  • Clojure Makes the Top 20: For the first time since we began surveying, Clojure joins its JVM-based counterpart Scala as a Top 20 language. It is the continuing success not only of Java the language but JVM-based alternatives that makes the regular “Java is dead” arguments so baffling.
  • Statistical Language Popularity: Both R and Matlab experienced gains this quarter, and this was the third consecutive quarter of growth for R in particular. While, as the plot indicates, these languages tend to outperform on Stack Overflow relative to GitHub, they are indicative of a continued rise in popularity for statistical analysis languages more broadly.
  • The Rise of Go: Go, which we termed a notable performer in last year’s Q1 ranking, continued its rise. It checked in just outside the Top 20 at 22 this quarter, a gain of six spots from last quarter.
  • Languages to Watch: In the intial run of the data for this quarter, Julia, Rust and Elixir finished back to back to back. After making a correction to the GitHub Archive query and re-running the data, they finished Julia, Rust and then Elixir one spot removed from Rust. Regardless, while these are not going to challenge for Top 20 rankings within the near future (Julia performs best at 62), they are each languages to watch, with notable followers and contributors. We’ll keep an eye on each as we move along.

Big picture, the takeaway from the rankings is that language diversity is the new norm. The Top 20 continues to evidence strong diversity in domain, and even non-general purpose languages like Matlab and R are borderline mainstream from a visibility perspective. Expect this to continue, with specialized tools being heavily leveraged alongside of general purpose alternatives, rather than being eliminated by same.

bro: just get to the point!

Nvidia marketing manager killed during train rescue attempt | Polygon

$
0
0

Comments:"Nvidia marketing manager killed during train rescue attempt | Polygon"

URL:http://www.polygon.com/2014/1/25/5344390/nvidia-marketing-manager-killed-during-train-rescue-attempt


Nvidia marketing manager Philip Scholz was killed on Jan. 20 after attempting to pull a man off the train tracks at the Santa Clara Caltrain Station in California, Mercury News reports.

According to surveillance footage taken just before his death, Scholz laid on his stomach and attempted to help pull the man to safety just before the train hit both men around 5:30 p.m. at 50 to 70 mph. Scholz was killed in the accident, while the man he helped remains in critical condition at the hospital. His identity has not yet been released.

Scholz, age 35, was raised in Washington. He attended Santa Clara University in California and was married to Emily Scholz.

The memorial for Philip Scholz will take place at 10 a.m. on Feb. 10 at the Veterans Memorial Building in Pleasanton.


Making GIFs from Video Files with Python - __del__( self )

$
0
0

Comments:"Making GIFs from Video Files with Python - __del__( self )"

URL:http://zulko.github.io/blog/2014/01/23/making-animated-gifs-from-video-files-with-python/#


Sometimes producing a good animated GIF requires a few advanced tweaks, for which scripting can help. So I added a GIF export feature to MoviePy, a Python package originally written for video editing.

For this demo we will make a few GIFs out of this trailer:

Converting a video excerpt into a GIF

In what follows we import MoviePy, we open the video file, we select the part between 1’22.65 (1 minute 22.65 seconds) and 1’23.2, reduce its size (to 30% of the original) and save it as a GIF:

1 2 3 4 5 6 from moviepy.editor import * VideoFileClip("./frozen_trailer.mp4").\ subclip((1,22.65),(1,23.2)).\ resize(0.3).\ to_gif("use_your_head.gif")

Cropping the image

For my next GIF I will only keep the center of the screen. If you intend to use MoviePy, note that you can preview a clip with clip.preview(). During the preview clicking on a pixel will print its position, which is convenient for cropping with precision.

1 2 3 4 5 kris_sven = VideoFileClip("./frozen_trailer.mp4").\ subclip((1,13.4),(1,13.9)).\ resize(0.5).\ crop(x1=145,x2=400).\ # remove left-right borders to_gif("kris_sven.gif")

Freezing a region

Many GIF makers like to freeze some parts of the GIF to reduce the file size and/or focus the attention on one part of the animation.

In the next GIF we freeze the left part of the clip. To do so we take a snapshot of the clip at t=0.2 seconds, we crop this snapshot to only keep the left half, then we make a composite clip which superimposes the cropped snapshot on the original clip:

1 2 3 4 5 6 7 8 9 10 11 12 anna_olaf = VideoFileClip("./frozen_trailer.mp4").\ subclip(87.9,88.1).\ speedx(0.5).\ # Play at half speed resize(.4) snapshot = anna_olaf.\ crop(x2= anna_olaf.w/2).\ # remove right half to_ImageClip(0.2).\ # snapshot of the clip at t=0.2s set_duration(anna_olaf.duration) CompositeVideoClip([anna_olaf, snapshot]).\ to_gif('anna_olaf.gif', fps=15)

Freezing a more complicated region

This time we will apply a custom mask to the snapshot to specify where it will be transparent (and let the animated part appear) .

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 import moviepy.video.tools.drawing as dw anna_kris = VideoFileClip("./frozen_trailer.mp4", audio=False).\ subclip((1,38.15),(1,38.5)).\ resize(.5) # coordinates p1,p2 define the edges of the mask mask = dw.color_split(anna_kris.size, p1=(445, 20), p2=(345, 275), grad_width=5) # blur the mask's edges snapshot = anna_kris.to_ImageClip().\ set_duration(anna_kris.duration).\ set_mask(ImageClip(mask, ismask=True)) CompositeVideoClip([anna_kris,snapshot]).\ speedx(0.2).\ to_gif('anna_kris.gif', fps=15, fuzz=3) # fuzz= GIF compression

Time-symetrization

Surely you have noticed that in the previous GIFs, the end did not always look like the beginning. As a consequence, you could see a disruption every time the animation was restarted. A way to avoid this is to time-symetrize the clip, i.e. to make the clip play once forwards, then once backwards. This way the end of the clip really is the beginning of the clip. This creates a GIF that can loop fluidly, without a real beginning or end.

1 2 3 4 5 6 7 8 9 10 11 12 def time_symetrize(clip): """ Returns the clip played forwards then backwards. In case you are wondering, vfx (short for Video FX) is loaded by>>> from moviepy.editor import * """ return concatenate([clip, clip.fx( vfx.time_mirror )]) VideoFileClip("./frozen_trailer.mp4", audio=False).\ subclip(36.5,36.9).\ resize(0.5).\ crop(x1=189, x2=433).\ fx( time_symetrize ).\ to_gif('sven.gif', fps=15, fuzz=2)

Ok, this might be a bad example of time symetrization,it makes the snow flakes go upwards in the second half of the animation.

Adding some text

In the next GIF there will be a text clip superimposed on the video clip.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 olaf = VideoFileClip("./frozen_trailer.mp4", audio=False).\ subclip((1,21.6),(1,22.1)).\ resize(.5).\ speedx(0.5).\ fx( time_symetrize ) # Many options are available for the text (requires ImageMagick) text = TextClip("In my nightmares\nI see rabbits.", fontsize=30, color='white', font='Amiri-Bold', interline=-25).\ set_pos((20,190)).\ set_duration(olaf.duration) CompositeVideoClip( [olaf, text] ).\ to_gif('olaf.gif', fps=10, fuzz=2)

Making the gif loopable

The following GIF features a lot of snow falling. Therefore it cannot be made loopable using time-symetrization (or you will snow floating upwards !). So we will make this animation loopable by having the beginning of the animation appear progressively (fade in) just before the end of the clip. The montage here is a little complicated, I cannot explain it better than with this picture:

1 2 3 4 5 6 7 8 9 10 11 12 13 castle = VideoFileClip("./frozen_trailer.mp4", audio=False).\ subclip(22.8,23.2).\ speedx(0.2).\ resize(.4) d = castle.duration castle = castle.crossfadein(d/2) CompositeVideoClip([castle, castle.set_start(d/2), castle.set_start(d)]).\ subclip(d/2, 3*d/2).\ to_gif('castle.gif', fps=5,fuzz=5)

Another example of a GIF made loopable

The next clip (from the movie Charade) was almost loopable: you can see Carry Grant smiling, then making a funny face, then coming back to normal. The problem is that at the end of the excerpt Cary is not exactly in the same position, and he is not smiling as he was at the beginning. To correct this, we take a snapshot of the first frame and we make it appear progressively at the end. This seems to do the trick.

1 2 3 4 5 6 7 8 9 10 11 12 carry = VideoFileClip("../videos/charade.mp4", audio=False).\ subclip((1,51,18.3),(1,51,20.6)).\ crop(x1=102, y1=2, x2=297, y2=202) d = carry.duration snapshot = carry.to_ImageClip().\ set_duration(d/6).\ crossfadein(d/6).\ set_start(5*d/6) CompositeVideoClip([carry, snapshot]).\ to_gif('carry.gif', fps=carry.fps, fuzz=3)

Big finish: removing the background

Let us dive further into the scripting madness: we consider this video around 2’16:

And we will remove the background to make this gif (with transparent background):

The main difficulty was to find what the background of the scene is. To do so, the script gathers a few images in which the little pigs are are different positions (so that every part part of the background is visible on at least several (actually most) of the slides, then it takes the pixel-per-pixel median of these pictures, which gives the background.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 # Requires Scikit Images installed import numpy as np import skimage.morphology as skm import skimage.filter as skf from moviepy.editor import * ### LOAD THE CLIP pigsPolka = VideoFileClip("pigs_in_a_polka.mp4").\ subclip((2,16.85),(2,35)).\ resize(.5).\ crop(x1=140, y1=41, x2=454, y2=314) ### COMPUTE THE BACKGROUND # There is no single frame showing the background only (there # is always a little pig in the screen) so we use the median of # several carefully chosen frames to reconstitute the background. # I must have spent half an hour to find the right set of frames. times = (list(np.linspace(2.3,4.2,30))+ list(np.linspace(6.0,7.1,30))+ 8*[6.2]) frames_bg = [pigsPolka.get_frame(t) for t in times] background = np.percentile(np.array(frames_bg), 50,axis=0) ### MASK GENERATION def get_mask_frame(t): """ Computes the mask for the frame at time t """ # THRESHOLD THE PIXEL-TO-PIXEL DIFFERENCE # BETWEEN THE FRAME AND THE BACKGROUND im = pigsPolka.get_frame(t) mask = ((im-background)**2).sum(axis=2) > 1500 # REMOVE SMALL OBJECTS mask = skm.remove_small_objects(mask) # REMOVE SMALL HOLES (BY DILATIATION/EROSION) selem=np.array([[1,1,1],[1,1,1],[1,1,1]]) for i in range(2): mask = skm.binary_dilation(mask,selem) for i in range(2): mask = skm.binary_erosion(mask,selem) # BLUR THE MASK A LITTLE mask = skf.gaussian_filter(mask.astype(float),1.5) return mask mask = VideoClip(ismask=True).\ set_get_frame(get_mask_frame).\ set_duration(pigsPolka.duration) ### LAST EFFECTS AND GIF GENERATION pigsPolka.set_mask(mask).\ subclip(12.95,15.9).\ fx(vfx.blackwhite).\ # black & white effect ! to_gif('pigs_polka.gif', fps=10, dispose=True, fuzz=10)

Network Security Blog » Can’t get there from here

$
0
0

Comments:"Network Security Blog » Can’t get there from here"

URL:http://www.mckeay.net/2014/01/24/cant-get-there-from-here/


Jan 24 2014

I’ve had an interesting problem for the last few days.  I can’t get to the Hack in the Box site, HITB.org, or the HITB NL site from my home near London.  Turns out I can’t get to the THC.org site or rokabear.com either.  That makes four hacking conferences who’s sites I can’t get to.  And I’m not the only one, since apparently a number of people who are using Virgin Media in the UK as their ISP can’t get to these sites, while other people on other ISP’s in Britain can get to all four of these sites.  I can even get to them if I log into my corporate VPN, just not while the traffic is flowing out through my home network.  I’m not going to accuse Virgin Media of blocking these sites, but I’m also not ruling chicanery on their part out as a cause either.  I also make no claims that I poses the network kung-fu to verify that any of my testing is more than scratching the surface of this problem.

So here’s how this all started:  Yesterday morning I decided I saw a tweet that the early bird sign up for Hack in the Box Amsterdam was going to end soon.  I know some of the organizers of the event, I’ve wanted to go for a long time, so I decided to get my ticket early and save the company a few bucks.  I opened up a new tab in Chrome, typed in haxpo.nl and … nothing, the request timed out.  Hmm.  Ping gave me an IP, so the DNS records were resolving, but the site itself was timing out.  I switched to the work computer, to find the same thing was happening.  The I logged into the corporate VPN and tried again, suddenly everything worked.  Curious.

At first I thought this might be a stupid DNS trick played at the ISP, so I changed my DNS resolvers to a pair of servers I have relative certainty aren’t going to play tricks, Google’s 8.8.8.8 and the DNS server from my old ISP back in the US, Sonic.net (who I highly recommend, BTW).  This didn’t change anything, I still couldn’t get to HITB.  I had to get working, so I did what any smart security professional does, I threw up a couple of tweets to see if anyone else was experiencing similar issues.  And it turns out there were a number of people, all using Virgin Media, who had the identical problem.  This is how I found out that THC and Rokabear are also not accessible for us.

As yesterday went by, I got more and more confirmations that none of these hacking sites are available for those of us on Virgin Media.  At first I thought it might simply be VM blackholing the sites, but VM’s social media person sent me a link to review who was being blocked by court order by Virgin Media.  I didn’t find any of the hacking sites listed in this, besides which Virgin Media actually throws up a warning banner page when they block a page, they don’t simply blackhole the traffic.  They will limit your internet access if they feel you’re downloading too many big files during peak usage hours, but that’s a discussion for another day.

The next step was tracert.  I a little chagrined to admit I didn’t think of tracert earlier in the process, but to be honest, I haven’t really needed to use it in a while.  What I found was a bit interesting (and no, you don’t get the first two hops in my network chain, you have no need to know what my router’s IP is).

 C:\Users\Martin>tracert www.hitb.org Tracing route to www.hitb.org [199.58.210.36] 3     9 ms     7 ms     7 ms  glfd-core-2b-ae3-2352.network.virginmedia.net [8.4.31.225]  4    11 ms     7 ms     7 ms  popl-bb-1b-ae3-0.network.virginmedia.net [213.10.159.245]  5    10 ms    11 ms    10 ms  nrth-bb-1b-et-700-0.network.virginmedia.net [62.53.175.53]  6    11 ms    15 ms    14 ms  tele-ic-4-ae0-0.network.virginmedia.net [62.253.74.18]  7    13 ms    16 ms    14 ms  be3000.ccr21.lon02.atlas.cogentco.com [130.117.1.141]  8    16 ms    14 ms    16 ms  be2328.ccr21.lon01.atlas.cogentco.com [130.117.4.85]  9    17 ms    15 ms    16 ms  be2317.mpd22.lon13.atlas.cogentco.com [154.54.73.177] 10    88 ms   102 ms   103 ms  be2350.mpd22.jfk02.atlas.cogentco.com [154.54.30.185] 11    99 ms   100 ms    91 ms  be2150.mpd21.dca01.atlas.cogentco.com [154.54.31.129] 12    97 ms    94 ms    96 ms  be2177.ccr41.iad02.atlas.cogentco.com [154.54.41.205] 13   102 ms   100 ms   105 ms  te2-1.ccr01.iad01.atlas.cogentco.com [154.54.31..62] 14   101 ms   210 ms   211 ms  te4-1.ccr01.iad06.atlas.cogentco.com [154.54.85.8] 15    90 ms    91 ms    99 ms  edge03-iad-ge0.lionlink.net [38.122.66.186] 16    90 ms    94 ms    98 ms  23.29.62.12 17  nlayer.lionlink.net [67.208.163.153]  reports: Destination net unreachable.

Rather than doing what I thought would be the logical thing and simply hoping across the channel and hitting Amsterdam fairly directly, my traffic leaves the VM network through Cogent Networks, hits a few systems in the US owned by a company called Lionlink Networks LLC and dies.  So my traffic leaves the UK, travels to Switzerland, then to the US, over to Washington DC and then dies.  And this happens with four separate hacker conference sites, but doesn’t appear to happen anywhere else.  Oh, and all four hacking sites take the same basic route and all die shortly after hitting LionLink.  Hmmmm.

I know I’m a professional paranoid.  I know how BGP works and that it’s not unusual for traffic to bounce around the internet and go way, way, way, out of what a human would consider a direct route, but the fact that all four EU hacking sites all route back to the US and that they all die when they hit Lionlink is more than a little suspicious to me.  It’s almost like someone is routing the traffic through Switzerland and the US so it can be monitored for hacker activity, since both countries have laws that allow for the capture of traffic that transgresses their borders.  But of course, that would just be paranoid.  Or it would have been in a pre-Snowden world.  In a post-Snowden world, I have to assume most of my traffic is being monitored for anomalous behavior and that the only reason I noticed is because someone at Lionlink screwed up a routing table, exposing the subterfuge.  But that would just be my paranoia speaking, wouldn’t it?

I’m hoping someone with deeper understanding of the dark magiks of the Internets can dig into this and share their findings with me.  It’s interesting that this routing problem is only happening to people on Virgin Media and it’s interesting that the traffic is being routed through Switzerland and the US.  What I have isn’t conclusive proof of anything; it’s just an interesting traffic pattern at this point in time.  I’m hoping there’s a less sinister explanation for what’s going on than the one I’m positing.  If you look into this, please share your findings with me.  I might just be looking at things all wrong but I want to learn from this experience whether I’m right or not.

Thanks to @gsuberland, @clappymonkey, @sawaba @tomaszmiklas, @module0x90 and others who helped verify some of my testing on twitter last night.  And special thanks to @l33tdawg for snooping and making sure I got signed up for HITB.

Update – And here it is, a much more believable explanation than spying, route leakage.  So much for my pre-dawn ramblings.

From Hacker News on Ycombinator: This is a route leak, plain and simple. Don’t forget to apply Occam’s Razor. All of those sites which are “coincidentally” misbehaving are located in the same /24. This is what is actually happening. Virgin Media peers with Cogent. Virgin prefers routes from peers over transit. Cogent is turrible at provisioning and filtering, and is a large international transit provider. Let’s look at the route from Cogent’s perspective:   BGP routing table entry for 199.58.210.0/24, version 2031309347 Paths: (1 available, best #1, table Default-IP-Routing-Table) 54098 11557 4436 40015 54876 38.122.66.186 (metric 10105011) from 154.54.66.76 (154.54.66.76) Origin incomplete, metric 0, localpref 130, valid, internal, best Community: 174:3092 174:10031 174:20999 174:21001 174:22013 If Cogent was competent at filtering, they’d never learn a route transiting 4436 via a customer port in the first place, but most likely someone at Lionlink (54098) is leaking from one of their transit providers (Sidera, 11557) to another (Cogent, 174). Also, traffic passing through Switzerland is a red herring — the poster is using a geoip database to look up where a Cogent router is. GeoIP databases are typically populated by user activity, e.g., mobile devices phoning home to get wifi-based location, credit card txns, etc. None of this traffic comes from a ptp interface address on a core router. GeoIP databases tend to have a resolution of about a /24, whereas infrastructure netblocks tend to be chopped up into /30s or /31s for ptp links and /32s for loopbacks, so two adjacent /32s could physically be located in wildly different parts of the world. More than likely, that IP address was previously assigned to a customer. The more accurate source of information would be the router’s hostname, which clearly indicates that it is in London. The handoff between Virgin and Cogent almost certainly happens at Telehouse in the Docklands. If someone were, in fact, trying to intercept your traffic, they could almost certainly do so without you noticing (at least at layer 3.)

SoundCloud Raises $60 Million At A $700 Million Valuation | TechCrunch

$
0
0

Comments:"SoundCloud Raises $60 Million At A $700 Million Valuation | TechCrunch"

URL:http://techcrunch.com/2014/01/25/soundcloud-raises-60-million-at-700-million-valuation/


SoundCloud recently closed a Series D round of funding led by Institutional Venture Partners with the Chernin Group. The Wall Street Journal first reported the news. It has since been confirmed by IVP and SoundCloud. Previous investors also participated in the round, including Kleiner Perkins Caufield & Byers, GGV Capital, Index Ventures and Union Square Ventures.

SoundCloud’s ultimate goal is to become the audio platform of the web, or the YouTube of audio. Just like YouTube, user-generated content remains the startup’s fuel. Every minute, 12 hours of sound and music are uploaded to the platform. For comparison’s sake, YouTube reports 100 hours of content uploaded every minute.

Many up-and-coming electronic music artists use SoundCloud to release mixtapes and share them around the web. Well-known musicians also release singles or live recordings on the platform to share them with their fans on Twitter or Facebook. In other words, SoundCloud is the perfect place to transform a music file into a URL and embeddable music player.

Seeing American VC firms putting a lot of faith in a European startup is a big win for the Berlin startup scene.

Back in October at Disrupt Europe, SoundCloud co-founder and CEO Alexander Ljung said that the company was focused on growth and engagement.

That’s why it simplified its premium offering. “The big thing when we made that change is that we went from four different account levels with a fairly wide range of pricing to two different levels with a smaller range,” Ljung said.

With a free account, you can upload up to 2 hours of music, while the most expensive plan allows you to upload an unlimited amount of music for $12 a month (€9). Subscriptions used to be much more expensive, and an unlimited plan was out of reach for many amateur artists.

Today’s funding news is probably the consequence of this focus on growth. At Disrupt, Ljung said that subscription numbers were “pretty much exactly on our forecast.” Seeing American VC firms putting a lot of faith in a European startup is a big win for the Berlin startup scene.

But SoundCloud still has to find the major hidden, yet reachable, treasure. Most of SoundCloud’s 250 million users turn to SoundCloud to consume music, listen to artist-curated playlists and comment. They aren’t content creators; they carefully curate a music feed by following artists on the platform. For now, they don’t generate a lot of money for the company — the website has never been inundated with ads.

According to Re/code, the company is now trying to sign content deals with major music labels. It would put SoundCloud in the same league as other big music companies.

It’s still unclear whether the company wants to create yet another subscription service like Spotify or Rdio, a music store like the iTunes Store or the Amazon MP3 Store, a radio-like experience like Pandora or iTunes Radio, or something completely different. It’s a crowded market, but signing these deals is an important step for the company.

With music labels on board, the company could get more users, more monetization options and better content to convince advertisers.

Democratization Is Badass: Soundcloud’s Alexander Ljung in Conversation with Josh Constine

Open source, programmable effects pedal for guitarists, musicians and hackers

16 Free eBooks On Machine Learning!

NES Nintendo World Championship Cart RARE Torn Label 100 Authentic Adult Owned | eBay

$
0
0

Comments:" NES Nintendo World Championship Cart RARE Torn Label 100 Authentic Adult Owned | eBay "

URL:http://www.ebay.com/itm/221357006206?ssPageName=STRK:MEWAX:IT&_trksid=p3984.m1438.l2649


Nintendo World Championship Cart: Grey Version

This is your chance to own the Super RARE Nintendo World Championship Cart for the NES!!!! As you can see by the pictures, this is an authentic, true to life original cart; no reproduction cart here.

Obviously, you'll immediately notice the ripped label. This is quite unfortunate but happened many decades ago by this point in time. No one knows the exact number of this cart (as each NWC cart was individually labeled upon production) as it appears in the upper left-hand corner of the cart label. This is known as the infamous "Mario" NWC cart that someone probably wrote on there long ago not having a clue what they actually had. Still, case in point, this is an authentic, original NWC cart from the championship back in the early 90s. The cart plays just fine and may some day be worth much more if someone decides to investigate a forensics lab's involvement to see if they can determine the official number by running tests on the cart.

A must for Nintendo collectors, which I can attest to since I've been one for over 25 years. Those that walk in NES circles will relate my name with honesty and integrity but feel free to ask for references if you doubt my authenticity. These carts are near impossible to find anywhere so don't let this pass you by! All my games are in working order.

PLEASE EMAIL ME IF YOU HAVE QUESTIONS or LIST THEM HERE

muresanATncDOTrrDOTcom I'm parting with most of my entire video game collection after collecting for nearly 25 years so keep checking back to find more gems hidden in the rough!!! On Jan-24-14 at 18:13:04 PST, seller added the following information:

I can't believe the positive response I've gotten from, seemingly, the world! Praise the Lord!

This question has popped up many a time since I posted the cartridge so here is the brief history on the cart as I know it to be: An Alt Newsgroups auction was held back in 1998 and purchased by thomaser in Norway. He traded to DreamTR, who sold to me maybe around 2004/05.

That should stop the rumors that this is a reproduction cartridge. Only internet monikers are used in the historical account to protect those prior to my role in this game.

Also, as high as this is going, my guess is the buyer and I will have to do an escrowed check or involve banks wiring money. Not sure Paypal is a secure enough method of transfer.

Lastly, as of 9:12PM EST, there have been 145604 views and 5227 watches.

On Jan-24-14 at 22:28:57 PST, seller added the following information:

As of 1:27AM EST, there have been 172850 views and 6446 watches.

Framed For Selling Crack, Surveillance Video Helps Him Sue Police

$
0
0

Comments:"Framed For Selling Crack, Surveillance Video Helps Him Sue Police"

URL:http://ipvm.com/updates/2416


Author: Carlton Purvis, Published on Jan 24, 2014

Busted for selling crack, a New York smoke shop owner used his surveillance system to prove he was set up by a police informant. Donald Andrews, the owner of the shop, says his lawyer will file a wrongful arrest suit against the city, seeking $500,000 from the police department, county and the village.

Andrews opened up Dabb City Smoke Shop in Scotia, New York last January. By April he was arrested for selling crack cocaine. In one of his few media interviews since the arrest, Andrews told us about the set up.

The Arrest

A police informant, James Slater, visited the shop on March 25th and 29th and said on both occasions he bought crack from Andrews. He provided cell phone photos of crack rocks on the front counter of the shop.

Around April 11, police raided the shop and arrested Andrews. From the very beginning Andrews asserted his innocence.

“I kept telling them that I hadvideo, and I could show them that never happened and that I wasn't selling drugs. The cops said there was no need for that -- that they had me on video, and they had audio. They said, ‘We don’t need to watch your video,’ but the confiscated my system anyway,” he said.

He was in jail for five days before he made bail. When he got out, he contacted a lawyer.

Grand Jury, Hearing Prosecutors Refuse to Return DVR

At his grand jury hearing, he says he testified that he had video proof that he wasn’t selling drugs out of the store and that police hadn’t allowed him to get the footage from his surveillance system to prove it.

“The grand jury wanted to see the video. The grand jury asked the DA where the videotapes were. The DA said the videos were irrelevant. My lawyer kept trying to get them to release the tapes, but they wouldn’t release the tapes. My lawyer had to beg for those tapes. It was a while before we got them,” he said.

Andrews was using a six-camera Nightowl system that he purchased online for $300. He had installed the system himself. Eventually, the authorities released the video.

What the Footage Shows

Once his lawyer was able to get the footage from his surveillance system, it told a dramatically different story than what the informant said. The tapes show the informant coming into the shop, setting a bag of crack on the counter, taking a photo of it, then picking it back up before leaving. See the video below:

The moment the informant plants the crack:

Other than the informant's testimony, police had no other evidence that Andrews was using the shop as a front to sell drugs. By July he was cleared of all charges, but not before his business took a hit.

“The impact on business was brutal,” he said. “The arrest was all over the six news channels, and people didn’t know what to think ... I had just moved into the neighborhood so people don’t really know me. People were saying then that they didn’t want me here.”

A Scotia resident that I spoke to about the case said people are suspicious police targeted him because he is “the only black business owner in that part of town.” Andrews says he thinks he was an easy target.

Andrews says police told him the informant was sent to his store as part of a series of investigations into stores in Scotia. The informant suggested to police he could help make a case against Andrews because they went to high school together.

Informant Arrested

After Andrews was released from jail, the informant skipped town, but was arrested a month later for perjury, drug and tampering with evidence charges.

This same informant was used in seven other convictions. Those cases are now under review.


Comments (18)

Only IPVM PRO Members may comment. Login or Join.

Luis Marrero

1 day ago

"seeking $500,000......" Not enough for this type of misbahavior.

Lou Marrero

So a $300 surveillance system saved him from having his life essentially destroyed. Powerful story.

"Andrews says police told him the informant was sent to his store as part of a series of investigations into stores in Scotia."

Can you get anything via FOAI from the PD on documentation of this series of investigations?

Maybe. To be honest, this case has FOIA written all over it. It would be interesting to get a better look at the documents behind this, not to mention the seven other convictions where they used this informant. This weekend I'll send some their way, just out of curiosity. But my gut tells me they are going to be reluctant to release any of it by using the "ongoing investigation" exemption.

I'm curious why the DA is not taking more heat for this. I see via the various stories on this case out there that most of the blame has been shifted to the snitch. It is the D.A.'s job to seek justice. Sounds like maybe this D.A. was seeking something else entirely.

Also of note... the FBI did a major sweep the previous year in the area, ringing up a bunch of young, gang-affiliated crack selling dudes with RICO jackets.

Maybe the Schenectady County DA didn't get himself enough headlines during the Fed case and wanted some TV face time for his own 'series of investigations'?

1. I like how we can reply direcly to ourselves (kinda schizophrenic maybe)

2. How come the oldest dude in the gang gets the worst a/k/a name?

"Eric Bell, a/k/a Glasses, age 41"

"I'm curious why the DA is not taking more heat for this."

Absolutely. It seems to me there are two possibilities here:

1.) The DA had blinders on. They were so single-mindedly focused on going after the conviction based on the evidence obtained by the informant that they completely ignored the DVR. They did not even bother to look at the DVR video for additional evidence, either corroborating or exculpatory.

2.) The DA did review the DVR video, saw the exonerating evidence, but chose to ignore/suppress that evidence and still prosecute the case.

The people of Scotia, New York have an interest in knowing which it is. Their DA is either 1.) incompetent or 2.) corrupt/criminal.

Nope, I would have started at $5 million. Bad enough they framed a business owner, but to add racism to it. It just goes to prove that video is still the best form of protection.

Steve Cobb

1 day ago

"They" didn't frame the business owner. They had a bad CI that they obviously put too much faith in, he broke the law and ultimately made those officers look bad. It's unfortunate what happened, but the evidence did exonerate the store owner, and all other cases with that CI will be reviewed and should be. You guys who think there is some huge conspiracy looking to "frame" innocent people all the time dont realize there just arent enough of us to deal with the good guys and the bad guys too. That being said there is always an exception, and when those of us are found to be breaking the law, they should be dealt with.

What is your take on why the DA didn't want to release the video during the grand jury hearing?

No offense Steve, but are you a law enforcement officer? :)

Are you serious? The evidence proving he didn't do shit existed at the time of his arrest.

It is the D.A.'s job to seek evidence that proves the truth - not that 'proves' the guilt of whomever the cops arrestframe.

The CI is an agent of LE - Isn't it LE's job to make sure what the CI says is true - using the existing evidence easily and readily available with the perp screaming about exactly where it is whenever he can?

Cops can get overzealous, sure.... but it is the D.A.'s job to make sure justice is served - not play games with peoples lives to get headlines and TV face time.

I am a police officer. And I wasnt there during the warrant, but I have done a lot of similar narcotics related warrants where the person we were arresting was screaming about something that proves they are innocent. I have taken DVR's, just like I am sure they did, with the understanding that if there is something on there it can be examined later. From phones to computers, unless it is on the warrant to be searched it cant be examined on the scene without some type of exigency. Looking back if they had an idea the CI was lying, they probably wouldnt have done the warrant. A couple of things probably went wrong. First, the majority of cops aren't techs and they unfortunately have to rely on "cell phone pictures" as opposed to some type of real time audio and or video. Thats something that commanders and departments need to change, and give the police tools to do their jobs better.

Second, CI management is tough. You are relying on someone who probably was a criminal (and usually still is) to gain access to people you couldnt by yourself, to help with an investigation. Over time, however a lot of detectives fail to attempt to gather evidence on a target from all angles and not just the CI buy. Your undercover purchase should only be a part of an investigation, or if you have a CI go rougue, this is what can happen.

And lastly, for some reason in my line of work we are expected to be perfect and not make mistakes. Thats impossible, so what happens is instead of admitting mistakes were made and dealing with why they happened we have guys and gals try to cover things up or not cooperate to try to mitigate the problem. We may be the most accountable people in your local government, I mean is there a department at your work solely there to investigate if you do something wrong? That being said I realize with my job comes an incredible amount of responsibility that shoudnt be taken lightly. Taking someone's freedom away for any reason, is something that should be understood as extremely serious by everyone in law enforcement. Its a bad situation all the way around, and I am sure as soon as they saw the CI plant the crack they knew that he was probably making bad buys in other investigations. But if they cops, the DA, or anyone in the chain knew they had a bad CI they needed to release whatever exculpatory evidence they had.

Steve,

That is an excellent reply! Thanks!

I put the full blame here directly on the D.A. - for the reasons I've already ranted.

LE (on the street) is one of the most thankless, underpaid, lots of it unrewarding, see-crap-nobody-wants-to-ever-see - profession.

It takes a rare type of person who can do it well - especially over time. The crap level of society that you have to deal with day in and day out is soul-crushing. I can't watch an entire episode of A&E's The First 48 without getting depressed... :(

Mark Nicol

1 day ago

This was a poor investigation before the CI even set foot into the shop. When running a CI, you have to eliminate any doubts about the case and one way to do so is when you meet with the CI just prior to sending them in, you search the CI just shy of a strip search. Then the CI is in view from the moment after the search until they enter the target location. Yes! This is a problem in some situations but it's the only way to honestly testify when requesting the search warrant you will be requesting after the narcotic was purchased.

I always doubted any CI as they always had a strong bias to make the buy but if done correctly the end result is taking out another crook a bit higher up the chain.

Undisclosed (#2612772) Integrator

1 day ago

Steve:

"I have taken DVR's, just like I am sure they did, with the understanding that if there is something on there it can be examined later. From phones to computers, unless it is on the warrant to be searched it cant be examined on the scene without some type of EXIGENCY."

1.) The "exigency" was the business owner's presumption of innocence. The "exigency" is the implied, and all but certain assertion of the business owner that he had an alibi, on a video recordation no less. Did he make the assertion and then tell the police they were not permitted to view his alibi? That just would make no sense at all.

2.) Law enforcement's mission/purpose to seek the truth and justice. They cannot hide behind a false cloak of a warrant as an excuse for inexcusable behavior. Any investigator worth his salt knows this and will tell you the same. Would these police officers and DA have done this if the circumstances were reversed. What if it was their business being served a warrant based upon a false affidavit, planted illegally held drugs from a less than credible witness and being refused the opportunity to prove their innocence via irrefutable video evidence.

Then to compound matters the DA pulls an arguable, if not well founded, obstruction of justice when he refuses the grand jury's request to "see the video", calling it "irrelevant".

The video evidence eventually exonerates the victim/defendant, but not until after the dogged efforts of the victim's attorney to retrieve that same video evidence held in the custody of the police. Think these actions through. This borders on collusion by the investigating officers and the DA toward obstruction of justice.

Instead of abusing the victim/small business owner, the more important question is why weren't they holding their CI responsible for his crimes?

Too many lost opportunities here to right a wrong. This gives every appearance of a huge travesty of justice that should not be borne by the citizen/taxpayers if there is any civil and punitive damages awarded, but by those responsible for their own actions and abuse of their power and authority.

Sherman Hall

about 20 hours ago

I'm a Police Officer too. I agree with Steve's assessment, but would add that digital evidence is something that most PDs aren't prepared to support. Beyond the training and equipment is the struggle with how to best deploy resources.

Even if they had the capabilities in house, do they pull an investigator off another case to look at the DVR or have that person work on other cases that don't appear on the surface to have been "solved".

Beyond the hours required to review the DVR contents and make copies, is the time required to write the warrant, get a judge to sign it, and then return the findings to the court upon completion. Depending on your County, that may not be a trivial investment in mantime.

My guess is the cops thought they had sufficient evidence to prove their case beyond a reasonable doubt without devoting the resources to examine the DVR. So, the DVR got seized, placed in evidence, but it was never examined.

That's where discovery comes into play. The defense is absolutely entitled to the contents of that DVR, regardless of whether the prosecution considers it meaningful to the case or not. That's the part of this story that doesn't make sense to me. How could the prosecution put up roadblocks?

The defense would be on the hook for examining their copy of the evidence. And, they wouldn't be compelled to share their findings with the prosecution. Had this gone to trial, that would have been a pretty dramatic piece of testimony! My guess is it would be an instant dismissal from the bench.

I have personal experience in this area of law enforcement as a victim.

In our case, first, the CI lied to investigating officers about what we were doing(growing and selling marijuana). We found this out through discovery.

Second, the investigating officers knew the CI had a real past history via civil court cases against us, over my sons parental rights to his three sons. The CI also had an intimate relationship with at least one LEO. The CI was my sons ex-wife of 4 years.

Third, the head officer in charge lied to the judge in the affidavit to obtain the search warrant. He stated he observed our property and buildings from adjacent public land which is physically impossible to do. We could not use that information in a motion to suppress the warrant because the judge AT THE TIME OF THE AFFIDAVIT had every expectation to believe the officer was being truthful.

Long story short, law enforcement spent huge sums of money on us and got nothing. I never spent a day in jail and they dropped the civil forfeiture case against us for two homes, two shops and our small farm. That took a year and a half before it happened.

This subject is about the War on Drugs and related government abuse of power.

Some questions about this case come to mind:

How would this have turned out if Donald did not have the means/etc to get a good lawyer? Discovery costs money.

I have heard local juristictions get a pay-off from the Federal government of $20,000 for any local felony drug conviction. Is this true? Perhaps the officers involved in this discussion can answer that question. Could this be an incentive to encourage the lack of local integrity shown in Donalds case?

For what it is worth, I found the troops(of the lower pay scale....their words) to be mostly honorable and dedicated folks, just as we have heard from the officers involved in this discussion. I spent 6 hours with them and was shaking many hands at the end of that 6 hour period. They were just doing their job, as instructed.

In our case, we estimate the "government" wasted well over $100,000. The CI continues merrily along facing zero consequences. We do plan a FOIA request when all the dust has settled and we get all computers, phones, cameras and personal records returned as we want to know the exact amount of taxpayer money that was spent on us. They have already released all liens and interests on our real property.

Multiply Donalds and our case by thousands and you get the real picture of the WOD.

This is a great discussion. Thanks all for the excellent comments!

I've made this post publicly available so you can share with all your friends and colleagues.


Other Updates on Case Studies

UK Video Forensics Insights on Jan 23, 2014
David Spreadborough has been a police officer in the UK for 23 years, a forensic video investigat...

Beaten Nearly to Death, Weak Video Lets Attackers Go Free on Jan 22, 2014
Watch this: If you were a juror could you make a decision on what happened here? Eyewitness te...

Cruise Ship Surveillance Reviewed on Jan 21, 2014
Falling overboard to die alone in a dark cold sea is terrifying. Video analytics might solve this...

Store Employee Explains How They Stole on Jan 20, 2014
In 2004, Lauren started work at a large CVS in a Washington, D.C. suburb. She says she really nee...

Silicon Valley Startup Targets Neighborhood Surveillance on Jan 16, 2014
Silicon Valley is warming up to the surveillance market, seeing the potential of consumers to emb...

ALPR / NPR Recognition Accuracy and Issues on Jan 15, 2014
Sick of red light and speed cameras? A lot of people are. There are entire websites and web forum...

Cable Company Home Security Issues on Jan 14, 2014
Mark already had cable from Comcast so when he started getting offers for their home security ser...

Criminal Explains How Cameras Caught Him on Jan 13, 2014
Henry’s story is the second in our series exploring surveillance from the other side of the...

Guard Fired For Reporting Surveillance Sexual Harassment on Jan 10, 2014
A guard is fired after reporting misconduct by another guard monitoring surveillance cameras. Now...

Most Recent Industry Updates

LAST Chance - IP Camera Course Winter 2014 on Jan 25, 2014
This is the last chance to get into IPVM's IP camera course that starts next Tuesday, January 28t...

UK Video Forensics Insights on Jan 23, 2014
David Spreadborough has been a police officer in the UK for 23 years, a forensic video investigat...

Ask the AHJ: Chicago on Jan 23, 2014
The AHJ has the final say in access control systems. That power, combined with the rules not alwa...

Cloud VMS For $5 Per Camera Per Month on Jan 22, 2014
A startup launched by the founder of Baracuda, a networking company worth more than a billion dol...

Beaten Nearly to Death, Weak Video Lets Attackers Go Free on Jan 22, 2014
Watch this: If you were a juror could you make a decision on what happened here? Eyewitness te...

Cruise Ship Surveillance Reviewed on Jan 21, 2014
Falling overboard to die alone in a dark cold sea is terrifying. Video analytics might solve this...

Delayed Egress Maglock Claims to Save Thousands on Jan 21, 2014
Deploying delayed egress right is tricky even when codes allow it, and making sure you meet all t...

Exacq Breaks Avigilon Integration on Jan 20, 2014
IPVM testing has verified that Exacq has broken integration with Avigilon cameras. Up until mid y...

Store Employee Explains How They Stole on Jan 20, 2014
In 2004, Lauren started work at a large CVS in a Washington, D.C. suburb. She says she really nee...


Level 3 are now hijacking failed DNS requests for ad revenue on 4.2.2.x | James's web home

$
0
0

Comments:"Level 3 are now hijacking failed DNS requests for ad revenue on 4.2.2.x | James's web home"

URL:http://james.bertelson.me/blog/2014/01/level-3-are-now-hijacking-failed-dns-requests-for-ad-revenue-on-4-2-2-x/


As I was getting ready to leave the office today, I started to google for a movie to go to with my wife tonight. I’d been testing sites in chrome and firefox all day, so without thinking I typed my search term into the firefox address bar. What I got back astounded me:

Yep. Instead of responding with NXDOMAIN as a good DNS resolver should, it redirected me to their ultra-spammy “search page.” I’m running debian, so the chances of there being a virus are pretty low, and some research confirmed my suspicions:

jbert@vps:~$ dig cinetopia
; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> cinetopia
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14427
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;cinetopia. IN A
;; ANSWER SECTION:
cinetopia. 10 IN A 198.105.254.11
;; Query time: 2 msec
;; SERVER: 4.2.2.3#53(4.2.2.3)
;; WHEN: Fri Jan 24 22:11:03 2014
;; MSG SIZE rcvd: 43
jbert@vps:~$ cat /etc/resolv.conf
nameserver 4.2.2.3

This has a few ramifications. First, I don’t blame them for wanting to monetize these servers. Everyone and their brother uses them for pings, DNS resolution, etc. — servers aren’t free and bandwidth isn’t free. So I get it. But, for one, I have no idea what else this page might or might not be doing. Is it setting third party tracking cookies? Tracking/bubbling my browser fingerprint? At the least it’s leaking, in clear text on the wire, things that I expected to be sent to an encypted DDG search. If there was sensitive search terms or information in that query, it just dropped into Level3′s logfiles. Additionally, I have a few scripts that rely on a nonexistent domain getting an NXDOMAIN response. They’ll now break.

So, be warned. One can no longer rely on 4.2.2.x DNS for RFC-compliant responses.

EDIT: On further testing, this does not appear to be happening from other locations. It’s also stopped happening from this VPS. It’s worth noting that this is not the first time I’ve noticed this, just the first time I’ve had the chance to grab some evidence and make a post about it.

Bookmark the permalink.

How Long Have I Got Left?

“We Just Can’t Have You Here” | WEEKEND

$
0
0

Comments:"“We Just Can’t Have You Here” | WEEKEND"

URL:http://yaledailynews.com/weekend/2014/01/24/we-just-cant-have-you-here/


“I’m Rachel,” I say to the man who is here to evaluate me, extending my hand, trying to put on my best sane face. Problem is, no one ever told me what that looks like.

He eyes me for a moment, then takes my hand.

I run him through the story, trying to emphasize my efforts to be honest and to get help.

I say, “So as soon as I cut, I texted my FroCo for support.”

“But you admit that you willfully harmed yourself?” he says, like he’s just won something.

“Well … yes.” Because obviously I admit it. I’m not a liar. If I were a liar, I would never have gotten myself into this mess. Fuck me for not being a liar.

And so, when I say “yes” to the ‘I admit cutting myself’ part, he nods his head and closes his eyes like someone has just given him a bonbon.

I tell him when I come back to Yale, I will get a therapist on campus and keep working with the one I have at home. I will stop cutting.

“Well the question may not be what will you do at Yale, but if you are returning to Yale. It may well be safer for you to go home. We’re not so concerned about your studies as we are your safety,” he says.

“I’m sorry,” I say. “What makes you think I will be safer away from school, away from my support system?” School was my stimulation, my passion and my reason for getting up in the morning.

“Well the truth is,” he says, “we don’t necessarily think you’ll be safer at home. But we just can’t have you here.”

* * *

On the night of Jan. 27, 2013, I slashed open my right thigh six times with a Swiss Army knife. I then spent four hours thinking about how good it would feel to jump off the fifth floor of Vanderbilt Hall. On Jan. 28, I put on a pretty dress and went to class. Before lunch, my cuts had stained it brown.

That night I texted my Freshman Counselor to tell her what had happened, just as I had done all the other times I felt suicidal and had cut myself. When I went to her suite, I showed her the gashes.

We went to Yale Health Urgent Care, at around 11:00 p.m., where a doctor bandaged my leg. A psychiatrist appeared. I told her that I had experienced suicidal thoughts the night before, but that the cuts had not been a suicide attempt. I told them that I was no longer suicidal.

At midnight, I was strapped to a stretcher under the ashen ceiling of an ambulance, on my way to Yale-New Haven Hospital. There I was taken to the locked ward of the ER — guarded by officers with guns — stripped of all my belongings, including my pants (they had a drawstring), and shunted into a cubicle containing nothing but a bed. I was here for my own good, they told me.

For 24 hours I had nothing to do but listen to the rattling gasping sound coming from the person two beds down, and to a schizophrenic person declare, every hour or so, that he had soiled himself. I was asked to recite the presidents of the United States, in reverse order, as part of a psychiatric evaluation. For more than a day I was not permitted to make a phone call. For more than a day no one had any idea where I was — not even my parents.

When a bed opened up in the actual Yale-New Haven Psychiatric Hospital, I was transported, again in an ambulance, and introduced to the place I would spend the next week of my life. Upon arrival, I was taken into a small room with two female staff members, forced to take off my underwear, spread my legs, then hop up and down to make sure nothing was hidden “up there.”

My Freshman Counselor had brought me some extra clothes and a course packet for my travel writing class, so that I would have something to read. The course packet was confiscated. Why? Because I might cut myself with the plastic binding — you know — the kind you get from Tyco. I might commit suicide with that, they said. “You’re a cutter,” they told me.

For a week, I was not allowed to set foot outside. I was not allowed to stretch my hamstrings or calves or any other body part. I was not allowed to pace my confines. I was not allowed to drink caffeine. I was not permitted to take ibuprofen for my caffeine withdrawal headache. I did not get to take a shower until my third day. Phone usage was restricted and phone calls were closely monitored. I was threatened, by a nurse, with the possibility of having my wrists and ankles tied to my bed, and witnessed this threat be carried out on others. Whoever built the hospital had termed this ward, “Liberty Village.”

There was little “treatment” in the hospital. Mostly, we watched television, played Pictionary and Connect Four and sat. I was interviewed by various clinicians a few times a day; I saw my assigned psychiatrist only three times, for half an hour or so, over the course of seven days. This limited treatment was fairly standard for all patients, but it soon became clear that it would have little effect on my situation.

The milieu counselors, nurses and doctors in Yale-New Haven Psychiatric Hospital have absolutely no input when it comes to deciding who gets to stay at Yale and who is forced to leave. In talking to the nurses, doctors and fellow Yale students I encountered in the hospital, I understood that job to belong to Dr. Eric Millman and to chief of Yale Psychiatry, Dr. Lorraine Siggins — two people who work for the University, rather than the hospital.

I have shared with you my memorable exchange with a senior psychiatrist at Yale Mental Health who came to evaluate me. It was this exchange that led me to keep an extensive and thorough journal during my time in the hospital.

But Dr. Siggins is the one who makes a ruling: Does Johnny stay at Yale or does he go? And in my talks, a consensus emerged: Dr. Siggins does not always — and by some accounts, rarely — make contact with the student in question. (A Yale senior who was in the hospital with me was not granted a meeting with Dr. Siggins but was still forced to leave Yale.) Neither the staff members I spoke with nor a fellow Yalie who had prior experience in the hospital knew of any Yale student admitted to the hospital who had been allowed to stay at Yale.

My interview left me terrified of the possibility of leaving school. I called my parents, and they promptly put themselves on Dr. Siggins’ radar, meeting with her twice and securing me a personal interview. All I remember was that my mind was totally blank when I spoke to her, because I was so focused on making her believe that I was “okay.” This, of course, is totally futile when you’re sitting on a cot in a mental hospital.

She called me three days later to tell me that I would have to go home. That meant that I was forced to formally withdraw from the college, with no guarantee of return. As soon as her decision came down, I was eligible for release into my parents’ custody. Upon my release from the hospital (also not a function of my recovery — but as a result of my expulsion from the College I was even more depressed when I left than when I was admitted, my Yale ID was confiscated, as was my room key. I was given one evening to pack up my entire life.

My college dean told me I was not even allowed to spend the night in my room in Vanderbilt Hall. I fell asleep on the futon in my suite’s common room at four a.m., breaking the rules, but exhausted and unable to continue putting my things in boxes, dismantling the reality of my college life. I had a chance to say goodbye to a few friends — most of whom I would not hear from during my time away. 18 hours after I walked out of the hospital doors, I was on a plane, headed back to North Carolina in a storm of tears.

I did what they said was necessary to be a candidate for readmission: therapy, more therapy, two college courses, more therapy. And I healed. Mostly.

I filled out the paper application for readmission: the usual demographic crap, a three-page personal statement, a transcript of my summer classes, two letters of recommendation, a profile from a therapist and a check for $50. I flew to New Haven for my three interviews — with the dean of my residential college, Dean Pamela George (chair of readmission) and Dr. Siggins.

As a side note, I might mention that Dr. Siggins was 45 minutes late to my interview. Dean George called me an hour before the scheduled time to cancel, forcing me to interview the following day, two hours before my return flight took off. I answered every question with as much positivity as I could sell. I said: I do not cut, I do not think of killing myself. I am great. Two weeks later, I was readmitted.

Every morning of my year away from Yale, I woke to the sight of the “Yale” pennant on my bedroom wall — the one they send to accepted freshmen in the big, glorious “Welcome to Yale” packet. “You’re in!” it says. “You’re a treasured asset to our University!” it says. “Come to Bulldog Days and feel the love because we love you and we care about you and we don’t want you to go to any other school because you’re the shit!” it says.

Thinking back to that welcome packet, there is a conspicuous omission: *We love you and want you and will provide for you and protect you, as long as you don’t get sick.*

* * *

I return to a different Yale, though it is I who have changed. After a year spent focusing solely on my health and well-being, I find myself, though not perfectly balanced, resting closer to my ideal center. And, after a year of watching and analyzing every one of my inner ticks, I see external things that were invisible to me before.

I see that Yale is a fundamentally unhealthy place in one important way. The problem is, everyone is “okay.” I have known friends who have suffered the deaths of siblings, who have been victims of sexual assault or who have fought life-threatening illness, all while navigating their sexuality, while taking five-and-a-half credits, while chairing more organizations and running to more meetings than they can keep track of. I have known friends to do all of this and still profess, at every opportunity, to be “okay,” “fine,” “great.”

To say something else, to be — in our own minds and in the minds of others — something else, is for some reason not acceptable at Yale. None of us are completely okay. But the pressure to conform to being perfectly functional and happy is a burden that we should neither want nor bear.

Where does it come from? For most students at Yale, I think the pressure is subconscious, upheld through day-to-day conversation: My classes are amazing. My extracurriculars are dope. My internship this summer is baller. Life is awesome. Are you awesome? No one wants to deviate.

But I think the source is not, in fact, the students. Those of us who have admitted, at some point or another, that we are legitimately not okay, have learned that there are real and devastating consequences of telling the truth. Because Yale does not want people who are not okay. Yale does not want people who are struggling, who are fighting. Yale, out of concern for its own image, wants them to leave. And Yale makes them.

With this, I refuse to be okay.

 

Official Blog: Today’s outage for several Google services

$
0
0

Comments:" Official Blog: Today’s outage for several Google services "

URL:http://googleblog.blogspot.com/2014/01/todays-outage-for-several-google.html


Earlier today, most Google users who use logged-in services like Gmail, Google+, Calendar and Documents found they were unable to access those services for approximately 25 minutes. For about 10 percent of users, the problem persisted for as much as 30 minutes longer. Whether the effect was brief or lasted the better part of an hour, please accept our apologies—we strive to make all of Google’s services available and fast for you, all the time, and we missed the mark today.

The issue has been resolved, and we’re now focused on correcting the bug that caused the outage, as well as putting more checks and monitors in place to ensure that this kind of problem doesn’t happen again. If you’re interested in the technical explanation for what occurred and how it was fixed, read on.

At 10:55 a.m. PST this morning, an internal system that generates configurations—essentially, information that tells other systems how to behave—encountered a software bug and generated an incorrect configuration. The incorrect configuration was sent to live services over the next 15 minutes, caused users’ requests for their data to be ignored, and those services, in turn, generated errors. Users began seeing these errors on affected services at 11:02 a.m., and at that time our internal monitoring alerted Google’s Site Reliability Team. Engineers were still debugging 12 minutes later when the same system, having automatically cleared the original error, generated a new correct configuration at 11:14 a.m. and began sending it; errors subsided rapidly starting at this time. By 11:30 a.m. the correct configuration was live everywhere and almost all users’ service was restored.

With services once again working normally, our work is now focused on (a) removing the source of failure that caused today’s outage, and (b) speeding up recovery when a problem does occur. We'll be taking the following steps in the next few days:
1. Correcting the bug in the configuration generator to prevent recurrence, and auditing all other critical configuration generation systems to ensure they do not contain a similar bug.
2. Adding additional input validation checks for configurations, so that a bad configuration generated in the future will not result in service disruption.
3. Adding additional targeted monitoring to more quickly detect and diagnose the cause of service failure.

Posted by Ben Treynor, VP Engineering

Robot Odyssey: The Hardest Computer Game of All Time

$
0
0

Comments:"Robot Odyssey: The Hardest Computer Game of All Time"

URL:http://www.slate.com/articles/technology/bitwise/2014/01/robot_odyssey_the_hardest_computer_game_of_all_time.html


Odysseus had it easy next to this.The Learning Company

My first computer was an Apple IIe with 128KB of RAM, no hard drive, and a 5¼ inch floppy drive. One of the top educational games back then was Rocky’s Boots, an inventive game that taught the basics of formal logic to kids. I loved it when I was 6. Two years later, I got Robot Odyssey, which promised to expand on Rocky’s Boots by extending the formal logic to actual programming. The game devastated me. My brain could not comprehend how to solve its puzzles. I finally finished it—13 years later, and not without some assistance.

Let me say: Any kid who completes this game while still a kid (I know only one, who also is one of the smartest programmers I’ve ever met) is guaranteed a career as a software engineer. Hell, any adult who can complete this game should go into engineering. Robot Odyssey is the hardest damn “educational” game ever made. It is also a stunning technical achievement, and one of the most innovative games of the Apple IIe era.

Visionary, absurdly difficult games such as this gain cult followings. It is the game I remember most from my childhood. It is the game I love (and despise) the most, because it was the hardest, the most complex, the most challenging. The world it presented was like being exposed to Plato’s forms, a secret, nonphysical realm of pure ideas and logic. The challenge of the game—and it was one serious challenge—was to understand that other world. Programmer Thomas Foote had just started college when he picked up the game: “I swore to myself,” he told me, “that as God is my witness, I would finish this game before I finished college. I managed to do it, but just barely.”

Programming in your pajamas: the simulation.Illustration by Gil Morales, from the game manual

In Robot Odyssey, you played a character who falls in a dream into the mysterious city of Robotropolis. There were five ascending levels to Robotropolis before you could return back home. Here’s a rough estimate of their difficulty:

The Sewer: Moderate The Subway: Challenging The Town: Very Difficult The Master Control Center: Impossible The Skyways: Impossible
Robotropolis as rendered by Gil Morales.Illustration by Gil Morales, from the game manual

By my teenage years I’d completed the first three levels, but my siblings and I hit a brick wall with the fourth level, which is to earlier levels like algebra is to arithmetic. (As Thomas Foote said, “I was stuck on this level for most of my college years.”) The fifth level was nothing more than a fabled dream. The Internet didn’t exist in those days, and even finding someone else who had played the game was difficult if you didn’t live in Silicon Valley.

The game became my bête noire, a lingering reminder of my inadequacy. To give you some idea, I couldn’t get past the fourth level even after I’d been programming in BASIC and Pascal for years.

The game had a profound effect on those who played it. My younger brother, who suffered with my sister and me as we struggled through the game, told me, “It’s where I started on the road to becoming a programmer.” Even if players got stuck (and everyone got stuck), the game offered ideas and concepts that no other game did. Game designer and hardware hacker Quinn Dunki of One Girl, One Laptop wrote Gate, a spiritual successor to Robot Odyssey that employed many of the same concepts. The tech law professor James Grimmelmann told me it had been his “game for a rainy decade,” describing an immense sense of accomplishment on finishing one of the nastier puzzles—“a big part of why I loved programming.” Programmer/musician/hackerJoan Touzet used it to teach programming to middle schoolers—in 2004. Thomas Foote was so taken with the game that he spent years re-implementing the entire game in Java, with the support of a small but dedicated fan community. (One of them remembers completing the game and getting a certificate from the Learning Company declaring him the 34th person to finish.) Foote called his version DroidQuest, and it is the easiest way to play Robot Odyssey today.

Software engineer Micah Elizabeth Scott, who ported the game to the Nintendo DS, told me that Robot Odyssey“played a large role in shaping who I'd later become,” and emphasized just how personal and distinctive a creation it was: “You see the style of an individual or a very small team, uncluttered by corporate structure or modern abstractions.”

It’s a testament to the sheer free-spiritedness of the early days of consumer software that such a game could even get made. The Learning Company, who also made classics like Rocky’s Boots, Reader Rabbit, and Gertrude’s Puzzles, was a small company founded in 1980 on an NSF grant by four educators who had taken an interest in software: Leslie Grimm, Frona Kahn, Ann McCormick, and Teri Perl, as well as Warren Robinett (who had created the world’s first Easter egg when he hid his name in a secret room in Atari’s Adventure). The company was atypical both in focusing on educational software and in being led by women. Grimm and Robinett designed 1982’s Rocky’s Boots, which taught Boolean logic gates to kids, and which had captivated my 6-year-old self. Grimm also co-authored Robot Odyssey, which began as the brainchild of Michael Wallace, a 22-year-old Stanford undergrad at the time.

The game taunts you.The Learning Company

Wallace told me that writing the game was one of the best times of his life. Originally a customer service rep at the Learning Company, Wallace taught himself to code in Apple 6502 assembly by looking at Robinett’s code for Rocky’s Boots. After Robinett left the company, Wallace expanded Robinett’s code to architect the underlying technology for Robot Odyssey, including the dazzling ability to embed circuits within circuits. Doing this was no easy task; Wallace called it “an art form” and recounted working 100 hours a week. When Teri Perl described the project to legendary computer scientist Alan Kay, he said, “You’re wasting your time. It can’t be done.” That is, the basic idea was simply too complex to run on an Apple home computer. When Robot Odyssey shipped, the company gave Wallace a plaque that said, “It can’t be done. —Alan Kay.”

After getting her Ph.D. in biology from Stanford, Leslie Grimm became fascinated by computers and their educational potential while volunteering in her daughter’s school. In addition to directing the entire project, Grimm was in charge of the game portion of Robot Odyssey: the five levels of Robotropolis and three tutorials (expanded to five tutorials in Version 1.1, in the hopes of making the game a bit more tractable to players). Each of the five game levels was the personal creation of a single person. I’d like to single out Shaun Gordon, the 16-year-old high school whiz who designed the diabolical fourth level, the Master Control Center, which was the Waterloo for many a player (including myself).

Wallace was kept so busy with the plumbing of the game that he himself never played it through to completion. I asked him if he might try someday, and he said, “It might take a year of my life.” He wasn’t sure that anyone at the Learning Company had solved the entire game singlehandedly!

To solve the puzzles, you are given three (eventually four) robot pals to wire and program. From left to right, they are Sparky, Scanner, and Checkers. They can move, detect walls, pick up and drop things, and communicate to one another.

Sparky, Scanner, and Checkers: they are yours to command (and scream at).The Learning Company

When I say program, I mean something a bit more primitive than computer code, even the low-level assembly that processing chips natively run. I mean the actual logic gates (AND, OR, NOT) that make up the innards of chips. So Robot Odyssey was programming, but it was also electrical engineering. Your tools for implementing “programs” were the most primitive available. You had “electricity” going through wires into gates. The gates implemented the primitive operations of formal Boolean logic.

Simple, right?The Learning Company

Boolean logic is fairly simple. It deals in two opposing values, often called TRUE and FALSE (if logic is being applied to assertions), but since we’re talking about electricity here, they’re better called ON and OFF. The robots in the game have thrusters that make them move. For example, if you feed electricity into a robot’s thruster through a wire that is ON, the thruster turns ON and the robot moves.1 In addition, there are assorted logic gates that change the nature of the electricity. A NOT gate had one wire going in and one wire coming out, and inverted the input wire. If the incoming wire was ON and had electricity going through it, the gate would not output electricity. If the incoming wire was OFF, the gate would output electricity.2

A “wall hugger” robot. The actual logic is embedded “inside” the blue "2" chip.The Learning Company

Using these gates and a few others, you had to wire up robots to perform tasks—reasonably simple ones at first,3 but which became increasingly complicated as the game progressed.

Eric Welsh’s circuit that “plays” a 100110 pattern on the antenna.The Learning Company

When the task is to get one robot to communicate orders to move to another robot through an antenna that can only be ON or OFF, those logic gates start to seem awfully limited in their capabilities. The trick is, they aren’t limited—in sufficient combination, those little logic gates can do anything. But it takes some real thought.

Getting these simple gates to execute complex programs melted my brain. My child’s mind was literally incapable of making the jump from those simple gates to the complex control structures required to solve the game’s puzzles. The game offered you the ability to “burn” circuits into chips in order to abstract control structures. Here’s a chip that uses a lot of OR gates in order to ... well, I won’t get into it (see here for the grisly details).

Inside a chip: Fun for the whole family!The Learning Company

The point being that those simple logic gates could, in sufficient combination and organization, do tremendously complicated things. That, after all, is the very stuff of computer programming, using primitive operations in immensely complex architectures. For Foote, the fundamental appeal of the game is much the same as the fundamental appeal of mathematics and computer science: “The world is logical, and operates under simple rules. From such simplicity can come great complexity.”

Though a planned sequel (the original box billed the game as Robot Odyssey I) never materialized, the game won awards and a write-up in Scientific American. The game got Wallace an audience with the top brass at Apple and a presentation at Xerox PARC, and he went on to design electronic toys including the Nintendo Power Glove and now has his own company, Pure Imagination. Grimm stayed with the Learning Company and authored many more games, including the successful Reader Rabbit franchise, and more recently developed educational software for deaf children. The sheer complexity of Robot Odyssey made it the spiritual forebear to today’s sandbox games like Minecraft. It probably turned hundreds of people into computer programmers, and in the hopes of making a few more, I issue the Bitwise Robot Odyssey Challenge: The first reader to complete Robot Odyssey—send a save game file to me as proof— gets a replica of the Robot Odyssey completion certificate from the Learning Company. Only first-time players allowed—and no cheating by looking up the solutions!

1. If you stop the electricity flowing through the wire, the thruster turns OFF and the robot stops moving. (Return.)

2. An AND gate takes two inputs and outputs electricity if its two inputs are both on. An OR gate outputs electricity if either or both of its two inputs are on. An XOR gate (for exclusive-or) outputs electricity if either of its two inputs are on, but not both. (Return.)

3. Here’s a simple example. Let’s say you want a robot to move up when its antenna is receiving a signal (when the antenna is ON), and move down when the antenna is not receiving a signal (when the antenna is OFF). You wire up the antenna output to the UP thruster so that when the antenna is ON, the UP thruster turns on, and vice versa. You also wire up the antenna output to the DOWN thruster, but put it through a NOT gate first, which reverses the antenna output. So when the antenna is ON, the DOWN thruster is OFF, and vice versa. (Return.)

Viewing all 9433 articles
Browse latest View live