Loud

"Like many other antidepressants, Prozac increases the brain’s supply of serotonin, a..."

2008-07-07T05:43:58-05:00

“

Like many other antidepressants, Prozac increases the brain’s supply of serotonin, a neurotransmitter. The drug’s effectiveness inspired an elegant theory, known as the chemical hypothesis: Sadness is simply a lack of chemical happiness. The little blue pills cheer us up because they give the brain what it has been missing.

There’s only one problem with this theory of depression: it’s almost certainly wrong, or at the very least woefully incomplete. Experiments have since shown that lowering people’s serotonin levels does not make them depressed, nor does it does not make them depressed, nor does it worsen their symptoms if they are already depressed.

”

- How Prozac sent the science of depression in the wrong direction - The Boston Globe

"Here’s a true story about how awesome Pixar is."

2008-07-07T05:10:16-05:00

“Here’s a true story about how awesome Pixar is.”

- Wow-e: Malthusian Fear Mongering Can Be Annoying | MetaFilter

Against Method

2008-07-06T09:02:47-05:00

It strikes me that Chris Anderson is the Paul Feyerabend of the web age.

That may be giving Mr. Anderson too much credit but I’m a generous soul that way.

"The approach that I have been using (and many of you are probably very aware of this!) is to use my..."

2008-07-05T08:26:46-05:00

“The approach that I have been using (and many of you are probably very aware of this!) is to use my online social network using tools such as my blog, Twitter, LinkedIn, and FaceBook. I have been pleasantly surprised by how successful this has been - on a number of levels.”

- disambiguity - » Guerrilla Research - Recruitment

"When Microsoft rolled out IE7, it did so only in newer generation operating systems, such as Windows..."

2008-07-05T07:41:55-05:00

“When Microsoft rolled out IE7, it did so only in newer generation operating systems, such as Windows XP and Vista. This left a large contingent of users of IE6 on Windows 2000, which is still in fairly wide use. The company also didn’t post recommendations for W2K users to switch to a different browser, such as Firefox or Opera. Both actions served to leave a bloc of orphaned IE6 users, many of whom are still haunting our web sites.”

- Phasing Out IE6 | Painting the Web

"Wonder why you see pros doing workshops, endorsing products, doing video training or inspirational..."

2008-07-04T09:39:55-05:00

“Wonder why you see pros doing workshops, endorsing products, doing video training or inspirational DVDs, and other things that aren’t “selling photos”? Well, that’s because “selling photos” is a lot harder than it used to be, doesn’t pay the bills as well as it used to, and is highly subject to fluctuations in the economy. They’re looking for other ways to provide steady income so that they can do what they enjoy. The sale of photos is becoming less their primary business and more secondary.”

- Becoming a better Photographer by Thom Hogan

Digital Web Magazine - Portable Social Networks, The Building Blocks Of A Social Web

2008-07-04T07:53:35-05:00

Digital Web Magazine - Portable Social Networks, The Building Blocks Of A Social Web

Garden Party (via baldurbjarnason)

2008-07-04T06:31:16-05:00

Garden Party (via baldurbjarnason)

Understanding the Web browser threat by Stefan Frei

2008-07-03T08:59:32-05:00

Understanding the Web browser threat by Stefan Frei:

It is noteworthy that it has taken 19 months since the initial general availability of IE7 (public release October 2006) to reach 52.5% proliferation amongst users that navigate the Internet with Microsoft’s Web browser. Meanwhile, 92.2% of Firefox users have migrated to FF2.

Regarding my earlier post on IE’s XSS filter.

The point deserves to be repeated: Security improvements, while positive in their own right, are largely meaningless unless they are deployed. The situation with online security today is identical to that of the various dangerous and widespread childhood diseases prior to mandatory vaccinations.

We need herd immunity for the browser populace.

Nothing less will do.

Shneiderman's Eight Golden Rules of Interface Design

2008-07-03T08:39:05-05:00

Shneiderman's Eight Golden Rules of Interface Design

two kinds of training (3 July, 2008, Interconnected)

2008-07-03T08:37:52-05:00

two kinds of training (3 July, 2008, Interconnected)

"Again, I am so disappointed. For all the argument-Olympics of hairsplitting over rights, it all..."

2008-07-03T08:21:27-05:00

“Again, I am so disappointed. For all the argument-Olympics of hairsplitting over rights, it all comes down to power, to might-makes-right. Boing Boing is not notable for extending charity and understanding to those they accuse of having committed ethical transgressions against openness and transparency. Being A-list means being able to set the terms of discussion (to a good approximation). Nothing more for me to say here, it wouldn’t do any good.”

- Infothought: Boing Boing / Violet Blue notes

"[The XSSFilter in IE8.0 is] not perfect, don’t get me wrong, but it’s a huge leap forward in the..."

2008-07-03T06:54:22-05:00

“[The XSSFilter in IE8.0 is] not perfect, don’t get me wrong, but it’s a huge leap forward in the right direction”

- ha.ckers.org web application security lab - Archive » XSSFilter Released

IEBlog : IE8 Security Part IV: The XSS Filter

2008-07-03T06:43:00-05:00

IEBlog : IE8 Security Part IV: The XSS Filter:

It is important here, as a web-thingy person watsit, to understand what Microsoft will and will not try with this XSS filter:

It’s a whitelist which can be evaded with a moderate amount of work.
It targets the common and basic XSS vectors.
It is part of a much larger and ongoing work all of the browser vendors have been doing to try to close off the common attack vectors.

The key takeaway here is that most of these measures are, for the most part, script-kiddie countermeasures. They close of the easy copy-paste-able vectors that a moron in his mother’s basement can plug into without much knowledge or expertise.

The real criminals here, the ones who do mass deployment and build adaptive, learning attacks are well funded by criminal organisations and have knowledge and experience that rivals the best in the computer security business:

They don’t write viruses any more. They write code that auto-generates mutating viruses with variable behaviour to counter signature detection and complicate heuristic detection.
They deploy faster than anybody else. Faster than browser auto-updates. Faster than OS updates. Faster than the antivirus programs update.

Countering professional criminals is never easy, in any business. Microsoft’s updates are a good start and they’ve come a long, long way, but since they can’t even get a substantial portion of their IE 6 users to upgrade even to version 7, their efforts are largely pointless.

Every single browser on the planet should have something similar to Firefox’s auto-update system. The browser vendors need to have an deployment story that matches that of the professional criminals in speed and effectiveness. Once that happens, the game is ours to win.

"And there I started smiling: you realize, guys, that those listed “on sites like XSSed.com” are not..."

2008-07-03T06:09:57-05:00

“

And there I started smiling: you realize, guys, that those listed “on sites like XSSed.com” are not “XSS vulnerabilities” which will “stop working in IE8″, but just minimal exploit test cases —

Anyway, such a feature being deployed as a built in of a popular browser, rather than as an add-on for an awesome browser, will likely keep script kiddies busy a while, maybe taking a filter evasion crash course. I just hope it won’t give some site owners an alibi not to fix their bugs, though, putting a “This site is best viewed with IE8” badge near to their McAfee’s Hackersafe logo.

”

- hackademix.net » NoScript’s Anti-XSS Filters Partially Ported to IE8

Garden Party (via baldurbjarnason)

2008-07-02T10:50:28-05:00

Garden Party (via baldurbjarnason)

2008-07-02T10:49:42-05:00

Garden Party (via baldurbjarnason)

"The techniques used by the modern cyber-criminal are truly scary. They’re backed by mafia,..."

2008-07-02T10:46:49-05:00

“The techniques used by the modern cyber-criminal are truly scary. They’re backed by mafia, supported by nation states, and often even carried out by, or in conjunction with, rogue insiders. We are dealing with polymorphic malware, 100,000-computer strong botnets, drive-by-downloads, rootkits with anti-forensic capabilities conducted by adversaries who fear no U.S. law. The bad guys make certain their newest tricks are packed, encrypted, and undetectable by the most popular security products. We are long past the era of stereotypical sleep deprived teenage hackers hell bent on the “information wants to be free” philosophy, practicing a dark art.”

- Industry View: Web Application Security Today - Are We All Insane?

"While web application security was clearly recognized as a big problem several years ago, many..."

2008-07-02T10:45:01-05:00

“While web application security was clearly recognized as a big problem several years ago, many organizations were slow to act. Now Web application exposure has reached the crisis stage because criminals have taken notice and made Web applications their primary target. There’s an old proverb that explains how to determine whether or not someone is sane. An individual is shown a river flowing into a pond. He is given a bucket and asked to drain the pond. If he walks to the stream to dam the inflow into the pond he will be considered sane. If he decides to empty the pond with his bucket without first stopping the inflow then he would be considered insane. This is analogous to today’s approach to software security, and specifically Web application security.”

- Industry View: Web Application Security Today - Are We All Insane? - CSO Online - Security and Risk

Garden Party (via baldurbjarnason)

2008-07-02T06:12:33-05:00

Garden Party (via baldurbjarnason)