Hacker Newsnew | past | comments | ask | show | jobs | submit | mb0's commentslogin

"i'm seeing two (obvious) bigger picture trends here that this story reinforces.

1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin )"

Unfortunately, your thumb print can be replicated and used. Check out this news story - police actually 3d printed a murder victim's finger to unlock their phone - http://www.theverge.com/2016/7/21/12247370/police-fingerprin...


I've heard that people with hyperhydrosis have a lot of trouble with biometrics devices as well as smart phones. If your skin is too moist it just kinda gums up the works.


I have a lot of problems with touch screens. Some screens refuse to register my touch, and other screens register my touch before I even make contact with the screen. If you turn on developer tools in android and look at the "touches", you can see them registering all over if I have my fingers a cm or so above the screen.

I have really moist skin, so I wouldn't be surprised if this was the issue. I had a fingerprint reader on my gen 1 Motorola Atrix and that worked just fine though. I think the company that built that authentication system was purchased by Apple and used in the iPhones. I wonder if his wife would have the same issues with his phone, it might be that his fingerprint scanner is less sensitive.


Makes sense, my biggest annoyance with the fingerprint reader is that it doesn't work reliably if your finger is at all wet (like while cooking).


I think you're being a bit over-dramatic with the "wretched hive of scum and villany" stuff. The commonality of this sort of behavior varies from forum to forum, depending on the mood of that forum. For instance, this sort of thing was not abnormal at all during the hey-day of Something Awful (One of the largest forums around some years ago, still #5 in membership numbers).

As far as the editing Spez did, if they were really out there calling him a pedophile, they should have expected some backlash. You can only push an authority figure so far before they're going to go on the defensive. This will definitely make things worse though.


Of course I'm being a bit dramatic. But it's pretty bad.

I didn't know that was so common on SA. I knew the site was heavily-moderated, despite The Goons' famous repuation. But it's still terrible there, too.


What if you crafted a program that mimicked the functionality of an ntp server, and but it had a built in memory of what times have been given out to network clients? Couldn't you in theory send a series of NTP answers that quickly stepped back the clock of the target system, with the stepback value being whatever the maximum value the ntp client will handle? Answer one subtracts the time by 24 hours, the next by another 24 hours, the next by 24 hours? Is there a limit to how frequently the time can be stepped back?


Finally! Seagate has been dropping the ball on drive stability for a long time now, and the failure rates on these 3TB disks is completely unacceptable. Additionally, seagate's own RMA department has been failing terribly, with a lot of their "recertified" disks being returned to customers with serious conflicts, ranging from a high number of uncorrectable sectors to logic board problems that completely cripple systems they are installed in.

Nasdaq:STX is down 1.80 points (5.92%) right now. It was down around 6.76% about an hour ago. I hope, for the sake of their shareholders & customers, that seagate gets it together.


Shodan itself shows that all instances of this database are located in China, and there are 390 instances of it. Top organizations are:

China Telecom Yunnan 83 China Telecom xinjiang 80 China Telecom 60 China Unicom Shandong 11 China Telecom Chongqing 10

Connecting to one instance in particular, 183.221.158.220:

> show dbs; DrugSupervise 0.125GB local 0.03125GB > use DrugSupervise switched to db DrugSupervise > show collections DrugSupervise.Entity.Models.DictList.DictCodeList DrugSupervise.Entity.Models.DictList.DictCodeTypeList DrugSupervise.Entity.Models.DictRegion.DictRegionList DrugSupervise.Entity.Models.EntPartner.EntPartnerList DrugSupervise.Entity.Models.PhysicsName.PhysicNameList DrugSupervise.Entity.Models.RIOS.InOutStoreD`1[DrugSupervise.Entity.Models.PI.PurchaseInStore] DrugSupervise.Entity.Models.RIOS.InOutStoreD`1[DrugSupervise.Entity.Models.RG.GetDrugOutStore] system.indexes

Looking at the DrugSupervise.Entity.Models.PhysicsName.PhysicNameList collection, see a bunch of stuff like this:

{ "_id" : BinData(3,"s6CfpmQtDkG5Nh3lqDGOQQ=="), "physicName" : "磷酸可待因注射液", "physicInfo" : "磷酸可待因注射液 注射剂 15mg" } { "_id" : BinData(3,"3Aa7ZwXzy0ax2KRCFRhsSg=="), "physicName" : "硫酸吗啡口服溶液", "physicInfo" : "硫酸吗啡口服溶液 口服液 10ml:30mg" } { "_id" : BinData(3,"t9+GHfNq10eqqi2EaqhQKA=="), "physicName" : "枸橼酸舒芬太尼注射液", "physicInfo" : "枸橼酸舒芬太尼注射液 注射剂 2ml:100vg(以舒芬太尼计)" } { "_id" : BinData(3,"bFLxr6tN0kO8vso+BTjB5w=="), "physicName" : "硫酸吗啡片", "physicInfo" : "硫酸吗啡片 片剂 20mg" } { "_id" : BinData(3,"5FGsZIWsPE6L+UQSTEfVag=="), "physicName" : "盐酸吗啡片", "physicInfo" : "盐酸吗啡片 片剂 30mg" }

I have no idea what this is, but it looks like some kind of registry of prescriptions.


Yes. Both NTP and DNS operate over UDP. UDP is a connectionless protocol, which means no connection handshake needs to be made in order for a data to be delivered to a target IP address. What generally happens is, one attacker will send many requests to a many DNS and or NTP servers whilst spoofing their IP address to make it appear as if their victim is sending all of these requests. No connection handshake happens to verify that the victim is actually making these requests. So, every server that the attacker sent this request to will send the much-larger answer back to the victim. If DNS were to only operate over TCP (which uses a connection handshake), the internet would be much slower, because connection handshakes can take a while.

However, this isn't what happened on Monday. It seems like one attacker with a lot of systems used those systems to query someone's domain name whilst spoofing many IP addresses at once. This in turn overwhelmed many of the root servers, and possibly several authoritive DNS servers in the process. Sounds like a botnet owner was showing off how much power they have.


find / -type f -iname 'ASTERISKsublimeASTERISK' | grep -i settings | grep -v backup


hostname -i on cb.vu says the IP address is 78.31.70.238, but if you ping a host from the interface, the pings originate from 178.33.34.4 (according to tcpdump).


I love the "why not try this" attitude of your comment.

Is this due to an LB fronting?


On this system hostname -i says 127.0.1.1, despite this address not being set on any of my interfaces (lo0 is 127.0.0.1).


It looks like hostname -i is getting its value from /etc/hosts. hostname --all-ip-addresses returns the correct result.


ip route get 8.8.8.8 | head -1 | cut -d' ' -f8


Did you experience major depression prior to taking the drug, or have you talked to any major depressive people who also tried the drug? Have you experienced any negative side effects from the drug, or talked to anyone who experienced negative side effects? I am pretty cautious about trying new drugs, as some currently legal drugs can carry dangerous side effects (ie: viibryd causing brain shocks in active patients).


Note that a similar question was asked in the thread I linked:

https://news.ycombinator.com/item?id=9880661

Not that it would hurt to discuss it further here.


No major depression, just work related burn out and the ordeal of coming of age during the Bush administration.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: