I'm a char salesmen. I share things about; Programming, SysOps, Civil Rights, education, and things that make me happy. And robots.
936 stories
·
14 followers

Cassini Through the Gap

2 Shares

Sometimes it pays to step back and try to look at spaceflight with fresh eyes. Go out and find Saturn in the sky and consider it as the ancients did, a moving celestial ember. And as you stand there, realize all over again that we’ve built a spacecraft that has been operating around that world since 2004, feeding us a datastream as its path was tweaked to look at interesting targets. The sheer magnitude of this accomplishment — Cassini is now operating between the planet and its rings! — is cause for celebration even as the mission’s end approaches.

40_CGF_STILL_00022_1600

Image: Artist’s concept of Cassini diving between Saturn and its innermost ring. Credit: NASA/JPL-Caltech/Space Science Institute.

Today’s good news is that controllers have reacquired Cassini’s signals following its plunge through the ring/planet gap on April 26, a time during which its 4-meter high-gain antenna was re-oriented to serve as an ad hoc shield against whatever dust grains or particles might be in its path. Critical maneuvers like these always produce nail-biting moments, and the spacecraft was out of contact during the entire ring-plane crossing, which occurred at 0900 UTC on the 26th, followed by renewed contact with Earth some 22 hours later.

cassini1

Image: This unprocessed image and the two that follow show features in Saturn’s atmosphere from closer than ever before. These views were captured by NASA’s Cassini spacecraft during its first Grand Finale dive past the planet on April 26, 2017. Credit: NASA/JPL-Caltech/Space Science Institute.

The next dive is scheduled for May 2 in this ‘Grand Finale’ stage of the mission, during which Cassini will make a total of 22 dives, but this first one was obviously crucial in that we have a healthy spacecraft and will obviously learn more about spacecraft protection on future ring-plane crossings. As to that gap between the tenuous upper atmosphere of Saturn and the rings, it’s about 2000 kilometers. With Cassini moving through this area at roughly 34 kilometers per second relative to the planet, any small collisions could knock the craft out of commission.

cassini2

But Cassini made it through. Earl Maize is Cassini project manager at JPL:

“No spacecraft has ever been this close to Saturn before. We could only rely on predictions, based on our experience with Saturn’s other rings, of what we thought this gap between the rings and Saturn would be like. I am delighted to report that Cassini shot through the gap just as we planned and has come out the other side in excellent shape.”

Science and engineering data are now being beamed back to Earth after acquisition of the Cassini signal at the Deep Space Network’s Goldstone Complex in California at 0656 UTC on April 27, with the data flow commencing minutes later. The ring-plane plunge took the spacecraft within 3000 kilometers of the cloud tops, an area where the air pressure is 1 bar, comparable to the atmospheric pressure of Earth at sea level. According to this JPL news release, Cassini also came within 300 kilometers of the innermost visible edge of the rings.

cassini3

This is a good time to monitor the Cassini raw image gallery. During these ring-plane dives, Cassini will gather data about Saturn’s gravity and magnetic fields, helping us gain a better understanding of the planet’s internal structure. We’ll begin to get our closest ever imagery of the rings and atmospheric clouds even as the spacecraft’s particle detectors sample ring particles being drawn into the atmosphere. And at the end, when Cassini makes its plunge into Saturn itself, we’ll gain measurements of the atmosphere until contact is lost.

We’ve had 13 years at Saturn, and if you wonder why we can’t just keep them going, the fact is that the spacecraft is running out of the fuel needed to adjust its course. Eventually, we’d lose the ability to keep Cassini away from interesting astrobiological targets like Enceladus and Titan, with the subsequent danger of contamination. The Grand Finale maneuvers seek to draw maximum information out of Cassini’s final days before a spectacular finish.

tzf_img_post

Read the whole story
reconbot
4 hours ago
reply
New York City
satadru
23 hours ago
reply
New York, NY
Share this story
Delete

The future of ad blocking

1 Share

There’s an ongoing arms race between ad blockers and websites — more and more sites either try to sneak their ads through or force users to disable ad blockers. Most previous discussions have assumed that this is a cat-and-mouse game that will escalate indefinitely. But in a new paper, accompanied by proof-of-concept code, we challenge this claim. We believe that due to the architecture of web browsers, there’s an inherent asymmetry that favors users and ad blockers. We have devised and prototyped several ad blocking techniques that work radically differently from current ones. We don’t claim to have created an undefeatable ad blocker, but we identify an evolving combination of technical and legal factors that will determine the “end game” of the arms race.

Our project began last summer when Facebook announced that it had made ads look just like regular posts, and hence impossible to block. Indeed, Adblock Plus and other mainstream ad blockers have been ineffective on Facebook ever since. But Facebook’s human users have to be able to tell ads apart because of laws against misleading advertising. So we built a tool that detects Facebook ads the same way a human would, deliberately ignoring hidden HTML markup that can be obfuscated. (Adblock Plus, on the other hand, is designed to be able to examine only the markup of web pages and not the content.) Our Chrome extension has several thousand users and continues to be effective.

We’ve built on this early success. Laws against misleading advertising apply not just on Facebook, but everywhere on the web. Due to these laws and in response to public-relations pressure, the online ad industry has developed robust self-regulation that standardizes the disclosure of ads across the web. Once again, ad blockers can exploit this, and that’s what our perceptual ad blocker does. [1]

The second prong of an ad blocking strategy is to deal with websites that try to detect (and in turn block) ad blockers. To do this, we introduce the idea of stealth. The only way that a script on a web page can “see” what’s drawn on the screen is to ask the user’s browser to describe it. But ad blocking extensions can control the browser! Not perfectly, but well enough to get the browser to convincingly lie to the web page script about the very existence of the ad blocker. Our proof-of-concept stealthy ad blocker successfully blocked ads and hid its existence on all 50 websites we looked at that are known to deploy anti-adblocking scripts. Finally, we have also investigated ways to detect and block the ad blocking detection scripts themselves. We found that this is feasible but cumbersome; at any rate, it is unnecessary as long as stealthy ad blocking is successful.

The details of all these techniques get extremely messy, and we encourage the interested reader to check out the paper. While some of the details may change, we’re confident of our long-term assessment. That’s because our techniques are all based on sound computer security principles and because we’ve devised a state diagram that describes the possible actions of websites and ad blockers, bringing much-needed clarity to the analysis and helping ensure that there won’t be completely new techniques coming out of left field in the future.

There’s a final wrinkle: the publishing and advertising industries have put forth a number of creative reasons to argue that ad blockers violate the law, and indeed Adblock Plus has been sued several times (without success so far). We carefully analyzed four bodies of law that may support such legal claims, and conclude that the law does not stand in the way of deploying sophisticated ad blocking techniques. [2] That said, we acknowledge that the ethics of ad blocking are far from clear cut. Our research is about what can be done and not what should be done; we look forward to participating in the ethical debate.

 

[1] To avoid taking sides on the ethics of ad blocking, we have deliberately stopped short of making our proof-of-concept tool fully functional — it is configured to detect ads but not actually block them.

[2] One of the authors is cyberlaw expert Jonathan Mayer.

Read the whole story
reconbot
1 day ago
reply
New York City
Share this story
Delete

Analyzing Cyber Insurance Policies

2 Shares

There's a really interesting new paper analyzing over 100 different cyber insurance policies. From the abstract:

In this research paper, we seek to answer fundamental questions concerning the current state of the cyber insurance market. Specifically, by collecting over 100 full insurance policies, we examine the composition and variation across three primary components: The coverage and exclusions of first and third party losses which define what is and is not covered; The security application questionnaires which are used to help assess an applicant's security posture; and the rate schedules which define the algorithms used to compute premiums.

Overall, our research shows a much greater consistency among loss coverage and exclusions of insurance policies than is often assumed. For example, after examining only 5 policies, all coverage topics were identified, while it took only 13 policies to capture all exclusion topics. However, while each policy may include commonly covered losses or exclusions, there was often additional language further describing exceptions, conditions, or limits to the coverage. The application questionnaires provide insights into the security technologies and management practices that are (and are not) examined by carriers. For example, our analysis identified four main topic areas: Organizational, Technical, Policies and Procedures, and Legal and Compliance. Despite these sometimes lengthy questionnaires, however, there still appeared to be relevant gaps. For instance, information about the security posture of third-party service and supply chain providers and are notoriously difficult to assess properly (despite numerous breaches occurring from such compromise).

In regard to the rate schedules, we found a surprising variation in the sophistication of the equations and metrics used to price premiums. Many policies examined used a very simple, flat rate pricing (based simply on expected loss), while others incorporated more parameters such as the firm's asset value (or firm revenue), or standard insurance metrics (e.g. limits, retention, coinsurance), and industry type. More sophisticated policies also included information specific information security controls and practices as collected from the security questionnaires. By examining these components of insurance contracts, we hope to provide the first-ever insights into how insurance carriers understand and price cyber risks.

Read the whole story
reconbot
1 day ago
reply
New York City
Share this story
Delete

Interactive Show Preview: Red Rider

1 Share

Time has been flying and we’ve been frantically getting ready for the The Interactive Show. It’s just 17 days away! Here’s a preview of “Red Rider” by Ranjit Bhatnagar and Colleen AF Venable.

-1

Red Rider

A modern take on Little Red Riding Hood with a NYC twist. The story is told in six voices, each giving their version of what happened—including Red Rider (the fastest bike messenger in the city), the now-vegan Wolf, the Lumberjock (who always gives 110%), three very bizarre little pigs, and a maybe-not-so-sweet-and-innocent Grandma. Find the six listening stations and see if you can you figure out what happened to the Wolf.

Tickets are just $15 in advance, and the libations are on us. Get your tickets now!

There’s still time to submit a project before the May 1st deadline, contact us!

Read the whole story
reconbot
1 day ago
reply
New York City
Share this story
Delete

Questions for the FBI on Encryption Mandates

2 Shares

I wrote on Monday about how to analyze a proposal to mandate access to encrypted data. FBI Director James Comey, at the University of Texas last week, talked about encryption policy and his hope that some kind of exceptional access for law enforcement will become available. (Here’s a video.)  Let’s look at what Director Comey said about how a mandate might work.

Here is an extended quote from Director Comey’s answer to an audience question (starting at 51:02 in the video, emphasis added):

The technical thing, look, I really do think we haven’t given this the shot it deserves. President Obama commissioned some work at the end of his Administration because he’d heard a lot from people on device encryption, [that] it’s too hard.  [No], it’s not too hard. It’s not too hard. It requires a change in business model but it is, according to experts inside the U.S. government and a lot of people who will meet with us privately in the private sector, no one actually wants to be seen with us but we meet them out behind the 7/11, they tell us, look, it’s a business model decision.

Take the FBI’s business model. We equip our agents with mobile devices that I think are great mobile devices and we’ve worked hard to make them secure. We have designed it so that we have the ability to access the content. And so I don’t think we have a fatally flawed mobile system in the FBI, and I think nearly every enterprise that is represented here probably has the same. You retain the ability to access the content. So look, one of the worlds I could imagine, I don’t know whether this makes sense, one of the worlds I could imagine is a requirement that if you’re going to sell a device or market a device in the United States, you must be able to comply with judicial process. You figure out how to do it.

And maybe that doesn’t make sense, absent an international component to it, but I just don’t think we, and look, I get it, the makers of devices and the makers of fabulous apps that are riding on top of our devices, on top of our networks, really don’t have an incentive to deal with, to internalize the public safety harm. And I get that. My job is to worry about public safety. Their job is to worry about innovating and selling more units, I totally get that. Somehow we have to bring together, and see if we can’t optimize those two things. And really, given my role, I should not be the one to say, here’s what the technology should look like, nor should they say, no I don’t really care about that public safety aspect.

And what I don’t want to have happen, and I know you agree with me no matter what you think about this, now I think you’re going to agree with what I’m about to say, is we can’t have this conversation after something really bad happens. And look, I don’t want to be a pessimist, but bad things are going to happen. And even I, the Director of the FBI, do not believe that we can have thoughtful conversations about optimizing things we care about in the wake of a serious, serious attack of any kind.

The bolded text is the closest Director Comey came to describing how he imagines a mandate working. He doesn’t suggest that it’s anything like a complete proposal–and anyway that would be too much to ask from an off-the-cuff answer to an audience question. But let’s look at what would be required to turn it into a proposal that can be analyzed. In other words, let’s extrapolate from Director Comey’s answer and try to figure out how he and his team might try to build out a specific proposal based on what he suggested.

The notional mandate would apply at least to retailers (“if you’re going to sell … or market a device”) who sell smartphones to the public “in the United States.” That would include Apple (for sales in Apple Stores), big box retailers like Best Buy, mobile phone carriers’ shops, online retailers like Amazon, and the smaller convenience stores and kiosks that sell cheap smartphones.

Retailers would be required “comply with judicial process.” At a minimum, that would presumably mean that if presented with a smartphone that they had sold, they could extract from it any data encrypted by the user. Which data, and under what circumstances? That would have to be specified, but it’s worth noting that there is a limited amount the retailer can do to control how a user encrypts data on the device. So unless we require retailers to prevent the installation of new software onto the device (and thereby put app stores, and most app sellers, out of business), there would need to be major carve-outs to limit the mandate’s reach to include only cases where the retailer had some control. For example, the mandate might apply only to data encrypted by the software present on the device at the time of sale. That could create an easy loophole for users who wanted to prevent extraction of their encrypted data (by installing encryption software post-sale), but at least it would avoid imposing an impossible requirement on the retailer. (Veterans of the 1990s crypto wars will remember how U.S. software products often shipped without strong crypto, to comply with export controls, but post-sale plug-ins adding crypto were widely available.)

Other classes of devices, such as laptops, tablets, smart devices, and server computers, would either have to be covered, with careful consideration of how they are sold and configured, or they would be excluded, limiting the coverage of the rule. There would need to be rules about devices brought into the United States by their user-owners, or if those devices were not covered, then some law enforcement value would be lost. And the treatment of used devices would have to be specified, including both devices made before the mandate took effect (which would probably need to be exempted, creating another loophole) and post-mandate devices re-sold by a user of merchant: would the original seller or the re-seller be responsible, and what if the reseller is an individual?

Notice that we had to make all of these decisions, and face the attendant unpleasant tradeoffs, before we even reached the question of how to design the technical mechanism to implement key escrow, and how that would affect the security and privacy interests of law-abiding users. The crypto policy discussion often gets hung up on this one issue–the security implications of key escrow–but it is far from the only challenge that needs to be addressed, and the security implications of a key escrow mechanism are far from the only potential drawbacks to be considered.

Director Comey didn’t go to Austin to present an encryption mandate proposal.  But if he or others do decide to push seriously for a mandate, they ought to be able to lay out the details of how they would do it.

 

 

Read the whole story
reconbot
1 day ago
reply
New York City
Share this story
Delete

REI's Wall of Litho Stones in New York, New York

2 Shares

Second half of the wall

In 2011, while the REI store in the Puck Building in Manhattan's SoHo district was undergoing renovation, workers made an unexpected discovery. Hidden behind one of the walls of the cellar were more than 100 lithography stones from the building’s days as a printer. They are now on display on the store’s lower floor. 

The historic building got its name from the magazine Puck, the first wide-reaching humor publication in the United States, which was founded in 1871 and moved to lower Manhattan in 1887. It shared the space, in a mutually beneficial relationship, with its printer, J. Ottman Lithographic Company. Their shared headquarters was the largest building in the printing district at the time.

J. Ottman Lithographic Company printed many things beyond the Puck magazines, including theatrical posters and board games. Among the works now hanging on the REI wall are a high school diploma, a certificate of election, and a mortgage bond. Some of the litho stones are in rougher shape than others.

Most of the writing and images on the stones is “backwards,” standard practice so that the final print is the reverse of what is seen on the plate or stone. Some, though, were prepared for offset printing, which involves an additional step between the plate and the final product. The inked image, prepared “forwards,” or as it would be seen in the final product, is first transferred to a rubber blanket, reversing the image once, and then to the final surface, setting it right.

Puck continued to operate out of the Puck Building until 1918, when it ceased publication. It was known for beautiful, full-color lithographs and sharp political satire. Statues of the magazine’s mascot, Puck, decorate the outside of the building. J. Ottman Lithographic Company shuttered around the same time. Other printing companies, and even another satirical magazine, have called the building home since the original tenants left.

During REI’s renovation, a deliberate effort was made to repurpose materials from the original building. Fixtures from the steam engine that powered the presses are on permanent display, including two flywheels and the governor. Nineteenth century I. P. Frink chandeliers, newly fitted with LED lights, help light the main floor.

Read the whole story
reconbot
2 days ago
reply
New York City
Share this story
Delete
Next Page of Stories