random:seed

Last night I received an e-mail in which one of my visitors asked me a few questions after reading the post about parsing phone numbers in Clojure. The question was seemingly simple and concerned a technical detail of software construction, but in reality the reader touched on a very important subject that I had been pondering years ago, and I decided to summarise it here.

Starting today, podcasts distributed under the random:stream section have a new home. This short tale — with some technical details and a surprise ending — explains why and how.

Every couple of years, there’s an increase in devices that enable individuals to measure the bioelectrical activity of their brains at home. These devices exploit the occurrence of fluctuating brain wave frequencies, which vary according to the user’s psychophysical state. Driven by a pandemic-induced fondness for my residence, I decided to purchase one of these gadgets. After several weeks, I sought to offer a subjective review of the chosen model and conduct an experiment using raw data.

At the turn of September and October 2014 the world learned of a security vulnerability that had been lurking for years in the GNU Bourne Again Shell (a.k.a. Bash). Most IT-security outlets had already covered the topic and published appropriate remediation methods, yet what caught my attention was the educational aspect of the flaw – in that regard it is a “good bug”, that is, one that can be used to explain many interesting mechanisms present in Unix-like systems.

When typing a website name into the browser’s address bar, mistakes sometimes happen. Instead of visiting the right site, we end up on a so-called domain parking page, or in a completely different service. There are also less safe situations—sites deceptively similar to the originals, used to siphon data or infect a computer with malware. Let’s imagine that a similar situation could occur even when the entered address was correct…

Attacks that rely on setting up fake update servers are not as difficult to carry out as one might think. The main reasons are administrators’ carelessness and the absence of robust version-publishing processes, although occasionally we see astonishing attack vectors that are hard to anticipate.