Personalmente me gusta usar distribuciones LTS por varias razones. Cuando Canonical publicó la versión 12.04 LTS, me actualicé desde la 10.04 LTS, la que funcionó muy funcionó durante esos 2 años. Después de actualizarme a 12.04 LTS (reinstalé, para ser más exactos) me llevé algunas desagradables sorpresas, y no porque no me gustara Unity, sino porque cosas como la conexión de 2 monitores externos no funcionaba, al menos a mi no me funcionaba. Llegué a la conclusión que el problema era del pobre soporte 3D de los drivers ATI que tenía.

The Amnesic Incognito Live System o quizás más conocido como TAILS, es un sistema operativo de estos que puedes arrancar y usar desde un DVD, lápiz USB, tarjeta de memoria, etc. Más conocido como sistema vivo o Live.

La principal característica de este sistema operativo es que está construido con la privacidad como pilar principal. Es un sistema Linux basado en Debian y que integra varias herramientas ya configuradas para usar la red Tor, GPG, OTR (Off The Record), cifrado de discos y particiones (LUKS), etc.

PyCon es probablemente la mayor conferencia sobre el lenguaje de programación Python. Aunque la edición actual, 2014, está todavía en proceso (hasta el 17 de abril), ya se han publicado los vídeos de las charlas celebradas entre los días 11 y 13 de abril.

La lista de vídeos está disponible en PyVideo.org y os la dejo a continuación:

• 2D/3D graphics with Python on mobile platforms
• Advanced techniques for Web functional testing
• Analyzing Rap Lyrics with Python
• A Scenic Drive through the Django Request-Response Cycle
• Building the App
• Cheap Helicopters In My Living Room
• Closing address - PyCon 2014 (2014/04/13)
• Data intensive biology in the cloud: instrumenting ALL the things
• Deliver Your Software In An Envelope
• Designing Django's Migrations
• Designing Poetic APIs
• Developing Flask Extensions
• Discovering Python
• Diving into Open Data with IPython Notebook & Pandas
• Django: The good parts
• Farewell and Welcome Home: Python in Two Genders
• Fast Python, Slow Python
• Games for Science: Creating interactive psychology experiments
• Garbage Collection in Python
• Getting Started Testing
• Hitchhikers Guide to Participating in Open Source
• In Depth PDB
• Introduction to Docker
• Introduction to SQLAlchemy Core
• It's Dangerous to Go Alone: Battling the Invisible Monsters in Tech
• Keynote - Fernando Pérez
• Keynote - Guido Van Rossum
• Keynote - Jessica McKellar
• Keynote - Van Lindberg
• Know Thy Neighbor: Scikit and the K-Nearest Neighbor Algorithm
• Lightning talks - Saturday morning
• Lightning talks - Sunday morning
• Localization Revisited
• Multi-factor Authentication - Possession Factors
• My big gay adventure. Making, releasing and selling an indie game made in python.
• Outreach Program for Women: Lessons in Collaboration
• Performance Testing and Profiling: A Virtuous Cycle
• Postgres Performance for Humans
• PostgreSQL is Web Scale (Really :) )
• Programming an Autonomous 20 Foot Blimp with Python
• Pushing Python: Building a High Throughput, Low Latency System
• Python in the Browser: Intro to Brython
• Python packaging simplified, for end users, app developers
• Quick Wins for Better Website Security
• REST is not enough: Using Push Notifications to better support your mobile clients
• Sane schema migrations with Alembic and SQLAlchemy
• See Docs Run. Run, Docs, Run!
• Set your code free: releasing and maintaining an open-source Python project
• Smart Dumpster: Employing Python to Report Real-Time Resource
• Software Carpentry: Lessons Learned
• Software Engineering Research for Hackers: Bridging the Two Solitudes
• So You Want to Build an API?
• Subprocess to FFI: Memory, Performance, and Why You Shouldn't Shell Out
• Technical on-boarding, training, and mentoring.
• The Day of the EXE Is Upon Us
• The Sorry State of SSL
• Track memory leaks in Python
• Unit Testing Makes Your Code Better
• Upgrade your Web Development Toolchain
• What is coming in Python packaging
• Which messaging layer should you use if you want to build
• Writing RESTful web services with Flask
• Advanced methods for creating decorators
• All Your Ducks In A Row: Data Structures in the Standard Library and Beyond
• An Introduction to Twisted
• Ansible - Python-Powered Radically Simple IT Automation
• Application Deployment State of the Onion
• Bayesian statistics made simple
• Beyond Defaults: Creating Polished Visualizations Using Matplotlib
• Blending art, technology, and light, Python for interactive and real time
• Building and breaking a Python sandbox
• Build your own PiDoorbell! - Learn Home Automation with Python
• By Your Bootstraps: Porting Your Application to Python3
• Cache me if you can: memcached, caching patterns and best practices
• Castle Anthrax: Dungeon Generation Techniques
• Character encoding and Unicode in Python
• Computer science fundamentals for self-taught programmers
• Contribute with me! Getting started with open source development
• Data Wrangling for Kaggle Data Science Competitions -- An etude
• Decorators: A Powerful Weapon in your Python Arsenal
• Distributed Computing Is Hard, Lets Go Shopping
• Distributed task processing using Celery
• Django for Web Designers and Front End Developers
• Dynamics and Control with Python
• Enough Machine Learning to Make Hacker News Readable Again
• Fan-in and Fan-out: The crucial components of concurrency
• Faster Python Programs through Optimization
• Flask by Example
• For Lack of a Better Name(server): DNS Explained.
• Generators: The Final Frontier
• Getting Hy on Python: How to implement a Lisp front-end to Python
• Getting Started with SaltStack
• Hands-on with Pydata: how to build a minimal
• Hello Physical World: A Crash Course on the Internet of Things
• How to Get Started with Machine Learning
• Import-ant Decisions
• Improving automated testing with py.test
• Introduction to game programming
• Introduction to Regular Expressions
• Introduction to SQLAlchemy
• Introduction to Web (and data!) Scraping with Python
• IPython in depth: high productivity interactive and parallel python
• Keynote - John Perry Barlow
• Kneel And Disconnect: Getting The Fastest Connection Out Of A Hostname
• Let's Learn Twisted Python
• Lightning talks - Saturday Evening
• Pickles are for Delis, not Software
• PostgreSQL Proficiency for Python People
• Puppet Modules: Apps for Ops
• Python 3/2 Web Development with Pyramid
• Python for Social Scientists
• Python + Geographic Data = BFFs
• Python Scraping Showdown: A performance and accuracy review
• Realtime predictive analytics using scikit-learn & RabbitMQ
• Search 101: An Introduction to Information Retrieval
• Shiny, Let's Be Bad Guys: Exploiting and Mitigating the Top 10
• So you want to be a full-stack developer? How to build a full-stack python
• Straightening Out AngularJS with Python
• TDD for web applications, from scratch
• Teaching Python: To Infinity and Beyond
• The Python Pipeline: Why you should reach out to local teachers
• The State of Crypto in Python
• The Young Coder: Let's Learn Python
• Turn Your Computer Into a Server
• Twisted Mixing
• What Is Async, How Does It Work, And When Should I Use It?
• 0 to 00111100 with web2py
• Descriptors and Metaclasses - Understanding and Using Python's More Advanced Features
• Diving deeper into Machine Learning with Scikit-learn
• Exploring Machine Learning with Scikit-learn
• Getting Started with Django, a crash course
• Hands-on intro to Python for beginning programmers
• How to formulate a (science) problem and analyze it using Python code
• Lightning talks - Saturday morning
• Mining Social Web APIs with IPython Notebook
• mrjob: Snakes on a Hadoop
• Opening Statements - PyCon 2014 (2014/04/11)
• Python Epiphanies

El CERT mantiene una lista de reglas y buenas prácticas que recomiendan seguir cuando escribimos código en el lenguaje de programación Java de Oracle. La versión 1.0 de esta lista se apoya en las versiones 1.6 y 1.7 de Java.

La lista se divide en las siguientes secciones:

• 00. Input Validation and Data Sanitization (IDS)
• 01. Declarations and Initialization (DCL)
• 02. Expressions (EXP)
• 03. Numeric Types and Operations (NUM)
• 04. Object Orientation (OBJ)
• 05. Methods (MET)
• 06. Exceptional Behavior (ERR)
• 07. Visibility and Atomicity (VNA)
• 08. Locking (LCK)
• 09. Thread APIs (THI)
• 10. Thread Pools (TPS)
• 11. Thread-Safety Miscellaneous (TSM)
• 12. Input Output (FIO)
• 13. Serialization (SER)
• 14. Platform Security (SEC)
• 15. Runtime Environment (ENV)
• 16. Java Native Interface (JNI)
• 49. Miscellaneous (MSC)
• 50. Android (DRD)

Como podemos ver la última sección de la misma está orientada a Android, en la que se comentan los siguientes temas:

• DRD00-J. Do not store sensitive information on external storage (SD card)
• DRD01-J. Limit the accessibility to your sensitive content provider
• DRD02-J. Do not allow WebView to access sensitive local resource through file scheme
• DRD03-J. Do not broadcast sensitive information using an implicit intent
• DRD04-J. Do not log sensitive information
• DRD05-J. Do not grant URI permissions on implicit intents
• DRD06-J. Do not act on malicious intents
• DRD07-J. Protect exported services with strong permissions
• DRD08-J. Always canonicalize a URL received by a content provider
• DRD09-J: Restrict access to sensitive activities
• DRD10-J. Do not release apps that are debuggable
• DRD11-J. Ensure that sensitive data is kept secure
• DRD12-J. Do not trust data that is world writable
• DRD13-J. Do not allow JavaScript in Web Apps
• DRD14-J. Check that a calling app has appropriate permissions before responding
• DRD15-J. Consider privacy concerns when using Geolocation API
• DRD16-J. Explicitly define the exported attribute for private components
• DRD17-J. Do not use the Android cryptographic security provider encryption default for AES
• DRD18-J. Do not use the default behavior in a cryptographic library if it does not use recommended practices
• DRD19-J. Properly verify server certificate on SSL/TLS

Si eres de los que prefieres un libro, The CERT Oracle Secure Standard for Java (imagen que encabeza esta entrada), es una buena opción, aunque no cubre el apartado de Android, al menos en la revisión actual.

Desde la web de Irongeek podemos acceder a los vídeos de la Notacon 11, conferencia sobre seguridad informática celebrada del 10 al 13 de abril. Los vídeos disponibles son los siguientes:

• Big Data Technology – The Real World ‘Minority Report’ - Brian Foster
• Naisho DeNusumu (Stealing Secretly) – Exfiltration Tool/Framework - Adam Crompton
• Wireless Mesh Protocols - Alex Kot
• MDM is gone, MAM is come. New Challenges on mobile security - Yury Chemerkin
• Moving the Industry Forward – The Purple Team - David Kennedy
• Pwning the POS! - Mick Douglas
• Nindroid: Pentesting Apps for your Android device - Michael Palumbo
• Building a private data storage cloud - Michael Meffie
• Lessons Learned Implementing SDLC – and How To Do It Better - Sarah Clarke
• Plunder, Pillage and Print - Deral Heiland & Peter Arzamendi
• Microsoft Vulnerability Research: How to be a finder as a vendor - Jeremy Brown & David Seidman
• SMalware Analysis 101 – N00b to Ninja in 60 Minutes - grecs
• Omega – A Universe Over IP - Mo Morsi
• IRS, Identity Theft, and You (or Someone Pretending to Be You). - 123-45-6789
• All About the Notacon Badge -Sam Harmon
• Collaboration between Artificial Intelligence and Humans: How to cure every disease within 50 years - Joe O’Donnell
• Science “Fair” - The Nomad Clan
• Hacking Your Way Into the APRS Network on the Cheap - Mark Lenigan
• Dominate! (Or let your computer do it for you.) - Paul Jarc
• Wearable Technology as Art for Countersurveillance, Cinemaveillance, and Sousveillance - Ross Bochnek
• 3D Printing for Work and Fun (temp title) - Mirabela Rusu
• Comparing “Go Green” With “Common Sense” - Suellen Walker
• Living in the Future: It seems to be in Beta - Jeff Goeke-Smith
• A Brief Introduction to Game Theory - Charlotte DeKoning - Beyond Using The Buddy System - Holly Moyseenko & Kris Perch

Un editor hexadecimal es una de las herramientas que siempre es bueno tener a mano. Recuerdo usar este tipo de herramientas en mis tiempos de Spectrum y Amiga para cambiar el texto que aparecían en los juegos. Una tontería, pero me divertía :)

El editor que actualmente uso es wxHex Editor. Aunque yo personalmente prefiero usar aplicaciones locales, también me gusta tener a mano herramientas online, porque nunca se sabe en que sistema te vas a encontrar y que herramientas vas a necesitar.

Las presentaciones de la SyScan 2014 celebrada en Singapur del 31 de marzo al 4 de abril ya están disponible para descarga. El material disponible es el siguiente:

• Charlie Miller and Chris Valasek - Car Hacking for Poories
• Corey Kallenberg, Xeno Kovah, John Butterworth, Sam Cornwell - Setup for Failure: Defeating SecureBoot
• Daniel Bilar - Scientific Best Practices for Recurrent Problems in Computer Security R&D
• Alfredo Ortega - Deep-Submicron Backdoor
• Adam Laurie - RFIDler
• Anton Sapozhnikov - Getting User Credentials is not only Admin's Privilege
• Joxean Koret - Breaking Antivirus Software
• Mathias Payer - Embracing the New Threat: Towards Automatically Self-Diversifying Malware
• Josh "m0nk" Thomas - How to Train your SnapDragon: Exploring Power Regulation Frameworks on Android
• Dr. Thaddeus (The) Grugq - Click and Dragger: Denial and Deception on Android Smartphones
• Alex Plaskett and Nick Walker - Navigating a sea of Pwn?: Windows Phone 8 AppSec
• Snare and Rzn - Thunderbolts and Lightning: Very Very Frightening
• Georg Wicherski - Linux Memory Forensics: A Real-Life Case Study

Haim

Spotify & GrooveShark

La archiconocida y magnífica revista electrónica Phrack ha hecho público una nota en la que anuncian cambios en la política de publicación.

Phrack se iba publicando tras varios meses y últimamente incluso años. A ese ritmo, el problema es que si alguien manda un artículo y éste se publica un año o dos más tarde, dicho artículo ya se esté obsoleto o no tenga relevancia alguna. Por ello, Phrack ha decidido crear una sección llamada Paper Feed, en la que se irán haciendo públicos los artículos que sean enviados y aprobados por los revisores.