April summary - 2017-04

04 April

• We knew that ants were farming fungus https://en.wikipedia.org/wiki/Ant%E2%80%93fungus_mutualism. The news is that http://www.popsci.com/ants-farming-fungi it happened 65 millions years ago in dry climate. It is quite fascinating subject, that both species influenced each other, to the point of being dependent. (Via ScienceFriday)
• American maybe the most liberal, but they are also very critic of the "financial matter". Rana
  Foroohar of the Financial Times talks about: "Makers and Takers: The Rise of Finance and the Fall of American Business".  http://www.econtalk.org/archives/2017/04/rana_foroohar_o.html
• Nice Math tool: SageMath. It has command line and a web interface. http://www.sagemath.org/ (based on Python, R and TeX, install is about 2Go ...)
• Always nice from times to times "10 Mistakes That Spell Disaster for Your Career" https://www.linkedin.com/pulse/10-mistakes-spell-disaster-your-career-jan-johnston-osburn

Music

• A mashup of Coltrane's "Mars" and Sunn O))) "Rabbit's Revenge" https://www.youtube.com/watch?v=-6zSbtcQ5ZA (via Adam Neely https://www.youtube.com/watch?v=iHPFAQj0Geg)

Security

• TLS implementations leaking information via caching intermediate certificates. Tricky, very tricky  https://shiftordie.de/blog/2017/02/21/fingerprinting-firefox-users-with-cached-intermediate-ca-certificates-fiprinca/
• Yet another issue with HTTPS intercepting tool: https://community.sophos.com/products/unified-threat-management/f/general-discussion/91085/https-scanning-web-protection-ssl-error-err_cert_common_name_invalid/330113
• Critical vulnerability in JSON Web Encryption (JWE) - RFC 7516  http://blog.intothesymmetry.com/2017/03/critical-vulnerability-in-json-web.html
• TOP 10 DEVELOPER CRYPTO MISTAKES (Scott Contini)  https://littlemaninmyhead.wordpress.com/2017/04/22/top-10-developer-crypto-mistakes/
• New top ten OWASP. The PDF is short and visual: good. https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
• User Authentication NIST goes in depth on the topic https://pages.nist.gov/800-63-3/.
  Passwords should be more usable: https://www.passwordping.com/surprising-new-password-guidelines-nist/ !