Leo Laporte – Observations from Uppsala

Security Now on Hacking Vehicles – A Bit of Let-Down

The Security Now Podcast number 497 dealt with the topic of Vehicle Hacking. It was fairly interesting, if a bit too light on the really interesting thing which is what actually went on in the vechicle hack that was apparently demonstrated on US national television at some point earlier this year (I guess this CBS News transcript fits the description). It was still good to hear the guys from the Galois consulting firm (Lee Pike and Pat Hickey) talking about what they did. Sobering to realize just how little even a smart guy like Steve Gibson really knows about embedded systems and the reality of their programming. Embedded software really is pretty invisible in both a good way and a bad way.

Continue reading “Security Now on Hacking Vehicles – A Bit of Let-Down”

Questioning the Choice of C++

flossweekly In FLOSS Weekly issue 57, about 20 minutes into the show, Randall Schwartz and Leo Laporte express genuine surprise that the XMBC media player application is all in C++. That is pretty telling, some parts of the computing world are indeed moving on to more modern pastures like Python, Perl, Ruby, and even Objective C (for the Mac people). And quite a contrast to the EDA world where C++ is still considered the new shiny thing, as I have lamented before… thanks for that small but golden genuine surprise, Randall and Leo!

Continue reading “Questioning the Choice of C++”

The Customer is not always Right

I just listened to Episode 103 of the Security Now podcast, where Leo Laporte and Steve Gibson talk to the head of security at PayPal. PayPal is doing the right thing right now, issuing their customers with RSA security keys. Which gives them two-factor authentication (password and security key passnumber).

But for some reason, they do not enforce the use of security keys on their customers. Even when you have obtained a security key (which is optional, weirdly enough) and said you are using it, you can still login without it doing some additional security questions. For the reason of convenience! Which basically reduces the security added to nothing, since you can still login in a traditional fashion.

Continue reading “The Customer is not always Right”