Web 2.0

Usually my annual “Steve’s Road Trip” adventures are out west to the mountains, or down to the desert southwest, but for the second summer I’m headed to the north shore of Lake Superior before summer gives way to the fall. I’ll also go up to Ely for a day (and stop at former National Geographic photographer, Jim Brandenburg’s gallery) and so I can also head over to Sigurd Olson’s Listening Point and take some photos. (You can read my 2014 post about my first visit to Listening Point here).

When I mentioned my trip to a buddy of mine he asked, “Are you going to shoot with your iPhone?” I thought he was joking, but in the past we’ve talked about the “photography revolution” since smartphone shooting has essentially killed the “point and shoot” lower end camera market, and ad campaigns like Apple’s Shot on iPhone make it seem like anyone running around with their iPhone will get National Geographic-worthy photos (reality check: you won’t).

So that begs the question: Do you shoot important photos with your smartphone? Read More

Private Internet Access (PIA), my VPN of choice, just made a gutsy move that any of us who use the service are applauding, and one I’ll wager will also pay off with heightened awareness of their service.

You may have heard about a new “anti-terror” law that Russian President Vladimir Putin signed into law this past week. At its core the law dictates that communication companies doing business in Russia will have to keep a record of their users’ calls, text messages, photos, and internet activity for six months, and store ‘metadata’ for three years, according to the International Business Times.

Since PIA’s servers in Russia keep no logs—and key to the PIA service is that do not log any traffic or usage by customers on any of their servers—the Russian government seized their servers!

This is what was sent out late yesterday to PIA customers:

To Our Beloved Users,

The Russian Government has passed a new law that mandates that every provider must log all Russian internet traffic for up to a year. We believe that due to the enforcement regime surrounding this new law, some of our Russian Servers (RU) were recently seized by Russian Authorities, without notice or any type of due process. We think it’s because we are the most outspoken and only verified no-log VPN provider.

Luckily, since we do not log any traffic or session data, period, no data has been compromised. Our users are, and will always be, private and secure.

Upon learning of the above, we immediately discontinued our Russian gateways and will no longer be doing business in the region.

To make it clear, the privacy and security of our users is our number one priority. For preventative reasons, we are rotating all of our certificates. Furthermore, we’re updating our client applications with improved security measures to mitigate circumstances like this in the future, on top of what is already in place. In addition, our manual configurations now support the strongest new encryption algorithms including AES-256, SHA-256, and RSA-4096.

All Private Internet Access users must update their desktop clients at https://www.privateinternetaccess.com/pages/client-support/ and our Android App at Google Play. Manual openvpn configurations users must also download the new config files from the client download page.

We have decided not to do business within the Russian territory. We’re going to be further evaluating other countries and their policies.

In any event, we are aware that there may be times that notice and due process are forgone. However, we do not log and are default secure against seizure.

If you have any questions, please contact us at helpdesk@privateinternetaccess.com.

Thank you for your continued support and helping us fight the good fight.

Sincerely,
Private Internet Access Team

Saw a commercial last night about a General Motors “up to $X cash back” on several of their cars, including the 2016 Chevrolet Volt. The $7,820 cash back would take the “Premier” model price-point drop down around the current 2017 entry-level model’s price.

So before heading over to our local dealer, Suburban Chevrolet, I was at my computer doing some other stuff so thought I’d try out their live chat and just ask about availability. There was no 2016 inventory on their website, but dealers know they have a limited window to dump last year’s models and will swap out vehicles when needed.

This live chat was such a complete and utter waste of time that I am drop-jawed American car companies still use such plaid-sport-coat sales tactics and it felt like I was car shopping in the 1970s.

Just so you know, the live chat was all about qualifying, and obtaining an email or phone number, instead of answering ANY simple question (one they should know, of course).

Read how this third party chat group evades answering anything… Read More

Started to research the eero Wifi system today after a tech buddy’s endorsement this past week. My wife and I would love to saturate our 3500 sq ft home with 5ghz Wifi signal, instead of our remote spaces only getting the 2.4ghz, and the eero super-simple setup and mesh networking seems VERY intriguing.

The eero system is described by the company as “self-healing” because it “phones home” to their servers to update as it learns from other people’s installations. Amazon reviews were glowing and my wife was excited, but I said I had to research their security model before buying.

After poking around a bit I then read this post by a guy I follow Brian Krebs (he’s the guy that broke the Target breach story) and he seems convinced. But reading what the CEO said in Brian’s interview with him, and people in the comments, confirmed my suspicion: eero uses public key cryptography but *eero* holds the key. That means they would be able to gain full access to our internal LAN (and all devices on our network) or be compelled to hand over the key for access by who-knows-whom.

Guess we’ll pass.

My GOD am I ever weary of the scumbags who invest their time, energy and effort in acting like script-kiddies attacking WordPress sites. It’s exploded in the last few weeks and, once again, the lion’s share of attacks are coming from that haven for black-hat hacker wannabees, OVH in France.

Over three years ago I wrote, “Brute Force Attacks Coming From OVH in France” after I’d reached out to Octave Klaba the “founder, chairman and cto” of OVH. He didn’t care then and I’m certain he won’t care now, but you’ve got to check out this stream of attacks today in less than a minute to see why I’m so agitated:

Again, Klaba made it very clear to me all those years ago that he could care less about online abuse like this which is why I’ve redirected all the standard URLs for these attempts so they go to Interpol. Maybe some Interpol sysadmin will wonder why they’re now receiving so much traffic from OVH and at least make an inquiry. This shit has to stop.