A couple weeks ago, Biz explained how Twitter users were being victimized by phishing scams spread primarily through links in Direct Messages. Basically, people click the link and bad things happen. My team can only detect these scams after malicious links have already been sent out.

Today, we’re launching a new service to protect users that strikes a major blow against phishing and other deceitful attacks. By routing all links submitted to Twitter through this new service, we can detect, intercept, and prevent the spread of bad links across all of Twitter. Even if a bad link is already sent out in an email notification and somebody clicks on it, we’ll be able keep that user safe.

A much needed step.

The Department of Homeland Security’s top cybersecurity official told CNET on Wednesday that the department may eventually extend its Einstein technology, which is designed to detect and prevent electronic attacks, to networks operated by the private sector. The technology was created for federal networks.

Scary times.

Web authentication and security firm VeriSign has expanded its mobile, cloud based authentication service to the Android platform.

The VeriSign Identity Protection (VIP) Access for Mobile application is a free tool which turns a into user’s mobile device into VIP credentials for strong authentication, requiring a username, password and a unique one-time six-digit security code, the firm said.

Excellent news for Android users out there.

Honestly, I love this format so much I wish *more* sites used it. There are so many sites I like but don’t *love* because they don’t allow themselves to simply link to something with a few words rather than craft a 250-word wrapper for every entry.

This is something I’ve been on about for a long time now, but nobody I explain it to seems to get it. I think I’m explaining it poorly. Here’s my implementation: http://danielmiessler.com/blog/aggregating-and-displaying-your-discovered-con… (also visible in the first column to the right).

When creating a web application that accepts input from users one important step to ensure that you application is secure, is assigning a maximum length to user input.  Keep in mind that input length validation is just the tip of a very large iceberg when it comes to web application security, but it is a good first step.  It’s safe to say that if someone is trying to put in 1200 characters for their first name that something fishy is going on.

As much as I love ASP.NET I’ve found that it can easily lull some programmers into a false sense of security when it comes to input length validation.  To demonstrate what I am talking about I have put together a small application that will show how simple it is to pass longer than expected input to an application that would appear (to the uninformed programmer at least) to limit input length.

To begin I have created the basic aspx page below.  Notice the MaxLength attribute that is highlighted in red:

It’s funny how people think they’re so unique. I just found out my cousin Abe (say hello to him at abemiester.com)–who I’ve spoken to all of about 3 times for a grand total of less than 10 minutes since we were children–is not only in IT, but is heavily interested in Application Security. This happens to be what I do for a living as well.

Check out this post of his on how .NET tries to pass off client-side testing as “validation”. Indeed, Abe. If you didn’t check on the server side, you didn’t check.

1. Limit your friends. Not real-life friends, but social network and blogging and forum friends. Not that these can’t be good relationships, but having too many makes them meaningless. And each friend will take up a little bit of your attention — when you read their updates, click on their links, reply to their messages, look at their photos, and so on. The more you have, the more attention they’ll require. Limit them to just the essential.
2. Limit your feeds. Blog subscriptions, newsletters, other updates and news subscriptions and so on. Limit them to a handful of essentials, and let the rest go. The more you have, the more attention they require.
3. Limit your communication time. Going into your email inbox? Just give yourself 10 minutes to read, reply, delete, and get out. Going to do Twitter? Give yourself 5 minutes. Seriously, set up a timer. Don’t let these things take up all your attention.
4. Give up on news. It’s a never-ending cycle. And if you’ve paid attention to the news as long as I have (I’m a former journalist), you know it’s all the same, year after year. Unless your job depends on it, the news is usually a waste of your attention. Let go of the need to stay updated. Even if your job does depend on it, keep it limited.
5. Be brief. Write brief emails, tweets, updates, blog posts. With some exceptions, of course. But make brief your de facto. Read more.
6. Give your attention to the important. This is the crucial part: choose what you give your attention to, and do this choosing carefully. What is important to you? Writing? Photography? Design? Coding? Creating a new business that helps others? Your kids? Figure this out, and give this the majority of your attention.
7. Become conscious of your distractions. Once you’ve decided to focus your attention on the important, become more aware of distractions as they come up. Make note of them, and as you get the urge to be distracted, learn to pause, breathe, and return to the important.
8. Surround yourself with the positive. If you want your life to be positive, let the positive have your attention. This applies to blogs, people, projects, and more.

I especially like the one about giving up on news; it’s something I’ve been grappling with for years. I’m not yet ready, I’m afraid, but I feel like this evolution is inevitable.

Atlanta- Pat Robertson, the conservative Christian televangelist and host of the 700 Club said that the 8.8 magnitude earthquake off the coast of Chile yesterday  was the result of the nations pact with the Chupacabra, or goat-sucker, a devilish beast blamed for livestock deaths across Latin America.

“Something happened a long time ago in Chile, and people might not want to talk about it,” Robertson said. “They were under the heel of the democratically elected SOCIALIST regime of Salvador Allende …and they got together and swore a pact to the chupacabra. They said, ’We will serve you if you’ll get us free from the the man we elected president, and install a military dictatorship that will make thousands of ‘troublemakers disappear.’” ”True story,” he continued. “And the devil said, ‘OK, it’s a deal.’ Ever since, they have been cursed by one thing after another.”

It saddens me that people send this man money.

In a well-meaning attempt to be tolerant of other cultures and religions we often blithely subvert our values and morality, says Sam Harris, the outspoken critic of blind religious faith. We do this because we think that questions about good and evil or right and wrong cannot be answered definitively. But they can, he told a rapt audience at the Technology, Entertainment and Design conference Thursday — and they should.

Harris is no stranger to the argument that, to put it more mildly than he might, religion does more harm than good. His 2005 New York Times bestseller The End of Faith attempted to draw a straight line from faith to human atrocities. His subsequent Letter to a Christian Nation took on the fierce pushback he received from writing his first book.

So it should come as no surprise that Harris ran with this theme at TED, expanding his argument beyond the faithful to the secular-leaning. Scientists and academics, who are wedded to facts and empiricism, he said, do something different when they talk about morality. “We value differences of opinion in a way that we don’t in other areas,” Harris said.

We know that there are fundamentally right and wrong answers to certain questions and issues, but do not trust our instincts, he said. These cast-aside tenets should respected and should be the basis of a universal morality, regardless of variations in cultures and belief.

The arrow of time is based on ideas that go back to Ludwig Boltzmann, an Austrian physicist in the 1870s. He figured out this thing called entropy. Entropy is just a measure of how disorderly things are. And it tends to grow. That’s the second law of thermodynamics: Entropy goes up with time, things become more disorderly. So, if you neatly stack papers on your desk, and you walk away, you’re not surprised they turn into a mess. You’d be very surprised if a mess turned into neatly stacked papers. That’s entropy and the arrow of time. Entropy goes up as it becomes messier.

So, Boltzmann understood that and he explained how entropy is related to the arrow of time. But there’s a missing piece to his explanation, which is, why was the entropy ever low to begin with? Why were the papers neatly stacked in the universe? Basically, our observable universe begins around 13.7 billion years ago in a state of exquisite order, exquisitely low entropy. It’s like the universe is a wind-up toy that has been sort of puttering along for the last 13.7 billion years and will eventually wind down to nothing. But why was it ever wound up in the first place? Why was it in such a weird low-entropy unusual state?

Great stuff.

“Years ago, when you were about four years old, the system set out to persuade you of something that isn’t true.

Not just persuade, but drill, practice, reinforce, and yes, brainwash.

The mission: to teach you that you’re average. That compliant work is the best way to a reliable living. That creating average stuff for average people, again and again, is a safe and easy way to get what you want.

Step out of line and the system would nudge (or push) you back to the center. Show signs of real creativity, originality or even genius, and well-meaning parents, teachers and authority figures would eagerly line up to get you back in line.

Our culture needed compliant workers, people who would contribute without complaint, and we set out to create as many of them as we could.

And so generations of students turned into generations of cogs, factory workers in search of a sinecure. We were brainwashed into fitting in, and then discovered that the economy wanted people who stood out instead.

When exactly were we brainwashed into believing that the best way to earn a living is to have a job?

I think each one of us needs to start with that.”

Yes.

I actually previously discovered that Larry’s speculation is false. In the General Social Survey, it is primarily Wordsum score and not years of schooling which correlates with less religiosity. It should also be noted that the correlation of higher IQ with less religiosity was observed in the 1920s, before liberals took over the colleges. And even before the invention of IQ tests, it can be observed though the study of history that the elites tended to be more secular than the masses.

In the United States where belief in God is the norm, self-identifying as an atheist means you are likely to have thought about the issue, which indicates higher intelligence. But beyond this, it seems obvious to me that smarter people find the Bible hard to believe, so even when smarter people claim to believe in God, their religious beliefs tend to be more like universal Unitarianism than traditional Christianity with its reliance on supernatural events for which there is no historical or scientific evidence.

Obvious, but necessary to reinforce.