Yes, the government is spying on everyone's Internet traffic

Welp, looks like, yes, the NSA has an untargeted, mass surveillance program snooping on domestic Internet traffic. I like how the White House granted this extraordinary, likely unconstitutional, legal immunity just for a "pilot project." So basically, that's the level of justification they require (jack).

Soooo I'd like to take this opportunity to remind everyone about HTTPS Everywhere. This Firefox/Chrome extension checks whether each site you're visiting has an encrypted connection option, and if it does, it makes sure to use it. That means no one listening in-between will be able to see anything you do on the site, except you and the site owner. Not even the NSA, in all likelihood.

This little extension has come a long way in the past few years. It started out with a list of only a few dozen sites whose secure connection option it knew how to use. Now there are thousands in the list, including most big-name destinations like Google and Facebook. Think about it. You enable this, and no one except you and Google will see anything you do on any of their sites. No one at the NSA, Comcast, the airport WiFi service, or the dude sitting next to you at Starbucks.

Now, I only wish there was a mobile version. I've been thinking it'd be nice, since you're using your phone all the time on insecure WiFi networks run by random parties. But now that AT&T is a specific company they mention participating in this spying, it'd be pretty great to black out my phone traffic to them too. Well, luckily both Android and the iPhone support VPN connections, so all you gotta do is run OpenVPN at home (or, if you're a human, sign up for a VPN service) and do your part in saying "screw you, AT&T."

Evolution, in a sentence

Most teachers and biologists like to gum up the theory of evolution with lots of preconditions and caveats. Instead, I see it as something so simple, it's basically built in to the logic of the universe.

Maybe I'll expand on this in another post, but right now I just wanted to note the best, simplest way of explaining it I've stumbled upon so far:

If a thing makes more things, then there will be more of that thing.

It really boils down to that. There aren't really any more complicated "rules" or mystical workings to evolution. Instead, it's beautifully simple and automatic.

That's it for now.

CSS

All you web developers, you know what I'm talking about.

I've never seen it summed up so well.

Google Reader killed in its prime?

Okay, so maybe not exactly its prime. But I noticed that in their announcement, Google noted Reader's years of declining usage as the reason for ending it. Now, I have no sense of its popularity; I don't even use it myself. So out of curiosity I went to Google Trends to check interest in Reader:

Now, Google Trends is a pretty rough indicator of the actual number of users of something. But I found it interesting that there's absolutely no sign of a decline until just last year. In fact, the last couple years seem to be the strongest in Google Reader's history.

So either Google Trends is way off, or lack of interest isn't the main reason Google is shutting it down. Perhaps it's a slightly more conniving move to shore up Google Plus. Ars has the details, but Hitler might have put it even better:

Expand short urls with one bash command

Warning: This post is pretty much for techies/programmers only. Sorry, but I just had to share this cause it ended up being pretty cool.

The rise of url shorteners, while useful, has made it kinda uncertain where any particular click will take you. Even if you're not as security-conscious as I am, sometimes you might be wondering whether some link will take you to some annoying spam page.

There are wonderful services like LongURL and Long URL Please, which try to make it possible to see where you're going before you click, but sometimes they're tripped up by unknown url shorteners or multiple levels of redirection. Plus, it takes a few clicks to get to those services in the first place.

Thing is, I know that it's possible to make a generalized service that simply looks for any HTTP redirects and follows them until the end of the chain. For the longest time I've meant to make this, probably as a web tool. But then I started messing with curl's -I option (which prints just the HTTP response header), and realized I could make it much more simply. Eventually I ended up fitting it into 6 lines of bash! So I thought I'd share:

longurl () {
  url="$1"
  while [ "$url" ]; do
    echo "$url"
    line=$(curl -sI "$url" | grep -P '^[Ll]ocation:\s' | head -n 1)
    url=$(echo "$line" | sed -r 's/^[Ll]ocation:\s+(\S.*\S)\s*$/\1/g')
  done
}

Just paste the url after the command "longurl" and it'll follow the redirect chain, printing each url. For example:

$ longurl http://t.co/8VzDpOP0Xz
http://t.co/8VzDpOP0Xz
http://ow.ly/hU93Q
http://www.quora.com/Lincoln-2012-movie/How-historically-accurate-is-Lincoln-the-movie

Note: As an optional feature, you can add the line "echo -n "$url" | xclip -selection clipboard" at the top of the loop to use xclip to automatically paste the final url into your clipboard*. But it only works on Linux systems and xclip isn't a default package, so I left that line out. Oh, and a disclaimer while we're at it: I really should be checking the HTTP response code, yadda yadda yadda, didn't read the relevant RFC's, etc. But this is simple, it should work in most cases, and when it doesn't, you'll know.

Anyway, if you're the kind of person who usually has a terminal sitting open, this might prove pretty convenient. Just paste the function into your .bashrc file to have the command available in every session. Oh, and make sure you have curl installed. But you should already have that, shouldn't you?

If you need any more convincing, here's an example I just ran into of a nice, long redirect chain that did indeed end up at a spammer site. Glad I checked it first:

$ longurl http://t.co/oZ2IWUfW9m
http://t.co/oZ2IWUfW9m
http://is.gd/5TIIkF/ubeldynl
http://steve.omeuemail.com.br/7voxe1rz0m1hwcrsOmngucq/Qznqh4x-Ninlkk0yiq7kdmlyx-Rje1ieyqgkmbtqxhswaxmcl/5rwc6eyhfxqbp/Sw0yazi5lqmew5fxszvte0/Nvefuwsqe9q3zbjvvlsiswyv0Kmbbqpmgawedcrtkhv/Rdwoy5iwkfxigllbuqzvxfyw-D3qvi1z7f
http://gift-card-rewards.com/?r=y

*Now, I actually have a modified version that uses sed to paste just the domain name into my clipboard because my most common use case is to immediately paste the domain into Web of Trust to see if the link actually goes somewhere nasty. So as an FYI, here's my version of the line:

echo -n "$url" | sed -r 's/^https?:\/\/([^/]+).*\/.*$/\1/g' | xclip -selection clipboard

Update: If you're looking for some interesting links to try it on, I suggest using any of the links in the weekly Ars Technica "Dealmaster" posts. These seem to always go through incredible numbers of redirects via various tracking, advertising, and analytics companies. For example, http://bit.ly/1b5KFTr gets you a total of 14 redirects! It actually fails on the last one because it's a relative URL, but you can just use the one before it. I don't have a problem with these links, since I believe the redirects give credit to Ars and helps support them. Still, it shows how this little tool can shed light on a lot of stuff going on behind your back that you wouldn't have ever noticed otherwise.

Uninstall Java.

(source: codemonkeyx.net)
(coincidentally in a story about getting viruses from Java)

Just as a PSA, if you have Java on your system, you need to either uninstall it, or at the very least, make sure it's disconnected from your web browser. Skip to the bottom for instructions or read on for the full story.

The past six months have shown Java to be the biggest security disaster in personal computing right now. Really, though, we've known this for a while now. A 2010 report by Microsoft showed that having Java was by far the most common reason users got malware on their computers:

(via Ars Technica)

Fraudulent Google Certificate Issued by TURKTRUST - a CA you can safely delete

Firefox's default list of trusted certificate authorities

I'll point you here for the full story, and add my two cents below.

Sadly I don't have time to get into the rabbit hole of explaining certificates and SSL, so this will have to be directed at those already in the know.

Here's the overview. A root certificate authority, TURKTRUST (yes, they're Turkish), somehow issued two certificates in 2011 that allowed their owners to impersonate any *.google.com site. And I'm here to let you know you can go right ahead and delete TURKTRUST from your browser without worrying you'll ever need it.

This useful bit of information is courtesy of "Nasko" at netsekure.org, who did a survey in 2010 of the most commonly used certificate authorities on the web. This was in order to reduce his attack surface, since we've seen a steady stream of CA (certificate authority) compromises over the years, and if you don't trust a CA in the first place, you can't be fooled by their fraudulent certificates.

His surprising results were that you only need about 25 CA's out of the hundreds that browsers trust by default. His survey queried the top 1 million most popular sites according to Alexa, so you can be pretty sure he didn't miss much of the web.

What's more, I actually implemented his findings, deleting all but the those 25 from my own browser. And after several months of (heavy) browsing, I can tell you I've never once run into a problem.

After the jump, my revelations on the bigger picture I learned through this experiment.

Update: A billion views.

Well, it happened. Since becoming the most viewed video ever over Thanksgiving, Gangnam Style gathered 200 million views in under a month to become the first Youtube video ever with more than a billion views. Man. Remember when a million views was a lot?

Oh, and the bonus is that a couple weeks ago, some people started passing around a supposed Nostradamus prediction that could be interpreted as saying the world will end when Gangnam Style gets a billion views. The prophesy included hints at Korea, the horse dance, and the nine zeros in 1 billion. And when I saw that, I realized that the video was on track to a billion views right around Dec 21st, which was only too perfect. And now it did happen on the 21st! Right at noon. Extra bonus Apocalypse points.

Fake Morgan Freeman turns out to have the sanest comment on the shooting

This has been making the rounds on Facebook, misattributed to Morgan Freeman (because nothing on Facebook can occur without some misinformation propagated by the gullible). Turns out it comes from some Facebook user named Mark, but it's just as sensible a comment on this whole circus.

"You want to know why. This may sound cynical, but here's why.
It's because of the way the media reports it. Flip on the news and watch how we treat the Batman theater shooter and the Oregon mall shooter like celebrities. Dylan Klebold and Eric Harris are household names, but do you know the name of a single victim of Columbine? Disturbed people who would otherwise just off themselves in their basements see the news and want to top it by doing something worse, and going out in a memorable way. Why a grade school? Why children? Because he'll be remembered as a horrible monster, instead of a sad nobody.

CNN's article says that if the body count "holds up", this will rank as the second deadliest shooting behind Virginia Tech, as if statistics somehow make one shooting worse than another. Then they post a video interview of third-graders for all the details of what they saw and heard while the shootings were happening. Fox News has plastered the killer's face on all their reports for hours. Any articles or news stories yet that focus on the victims and ignore the killer's identity? None that I've seen yet. Because they don't sell. So congratulations, sensationalist media, you've just lit the fire for someone to top this and knock off a day care center or a maternity ward next.

You can help by forgetting you ever read this man's name, and remembering the name of at least one victim. You can help by donating to mental health research instead of pointing to gun control as the problem. You can help by turning off the news."

Best argument for Google ever

You can guess which one's Google.