&

2023 Dealer Design Awards: Contractor Services & Software

The Gold award goes to a new computer application designed to help technicians save time and money and provide efficient HVAC equipment installation and diagnostics.




&

Hear How Lavender AC & Heating Boosted Growth By 100%

Struggling to grow revenue past $500K, Lavender transformed their operations with Sera, the all-in-one FSM solution.




&

2024 Dealer Design Awards: Contractor Services & Software

The gold winner can service, certify, and ship a combustion analyzer the same day it’s received.




&

AI and 'Ask A2L'

Artificial intelligence and HARDI’s new AI tool were big topics during the group’s recent Focus conference in Dallas, Texas.




&

Four Ways Software Can Help With the Labor Shortage & How to Maximize It

Software can increase productivity, better manage labor, encourage retention, and keep things consistent and organized. But it’s up to HVACR contractors to choose the right software and take the proper stops to implement it.




&

Luxaire®, a brand of Johnson Controls: Rooftop Unit Line

These products are designed to serve both the new construction and replacement markets.




&

Manager Named for Contractor's New Dayton, Ohio, Branch

Daniel Truxillo, the general manager of the Dayton, Ohio, branch of Thomas & Galbraith Heating, Cooling & Plumbing, has a long history of success in the home-services industry and got his start as an HVACR technician nearly two decades ago.




&

LeakSmart®: Water Flow Monitoring

This product provides water flow analytics and monitors and controls the home’s water activity — from in-wall to appliance leaks.




&

HVAC Q&A Episode 3: What Contractors Need To Know About RDS Field Installs

Since A2L refrigerants are designated as mildly flammable, safety features like refrigerant detection systems (RDSs) are being incorporated into new residential/light commercial ducted split systems that contain more than 4 pounds of A2L refrigerant. Here’s what HVAC technicians need to know about installing those RDS in the field.




&

Lessons Learned From CO<sub>2</sub> Refrigeration Installations

In an informative session at the NASRC’s Sustainable Refrigeration Summit, Publix and Coborn’s shared the pros and cons of incorporating CO2 refrigeration systems into their stores.




&

Bed Bath & Beyond Accused of Turning Off Air Conditioning to Cut Costs

Preventive maintenance and proper setbacks can save a business money while keeping staff and customers comfortable.




&

Air Force Veteran Wins HVAC Contractor's A/C Giveaway

Don Kuhl, a U.S. Air Force veteran and civil servant, secured the most public votes and won an a/c unit in the giveaway, which honors the sacrifices of local veterans, active-duty service members, and their families.




&

HVAC Industry Victory Against EPA Cylinder Ban 'Official'

“While the recent news is a formality, it makes the victory over these burdensome regulations official."




&

Cooper&Hunter and Tropic Supply Team Up to Donate HVAC Systems

In collaboration with Tropic Supply, Cooper&Hunter has gifted Daytona State College with six complete HVAC systems, considering the donation as a useful investment in the next generation. The on-campus working stations, which include units from Cooper&Hunter’s modern “Sophia Mini-Split Single Zone Series,” will give students hands-on learning opportunities with technology that is becoming increasingly popular in the U.S.




&

Access Inc. Joins Johnson Controls-Hitachi Manufacturers' Sales Rep Team

Access Inc. will be the new manufacturers' representative for Hitachi VRF systems and SmartFlex™ systems in eastern Michigan and Northwest Ohio




&

Cooper&Hunter: Single-Zone Mini-Split

The 25 SEER model is a wall mount unit with Wi-Fi capabilities, a silver ion filter, a cold catalyst filter, and a GoldFin anti-corrosive coating.




&

Better than Bubbles: The Ins & Outs of Electronic Leak Detectors

Soap bubbles have long been thought of as the standard method for leak detection, but times, and technology, are changing.





&

CVE-2024-52533: Buffer overflow in socks proxy code in glib < 2.82.1

Posted by Alan Coopersmith on Nov 12

Another CVE was issued by Mitre yesterday for another bug listed on
https://gitlab.gnome.org/Teams/Releng/security/-/wikis/home

https://gitlab.gnome.org/GNOME/glib/-/issues/3461 reports that:
"set_connect_msg() receives a buffer of size SOCKS4_CONN_MSG_LEN but it writes
up to SOCKS4_CONN_MSG_LEN + 1 bytes to it. This is because SOCKS4_CONN_MSG_LEN
doesn't account for the trailing nul character that set_connect_msg() appends...




&

Luxaire® Unitary Products: Package Equipment

This series of residential package equipment features energy-saving performance as well as cost-effective installation and maintenance.




&

2020 Dealer Design Awards: Testing & Monitoring Products

Badger Meter won Gold in the Testing and Monitoring category for its Dynasonics® TFX-5000 ultrasonic clamp-on meter, which measures volumetric flow and heating/cooling energy rates in clean liquids, as well as those with small amounts of suspended solids or aeration, such as surface water or raw sewage.




&

possible false positive for 'INDICATOR-SHELLCODE x86 setgid 0' can someone confirm

Posted by John via Snort-sigs on Oct 29

When I attempt to download the following xz file, my IPS blocks it with the below populating the snort log. I suspect
this is a false positive unless there is some code in the xz file that is truly malicious. Can someone with more
knowledge about the rule please comment?

Link to file that triggers the match:
http://fl.us.mirror.archlinuxarm.org/armv7h/extra/qt5-base-5.15.15%2Bkde%2Br136-1-armv7h.pkg.tar.xz

Entry from snort log:...




&

HVAC Q&A Episode 4: Overlooked Ways to Advertise Locally

Four marketing coaches share what makes an HVAC contractor stand out to potential customers.




&

Q&A: Does Building Automation Make a Difference in Air Quality?

Today’s commercial structures are full of sophisticated controls that have been changing building automation systems exponentially.




&

HVAC Q&A Episode 1: Common Heat Pump Installation Mistakes

What are the most common mistakes in heat pump installs, and how do you avoid them? Here’s what experts had to say about heat pump installation — a must-watch as electrification continues to gain momentum.




&

"Exploitation Less Likely"

Posted by Dave Aitel via Dailydave on Aug 12

DefCon is a study in cacophony, and like many of you I'm still digging
through my backlog of new research in multifarious browser tabs, the way a
dragonfly keeps track of the world through scintillated compound lenses. In
between AIxCC (which proved, if anything, the boundaries
<https://dashboard.aicyberchallenge.com/collectivesolvehealth> of automated
bug finding using current LLM tech?), James Kettle's timing attack research...




&

Re: "Exploitation Less Likely"

Posted by Don A. Bailey via Dailydave on Aug 13





&

Re: "Exploitation Less Likely"

Posted by Dave Aitel via Dailydave on Aug 13

https://github.com/CloudCrowSec001/CVE-2024-38077-POC/blob/main/CVE-2024-38077.md
https://github.com/Wlibang/CVE-2024-38077/blob/main/One%20bug%20to%20Rule%20Them%20All%2C%20Exploiting%20a%20Preauth%20RCE%20vulnerability%20on%20Windows%20(2024_8_9%2010_59_06).html

But while you are at it, always good to watch a video for no reason:
https://www.youtube.com/watch?v=mVXrl4W1jOU

-dave




&

Old Infosec Talks: Metlstorm's Take on Hacky Hacking

Posted by Dave Aitel via Dailydave on Oct 31

The Anatomy of Compromise

One of my demented hobbies is watching old infosec talks and then seeing
how well they hold up to modern times. Recently I excavated Metlstorm's
2017 BSides Canberra
<https://www.youtube.com/watch?v=OjgvP9UB9GI&list=TLGGvAY1CcIr-AcyNjEwMjAyNA>
talk on "How people get hacked" - a pretty generic topic that gives a lot
of room for opinion, and one a lot of people have opined on, but the talk
itself...




&

Episode 121: OR Mappers with Michael Plöd

In this episode, Michael Plöd is interviewed about Object-Relational Mapping technology. He talks about the common concepts, compares the range of different tools that go by this name, and goes into the design and architectural consequences of using an OR mapper.




&

Episode 155: Johannes Link & Lasse Koskela on TDD

In this episode Johannes Link interviews Lasse Koskela - the author of "Test-Driven" - about test-driven development (TDD). We cover the basics, the rationale behind it and the challenges you face when doing it in more difficult environments.




&

Episode 200: Markus Völter on Language Design and Domain Specific Languages

For Episode 200 of Software Engineering Radio, Diomidis Spinellis interviews Markus Völter, the podcast’s founder. Markus works as an independent researcher, consultant, and coach for itemis AG in Stuttgart, Germany. His focus is on software architecture, model-driven software development and domain specific languages as well as on product line engineering. Markus also regularly publishes articles, […]




&

SE-Radio-Episode-234:-Barry-O'Reilly-on-Lean-Enterprise




&

SE-Radio Episode 240: The Groovy Language with Cédric Champeau




&

SE-Radio Epislode 250: Jürgen Laartz and Alexander Budzier on Why Large IT Projects Fail

Alex Budzier of the Oxford Saïd Business School and Jürgen Laartz of McKinsey Berlin join Robert Blumen to talk about the their research on large IT project failures. Why do large projects fail and to what extent are these failures avoidable?




&

SE-Radio-Episode-267-Jürgen-Höller-on-Reactive-Spring-and-Spring-5.0

Eberhard Wolff talks with Jürgen Höller about Reactive Spring. Reactive programming is a hot topic, but adoption has been slow in the enterprise. Spring 5 incorporates Reactor and the RxJava API to help Java developers build scalable high-performance web applications. The discussion explores architectural challenges, transactions, porting existing applications, and increased code complexity.




&

SE-Radio-Episode-276-Björn-Rabenstein-on-Site-Reliability-Engineering

Björn Rabenstein discusses the field of Site Reliability Engineering (SRE) with host Robert Blumen. The term SRE has recently emerged to mean Google's approach to DevOps. The publication of Google's book on SRE has brought many of their practices into more public discussion. The interview covers: what is distinct about SRE versus devops; the SRE focus on development of operational software to minimize manual tasks; the emphasis on reliability; Dickerson's hierarchy of reliability; how reliability can be measured; is there such a thing as too much reliability?; can Google's approach to SRE be applied outside of Google?; Björn's experience in applying SRE to Soundcloud - what worked and what did not; how can engineers best apply SRE to their organizational situation?; the importance of monitoring; monitoring and alerting; being on call, responding to incidents; the importance of documentation for responding to problems; they wrap up with a discussion of why people from non-computer science backgrounds are often found in devops and SRE.




&

SE-Radio Episode 290: Diogo Mónica on Docker Security

Docker Security Team lead Diogo Mónica talks with SE Radio’s Kim Carter about Docker Security aspects. Simple Application Security, which hasn’t changed much over the past 15 years, is still considered the most effective way to improve security around Docker containers and infrastructure. The discussion explores characteristics such as Immutability, the copy-on-write filesystem, as well as orchestration principles that are baked into Docker Swarm, such as mutual TLS/PKI by default, secrets distribution, least privilege, content scanning, image signatures, and secure/trusted build pipelines. Diogo also shares his thoughts around the attack surface of the Linux kernel; networking, USB, and driver APIs; and the fact that application security remains more important to focus our attention on and get right.




&

SE-Radio Episode 321: Péter Budai on End to End Encryption

Péter Budai and Kim Carter discuss End to End Encryption (E2EE), backdoors, the scenarios where E2EE can be and should be used. IM, VoIP, Email scenarios, interservice communication scenarios such as securing data in use.




&

SE-Radio Episode 333: Marian Petre and André van der Hoek on Software Design.mp3

Felienne interviews Marian Petre & André van der Hoek on their book ‘Software Design Decoded’, which contains 66 scientifically backed insights for the design process.




&

SE Radio Episode 342 - István Lam on Privacy by Design with GDPR

István Lam of Tresorit talks with host Kim Carter about GDPR (the EU General Data Protection Regulation, which has been described as “the most important change in data privacy regulation in 20 years.”)  The discussion covers terminology, planning, implementation, users' rights regarding their personal data, managing personally identifiable information (PII) across an organization, and required documentation. István talks about establishing the intent of different types of PII; when data can be shared or sold, when PII can be stored; storage of backups, and the ability to reveal, modify, or remove all of a customer's PII.




&

Episode 351 - Bernd Rücker on Orchestrating Microservices with Workflow Management

Bernd Rücker, who has contributed to multiple open source workflow management projects, discusses orchestrating microservices with workflow management.  As distributed systems evolve into a family of microservices that must handle long-running stateful processes with time-dependent actions, events, multiple paths through the system, and complex rollbacks, the workflow management model provides a way to ensure clear modeling, correctness, and separation of concerns.   Rücker recommends a federated model in which each microservice is paired with its own workflow to handle retries and other policies and failure modes around that service.  Robert Blumen spoke with Rücker about microservice architecture, event-driven systems, long-running stateful processes versus synchronous request/response, event handling, time-outs, and handling exceptional conditions with compensating transactions. Rücker compares the choreography versus orchestration models for collaboration and discusses why orchestration provides a better separation of concerns.  The discussion delves into the implementation of workflow management systems including persistence, scaling, event handling, timers and scheduling, and similarities to CQRS.  The discussion wraps up with monitoring and visualization.




&

Episode 389: Ryan Singer on Basecamp's Software Development Process

Ryan Singer on Basecamp’s “Shape Up” software development process. Basecamp has ditched the backlog and 2-week sprint in favor of solution “shaping” and strategic 6-week projects, using tools like scope mapping, checklists, and hill charts to understand and reduce risk.




&

Episode 508: Jérôme Laban on Cross Platform UI

Jérôme Laban, CTO of Uno Platform, joined host Jeff Doolittle for a conversation about Cross-platform User Interfaces. The conversation addressed the unique challenges and possibilities related to applications designed to run on multiple platforms...




&

SE Radio 588: José Valim on Elixir, Machine Learning, and Livebook

José Valim, creator of the Elixir programming language, Chief Adoption Officer at Dashbit, and author of three programming books, speaks with SE Radio host Gavin Henry about what Elixir is today, what Livebook is, the five spearheads of the new machine learning ecosystem for Elixir, and how they all fit together. Valim describes why he created Elixir, what “the beam” is, and how he pitches it to new users. This episode examines things you can do with Livebook and how it is well-aligned with machine learning, as well as why immutability is important and how it works. They take a detailed look at a range of topics, including tensors with Nx, traditional machine learning with Scholar, data munging with Explorer, deep learning and neural networks with Axon, Bumblebee and Huggingface, and model creation basics. Brought to you by IEEE Computer Society and IEEE Software magazine.




&

SE Radio 597: Coral Calero Muñoz and Félix García on Green Software

Coral Calero Muñoz and Felix Garcia, professors at the University of Castilla-La Mancha, speak with host Giovanni Asproni about green and sustainable software—an approach to software development aimed at creating software systems that consume less energy and produce less CO2 during their entire lifetimes with minimal impact on their functionality and other qualities. The episode starts by describing why green software matters, particularly in the context of global warming, and introducing the key concepts. Continues discussing the current status of the field, in both academia and industry, and finishes with hints and tips that can be readily applied by development teams to make their systems greener. Brought to you by IEEE Computer Society and IEEE Software magazine.




&

SE Radio 615: Kent Beck on "Tidy First?"

Kent Beck, Chief Scientist at Mechanical Orchard, and inventor of Extreme Programming and Test-Driven Development, joins SE Radio host Giovanni Asproni for a conversation on software design based on his latest book "Tidy First?". The episode starts with exploring the reasons for writing the book, and introducing the concepts of tidying, cohesion, and coupling. It continues with a conversation about software design, and the impact of tidyings. Then Kent and Giovanni discuss how to balance design and code quality decisions with cost, value delivered, and other important aspects. The episode ends with some considerations on the impact of Artificial Intelligence on the software developer's job. Brought to you by IEEE Software and IEEE Computer Society.




&

SE Radio 618: Andreas Møller on No-Code Platforms

Andreas Møller, founder of Toddle, a no-code tool for building scalable performant web applications, speaks with SE Radio's Brijesh Ammanath about no-code platforms. They discuss the role of developers in a no-code ecosystem and explore scalability and performance considerations, as well as enterprise adoption of no-code tools. Andreas also expands on why he built Toddle.dev and its unique features. Brought to you by IEEE Computer Society and IEEE Software.




&

SE Radio 630: Luis Rodríguez on the SSH Backdoor Attack

Luis Rodríguez, CTO of Xygeni.io, joins host Robert Blumen for a discussion of the recently thwarted attempt to insert a backdoor in the SSH (Secure Shell) daemon. OpenSSH is a popular implementation of the protocol used in major Linux distributions for authentication over a network. Luis describes how a backdoor in a supporting library was recently discovered and removed before the package was published to stable releases of the Linux distros. The conversation explores the mechanism of the attack through modifying a function table in the runtime; how the attack was inserted during the build; how the attack was carefully staged in a series of modifications to the lz compression library; the nature of “Jia Tan,” the entity who committed the changes to the open source project; social engineering that the entity used to gain the trust of the open source community; what forensics indicates about the location of the entity; hypotheses about whether criminal or state actors backed the entity; how the attack was detected; implications for other open source projects; why traditional methods for detecting exploits would not have helped find this; and lessons learned by the community.

Brought to you by IEEE Computer Society and IEEE Software magazine.




&

Sacred Sustenance

Fifty years ago, the Boldt decision reaffirmed Indigenous fishing rights and recognized tribes as equal partners in resource management.