k

Smart Heat Pumps: A Look at the Future of Home Heating

One innovation leading the way in home comfort and efficiency is an air-to-water monobloc heat pump, which offers a blend of efficiency, sustainability, and cutting-edge technology.




k

Three Ways Contractors Can Make High-End Furnaces ‘Sell Themselves’

If contractors in colder climates focus on educating their customers on what new higher-efficiency furnaces bring to the table, often times the furnaces will sell themselves.




k

Judge Overturns Berkeley Gas Infrastructure Ban

The decision is a win for the California Restaurant Association, which challenged the ban that took effect in 2020. The city has not decided whether to appeal.




k

How a Condensing Gas Furnace Works

Taking a look at the major concerns around replacing an 80% furnace with a high-efficiency one such as venting requirements, drilling extra holes, and financial costs.




k

Ted Cruz Gives DOE Furnace Rule Pushback

U.S. Senator Ted Cruz is leading the charge to assist HVAC contractors in pushing back on the final rule on gas furnace efficiency standards from the U.S. Department of Energy (DOE).




k

How a Fan Center Works

For technicians who run across older furnaces where air conditioners were later added, it pays to know how a fan center operates.




k

Risks Digest 34.35

Posted by RISKS List Owner on Jul 11

RISKS-LIST: Risks-Forum Digest Thursday 11 Jun 2024 Volume 34 : Issue 35

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.35>
The current issue can also be found at
<...




k

Risks Digest 34.36

Posted by RISKS List Owner on Jul 21

RISKS-LIST: Risks-Forum Digest Sunday 21 Jul 2024 Volume 34 : Issue 36

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.36>
The current issue can also be found at
<...




k

Risks Digest 34.37

Posted by RISKS List Owner on Jul 25

RISKS-LIST: Risks-Forum Digest Thursday 25 Jul 2024 Volume 34 : Issue 37

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.37>
The current issue can also be found at
<...




k

Risks Digest 34.38

Posted by RISKS List Owner on Jul 29

RISKS-LIST: Risks-Forum Digest Monday 29 Jul 2024 Volume 34 : Issue 38

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.38>
The current issue can also be found at
<...




k

Risks Digest 34.39

Posted by RISKS List Owner on Aug 03

RISKS-LIST: Risks-Forum Digest Saturday 3 Aug 2024 Volume 34 : Issue 39

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.39>
The current issue can also be found at
<...




k

Risks Digest 34.40

Posted by RISKS List Owner on Aug 14

RISKS-LIST: Risks-Forum Digest Wednesday 14 Aug 2024 Volume 34 : Issue 40

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.40>
The current issue can also be found at
<...




k

Risks Digest 34.41

Posted by RISKS List Owner on Aug 24

RISKS-LIST: Risks-Forum Digest Saturday 24 Aug 2024 Volume 34 : Issue 41

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS
(comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats,
etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.41>
The current issue can also be found at
<...




k

Risks Digest 34.42

Posted by RISKS List Owner on Aug 26

RISKS-LIST: Risks-Forum Digest Monday 26 Aug 2024 Volume 34 : Issue 42

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.42>
The current issue can also be found at
<...




k

Risks Digest 34.43

Posted by RISKS List Owner on Aug 29

RISKS-LIST: Risks-Forum Digest Thursday 29 Aug 2024 Volume 34 : Issue 43

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.43>
The current issue can also be found at
<...




k

Risks Digest 34.44

Posted by RISKS List Owner on Sep 08

RISKS-LIST: Risks-Forum Digest Sunday 8 Sep 2024 Volume 34 : Issue 44

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.44>
The current issue can also be found at
<...




k

Risks Digest 34.45

Posted by RISKS List Owner on Sep 14

RISKS-LIST: Risks-Forum Digest Saturday 14 Sep 2024 Volume 34 : Issue 45

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.45>
The current issue can also be found at
<...




k

Risks Digest 34.46

Posted by RISKS List Owner on Oct 01

RISKS-LIST: Risks-Forum Digest Tuesday 1 Oct 2024 Volume 34 : Issue 46

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.46>
The current issue can also be found at
<...




k

Risks Digest 34.47

Posted by RISKS List Owner on Oct 17

RISKS-LIST: Risks-Forum Digest Thursday 17 Oct 2024 Volume 34 : Issue 47

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.47>
The current issue can also be found at
<...




k

Risks Digest 34.48

Posted by RISKS List Owner on Nov 08

RISKS-LIST: Risks-Forum Digest Friday 8 Nov 2024 Volume 34 : Issue 48

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.48>
The current issue can also be found at
<...




k

How to make a minimal HTTPS request with ncat --ssl with explicit HTTP content?

Posted by Ciro Santilli OurBigBook via dev on Sep 17

Hello, I was trying for fun to make an HTTPS request with explicit hand-written HTTP content.

Something analogous to:

printf 'GET / HTTP/1.1 Host: example.com ' | ncat example.com 80

but for HTTPS. After Googling one of the tools that I found that seemed it might do the job was ncat from the nmap
project, so I tried:

printf 'GET / HTTP/1.1 Host: example.com ' | ncat --ssl example.com 443

an that works...




k

[PATCH 0/1] Improved the legibility of Makefile

Posted by Ariel Otilibili on Sep 17

Hello committers,

The same patch is on this PR: https://github.com/nmap/nmap/pull/2938

Have a good weekend,
Ariel

Ariel Otilibili (1):
Improved the legibility of `Makefile`

Makefile.in | 14 +++-----------
1 file changed, 3 insertions(+), 11 deletions(-)




k

[PATCH 1/1] Improved the legibility of `Makefile`

Posted by Ariel Otilibili on Sep 17

* source files obtained by a wildcard
* headers and objects generated by differences.

```
$ grep -P '(SRCS|HDRS|OBJS) =' Makefile.in |
sed -e 's/^export.*= //g; s/$.*//g; s/OBJS = //' |
sed -ne '2p' |
tr ' ' ' ' |
sed -e 's/.h//' |
sort -d |
grep -vP '^$' > headers

$ grep -P '(SRCS|HDRS|OBJS) =' Makefile.in |
sed -e...




k

CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management

Posted by CISA on Mar 21

Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow

You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated, and is now available.

CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management [...




k

PRANA Hack and Leak Report Release

Posted by Dave Aitel via Dailydave on Aug 02

Cordyceps Analysis Report on PRANA Network Hack and Leak Operation:
https://docs.google.com/document/d/1oOJbBTUwyK85ZKYAAdwWqxk-sMvqrBqzJYX1oziTFu4/edit?usp=sharing

Lately I've been reading a lot of academic papers, mostly the Research
Handbook on Cyberwarfare
<https://www.elgaronline.com/edcollchap/book/9781803924854/book-part-9781803924854-6.xml>.
Some of them are good papers! JD Work has a paper in it! But also some of
them get...




k

"Exploitation Less Likely"

Posted by Dave Aitel via Dailydave on Aug 12

DefCon is a study in cacophony, and like many of you I'm still digging
through my backlog of new research in multifarious browser tabs, the way a
dragonfly keeps track of the world through scintillated compound lenses. In
between AIxCC (which proved, if anything, the boundaries
<https://dashboard.aicyberchallenge.com/collectivesolvehealth> of automated
bug finding using current LLM tech?), James Kettle's timing attack research...




k

Re: "Exploitation Less Likely"

Posted by Don A. Bailey via Dailydave on Aug 13





k

Re: "Exploitation Less Likely"

Posted by Dave Aitel via Dailydave on Aug 13

https://github.com/CloudCrowSec001/CVE-2024-38077-POC/blob/main/CVE-2024-38077.md
https://github.com/Wlibang/CVE-2024-38077/blob/main/One%20bug%20to%20Rule%20Them%20All%2C%20Exploiting%20a%20Preauth%20RCE%20vulnerability%20on%20Windows%20(2024_8_9%2010_59_06).html

But while you are at it, always good to watch a video for no reason:
https://www.youtube.com/watch?v=mVXrl4W1jOU

-dave




k

Old Infosec Talks: Metlstorm's Take on Hacky Hacking

Posted by Dave Aitel via Dailydave on Oct 31

The Anatomy of Compromise

One of my demented hobbies is watching old infosec talks and then seeing
how well they hold up to modern times. Recently I excavated Metlstorm's
2017 BSides Canberra
<https://www.youtube.com/watch?v=OjgvP9UB9GI&list=TLGGvAY1CcIr-AcyNjEwMjAyNA>
talk on "How people get hacked" - a pretty generic topic that gives a lot
of room for opinion, and one a lot of people have opined on, but the talk
itself...




k

Hacking the Edges of Knowledge: LLMs, Vulnerabilities, and the Quest for Understanding

Posted by Dave Aitel via Dailydave on Nov 02

[image: image.png]

It's impossible not to notice that we live in an age of technological
wonders, stretching back to the primitive hominids who dared to ask "Why?"
but also continually accelerating and pulling everything apart while it
does, in the exact same manner as the Universe at large. It is why all the
hackers you know are invested so heavily in Deep Learning right now, as if
someone got on a megaphone at Chaos...




k

Episode 9: Remoting Pt.1 and Listener Feedback

This Episode as well as the next one take a look at remoting infrastructures such as CORBA, .NET Remoting or Webservices. In this first part we will take a look at why remote communication is necessary in the first place, what remoting middleware can do for you as well as which other middleware technologies exist in addition to OO-RPC systems, such as messaging middleware. Finally, we conclude with a brief overview of what the broker pattern can do for us in the context of remoting middleware.




k

Episode 11: Interview Gregor Kiczales

In this Episode we have the pleasure of talking with Gregor Kiczales. Gregor is one of the fathers of aspect-oriented programming (AOP). Today he is a professor of computer science at the University of British Columbia. Back in his days at Xerox Parc, he and a number of other people worked on the early forms of AOP as well as on some of its forerunners, such as meta object protocols. In this interview, we talk about a number of interesting topics, such as the history of AOP, the relationship of AO to interceptors, the industry acceptance of AOP, early aspects (i.e. using AO in development phased before implementation) as well as adoption strategies for AOP.




k

Episode 17: Feedback and Roadmap

This is a short episode that outlines the upcoming episodes and interviews, as well as reports on some listener feedback.




k

Episode 22: Feedback

This is an episode with some more of your feedback. Specifically, the episode also contains a 5 minute section from Geert Bevin where he explains how Continuations are used an implemented in the Rife Framework. This is in response to a discussion about continuations and Rife in Episode 15, Future of Enterprise Java. We also have some feedback from Bill Pugh about flaws in our description about the problems of double-checked locking in Java.




k

Episode 26: Interview Jutta Eckstein

In this Episode, Arno, Bernd and Markus interview Jutta Eckstein. Jutta is a pioneer and expert on using Agile software development, specifically in larger teams. In the interview we talk about the agile manifesto, the role of personal relationships and trust in software projects, differences between agility in the small and in the large, as well as offshoring.




k

Episode 39: Interview Steve Vinoski

This episode is an interview with Steve Vinoski. Steve works as the Chief Engineer for IONA. He's what you'd call a middleware guru, he was for example deeply involved with CORBA. So, this interview centers mainly around middleware. We begin by talking about his own history wrt. middleare and ORBs and how ORBs evolved over time. We then talked about whether coarse-grained, stateless components might be a better abstraction for distributed systems than "objects". We then covered the future of CORBA, it's use in ethe embedded space as well as the practical relevance of the POSA patterns when building ORBs. Then we switched topics and addressed the role of web services as a "middleware middleware" and the maturity of WS-* specifications. We then looked at what Steve is working on these days, which is e.g. the Advanced Message Queueing Protocol (AMQP) as well as dynamic languages. We concluded the interwiew with his view on SOA.




k

Episode 54: Interview Frank Buschmann

This episode is an interview with Frank Buschmann, one of the pioneers of the pattern movement in Europe. Michael and Frank discuss how it all began: the first conferences on patterns and the first publications by the Gang-of-Four and the POSA 1 team. Frank then elaborates on the new volumes in the Pattern-Oriented Software Architecture book series - POSA 4 and POSA 5 - and gives some examples from the books. The episode concludes with a general discussion on software design and architecture, and best practices on software development.




k

Episode 56: Sensor Networks

In this episode we discuss sensor networks with our guest Steffen Schaefer, who is the Technical Thought Leader for Sensors & Actuator Solutions at IBM. The discussion resolves around the TREC device, which can be mounted on containers to track them on their journey over seas, railway tracks and roads. The TREC is a small embedded device developed by Steffen's employer, IBM, that has various sensors and communications channels.

In the episode we first talked about container transport in general, and then looked at how the TREC device works - specifically, it's hardware, software and power management. We then looked at the necessary backend infrastructure. The main part of the discussion covered the communication between the device and the backend, using technologies such as Zigby, GSM and satellite communications. We also looked at the middleware infrastructures used, such as the MQtt messaging tool.

We closed the episode with a little discussion of the "Internet of Things" and some discussion about embedded software devleopment in general. Note that SE Radio will feature more embedded topics in the future - an introduction to embedded development will be put online soon.




k

Episode 62: Martin Odersky on Scala

In this Episode we talk about the Scala language with its creator Martin Odersky. Scala is a language that fuses object oriented and functional programming. Martin started out by providing a two-minute overview over the language, and then talked a little bit about its history. We then discussed the basics of functional programming. The main part of the episode features a discussion of some of the important features of the Scala language:

  • Case Classes and Pattern Matching
  • Multiple Inheritance and Compound Types, Traits, Mixins
  • Closures
  • Functions as types, "Function pointers", Anonymous functions
  • Higher Order Functions
  • Currying
  • (Sequence) Comprehensions
  • Generics
  • Type Bounds (Upper, Lower)
  • Static/Dynamic Typing, Type Inference
  • Operators
  • Implicits
We then talked about Scala's actors library, a highly scalable concurrency package. The last part of the episode covered some more general topics, such as where and how Scala is used today, IDE support and the user and developer community. We concluded the episode by looking at current development and next steps in Scala language evolution.




k

Episode 64: Luke Hohmann on Architecture and Business

In this episode we talk about the relationship between software architecture and the business. Based on his book, Beyond Software Architecture we discuss how things such as branding, licensing, updating or different deployment scenarios influence the technical architecture of a system. We also discuss issues such as portability that add a huge amount of complexity, although from a business perspective it often does not make much sense. In the second part of the interview we discuss how the technical team and the business team can improve the way they work together. We look at some of the games (such as Buy a Feature or Give them a Hot Tub) from his new book Innovation Games, which discusses how to use collaborative play to be more creative and innovative in product creation.




k

Episode 72: Erik Meijer on LINQ

This episode is a discussion with Erik Meijer on LINQ. This is a relatively technical discussion about the following topics: what is LINQ, what are the common abstractions between the different data structures one can access with LINQ, what is the relationship to established languages for querying, how does the integration into the type system of the host language work, how to specify the mapping between the language level classes and the data, and how optimizations are implemented (lazy loading, prefetching, etc.).




k

Episode 80: OSGi with Peter Kriens and BJ Hargrave

This episode is about OSGi, the dynamic module system for Java. Our guests are Peter Kriens (OSGI's Technical Director) and BJ Hargrave (OSGI's CTO). We'll discuss what OSGi is all about and why and in which contexts it is useful. Additionally we are having a look at the different layers of OSGI and where and how they are used. Other questions discussed are: What means dynamicity in an OSGI environment? Where is OSGI used? What’s the future of OSGI? How does OSGI interact with existing middleware solutions? How can I run several versions of the same JAR at the same time? Where are OSGI’s problems?




k

Episode 84: Dick Gabriel on Lisp

In this Episode we're talking with Dick Gabriel on Lisp. We started by looking at artificial intelligence as the historic context of Lisp, the goals AI tried to reach, and how Lisp was supposed to help reach those. We then discussed the language itself, starting with the Data As Program / Program As Data concept that is a foundation for Lisp. Then we discussed adding a meta-circular interpreter, programming as language development, and the blurred boundary between language and frameworks (because everything uses the same syntax). We then talked about Lisp's type system and the importance of macros to extend the language. The next section concerned CLOS, the Common Lisp Object System and its important concepts: generic functions, multimethods, mixins, and method combination. We also briefly looked at the meta-object protocol but agreed this is a topic for a separate episode. After a discussion about the various dialects of Lisp and Scheme, we concluded the Lisp discussion by explaining why Lisp did not really catch on ("AI Winter") and Lisp's role in today's industry. We ended the episode with a couple of details about Dick's other life as a poet and his Poem a Day effort. Make sure you listen till the end, where we have added a song about Lisp (courtesy of Prometheus Music.)




k

Episode 90: Product Line Engineering, Pt. 3, with Charles Krueger

In this episode Charles Krueger, a well-known member of the product line engineering community, talks about his long term experiences in the field. Charles is also the founder and CEO of a company that provides tooling for variability management and product derivation. Besides some clarifications on terms like product line architecture and reference architecture, you also learn what kind of preconditions need to exist before product line engineering can be applied successfully.




k

Episode 91: Kevlin Henney on C++

In this episode, we talk with Kevlin Henney about the C++ programming language. We look at the history and the culture of the language, and how it went through several phases in its evolution. We also take a look at some of the special language features of C++ and their overall influence.




k

Episode 93: Lessons Learned From Architecture Reviews with Rebecca Wirfs-Brock

In this episode, Markus talks to Rebecca Wirfs-Brock on what she has learned from architecture reviews. This is a very complement to the earlier episode on architecture evaluation.




k

Episode 94: Open Source Business Models with Dirk Riehle

In this episode we're talking to Dirk Riehle about open source business models. We started looking at the way OS projects work and defined different kinds of open source projects. In the main part of the discussion we looked at various ways of how to make money with open source: consulting, support contracts, commercial variant of an open source project, etc. We then looked at the chances and risks of each of these approaches. The next part focused on different open source licenses and how they are suitable for open source business. We concluded the episode by discussing a couple of specific questions and loose ends. After the show, Dirk informed me about the following three corrections: Black Duck Software's main product is called protexIP not IP Central, there are presently 70 licenses approved by the Open Source Initiative, and EnterpriseDB has so far acquired $37M in venture capital




k

Episode 95: The New Guardian.co.uk website with Matt Wall and Erik DoernenBurg

In this episode we talk to Matthew Wall (Guardian News and Media) and Erik Doernenburg (Thoughtworks) about their work on the new guardian.co.uk website. We discuss the challenge of scalability and interactivity, their use of Domain Driven Design, some of the technical building blocks as well as the approaches they use for performance measuring and scalability tuning.




k

Episode 96: Interview Krzysztof Czarnecki

This episode is the long-awaited (and much requested) interview with Krzysztof Czarnecki, the author, together with Ulrich Eisenecker, of the book Generative Programming. In the interview we discussed the state of generative programming today and related it to model-driven development and DSLs. We then talked a little bit about product lines in general. We then discussed his current field of research, which currently focusses on framework-specific modeling languages and non-trivial roundtrip engineering.




k

Episode 98: Stefan Tilkov on REST

In this episode we discuss REST (Representational State Transfer) with Stefan Tilkov. We started out by discussing the 5 steps to REST: IDs, links, Standard Methods, multiple representations and stateless communication. We then looked at how to use HTTP for REST, and discussed about how to use it for Web Services. We then we discussed whether and how to use REST for enterprise applications, and not just for apps on the internet. We concluded the discussion with a couple of recommendations.