CST 373 Week 2

Scrapbook 2 - Cloudflare Bug Exposes Unintended Information

Massive Bug May Have Leaked User Data From Millions of Sites. So … Change Your Passwords by Lily Hay Newman of Wired (PDF archive)

Summary

Many large name websites, like Fitbit, Uber, and OkCupid, were utilizing Cloudflare's SSL certificates for their website security. Cloudflare had a major vulnerability exploited that caused requested endpoints to return additional data in the response from other websites. Cloudflare acts as a middleman when performing requests. So, when a request is made to a website behind Cloudflare, it passes through Cloudflare at the time of the request and at the response. The bug exploited from requests that returned HTML and the issue was in their parser. If a website response was HTML and there were mismatched HTML tags, Cloudflare would incorrectly parse the HTML and return additional information from its cache. This cache could contain any set of data from any other request. While the results could vary, they were cached in search engines like Google and Bing. Cloudflare worked quickly to resolve the bug, but the data was still cached for some period of time in these websites (or search engines) that scrape website information. This was a very serious issue that may have impacted a large number of users.

Reason Chosen

The Cloudflare "Cloudbleed" vulnerability was very big news recently and really highlighted the issue of using a third-party service to take care of a website's security. The impact was also large and they were unsure of who all would be impacted by this.

At my work, particularly, we had clients that were utilizing this service and it sent some of my coworkers into a bit of a frenzy. Not all of our clients use this service so it didn't impact many of us but it was extremely relevant and discussed a lot. It was also a good reminder to really take into consideration what third-party services are being used for and if using them is really in the best interest of the website users.

Ethical Implications and Personal and Social Values at Stake

This situation highlights the kinds of problems that can occur outside of the scope of a single code base when relying on third-party providers to handle security for your website. As a company needing to handle SSL certificates, passing this responsibility off to another is an ethical issue when one needs to be concerned about protecting their user data. Users are trusting the websites they utilize to do this and do it well. It's troubling to know that so many websites were utilizing this feature and that such a small issue can cause such a large problem for individual people.

This GitHub Gist has a list of websites that were using Cloudflare and it was recommended that users change their passwords for all of them.

Source Credibility

Wired is a well-known, technology-focused magazine based in San Francisco, California that has been active since 1993. They provide detailed articles surrounding relevant issues in technology.

Lily Hay Newman is a Security Staff Writer for Wired and has previously worked at other notable magazines and news organizations.

CST 373 Week 1

Scrapbook 1 - Are They Listening?

Can Alexa help solve a murder? Police think so — but Amazon won’t give up her data. by Amy B. Wang of The Washington Post (PDF archive)

Summary

A suspected homicide took place in a home equipped with smart devices. Among these devices was an Amazon Echo device. Authorities seized the device from the home and served Amazon with a warrant to obtain any recordings from the device, citing that they expect Amazon to host recording from the device that may provide assistance in the case. Amazon claims that they only keep recordings that consist of the command that the device hears. These recordings begin with the specified trigger word, "Alexa". They also claim that the user can delete the recordings through their smartphone application and while they're always listening, they don't record any additional information.

Reason Chosen

This situation highlights something close to me, as I have Amazon Echo products in my home. I keep one in my living room and another in the bedroom. They're used adjust the lights (on/off/dim) in each of the rooms. This article came out shortly after I had purchased the first product and it was a little worrisome. I was not worried because I was going to plan a murder but because of the other implications that it could have. Some of us don't see our daily activities as something to guard as private and other do. However, I live with my boyfriend and owning one wasn't just a decision to make for myself, but for him too. It's worth spending an additional moment to consider who else could be impacted by these purchases and if they would be okay with it.

Ethical Implications and Personal and Social Values at Stake

While this article was primarily focused on the police attempting to use a warrant to gain recordings from the Amazon Echo device, I'd like to place more attention on Amazon themselves and if what they claim is true regarding how they store the recordings.

Amazon claims that they only store the commands that are initiated with the trigger word, "Alexa" and that the owner of the product can delete recordings from their Amazon Echo application. There are a few moving pieces in this claim. First, the software for the product is closed-source and we don't know how Amazon is actually handling the data (sound processed in the cloud). We are completely relying on their claims. Because we can't verify how our data is being handled, we can't guarantee that the recordings are actually deleted when the user requests that they are not actually storing additional information.

Many people purchasing these products are unfamiliar with how "the cloud" works and that it is used at all with these products. They may feel differently about them if they knew that everything they said was being transmitted to a server outside of their home for processing, or understanding what you said and saying something in response. Once their data leaves their network, they no longer have control over it and can't guarantee the safety of it. They're trusting Amazon to handle their data respectfully and do anything malicious with it.

What's interesting to consider is if and how this should be handled. Is it okay to have so many products, in our own homes, listening? Could or should this be regulated? How do we know who we can trust? Perhaps there could be some sort of required warning about it? We don't have the answers but this is definitely pushing us into a new direction.

Source Credibility

The Washington Post is a well-known news source and is primarily circulated in Washington, DC. The author is a legitimate full-time journalist with The Washington Post. It is notable, and noted within the article itself, that the owner of The Washington Post is the chief executive of Amazon. However, this point does not diminish the value of my analysis.

CST 370 Week 8

Week 8

Phew! What a course! As we wrap up the final week, I'm very glad we've completed the course and are on to the next one (CST 373 Ethics in Communication and Technology). I've been looking forward to our next course for a while now because I really enjoyed the quick look into ethics in our first Proseminar course. I hope it lives up to my expectations.

As for this current course, we covered graphs this week. I'm sure we just covered the tip of the iceberg since we have a shorter week with only one homework assignment. The content covered in-order, pre-order, and post-order tree traversals, edge lists, adjacency matrices, and Dijkstra's algorithm. Throughout the course we've been watching videos from My Code School and they've been very helpful. I liked the emphasis this week regarding the trade offs between using an edge list and a adjacency matrix for storing a graphs. It's good to consider that an adjacency matrix will take up a lot more space and an edge list has a large lookup time. Those are very valid things to consider when working on larger systems.

The final has not yet been released as of writing this. I wanted to get all of my course work done before the final release so I don't miss anything. I expect to do well, especially since it's a programming assignment but you never really know...

Overall, I've really enjoyed this course and have loved how organized it is. There were no surprises and the course maintained consistency. The modules seemed pretty evenly weighted but I think stacks and queues could be combined. I was already familiar with the topics so I didn't not end up seeking out much help, but the professor and TA both seemed very available and encouraged us to contact them when we needed help.

CST 370 Week 7

Week 7

This week we covered binary search trees. There was a lot of emphasis on recursion (Google it... it's fun!) in the programming assignment. A good portion of the assignments for the week covered in-order, pre-order, and post-order tree traversals. It appeared in both the homework and programming assignments.

The concepts for these are pretty straight forward. They all traverse the tree in a similar way and vary based on when the contents of the node are displayed. The images here show the same path and the point in the path when each value is printed for in-order and pre-order traversals. All of these algorithms use recursive functions, treating each node as the root of a tree, for their implementation.

Binary search trees are very neat and efficient for finding values (assuming it's properly balanced). Instead of looking through an entire list, you can just go through the depth of the tree.

As I'm writing this, our final module for the course has been released and, based on a quick look, we're on to graphs! I'm very excited to close out another course in this program and get one step closer to graduation. It's become much more difficult to maintain focus but I'm pulling through!

Here is my programming assignment for the week:

CST 370 Week 6

Week 6

I kept thinking that I'd get ahead this week in this course and place more focus on my discrete math class, but that hasn't happened so far. I think I need to just sit down and focus a little more. I am finding myself frequently distracted.... but we're in the last stretch and I need to keep my eyes on the goal (that's what I tell myself, at least)!

We continued with sorting algorithms this week and added binary searches to our little collection of tools. The assignments were straightforward and really not too bad, once you got going. We implemented a binary search, both iteratively and recursively, in our lab and a non-standard sorting algorithm in our program, which I walk through in the video below.

Overall, I'm happy with the way this course is going. I really appreciate the general structure and predictability. If this were the beginning of the program, I'd be a lot more into it but I'm feeling very run down this week and at this point in the program. The repercussions of doing an additional course each semester while working full time for this entire program are surfacing.

Here is my video of the programming assignment this week:

CST 370 Week 5

Week 5

We're on to sorting algorithms! This week we covered selection sort, bubble sort, insertion sort, and merge sort. I definitely feel like I have an advantage in this aspect because I've covered it so many times and I believe that I have a good handle on it. The homework was pretty straight forward and didn't feel like it came from left field, or another class, this time. I appreciated that. The programming assignment also remained on topic, since we implemented sorting algorithms ourselves.

We also had our midterm this past weekend. I wasn't very excited about it because of my big flop last week and my lack of discrete mathematics knowledge (which I am just barely enrolled in!). I was glad to see that the midterm wasn't so heavy on the discrete math bit and was much more focused on the data structures and other material we covered. I was also surprised that there weren't problems covering converting infix notation to polish or reverse polish.

As far as the grading has gone, I feel like there has been a surprising amount of focus on C++ language specifics. I really feel like the grading on our assignments (homework and labs) should be more focused on us understanding the material and concepts of what we're learning and not so much on the language itself, especially because this is not a class on C++ itself. Personally, I haven't used C++ since ~2009 (8 years!) and am rusty on a lot of the language-specific aspects of it. Our lectures and reading assignments aren't focused on these things and I don't believe the grading should be either.

Here is my video of the programming assignment this week:

CST 370 Week 4

Week 4

There was a fair amount of new material this week that was very unlike the previous few weeks. We covered a fair amount under the algorithm complexity umbrella, like big O notation, recurrence relations, and time complexity.

I didn't start the homework early enough this week and it really hurt me. The structure was a bit different so I slowly (for this program!) worked through videos and skimmed the readings. I didn't begin the assignment until Sunday, leaving me only Monday and Tuesday (after work) to complete the assignment. For 5 questions, I didn't think it would be too bad... but I was so wrong. There are problem that I worked out but left completely blank because I don't even know how I got to where I was (the step problem).

Discrete mathematics is the last course I need outside of this program. I have paid for it and am in the process of enrolling through the University of North Dakota Online. However, I have not even started it yet. The homework had discrete math topics that I was unfamiliar with. I used my sister's old discrete mathematics textbook to complete what I could of the assignment.

I'm just considering this week a loss and will press on with the upcoming material. I do have some extra credit to fall back on, thanks to the videos. I believe it's best to stay current with the course than dwell on getting caught up. I will spend an additional day trying to complete the unanswered question on assignment. If I don't get it, I will move on. I have at least turned in something. Not all "F"s are the same, after all!

CST 370 Week 3

Week 3

This week we covered converting infix expressions to prefix (or polish notation) and postfix (reverse polish notation) using stacks. The video tutorials we are following also explained how to evaluate the expressions using stacks but we didn't practice that ourselves. We also covered queues. The basic ideas of queues are very simple and I have been impressed with the challenges provided in the assignments.

I'm excited to learn about complexity next week and really deepen my knowledge on algorithm efficiency. This is a topic that you can never have enough review of and is extremely helpful for job interviews and real-world practice.

Here is my video on the programming assignment this week:

CST 370 Week 2

Week 2

We're on to stacks this week! I'm familiar with stacks from previous experience and courses, so this week wasn't very challenging for me and that is a-okay by me. I've enjoyed the review and not feeling completely swamped in assignments. The assignments were fun to think through and get working.

I got marked off on a piece of my lab for something that I misunderstood from the assignment and did intentionally, which drives me crazy. I really try to make sure I get all of the details down and didn't even think that I would need to clarify this bit. However, I think the extra credit from my video from last week cancels out the missed points. I'm hopeful that there weren't any misunderstandings this week!

Here is my video on the programming assignment for this week:

CST 370 Week 1

Week 1

It begins! A new year and a new set of courses. I'm very rusty with C++, since it's been nearly 10 years since I last worked with it, but am hoping to get back into the swing of things soon. The topic this week, linked lists, is familiar to me. I've implemented them in both Ruby and Java previously. In both cases, I wasn't working with pointers and references! I will understand when to use which one and what (heh) by the end of this course, dang it.

We had a couple of assignments that all basically had us iterating through some nodes to accomplish things, like insertion or just printing the data that the node contains. All of the reading and videos were also related to linked lists and doubly linked lists. The primary programming assignment was to find all of the possible substrings in a string beginning with 'A' and ending with 'B' and print them to the console.

Here is my video covering how I implemented the programming assignment this week: