Basic Diffrence between Http and Https

Hyper Text Transfer Protocol Secure (HTTPS), which is the encrypted version of its predecessor HTTP. Both of these protocols are used to transfer data from a website's server to the browser on your computer, but when you try to connect to a website using HTTPS, your browser will first ask the web server to identify itself. Then the server will send its unique public key which is used by the browser to create and encrypt a session key. This session key is then sent back to the server which it decrypts with its private key. Now all data sent between the browser and server is encrypted for the remainder of the session.

For example, a government could tell that a user is browsing Wikipedia, but couldn't tell that the user is specifically reading the page about Tiananmen Square.

Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

Image: Wikimedia Commons/Shutterstock - Remix by Jason Koebler

Harvard researchers found fewer instances of Wikipedia censorship after the site started encrypting all of its traffic.

"Knowledge is power," as the old saying goes, so it's no surprise that Wikipedia—one of the largest repositories of general knowledge ever created—is a frequent target of government censorship around the world. In Turkey, Wikipedia articles about female genitals have been banned; Russia has censored articles about weed; in the UK, articles about German metal bands have been blocked; in China,

Render web page to Image using phantom js

Install phantomjs

$ npm install phantomjs

Create a file github.js with following code

var page = require('webpage').create();
//viewportSize being the actual size of the headless browser
page.viewportSize = { width: 1024, height: 768 };
page.open('http://github.com/', function() {
    page.render('github.png');
    phantom.exit();
});

Pass the file as argument to phantomjs

$ phantomjs github.js

Happy Coding !!

By: saurabh saxena

The Race for Self-Driving Cars

Autonomous cars have arrived. Major automakers have been investing billions in development, while tech players like Uber and Google’s parent company have been
testing their versions in American cities.

How a Car Drives Itself

LIDAR UNIT

CAMERAS

Constantly spinning, it uses laser beams to generate a 360-degree image of the car’s surroundings.

Uses parallax from multiple 

images to find the distance to 

various objects. Cameras also 

detect traffic lights and signs, 

and help recognize moving

objects like pedestrians and 

bicyclists.

RADAR SENSORS

Measure the distance from the car to obstacles.

MAIN COMPUTER

(LOCATED IN TRUNK)

ADDITIONAL

LIDAR UNITS

Analyzes data from the sensors, and compares its stored maps to assess current conditions.

By Guilbert Gates |Source: Google | Note: Car is a Lexus model modified by Google.

DIFFERENCE BETWEEN CORE I3, CORE i5, CORE i7

► Core i3:
* Entry level processor.
* 2-4 Cores
* 4 Threads
* Hyper-Threading (efficient use of processor resources)
* 3-4 MB Cache
* 32 nm Silicon (less heat and energy)

► Core i5:
* Mid range processor.
* 2-4 Cores
* 4 Threads
* Turbo Mode (turn off core if not used)
* Hyper-Threading (efficient use of processor resources)
* 3-8 MB Cache
* 32-45 nm Silicon (less heat and energy)

► Core i7:
* High end processor.
* 4 Cores
* 8 Threads
* Turbo Mode (turn off core if not used)
* Hyper-Threading (efficient use of processor resources)
* 4-8 MB Cache
* 32-45 nm Silicon (less heat and energy)

Raspberry Pi and CoderDojo team up to create world's biggest coding school

Raspberry Pi, the makers of those affordable single-board computers, and the CoderDojo Foundation, which runs a network of coding clubs for school-age children, have announced they’re merging in order to give more young people opportunities to get into compsci.

CoderDojo is a global phenomenon, with over 1,250 clubs spread across 69 countries. These are attended regularly by 35,000 young coding enthusiasts. Phillip Colligan, CEO of the Raspberry Pi foundation, says it wishes to increase these to 5,000 by 2020.

The CoderDojo will retain its status as an independent charity, registered in the Republic of Ireland. The curricula will also remain the same, and dojos will be able to teach kids coding using whatever tech they see fit, or have available.

But the merger — which is subject to approval by Irish regulators — will see the Raspberry Pi Foundation as a corporate member, as well as providing practical, financial, and back-office support. Colligan will join the CoderDojo foundation as a director.

Given the quality of computer science curriculum in many schools leaves a lot to be desired, it’s amazingly gratifying to see third-sector organizations like the Raspberry Pi Foundation and CoderDojo fill the gap. Both of these organizations have historically been very effective at introducing young people to computer science. This closer collaboration will only increase their efficacy.

source: https://thenextweb.com

Facebook Now Cares About How Long You Look At Stuff In Your News Feed

You probably don’t always like/share/comment on the stuff that pops up in your Facebook feed, even if it’s something you care to see. Take, for example, a breaking news items about an earthquake on the other side of the world — you’d probably feel weird hitting a button labeled “Like” on that one, and you might not have anything to say… but that doesn’t mean you don’t care.

Realizing this, Facebook is tweaking its algorithms to account for a new metric: the amount of time you spend looking at things in your feed, regardless of whether or not you actively interact with it.

Scroll past something without stopping for long, and Facebook’s algorithms will slowly learn that you don’t particularly care for that sort of content.

Camp out on a post for a bit, though, and Facebook starts the timer behind the scenes. If you spend more time on this story than you spend on most things in your feed — studying a picture, perusing the comment thread — they’ll take that as a signal that it’s something you care about.

In other words: those endless baby photos and motivational fitness memes that you tend to scroll right on past? At least theoretically, this change allows Facebook’s algorithms to take the hint without requiring you to lift a finger.

It’ll be interesting/a little terrifying to see how this actually impacts what shows up in feeds, if only because it’s all so passive. Facebooks algorithm’s have thus far been largely tuned by what you’re liking/sharing/commenting on — actions that all require at least a modicum of conscious effort. Once things shift toward passive behavior analysis, Facebook’s News Feed begins to understand what you care about more than you ever could.

With that said, I wouldn’t expect any dramatic changes to what pops up in your feed — at least, not immediately. It’ll take some time/polish before they can give this data too much weight. They’ll have to account for things like users walking away from their computers with the news feed up but sitting on some random nonsense, and, on the other end, the folks (like me) who just mindlessly flick through the feed when bored without actually looking at much of anything..

Facebook says it’ll be rolling out the algorithm tweak in the coming weeks — but before all you social media managers of the world start panicking and coming up with new strategies involving super-long GIFs to keep people hovering, they also say that they “do not expect Pages to see significant changes in distribution as a result of this update”.

Generating Code from a Graphical User Interface Screenshot

Transforming a graphical user interface screenshot created by a designer into computer code is a typical task conducted by a developer in order to build customized software, websites and mobile applications. In this paper, we show that Deep Learning techniques can be leveraged to automatically generate code given a graphical user interface screenshot as input. Our model is able to generate code targeting three different platforms (i.e. iOS, Android and web-based technologies) from a single input image with over 77% of accuracy.

source : https://uizard.io/research#pix2code 

The Magic of XOR

Introduction

In mathematics, inclusive OR is given preference to exclusive OR (also called XOR).
For example, when you write p V q which is read "p OR q", this is inclusive OR. This statement is true when p is true, or q is true, or both p and q is true. Inclusive OR is used as the default meaning of OR, and works more often in logic than exclusive OR.
We often see XOR used in sentences. For example, if someone says "This summer, I am going to London, or I am going to Paris", they seem to suggest that they plan to go to one or the other, but not both. Even though their statement wouldn't be considered wrong if they went to both cities, it suggests very strongly that they intend to go to one city. (Of course, in logic, it's hard to convey the notion "suggests very strongly").
You would think XOR wouldn't be that interesting an operator. It's similar to OR, so why should it be any more interesting than OR?
But it is!

Various Views of XOR

You can think of XOR in many ways. Assume that p and q are Boolean variables. Also assume that p₁, p₂, ...p_n are Boolean variables. Let (+) be the XOR operator (this is a circle with a plus sign inside it). In this case, we assume that p and q are boolean values, instead of words, and we assume (+) is plain XOR, not bitwise XOR. Later on, we'll use it as bitwise XOR.

• p (+) q is true if exactly one of p and q is true. This is the conventional definition of XOR.
• p₁ (+) p₂ (+) ... (+) p_n is true if the number of variables with the value true is odd (and is false if the number of variables with the value true is even). Notice this definition ignores the variables which are assigned to false.This may seem like an odd view of XOR. (No pun intended). However, if you believe that XOR is associative (which it is), it's merely an extension of the first definition of XOR.
  This definition makes sense, if you read the next definition.
• p₁ (+) p₂ (+) ... (+) p_n is the same as adding modulo 2. If p_i is true, then treat it as a 1, otherwise treat it as a 0. Then, XOR operation is equivalent to:

       p1 (+) p2 (+) ... (+) pn == ( p1 + p2 + ... + pn ) % 2
  

  Thus, XOR applied to a bunch of Boolean variables is the same as summing up all the variables' values (where true is 1 and false is 0), and dividing mod 2. Recall that dividing mod 2 is one way to determine if a number is even or odd. Since only the variables that have value 1 contribute to the sum (0 is the identity value in sums), this determines how many variables have value 1.

Parity Check

People often use XOR as a means of doing a parity check. A bitstring has even parity if the number of 1's in the string is even. It has an odd parity if the number of 1's is odd. If you XOR the bits together, you can tell whether a bitstring has even or odd parity.
This can often be used to verify data sent across a network, where there's some probability a bit may be corrupted. For example, suppose you're sending N bytes across the network from a source location to a destination location.
How can you determine whether the bytes were sent correctly? One way is to use a kind of checksum, which uses XOR. Each byte can be written as b₇b₆...b₀. For each byte, XOR all the bits in position b_i.
If N was 10, and you're transmitting 10 bytes, then create an 11th byte where b_i is the XOR of all 10 bytes i^th bit. This 11th byte is called the checksum. This checksum is also sent across the network.
At the destination end, where the data is being received, you can then independently perform the checksum again, and see if the checksum you performed matches the checksum sent across. If so, then you have some confidence that no bytes were corrupted. If it's not the same, then the network has corrupted some bytes, and you may need to retransmit the data.
Clearly the system could have errors. For example, if two bits were flipped, say, bit 3 of bytes 4 and 5, then the checksum would be the same if they hadn't been flipped, but there would still be errors. Nevertheless, it catches some errors.

Properties of XOR

Here are several useful properties of XOR. This applies to plain XOR and bitwise XOR.

• x (+) 0 = xXORing with 0 gives you back the same number. Thus, 0 is the identity for XOR.
  
• x (+) 1 = \xXORing with 1 gives you back the negation of the bit. Again, this comes from the truth table. For bitwise XOR, the property is slightly different: x ^ ~0 = ~x . That is, if you XOR with all 1's, the result will be the bitwise negation of x.
  
• x (+) x = 0XORing x with itself gives you 0. That's because x is either 0 or 1, and 0 (+) 0 = 0 and 1 (+) 1 = 0.
  
• XOR is associative.That is: (x (+) y) (+) z = x (+) (y (+) z).
  You can verify this by using truth tables.
  
• XOR is commutative.That is: x (+) y = y (+) x.
  You can verify this by using truth tables.
  

Bitwise XOR

The properties of XOR apply to bitwise XOR. Suppose x and y are 32 bit words. Then, x ^ y is basically like performing 32 XORs in parallel on an array of 32 booleans.

Swapping without "temp"

Here's one of those brain-teasers that you can give to your CS friends. One of the classic problems any CS major should be able to solve is writing code to swap two numbers. Here's how it looks in C.

  temp = x ;
  x = y ;
  y = temp ;

To swap, you introduce a "temp" variable. Its name doesn't have to be "temp", but it is nevertheless an additional temporary variable.
Now ask your friend to solve this without using a temp variable. This means you can ONLY use x and y. This does NOT mean that you name the variable temp2.
How can you do this? If you're thinking "perhaps I can use bitwise XOR", you're right! If you're adventuresome, you can think about how to do this on your own, but if not, here's the answer.

  x = x ^ y ;
  y = x ^ y ;
  x = x ^ y ;

Are you convinced this works? Perhaps not. How could you be convinced this works?
The key to convincing yourself this works is to keep track of the original value of x and y. Let A be the original value of x (that is, the value x has just before running these three lines of code). Similarly, let Bbe the original value of y.
We can comment each line of code to see what's happening.

  // x == A, y == B
  x = x ^ y ;  
   // x == A ^ B, y == B
  y = x ^ y ;  
   // x == A ^ B
   // y == (A ^ B) ^ B == A ^ (B ^ B)  (by Assoc)
   //   == A ^ 0  (by z ^ z == 0 property)
   //   == A      (by z ^ 0 == z property)
  x = x ^ y ;
   // x == ( A ^ B ) ^ A
   //   == ( A ^ A ) ^ B  (by Assoc/Commutativity)
   //   == 0 ^ B            (by z ^ z == 0 property)
   //   == B                (by z ^ 0 == z property)
   // y == A

After the second statement has executed, y = A. After the third statement, x = B.
Now it turns out you can do a similar trick using subtraction instead of XOR. Doing swaps with XOR is slightly safer than swapping with subtraction because subtraction can cause overflow. However, usually overflow occurs in a "nice way" that it may still work. Overflow often just "wraps around", so things may still work out fine.

Writing bitwise XOR without ^

Suppose you wanted to implement bitwise XOR, but didn't have ^ operator. What would you do? With bitwise AND (&) and bitwise OR (|), you can do this.

  x ^ y == (~x & y) | (x & ~y)

This is the standard definition of XOR as defined in logic books, applied to bitwise operations.

Summary

XOR is an interesting operation. With it, you can do parity checks and swaps without temp variables.

source: https://www.cs.umd.edu/ 

Porting Windows Dynamic Link Libraries to Linux

Introduction

This repository contains a library that allows native Linux programs to load and call functions from a Windows DLL.

How does it work?

The peloader directory contains a custom PE/COFF loader derived from ndiswrapper. The library will process the relocations and imports, then provide a dlopen-like API. The code supports debugging with gdb (including symbols), basic block coverage collection, and runtime hooking and patching.

What works?

The intention is to allow scalable and efficient fuzzing of self-contained Windows libraries on Linux. Good candidates might be video codecs, decompression libraries, virus scanners, image decoders, and so on.

• C++ exception dispatch and unwinding.
• Loading additional symbols from IDA.
• Debugging with gdb (including symbols), breakpoints, stack traces, etc.
• Runtime hooking and patching.
• Support for ASAN and Valgrind to detect subtle memory corruption bugs.

If you need to add support for any external imports, writing stubs is usually quick and easy.

Why?

Distributed, scalable fuzzing on Windows can be challenging and inefficient. This is especially true for endpoint security products, which use complex interconnected components that span across kernel and user space. This often requires spinning up an entire virtualized Windows environment to fuzz them or collect coverage data.

This is less of a problem on Linux, and I've found that porting components of Windows Antivirus products to Linux is often possible. This allows me to run the code I’m testing in minimal containers with very little overhead, and easily scale up testing.

This is just personal opinion, but I also think Linux has better tools. ¯\_(ツ)_/¯

Windows Defender

MsMpEng is the Malware Protection service that is enabled by default on Windows 8, 8.1, 10, Windows Server 2016, and so on. Additionally, Microsoft Security Essentials, System Centre Endpoint Protection and various other Microsoft security products share the same core engine.

The core component of MsMpEng responsible for scanning and analysis is called mpengine. Mpengine is a vast and complex attack surface, comprising of handlers for dozens of esoteric archive formats, executable packers, full system emulators for various architectures and interpreters for various languages. All of this code is accessible to remote attackers.

Dependencies

Fedora / RedHat	Ubuntu / Debian	Comment
glibc-devel.i686	libc6-dev:i386
libgcc.i686	gcc-multilib
readline-devel.i686	libreadline-dev:i386	Optional, used in mpscript.
cabextract	cabextract	Used to extract definitions.

If you want to know which version you got, try this:

$ exiftool mpengine.dll | grep 'Product Version Number'
Product Version Number          : 1.1.13701.0

Debugging

If you want to debug a crash, single step through a routine or set breakpoints, follow these examples. First, you need a map file from IDA.

Microsoft doesn't release public symbols for every build, and sometimes the symbols lag behind for a few months after release. Make sure you're using an mpengine version with public symbols available.

Use the following sample commandline to generate map and idb files.

> idaw -A -P+ -S"createmap.idc mpengine.map" mpengine.dll

If you generate the map files on Windows, you'll get CRLF line terminators, fix them like this:

$ dos2unix mpengine.map

When you run mpclient under gdb, it will detect a debugger and print the commands you need to enter to teach gdb about the symbols:

$ gdb -q ./mpclient
(gdb) r testfile.txt
Starting program: mpclient
main(): GDB: add-symbol-file engine/mpengine.dll 0xf6af4008+0x1000
main(): GDB: shell bash genmapsym.sh 0xf6af4008+0x1000 symbols_19009.o < mpengine.map
main(): GDB: add-symbol-file symbols_19009.o 0

Program received signal SIGTRAP, Trace/breakpoint trap.
0x0804d213 in main (argc=1, argv=0xffffcc64, envp=0xffffcc6c) at mpclient.c:156
156         __debugbreak();
(gdb)

If you enter the commands it shows into gdb, you will have symbols available.

(gdb) add-symbol-file engine/mpengine.dll 0xf6af4008+0x1000
add symbol table from file "engine/mpengine.dll" at
 .text_addr = 0xf6af5008
Reading symbols from engine/mpengine.dll...done.
(gdb) shell bash genmapsym.sh 0xf6af4008+0x1000 symbols_19009.o < mpengine.map
(gdb) add-symbol-file symbols_19009.o 0
add symbol table from file "symbols_19009.o" at
 .text_addr = 0x0
Reading symbols from symbols_19009.o...done.
(gdb) p as3_parsemetadata_swf_vars_t
$1 = {void (void)} 0xf6feb842 <as3_parsemetadata_swf_vars_t>

Then you can continue, and it will run as normal.

(gdb) c

Breakpoints, watchpoints and backtraces all work as normal, although it may be more reliable to use hardware breakpoints than software breakpoints.

To use hardware breakpoints in gdb, you just use hb or hbreak instead of break. Note that you only get a limited number of hardware breakpoints.

(gdb) b as3_parsemethodinfo_swf_vars_t
Breakpoint 1 at 0xf6feb8da
(gdb) c
Continuing.
main(): Scanning test/input.swf...
EngineScanCallback(): Scanning input
Breakpoint 1, 0xf6feb8da in as3_parsemethodinfo_swf_vars_t ()
(gdb) bt
#0  0xf6feb8da in as3_parsemethodinfo_swf_vars_t ()
#1  0xf6dbad7f in SwfScanFunc ()
#2  0xf6d73ec3 in UfsScannerWrapper__ScanFile_scanresult_t ()
#3  0xf6d6c9e3 in UfsClientRequest__fscan_SCAN_REPLY ()
#4  0xf6d6a818 in UfsNode__ScanLoopHelper_wchar_t ()
#5  0xf6d6a626 in UfsNode__Analyze_UfsAnalyzeSetup ()
#6  0xf6d71f7f in UfsClientRequest__AnalyzeLeaf_wchar_t ()
#7  0xf6d71bb9 in UfsClientRequest__AnalyzePath_wchar_t ()
#8  0xf6dbbd88 in std___String_alloc_std___String_base_types_char_std__allocator_char______Myptr_void_ ()
#9  0xf6d75e72 in UfsCmdBase__ExecuteCmd__lambda_c80a88e180c1f4524a759d69aa15f87e____lambda_c80a88e180c1f4524a759d69aa15f87e__ ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
(gdb) x/3i $pc
=> 0xf6feb8da <as3_parsemethodinfo_swf_vars_t+7>: lea    ebx,[edx+0x1c]
   0xf6feb8dd <as3_parsemethodinfo_swf_vars_t+10>: push   esi
   0xf6feb8de <as3_parsemethodinfo_swf_vars_t+11>: mov    edx,ebx

What about Wine and Winelib?

This project does not replace Wine or Winelib.

Winelib is used to port Windows C++ projects to Linux, and Wine is intended to run full Windows applications. This project is intended to allow native Linux code to load simple Windows DLLs.

The closest analogy would be ndiswrapper but for userspace.

library link click here .

GitLab 9.2 Released with Multiple Assignees For Issues and Pipeline Schedules

GitLab is designed to allow everyone to contribute whether their teams are large or small, remote or in a single room.

As a new feature or product is moving from idea to production, often multiple people work on the same issue together. For example, it is not uncommon to have a front end developer, backend developer, UX designer, QA tester, and product manager teaming together to bring an idea to market. With 9.2, GitLab introduces Multiple Assignees for Issues to streamline collaboration and allow these shared responsibilities to be clearly displayed. All assignees are shown across our workflows and receive notifications as they would before, simplifying communication and ownership. read more