RT @Pinboard: Delete all you want; I’m an archivist! http://t.co/PZHD0WrTRE
-
Posted on Twitter over 12 years agoon August 20, 2014 - 2:36 AM and archived here at /twitter/2014/08/19/tweet-501920654803755009/at https://pizza.slow.high.quality.gravely.pizza/twitter/2014/08/19/tweet-501920654803755009/ in the Twitter collection in both HTML and markdown.
-

Figure 1. mirrored image from https://66.media.tumblr.com/a4e22db75a76bbe0f15452caf6152de9/tumblr_naj03mEeUL1tjflgfo1_1280.png without alt text, sorry. Evernote checks for update over unencrypted HTTP, and the update packages are also downloaded over HTTP. But it’s signed code, right? What could go wrong?
It’s trivially easy to perform a man-in-the-middle attack to prevent future updates from ever being received, or to redirect the user to unsigned or malicious code, that may or may not run.
There is a DSA signature on the file at the update URL, and there’s signatures on the files and a certificate OU deep within the app contents… but that all assumes the user can get to the update, and download it securely.
Good news for persistent threats, bad news for the millions of Evernote users who want to get critical security updates.
This looks easy enough to fix.
(Submitted by Phillip Knoll)
August 19th, 2014 8:38am
Posted on Tumblr over 12 years agoon August 19, 2014 - 3:38 PM and archived here at /tumblr/2014/08/19/httpshaming-evernote-checks-for-update-over/at https://pizza.slow.high.quality.gravely.pizza/tumblr/2014/08/19/httpshaming-evernote-checks-for-update-over/ in the Tumblr collection in both HTML and markdown. -
RT @richtener: Evernote enables DMARC to fight email spam: http://t.co/hKcfAqh7Bf #dmarc #security
Posted on Twitter over 12 years agoon August 18, 2014 - 11:10 PM and archived here at /twitter/2014/08/18/tweet-501506567653441538/at https://pizza.slow.high.quality.gravely.pizza/twitter/2014/08/18/tweet-501506567653441538/ in the Twitter collection in both HTML and markdown. -
Medical Engineer
Requirements
• Cardiology of Humans, cats, & robots
• HIPPA, SOX, DNA
• Able to code
• Culture fit
• Passion
• HomeopathyPosted on Twitter over 12 years agoon August 18, 2014 - 7:54 PM and archived here at /twitter/2014/08/18/tweet-501457061360574464/at https://pizza.slow.high.quality.gravely.pizza/twitter/2014/08/18/tweet-501457061360574464/ in the Twitter collection in both HTML and markdown. -
Comment section reserved for Danny Marquardt to give me dat ginger ale recipe. Because I am too lazy to install another dumb IM app.
Posted on Facebook over 12 years agoon August 17, 2014 - 12:59 PM and archived here at /facebook/2014/08/17/12-59-00-comment-section-reserved-for-danny-marquardt-to-gi/at https://pizza.slow.high.quality.gravely.pizza/facebook/2014/08/17/12-59-00-comment-section-reserved-for-danny-marquardt-to-gi/ in the Facebook collection in both HTML and markdown. -

Figure 1. mirrored image from https://farm4.staticflickr.com/3873/14941170505_e785e54ce0_m.jpg without alt text, sorry. View my 2 latest photos on Flickr: https://flic.kr/u/2mJ1Jd/aHsk1m48N3
Explore July 5, 2026Flickr (opens in a new tab) Figure 2. Link preview of https://flic.kr/u/2mJ1Jd/aHsk1m48N3, "Explore July 5, 2026". August 16th, 2014 6:13pm
Posted on Tumblr over 12 years agoon August 17, 2014 - 1:13 AM and archived here at /tumblr/2014/08/16/view-my-2-latest-photos-on-flickr/at https://pizza.slow.high.quality.gravely.pizza/tumblr/2014/08/16/view-my-2-latest-photos-on-flickr/ in the Tumblr collection in both HTML and markdown. -

Figure 1. mirrored image from https://66.media.tumblr.com/fd97db321d6ba38244e8278d8fb1fcc8/tumblr_naffcbPDvv1qzoybuo1_500.jpg without alt text, sorry. ~ brew install smoked porter on Flickr.
August 16th, 2014 6:12pm
Posted on Tumblr over 12 years agoon August 17, 2014 - 1:12 AM and archived here at /tumblr/2014/08/16/brew-install-smoked-porter-on-flickr/at https://pizza.slow.high.quality.gravely.pizza/tumblr/2014/08/16/brew-install-smoked-porter-on-flickr/ in the Tumblr collection in both HTML and markdown. -
~ brew install smoked porter https://t.co/851860sbiA
Explore July 5, 2026Flickr (opens in a new tab) Figure 1. Link preview of https://t.co/851860sbiA, "Explore July 5, 2026". Posted on Twitter over 12 years agoon August 17, 2014 - 1:12 AM and archived here at /twitter/2014/08/16/tweet-500812289973288963/at https://pizza.slow.high.quality.gravely.pizza/twitter/2014/08/16/tweet-500812289973288963/ in the Twitter collection in both HTML and markdown. -
The new pump works!
Posted on Facebook over 12 years agoon August 16, 2014 - 6:13 PM and archived here at /facebook/2014/08/16/18-13-00-the-new-pump-works/at https://pizza.slow.high.quality.gravely.pizza/facebook/2014/08/16/18-13-00-the-new-pump-works/ in the Facebook collection in both HTML and markdown. -
~ brew install smoked porter
Posted on Facebook over 12 years agoon August 16, 2014 - 6:12 PM and archived here at /facebook/2014/08/16/18-12-00-brew-install-smoked-porter/at https://pizza.slow.high.quality.gravely.pizza/facebook/2014/08/16/18-12-00-brew-install-smoked-porter/ in the Facebook collection in both HTML and markdown.