Wednesday, August 15, 2018

Hyperthreading Mitigation Security Warnings

13 hours ago VMware issued critical security patches for VMware vCenter, ESXi, Fusion and Workstation products as part of advisory VMSA-2018-0020 to fix the new CPU vulnerabilities Intel disclosed as well.

After applying the patches (Aug 14, 2018), a warning message showed on patched ESXi hosts: esx.problem.hyperthreading.unmitigated

host summary showing hyperthreading unmitigated error

According to the release notes, VMware introduced a new Advanced Configuration on the hosts to mitigate the new hyperthreading attacks, however, it states there's a performance hit that cannot be ignored.

After applying the patches, you have to manually enable the Hyperthreading mitigation setting in the advanced functions to enable the security fix, otherwise the exclamation mark on the host and the warning above will persist. It's set to manual modification due to the performance impact.

hyperthreading mitigation advanced setting

Change the value of "VMKernel.Boot.hyperthreadingMitigation" to true, then reboot the host for changes to take effect.

Update 1: Aug 15, 2018 - 14:29 UTC+3

After enabling hyperthreading mitigation, some virtual machines that were running HTTPS/443 services weren't accessible anymore. The VM is accessible, but not services on port 443 TCP. After undoing the configuration and rebooting the host, the services functioned again.

Approach this setting and the security vulnerability with caution and do proper testing for every service you have deployed.

Monday, August 13, 2018

RFID and NFC Blocking Wallets

Introduction

I've been on the lookout for a new wallet that blocks RFID/NFC frequencies to protect against scanners from people walking by you and scanning your cards' data.

Even though contactless cards have a limit set to allow payment without needing the pin, and if the limit is exceeding, a pin will be required, this limit varies from one country to another, and is enforced per transaction, not as a daily cap. So, if your card is cloned, the scammers can use it at different places throughout the day multiple times until you cancel/block the card with your bank.

Note: The pictures are taken with my OnePlus 5 phone's camera and are in no an indication of any product's quality. The camera isn't as good as that of Samsung or iPhone.

Finding The Right Wallet

My first attempt was to find one from mainstream wallet makers such as Mont Blanc and Prada, however, Prada didn't have any that block RFID/NFC and Mont Blanc only had one, but was bulky due to the big coin pouch in it.

My criteria:

  1. Minimalistic: thin & no coins.
  2. Fit big bank notes (height of 76 mm & length of 160 mm). I travel to Europe and Japan, and they have big bank notes.
  3. Fit at least 6 cards.
  4. Block RFIC/NFC.
  5. Don't bend cards.
  6. Look professional (not childish or cheap knockoff).


Attempt 0

Initially I found one on Amazon by Travando: Travando Money Clip RIO wallet. After using it for sometime, I wasn't really comfortable with it.

Pros:

  • Slim
  • Fits 6 internal cards & 1 external for quick access
  • Blocks RFID/NFC
  • Fits big money notes

Cons:
  • I never used a money clip approach before & I didn't like it at all. The money felt very exposed, so if you carry a lot of cash, you'd expose yourself in public when opening the wallet.
  • The wallet is lengthy and the cards get bent over time.
  • It didn't look professional enough, but this is a personal preference.
  • Because it's lengthy, it would sometimes bend one half away from the other, so over time, it'll damage the mid-section joining the two halves.
  • The money clip can't handle too much cash, so I had to slide in only half side and leave the other half out. This also helps getting specific bills out.

One thing as well: they're eco-friendly and use fake leather (faux leather), which is basically synthetic plastic/polymer material that feels like leather. It doesn't age, smell or scratch in a similar way, though. It also looks a bit different. This may or may not be to your liking.

Attempt 1

I kept looking and finally settled on Bellroy's Hide and Seek wallet (HI size for big bank notes). So far, I like it.

Pros:
  • Slim
  • Fits 4 quick use cards & 5+ cards in a group slot for stuff you don't use often
  • Blocks RFID/NFC
  • Fits lots of money
  • Has a hidden bank note/money section in addition to the main one
  • Hidden coin slot inside the hidden money section (a slot not a pouch)
  • Looks professional & smells good
  • Many options for colors
  • Cards don't bend and align properly when the wallet is pressed

Cons:
  • None so far. Will update if I face any.

Pictures













In the pictures above, I have 4 cards for quick access visible, and 4 others in the group pouch above the card on the left. There are many more slots available in the Bellroy. Check the link to their site to see more pictures.

Friday, August 3, 2018

Scam Alert: Thorium Molten Salt Reactor ICO Is A Scam

Introduction

The following conversation(s) happened back in May 2018, but I had a lot on my plate at the time and didn't get to post here. It took place in the CryptoMENA Telegram group where I lurk and contribute to the community and have discussions with various people.

TL;DR

It's a scam. Those posting about it refer to some videos that talk about how great Thorium is and it being an untapped source of energy. When asked for details, they refer to old research (1968) which didn't even include Thorium and only discussed Molten Salt Reactors (MSRs). At the end, when they have no more excuses, they start a conspiracy theory that countries insist on using nuclear reactors for weaponization purposes.

Warning

I have kept all links as-is and did not remove their links. The ones to the PDF files and YouTube videos are safe, but click anything else at your own risk.

Details

Below is the full conversation that happened in the group. I have masked the person's name because I don't want to smear them in person, and only focus on the ICO scam itself. I have also omitted the name of a person I had asked on nuclear reactors as I didn't get his permission prior to publishing this post. If he agrees to have it included, I'll add it later.

I'm pasting both images (first) then text to allow for the conversation to be indexed by search engines, in hope to save anyone who's looking for evidence or proof.

Picture-Captured Conversation

conversation - part 0
Part 0
conversation - part 1
Part 1
conversation - part 2
Part 2

Links to the 2 PDF files the person had shared:
ORNL-TM-2316.pdf : "Physical Properties of Molten-Salt Reactor Fuel, Coolant, and Flush Salts"
Pub20808.pdf : "An Account of Oak Ridge National Laboratory’s Thirteen Nuclear Reactors"


Text Conversation

The conversation is between 1 person and myself. I will add my name and color my text in red to differentiate it from the person.

Person: Make an impact - on your future and your children's, children's future: join our early blockchain project and contribute to clean transparent energy production. Now is our Private Token Sale. Watch these videos for more... The tech: https://goo.gl/WKDfsY; The story: https://goo.gl/7vwmkF
Register for the PTS document: https://goo.gl/XWTLe8. 
Let's build our future together.

MBH: Someone mentioned this last month, and as I warned before: Thorium reactors are inefficient on an industrial scale and that's why they weren't done decades ago.

You're free to invest into any coin you like, but don't do it based on false information and false promises.

Person: Thanks for your comments , but I am sure   the Danish nuclear group Copenhagen Atomics  has other point of view. They are partner in this project which I assume if it such project won't be feasible they would not invested and have dedicated team, nor would 100 other companies be developing molten salt technology, including a Chinese team with 700 engineers. Oak Ridge laboratory was forced to shut down their working molten salt loop in 1974 by the FBI because the reactor burns highly efficently and does not product plutonium - that means a thorium LFTR in thermal spectrum can't be used to make material for nuclear weapons. There's a great interview with two of the original engineers somewhere on youtube. Anyhow Denmark and other parts of world are long ahead of us in such subjects. 

Also your point that this group is related to the Crypto is valid too.  The blockchain for thorium is going to be the first ever transparent nuclear energy source tracking and management system ever in the world. Backed by thorium, each token will trace all energy production from this amazing fuel source.  However I saw there are many related discussions to ICO therefore I thought this can be relevant too, perhaps my misunderstanding.

MBH: Show me a valid research paper for mass produced Thorium reactors, please.

All what I saw were a bunch of videos, but the papers I saw indicated inefficiencies in production.

And yes, I understand it's an ICO and related to this group, which is why I didn't question that :)

Person: It's a proven technology - just forgotten - on purpose ;o)

Here's the research paper you ask for (the pdf)

And a video based on the paper:
https://www.youtube.com/watch?v=tyDbq5HRs0o

Wikipedia is an easier read, though not as accurate as the actual paper:
https://en.wikipedia.org/wiki/Molten-Salt_Reactor_Experiment

Here's an interview in 2012 with two of the engineers from Oak Ridge who actually worked on the molten salt reactor. They add much more context to the paper:
https://www.youtube.com/watch?v=ENH-jd6NhRc

Here's the reactor now:
https://www.youtube.com/watch?v=knofNX7HCbg

MBH: I don't want videos and interviews. I want a research paper for a production ready reactor.

Why would the energy industry leave such a lucrative energy source untapped? Especially in Germany and France.


MBH: I mention these 2 countries specifically because they're heavy on nuclear reactors, and if something exists that's cheaper and cleaner, then they would've used it.

PersonPub20808.pdf

This TSN blockchain aims to put the power of decentralisation, transparency and accountability of a vitally important energy technology back into the control of the people, and not governments. For civilian owned and managed power generation.

Here's one of our ICO members, Thomas Jam Pedersen, talking about the technology:
https://www.youtube.com/watch?v=tHO1ebNxhVI

Thomas just got back from presenting in China at a nuclear energy conference. Once the private token sale is over some of that footage will be used for the preICO.

I shared you the research papers

France wanted nuclear weapons

one of their representative is here in Kuwait if anyone wants to know more about the  technology and their current stage and process just register in this link https://goo.gl/XWTLe8 .

MBH: This talks about salt mixtures & plainly says it hopes for nuclear reactor design engineers to make use of it at some point. This is dating to 1968, yet we still don't have a single molten salt reactor...

Person: You have not read it, it was a working molten reactor for 5 years

MBH: (inserted picture showing an excerpt of the first document searching for the word "Thorium")

excerpt from first PDF

It talks about molten salt reactors, and then clearly states thorium was never used in the reactors (was part of the concept but never used in practice).

Let me ask: 5 years of a working *Thorium* MSRE? Or just a MSRE?

Why haven't there ever been any mass produced Thorium MSREs since 1950s?!?

All claims for Thorium MSREs are reducing cost of the nuclear reactors and the fuel, yet not a single mass produced one exists. All existed in experiments, if ever.

Germany is pushing hard for renewables & last year generated 30% of its need from them in one of the months, but that's not sustainable throughout the year, so nuclear is still needed throughout the year for sustainable energy.

Person: You have a point, but you are missing the big one: why isn't thorium mainstream? 

Because you can't make weapons out of it. 

It was bluntly shelved for this reason 

(In fact staff at ORL were told to destroy their research. They didn't thankfully...)

There's a huge misconception in "nuclear" energy.

The way of obtaining electrical energy using uranium is totally different to getting it from it's cousin, thorium.

It's like comparing apples with oranges. They just ain't the same.

The hugely expensive nuclear facilities of present day are like they are not to produce the energy - the energy comes out easy - way too easy.

The huge money in present nuclear is spent in-case things go wrong: spent to prevent a meltdown - a very bad thing; and spent to contain explosions from spreading radioactive material in the area - like Fukushima or Chernobyl....

Thorium doesn't need such high costs: 1) it can not "melt down", the technical reason is neutron density reduces as the fuel gets hotter, it cools, so it self regulates. No intervention needed, and 2) there is no high pressure cooling fluid pummelled with neutrons to either produce hydrogen (that goes bang) or create a rapidly expanding radioactive water vapour (steam explosion).  So no massive containment building or complex safety shut down systems are needed. The costs are much, much less.

Speaking of waste: less than 0.5% of the same volume of a uranium machine is produced in a thorium machine and this 0.5% only needs to be stored for 300 years...  

So, comparing apples with oranges is what is happening here between uranium and thorium. You can't, and shouldn't once you know the science.

(yes, for present nuclear it is in the billions to produce electricity at 20 cents per kWh and above - when you include the environmental costs. The thorium target is 5 cents per MWh, matching that with nuclear energy produced in France. Thorium doesn't have any significant environmental costs).  

Let's compare thorium as an energy source to the crypto market directly.

Here's the main reason why the bitcoin and crypto market is coming alive - rigging the gold and silver markets - traditional safe havens amid economic turbulence:

(see the chart...)

But! -Why- has gold been flat for the last five years? 

Because of futures contracts, rigged, fraudulent paper contracts issued mainly by the bullion banks themselves to control the market and avoid bank runs.  The coverage ratio in the chart tells all.  The ratio is now above 500 to 1.

500 to 1.....

500 imaginary bars of gold to 1, actual, physical, real bar of gold...

Basel 3 set the asset (cash) to debt ratio of 8 to 1 for the debt banking system....

Bullion banks and the futures markets operate outside Basel 3....

A -scam- pure and simple of the highest order.

https://www.moneymetals.com/news/2016/05/16/silver-gold-futures-market-000868

MBH: If weapon manufacturing is the reason: why are the following renewable energy technologies being invested into heavily especially by Europe?

- Wind
- Batteries
- Geothermal
- Solar panels

None of these are used for weapon manufacturing. Also, a nuclear bomb is very tiny in comparison to a reactor.

Yes, a lot of money goes into maintenance and safety procedures and construction, but that's a very well known issue with nuclear reactors.

Thorium research wasn't asked to be destroyed. They were asked to decommission the facility, just like any tech that's no longer funded. It's mentioned in the report you sent about Oak Ridge Lab.

I'm glad you mentioned the ICO.

I don't understand why someone who found a solution to make Thorium MSREs finally feasible, isn't patenting and getting VC/gov funding directly?

Why do an ICO? No regulation here and can easily run off with money.

Why not establish a legitimate company and go through funding?

Where are the patents?

Nothing makes sense in a scientific approach nor a business approach.

I'm not familiar with nuclear fission requirements, but I'm free in Ramadhan and can read about it and debate this, or I can ask a cousin who is a nuclear power engineer.

However, I don't need to know those to answer my other obvious questions about mass production of a thorium msre and the business plan and getting gov funding for a working demo of a mass produced design, rather than ask people to give money.

I think my cousin has a PhD in nuclear power now.

Person: This is a following chart to my earlier text abt the gold and comparison with thorium , see this chart

(inserts chart showing Comex Gold Cover ration [Open Interest/Registered Gold]. Y-Axis: 0x to 600x and X-Axis: 2000 to 2016)
Comex Gold Cover ration [Open Interest/Registered Gold]

Yes, thorium is heavily financed by the governments of Russia, China and India. The congress of US recently made a new law allowing research into thorium energy, hence opening up government funding in that country also

We are very confident that with transparency and legitimacy brought to the table of the nuclear industry.  We'll start a similar run as Bitcoin did in 2009. Bitcoin revolutionised money. The Thorium network will revolutionise nuclear energy.

Are we going to face opposition: we sure are! But again it's a project worth pursuing because the benefits of transparency drives innovation faster and this drives price discovery, for the entire world to see, watch, monitor and report upon.

Get into the tech, it's complicated, but it's worth it.

Poor Thorium suffered a similar fate, and continues to do so.

Fortunately the technology to bring it to life is nearing completion with Copenhagen Atomics, They have developed cutting edge monitoring and control systems.

Plus there are another 100 or more companies busy working on LFTR technology. 

China is scheduling 2024 for a working commercial LFTR machine.

From an engineering point of view, the physical technology required for LFTR is actually less sophisticated than that required to extract nickel from nickel laterite ores. Something that pioneers in Australia at Anaconda Nickel did in the early 2000's. 

They took a huge technical risk and almost broke the company - it cost $1.6b to build when they budgeted only $1b. 

@ Murrin Murrin Ni-Co: High pressure, high temperature acidic slurry - really hard to deal with, but the plant has been successfully producing high grade nickle since 2005.

(a member of the ICO team was close to this nickel project, so has first hand knowledge of it)

MBH: I spoke to [redacted]. Neither of us is convinced. He mentioned power generated from Thorium is far less than that from Uranium.

He also directed me to look at International Atomic Energy Agency (iaea.org) and see if I can find a list of thorium based reactors. There are none that I could find listed there, and the agency lists ALL reactors around the world.

Research by IAEA members on Thorium dates to 2001, by member countries: France, Germany, India, Japan & Russia.

An article dating to 2016 titled "Advanced Nuclear Fuels and Fuel Cycles" stated the following countries are collaborating in seeing a long term research in using Thorium: Canada, China, Czech, Germany, India, Israel, Italy & USA. No output from this yet.

Finally, I still don't see how an ICO/coin is related to building thorium reactors, when country-level budgets are spent in early research phases.

So if anything, this whole ICO is nothing but a scam.

If you want to discuss great possibilities of Thorium as a fuel, we can do that in a separate place. Feel free to discuss the ICO itself and how it relates, as long as you provide solid proof and not long statements with scattered scientific jargon without proof.