This blog post will discuss the issues and solutions for MySQL Data at Rest encryption.
Data at Rest Encryption is not only a good-to-have feature, but it is also a requirement for HIPAA, PCI and other regulations.
There are three major ways to solve data encryption at rest:
Full-disk encryption
Database-level (table) encryption
Application-level encryption, where data is encrypted before being inserted into the database
I consider full disk encryption to be the weakest method, as it only protects from someone physically removing the disks from the server. Application-level encryption, on the other hand, is the best: it is the most flexible method with almost no overhead, and it also solves data in-flight encryption. Unfortunately, it is not always possible to change the application code to support application-level encryption, so database-level encryption can be a valuable alternative. Sergei Golubchik, Chief Architect at MariaDB, outlined the pluses and minuses of database level encryption during his
Sergei Golubchik, Chief Architect at MariaDB, outlined the pluses and minuses of database level encryption during his session at Percona Live Amsterdam:
Pros
Full power of DBMS is available
Full power of DBMS is availableEasy to implement
Easy to implementOnly database can see the data
Only databases can see the dataPer-table encryption, per-table keys, performance
Per-table encryption, per-table keys, performanceCannot be done per-user
Cons
Cannot be done per-user
Does not protect against malicious root user
Data at Rest Encryption: Database-Level Options
Currently, there are two options for data at rest encryption at the database level:
MariaDB 10.1.3+ support encryption (using Google patch)
MySQL 5.7.11+ (and Percona Server 5.7.11) has InnoDB tablespace level encryption
MariaDB’s implementation is different from MySQL 5.7.11. MySQL 5.7.11 only encrypts InnoDB tablespace(s), while MariaDB has an option to encrypt undo/redo logs, binary logs/relay logs, etc. However, there are some limitations (especially together with Galera Cluster):
No key rotation in the open source plugin version (MySQL 5.7.11 has a key rotation)
mysqlbinlog does not work with encrypted binlogs (bug reported)
Percona XtraBackup does not work, so we are limited to RSYNC as SST method for Galera Cluster, which is a blocking method (one node will not be available for writes during the SST). The latest Percona XtraBackup works with MySQL 5.7.11 tablespace encryption
The following data is not encrypted (bug reported)
Galera gcache + Galera replication data
General log / slow query log
Database level encryption also has its weakness:
Root and MySQL users can read the keyring file, which defeats the purpose. However, it is possible to place a key on the mounted drive and unmount it when MySQL starts (that can be scripted). The downside of this is that if MySQL crashes, it will not be restarted automatically without human intervention.
Both MariaDB version and MySQL version only encrypt data when writing to disk – data is not encrypted in RAM, so a root user can potentially attach to MySQL with gdb/strace or other tools and read the server memory. In addition, with gdb it is possible to change the root user password structure and then use mysqldump to copy data. Another potential method is to kill MySQL and start it with skip-grant-tables. However, if the key is unmounted (i.e., on USB drive), MySQL will either not start or will not be able to read the encrypted tablespace.
MariaDB Encryption Example
To enable the full level encryption we can add the following options to my.cnf:[mysqld]
plugin-load-add=file_key_management.so
file_key_management_filekey = FILE:/mount/keys/mysql.key
file-key-management-filename = /mount/keys/mysql.enc
innodb-encrypt-tables = ON
innodb-encrypt-log = 1
innodb-encryption-threads=1
encrypt-tmp-disk-tables=1
encrypt-tmp-files=1
encrypt-binlog=1
file_key_management_encryption_algorithm = AES_CTRAfter starting MariaDB with those settings, it will start encrypting the database in the background. The file_key_management plugin is used; unfortunately, it does not support key rotation. The actual keys are encrypted with:# openssl enc -aes-256-cbc -md sha1 -k <key> -in keys.txt -out mysql.encThe encryption <key> is placed in /mount/keys/mysql.key.
After starting MySQL, we can unmount the “/mount/key” partition. In this case, the key will not be available and a potential hacker will not be able to restart MySQL with “–skip-grant-tables” option (without passwords). However, it also prevents normal restarts, especially SSTs (cluster full sync).
Additional notes:
Encryption will affect the compression ratio, especially for the physical backups (logical backups, i.e. mysqldump does not matter as the data retrieved is not encrypted). If your original compressed backup size was only 10% of the database size, it will not be the case for the encrypted tables.
Data is not encrypted in flight and will not be encrypted on the replication slaves unless you enable the same options on the slaves. The encryption is also local to the server, so when encryption was just enabled on a server some tables may not be encrypted yet (but will be eventually)
To check which tables are encrypted, use the Information Schema INNODB_TABLESPACES_ENCRYPTION table, which contains encryption information. To find all tables that are encrypted, use this query:
select * from information_schema.INNODB_TABLESPACES_ENCRYPTION where ENCRYPTION_SCHEME=1
MySQL 5.7 Encryption Example
To enable encryption, add the following option to my.cnf:[mysqld]
early-plugin-load=keyring_file.so
keyring_file_data=/mount/mysql-keyring/keyringAgain, after starting MySQL we can unmount the “/mount/mysql-keyring/” partition.
To start encrypting the tables, we will need to run alter table table_name encryption=’Y’ , as MySQL will not encrypt tables by default.
The latest Percona Xtrabackup also supports encryption, and can backup encrypted tables.
To find all encrypted tablespaces in MySQL/Percona Server 5.7.11, we can use information_schema.INNODB_SYS_TABLESPACES and the flag field. For example, to find normally encrypted tables, use the following query:mysql> select * from information_schema.INNODB_SYS_TABLESPACES where flag = 8225G
*************************** 1. row ***************************
SPACE: 4688
NAME: test/t1
FLAG: 8225
FILE_FORMAT: Barracuda
ROW_FORMAT: Dynamic
PAGE_SIZE: 16384
ZIP_PAGE_SIZE: 0
SPACE_TYPE: Single
FS_BLOCK_SIZE: 4096
FILE_SIZE: 98304
ALLOCATED_SIZE: 98304
*************************** 2. row ***************************
SPACE: 4697
NAME: sbtest/sbtest1_enc
FLAG: 8225
FILE_FORMAT: Barracuda
ROW_FORMAT: Dynamic
PAGE_SIZE: 16384
ZIP_PAGE_SIZE: 0
SPACE_TYPE: Single
FS_BLOCK_SIZE: 4096
FILE_SIZE: 255852544
ALLOCATED_SIZE: 255856640
2 rows in set (0.00 sec)You can also use this query instead: select * from information_schema.tables where CREATE_OPTIONS like ‘%ENCRYPTION="Y"%’;.
Performance overhead
This is a debatable topic, especially for the MariaDB implementation when everything is configured to be encrypted. During my tests I’ve seen ~10% of overhead for the standalone MySQL instance, and ~20% with Galera Cluster.
The MySQL 5.7/Percona Server 5.7 tablespace-level encryption shows an extremely low overhead, however, that needs to be tested in different conditions.
Conclusion
Even with all the above limitations, database-level encryption can be a better option than the filesystem-level encryption if the application can not be changed. However, it is a new feature (especially MySQL 5.7.11 version) and I expect a number of bugs here.
via Planet MySQL
MySQL Data at Rest Encryption
Tennessee Man Builds His Own Gigabit Network Thanks To State’s Protectionist Broadband Law
We’ve noted how Tennessee is one of twenty states that has passed state laws, quite literally written by companies like AT&T, prohibiting towns and cities from wiring themselves with broadband — even if nobody else will. When the FCC announced it would be taking aim at these protectionist broadband laws last year, Tennessee politicians threw a hissy fit, suing the FCC for "violating states rights." That incumbent ISPs are being allowed to write awful state law that’s hampering a generation of business development in the state? Not apparently much of a concern.
As an unsurprising result, Tennessee remains one of the least connected broadband states in the nation, and state residents have increasingly been giving beholden state politicians an earful. Those who can, like Tennessee developer John "Thunder" Thornton, have started taking matters into their own hands and building their own gigabit networks. To do so, Thorton had to get the aid of a power cooperative in Alabama, a state that has a slightly less restrictive municipal broadband law in place:
"Unable to gain high-speed broadband at what he deemed an affordable price from AT&T or Charter Communications and limited from service extensions from EPB’s ultra-fast Internet in Chattanooga, Thornton created his own Internet service provider last year. The private developer spent more than $400,000 to build his own fiber network and link it with a power cooperative in Stevenson, Ala., where fast broadband is available."
According to Thorton, the money he spent to wire his hilltop development cost a third of what AT&T was charging:
"Thornton said when he approached AT&T about providing Gig service to Jasper Highlands he was quoted a price of $1.3 million to serve his mountaintop development — more than three times what it ended up costing Thornton to build his own network connected to Alabama.
"Our costs are much less, but then I don’t have to pay for 27 lobbyists in Nashville like AT&T does," Thornton quipped.
So yeah, Tennessee lawmakers have done such a bang up job letting AT&T write awful state telecommunications law, state residents are being forced to spend their own money to get broadband at a relatively sane price. Sadly, most of the people that can’t get decent broadband can’t afford to go Thorton’s route. And while you’d think the cacophony of complaints from Tennessee residents would be enough to get some movement in the state legislature after a decade, all recent efforts to overturn the state’s protectionist law have gone nowhere.
Tennessee’s law prevents a popular Chattanooga-based utility-run ISP, EPB, from expanding its up to 10 Gbps offerings into any more markets. But attempts to repeal the law earlier this year went nowhere after mammoth pressure from incumbent ISP lobbyists. When that didn’t work, one lawmaker tried to pass a compromise bill that would have allowed EPB to expand into just one neighboring county. That proposal was shot down as well, one of the dissenting votes being that of Rep. Patsy Hazlewood, a former AT&T executive.
That leaves the FCC as the best, current option in getting some of these miserable laws overturned.
As it stands, the FCC is arguing that Section 706 of the Telecommunications Act allows it to preempt state laws that conflict with the agency’s Congressional mandate to guarantee "reasonable and timely" broadband deployment. While there’s twenty such laws, the FCC is currently trying to overturn just two: in Tennessee and North Carolina; the hope being the legal precedent then rolls downhill. But both states have taken the FCC to court, bravely defending their right to take campaign contributions — in exchange for protecting incumbent broadband providers from necessary and inevitable evolution.
Permalink | Comments | Email This Story
via Techdirt.
Tennessee Man Builds His Own Gigabit Network Thanks To State’s Protectionist Broadband Law
Sweet drug clears cholesterol, reverses heart disease—and was found by parents
Here’s how parents of kids with rare disease found what may be blockbuster drug.
via Ars Technica
Sweet drug clears cholesterol, reverses heart disease—and was found by parents
Every Cool Detail We Spotted in the Rogue One: A Star Wars Story Trailer
In case you somehow missed it, the first trailer for the next Star Wars film Rogue One appeared today. The first thing we all noticed was that it is insanely faithful to the original trilogy’s look. But what was less obvious was how the story actually goes. So we went through it frame by frame, to find the hidden clues.
If you had any doubts about who the main character in Rogue One was, this trailer—unless it is one hell of a red herring—makes it very clear that it’s Jyn Erso (Felicity Jones). The trailer lists her criminal background as “forgery of Imperial documents, possession of stolen property, aggravated assault, resisting arrest.” I kind of don’t see the Rebellion getting too up in arms about crimes committed against the Empire, but Erso is shackled in the Rebel base on Yavin 4.
Look, if you thought that J.J. Abrams recreated the feel of the original Star Wars trilogy in The Force Awakens, Gareth Edwards and his team has perfectly recreated the Yavin 4 base. There’s an astromech droid at the end of the shot, an X-Wing in the middle, just so much detail. Plus on the left hand side, as Erso is lead through the hanger, you can see a GNK power droid (or Gonk droid). That walking trash can droid has shown up over and over again, including The Force Awakens, but it’s good to see it back:
Jones’ character was originally described as a Rebel soldier, so the whole list of her crimes is slightly weird. If she weren’t restrained, I’d almost say it’s from another part of the movie where she’s in Imperial hands. Of course, she could be in trouble with the Rebel Alliance for a whole different set of reasons. Insubordination and refusal to follow orders would fit. The whole idea of Erso having a criminal past and being given a chance to prove herself gives this whole Ocean’s 11 “team assembled to get the Death Star plans” plot a hint of Suicide Squad in the mix.
“On your own from the age of 15, reckless, aggressive, and undisciplined.” Mon Mothma’s doing a little judging.
In addition to this being a perfect recreation of the command center in A New Hope, this Mon Mothma casting is dead on. More specifically, it’s an older casting choice that’s become almost perfect: this is Genevieve O’Reilly, who played the young Mon Mothma in Revenge of the Sith. On the left is Rogue One and on the right is Return of the Jedi:
It’s so good we thought it was CGI for a second. Of course, it does have the implication that Mon Mothma has only one clothing style when she’s in a movie, but still.
As Mon Mothma gives us the rest of the Erso backstory infodump, Diego Luna’s as yet unnamed character looks on. Based on where he is and how he’s acting, I’m betting hard on him being the Rebel officer in good standing assigned to this mission. Plus he’s got a very, Poe Dameron/Han Solo swagger about him.
While Erso does her best Homeland impression, note the droid following her around. He shows up again, making us think this might very well be Alan Tudyk’s motion capture character.
On whatever planet this is—although it apparently isn’t a Star Wars movie unless there’s lots of sand—Erso holds her own against some Stormtroopers. Just run of the mill ones, for now.
Since the plot of Rogue One is about the theft of the Death Star plans prior to A New Hope, we’re betting it follows the usual heist plot formula: the recruitment of the team and then the actual mission itself. This is all by way of saying that I’m not sure which part this is from, but I’m betting the recruitment, since we see almost no one else from the team here.
It’s kind of hard to tell, but it looks like Erso grabs Diego Luna’s character and brings him down to shield them from the explosion. He seems to be wearing the jacket from the very first still released at D23 last year.
Erso says, “This is a rebellion isn’t it? I rebel.” And Mon Mothma gives a look of amusement and disappointment that I think I’ve seen on about a dozen teachers.
Based on the scarf around her neck, I’m betting this shot of Erso in a transport of some kind is her after getting the assignment, not her being transported to Yavin 4 in handcuffs.
“We have a mission for you. A major weapons test is imminent. And we need to know what it is and how to destroy it,” says Mon Mothma. Of course, since we the audience all know what the weapon is, we get to see the giant laser focus get installed on the Death Star. The Star Destroyers at various levels in these shots give a hint of scale.
“Is that clear?” says Alistair Petrie, who is playing yet another unnamed Rebel.
A) Gonk droid again. B) Luna and Erso head out with what looks like a whole squadron of Rebel pilots.
Okay, we’ll admit that this image of Ben Mendelsohn caused a bit of a stir. Thanks to Kallus in Rebels, the ISB (Imperial Security Bureau) is still canon. But he never wears the white uniform the old EU gave the ISB—and which was based on some white uniforms seen on the first Death Star. The old EU also gave the all-white uniform to Imperial Grand Admirals (like fan favorite, Thrawn). On the whole, if one of these things is correct, I’d put my money on him being a member of the ISB. The fact he appears to be on the Death Star really tips the balance, as much as I’d love to see a Grand Admiral.
Stormtroopers walk through a city, probably before their fight with Erso from earlier in the trailer. The transport is interesting, but more interesting is the fact the Troopers riding on it look more Clone Trooper than Storm. We’re crossing generations here, people!
Suddenly, Forest Whitaker appears! His armor is much bulkier than we usually see in the Star Wars verse. And he looks like he has a limp, but could still completely destroy you. Making Star Wars has opined that, based on what they’ve heard his character’s code name is, “Eel Leader,” he’s a bounty hunter. Which would make sense, since he wasn’t in the photo of Erso’s team. His monologue then continues through the rest of the trailer.
This is the shot we saw in the tease for this trailer, and it’s an all black trooper. Still no clue if it’s a Shadow Trooper or Death Trooper or what, but there is something burning in background. Also, moisture vaporators!
Here are some captured pilots being led through the town, which might be the same pilots that went out with Luna and Erso earlier. Part of the plan to infiltrate, or have things gone very wrong? Also of note, it looks like Jawas in the back, but they’re a bit too tall. Probably just creatures with similar tailors.
“What will you do when they catch you?” Whitaker asks. Things look like they’ve gone very wrong, since they’re running through some kind of Imperial base—the Death Star?—here. Plus, they’re once again followed by the droid, who matches the description of one rumors described as being two-legged, grey, and with long limbs. He’s supposedly an Imperial droid repurposed by the Alliance.
“What will you do if they catch you? What will they do if they break you?” Whitaker’s character continues over this new scene. Donnie Yen appears to be wanted by the Empire. He’s also basically a space samurai because I guess that’s what every space movie has to have now. More sand, so I think he joins the team on this planet. Note the crashed X-Wing in the background, too.
Not that it takes away from how cool this looks.
A lot of the action in this trailer looks like it takes place on this tropical beach planet (there were rumors the film was going to shoot in South America and maybe this is it. Plus, it’s Star Wars, I assume the planet is all palm trees, sand, and ocean). Here we have more of the black troopers firing. It’s cut to look like their firing blows up the shuttle, but that seems kind of unlikely.
Mendelsohn continues to make the Empire look good.
He also appears to be surveying the damage after the battle on the beach planet. Lots of dead soldiers, but I also link I see a burning X-wing S-foil in the background there.
Someone in a black cloak kneels in front of this creepy, foggy column thing. The red guards are the Emperor’s Royal Guards. I don’t usually see Emperor Palpatine as the kneeling type, so either there’s something really important (like the Emperor) in that column or it’s so important his personal guards are there. We’ve heard rumors that Darth Vader is in this movie, but he doesn’t usually have a hood, so who this is still a mystery.
Whitaker continues his voiceover (but now, he’s clearly on a ship with a little Millennium Falcon vibe): “If you continue to fight…”
Jiang Wen runs in some sort of specially powered armor/weapon.
The Empire brought a ton of AT-ATs to this fight, and I’m pretty sure that Erso, Luna, and maybe Riz Ahmed are running from the lasers.
By the way, the AT-ATs seem to move more gracefully than in Empire Strikes Back and the red on the faces gives them a very Cylon-esque feel. (Yes, I know the original Battlestar Galactica ripped off Star Wars first, but still.) And if you’re wondering why the Empire is using AT-ATs before Empire Strikes Back, well, they used them on Star Wars Rebels too.
Whitaker ends his voiceover with “what will you become?” as we see Erso in what certainly looks like a TIE pilot’s flightsuit—but given that this is a heist movie, and she’s on an Imperial shop of some kind, looks can be deceiving.
The most surprising thing about this trailer is that it was almost all action and almost all shots of characters alone. No footage of anyone acting like a team, despite the fact that the first photo we got from this movie was the cast all arrayed like one. The tone was also a lot more action than espionage or heist stuff—which they’re either keeping to themselves, or this movie has an entirely different feel than we expected. I kind of think that we saw a lot from the first part of the film, before the team is actually all together. Which makes sense, since that’s going to be the most spoiler-free territory. This is a teaser trailer, after all.
Either way, I think we can guess a few things: Erso and Diego Luna’s character are tasked with getting the Death Star plans. It looks like they start out with some pilots as part of their team, but that goes awry and they end up with a motlier crew than intended. As for how they actually get the Death Star plans—which we know they do, since A New Hope happened—that’s a mystery for another day.
Oh, and you want more? Germain Lussier went on the io9 Facebook page to talk all about the trailer. Watch it here.
via Gizmodo
Every Cool Detail We Spotted in the Rogue One: A Star Wars Story Trailer
What Is The Silicon Valley Secret Sauce For Innovation Success?
There’s plenty of advice out there about how to make it in Silicon Valley. Some things are required for innovation success anywhere in the world, but the valley is a special place with different rules. As someone who’s spent a lot of time there, I think there are a few important elements to Silicon Valley’s success that others should know about if they’re trying to bring their ideas to life there.
Be Helpful: Successful People Help Others
You hear a lot these days about “corporate greed,” but even with so much money and prestige centered in Silicon Valley, the overall attitude of people there is very generous.…
via Phil McKinney
What Is The Silicon Valley Secret Sauce For Innovation Success?
Rogue One: A Star Wars Story
What Happens When You Shoot a Golf Ball at a Balloon Filled with Non-Newtonian Fluid?
Non-Newtonian fluids are liquids that are also sort of solid but also sort of neither but also sort of both? They’re very thick liquids or very giving solids, depending on what you want to call it. That’s why they’re so fun to do science experiments with. The Backyard Scientist went and filled up balloons with non-Newtonian fluids and ripped a chainsaw through them, shot a BB-gun at them, and fired off a golf ball cannon at them too.
He wanted to compare how non-Newtonian fluid would react vs regular ol’ water in the same situation. Let’s just say the non-Newtonian fluid explosions were so much better (and they acted like a solid).
SPLOID is delicious brain candy. Follow us on Facebook, Twitter, and YouTube.
via Gizmodo
What Happens When You Shoot a Golf Ball at a Balloon Filled with Non-Newtonian Fluid?
A Hotel Safety Checklist for World Travelers From a Former CIA Operative
No matter where you travel, you want your hotel room to be a place you can take a load off and relax. It’s hard to do that, however, if you don’t feel comfortable and safe. This hotel safety checklist from a former CIA operative can help.
Drew Dwyer, a Marine veteran and former CIA operative, has seen his fair share of travel around the world—including some not-so-safe places for travelers. If you plan on seeing all of the world and want to stay safe, Dwyer shares his personal hotel safety checklist at SOFREP.com:
- Acquire or make a copy of the fire escape plan on the back of your door. Most of these just slide out.
- Do not stay on the ground or the top floor. The ground floor is readily accessible to intruders and the top floor does not allow any room to maneuver. The first or second (European) floors allow access for most third world country emergency vehicles.
- Keep the “Do Not Disturb” sign on the door, even when you are not there.
- Always assume the room is bugged. Keep the radio or TV turned on with the volume on low at all times — even when you are not in the room.
- Keep the drapes/blinds pulled at all times, even when unoccupied.
- Keep a light on in the room when unoccupied.
- Keep a small “bug-out bag” packed with must-have items (money, ID, passport, etc.) in the event of an emergency departure.
- Carry a motion alarm that can be placed over the doorknob. They are about $20 and can be found in most electronics stores.
- Keep a flashlight next to the bed and within arm’s reach.
Some of this might seem like overkill for most travelers (especially the bugging bit), but it’s good information to know just in case. You can find more great world travel safety tips at the link below.
The CIA Operative’s Guide to Safe Travel | SOFREP via Entrepreneur
Photo by McKay Savage.
via Lifehacker
A Hotel Safety Checklist for World Travelers From a Former CIA Operative
An honest trailer for The Force Awakens
14 Netflix Hacks to Help You Binge Like a Pro
Netflix had some 75 million paying subscribers around the world—but how many of those people are getting the most out of their subscription? You can supercharge your viewing experience with these browser extensions and online apps that will take your Netflix game to a whole new level.
Extensions
Flix Plus by Lifehacker: a Chrome extension packed with tweaks from our good friends at Lifehacker, offering random episodes, customized lists, blocks for potential episode spoilers, fades for titles you’ve already seen, extended search and lots of other cool stuff.
Netflix Party: This Chrome extension enables you to watch Netflix remotely with friends. It introduces a group chat window down the right of the interface and keeps playback in sync between machines so you’re all watching the same scenes together.
NEnhancer: This Chrome extension adds a few bells and whistles on top of the core Netflix experience, including pop-up ratings, links to trailers, the option to show or hide categories on the front screen, and a random episode button (previously on Field Guide).
OttoPlay: A very handy (and free) Chrome extension that lets you watch Netflix like it’s running on an old-school cable (essentially adding the illusion of channel-surfing capabilities on top of the platform). It’s one of our favorite plug-ins for Netflix.
Super Browse: Did you hear Netflix has a ton of hidden category codes? Super Browse is a simple browser extension for Chrome and Firefox that unhides them and saves you having to guess the numerical code for each subcategory that you’re interested in exploring.
Super Netflix: Extra tools during playback are focus of this Chrome extension. It lets you adjust video quality on the fly, introduce custom subtitles, and get on-screen diagnostics with a click. It’s smooth and simple and feels very much like a native set of features.
Websites and online apps
FlickSurfer: if you’re stuck for something to watch, and you’re getting no joy out of Netflix’s recommendation algorithms, try FlickSurfer (a site we’ve covered in the past). Movies and shows can be filtered by actor, genre, rating, awards and more besides.
Flixed: As you’re probably aware, Netflix content differs wildly from country to country. Flixed lets you search by region with one click of the mouse, so you can check up on what you’re missing out on—or see the shows and movies you can watch on your next holiday.
JustWatch: This site and app covers pretty much every video-on-demand service currently out there—Not just Netflix. It’s a helpful tool for seeing exactly what’s available (use the ratings slider to make sure you’re just seeing the good stuff). This is another one of our favorites.
Leanflix: Leanflix isn’t a tool built exclusively for Netflix, but it can help you narrow down your streaming viewing choices based on critic scores, IMDB ratings, year of release, genre, MPAA rating and more besides.
Netflix Roulette: As you might expect, Netflix Roulette chooses something random for you to watch on the streaming service. You can filter by rating, director, actor, keyword, and type of content (movie or show) if you don’t want something completely random.
New On Netflix: This is another listings site, but one that’s more comprehensive than the others. The real strength of New On Netflix is its catalog of what’s old on Netflix—it has an up-to-date list of everything that’s leaving the platform in the coming days so you can watch it before it’s gone.
What Is My Movie?: The experimental What Is My Movie? isn’t specifically tailored for Netflix, but it can work out what film you’re talking about based on a natural language description (like “Tom Hanks is young”). Give it a try and be hugely impressed by its accuracy.
What Is On Netflix?: The What Is On Netflix? site looks similar to a lot of other streaming directories, but it has two important features in its favor—it lets you see all the new stuff with a couple of clicks and comes with apps for Android and iOS you can use on your mobile devices.
[Header image: Gil C/Shutterstock.com]