Quote of the Day

From the late, great Shelby Foote, author of the three volume, million word The Civil War: A Narrative, writing in 1958:

I am a Mississippian. Though the veterans I knew are all dead now, down to the final home guard drummer boy of my childhood, the remembrance of them is still with me.

When I was a boy growing up in the 1960s, the old veterans were the ones from World War I. They're all gone now, too, at least the ones from my town.

Foote's greatest gift was giving voice to the men who fought, making them more than just dates and maps. Human.

Like General Thomas Wood at the battle of Murfreesboro, ordered to stop an overwhelming confederate advance:

"Goodbye, General," Wood replied as he set out in the direction of the uproar, which now was swelling louder as it drew nearer. "We'll all meet at the hatter's, as one raccoon said to another when the dogs were after them."

General Wood survived the war, and the battle, with his sense of humor intact.

And on a lighter note ...

We can't be all about the government boot in the people's face, at least not all the time.

Mark Curphey (behind enemy lines in England) links to an outstanding Rube Goldberg contraption. Go watch. Just because.

Oh, and Mark - Internet Security Management is much, much more complicated than this.

New England following Old England down the drain

Tekmage has great post about Massachusett's idiot Attorney General, Martha Coakley. For those who haven't heard, here's the Cliff Notes version:

1. Pervert molests 4 year old in public bathroom.
2. Kid's (ex-Marine) dad catches him, and goes all Semper Fi on perv's ass.
3. Police show up, take one look at situation, and arrest the dad.
   

When Atty Gen Coakley was asked WTF was up with this, her reply was "We don't encourage self help." Well now.

Spank your child, go to jail:

Massachusetts lawmakers say a proposed measure that would ban parents from spanking their children, even in their own homes, is a way to protect kids from abuse.

Grope a toddler in a restroom? Not so much:

Although Rodriguez faces a felony charge, police decided not to arrest the suspect at the scene due to his advanced aged and lack of a criminal record.

On the surface, this just looks like another episode of Massachusetts Looney Tunes. It's not. Let's break the situation down into its constituent components:

• Perpetrator of what used to be a capital offense let go by the local constabulary? Check.
• Honest citizen arrested for execution of what used to be recognized as his public duty? Check.
• Local politicos engage in public round of "Tsk Tsk, don't you dare try to stop this sort of thing! You're to call us immediately!" Check.
  

Yesterday, I posted about idiotic airport security:

Actually solving the problem is hard. So look busy. If you can't do something productive, at least do something. The more visible, the better.

Unfortunately, that's not what's happening this time.

At first blush, it seems that the $64,000 question is "Why would the authorities not want the public's help?" Suppose that the Mass.Gov really wanted to reduce child abuse. They'd give the dad a medal, and haul Mr. Feely off to durance vile. Then everyone would retire to the local saloon: Whiskey for my men and beer for my horses.

That's sure not happening. So the real $64,000 question is "Why not?" The answer is ugly.

It's not ugly because the idiot police let the molester go free, although that's pretty ugly. While the molester is a threat to the community, he is not a threat to the authorities.

What is a threat to the authorities? Mr. Marine Dad, who wasn't a good victim, who didn't go running to the Nanny State for help, who handled things.

How's the Mass.Gov supposed to justify more spending on public safety when the public is, well, keeping itself safe. Can't have that. Listen to Ms. Coakley again:

We don't encourage self help.

You'll know that you understand her completely when a shiver runs down your spine.

So what does this have to do with Olde England? Well, we've seen this sort of thing before, in spades:

For more than two years, Sydney Davis’ house has been under siege from stone-throwing youths. And more than two hours into the latest attack on his family home, the police had yet to respond.

So after a particularly large missile landed in his kitchen, the 65-year-old grabbed a plank of wood and ran towards the gang to scare them away. But his desperate act came just as the police finally arrived on the scene - where they promptly arrested him for possession of an offensive weapon.

He now faces up to six months in prison.

There are so many of this sort of story from old Blighty that Rachel Lucas set up a whole new blog category for them. She's not the only one:

A former British soldier endures as his neighborhood terrorized by a pack of feral young thugs (“yobs,” as they call them over there) for several days. He calls the police; they never come. He looks for an officer; finds none. Coming home one day to find his wife in tears and terrified, he finally has enough, and goes out to execute a citizen’s arrest, dragging one of the thugs into house and calling his mother. Thereupon the police arrive with the mother — and naturally arrest the homeowner.

Old England is just further down the road than New England - so far so, in fact, that you can put a fork in them - they're done. The Brit.Gov is just about done assuming all power (but not responsibility - never responsibility). Crime isn't subversive to the government. Citizens are.

If the schools actually taught Massachusetts history, people might think differently. Can't have that:

If ye love wealth better than liberty, the tranquility of servitude better than the animating contest of freedom, — go from us in peace. We ask not your counsels or arms. Crouch down and lick the hands which feed you. May your chains sit lightly upon you, and may posterity forget that ye were our countrymen!

Sam, Sam, Sam. The Mass.Gov will not tolerate self help. It's subversive.

Airport Security is Kabuki theater

Tam writes a great post about how, while she has always loved flying, she won't anymore because airport security is criminal insane:

I love planes. But I won't go to the airport anymore. Not with the farce that flying has become. Two-hour waits for a ninety-minute flight. Inane security procedures. I'll drive instead, because my car won't grope me or steal stuff from my luggage.

Hey, it's a small price to pay for public safety, right? Kind of like the time the TSA has forced a military honor guard flying with a fallen comrade to strip on the tarmac,

How about this story of the woman, who was forced to publicly remove her nipple rings before going through the metal detectors? A Google search for that turned up stories from The Age (Australia), National Post (Canada), RTE (Ireland), and The International Herald Tribune (World + Dog). I guess George W Bush's policies really are getting us mocked overseas.

I once made the mistake of booking the lowest cost flight to take #2 son to see his grandparents. The round trip turned out to be two one-way tickets on different airlines (Bad Ted! No biscuit!). #2 son had to take off his shoes to get wanded down. 4 years old. At least he could get on the plane, unlike Senator Ted Kennedy.

Jonathan Adler wrote about a 3 year old who was forced to go through the explosive sniffer blower chamber by himself (cue Dr. Evil: Muhahaha!):

Amos Guiora's op-ed on the failings of airport security prompted significant response, here and elsewhere. Among other things, readers debated whether his example of TSA subjecting a three-year-old to the explosive-detecting "blower" was a good example of poor prioritization and a failure to focus on resources on actual threats.

Poor prioritization? Boy howdy.

A Google search for tsa+search+toddler returns over 100,000 hits. At least we're reducing the terrorist threat from Sippy cups and bottled breast milk.

Snark aside, there is a real downside from all this, when the public starts to assume that this is normal and prudent, and starts trying to "help" - like the grandmother who sent her infant grandson through the X-Ray scanner.

Bruce Schneier wrote about the bureaucratic approach to airport security. Surprise! It's not very effective:

Exactly two things have made airline travel safer since 9/11: reinforcement of cockpit doors, and passengers who now know that they may have to fight back. Everything else -- Secure Flight and Trusted Traveler included -- is security theater. We would all be a lot safer if, instead, we implemented enhanced baggage security -- both ensuring that a passenger's bags don't fly unless he does, and explosives screening for all baggage -- as well as background checks and increased screening for airport employees.

So why do they do it? I think it's related to why towns first cut libraries (sorry, Breda) whenever there's a budget cut, or why big city mayors like gun control despite its clear failure (not to mention unconstitutionality):

Actually solving the problem is hard. So look busy. If you can't do something productive, at least do something. The more visible, the better.

Ordinarily I'd be sympathetic. I work in an industry (Internet Security) where we're trying to so something that's hard, maybe unsolvable, and people fall for security theater here, too. As an example, look at the web site of one of the gurus of Internet Security, Marcus Ranum. Except you can't, at least with Firefox. The site is currently blocked by Google's "malware" detection (idiots). Firefox swallows this hook, line, and sinker (idiots). Ignore my advice, and take Internet Explorer and look at dumb idea #6:

There's an important corollary to the "Action is Better Than Inaction" dumb idea, and it's that:

"It is often easier to not do something dumb than it is to do something smart."

So it's hard to be sympathetic when some petty TSA functionary adopts Ready-Fire-Aim as standard policy, to show the rubes that we're from the government and we're here to help. Hey dude, can you pretty please stop doing something dumb?

No? Dang. I guess I'll drive.

Update 7-13-08 18:55: Holy tar-and-feathers, Batman! It seems like there's a web site devoted to tracking stupid TSA abuse. Hat tip to Stupid Security, which is a fun read and worth following if you care about security theater.

UPDATE #2 7-15-08 11:12: Whoo hoo! A Tam-alanche! Thanks, and hope y'all take a look around. My snark's not up to her level, but I try. ;-)

UPDATE #3 7-15-08 21:30: For the lighter side of airport security, you can find XKCD's take via here.

Doh!

Slashdot reports a pretty funny Internet attack:

"As all hardcore Simpsons fans know, Chunkylover53@aol.com was revealed to be Homer Simpsons' email address in one particular episode, registered by one of the shows writers, who would reply to fans as Homer himself. After a flood of messages, 'Homer' signed off — seemingly forever. Well in the last few days, security company Facetime Communications reports that anyone who had Homer on their AIM buddy list would have noticed his sudden reappearance. Unfortunately for all, he appears to have been hacked and pushing malware links which deposit those unlucky enough to run the file into a Turkish Botnet.

This is a good example of an attack that exploits a trust relationship - only users savvy enough to recognize this as Homer Simpson's real AOL account would be vulnerable. It's very plausible that one of these people would run an executable sent from this account.

So remember, "Click to run" is the Internet equivalent of "open your mouth and close your eyes" ....

And as always, the Slashdot comments come through with quality snark:

mmmmmmmm... trojans...

I'm not doing this right

As an update to yesterday's range report on the Winchester 1894, my shoulder has a bruise as large as the grouping shown in target #2. No wonder I had that dang flinch in the last group.

And no, I'm not posting a picture, but thanks for asking.

Teddy Roosevelt has been dead for these 90 years, and he's still going to kick sand in my face. He shot .45-90 in his beloved Winchester, not wimpy .30-.30.

Oh bother.

Postscript: There's some good reading from Teddy available. Barnes and Noble has republished The Wilderness Hunter (originally published in 1905), about T.R.'s ranch days. It gives many examples of his "enthusiastic but adequate" shooting. The Gutenberg Project has a selection of free T.R. e-book or text entries, from "Hunting the Grisly" to "The Right of the People to Rule". We don't see men of his caliber any more. Sigh.

Saturday Redneck - Big and Rich

We've got a bit of a cowboy theme running right now, between the Winchester range report and getting my Duke on. Today's dose of redneck comes from Big and Rich: "Save a Horse, Ride a Cowboy".

As always with my redneck selection, it has to be different from the expected. A lot of people associate country music with bible thumping holy rollers. This is (ahem) a horse of a different color:

Well, I walk into the room
Passing out hundred dollar bills
And it kills and it thrills like the horns on my Silverado grill
And I buy the bar a double round of crown
And everybody's getting down
An' this town ain't never gonna be the same.

(Chorus:)
Cause I saddle up my horse
And I ride into the city
I make a lot of noise
Cause the girls
They are so pretty
Riding up and down Broadway
On my old stud Leroy
And the girls say
Save a horse, ride a cowboy.
Everybody says
Save a horse, Ride a cowboy

Well I don't give a dang about nothing
I'm singing and Bling- Blanging
While the girls are drinking
Long necks down!
And I wouldn't trade ol' Leroy
Or my Chevrolet for your Escalade
Or your freak parade
I'm the only John Wayne left in this town

And I saddle up my horse
And I ride into the city
I make a lot of noise
Cause the girls
They are so pretty
Riding up and down Broadway
On my old stud Leroy
And the girls say
Save a horse, ride a cowboy.
Everybody says
Save a horse, Ride a cowboy

(Spoken:)
I'm a thourough-bred
That's what she said
In the back of my truck bed
As I was gettin' buzzed on suds
Out on some back country road.
We where flying high
Fine as whine, having ourselves a big and rich time
And I was going, just about as far as she'd let me go.
But her evaluation
Of my cowboy reputation
Had me begging for salvation
All night long
So I took her out giggin frogs
Introduced her to my old bird dog
And sang her every Wilie Nelson song I could think of

And we made love
And I saddle up my horse
And I ride into the city
I make a lot of noise
Cause the girls
They are so pretty
Riding up and down Broadway
On my old stud Leroy
And the girls say
Save a horse, ride a cowboy.
Everybody says
Save a horse, Ride a cowboy

What? What?
Save A Horse Ride A Cowboy
Everybody says
Save a Horse Ride a cowboy.

Not your father's country music. Boy, howdy. But hey, I'm the only John Wayne left in this town. Except for half the others that took the quiz.

Range Report - Winchester 1894

Last week, I went to the range. Last week, I couldn't hit the broadside of a barn (from inside the barn). Random Acts of Patriotism encouraged me to do a lever action range report (mmmm .... lever gun!). Plus, every time I look at the lever gun at Jay G's site, I have to wipe the drool from my chin. So I packed myself off to the range to get some shooty lever goodness.

I shot the Winchester model 1894, similar to the one here, only with a short (carbine) barrel:

Let me say right at the start that this is my absolute favorite gun, rifle or pistol. The iron sights are good (consistent), and the trigger is really nice - no creep, and a good sudden break. The .30-.30 gives some authority downrange, the carbine length barrel makes it very handy, and the solid construction means it has modest recoil. As a certified recoil wussie, that makes this a very easy rifle to make friends with.

I shot 40 rounds of .30-.30, in five shot groups, with a new targets each time for easy scoring. All shooting was done at 25 yards (I know, I know, but it's an indoor range), from a bench rest. First group of 5 was to see where the rifle's sights were zeroed.

I have a SuSE Linux CD-ROM to provide size comparison. Fighting for Liberty isn't the only "pompous Linux user" around!

So we'll give this a 'Gentleman's 3 inch group' - although it's high and to the right. OK, reload and correct the aim point:

Well, that's more centered. But still high. Then there was one of those "Earth to Ted" incoming bulletins - the rifle is probably zeroed at 150 yards; you're shooting at 25. Looks 2 inches high, which would be about right.

Correct, reload, fire. Last group (#8) was best, except for a flyer (after 40 rounds of .30-.30, my shoulder was getting sore, and I confess to a flinch):
A one-inch grouping (except for the antisocial Mr. Flinch). Overlapping bullet holes. X-Ring, baby!

OK, so I still suck - this was only 25 yards, from a bench. A nice rifle like this should shoot like this. But unlike last week, I was consistent in my groupings.

What I really need to do is fire 400 rounds, not 40, and at 100 yards, not 25. Then deer will ph33r me, but that wouldn't feel good for either my shoulder or my wallet.

Now, an interesting thought is a lever gun in .38 special/.357 mag. A quick exercise of my Google-fu suggests that it might be fine for hunting at up to 75 yards. Given how overgrown the New England forests are, and how I'm a (ahem) enthusiastic but only adequate shot, this might do the trick. Plus it would be nice to have a single caliber for both your rifle and a sweet wheelgun.

Not that there's anything wrong with being an enthusiastic but adequate shooter. Especially one also named Ted.

Gettin' my Duke on

What Kind of a Western Bad-Ass are You?

You scored as a John Wayne

You a classic all American cowboy who does the right thing. When you're sober. Which means occasionally. You like horses, the outdoors, whiskey, hot tempered women, whiskey, and bourbon.

What kind of Western Bad-Ass are You?

Oh, and Quizfarm? Not cool asking for the password to my blog so you can post something directly here. Even if "login info will never be saved." You're talking to a security guy here ...

Something I just don't understand

It seems that requiring someone to pass a test and pay for a license is blatantly unconstitutional if you're talking about history tour guides, but it's perfectly OK to require someone to pass a test and pay for a license to get a gun?

The Institute for Justice is challenging Philadelphia's new requirement that tour guides be licensed and take special history and geography exams. IJ seems to be exactly right on this: Such a requirement violates the First Amendment.

The government surely couldn't require that authors of history books or travel books be licensed and take exams. Nor can it require the same as to producers of travel documentary DVDs, or actors in theaters that present history/geography-related informational entertainment.

So what the heck do we do with these guys? History tour guides with guns!















Mind you, I'm not saying it's necessarily bad to get yourself all edumacated-like if you've a mind to pack some heat. Just what's the big diff between the first and second amendments? I must be missing something.

I guess that's why you need to take a zillion years of law school, to learn that the obvious isn't.

B2 Bomber computers upgraded to Pentium

No, that's not a typo. And that's Pentium, not Pentium II or III. The Reg reports:

While it might seem odd to some readers that the US Air Force's multibillion dollar flagship plane is only now "upgrading" to fairly basic tech, this is commonplace in advanced aerospace and military kit. The space shuttle's flight computers, similarly critical to it remaining under control, are likewise basic. In the early years of the 21st century, the main battle computer of a Royal Navy destroyer was still based around two 24-bit, 1 MHz processors each with 25KB of RAM.

Maybe it'll be water tight, too. But to make up for it, it's getting an awesome upgrade to colossal bunker buster bombs. Well, that's a start.

Dr. Evil: You know, I have one simple request. And that is to have sharks with frickin' laser beams attached to their heads! Now evidently my cycloptic colleague informs me that that cannot be done. Ah, would you remind me what I pay you people for, honestly? Throw me a bone here! What do we have?

Number Two: Sea Bass.

Dr. Evil: [pause] Right.

Number Two: They're mutated sea bass.

Dr. Evil: Are they ill tempered?

Number Two: Absolutely.

Dr. Evil: Oh well, that's a start.

Teh Funny (Spam edition)

Insty links to a Slashdot article on spammers circulating emails saying that the US has invaded Iran, and started World War III. As is so often the case with Slashdot, the money quote is in the comments:

World War III is starting? Oh god, I still haven't received my check from that Nigerian prince! And where's my viagra?

Mod +5 snark, that is.

That's not a bug, that's a feature

JD, on the 10th anniversary of the Massachusetts gun laws:

Before the 1998 law was passed, there were approximately 1.5 million licensed gun owners in the state, but because of the persecution and the expense ($100 for a gun license), the number has been reduced to about 240,000 and the armed criminals are having a field day.

So please tell me what this law actually reduced for illegal activity???

JD, the law has been a huge success - gun licenses down 85% in ten years. Mission accomplished! Why are you asking about something entirely unrelated, like illegal activity?

Sigh. Wonder what it'd be if this were a "shall issue" state?

Blogging: The second week

Something really weird happened this week - people started visiting. I'm not sure why this seems so astonishing.

Stats:

48 posts (almost 50% more this week than last, but I was on vcation).

3 more comments. Thanks, guys!

My first request! "Do another Range Report" - like I need another excuse ....

142 total visits, 67 this week. Still averaging ten a day, but now it's not all me! Whoo hoo!

Visitors from 5 countries. Really getting my international on!

But my Technorati-fu is still weak: #4,329,517. Oh, bother.

Internet Security and Guns (no, it's not me)

It's Squeaky.

Seems that antivirus [vendor name redacted] was messing up her dad's computer, so she rode to the rescue. Well done, you!

If you don’t know this information beforehand, you will spend HOURS waiting for Windows to remove the program. [vendor name redacted], being an over-bearing waste of RAM, will try desperately to spend as long as possible pretending to uninstall so that you will finally give up and leave it on your computer until the day comes when you have 10 hours to spend waiting for it to finally follow through.

Slow, expensive, and feature-poor, but other than that it's awesome.

But one gentle reminder:

Also? As a fun aside? As soon as AVG was active, and internet surfing to sites that my dad and stepbrother have used consistently commenced, AVG noted that there was spyware that was being transferred to the machine (via IE). [vendor name redacted] didn’t catch that, in over 2 years of use.

Internet Explorer? Ack, ack, ack. Remember the Two Simple Rules - not to be confused with the Four Rules ...

Environmentalism causes Global Warming

No, really.

"The decrease in aerosols [pollution reduction - ed.] probably accounts for at least half of the warming over Europe in the last 30 years," says Rolf Philipona, a co-author of the study at MeteoSwiss, Switzerland's national weather service.

So, clean up the environment, destroy the world. Damned Environmentalists. Thanks for nothing, guys!

At least Bruce reports the happy news that there seems to be nothing that global warming can't do:

Why, just yesterday, global warming cleaned the siding on my house, pruned my hedges, and made me a nice grilled cheese for lunch.

Mmmmm ... grilled cheese!

Quote of the Day

From Jay:

However, it's about damn time we of the cleansed pate were recognized as the sexy beasts that we are...

Well, duh!

And congrats on 100k visits!

Same planet, different worlds

Seems like Obama let the mask slip yet again. This time, it's not bitter rural folks clinging to their guns, it's embarrassment that y'all don't speak french.

I mean, how are you going to drop le mot juste if you can't do it with la clarité francaise? Shucks, everyone at the faculty lounge will laugh at you.

The Red State/Blue State divide has been hashed to death, but what is interesting is that each side considers the other to be so, well, stupid.

The Blue State view is easiest, and is dismembered in a flash. Red Staters are ignorant, red necky, knuckle dragging imbeciles who would all vote for the Commie-of-the-Month club if they'd just stop watching NASCAR and going to church all the damn time. The typical Blue Stater is completely sealed in his own sense of intellectual superiority, as Eric Raymond so mercilessly describes. Europeans get honorable mention as super-Blue Staters, the only outstanding question is are they clueless or calculating? Hey, go for both, guys!

Red Staters attitudes are more subtle, and therefore more interesting. My experience (living in both the north and the south) is that Red Staters are more willing to recognize the fancy book learning that Blue Staters are so proud of. Behind this, there is this under current of "How can someone so smart be so dumb?" It seems to Red Staters that sometimes Blue Staters will believe the most astonishing nonsense. Eric Raymond wrote seriously about this, as did Steven den Beste. James Lileks just mocked it.

What's striking is that the more you look at the Blue Stater's view - really seriously analyze things - you see it falls apart. The world is much more complex than they give it credit for. However, the more you analyze the Red Stater's view, the more it gets validated. Intellectually, I mean. You know, like more than just stereotypes.

I know, because I used to be one of those ignorant Blue State intellectual imbeciles. I got better. This just about completely sums them up - too smart for their own good, and not knowing it.

John Kerry was a living, breathing example of this; Barack Obama looks like he's another.

These folks have been told for so long that they're the brightest kids in the class, that they think they don't actually have to act like the smartest kids in the class. And the mask slips. Just for a second, and covered up by the media (who are paid up, lifetime members of Blue State America), but you can see it if you bother to look.

They don't realize that some of us have been there, done that, got the pix, and thanks, but I'm done with it. So Senator Obama, if you're embarrassed at us knuckle draggin', redneckin', cousin marryin', tobbacco chewin', NASCAR watchin' red necks, let me offer the mot juste:

Besse moi.

And for all you Blue Staters who think that the euros will kick intellectual sand in your faces the next time you're around Avignon way, here's a handy 12-step recovery program.

Dang. I think my passport expired.

Airline security: smart or not?

Not.

Bruce posts about some idiots that want to set up an Invisible Fence in a commercial airliner and give y'all a shock collar:

The bracelets remain inactive until a hijacking situation has been identified. At such time a designated crew member will activate the bracelets making them capable of delivering the punitive measure - but only to those that need to be restrained.

Bruce makes great points about qui custodiet ipsoes custodes, ending with the Question Of The Day:

I mean, what could POSSIBLY go wrong?

Well, Bruce, as a Full Service blog covering security issues, let me count the ways:

• Listen in on private communications sent via wireless? Check.
• Send Way Too Much electrical energy through the air via a directional antenna? Check.
• Figure out how to use "sooper sekret" wireless commands to reprogram medical equipment that can hurt or kill someone? Check.

I'm just waiting for those crazy kidz at Defcon to make a homebrew airline "Shock 'o Matic" for everyone to take home on the flight from Vegas. Don't believe me? Follow the link: "Real time social networking for Ninjas". Cool time. Check out the lockpicking and hardware hacking sessions.

Let me close with a story from the Old Days of computer security - so old, it was even before my time (yes, kids, it's true!).

This man called himself Cap'n Crunch:








The reason is that he figured out that he could program the long distance telephone switches (remember, kids, these are computers) to give him free long distance calls. This was back when long distance was muy expensive.

How did he reprogram the switches? What specialized hax0R tools did he need? This:









That's right, the prize in the cereal box.

How on earth was this possible? Well, it mostly boiled down to:

• "What if someone tries to ..."
• "Don't worry. Nobody would ever try that."
• "Besides, how ever would they get a whistle that plays precisly 2600 Hz/figure out the right combination of bits to beam via a laser"?

Of course, nobody who says anything like this has ever been to Defcon. Remember, kids, don't try this at home!

So Bruce, the answer to your question is "more than you can possibly imagine."

UPDATE, 7/10/2008 19:24: Looks like this is busted. Seems that someone proposed this to the TSA a while back, and the TSA said "thanks but no thanks." I still stand by the assertion that whoever proposed it had never been to Defcon.

Patch Tuesday - Nothing to see folks

Move along. Unless you run Vista - this will make your performance stink less. Maybe.

Follow the money

While we're still fresh from the ongoing Heat Death of Security (TM), there's a very interesting post over at Emergent Chaos on someone who's actually rolling out better security. What's interesting is not so much that they're beefing up security, but why they are:

This isn't the case of a game having better security than most banks (as Maynor says). This is a game company leaping ahead of some banks, because they realize they have bank-like security issues.

The gaming company? Blizzard, maker of World of Warcraft. Their players were having their accounts stolen, and when they player logged on, they found all their stuff had been stolen. The solution, provide stronger user authentication (duh!).

So good for Blizzard. The do some pretty interesting things to keep security on the up and up, anyway. Perhaps not everything works, but they're trying. Puts them rather a ways ahead of a lot of folks these days.

And thanks for asking, but I don't play WoW myself. I lost too much of my life to Civilization, back in the day. It would way cut into my range time.

OMG, we're all going to die!

There's a problem in DNS (for those of you new to Al Gore's Intarwebz, that's what changes cute names like "borepatch.blogspot.com" into actual, you know, addresses). Seems that if you're really clever, you can pretty much pwn DNS at will, which lets you do all sorts of fun and games - like impersonate web sites.

As you'd expect, the security world is in a bit of a tizzy over this. As they should be. They're security gurus, after all.

Should you be in a tizzy? Well, that depends. If you're also a security guru, then you don't need to listen to me on this. If you're not, here are some things you should know:

1. There's probably not much you can do about this. Your ISP (and all the other ISPs) will have their security guru run out the patch, post haste.
2. There's basically no information available on this - it will be unveiled at the Black Hat briefings next month in Las Vegas. Therefore, it's kind of hard to gauge just what the heck is going on, except a lot of smart security guys are paying attention (see links above, or on the blog roll).
3. The press is almost certain to get this wrong, and hype it as much as they think they can. None of them will have the slightest idea what they're talking about.

So, did we create the "Infrastructure of the 21st Century" out of moonbeams and spun sugar? Sure did. Did anyone at all give the slightest thought to security when Al Gore set his Zombie Army to work on the information super highway? Uh, sorry, nope. Will Sir Pwnsalot and his 'leet friends empty grandma's online bank account? Given web security, they probably already have - this doesn't change much.

Are we all gonna DIIEEEE? Don't think so.

Security is a pretty funny business. We're not getting any better at it, but we're not all getting fired, either. Yay, us!

You're really a security geek if you laugh at this

From the always funny xkcd.

War of Attrition

I was browsing the "Bargain Books" aisle at Barnes and Noble, and found Shelby Foote's 3 volume Civil War set. Cheap. Yay, me!

Well, I'm 10 pages from done with the first volume, and already I can appreciation how it must have dragged on for the poor sods who fought it.

And Foote is a pretty good writer. I must be turning into a wussie in my old age.

Obviously, Foote needed an editor. And Microsoft Office. Maybe the Powerpoint version of the Gettysburg Address. Just to tighten things up a bit.

Adieu, vacation

Back to work.

Two Simple Rules for Safer Browsing - Update

Dave LeBlanc has some interesting comments on the recent browser security study. Dave is a very serious security guy, as opposed to me (I just play one on TV), so as always, RTWT.

I'm not convinced to run IE (hey Dave, when are y'all going to have one that runs on SuSE?), but his take on the seriousness of information leaks is spot on:

A flaw that IE doesn't have is advertising to the server the exact minor version of the application. People often underestimate the value of information leaks – advertising the exact minor version is basically saying "Hello, you may attack me with these exploits, but I'm patched against those exploits."

He also points out some statistical analysis issues with the study. Good reading if you want some drill down from my blathering.

Teh Funny (George Orwell version)

Security cameras on the Placa George Orwell. You can't even make up this sort of thing.

Mark Curphey has pix.

662 to 6

That's the score of comments on the ACLU's "Blog of Rights" (Motto: "Because Freedom can't blog itself") discussing the ACLU's position re: D.C. v. Heller. 662 against the ACLU. Kind of stirred up a hornet's nest there, guys.

The funniest comment is #116:

OK

I read the bad comments on Heller stance.

Where is the good comment forum located?

I read 'em all so that you don't have to (Whee! That was fun!). Wasn't as hard as I thought: any post containing the words "shame", "stupid", "indefensible", and "repugnant" automatically went into the "against" column.

If you want to play this game at home, here are the comments that supported the ACLU: 39, 146, 197, 290, (maybe) 292, 348.

And a shoutout to commenter liberalsRlosers (#616): sorry, dude, I have to invoke Godwin's Law on your butt. I probably sort of agree with you in general (other than the icky Nazi reference), but you're hurting the team.

Hat tip: xrlq via Sebastian.

The Four Rules

The always hilarious Tam writes about an uber-leet french live fire demonstration gone wrong, with spectator casualties:

The world got an awful reminder on the last weekend in June, when a team of elite French para marines turned a public demonstration of a hostage rescue into a "How Many Of The Four Rules Can You Break At Once?" competition, Team Category.

Here at Chez Borepatch, we try to take a more, well, restrained approach to our violations of the four rules. Offered for your consideration is Exhibit 1, the porch:


Not shown: Finished floor (hadn't done sanding/sealing when I took the pic), painted trim (ditto), and spider-web shattered plate glass window.

Offered for your consideration as Exhibit 2, transcripts from secret Gitmo water-boarding of #2 son. Cliff's Notes version: he sang like a canary:

George W Bush: What happened to the window?

#2 Son: I don't know!

GWB: But you were out in the yard with your friends, playing with BB guns.

#2 Son: I got nothing for you, kuffar!

GWB (readying waterboard): So, do I have to call your friend's parents?

#2 Son: We missed the target! We didn't mean to! We didn't know that the target was in front of the window!

GWB: So which of the four rules did you violate?

#2 Son: Um, number 2?

GWB: And?

#2 Son, thinking quickly: Three, no four! Number 4! Be sure of your target and what's behind it! I'll go move the target to the tree house.

So, Tam's right. You need to violate 2 of the four rules to put holes in something you don't want perforated.

Oh, and BB guns won't break glass. They were shooting one of these. Oh, bother. $700 worth of oh, bother.

Range Report - Beretta Cx4 Storm

I used to shoot a bit when I was a kid - nothing unusual about this, growing up in central Maine in the 1960s/70s. Then I kind of dropped it for years. A few years ago, I found Kim du Toit on Al Gore's Intarwebz, and it started coming back. Kim was even nice enough to post a new shooter report featuring #2 son. So this Range Report is a thanks to Kim for getting me back into the swing of things.

Kim, I'm sorry to say that today, I sucked.

#2 son came with me, and took a hankering to the Beretta Cx4 Storm, a fine-looking Evil Black Rifle (EBR). While I had lever gun action in mind (mmmmm ... Lever Gun!), I thought that shooting an EBR would be a fine Heller celebration. Besides, this one was chambered in 9mm, so it would be cheap shooty goodness.
Let's start with the good. It's handy, short, light. OK, so it's a carbine. Buttons are easily workable - mag release, safety, etc. Easy, easy, easy to use. While I was a bit surprised at the recoil (9mm euro-pellet in a carbine form, I was expecting none to speak of), it was really easy to shoot. Good gun for new shooters when they move up from a .22 rifle.

Now the bad. The trigger is really heavy, with no good break. I don't know if Beretta has a reputation for good triggers, but they didn't enhance it with this. However, the worst thing was the sights. I just couldn't keep this on target worth a darn.Five groups of 10 rounds, at 25 yards, off hand. First is shown in orange - only 4 shots hit the paper (at 25 yards!). I suck. #2 son is grinning at this point. Second group shown in blue. I'm really concentrating, and in my head I hear Col. Jeff Cooper whispering "the FRONT sight!" Better, actually got one in the ten ring, but still missed the dang paper with 2 shots. I'm really starting to hate the trigger, but I keep getting distracted because I can't decide if I hate the trigger more than the sights. And what the HECK was with that flyer? I suck. #2 son is really paying attention now, as he's kicking my butt, and his grin is from ear to ear.

I really take my time on the third group, in green. Not so bad, but I should be better than this at 25 yards. And this is s-l-o-w fire. Fourth group is yellow. WTF? It's way off again, except a couple "flyers" that make me look good. The fifth group is a mystery, as at this point I'm so flummoxed that we forget to swap targets, and I shoot at #2 son's. On, bother.As you can see, his grouping is kind of spread out, but he's giving Mr. Target a bad day - 15 out of 50 in the 9 ring or better. Even if you count my extra 10, that's 15 out of 60, but the way I was shooting, those X-Ring babies were all his.

So, what did we learn?

1. Ted didn't make friends with the Beretta Storm.
   
2. If the Terrorists attack, they'd better hope that this is all I have, as they'll be entirely safe.
   
3. Of course, if I have #2 son with me, I'll just hand it to him, and let him give them a bad day, center mass-wise.
4. I have GOT to do better than this next time, or Jay will laugh at me at the New England Meet, Greet, and Skeet gun blogger meet up. And Weer'd Beard will kick sand in my face. Oh, bother.

UPDATE 16 August 2008 13:25: Since Google is still leading people to this post, you might want to check out an updated post that discusses Beretta triggers. And take a look around while you're here.

UPDATE 26 November 2008 14:05: I went back to the range and tried again, with very different results. Updated Range Report is posted here.

Saturday Redneck - Montgomery Gentry

One of the sad things to hit rock music in the last 25 years is excessive market fragmentation. While it makes sense from a marketing perspective (IOW, to pointy-haired marketing directors), it means that you get less and less variety when you turn on the radio. This is one of the reasons that I listen to Country stations, as there's actually much more variety there.

Today's Saturday Redneck is "All Night Long" from Montgomery Gentry. It's basic, rocking night club music - good guitar, easy to dance to, upbeat and fun. Kind of what Rock 'n Roll used to be. Not really Country at all, except you'll only hear it if you tune your radio to the Hillbilly part of the dial.

Well the party started early
About a quarter to three
Just a few close friends
Charlie, Troy, and me
We just got started when somebody asked
How long you think this party's gonna last

I said all night long (all night long)
I said all night long (all night long)
We'll be rockin' we'll be rollin'
Gonna boogie-woogie all night long

Well the next door neighbors started raising a fuss
Said you had a party and you didn't call us
I said put on your dancing shoes and come along
We'll be here till the cows come home

I said all night long (all night long)
I said all night long (all night long)
We'll be rockin' we'll be rollin'
Gonna boogie-woogie all night long
(and that's all night long)

(Ahh, guitar)

We'll be jumping through the windows and sneaking down the halls
Dancing on the ceiling, dancing on the wall
The last thing I remember 'fore the lights went out
I jumped up on the table and I started to shout

I said all night long (all night long)
I said all night long (all night long)
We'll be rockin' we'll be rollin'
Gonna boogie-woogie all night long

More on browser security

Yesterday I discussed browser security, and recommended using Firefox for day to day browsing and Opera for online financial browsing. There's a recent very interesting paper examining the security of different browsers that gives some more data supporting this. What is most interesting is their statistics about how many users of each browser type have the "latest and greatest" version of the browser. The latest version has the most security vulnerabilities fixed.














Notice that both Firefox and Opera score over 90% - in other words, over 90% of users running these browsers have the latest version, with the most security fixes. Just over half of Internet Explorer users are up to date. Also, Microsoft's update mechanism (Windows Update) has been known to probe around your computer for installed applications, report back to Microsoft even if you're not running their updates, change their terms of service without your consent, and install fixes when it wants without telling you even if you have configured it to require your approval. Not cool.

Personally, I've noticed that Firefox is very aggressive about getting security updates. Good for them.

So here's more support for the two simple rules to increase your browser security:

Rule #1: Don't ever use Internet Explorer.

Rule 2: Use Opera for important financial transactions. Use Firefox for everything else.

Note: I used to work at ISS before they were IBM ISS.

July 4, small town America

Even though this is the People's Republic of Massachusetts, the little town we live in has quite the parade each July 4. Even though the weather was a little disappointing, this year was no exception.

The day started Chez Borepatch with my greasy breakfast, this time with Patriotic Pancakes!








People get into the spirit of the day:


There's quite the turn-out:








Then the parade starts. Can't have a small town parade without vehicles ...




Jeeps, baby!


And who cares that gas is $4 a gallon?








The militia turned out. These guys are probably breaking the law in New Jersey. Hey, New Jersey! When I lived in Georgia, no matter how backwards, ignorant, and rednecky things got, folks would always say "Thank God for Alabama." Well, now I'm in Massachusetts. Thank God for New Jersey!


Heck yeah, those things work!








The veterans turned out. Thanks, guys! Yeah, that's a Navy Captain. Why do you ask?


Marching bands, too. The Republican party turned out with several bands. Nothing from the Democrats. Note to Democrats - don't take us for granted! Next year I expect a battle of the bands!


It's summertime. Ripe blackberries right along the road. Just be careful of the poison ivy right along the road ...

Thank you

From Abraham Lincoln, in his 4th of July address given after the fall of Vicksburg and the battle of Gettysburg, 1863:

That was the birthday of the United States of America. Since then the fourth day of July has had several very peculiar recognitions. The two most distinguished men who framed and supported that paper, including the particular declaration I have mentioned, Thomas Jefferson and John Adams, the one having framed it, and the other sustained it most ably in debate, the only two of the fifty-five or fifty-six who signed it, I believe, who were ever President of the United States, precisely fifty years after they put their hands to that paper it pleased the Almighty God to take away from this stage of action on the Fourth of July. This extraordinary coincidence we can understand to be a dispensation of the Almighty Ruler of Events.

Another of our Presidents, five years afterwards, was called from this stage of existence on the same day of the month, and now on this Fourth of July just past, when a gigantic rebellion has risen in the land, precisely at the bottom of which is an effort to overthrow that principle "that all men are created equal," we have a surrender of one of their most powerful positions and powerful armies forced upon them on that very day. [Cheers.] And I see in the succession of battles in Pennsylvania, which continued three days, so rapidly following each other as to be justly called one great battle, fought on the first, second and third of July; on the fourth the enemies of the declaration that all men are created equal had to turn tail and run. [Laughter and applause.]

Gentlemen, this is a glorious theme and a glorious occasion for a speech, but I am not prepared to make one worthy of the theme and worthy of the occasion. [Cries of "go on," and applause.] I would like to speak in all praise that is due to the the [sic] many brave officers and soldiers who have fought in the cause of the Union and liberties of this country from the beginning of this war, not on occasions of success, but upon the more trying occasions of the want of success. I say I would like to speak in praise of these men ...

On this July 4th, I'd like to thank the men and women who have left home and family to fight what has often seemed an uphill battle in Iraq and Afghanistan. We're winning now, thanks to you.

And special thanks to Lance Corporal Daniel Hansen, currently in Fallujah. Stay safe, kick the Bad Guy's butt, and come home soon.

Ray Charles would typically start "America the Beautiful" with the second verse, not the first:

O beautiful for pilgrim feet
Whose stern impassioned stress
A thoroughfare of freedom beat
Across the wilderness!
America! America!
God mend thine every flaw,
Confirm thy soul in self-control,
Thy liberty in law!

It wasn't a song, it was a prayer. Today, and every day - amen.

Quote of the Day

From Marco:

They should have just randomly mailed taxpayers a pallet of Bud Light, an iPod, a Marlin lever gun, or a lifetime subscription to “German Midget Co-Eds Gone Wild”, and achieved the same economic effect, only with more entertaining distribution.

Mmmm. Lever gun!

Saturday Redneck Security Snark

It's not saturday, but this isn't redneck. Dang funny, and while Mac security isn't perfect, it is a way to increase your security-fu.

2 simple rules for safer browsing.

A week ago I rambled a bit on the lousy state of browser security. So what can you do about your browser security? Basically, make yourself a difficult target. It's easier than you think.

What you need to know is where the threat comes from and what the Bad Guys are trying to get. Then it will be a lot clearer how to make this harder for them.

The Bad Guys

I pointed out in my post Patching is a pain in the bore that malware has pretty much been criminalized. The Bad Guys are organized crime, mostly (well, the dangerous ones, who are most likely to try to nab your Paypal info). Talented people make a living writing exploits. Now, it's not the easiest thing writing exploits - if you screw up, your 'sploit runs wild like RTFM or Farid Essebar, and everyone notices. Chris notices. The New York Times notices. Your boss notices. Your boss is mad, because stealing money is harder when every rushes to apply the security patch. Did I mention the organized crime bit?

What this means is that we're seeing an increase in quality in malware. This is A Bad Thing, because:

1. Low quality malware makes programs crash. A crashed program can't steal data. It's a Good Thing when they can't steal data.
   
2. Users notice when programs crash. The more they notice, the more likely they are to patch their program. Patching in general is A Good Thing.
   
3. When users notice your malware, they send it to antivirus companies, who make signatures for your malware. This means some of your potential victims are protected by the time your exploit attacks them.
   

So malware is written much more carefully than it used to be. 2003 in particular was the "Year of the worm". We don't see that any more, not because we're better at patching (ha!), or because our security software is better at protecting us (double ha!), but because we no longer notice successful attacks.

What the Bad Buys are trying to get

Money. Credit card numbers, social security numbers, Paypall account info, other personal info. Your info.

Make yourself a harder target

The exploit writer needs to produce a high quality exploit - this is pretty hard, and takes some time. He's going to invest his time making an exploit that will work for the largest number of computers possible. For example: target Internet Explorer or Firefox? Well, Internet Explorer has 75% market share, to Firefox's 20%. Also, you have 3 out of 4 chance of having a successful exploit in IE (75%) vs. maybe a 1 in 3 chance in Firefox (33%). So, 75% of 75% of the market is 56% of everyone is vulnerable, vs. 33% of 20% (7% of everyone).

Rule #1: Don't ever use Internet Explorer.

Ever. Don't make me want to change my tone.

Also, browsers aren't the only part of your computing environment. Your Operating System is darn important to Exploit Boy. If he wants to install a sneaky bot (trojan, spyware, spam relay), it needs to run on your OS.

Again, let's play the percentages: 90% Windows, 8% Macintosh, 1% Linux, 1% other.

So, Tam, you're in pretty good shape. Me, too - I run Linux. Admittedly, this may not be practical for everyone (especially Kim, who's probably lost his CPU to Vista now), but it's a big, big win if you can.

Whether you or not can not use Windows, you should absolutely use a separate browser for important (e.g. financial) browsing: online banking, brokerages, 401k, Paypal - all of these should only be done in a different browser. By "different" I don't mean "open another window". I mean get a different damned browser. I like Opera. Fast, free, everything works fine in it. 0.7% market share - nobody in his right mind will target it. Did I mention the Organized Crime bit?

Rule 2: Use Opera for important financial transactions. Use Firefox for everything else.

Everything. I mean it. OK, Macintosh folks can use Safari for everything else. Actually, Windows users can use it, too, but remember that it's 7% market share vs. 0.7% market share (yeah, OK, Safari on Windows is not 7%, but still, you know what I mean).

So I don't lose my security geek street cred, I have to say that this is no panacea, yadda yadda yadda. Still, it's easy, simple, hard to mess up, and reduces your attack profile. I don't care who you are, that's a security win.

OMG! More security in new browsers?

Say it ain't so. I guess I shouldn't snark, and be grateful that security is at least included in the wish list. Then again, where would we be without snark? Security is only 4 out of the top 15 features? With the imminent heat death of the browser casting its shadow on the whole of the Web 2.0 Intarwebz? Pretty well sums up how we got to the edge of the heat death of the Intarwebz.

For anyone interested in Cross Site Scripting, there's a great introduction here. Except, dude! You have the black leather and sunglasses down for the 'leet h4X0r guy - but where's the goatee?

Happy birthday NSFNet

A day late, but at least my heart is in the right place. It's really hard to imagine what networking was like before The National Science Foundation rolled out the NSFNet: lots of different networks (BITnet, USEnet) running lots of different protocols (SNA, DECnet, UUCP). NSF made two really important decisions:

1. Standardizing on TCP/IP meant that any computer could hook up to NSFnet. This was important to the universities, which had pretty much ever old sort of computer ever made.
2. While it was modeled on the DoD's ARPAnet, NSF let pretty much anyone - education, government, or private companies - use their backbone. In essence, it created the Internet.

All snark aside, Al Gore was actually pretty instrumental in pushing funding for this. NSFnet was all T-1, and they weren't cheap. While we think it's dog slow today (at least if you have broadband), it was pretty smoking fast at the time. Just as a reference point, 4 years after NSFnet came online, 12 other engineers and I shared a 32 kbps Frame Relay link, and thought we were the coolest network kids in the neighborhood.

Of course, nobody thought about security at the time. And of course, it only took 4 months for someone to show that this was A Bad Thing.

All of this was back when my Network-fu was strong, like Chris. Back when my email went to Dockmaster. I sound like such an old fart.

My work here is done

On the screened porch, that is.

Floor looks great (sanded and finished). Ceiling looks great (finished). In-wall stereo hooked up. Rewired system so that in-wall stereo now actually makes noise. Moved carpet and furniture there.

The kids hated it when I had to take down the house LAN to get the @#$%! stereo playing music. They actually had Intarwebz withdrawal. I expect a SWAT team headed by Al Gore any second now.

I'm pooped. If you don't mind, I'll take an Ibuprofen cocktail and head to bed now ...

Blogging: The first week

OK, one week in. You want stats? We got stats:

20 posts (would be more except had to go into the office yesterday. On vacation. Oh, bother.)

1 link (thanks, Jay!)

1 Comment (from Tam! Whoo hoo!)

63 Total Visits (Average 10 Per Day) (Well done, you!)

121 Total Page Views (Average 17 Per Day)

A lot of those visits and views were me. However, it seems that I'm getting at least a couple dozen actual real folks stopping by. I'm assuming you're mostly checking up on what I'm saying.

My Technorati-fu is still weak, but hey I'm up to #3,900,162. Thanks a million, everyone!