Emmylou Harris : Red Dirt Girl

A red dirt girl's brother is fixing up a '49 Indian motorcycle.  He promises to take her "riding the wind", but doesn't come back from Vietnam.

Nobody does sad like Emmylou. Maybe that's why she won the Grammy for this album.



Red Dirt Girl (Songwriter: Emmylou Harris)

Me and my best friend Lillian
And her blue tick hound dog Gideon,
Sittin on the front porch cooling in the shade
Singin every song the radio played
Waitin for the Alabama sun to go down
Two red dirt girls in a red dirt town
Me and Lillian
Just across the line and a little southeast of Meridian.

She loved her brother I remember back when
He was fixin up a '49 Indian
He told her 'Little sister, gonna ride the wind
Up around the moon and back again"
He never got farther than Vietnam,
I was standin there with her when the telegram come
For Lillian.
Now he's lyin somewhere about a million miles from Meridian.

She said there's not much hope for a red dirt girl
Somewhere out there is a great big world
Thats where I'm bound
And the stars might fall on Alabama
But one of these days I'm gonna swing
My hammer down
Away from this red dirt town
I'm gonna make a joyful sound

She grew up tall and she grew up thin
Buried that old dog Gideon
By a crepe myrtle bush in the back of the yard,
Her daddy turned mean and her mama leaned hard
Got in trouble with a boy from town
Figured that she might as well settle down
So she dug right in
Across a red dirt line just a little south east from Meridian

She tried hard to love him but it never did take
It was just another way for the heart to break
So she dug right in.
But one thing they don't tell you about the blues
When you got em
You keep on falling cause there ain't no bottom
There ain't know end.
At least not for Lillian

Nobody knows when she started her skid,
She was only 27 and she had five kids.
Coulda' been the whiskey,
Coulda been the pills,
Coulda been the dream she was trying to kill.
But there won't be a mention in the news of the world
About the life and the death of a red dirt girl
Names Lillian
Who never got any farther across the line than Meridian.

Now the stars still fall on Alabama
Tonight she finally laid
That hammer down
Without a sound
In the red dirt ground

What's cool

Running errands on your motorcycle with a backpack you stole back from the kids.  Got saddlebags?  Doesn't matter: backpack FTW!

Getting done riding your motorcycle, taking your riding gear off, and finding out that you're not covered in sweat.  It's record low temperatures here in Hotlanta, meaning that the temperature is delightfully temperate.  It feels like early October, as a matter of fact.  I look forward to the riding that I shall do.

Meeting a gent in a local pub whose voice sounds just like Christopher Walken.  And who says that nobody had ever told him that.

Introducing that gent to Youtube's Christopher Walkenthrough series.  Win.



Turning off the air conditioner, opening the windows and turning on the attic fan at night.

Playing hookey from posting for an evening.

Why everyone hates security

Even I hate security sometimes.  Times like this, in fact.



Password must be a palindrome. Epic security troll is epic.

More problems with climate data

This time it's with tree ring analysis:

A new paper now in open review in the journal Climate of the Past suggests that “modern sample bias “has “seriously compromised” tree-ring temperature reconstructions, producing an “artificial positive signal [e.g. 'hockey stick'] in the final chronology.”

Basically, older trees grow slower, and that mimics the temperature signal paleo researchers like Mann look for. Unless you correct for this issue, you end up with a false temperature signal, like a hockey stick in modern times. Separating a valid temperature signal from the natural growth pattern of the tree becomes a larger challenge with this correction.

Huh.  Pretty hard to see bias as driving that, just a reflection that the universe is a tricky place that we (mostly) poorly understand.  I wonder what sort of biases are in ice core data?  They're obviously highly dependent on precipitation levels as well as temperature.

Dang it.  And I thought that the science was settled.

Top 10 Hollywood Hack scene fails

The Gaijin emails to point out the awesomeist Redit, It's A Unix System I know this!  You will lose a day here, not just in what is posted to it but in what that leads you to.  This is pretty good.



All I can add is that the movie "Hackers" was such a deep sucking chest wound of FAIL that it could have had 3 or 4 scenes in the top 10.  But I guess that would have been bogarting the Fail, or something.

Etta James - Misty Blue

NSA fallout

I'm conflicted.  A year ago, I posted about the CyberPatriot IT Security competition for High School students:

The Air Force sponsors a High School cyber defense program called CyberPatriot, where schools form teams of students who compete with other teams in a NCAA-style March Madness where the kids have to secure a set of computers and an Air Force Red Team attacks:

CyberPatriot is the premier national high school cyber defense competition that is designed to give hands on exposure to the foundations of cyber security. CyberPatriot is not a hacking competition. CyberPatriot's goal is to excite students about Science, Technology, Engineering, and Mathematics (STEM) education.

The Competition

In each competition round, students are provided one to three virtual machines. These machines contain several vulnerabilities, and students must clean the image of them. The virtual machines can have Windows or GNU/Linux Operating systems. They are given a set amount of time on the competition day to do so. Teams that find the most vulnerabilities pass on to the next round, and the winners of all three rounds compete in the National Championships in Washington, D.C.

Here's what's cool: the skills that the kids learn are basic IT administration, with an emphasis on security.  Passwords, patches, configuration settings.  There's a curriculum downloadable from the CyberPatriot web site, but the contents will be familiar to anyone who's in IT.

But dig this: while you have to actually be a teacher at the school to be a coach, the system relies on "mentors" who volunteer from the community.  Anyone can do it, although they'll do a background check on you.  I'm trying to talk #2 Son's JROTC commander into signing up.

Now I don't know.  Yes, it would be a great field for the kids to get into.  Yes, the program is great hands-on experience, and can help kids get into great college programs.  Yes, the country needs more IT security experts.

But the whole NSA Spyapalooza thing has made me reconsider whether I should help the military get more guys who very well might end up feeding that beast.  Maybe I'm over reacting, but part of me really doesn't trust the DoD - in such a deep, deep way - that my heart isn't in it.  If they ask me to, I probably will, but I'm not sure if I'll bring it up.

If #2 Son wants to learn, I'll teach him.

Man, I never thought things would come to this.

Did the Airbus flight control computers just kill two more pilots?

Airbus has a long history of "pilot error" (note that this is disputed by the Air France pilot's union) causing crashes, particularly on landings when airframes fly into hills.  And so why I heard about the fatal crash of a UPS A300-600F, I immediately thought angle of descent vs. rate of descent:

Following an uneventful flight from Lyons the crew prepared for a descent and approach to Strasbourg. At first the crew asked for an ILS approach to runway 26 followed by a visual circuit to land on runway 05. This was not possible because of departing traffic from runway 26. The Strasbourg controllers then gave flight 148 radar guidance to ANDLO at 11DME from the Strasbourg VORTAC. Altitude over ANDLO was 5000 feet. After ANDLO the VOR/DME approach profile calls for a 5.5% slope (3.3deg angle of descent) to the Strasbourg VORTAC. While trying to program the angle of descent, "-3.3", into the Flight Control Unit (FCU) the crew did not notice that it was in HDG/V/S (heading/vertical speed) mode. In vertical speed mode "-3.3" means a descent rate of 3300 feet/min. In TRK/FPA (track/flight path angle) mode this would have meant a (correct) -3.3deg descent angle. A -3.3deg descent angle corresponds with an 800 feet/min rate of descent. The Vosges mountains near Strasbourg were in clouds above 2000 feet, with tops of the layer reaching about 6400 feet when flight 148 started descending from ANDLO. At about 3nm from ANDLO the aircraft struck trees and impacted a 2710 feet high ridge at the 2620 feet level near Mt. Saint-Odile. Because the aircraft was not GPWS-equipped, the crew were not warned.

Why this is interesting is that fuel economy drives the use of many of the modes in the Airbus:

On a jet, the most fuel efficient way to descend is of course to stay in the optimal cruising altitude as long as possible, then cut the thrust and glide with a certain glide speed to the destination deceleratate for the approach, and, ideally you only advance throttles as far as the outermarker to spool up for go-around.

Simply put, the speed (i.e. steepness of your glide/dive ) calculation is based on economic fuel to flight time ratio (the cost index). So all you have to do is make a good decison about the top of descent point observing all the speed and altitude constraints ahead. Which is, obiously the tricky part.

For this regime the autopilot interface has a mode selector named Level Change (B) or Open Descent (A).

Should you find yourself short of the field, either you slow down (shallow your descent) - not good as you accumulate extra time on the flight, or add thrust - fuel penalty, the lower the worse.

While I don't know details, I wouldn't be at all surprised that this was the intersection of a complicated cockpit control design and corporate policies that made pilots think twice before taking corrective action.

Certainly Airbus has a history of their computerized control systems confusing pilots - a record not shared by Boeing.  Me, I much prefer flying in a Boeing rather than in a "Scairbus", but that's just me.

It's the hottest year ever

Did I say "hottest?"  I mean record cool temperatures:

The average high temperature this time of year in these parts is 89°.  Today looks to be more than 15° lower, and actually setting a record for the "High Minimum" temperature - the lowest recorded maximum temperature of the day (beating 77° set in I think 1908).

I blame Global Warming!  Why is this?  Because Global Warming causes everything!

Ceci n'est pas une blogpost

Via El Wik

René Magritte is perhaps my favorite painter, relentlessly clever and ever so sneaky: his works sucker you in to real intellectual challenge because they're just plain fun.

He was a Belgian impressionist painter who quickly took a turn to the surreal.  Unlike most surrealists (*cough* Salvador Dali *cough*), his works kept one foot in the sane world.

He is best known for his painting of a tobacco pipe, done in the style of the ubiquitous tobacco advertisements of his day.  The painting had a bold script reading Ceci n'est pas une pipe (this isn't a pipe).  It's a reference that you stumble across rather a lot, foreshadowing complaints about Madison Avenue and stupid adverts by decades.  The title of the painting is not widely known, but should be: The Treachery of Images.  As Magritte said about the painting, "Of course it is not a pipe.  How would you fill it with tobacco?"

Image via El Wik

This one used to hang in my apartment.  It got pretty beat up, and sadly got tossed some while back.

Many of his paintings included men in overcoats wearing bowler hats, most famously raining down on a city from the sky.  It was the inspiration for this delightfully playful (dare I say Magrittesque) scene from the remake of The Thomas Crown Affair.



René Magritte died on this day in 1967.  Thanks for the intellectual challenge, René.  And for all the fun.

Judgemental

That's me.

Judgy, judgy, judgy.

What do you get when you spend $100 on a lightbulb?

A couple months ago I posted on the $100 Philips Hue light bulb which is so exclusive that it's only sold to fanboys through the Apple Store.  So what do you get for your money?  A light bulb that can be trivially hacked to leave you in the dark:

The Philips Hue “smart lighting” system uses a dumb-as-a-sack-of-hammers device authentication scheme that allows anyone with the iPhone control app to issue instructions to the controller via HTTP.

...

And Hue also has a “feature” that probably had the marketing team in a spasm of hypegasm when it was devised: users can set up “recipes” that let the lights respond to the state of other apps. For example, the hue of the Hue can be made to respond to the user's Facebook activity for a service call “If This Then That” (IFTTT).

If the lights' colour was set to respond to a tagged photo on Facebook, for example, then simply sending a black photo would activate the recipe and turn the lights off.

Security wasn't an after thought, it wasn't thought of at all.  Here's a video of the hack in action:



I'd call the Philips team a bunch of idiots, but that would be insulting to actual idiots.

Security: what's old is new again

A great introduction to security bugs is the old, old (1990s) "ping of death".  It shows the disconnect between how software developers think and how security researchers probe and test the limits.

Quick background: ping is an old, old network test tool from the 1980s.  It sends a network packet to a destination you specify, and the destination replies.  Basically it's a "can you hear me now?"/"Sure can" test.  The name refers to sonar, and the film Hunt For Red October shows the use of that in a decidedly non-network context. You can run this yourself, if you get a DOS shell (Command prompt).  Type "ping a.b.c.d" (where the IP address goes in place of the a.b.c.d).

The problem that was discovered in the 1990s was that if instead of sending 56 bytes of ping data, if you sent 64,536 bytes, some systems would crash.  The responding system was supposed to return all received ping data, and this much data caused the packet to get fragmented and some computer operating systems simply couldn't deal with this.  The system would go down when it received one of those "ping of death" packets.

Nothing has been vulnerable to ping of death for years and years.  Until now.  Microsoft's Patch Tuesday has an update for the next generation IP (IPv6) that fixes the new, old ping of death:

MS13-065 is another interesting item in this month’s lineup. It addresses a vulnerability in the Windows TCP/IP stack for IPv6. A few ICMPv6 packets with Router Advertisements requests can cause a Denial of Service vulnerability reminiscent of the famous “Ping-of-Death.” It’s a good illustration of how much we still do not know about the stability of IPv6. We continue to recommend turning off IPv6 on workstations if your network is not engineered for its use. Take into account that a number of home networks already have IPv6 and that your corporate machines might be exposed to this attack vector already.

Retro exploits FTW!

Why Edward Snowden is a sea change in government leaking

In a long and thoughtful essay on government secrecy, leaks, and civil disobedience, Danah Boyd observes the dynamic in play:

Ironically, the government’s efforts to deter future whistleblowers by being tough on Snowden is most likely to backfire. This kind of zero-tolerance approach assumes that those who are engaging in whistleblowing are operating under the same logic, priorities, and values as government actors. Sure, plenty of people don’t come forward because they’re too scared; that’s not new. But because of how the government responded to Snowden, those who are willing to take on the big fight now have a model for how to do it, how to iterate based on what they learned watching Snowden. The US government, far from deterring future whistleblowers, has just incentivized a new generation of them by acting like a megalomaniac.

And this is where I think that Nadia’s second point is of serious importance. People growing up with the internet understand that information is power. Those who’ve watched protests in recent years know that traditional physical civil disobedience doesn’t create the iconic narratives and images that it once did. And thus, not surprisingly, what it means to protest is changing. This is further complicated by an increased obsession with secrecy – secret courts, secret laws, secret practices – that make using the rule of law to serve as a check to power ineffective. Thus, questioning authority by leaking information that shows that power is being abused becomes a more valuable and notable form of civil disobedience. As with all forms of civil disobedience, there are significant consequences. But when secrecy is what’s being challenged, the biggest risk is not being beaten by a police officer for staging an event, but being disappeared or silenced by the institutions being challenged or embarrassed. And thus, as much as I hate to accept it, becoming a diplomatic incident is extraordinarily powerful not just for self-protection, but also as a way to make sure that the media doesn’t lose interest in the issues at play.

Too many people - especially those whose career has been spent in static, hierarchical organizations like governments - think in terms of static process.  Make policy X.  Enforce policy X.  They don't realize that policy X changes the behavior of citizens effected by policy X.  Tax policy is a good example - tax increases never result in nearly as much revenue as projected, because people change their behavior to avoid actions that would cause them to be taxed.

For those of us who haven't spent our careers in static, hierarchical organizations, this is all a bunch of well duh.  Maybe that's why I'm not impressed with Progressives who seem to have forgotten Marx' dialectic: thesis (action), antithesis (reaction), synthesis (the new equilibrium).  The government in general and the NSA in particular seem to think that cracking down on whistleblowers (thesis) is the new equilibrium. 

They'll have as much luck with that as getting rid of 90% of their system administrators:

The National Security Agency, hit by disclosures of classified data by former contractor Edward Snowden, said Thursday it intends to eliminate about 90 percent of its system administrators to reduce the number of people with access to secret information.

If they could actually do that, they'd be billionaires in the business world.  The fact that nobody has figured out how to eliminate the cost of 90% of the folks who run IT tells you just how out of touch the NSA is.  My guess is that the new equilibrium will be wildly beyond the dreams of the people running this Administration.

The old joke is that the rocket scientists work at the other NSA.  That seems to be truer and truer.

Scientists: Actually, we don't think that Mankind is changing the climate

Specifically, only 36% actually do believe this:

Don’t look now, but maybe a scientific consensus exists concerning global warming after all. Only 36 percent of geoscientists and engineers believe that humans are creating a global warming crisis, according to a survey reported in the peer-reviewed Organization Studies. By contrast, a strong majority of the 1,077 respondents believe that nature is the primary cause of recent global warming and/or that future global warming will not be a very serious problem.

The survey results show geoscientists and engineers hold similar views as meteorologists. Two recent surveys of meteorologists (summarized here and here) revealed similar skepticism of alarmist global warming claims.

It's peer reviewed, so Science!  What, you're not one of those bloody Science Deniers, are you?

The British Library blocks access to Hamlet

The British Library is perhaps the greatest library in the world, an absolute delight to bibliophiles everywhere and a protector of civilization's greatest works.  Or it used to be, before the Nanny State instinct caused it to block WiFi access to Shakespeare's Hamlet because the play is "too violent":

I took my computer over to the information desk, and after I had explained to them what MIT stood for (really), they called the IT department and told them about the webpage that I had been blocked from. http://shakespeare.mit.edu/hamlet/full.html

They had to spell out Shakespeare letter by letter. Really. Ess. Aitch. Ay. Kay...

I asked them if they were surprised that Hamlet was now banned in the British Library. They shrugged. I asked them how it was that I could still access youtube, facebook and twitter. I asked why the girl at the next desk to me had been able to spend the last half hour on Guardian Soulmates, while the Massachusetts Institute of Technology's website was banned. They shrugged.

I asked if they saw the problem, perhaps just the symbolism, of Hamlet being banned in the British Library. They shrugged.

[Blink] [Blink]

Observe your Philosopher Kings, ye Progressives.  Philosopher Kings.  After our hero posted the story and a rather lot of unwelcome attention resulted, the British Library relented and now the Bard can be read by patrons of the library.  It's a "victory" that Britain's greatest author can now be read in the British Library.

Well done, Mr. Forsyth.

... I'll have grounds
More relative than this: the play 's the thing
Wherein I'll catch the conscience of the king.

Every now and then it seems like we're caught in the 1950s

#2 Son brought back a bunch of "You need to sign these forms" from his first day of school.  This one (from his economics class) struck me as something I might have received, back in the day:

• This is a classroom, not a locker room.  You are a student, not a sailor.  Use language that is appropriate for students in class.
• Cheating (including plagiarism and copying the work of others on homework or tests) is both disrespectful and dishonest.  It is also disgraceful.  Your character is worth more than some random grade in Economics class.

Emphasis in the original.  There's more, but these jumped out at me.  Probably in my day these wouldn't have been written down, but they absolutely would have been told to us.

And yes, the teacher is male.  I like the cut of this fellow's jib.

Every now and then it seems like we're caught in the 1930s

"Angel Priest" identified.  This seems like a story you could have read in the '30s.

Two wheels move the soul

This compressed bit of win is Ends In The Ocean by the Kiwi band Avalanche City.  TMe, I'd love to take this ride.  Err, and get some Sauvignon Blanc.

It's the Internet. It has cat pictures.

When you don't feel like posting, there are always cat pictures.

Meh

Having trouble working up the gumption to post.  There's even big security news (the Federales taking out much of the TOR anonymyzing network), but I'm just not feeling it.

Must be the Dog Days of August or something.

The Great Questions

Throughout recorded history, the greatest minds have grappled with the Great Questions.  Not the OK Questions, not the Pretty Good Questions.  Not the Have Your Heard Questions.

The Great Questions.  What is it fully to be human?  What is it to live the Good Life?  What is it to live as if today were to be your last day?  Some give us answers that make us stop, and think.



Some of those in our little corner of the Internet challenge us in the same way.  Brigid is one of my daily reads, because when she's at her best she approaches Proust:

But what about those inner thoughts, those you don't tell anyone? Think to someone you once loved, or perhaps do now. If you had known then, what you know now, about your desire and theirs, would you have run away from the intensity of their gaze, those eyes possessing a wisdom all their own. Or would you, knowing what you know now, run to them with an ease and a comfort that no random coming together of two people could ever have produced.

Or would you have simply run away?

A Great Question.  Not an OK Question, or a Pretty Good Question.  Great.  A question that challenges us to the darkest pits of our soul.

You notice things. You notice the way he looks at her, this woman who is no longer a girl, as if he measured everything in his sight by the response it drew from her twinkling eyes. He lights her cigarette, with a look and a touch, the flame burning brightly, a star in miniature, expiring into the darkness with the rush of its need. You smile as they rush on in, never seeing you, traceless in your quiet detachment, the flame now vanished towards the distant moon, stars so far out of reach.

You think of someone else, a voice that paused with emotion when you laid out your hurt and your fear, words that comfort and ears that listened.

What might have been?  Where would the Road Not Taken lead?  Great Questions.

The Great Questions, of course, do not have answers.  That is not their purpose.  It is said that if you want to hear God laugh, tell Him your plans.  God does not give us answers, but rather the Great Questions.  What is it fully to be human?  What is it to live the Good Life, as God and we would wish?   What is it to live as if this very day we would find ourselves Bound For Glory?

Read Brigid's whole post, which may be her very best ever.  It answers no questions; on the contrary, it asks questions that challenge us.  Great Questions.  Being human is a quest.  A journey, not a destination.  Like with the Arthurian Knights of old, you enter the trackless wilderness at a lonely place where no man has set foot, each striking out on his or her own in what can only be considered an act of the highest impertinence to an uncaring universe.  Because the finding is not possible without the seeking.

RTWT, twice.

That's how I roll, yo

It's been all nerd all the time lately, so here's the Official® Theme Song for Nerds everywhere.  Extra Nerd points for using Lego stop action filming.  After all, I need to level up ...



White and Nerdy (Songwriter: Weird Al Yankovic)

They see me mowin'
My front lawn
I know they're all thinking
I'm so White N' nerdy

Think I'm just too white n' nerdy
Think I'm just too white n' nerdy
Can't you see I'm white n' nerdy
Look at me I'm white n' nerdy!
I wanna roll with-
The gangsters
But so far they all think
I'm too white n' nerdy
Think I'm just too white n' nerdy
Think I'm just too white n' nerdy
I'm just too white n' nerdy
Really, really white n' nerdy

First in my class here at M.I.T.
Got skills, I'm a Champion of D&D
MC Escher that's my favorite MC
Keep your 40
I'll just have an Earl Grey tea
My rims never spin to the contrary
You'll find they're quite stationary
All of my action figures are cherry
Steven Hawking's in my library
My MySpace page is all totally pimped out
I got people begging for my top 8 spaces
Yo I know Pi to a thousand places
Ain't got no grills but I still wear braces
I order all of my sandwiches with mayonnaise
I'm a whiz at minesweeper I can play for days
Once you see my sweet moves you're gonna stay amazed,
my fingers movin' so fast I'll set the place ablaze
There's no killer app I haven't run
At Pascal, well, I'm number 1
Do vector calculus just for fun
I ain't got a gat but I got a soldering gun
"Happy Days" is my favourite theme song
I can sure kick your butt in a game of ping pong
I'll ace any trivia quiz you bring on
I'm fluent in JavaScript as well as Klingon
Here's the part I sing on

They see me roll on, my Segway!
I know in my heart they think I'm
white n' nerdy!
Think I'm just too white n' nerdy
Think I'm just too white n' nerdy
Can't you see I'm white n' nerdy
Look at me I'm white n' nerdy
I'd like to roll with-
The gangsters
Although it's apparent I'm too
White n' nerdy
Think I'm just too white n' nerdy
I'm just too white n' nerdy
How'd I get so white n' nerdy?

I've been browsing, inspectin'
X-men comics you know I collect 'em
The pens in my pocket
I must protect 'em
my ergonomic keyboard never leaves me bored
Shopping online for deals on some writable media
I edit Wikipedia
I memorized "Holy Grail" really well
I can recite it right now and have you ROTFLOL
I got a business doing web sites
When my friends need some code who do they call?
I do HTML for them all
Even made a homepage for my dog!
Yo! Got myself a fanny pack
they were having a sale down at the GAP
Spend my nights with a roll of bubble wrap
POP POP! Hope no one sees me gettin' freaky!

I'm nerdy in the extreme and whiter than sour cream
I was in AV club and Glee club and even the chess team!
Only question I ever thought was hard
Was do I like Kirk or do I like Picard?
I spend every weekend
at the renaissance fair
I got my name on my underwear!

They see me strollin'
They laughin'
And rollin' their eyes 'cause
I'm so white n' nerdy
Just because I'm white n' nerdy
Just because I'm white n' nerdy
All because I'm white n' nerdy
Holy cow I'm white n' nerdy
I wanna bowl with-
the gangsters
but oh well it's obvious I'm
white n' nerdy
Think I'm just too white n' nerdy
Think I'm just too white n' nerdy
I'm just too white n' nerdy
Look at me I'm white n' nerdy!

 Actually, Stephen Hawking is in my library.  That's how I roll, yo.

I don't think this is as accurate as Alan's

His is spot on.  Mine, I'm not so sure:

You Are A:

True Neutral Human Ranger/Sorcerer (4th/3rd Level)

Ability Scores:
Strength- 12
Dexterity- 13
Constitution- 15
Intelligence- 15
Wisdom- 12
Charisma- 14
Alignment:
True Neutral- A true neutral character does what seems to be a good idea. He doesn't feel strongly one way or the other when it comes to good vs. evil or law vs. chaos. Most true neutral characters exhibit a lack of conviction or bias rather than a commitment to neutrality. Such a character thinks of good as better than evil after all, he would rather have good neighbors and rulers than evil ones. Still, he's not personally committed to upholding good in any abstract or universal way. Some true neutral characters, on the other hand, commit themselves philosophically to neutrality. They see good, evil, law, and chaos as prejudices and dangerous extremes. They advocate the middle way of neutrality as the best, most balanced road in the long run. True neutral is the best alignment you can be because it means you act naturally, without prejudice or compulsion. However, true neutral can be a dangerous alignment when it represents apathy, indifference, and a lack of conviction.

Race:
Humans are the most adaptable of the common races. Short generations and a penchant for migration and conquest have made them physically diverse as well. Humans are often unorthodox in their dress, sporting unusual hairstyles, fanciful clothes, tattoos, and the like.

Primary Class:
Rangers- Rangers are skilled stalkers and hunters who make their home in the woods. Their martial skill is nearly the equal of the fighter, but they lack the latter's dedication to the craft of fighting. Instead, the ranger focuses his skills and training on a specific enemy a type of creature he bears a vengeful grudge against and hunts above all others. Rangers often accept the role of protector, aiding those who live in or travel through the woods. His skills allow him to move quietly and stick to the shadows, especially in natural settings, and he also has special knowledge of certain types of creatures. Finally, an experienced ranger has such a tie to nature that he can actually draw on natural power to cast divine spells, much as a druid does, and like a druid he is often accompanied by animal companions. A ranger's Wisdom score should be high, as this determines the maximum spell level that he can cast.

Secondary Class:
Sorcerers- Sorcerers are arcane spellcasters who manipulate magic energy with imagination and talent rather than studious discipline. They have no books, no mentors, no theories just raw power that they direct at will. Sorcerers know fewer spells than wizards do and acquire them more slowly, but they can cast individual spells more often and have no need to prepare their incantations ahead of time. Also unlike wizards, sorcerers cannot specialize in a school of magic. Since sorcerers gain their powers without undergoing the years of rigorous study that wizards go through, they have more time to learn fighting skills and are proficient with simple weapons. Charisma is very important for sorcerers; the higher their value in this ability, the higher the spell level they can cast.

One thing for sure, the Nerd is strong in both of us ...

Sunday Morning link dump

It looks like Heroditus Huxley may have found a summer camp for Wolfgang.  Sure would solve the problem of how far he'd have to run after the tennis ball ...

That's loud, Comrade!

I've posted several times about the amazing smart-o-matic that is the James Burke shows.  Connections II is no exception.  And also from Your Crazy Uncle Bubba, subtly restrained, stylish fashion.

It's not a link dump without Isegoria (you do read him every day, don't you?).  The public education system is failing boys, both figuratively and literally.  There's a simple solution to this.

If you're not angry, you're not paying attention.  Meh, I'm angry at the Democratic Party who used to stick up for the working guy.  Now with Obamacare everybody work 29 hours a week and immigration amnesty flooding the labor supply, the hypocrisy that makes RWCG angry with the Reason Magazine school of libertarians is precisely what I feel towards "Progressives".  Makes me rather cross on a lovely Sunday morning.

Good luck hacking this car.

Handel and Purcell: Baroque trumpet made anew

Here we find that marketing meets the Baroque, which will indeed test the old saying if it's not baroque, don't fix it.  This is sufficiently made of win as to make that unlikely.

EMI has a new Alison Balsom album out.  She's a rising star in the Baroque trumpet set, and a bit dishy to boot.  And so the Marketroids have a Youtube video promoting here new album of Handel and Purcell.  Since some of us would crawl on our hands and knees over broken glass for Handell and Purcell trumpet music, this dishiness seems a bit distracting.



There's a bit too much talking with not enough to say, but oh the music.  Sublime doesn't begin to describe it.  The tenor singing in falsetto would be a distraction, except that's precisely how it was done ca. 1700, when it was still somewhat scandalous for women to perform in public.  While there was rather a lot of that happening, you never would have seen in it Royal performances.

Alas, I do not have the lyrics to these works.  Handel was a native German (Georg Philip Handel, if you please) had an "interesting" view on English pronunciation.  There's quite a bit of inside humor in The Messiah, for example.

But all in all, well done to the EMI Marketroids.  This makes me want to take a listen to Ms. Balsom's album which, after all, is what marketing is all about.  Here's is another taste of Ms. Balsom's album.  Tasty indeed, especially with a good cup of coffee on a lazy  Sunday morning.



Full disclosure: I played trumpet for ten years in school, and entirely enjoyed the challenge of Purcell.  Alas, I never had the opportunity to sing falsetto, keeping my vocal escapades confined to the baritone range.

The day that Borepatch became Borepatch

I was 15.  We were getting out of Vietnam.  I was - as most teenagers do - was learning how to think as an adult, and not as a child.  On that day, I watched this, and nothing was ever the same again.



This was the intellectual turning point for me, and it's now available to anyone who wants it, courtesy of Mr. Gore's most excellent Information Superhighway.  It's a little dismaying to compare the 49,000 page views of this to the 49 Million (or whatever) from Honeybadger.

Nerdgasm

I was out on the Motorcycle, and while waiting in traffic saw a hand lettered sign "Used Book Sale".  Well, I'm constitutionally incapable of passing that sort of thing up, and so pulled into the parking lot.  It was the Milton (GA) Library raising money.  It was late in their display time, and so most of the selection was pretty well picked over.

Fortunately, my tastes are a little (ahem) eclectic.  I cruised over to the history section, and saw this:

That's The Story of Civilization by Will and Ariel Durant.  10,000 pages of Pulitzer Prize winning overview of Western Civilization.  Alas, they did not have Volume VIII (Louis XIV), but I scooped up the rest for a buck a book.

Ahem.

I expect that this is the best deal in learning ever seen on the face of the earth.  Amazon has used sets from $85 or so.  I firmly believe that if you were to read this cover to cover, you would be better educated than 99.99% of anyone you will run across.

And note to self: saddle bags for the bike are a good idea, but don't size them for 10,000 pages of Western Civilization.  You probably won't run across this sort of cosmic win again.

That's quite a friend

Erin posts a moving plea about her friend, Squeeky:

I am ready to record a dramatic reading of whatever you folks like, but there has been a lack of decision as to what this reading will be. Some folks have expressed an interest in having me read a Dr. Seuss tale, and others want me to read a selection from 50 Shades of Gray. I'm going to start accepting nominations for what I read in the comments below, and then folks will vote on the choices.

She's all in, putting friendship before everything.

Here's how you can help:

1. Donate money to her surgical fund. Between needing a wheelchair and this new procedure, and then whatever expenses come after, she's going to need all the help she can get. Please donate what you can.
2. Buy her a gift for Operation: Lymeparty.  Let's lift her spirits so she can get through this difficult period of fear and worry!
3. If you live in/near Memphis, TN and are willing to act as a clearinghouse for physical gifts, please let me know!
4. Spread the word on your blog.  The more coverage this gets, the more help she gets. 
5. If you know anyone within the medical supply field, contact me directly. Squeaky needs things to make her wheelchair more comfortable.

Ours is a small corner of the Internet, but Erin shows that it contains big hearts.

Old warbirds

Comrade Misfit tells us that one out of a thousand B-17s are still flying.  She has video.

UPDATE 11 August 2013 10:21: Updated to make the gender of the text agree with the gender of Comrade Misfit.  Bolshoe spasibo, Comrade!

Howlin' Wolf - How Many More Years

Birthday music, of a sort.

Dang.

Can I have a different Czar of Muscovy?

I'm guessing that Our Czar woudn't save just the World, but would save the Universe.  While having the meteor obliterate His enemies ...

UPDATE: Picture removed after people's antivirus started complaining about it.

His name is "Organ P. Donor"

2cents (who's blogging again!  You do read him every day, don't you?) emails this picture which more or less speaks for itself.

Hey, the chicks dig organ donors.  Well, it's what I heard.

And 2cents has a kick ass post about a kick ass Frenchman in World War II.  No joke.  I'm guessing the chicks dug him.  Formidable!

Dear gunstore lawyers: Shut. Up.

Epic rant is epic:

The nice lady who cuts my hair was mentioning to me the other day that she attended a concealed carry class. I asked her what she thought of it, and her conclusion was that actually having ready access to a gun was too much liability. Turns out that her “instructor” had given her lots of tips, like suggesting that if a dude kicks in her front door and comes in the house with a weapon, she can’t take any aggressive action because he might just be there to steal the TV or something.

A woman who is sometimes alone at night in her house with just her young children is being told by an “instructor” that she has to let an armed home invader do whatever the hell he wants because he might only be after some valuables. You can’t point a gun at him or shoot him until he actually succeeds in attacking you!

Spreading incorrect information about self defense law is not helping people. It is not protecting them. It is not serving their interests in the slightest. It is guaranteeing that people who face the compelling need to use significant force in a hurry will be unsure about doing so, and will increase the chances of them being injured or killed by a criminal aggressor.

If you have not so much as bothered to google statutes and case law relevant to self defense in your jurisdiction, then I insist that you do the entire planet a service and shut the ***CENSORED*** up.

Read. The Whole. Damn. Thing.  Dang, I need Ratus to do a "It's fixin' to collapse into a Black Hole of Win" picture for me ...

World's Smallest Violin

New York Yankees player Alex Rodriguez - the biggest cheater in the history of the sport, who is now suspended for the rest of this season and all of next season for using performance enhancing drugs - says that the last 7 months have been a "nightmare":

Alex Rodriguez told a news conference Monday the past seven months had been a “nightmare, probably the worst time of my life” but refused to go into specifics about his suspension by Major League Baseball for the remainder of the current season and all of next year for using performance-enhancing drugs.

...

 Rodriguez, the game’s highest paid player, said repeatedly he wanted to “let the process play out” as he addressed reporters before taking the field against the Chicago White Sox, where he was jeered by fans as he stepped to the plate.

All together now: poor widdle Alex.

And because it's A-Rod, and because this is about his drug use, I gladly invoke Chris Lynch's excellent suggestion and play the A-Rod theme song.

Reason #458 why Obamacare is a bad idea

The Health Insurance Exchange web sites look like they won't be secure:

(Reuters) - The federal government is months behind in testing data security for the main pillar of Obamacare: allowing Americans to buy health insurance on state exchanges due to open by October 1

The missed deadlines have pushed the government's decision on whether information technology security is up to snuff to exactly one day before that crucial date, the Department of Health and Human Services' inspector general said in a report.

As a result, experts say, the exchanges might open with security flaws or, possibly but less likely, be delayed.

Look at that last sentence: schedule is more important than security.  Remember, all your personal information including Social Security Number, address, full legal name, telephone number, and income all go into the Exchange web site.

And as we see, schedule is more important than security.  Ooooooh kaaaaaaay.

At this point all Progressives that ever uttered the words "government is what we all choose to do together" can just STFU and sit down in the back of the room.  Grownups are talking.  And quite frankly, have been talking, and about this, for over a year:

According to an April [2012] RAND Corporation report, the feds might lose up to $98 billion annually to Medicare and Medicaid fraud and abuse, significant amounts of that related to the theft of personal information from government databases. And the political pressure to complete the hub before the exchanges begin enrolling applicants next fall will only add to the temptation to cut corners and declare success with a shoddy product not ready for prime time.

The data security aspect of ObamaCare's health insurance exchanges has received little scrutiny and less thought.

Security wasn't an afterthought: it wasn't thought of at all.  What a train wreck.  $100B/year has got to be a record for crummy computer security.  Figures it would be the Fed.Gov setting that benchmark.

Um, it looks like that might be a bad file.

Just a hunch.

CIA-BIN FTW.

Man, I want one of these so bad I can taste it

Fully automatic Gauss Gun:

While it may only be able to shoot a few cans right now, we certainly wouldn’t want to be in front of [Jason]‘s fully automatic Gauss gun capable of firing 15 steel bolts from its magazine in less than two seconds.

The bolts are fired from the gun with a linear motor. [Jason] is using eight coils along the length of his barrel, each one controlled by an IGBT. These are powered by two 22 Volt 3600mAh LiPo battery packs.

Sure it's only a prototype.  Sure, the muzzle velocity is only 120 ft/sec.  Nothing says "Living in the Future" like a Gauss rifle.  The electronics had to be designed to keep the electrical system from exploding from the voltage.  That's a manly gat, right there.

Happy birthday to me

The sirens you hear are just your local fire brigade.

Oh, bother.

Nostalgia isn't what it used to be

Most of the people who recognize this were kids at the time.

Let me just say that the day that Discovery Zone and California Pizza Kitchen both hit the Mall was awesome.  Because Discovery Zone had "drop off your kids" and CPK had booze.  That's why we beat the Godless Commies.

The boys miss Discovery Zone.  Me, I'm also nostalgic.

Now it's the NSA helping set up the call

My little pwnie awards

The "Oscars" for the security industry are presented at the Black Hat Briefings each year.  Last week saw the awarding of the Pwnie Awards for Epic security and Epic security fail.

This year there was a tie for the much coveted "Epic 0wnage" Pwnie.  The award is shared between the NSA and Edward Snowden:

0wnage, measured in owws, can be delivered in mass quantities to a single organization or distributed across the wider Internet population. The Epic 0wnage award goes to the hackers responsible for delivering the most damaging, widely publicized, or hilarious 0wnage. This award can also be awarded to the researcher responsible for disclosing the vulnerability or exploit that resulted in delivering the most owws across the Internet.

• Joint award to Edward Snowden and the NSA
  Edward Snowden's leak of NSA secrets was an epic example of the insider threat to information security, while his revalations convinced many that the entire Internet is thoroughly and epicly owned!
  

Recursive pwnage is recursive.

Other Pwnie awards include Most Epic Fail, Most Innovative Research, and lots for bugs.

Gay Hitler. LOLOLOL

Via Chris Lynch we find this delicious morsel:

What's amazing about the story is not just the information it contains but the completely deadpan tone. George Washington Hitler was a person! He had a son named Gay Hitler! Who became Doctor Gay Hitler! This was a real person. Doctor. Gay. Hitler. In Ohio. Until  — hmmmm — 1946.

Gay Hitler.  Awesome.

3D printed Liberator pistol at DEFCON

I was walking down the halls at DEFCON, and saw this:

That, of course, is Defense Distributed's Liberator 3D printer pistol design.  OK, thought I - this will be an interesting presentation.  Indeed it was.

Unlike most of the DEFCON sessions, the presenters said that photographs were welcome, and the entire session was on the record.  They explained that this was an important discussion, and so were waiving the typical DEFCON "if you see sumd00d with a camera, punch him" unwritten rule.  They also said that the media was welcome to sit in.  I introduced myself as a gunblogger and asked if I could interview them, and they kindly agreed.

@seanwayne and Dallas were the tag team presenters.  They had printed a modified Liberator pistol and brought it (via commercial air) to Vegas.  Sean is an infosec consultant and FFL manufacturer who (I was astonished to hear) read my blog every now and then.  Dallas was more incognito, but was the guy who convinced me to sit in on the session in the first place.  Both have concealed carry licenses.  Both have relationships with the Feds, and see one of their missions as helping to educate law enforcement on printable guns.

The first thing that struck me was their story that the TSA was cool with them flying with the pistol (obviously, checked like any other firearm.  The airline was definitely not cool with it, and their experience at the airport went something like this:

Dallas (at the check-in counter, with Liberator pistol): I'd like to declare and check a firearm, please.

Airline drone: What on earth is that?

Dallas: It's a plastic pistol.  I'd like to check it, please.

Airline drone: You can't fly with this!

Dallas: Of course I can.  It's a firearm; I need to check it.

Airline drone: I'll have to call the TSA.

TSA agent arrives.

TSA Agent: Hey, cool gun!

Of course, you need to treat this like any firearm, which means making sure you're not flying through Mordor^H^H^H^H^H^H Chicago or New York.

Education is something both of these gentlemen spend quite some time on.  Dallas talked about the time he gave a presentation on 3D printing and firearms to a group of lawmakers.  The two congressmen were OK with it, but the State legislators were pretty concerned.  The implication is that the risk of silly new laws may be more from local rather than national bodies (as we see with Colorado's moronic limit on magazine capacity).

The same applies to law enforcement, according to them.  Local LEOs are a problem, but their experience with the Feds is that once educated, they're moderately cool with the situation.

Sean is a gunsmith and manufacturer, and repeatedly told the audience that printing one of these is entirely legal, but selling it was the express lane to 5 years minimum at Club Fed.  He mentioned that he didn't have a problem with some laws that have been proposed, for example having your name engraved on any pistol you make.  I'm not sure how that would help with people determined to abuse the technology.

One of the problems they had when they proposed giving the session was that DEFCON was in a cassino.  The Nevada Gaming Commission and the cassino raised eyebrows.  The solution was that some of the pieces were printed in a scaled up size (the ones shown in green plastic).  Even if someone wanted to assemble the gun, it wouldn't fit together.

This was an interesting perspective on the whole printed pistol thing, and I was kind of surprised to see that the Feds were cooler about it than the local guys.  I'd have expected the reverse.  Sean and Dallas were quite clear that people can be educated about the issues, if you want to try.  That seems like quite a worthwhile effort.

I also got a chance to see a Liberator up close, and it reinforced my view that I absolutely don't want to shoot it.  The gasses from the chamber leak out the hole where the trigger protrudes, and so you might burn your hand even if you were wearing gloves.  Ouch.  Gives renewed meaning to the expression "kills on one end, maims on the other".

Of course, 3D printing is in its infancy, as their presentation clearly pointed out.  This technology is rapidly evolving, and likely one day will become ubiquitous.  Their biggest concern is not someone like you or me printing one of these, but a 15 year old kid.  Immature judgement combined with readily available technology is likely a volatile cocktail.

Thanks to Sean and Dallas for a very informative (and often times surprising) overview of this technology.  I am continually surprised by the intersection of computer security and firearms - maybe 80% of the security guys I know carry concealed.  This talk was a natural for DEFCON.

John Coltrane - In A Sentimental Mood

What is the NSA up to?

Triggerfinger has an outstanding (and very detailed) overview of XKeystore, the latest revelation of NSA's snooping activity:

In other words, a competent programmer can reliably parse out email addresses from the structured header fields with effectively no chance of getting user-entered content by mistake, unless the user was hand-crafting the email. All they have to do is stop reading the message at the first blank line (as I have marked in the example with a dividing line).

In order to get occasional cases where the Xkeystore retrieves "metadata" in the form of email addresses that turns out to be user-entered content instead, the NSA must be retrieving and parsing the content of the email. They may have coded their application to only show what they think are email addresses, but they are extracting those email addresses from the content, not from the headers. Which means they must be collecting and analyzing the content, not just the metadata.

It's like a pretty girl who wants to change clothes in your bedroom. Does she trust you not to look or does she find a screen or use a bathroom or closet so that you can't look? Does it matter if you promise not to look?

Clearly, the NSA has the ability to intercept email content, not just metadata; just as clearly, they are actually interceptingthe full email content and collecting it for analysis. They are asking us to trust them not to look at the content, even though they already have it. Maybe they have built their application so that they can't look without getting permission, but according to Snowden, the permission system is a joke and a rubber stamp. We already know that Homeland Security does keyword scanning of content, and I'm betting the NSA is doing the same thing with its application, and if the right keywords are there -- or the right sender or recipient, two or three degrees away from a "suspected" terrorist -- the content is flagged for a closer look. Or the NSA analyst can make up his own justification and get it rubber stamped.

And we can't see how their application works, or have any way of knowing that it does what it says it does. In this analogy, the NSA is the guy wearing a nice Google Glass device, and he tells the pretty girl in his bedroom she can strip down right there in front of him and she will be perfectly safe -- he's written his own privacy app, you see, and when it detects a pretty girl in his field of view it doesn't let him look. He's just watching you to keep you safe, you see. He's not recording the whole thing and uploading it to his friends.

This is an excellent introduction to how the messages are sent, what they look like, and how NSA must be doing things.  Highly recommended.

Elephants really never forget

This is pretty amazing.



The younger elephant, Jenny, was "mothered" by the older Shirley at a circus where they both performed.  After a year, they were split up, with Jenny sold to a different circus.  7 years later, they were reunited at The Elephant Sanctuary:

Jenny came into the barn for the first time since Shirley's arrival at around 7:00 p.m. There was an immediate urgency in Jenny's behavior. She wanted to get close to Shirley who was divided by two stalls. Once Shirley was allowed into the adjacent stall the interaction between her and Jenny became quite intense. Jenny wanted to get into the stall with Shirley desperately.She became agitated, banging on the gate and trying to climb through and over.

After several minutes of touching and exploring each other, Shirley started to ROAR and I mean ROAR—Jenny joined in immediately. The interaction was dramatic, to say the least, with both elephants trying to climb in with each other and frantically touching each other through the bars. I have never experienced anything even close to this depth of emotion

On this day in 1892 ...

... one Elizabeth Borden created what would become an absolutely cracking Chad Mitchell Trio song.



It's quite a New England dig at New York: Massachusetts is a far cry from New York. 

Jump like a fish, jump like a porpoise,
all hold hands and habeas corpus!

Awesome.

When music was actually music

Song by Bob Dylan*, singing by Peter, Paul, and Mary.



* Go ask your parents, kids.

Nat "King" Cole - Mood Indigo

Back when people aspired to display a little class.  Nobody did it like Nat.

100 miles

That's the distance I've put on the motorcycle since I bought it.  Given that I was gone in Vegas for a week, that means I'm doing more than 100 miles a week.

What's interesting is that I'm happy to run errands now.  I went and picked up a prescription for one of the family last night, and it felt like I was 17 with a newly-minted driver's license.

Not 17 any more, but the newly minted license feel is just the same.

50 acres and this

A house made from 2 shipping containers.  This guy seems pretty handy with a welding torch.

Heikegani (The Tale of the Heike)

My Sunday music is disproportionately weighted towards the European Canon.  There is a lot of great classical music from other lands.  Today is Japan and the Take of the Heike.  This is sometimes referred to as the first ever novel (The Tale of Gengi), but as with Homer, the story was sung, not read in per-literate societies.  The story is nicely introduced by Carl Sagan, of all people:



We get a hint of the music in this, but only a hint.  Japanese music consists of recognizable instruments: stringed lutes, flutes, drums.  This is the real music, reminiscent of Homer an artist singing the tale and accompanying himself on what is easily portable..  It shows how seemingly familiar instruments can produce music that could be from another planet.  Ancient Greek and Roman music may not have been far from this.

Who takes his eye from a comet?

Brigid emails to say that Tin Can Assassin is back in the hospital with heart problems.  This is the second time this has happened, which isn't ever good. He has a donate button up on his site, if you can spare something for one of our fellows in this corner of the Internet.

Who casts not up his eye to the sun when it rises?  But who takes off his eye from a comet, when that breaks out? who bends not his ear to any bell, which upon any occasion rings?  But who can remove it from that bell, which is passing a piece of himself out of this world?

No man is an island,  entire of itself; every man is a piece of the continent, a part of the main; if a clod be washed away by the sea, Europe is the less, as well as if a promontory were, as well as if a manor of thy friend's or of thine own were;  any man's death diminishes me, because I am involved in mankind, and therefore never send to know for whom the bell tolls; it tolls for thee.

- John Donne, Meditation XVII

I see I'm not the only thing finding it hard to start up this morning

That's a sign in Charlotte airport. Joking about electronic signage BSODs is so very 1999, but a red eye will do that.

- Posted using BlogPress from my iPhone

Chet Atkins - Midnight Train

When this posts, I'll be in the air, flying back to Atlanta on the red eye.  I'm not a fan of the red eye, not least in that it lacks the glamor of bygone days.  The great trans-Atlantic glory days of flight are now sadly gone (when first class served Fleur de France champagne).  The poetry is gone.

Of course, people have been traveling during the wee hours since time began.  The glory days of the rail roads gave a whole bushel basket of great songs, including Gladys Knight and the Pips as late as 1973, with Midnight Train To Georgia.  By then the trains were a basket case, but twenty years before Chet Atkins came out with this instrumental.  I'd say that it's pretty amazing how he gets his guitar to sound like a train whistle, but c'mon - this is Chet Atkins.  He could make the guitar sound like a jet engine if he wanted to.

Anonymous as the Ingenue?

Might work.

Let's not call it "hacking"

"Hacking" is such a judgemental term.

Let's call it "stalking" ...

No, I am not taking my computer to DEFCON

Duh.  There be dragons.  I'm also turning the WiFi off on my phone.  Proper prior planning prevents perverse performance, and all that.

Long time readers will recall me ranting about how all the SCADA computers that control the power grid, oil drilling, chemical plants, etc are swiss cheese from a security perspective.  Well, I went to a nifty demo yesterday where they showed a hack (against a system they brought to the show, not against anyone live) where they (a) made a valve open to 100% to fill a tank, (b) made the SCADA operator's console show that the water level in the tank was decreasing, and (c) uploaded executable code of their choice to the SCADA system.  Mad lulz when they showed that the executable code was solitaire, and the operator's console was a touch screen.  Good times, good times.

Yeah, we're totally screwed.

DEFCON starts today.  I'm only going to today's sessions - I've been traveling long enough, thank you very much, and today's VoIP hacking session is of considerable interest to the company.  But there are not one, not two, but three sessions on hacking automobile computer systems.  My recommendation is to get yourself a GTO.  Or a Harley.  Hack those, biatchz!

And I'll miss out on the Pwnie Awards for best hacks.  I'll post on that when I get home.

I'll have scheduled posts for later today, but I'll be sort of dropping off the grid today as I prowl the mean corridors of the show.  You will not see me posted on the Wall Of Sheep.

Peace out.  Hack the Planet.  Free Kevin.

Pedantic blogger is pedantic

This is the kind of thing that bugs me.  Yeah, I know that nothing in Vegas is supposed to be accurate, but this is the kind of thing that makes me feel like the Princess and the Pea.  Spot the misuse of Egyptian mythical symbols.

Horus was one of the key parts of the Egyptian mythos.  While the scarab beetle was also seen in their art, it was minor compared to Horus and would never have covered up the hawk.  Also, the cobras are not a common motif in ancient Egyptian art; snakes are associated with the Moon god (as in Aztec symbology) so mythically speaking they wouldn't be out of place here with the Horus Sun association, but the Egyptians didn't use the snake for Mood god representations.  They used the Bull, which was closely associated with Pharaoh.

This ends today's lesson in pedantry.

Overheard at Black Hat: "Who here has seen the film 'Sneakers'?"

This question was asked in a session about security problems in crypto-mathematics.  Half the hands went up.   I wonder if the speaker reads Borepatch?

There may be a problem in the encryption that underlies Secure Sockets Layer (SSL) - this is the stuff that protects you when you browser to some https:// location.  While the encryption isn't broken, there's a lot of mathematical analysis going on in this field that is showing partial results.  Already this year there have been three published paper on the Discrete Logarithm Problem (don't worry about the details).  There hadn't been any progress for 30 years, and now this is the new mathematical hotness.  It it becomes possible to solve this problem then we have exactly the situation shown in Sneakers - everything on the Internet will be able to be decrypted.  Worse, the techniques likely will be easy to implement, and so everything will be vulnerable, all in the space of a week or two.

They call this the Cryptopocalypse.  Slides (and maybe video) of the session should be posted there in a day or two, and if you're interested you should check it out.  It was the best presentation on encryption that I've ever seen.

Even more interesting is that the recommendations - to use Elliptic Curve encryption (don't worry about the details).  The Russian crypto system GOST was based on this.  It isn't based on the RSA standard we use here, that depends on Discrete Logarithms.  In the film, the Soviet Attache said that their encryption was different, and that the decryption box wouldn't work against them.

All in all, the world is a very strange place where so much prediction seems to have come from Hollywood.

I got quoted by the Associated Press

More or less accurately, although I didn't say I thought they were doing it, but that they had the capability.

UPDATE: The accuracy issue needs clarification, because  it wasn't a misquote, it was edited for brevity (what - me needing to be edited for brevity?!).  I was discussing capabilities - that the NSA certainly would have the capability to run speech-to-text transcription in real time.  There's absolutely nothing secret here - if you see Closed Captioning, that's what's happening.  Dragon speech-to-text lets you talk to your computer and tell it to do things.  The tech has been around for years.  The NSA may even have better tech in this area.

And so, while I don't know that NSA is automatically using machine transcription to convert everyone's phone calls to text, and then have automated search routines cruising through the text looking for key words, they certainly could do this if they wanted to.

Does that mean that I "suspect" that they're doing this?  Well, I just un-edited the news report for you.  ;-)

It's a bad day when your company gets mentioned at Black Hat

But these guys have earned it:

Web-enabled portable medical device
US Patent 20080091175 A1 

Abstract

A portable personal medical device, e.g., a wearable insulin pump, is provided with a web server and is controllable over a network by a browser equipped client, thereby enabling comprehensive and comfortable control, operation and/or configuration of the device.

"Comprehensive" control?  Boy howdy.  What's especially bad about this is that every medical device manufacturer says that they're not allowed to provide security patches, per the FDA.  That seems not to be true, but they say it anyway (because they don't want to incur the expense of testing the patch).

Explaining it to them in simple terms, web servers need lots of patches or they get pwned.

Someone is going to die from this.

Um, maybe I won't phone home ...

Black Hat is the security Silly Season.  Some attendees take that in stride.

World of Warcraft or something, waiting for the presentation to start.