The War on Terror bears bitter fruit for US Tech Companies

This is enormously, indescribably bad for Silicon Valley:

In a decision with widespread implications for the international transfer and processing of data - and the companies that provide these services - the European Court of Justice has ruled the EU-US Safe Harbour pact invalid. Experts are warning of massive disruption to international business.

What, you may be wondering, is the Safe Harbour pact?

The agreement was reached in 2000, following the introduction of the European Union Directive on the Protection of Personal Data which became effective October 1998. The Directive prohibits the transfer of data outside the EU to third party nations that don't meet the EU test of “adequacy” with regard to privacy protections. The Safe Harbour Decision enabled US organisations to “self certify” that their data protection systems met the EU adequacy test so they could lawfully transfer personal data from the EU to the US for the purposes of storage and processing.

OK, so who peed in the corn flakes?

Today's decision striking down Safe Harbour came about after an Austrian law student, Maximillian Schrems, a Facebook user since 2008, lodged a complaint with the Irish Data Protection Commissioner that his personal data was being unlawfully processed by Facebook in the US. His claims were based on revelations by Edward Snowden regarding cooperation between the US National Security Administration (NSA) and companies such as Facebook to access the personal data of social media users.

Well, well, well.  How's that whole Eye Of Sauron thing working out for you, Fed.Gov?  The implications of this are wide ranging:

Daniel Castro, vice president of the Information Technology and Innovation Foundation said: “In the wake of the Snowden disclosures, European citizens and policymakers are understandably concerned about privacy safeguards in U.S. law. But abruptly revoking the Safe Harbor agreement was the wrong way to address those concerns. It will disrupt not just the thousands of U.S. and European companies that currently depend on the Safe Harbor to do business across the Atlantic, but also the broader digital economy. Aside from taking an ax to the undersea fiber optic cables connecting Europe to the United States, it is hard to imagine a more disruptive action to transatlantic digital commerce. Policymakers in the United States and EU should work together swiftly to implement an interim agreement so that we do not shut down transatlantic digital commerce overnight.” [Emphasis by me - Borepatch]

Someone just figured out how to change things.  Remember, when they say the issue is one of principle, it's all about the money.  This will be massively expensive for US companies to address - basically they will have to replicate their entire infrastructure in the EU and put up firewalls between their EU and US operations.  That will show up in the bottom line, and that will make their stock prices nosedive.

And that will hit Silicon Valley where it hurts.

Keep your eye on this - this is perhaps the biggest (i.e. most expensive) security news in history, and the ripples will be felt for a long, long time.  Maybe even all the way to Ft. Meade.

Well played

James Burton - Working Man Blues

I think I'm done getting Camp Borepatch ready for inspection to put on the market.  May or may not give the front door another coat of pain; got to drop another load of stuff off at Salvation Army.

But oof.  May take a soaky bath in the soaker tub.  Only done that two or three times (like when I added the pond).  Not used to working for a living, and at my age I need an ibuprofen cocktail.

So rock me out, Jimmy ...

Climate models run provably hot

Burt emails to point out this:

A MATHEMATICAL discovery by Perth-based electrical engineer Dr David Evans may change everything about the climate debate, on the eve of the UN climate change conference in Paris next month.

A former climate modeller for the Government’s Australian Greenhouse Office, with six degrees in applied mathematics, Dr Evans has unpacked the architecture of the basic climate model which underpins all climate science.

He has found that, while the underlying physics of the model is correct, it had been applied incorrectly.

He has fixed two errors and the new corrected model finds the climate’s sensitivity to carbon dioxide (CO2) is much lower than was thought.

People have been saying this for years and years.  What's different is that Dr. Evans has demonstrated this mathematically.

“Yes, CO2 has an effect, but it’s about a fifth or tenth of what the IPCC says it is. CO2 is not driving the climate; it caused less than 20 per cent of the global warming in the last few decades”.

And this actually sounds reasonable.  This means that the projected warming of up to 4°C in the 21st Century would actually be up to 0.4°C which maps pretty well to what we saw in the 20th Century.

Of course, Dr. Evans will never get another research grant, because he's fixin' to upset all the sweet, sweet government funding.  And he won't get tenure because he won't get any grants.  But well done on doing some actual, you know, science.

New Air Force Jet

Already looking to upgrade the F-35:

THE PENTAGON — The Pentagon released a report today requesting Congressional authorization for 500 gold-plated F-35 fighter planes.

...

The new variant, dubbed the F-35G, is proposed as an upgrade over existing F-35 models. In addition to 24K gold plating encasing its exterior, its cockpit is trimmed with wood grain paneling harvested from the endangered African blackwood tree and leather upholstery from the hide of the northern white rhinoceros. Its GAU-12/A 25mm rotary cannon is able to fire solid platinum rounds at a rate of 3300 per minute. Each round is handcrafted by a Swiss jeweler.

What's funny is that the story is plausible, given the F-35's chequered history.  And this bit is pretty funny:

It also remains to be seen if the F-35G’s combat performance will be able to deliver on the program’s promises. At present, the added weight from the gold plating has prevented the F-35G from achieving flight. Its first test was a disaster, as the prototype F-35G rolled straight through the end of the test runway and careened into oncoming traffic on a nearby highway, resulting in 12 fatalities.

 The Duffel Blog delivers.

Quote Of The Day #2: Gun Control screws poor people

The Czar of Muscovy looks at the disaster that is Chicago and observes that disaster is not evenly distributed.  Not only is crime concentrated in poor (mostly Black) neighborhoods, the onerous cost of firearms licensing there is prohibitively expensive for those same (poor, Black) people:

So if you’re an impoverished Chicagoan who wants to take back the neighborhood for decent folks in the fastest way possible—an armed and defensively ready neighborhood—be ready for a few neighbors to shell out about $2,000 each. That might be a monster-sized chunk of your annual income in those neighborhoods, but you can do it, right? After all, the super-trendy neighborhoods in Chicago all did it. Maybe you could stop blowing your cash on stupid stuff like kale, arugula pesto, and tawny ports, Greshamites. Maybe you Englewood residents could have your kids not attend Minecraft camp for one summer, like the folks in the upscale Beverly community did?

Seems Democrats are hypocrites.  Who'da thunk?

Quote of the Day: Europe's view of America's gun laws

This hits center mass:

Meanwhile, while I read all this self-congratulatory bollocks about how much more violent Americans are than the peaceful gun-loathing British, I am sitting somewhere in Tower Hamlets, one of the world centres of ISIS recruitment. One of Britain's most important exports right now is young men who are performing beheadings and crucifixions, for fuck's sake, in the cause of committing actual genocide. They are killing and torturing and enslaving innocent people by the tens of thousands.

But yeah, nine people dead, and it's America that has the big violence problem.

This is from a Brit, looking at his countrymen with a (rightly) jaundiced eye.  What was most memorable from my year living in Blighty was the uniiversal, casual assumption by the Brits that they were smarter than we Colonials.  And the assumption that they all had better taste.  Buried in Squander Two's excellent post was this line that made me smile:

In short, it should occur to you that American laws might to some extent be based on American votes, and that Americans might know just a teeeensy bit more about living in America than some wanker from Haringey who once spent a week in Orlando but doesn't want to go back because he found it crass.

I spent a weekend in Weston-super-Mare once, and found it a bit tacky.  Ya know, if you go to tacky touristy spots, you might find a tacky touristy spot.

RTWT.  It's a refreshingly sane view from the far side of the Pond.

Perseverance

Finally, an honest debate about gun control

Obama has triggered what is looking to be a debate about gun control where people actually tell the truth for a change:

President Obama is clearly fed up. His speeches after mass shootings — speeches that have become a bit of a morbid ritual, given how regularly the shootings occur — have grown angrier, more emotional, and more disgusted at America's gun violence problem and Congress's unwillingness to do literally anything to stop it. "This is a political choice that we make," Obama declared Thursday night, after the 294th mass shooting of 2015, "to allow this to happen every few months in America."

But let's be clear about precisely what kind of choice this is. Congress's decision not to pass background checks is not what's keeping the US from European gun violence levels. The expiration of the assault weapons ban is not behind the gap. What's behind the gap, plenty of research indicates, is that Americans have more guns. The statistics are mind-blowing: America has 4.4 percent of the world's population but almost half of its civilian-owned guns.
Realistically, a gun control plan that has any hope of getting us down to European levels of violence is going to mean taking a huge number of guns away from a huge number of gun owners.

Other countries have done exactly that. Australia enacted a mandatory gun buyback that achieved that goal, and saw firearm suicides fall as a result. But the reforms those countries enacted are far more dramatic than anything US politicians are calling for — and even they wouldn't get us to where many other developed countries are.

That's Vox, a reliably leftie new media site.  It doesn't shrink from calling for confiscation:

The US doesn't just have a gun violence problem because of its lax gun regulation. It has a problem because it has a culture that encourages large-scale gun possession, and other countries do not. That, combined with Australia's experience, makes large-scale confiscation look like easily the most promising approach for bringing US gun homicides down to European rates.

But what's interesting is Vox's conclusion:

Large-scale confiscation is not going to happen. That's no reason to stop advocating it.

So finally we have an honest debate.  This is about confiscation.  Even the Left doesn't think that's going to happen.  But at least we can reject the grotesque lies that have been put up as a smoke screen ("common sense gun control").  Truth is a Very Good Thing Indeed.

A year ago

I was riding along the beach in Florida, never expecting what would happen the next day.  It just takes a moment to go from this:

to a hospital bed.  It's been an interesting year, and the rest of 2015 looks like it's fixin' to continue interesting.  But it feels like it's turned a corner, and there's good reason to believe that the interesting bits, while bittersweet, will have a lot more sweet than bitter.

That's a nice feeling.

Quote of the day: idiot leftists edition

Smartest guys in the room:

The idea that taxes cut into existing productive activity, and that as a cost, will be passed on to consumers (such as the financial transaction tax passing on costs to bank clients, shareholders, etc) doesn’t occur [to leftists]. No, taxes are part of that wonderful magic money tree. Why stop at a pathetic 50 per cent? Why not tax the lot? Give it all to the State, so those clever people can spray it around and make us richer, except of course the money has that odd way of disappearing from our paychecks……..Sorry, excuse me, time for my pills.

You do have to wonder what a century or more of compulsory education has wrought.

Actually, no you don't.

Seen inside the Camp Borepatch perimeter

Danaus plexippus.  Click to embiggen.

"I'd like to add you to my professional network on LinkedIn"

It seems that this caption works for every cartoon published in The New Yorker.  For example:

There are lot more.

(via)

Chet Baker & Paul Desmond - Autumn Leaves

I've been busy.  Life's been loud, but for once in a good way.  In the meantime, the leaves are falling at Camp Borepatch, so here's some autumn jazz for the occasion.

Snerk

It's funny because it's sort of true.

Your thought for the day on gun control

The Usual Suspects™, led by our Divider-In-Chief are dancing in the blood of the victims again.  They don't know what the problem was, but they're convinced that the answer is more gun control.

Remember, sometimes it's easier not to do something stupid than it is to do something smart.  

The gun grabbers forget this every single time.  Every. Single. Time.

I'm not opposed to gun control, just to stupid and counterproductive gun control.  Like prohibitions on campus concealed carry, which prevented all of the victims from defending themselves.  Every gun control proposal should be immediately challenged - the proposer should have to explain why it's not stupid or counterproductive.

Hack the Po-Po

Well, the cruiser, anyway:

A state trooper responding to a call starts his vehicle, but is unable to shift the gear from park to drive. The engine RPMs suddenly spike and the engine accelerates, no foot on the pedal. Then the engine cuts off on its own.

The unmarked 2012 Chevrolet Impala from the Virginia State Police's (VSP) fleet has been hacked -- but luckily, by good hackers.

This is what police officers could someday face in the age of car hacking. It's just one in a series of cyberattacks waged on the VSP's Impala and on one of its 2013 Ford Taurus marked patrol cars as part of an experiment by a public-private partnership to test how state trooper vehicles could be sabotaged via cyberattacks. Virginia Governor Terry McAuliffe in May first announced the initiative, which was aimed at protecting the state's public safety agencies and citizens from vehicle-hacking.

Actually this is a very good thing.  I've had "White Hat" hackers do this sort of analysis in the past, and you always learn a lot that improves the security of the system.  More of this, please.

It's not often I say "Well done" to the government's security program, but well done indeed.

Busy

The house is almost all done - a quick tidy of the detritus that settled during the last room clean ups and vacuuming and dusting.

Err, and #2 Son tidying his room up ...

But the house across the street just sold.  In 4 hours.  Confidence is high that Camp Borepatch will have new owners in the next little while.

But man I'm worn out.

Adjustments to climate data always add warming

Strangely, they never add cooling:

Note well that all corrections used by USHCN boil down to (apparently biased) thermometric errors, errors that can be compared to the recently discovered failure to correctly correct for thermal coupling between the actual measuring apparatus in intake valves in ocean vessels and the incoming seawater that just happened to raise global temperatures enough to eliminate the unsightly and embarrassing global anomaly “Pause” in the latest round of corrections to the major global anomalies; they are errors introduced by changing the kind of thermometric sensors used, errors introduced by moving observation sites around, errors introduced by changes in the time of day observations are made, and so on. In general one would expect measurement errors in any given thermometric time series, especially when they are from highly diverse causes, to be as likely to cool the past relative to the present as warm it, but somehow, that never happens.  Indeed, one would usually expect them to be random, unbiased over all causes, and hence best ignored in statistical analysis of the time series.

Note well that the total correction is huge. The range is almost the entire warming reported in the form of an anomaly from 1850 to the present.

Emphasis in the original.  This is a very interesting analysis of the adjustments made to the temperature data sets.

Donald Trump explained, 5 years ago

From a post here:

There's so much smart packed into this post that it's in danger of collapsing into a Black Hole of Smart:

Foseti said:

the root of the problem is democracy.

I disagree.

The root of the problem is:
Because the interests of the elite do not match the interests of the whole of society, the natural flow of governance is for elites to aggregate ever more power, and the populace to become ever more immiserated. Mandarin China, Louis XIV France, and Tsarist or Communist Russia is the rest-state for relations between government and subject. Government extracts as much as it can, subject lives in soul-crushing poverty.

The depressingly elegant thing about this is that the game theory is stable. Take the folks who make decisions, build as small a stable coalition as you can, and divide the spoils among the small coalition. It's as inexorable a solution as gravity, given power politics.

This is what governments do when they can. The core challenge of government is how to prevent that.

This is indeed how they roll, from the Forbidden City to Versailles to Washington D.C. to your local city council. Go read.

The secret, of course, if to vote incumbents out so that the remaining pols fear us more than they are encouraged by their rent-seeking cronies. Voltaire was right: In this country it is wise, from time to time, to kill an Admiral to encourage the others.

The Establishment has made it extremely difficult to vote them out, much more so that I had expected.  Even the elections of 2010 and 2014 did not provide the purge that the populace was looking for.

And so enter the outsiders.  Trump, a billionaire, doesn't need Establishment money to run.  The system has indeed been Game Theory stable, but things that cannot continue forever do not.  The moment was primed, and lacked only the right Man to step into the Arena.

Would Trump make a good president?  Who can say?  But what is now clear is that the situation is no longer Game Theory stable.

The hypocrisy of the left: Green "Non-Profits"

This is actually sickening:

Anyway, a couple of folks, including Roger Pielke, Jr. and Steve McIntyre, both folks who get accused of being oil industry funded but who in fact get little or no funding from any such source, wondered where  [Professor Jagadish] Shukla's funding comes from.   Shukla gets what looks like a very generous salary from George Mason University of $314,000 a year.  Power to him on that score.  However, the more interesting part is where he makes the rest of his money, because it turns out his university salary is well under half his total income.  The "non-profits" he controls pays him, his family, and his friends over $800,000 a year in compensation, all paid out of government grants that supposedly are to support science.

It's grifters and con artists all the way down.  But at least there's no "profit" motive to corrupt things.

The punch line?  Professor Shukla is the author of the letter to President Obama asking that climate skeptics be prosecuted under the RICO statute.

Otis Rush - I Can't Quit You Baby

Sunshine, kittens, and bacon

Boy, I've been grumpy lately.  Mustn't grumble.

Everyone likes sunshine, right?

And kittens.  You you don't like these, we can't be friends anymore.

Yo, dawg!  We heard you liked bacon, so we made Bacon out of bacon.  Because bacon.  Everyone likes that.

It's weird being an (almost) empty nester

When I got back from my trip to DC last Friday, #1 Son had moved out.  This was no surprise - he's in his 20s and so it's time, and he'd been planning this for a couple months.

But it was strange to come back to an empty room.  Well, a messy empty room, which seems like an oxymoron.

I feel quite torn by all this.  Not that I want him living in my basement into his 30s - after all, it was time for him to stretch his wings - but this is the first time since 1992 that he wasn't living under my roof.

Maybe I'll go through my whole life seeing him like this:

His first beer at the Hoffbrauhaus in 1996.

I must confess that I'm rather disappointed in myself - my sentimental reaction is so common as to be boring.  It's easy enough for me to be boring, so I shall endeavor to be less so in the future.

But one down and one more to go.  When Camp Borepatch gets sold, that will happen too.

The dangers of working in Internet security

Now includes fire bombs:

Russian ATM VXers have firebombed the research lab of an anti-virus firm after its researchers refused to retract reverse engineering analysis of their malware.

The attack followed email threats by the group calling itself the 'Syndicate' to the Moscow company which sold the Shield antivirus product that prevented the gang's malware running in ATMs.

Dr Web says it refused to comply with demands to remove references to ATM malware analysis.

Actual threat or PR stunt?  Explosives seem a little extreme for the marketing department.

Misinformation

(via)

Thousands of medical devices reachable from the Internet

I'm shocked, shocked to find this:

Security researchers Scott Erven and Mark Collao found, for one example, a "very large" unnamed US healthcare organization exposing more than 68,000 medical systems. That US org has some 12,000 staff and 3,000 physicians.

Exposed were 21 anaesthesia, 488 cardiology, 67 nuclear medical, and 133 infusion systems, 31 pacemakers, 97 MRI scanners, and 323 picture archiving and communications gear.

The healthcare org was merely one of "thousands" with equipment discoverable through Shodan, a search engine for things on the public internet.

But fear not, no doubt these devices are all configured securely.  Oh, wait:

"[Medical devices] are all running Windows XP or XP service pack two … and probably don't have antivirus because they are critical systems."

Executing custom payloads, establishing shells, and lateral pivoting within a network, are all possible, he said.

You see, this is why we can't have nice things on the Internet ...

Yeah, this would work for Wolfgang

Borepatch: predicting the future better than climate scientists

From your humble blogger, 9 December 2009:

Take away the adjustments [to the climate data], and all the warming from 1850 [in New Zealand] disappears. Change the data, and all the Climatologists will discover that the Earth is "warming". [because all climatologists use the same - adjusted- climate data sets]

Let me say this explicitly: I used to believe that the planet was warming, and that this was likely due to natural (as opposed to man made) causes. Now I'm not sure that the planet is warming.  The data do not show warming over the last 70 years, maybe longer.

27 September 2015:

The US accounts for 6.62% of the land area on Earth, but accounts for 39% of the data in the GHCN network. Overall, from 1880 to the present, approximately 99% of the temperature data in the USHCN homogenized output has been estimated (differs from the original raw data). Approximately 92% of the temperature data in the USHCN TOB output has been estimated. The GHCN adjustment models estimate approximately 92% of the US temperatures, but those estimates do not match either the USHCN TOB or homogenized estimates.

[My emphasis - Borepatch]

And one last little nugget, from a post here on 30 November 2009:

If you look closely at climate data, you will find that all the major data sets consist of two parts:

Raw Data, which is the instrument reading: satellite, thermometer, or proxy (tree ring, ice core, etc). This is data straight from the sensor.

Adjustments, which are corrections applied to raw data to adjust for inconsistencies. For example, it is important to read the thermometer temperature at the same time every day. If the hottest time of the day is, say, 2:30 PM, but you read the thermometer at 10:00 AM, then the day's reading will be low. Adjustments are also made when weather stations are re-sited, and for other reasons.

An interesting question is how much of the 20th Century's warming came from adjustments, rather than from raw data? A picture is worth a thousand words:
What you're looking at is the annual adjustment made to the raw temperature, for each year in the 20th Century. You'll notice that almost no adjustments are made to years up to 1960, and then a very interesting shape appears in the graph.

A hockey Stick.

This is not from the Hadley/CRU temperature data set, this is from the US HCN (Historical Climate Network)

So we know that 99% of the data has been adjusted, and we know that over 80% of the reported warming in the lower 48 States over the entire 20th Century was due to adjustments - the raw data simply do not show this warming.

And all of this is from the Fed.Gov's own published data.  Let me say it again:

Let me say this explicitly: I used to believe that the planet was warming, and that this was likely due to natural (as opposed to man made) causes. Now I'm not sure that the planet is warming.  The data do not show warming over the last 70 years, maybe longer.

Some of you may have noticed that I'm just not posting much of Global Warming issues.  It's because I've said pretty much all that I have to say, six years ago.

Dumbass of the week

Guy sees a spider on his gas tank as he goes to gas up his ride.  You or I would brush it off, the more squeamish perhaps grabbing a paper towel first.  Our hero?

He flicked his bic.  Hilarity ensued as the station went up in flames.

Well, at least we can wear kilts

(via)

Remember, items in the overhead bins may have shifted position

Vincent Youmans and Irving Caesar - Tea For Two

You'd heard this song, even if you haven't heard its notorious background.  While purists might complain about including Broadway numbers in with Classical music, you're likely to hear this only on classical radio these days.

Vincent Youmans was a young man whose plans of becoming an engineer were derailed when he was drafted into the Navy in World War I.  Rather than seeing combat, he found himself in charge of putting on entertainments for the sailors.  After the War, he became one of the "Tin Pan Alley" composers, penning this song along with collaborations with Ira Gershwin and Oscar Hammerstein among others.



This was his biggest hit, which is why you will recognize it.  Vincent Youmans was born on this day in 1898.

So what is the notoriety associated with this song?  It's from the musical "No, No, Nanette" which Red Sox fans will recognize.  The Red Sox sold Babe Ruth to the New York Yankees to finance this musical leading to 86 years of baseball humiliation at the hands of the Bronx Bombers.

Except it seems that this isn't actually true.  Ruth was sold to finance a forgettable musical "My Lady Friends", not No No Nanette.  Presumably the latter was included in the "Curse of the Bambino" because it was one of the most successful musicals of the 1920s, Ruth's glory days in pinstripes.

Well, one of those will work

Good thing there's a "Living Wage"

Those Progressives and their $15/hour minimum wage.  All those waiters who saw their hours go to zero must be so grateful.

Seen at the bar at the airport last night.

Dale Ann Bradley - Run Rufus Run

Bluegrass is perhaps the soul of American music.  It certainly is as close to the original, ur-music of this land.  Here's one about leaving the coal mine to take up whiskey running. 

A moment of Zen

A haiku:

Repeat after me:
It is always a good flight
When you're going home.

Although it will be strange - #1 Son moved out while I was gone.  I seem to be shedding family as I age.

Good thing I'm aging gracefully.  /sarc

Maybe this "War On Drugs" is easier than I thought

Glad that's all wrapped up, then.

Microsoft security updates violate your privacy

Carl emails to point out some posts he's put up on his blog about security.  Now I've repeatedly advised readers to make sure that they have Windows automatic updates turned on, because Windows has a pretty bad security track record and this is an easy way for people to do something that helps out their security.

Except maybe Microsoft is abusing that trust:

I would hope all Windows users are aware of the deliberate snooping built directly intoWindows 10, and know not to “upgrade” to it. If not, the short form is that MicroNSA believes so strongly in the future of “cloud computing” that it’s going to make Win10 users do it whether they like it or not.

That’s bad.

Worse: It now appears that wasn’t good enough for the NSA’s corporate buttbuddy. They’re pushing a set of updates to Win7 and Win8 that implement some of the same file, email, browsing, and search data snooping to be found in 10.

If you must run Windows, do not upgrade to Windows 10. If you are running 7 or 8, turn off Automatic Updates immediately. Check your system (Control Panel=>Windows Updates=>View Update History) for the following updates:

• KB3068708
• KB3022345
• KB3075249
• KB3080149

Disable them.

If you aren’t on automatic, check the list of “Updates to install.” If you see them there, right-click on them and “Hide Update.”

These "security" updates are the ones that collect your browsing and usage history and send it to the Borg cloud.  This is a terrible, no good, very bad thing for a security tool to do.  And quite frankly, this is something that security guys have discussed for years, going all the way back to Ken Thompson's Turning Award speech Reflections On Trusting Trust.  For a Turning Award lecture, it's pretty accessible even to lay persons - just skip over the code bits to this part:

The actual bug I planted in the compiler would match code in the UNIX "login" command. The replacement code would miscompile the login command so that it would accept either the intended encrypted password or a particular known password. Thus if this code were installed in binary and the binary were used to compile the login command, I could log into that system as any user. 

It's an undetectable security backdoor introduced from a trusted source - trusted source code, in Thompson's thought experiment.  Microsoft has done something very like this.  "Trust us," they said. "We will keep you secure if you just turn on automatic updates."  And then that trusted channel becomes the means that your privacy is raped and pillaged to fatten their bottom line.

At this point it's clear that most people simply will not be able to keep their Windows computer secure.  People like Carl and myself certainly can, although it looks like we both run Linux Mint (and you should, too).  But people who aren't computer security nerds simply won't have the background to examine every single Microsoft security update and make a rational decision about the risks of installing it vs. the risks of not installing it.

Bottom line: as a security professional I cannot recommend that anyone should run Windows if they care about their security and privacy.  Trust can no longer be trusted, at least from Microsoft.  If there are certain Windows applications that you absolutely cannot live without, then keep a dual-boot system where you can boot up Windows for those times you absolutely need that app, but only run that app.  The rest of the time, run Linux, which won't sell out your privacy to fatten its bottom line.  It will never do that, because Open Source has no bottom line.

And you should read Carl's blog, which has a regular menu of techie geekdom, libertarian rants, and that sort of thing.  Plus humor like 50 Nerds of Grey.  Snerk.

Cargo Cut University

Hey, Wheetabix started blogging and didn't tell me.  He has a great post up about the return on investment from college:

Economics 101 discusses supply and demand.  The more you have of something, the less valuable it is.  Think how much you value packing peanuts and plastic grocery bags.  In my 20's, everyone had a high school degree.  The only people who ever wanted proof were the people in the admissions offices of the colleges I applied to.  It had almost no value to anyone else.  The same thing has now happened to college degrees.

High school teachers began to value education over the ability to make a living.  Colleges had a vested interest in increasing attendance.  Government got into the lucrative student loan game.  And education became a product instead of a path.  "A mind is a terrible thing to waste" sounds inspirational, but "be cool, stay in school" is more honest.  What it means now is "we won't let you work, and we have to store you somewhere."

Pretty smart there about more of something drives down its cost.  The only thing I would add is that there is more than  little whiff of cargo cult thinking here - in the 1960s and 1970s college graduates generally made good money.  So let's make more college grads out of whatever is at hand.  The cargo cuts  wanted the GIs to come back with all their stuff so they made GI stuff out of whatever was at hand.

Oh well, I'm sure this will work out fine for the colleges when they just tune their bamboo radios to the right frequency ...

Friends don't let friends upgrade to Windows 10

Seriously, they don't.

Is this the end of the Evil Black Rifle?

Marine Corps to modernize small arms, adding silencers to rifles among other things:

The Marine Corps’ Small Arms Modernization Strategyincludes some long-overdue elements: 

The Corps is considering allowing camouflage painted rifles for every Marine and suppressors for rifle squads, Woodburn said. It’s part of an effort to help Marines blend into their surroundings and communicate better.

My guess is that haters still gonna hate.

Thank you, Yogi. For the laughs, but more importantly for the baseball.

You weren't just great, you always made me laugh.

I'm a Boston Red Sox fan, forever and ever, Amen.  But bless me Father, for I have sinned.  I have been hard hearted .against New York players - despite your admonition to render unto Caesar, etc.  Yogi deserved - and I hope got - better.  Younger generations remember the jokes: Baseball is 90 percent mental and the other half is physical.  But the young punks don't realize that he may have been the greatest catcher of all time.

While perhaps not as much as Ted Williams, Yogi gave up good years for his country.  The 19 year old Berra found himself off Normandy on D-Day on the U.S.S. Bayfield.   Unlike Williams, Yogi didn't lose the best years of his hall of fame career.  But a hall of fame career it was:

[He] established Series records for the most [post season] games (75), at-bats (259), hits (71), doubles (10), singles (49), games caught (63), and catcher putouts (457). In Game 3 of the 1947 World Series, Berra hit the first pinch-hit home run in World Series history, off Brooklyn Dodgers pitcher Ralph Branca (who later gave up Bobby Thomson's famous Shot Heard 'Round the World in 1951).

Berra was an All-Star for 15 seasons, and was selected to 18 All-Star Games (MLB held two All-Star Games in 1959 through 1962). He won the American League (AL) MVP award in 1951, 1954, and 1955; Berra never finished lower than fourth in the MVP voting from 1950 to 1957. He received MVP votes in fifteen consecutive seasons, tied with Barry Bonds and second only to Hank Aaron's nineteen straight seasons with MVP support. From 1949 to 1955, on a team filled with stars such as Mickey Mantle and Joe DiMaggio, it was Berra who led the Yankees in RBI for seven consecutive seasons.

One of the most notable days of Berra's playing career came when he caught Don Larsen's perfect game in the 1956 World Series, the first of only two no-hitters ever thrown in postseason play.

But did I say laugh?  I'm not making this up.



Good night, sweet Prince.  And may flights of Angels sing thee to thy rest.  I hope St. Peter has tears of laughter running down his face.

The Lord broke the mould with him.

How do you know that it's time to update Adobe Flash?

Because it's a day who's name ends in "day":

Adobe has released a critical software update to fix nearly two-dozen security holes in itsFlash Player browser plugin. Separately, I want to take a moment to encourage users who have Adobe Shockwave Player installed to finally junk this program; turns out Shockwave — which comes with its own version of Flash — is still many versions behind in bundling the latest Flash fixes.

If you use and need Flash Player, it’s time to update the program (the latest version is 19.0.0.185 for Windows and Mac users). Google Chrome and Internet Explorer bundle their own versions of Flash (also now at v. 19.0.0.185); each should auto-update to the latest. Find out if you have Flash installed and its current version number by visiting this page.

Flash, of course, if the software that makes Internet video work, so basically all y'all are running it.  Scamper off to the Adobe link and get you some security goodness.

And if you're running Shockwave, you really should stop.  It's a sucking chest wound of security fail.

R.I.P. Jimmy Olsen

Actor Jack Larson who played that role on the TV show "Adventures of Superman", dead at 87.

Poor Internet Explorer

The kids all make fun of him all the time ...

Actually, you could replace "Speed" with "Security" and it would be even funnier.

Hat tip: Burt, via email.

Any readers in the Washington DC/Rockville area?

Leave a comment if you want to get together. I'm in town until Friday.

An unhackable computer?

Bluesun emails to point out this development:

The software that kept the helicopter’s computer secure was at the heart of its operating system, and it could be just what the world needs to make everything from pacemakers to insulin pumps and power stationsto cars immune to hacking.

“My hope is that in 10 years’ time, anything that is security critical is running on our system or some other one built on the principles we’ve established,” says Gernot Heiserfrom the newly formed Australian national research agency, Data61. One of its predecessors developed the crucial component of the “unhackable” operating system – its kernel.

...

Known as seL4, the kernel has a few highly secure properties: it can only do what it is designed to do; its code can’t be changed without permission; and its memory and data transfers can’t be read without permission. An earlier version of it, called OKL4, is now in millions of smartphones.

Heiser says that two features underpin seL4’s security, one of which is a new way of isolating data inside the kernel. But the key development was making the code capable of being checked mathematically. Other kernels might have these properties too, but it is impossible to know for sure without mathematical proof, says Heiser.

As devout Catholics say about miracles, that would be something.  Color me skeptical.

There has been a desire for provably secure operating systems for decades.  The first formalized efforts were captured in what was called the Orange Book, which defines what is required to do this.

The Orange Book pre-dates my 30+ career in computer security.  I've personally been involved in Orange Book evaluations of commercial products.  It was not a happy experience.  Lots of time spent, even more money spent, no return on the investment.

The problem is that what the security people want (security, duh) is not what the people budgeting for the computer want (functionality).  Sometimes the security people can impose standards that products have to meet (welcome to the Defense Department alphabet soup of FISMA, FEDRAMP, and JITC), but in the long run the security team will always lose the battle to the end users.

And this makes sense.  Just imagine if in 1950 the government established the Department of Computer Design, and all computers had to come from there.  Do you think you'd have an iPhone today?

And so my skepticism goes far beyond whether this truly is mathematically provably secure - I don't have the skills to really address that, although there's an old saying in cryptography that everyone knows enough to design a cipher that they can't crack (which doesn't mean that someone else can't).

My skepticism goes deeper - if this kernel is as secure as is claimed, then it can only be so because functionality is severely restricted.  If you restrict functionality, you make your end users very unhappy.  If some of these have stars on your uniform, you are unlikely in the extreme to be able to force them to use your system.

"My hope is that in 10 years’ time, anything that is security critical is running on our system or some other one built on the principles we’ve established"

Sorry, you don't get 10 years of reduced functionality - likely at significantly higher cost (those Computer Science PhDs don't pay for themselves).  Your users won't stand for it, or wait for you.

And so while an unhackable computer would be very nice indeed, this almost certainly isn't it.  Oh well, mustn't grumble - more work for Internet Security folks ...

Overheard

I read the recent poll on drug testing Congress and laughed.  The Queen Of The World asked what's up:

Me: New poll says that 78% of Americans want members of Congress to have to have random drug testing.

The Queen: Well, sure.  Who doesn't?

Me: Well, they pass all these drug laws.  Why shouldn't they have to pee in the cup?

The Queen: They should have to put their pee where their mouth is.

Me: Ewww.  Not saying that you're wrong, but ewww.

Heh.  You can have any sort of sense of humor that you want when you are Queen Of The World.

Giuseppe Matteo Alberti - Concerto for violin, strings & b c in G minor

Many people think that people in the past were less intelligent, or interesting than people today.  They clearly don't know about Giuseppe Matteo Alberti, a baroque Italian choirmaster who was married six times (!).

Ah, amore.

Sadly, the sum total about Signore Alberti's love life at il Wik is this:

He also was married six times.

His music was pure baroque.  If you like Vivaldi, you'll like this.

Louisiana's LeRoux - Take a Ride On a Riverboat

Library offers anonymous browsing software. Homeland Security objects.

Hilarity ensures:

In July, the Kilton Public Library in Lebanon, New Hampshire, was the first library in the country to become part of the anonymous Web surfing service Tor. The library allowed Tor users around the world to bounce their Internet traffic through the library, thus masking users’ locations.

Soon after state authorities received an email about it from an agent at the Department of Homeland Security.

“The Department of Homeland Security got in touch with our Police Department,” said Sean Fleming, the library director of the Lebanon Public Libraries.

After a meeting at which local police and city officials discussed how Tor could be exploited by criminals, the library pulled the plug on the project.

Funny, cars can be used by both honest citizens and criminals.  There's no word as to whether the motorpool also got a visit from Special Agent Friendly.

“Right now we’re on pause,” said Fleming. “We really weren’t anticipating that there would be any controversy at all.”

But word got out, and the community responded:

Update, Sept. 16, 2015: After this article was published, the library received overwhelming support from the community to restart its participation in the anonymous Web browsing project. The library board met Tuesday and decided to restart the effort.

Bravo to the good Burghers of Lebanon, NH for sticking up for privacy.

(via)

Where ASM826 gets his firewood

Long time readers will recall co-blogger posting about his wood stove that keeps his house warm in the winter.  But heating with wood is not for the faint of heart - it's a lot more expensive than you think.

Wanted: Groundskeeper for football stadium

Old groundskeeper couldn't tell the difference between fertilizer and weed killer.

Thoughts about last night's debate

Boy, howdy, Carly Fiorina is impressive.  Holy cow.

Boy, howdy, Rand Paul was a disappointment.  He was really good going after Bush on medical marijuana.  But he wasn't impressive.

Boy, howdy, Donald Trump is a d-bag.  That doesn't disqualify him from the Oval Office, but wow.

Jeb Bush walks, talks, and quacks like the establishment.  Big applause line when Jeb stuck up for his brother, but I think he's actually befuddled about how to campaign.  Likely this is because his donors don't want him to actually say what he'd do.  Likely that's because he's not as smart as they are.  Dead man walking.

I really want to like Chris Christie.  I really do.  "Who's going to prosecute Hillary Clinton?"  LOL. I loved it when he said a 55 year old construction worker doesn't care about Donald Trump's or Carly Fiorina's careers.  His story about 9/11 was good.  Of course, he'd ban guns.  Good thing he's toast. 

Sen. Cruz may be closest to most of my positions.  He should get more traction, but probably won't.  I don't like him because he's a conservative, I like him because he's a maverick that is willing to drive the herd rather than run with it.  He had a great shout-out to Gun Owners of America.

Rubio will go pretty far, but not this election cycle.  He's pretty impressive, and very young.  He's great on Global Warming.  I wouldn't be surprised to see him offered the Vice President slot.  I also wouldn't be surprised to see him turn it down.

Not sure what I think of Carson.  I suspect that he's anti-gun, but don't really know.  He's what I should like -  the Thinking Man's thinking man.  But I'm not sure.

I'd say something about John Kassich, but very time he opened his mouth I fell asleep.

Nobody is talking about regulations.  This is the biggest gap in the entire campaign, and probably the biggest argument against Trump (who as a big businessman uses them for his competitive benefit).

Who cares about foreign policy.  Nobody will cast a vote based on this next year.

Huckabee was the only one who mentioned the second amendment.  Don't think I like him, but he's there.

Did I mention that Carly Fiorina is impressive as hell?

Lord, Donald Trump is a jerk.

I guess there were others on the stage, too.  Whatvs.

The CNN moderators were pretty goodc, even with the expected gotcha questions.  And the format was decently debate-ish with the candidates challenging each other.

We're not voting ourselves out of this.  None of the men (or women) on the White Horse are going to save the Republic.  But the circus is entertaining and the bread is free.  Are you not entertained?



I did this for you so that you don't have to.  No need to thank me, it's all part of having a full-service blog.

You need some duct tape to go with those beer cans

You know, to make it a more permanent repair ...

Harry Potter's resume

Heh.

(via)

The road goes ever on and on

A new job opportunity has come up, one that's a big step up from where I am.  And so on Monday, I'll start a new gig at a tech company in the Washington DC suburbs.  I'm not a fan of that area but the offer was too good to turn down.

And so when Camp Borepatch finally sells, I'll point the tires north and find myself back in my old stomping grounds of Maryland.  I left there in 1996, bound for London.  Then Atlanta, Boston, and Atlanta again.  Now this.

It seems like a lot of moving.

And it will be strange to have the kids gone.  That was going to happen anyway, but I thought they'd be across town, not hundreds of miles away.

Those of you here in the ATL who would like to meet up sometime in the next month or so, leave a comment.

Travel and change of place impart new vigor to the mind.

- Seneca

Kentucky Headhunters - Big Boss Man

Because it's awesome to ride the Harley with this blaring from the speakers.

On the limitations of intelligence

Totally Stupid Agency screws up your locks

Facepalm:

Air travelers who don’t have firearms in their checked luggage probably use a special Transportation Security Administration (TSA) approved lock. What is a TSA approved lock? I’ll let the TSA’s very own Blogger Bob explain:

TSA has worked with several companies to develop locks that can be opened by security officers using universal “master” keys so that the locks may not have to be cut. These locks are available at most airports and many travel stores nationwide. The packaging on the locks indicates whether they can be opened by TSA.

In other words TSA approved locks are locks with an included backdoor that can be used by TSA officers to access your luggage. I will take a moment to note that the use of TSA approved locks is not lawful when firearms are in your checked luggage so those of us who do fly with them do not, and legally can not, use TSA approved locks.

Guess what happened with the TSA's backdoor key?

Golly gosh, let's all remember to thank the Republicans for this smoking crater of a failed Agency.  And let's make sure to vote for some more Republicans so we can get even more!

Sometimes the good guys win

David Ortiz was a huge part of the revitalization of the Boston Red Sox in the aughties, when they finally emerged from the New York Yankee's shadow to win three World Series championships in a decade.  One of the few things I look back on with fondness from my days in Massachusetts was their 2004 series win.  New England went nuts - people would go to the cemeteries to leave "Boston Red Sox World Champion" hats on the tombstones.  Tough Irish cops in Boston were unashamed to have tears running down their faces.

I even did my own part, one Halloween:

Box score of the final series game, by yours truly.  The neighborhood moms were (mostly) a little mystified, but the neighborhood dads thought that it was the cat's meow.

But back to David Ortiz, who is playing out what is likely his final season.  Ortiz has always been a ray of sunshine in the Red Sox clubhouse, with a perpetually upbeat attitude that was mostly missing from the Sox in the '80s and '90s.

Well, the good guys win sometimes.  Ortiz has achieved the following milestones: over 500 home runs, 3 world series rings, and if he hits another 22 doubles he will have 600 doubles.

To put that in perspective, only three other players have had 500+ home runs and 3 world series rings:

• Babe Ruth
• Mickey Mantle
• Reggie Jackson

That's some company, right there.  and there are only two other players who had 500 homers and 600 doubles:

• Hank Aaron
• Barry Bonds

Bonds was a cheater, but Big Pappy's numbers kept coming after the league cracked down on performance enhancing substances.  It's not often we get to watch the closing of a career when we know for an absolute fact that this is a hall of fame player.



Hat tip: Chris Lynch, who gave the stats that led me down this memory lane.

UPDATE 14 September 2015 16:22: Here's an example of the feeling in New England in 2004.  While this is a parody, it really isn't.  I was there.

"Surely this wound will get me home."

A dying Tommy's last words at Ypres.

Your NFL team cheats

Really.

Hat tip: Rick via email.

Maurice Duruflé - Requiem

Requiem aeternam dona eis, Domine

Et lux perpetua luceit eis

Amen 

Intelligence Agency chiefs shocked to see public distrusts them

Shocked, I say:

WASHINGTON, DC – On a stage in a ballroom in the Walter Washington Convention Center on September 10, the heads of the United States' intelligence community gathered to talk about the work their agencies perform and the challenges they face—or at least as much as they could in an unclassified environment. But the directors of the Federal Bureau of Investigations, the Central Intelligence Agency, and the National Security Agency also had one particular mission in mind as they took the stage at the Intelligence & National Security Summit, an industry event largely attended by government officials and contractors: stopping the poisoning of the public debate around their missions, and especially around the issue of encryption, by unreasonable haters.

CIA Director John Brennan suggested that negative public opinion and "misunderstanding" about the US intelligence community is in part "because of people who are trying to undermine" the mission of the NSA, CIA, FBI and other agencies. These people "may be fueled by our adversaries," he said.

FBI Director James Comey referred to the backlash against his lobbying for backdoors into encrypted communications provided by the technology industry as "venom and deep cynicism" that are making a rational discussion about what could and should be done nearly impossible.

Let me explain it for you scooter: after repeatedly lying to the American public you want the to put their trust in you so it makes your job easier?  That takes a special kind of stupid.  You want trust?  Free Edward Snowden and jail General Clapper for perjury.  No?  Thought not.

Yo, Intel big cheeses!  Since it's Saturday and I need a country music song, here's one for you.