About Apple being ordered to unlock an iPhone

A Federal Judge has ordered Apple to unlock the San Bernadino terrorist's iPhone for the FBI.  Apple is resisting.  A lot of people are (sensibly) concerned over another example of Silicon Valley possibly crawling in bed with The Man.  It seems that there's more to this than meets the eye.

First, it appears that Apple could do this because the iPhone is old.  There's an in-depth analysis of this at Errata Security, but this is the bottom line:

The upshot is this. It's an older phone. If the iOS version is old, and especially if it's been configured to "trust" a laptop/desktop, then there is a good chance Apple or the FBI could decrypt it. If the software is reasonably up-to-date, my understanding of how iPhone's work, it's impossible at the moment for Apple to decrypt the device, especially as suggested by the court order.

If you have a newer iPhone (iPhone 6) then there's a hardware security module that would prevent this.  The Bad Guy had an iPhone 5 version that didn't have this.

There's more at El Reg that delves into the technical (for those that care) but also speculates on Apple's motives to resist the court order:

OK, so why is Apple going to war with the federal government over this?

It's hard to know for certain, but some or all of the following points are likely good reasons:

• As mentioned above, it doesn't want to admit that its phones can be updated even when locked, by simply connecting a USB cable to them. Sure, you're updating it with official Apple firmware – just in this case, the firmware is deliberately insecure.
• Apple doesn't feel it can back down now that it has publicly stood up to law enforcement and politicians on matters of privacy and security.
• It fears that agreeing to this request would set a dangerous precedent for future versions of iOS. You trust Apple with every update – and now Apple's being asked to demonstrate that it can quite easily create insecure versions of its software and release them.
• It sees a strong defense of customer data as a key differentiator in the market.
• It has been waiting for a test case and thinks it can win this one, possibly all the way up to the Supreme Court.
• It is still angry about the Snowden revelations and wants to force the US government into the open over its surveillance of citizens.

As the Mythbusters would say, "plausible".

The New York Times thinks that Hillary is toast

Maureen Dowd has a column in the NYT: When Hillary Clinton killed feminism.  Given Hillary's "Vote for me - I have Lady Parts" campaign, this is enormously damaging to Clinton's position.

The NYT is famously left of center, so the question is what gives?  Michael Hiteshew at ChicagoBoyz examines the situation:

I’m stunned I read this call-out of the Clinton’s hypocrisy in the NYT of all places from none other than Maureen Dowd. This is tectonic and tells us the ground has just shifted on the left. That says a few things:

1. The NYT in general and Maureen Dowd in particular no longer fear the Clinton’s power nor feel they will be punished for disloyalty by a Hillary Clinton administration. Because…
2. The NYT in general and Maureen Dowd in particular no longer see a Hillary Clinton administration as a probability. They know the Hillary campaign is in flames and will only get worse.

I'd also add that the left has never really liked her.  Obama ran away with the nomination in 2008 in large part because of this.  Sure, the Clintons had a ton of money and that bought a certain loyalty, but Hillary wasn't liked in the same way that Bill was.  As soon as there was a viable alternative, the preference cascade began.

It looks like it's begun again, and even the NYT recognizes that.

The New York Times on nominating a moderate to the Supreme Court

Rick emails with this blast from the Gray Lady's past:

The President's supporters insist vehemently that, having won the 1984 election, he has every right to try to change the Court's direction. Yes, but the Democrats won the 1986 election, regaining control of the Senate, and they have every right to resist. This is not the same Senate that confirmed William Rehnquist as Chief Justice and Antonin Scalia as an associate justice last year.

The division of power thus makes moderates of both parties decisive. Against this change in political reality, for Mr. Reagan to nominate Robert Bork was to stick a thumb in moderates' eyes. The Senate need not and should not endorse views so alien to the Supreme Court's honored role as definer and defender of constitutional liberties.

People say that standards are slipping in the media.  Their double standard seems to be doing quite well.

Well, this was asking for it

You must be at least 52" to hack the head of the CIA

Stephen emails to point out this bit of hilarity:

A British teenager is suspected of being a mystery hacker who infiltrated the personal email account of the director of the CIA and posting personal details online.

...

It is alleged that Cracka called US Internet provider Verizon posing as a technician and persuaded them to hand over personal details of Mr Brennan’s AOL email address.

He then allegedly called AOL and convinced a representative to reset the password, using the personal details he obtained from Verizon to get through security.

Yeah, OK, this is an old trick.  But the kid was 15 years old at the time.

Note: this was not his government email, it was his personal account on AOL.  Why the Director of the CIA is on AOL is perhaps the biggest cause for concern ...

The poison of "Social Justice"

Lawrence has a post about how the Open Source community is being slowly poisoned by Social Justice Warriors:

Now comes word that GitHub’s “Social Impact Team” has decided “We don’t want any of those stinking white people here.” “It is very hard to even interview people who are ‘white’ which makes things challenging.”

Eric S. Raymond blogged about this last year:

The hacker culture, and STEM in general, are under ideological attack. Recently I blogged a safety warning that according to a source I consider reliable, a “women in tech” pressure group has made multiple efforts to set Linus Torvalds up for a sexual assault accusation. I interpreted this as an attempt to beat the hacker culture into political pliability, and advised anyone in a leadership position to beware of similar attempts.

...

But, if you think you’re reading that ‘djangoconcardiff’ considers acceptance of pull requests putatively from “persons of color” to be politically mandatory, a look at the Contributor Covenant he/she advocates will do nothing to dissuade you. Paragraph 2 denounces the “pervasive cult of meritocracy”.

"Culture of Meritocracy"?  Can't have that.

In other news, enrolment in liberal arts is down and computer science is up.  I think that we're seeing the Death Throes of Progressivism as we have come to know it.  The University and the Media have been super-saturated with SJW thought as Progressives have come to entirely dominate both institutions.  But both institutions are financially very sick, and will look very different a decade hence.

What will come next?  Who can say?  We've seen progressivism morph into liberalism, then back to progressivism, and seemingly now to socialism.  But the engine that has driven this has been money.  That's changing.

Ted Cruz' political platform

In-depth analysis at ChicaghoBoyz:

Most impressive to me is his Five for Freedom plan. This from the first section:

Abolish the IRS, the Department of Education, the Department of Energy, the Department of Commerce, and the Department of Housing and Urban Development. A Cruz Administration will appoint heads of each of those agencies whose sole charge will be to wind them down and determine whether any programs need to be preserved.

1. Internal Revenue Services – end the political targeting, simplify the tax code, and abolish the IRS as we know it.
2. Department of Education – return education to those who know our students best: parents, teachers, local communities, and states. And block-grant education funding to the states.

There are more.  The analysis and the comments are thought provoking.  And it made me think that I've been looking at this election wrong.

The problem is not breaking the political establishments.  The problem is the permanent governing class.  I wrote about that a couple years back, linking to some very interesting thinking at Isegoria:

The nature of the state

• The state is established by citizens to serve their needs. Its actions are generally righteous.
• The state is just another giant corporation. Its actions generally advance its own interests. Sometimes these interests coincide with ours, sometimes they don’t.

The power structure of the West

• Power in the West is held by the people, who have to guard it closely against corrupt politicians and corporations.
• Power in the West is held by the civil service, that is, the permanent employees of the state. In any struggle between the civil service and politicians or corporations, the civil service wins.

...

This is the first truly revolutionary philosophy that we've seen in a hundred years, and it is just now emergent. Whether you accept or reject its arguments, this is the intellectual structure that will battle Progressivism.

This may be a fool's errand, but Cruz' target selection is dead on.  The question is whether he can do it.  The key is whether we can get people to sign up for cabinet positions in his administration when all he wants to have them do is spin down the agency.  The press will do their best to ruin the reputation of anyone who does this.  I'd love to hear someone ask him how he can hire the right people to do this.

Damn, he's good

I think this picture is in the dictionary under the entry for "hubris" ...

The liberal war on science

I need to read this book:

Jesse Singal left his copy of Galileo’s Middle Finger lying around the house when he went home for Thanksgiving, and his dad picked it up:

“That’s an amazing book so far,” I said. “It’s about the politicization of science.” “Oh,” my dad responded. “You mean like Republicans and climate change?”

Not exactly:
What she found, over and over, was that researchers whose conclusions didn’t line up with politically correct orthodoxies — whether the orthodoxy in question involved sexual abuse, transgender issues, or whatever else — often faced dire, career-threatening consequences simply for doing their jobs.

Two examples stand out as particularly egregious cases in which solid social science was attacked in the name of progressive causes.

Prsonally, when I'm feeling mischievious and some leftie brings up "anti-science Republicans" I like to wax poetic about evolutionary psychology and its implications for gender relations and world peace ...

Do not buy a Samsung Smart TV

It listens to your conversations and uploads them to the 'net:

In a troubling new development in the domestic consumer surveillance debate, an investigation into Samsung Smart TVs has revealed that user voice commands are recorded, stored, and transmitted to a third party. The company even warns customers not to discuss personal or sensitive information within earshot of the device.

...

The new Samsung controversy stems from the discovery of a single haunting statement in the company’s “privacy policy,” which states:

“Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party.” 

Samsung seems to be kind of sort of disputing what this means, but there's no doubt about what their privacy policy said.  And much of the discussion from them has a "we're really unhappy that we got caught" flavor.

My recommendation is to not buy one of these things.  Having a major product line get shut down because of this sort of thing is exactly what the industry needs to take privacy more seriously.

Do people ever pay attention?

Srlsy:

President's Day - who were the best and worst Presidents

[This has been an annual re-post since 2012, but in 4 years I haven't found the need to update it. - Borepatch]

It's not a real President's birthday (Lincoln was the 12th, Washington is the 22nd), but everyone wants a day off, so sorry Abe and George, but we're taking it today.  But in the spirit intended for the holiday, let me offer up Borepatch's bestest and worstest lists for Presidents.

Top Five:

#5: Calvin Coolidge

Nothing To Report is a fine epitaph for a President, in this day of unbridled expansion of Leviathan.

#4. Thomas Jefferson.

Jefferson is perhaps the last (and first) President who exercised extra-Constitutional power in a manner that was unambiguously beneficial for the Republic (the Louisiana Purchase).  He repealed Adam's noxious Alien and Sedition Acts and pardoned those convicted under them.

#3. Grover Cleveland. 

He didn't like the pomp and circumstance of the office, and he hated the payoffs so common then and now.  He continually vetoed pork spending (including for veterans of the War Between the States), so much so that he was defeated for re-election, but unusually won a second term later.  This quote is priceless (would that Latter Day Presidents rise so high), on vetoing a farm relief bill: "Federal aid in such cases encourages the expectation of paternal care on the part of the Government and weakens the sturdiness of our national character." 

#2. Ronald Reagan

He at least tried to slow down the growth of Leviathan, the first President to do so in over half a century (see entry #5, above).  He would have reduced it further, except that his opposition to the Soviet fascist state and determination to end it cost boatloads of cash.  It also caused outrage among the home grown fascists in the Media and Universities, but was wildly popular among the general population which was (and hopefully still remains) sane.

#1. George Washington

Could have been King.  Wasn't.  Q.E.D. 

Bottom Five:

#5. John Adams.

There's no way to read the Alien and Sedition Acts as anything other than a blatant violation of the First Amendment.  It's a sad statement that the first violation of a Presidential Oath of Office was with President #2. 

#4. Woodrow Wilson.

Not only did he revive the spirit of Adams' Sedition Acts, he caused a Presidential opponent to be imprisoned under the terms of his grotesque Sedition Act of 1918.  He was Progressivism incarnate: he lied us into war, he jailed the anti-war opposition, he instituted a draft, and he was entirely soft-headed when it came to foreign policy.  The fact that Progressives love him (and hate George W. Bush) says all you need to know about them.

#3 Lyndon Johnson.

An able legislator who was able to get bills passed without having any real idea what they would do once enacted, he is responsible for more Americans living in poverty and despair than any occupant of the White House, and that says a lot.

#2. Franklin Roosevelt.

America's Mussolini - ruling extra-Constitutionally fixing wages and prices, packing the Supreme Court, and transforming the country into a bunch of takers who would sell their votes for a trifle.  At least Mussolini met an honorable end.


#1. Abraham Lincoln.

There's no doubt that the Constitution never would have been ratified if the States hadn't thought they could leave if they needed to.  Lincoln saw to it that 10% of the military-age male population was killed or wounded preventing that in an extra-Constitutional debacle unequaled in the Republic's history.  Along the way, he suspended Habeas Corpus, instituted the first ever draft on these shores, and jailed political opponents as he saw fit.  Needless to say, Progressives adore him.

So happy President's Day.  Thankfully, the recent occupants of 1600 Pennsylvania Avenue haven't gotten this bad.  Yet.

Pool table assembly

It's under way at Castle Borepatch.  This is actually the third time I've done this, and it's surprisingly easy to do.  Other than putting the slate on the frame, it's a one man job.*

The trick is levelling the frame before you put the slate on.  When I first bought the table, I watched the guys who set it up and learned their secret - playing cards.  You keep adding cards one or two at a time between the frame and the legs until the whole thing is level.  I have two mason's levels (extra long levels) plus a normal sized one, and so this really didn't take too long.  Then bolt everything together.

I was dumb when I took the table apart at Camp Borepatch, because I folded the felt up.  Yeah, they say to replace the felt when you move the table but this is because most pool tables get moved once in a blue moon.  I only set up the table around 18 months ago, and the felt was brand new.  So I ironed it to get the creases out and it looks fine.

But the design and engineering of a pool table is really straight forward.  All you need to put it together is a ratchet set for the bolts, a screwdriver for the side pieces (and screwing down the slate), and a staple gun to make sure that the felt is taught.

And I didn't need a dining room anyway - actually, both the Queen Of The World and I like having the pool table there instead.

* Needless to say, I did the slate by myself, too.  Not sure that I'll do that again.

Damn

The weather at Castle Borepatch: 18° with 20+ mph winds.  And single digits tonight: that means there are so few degrees that we're just about out of them.

I'm going through withdrawal for Georgia winters ...

Watch out for those special snow flakes

Same song, different voices

The Grammy winning singer/songwriter Delbert McClinton:



The poet  Edna St. Vincent Millay (one of Mom's favorite poets):

Time does not bring relief; you all have lied
Who told me time would ease me of my pain!
I miss him in the weeping of the rain;
I want him at the shrinking of the tide;
The old snows melt from every mountain-side,
And last year’s leaves are smoke in every lane;
But last year’s bitter loving must remain
Heaped on my heart, and my old thoughts abide.
There are a hundred places where I fear
To go,—so with his memory they brim.
And entering with relief some quiet place
Where never fell his foot or shone his face
I say, “There is no memory of him here!”
And so stand stricken, so remembering him.

My co-blogger ASM826:

We mark the beginnings of things, but very often there is no way to mark the last times. 

When was the last time:...I read one of them a bedtime story...We all went to the beach together...One of them sat in my lap...One of them held my hand to cross the street...I helped one of them with his homework...and so on... I dunno. Those kinds of things fade away and you don't even notice.

The music of these three voices is ancient.  It is, in fact, the voice of every person who has ever lived.

Things I did not know

Eric S. Raymond (computer guru and gun nut) has a Gun Nut web page.  There's an interesting collection of links there for gunnies.

There's quite a strong correlation between people who work in tech (and especially in computer/network security) and people who shoot.  I haven't seen data on this but it is quite striking.  My guess is that people in these fields are focused on assessing and managing risk, and are used to using tools to help manage those risks.

How TOR users get busted

Here is a presentation from last year's DEFCON conference that contains a number of examples of TOR users who got de-anonymized.  The common theme?  Bad OPSEC.



If you're interested in anonymity on the 'net, this is useful information.

Over-reliance on spellcheck

Just because the word is spelled right doesn't mean it's the word you want.

How Venture Capital works in the Internet Security market

Interesting article over at Robert Graham's blog, using a recent startup flameout as an example of how the VC work works.  My track record has been sort of all over the map - at a successful IPO, at a successful acquisition, at a long, protracted zombie existence.  Robert lays it out the way it is.

If you're interested in how capital fuels Internet Security, this is a great article.

Truth

Apparently the Lord does not have favorites ....

Now that's a pie chart

An Officer and a Gentleman

This guy gave up his shot at the Hall Of Fame to serve his country:

Mitch Harris pitches for the St. Louis Cardinals. But he was in Boston last week to receive the Tony Conigliaro award, given by the Red Sox at the Boston baseball writers dinner to someone who exemplified the determination, grace and will with which Tony C. dealt with adversity in his all-too-short life. We think after you hear about Mitch Harris, you’ll be glad we shared his story, and you’ll perhaps understand why Richie Conigliaro, Tony’s brother, was in tears when he presented Harris with his award, and a banquet hall full of people were moved to rise to their feet. 

Unlike most recipients of the Tony C. award, Harris did not face a physical challenge he had to overcome. His test was of another sort, one that he elected to take on voluntarily, despite an awareness of the near-impossible odds he was facing. Mitch Harris burned with the desire to play big-league baseball, and had the talent to do so. But as a member of the Naval Academy, he had embraced another calling, one he renewed after his sophomore year. Midshipman Harris had the option after two years at the Academy to walk away. Instead, he signed a 2-7 commitment: two more years in the academy, five years of service as an office in the Navy.

Bravo Zulu.  This brings to mind what Ted Williams and Bob Feller did.

Hat tip: Chris Lynch, who also has a video of Archer as Magnum P.I.  Awesome.

Careful who you put in charge of sales

Things seem kind of fishy here.

Climate Change as a political proxy measure

Rick emails to point out that the population simply isn't much interested in Climate Change:

A YouGov poll of 18,000 people in 17 countries found only 9.2 percent of Americans rank global warming as their biggest concern. Only Saudi Arabians were less concerned about global warming at 5.7 percent. The biggest concern for Americans was global terrorism — 28 percent of Americans polled listed this as their top issue.

Despite a big PR push by President Barack Obama to tout his administration’s global warming agenda, most Americans have been unconvinced it’s the country’s most pressing issue. A Fox News poll from November found only 3 percent of Americans list global warming as their top concern.

So why the intense focus by the political establishment?  Partly it's so that Democrats have an issue to run on this year that isn't their terrible track record of governance screw ups.  Partly it's about political donations from "Big Green" environmental movements.  Partly it's a desire (by both parties) for higher revenue from Carbon taxes and the like.

But the real message to take away from this is that it reflects the profound anti-democratic views of the entire governing class.  The concerns and desires of the governed are quite irrelevant - only the concerns and desires of the elite matter.

It's another example of the anarchy-tyranny in which we find ourselves: the anarchy (lack of effective approach to terrorism) is mixed in equal measure with tyranny (a continued push for Carbon Taxes, and damn the polls).

Heh

Well played, Netflix:

Dude. You had one job.

Did they blow the architecture, or the design?

But this is my new favoritist Twitter feed.  Via Chris Lynch, who finds the coolest stuff.

Support our snoops!

Heh:

(via)

Star Wars Episode 8 (spoiler alert)

HAHAHAHA!

(via)

It pains me to say this

The Internet can't match the local pub:

The Campaign for Real Ale (CAMRA) has perhaps merely confirmed what all right-minded people already know: that those who have a local boozer in which to quaff ale and chew the fat with mates are "significantly happier" than wretched souls who do not. 

CAMRA asked Oxford Uni's Professor Robin Dunbar to look into the link between pub-based social interaction and personal wellbeing. He concluded that "having a strong social network significantly improves both your happiness and your overall health".

So much as I love all y'all, get out to your local and have a pint with your mates.  Because SCIENCE®!

Is the NSA making friends and influencing people at other agencies?

Because Congress is grilling those other agencies over their use of equipment containing backdoors probably put there by NSA:

A bunch of US government departments and agencies – from the military to NASA – are being grilled over their use of backdoored Juniper firewalls. 

The House of Representatives' Committee on Oversight and Government Reform fired off letters to top officials over the weekend, demanding to know if any of the dodgy NetScreen devices were used in federal systems. 

Juniper's ScreenOS software – the firmware that powers in its firewalls – was tampered with by mystery hackers a few years ago to introduce two vulnerabilities: one was an administrator-level backdooraccessible via Telnet or SSH using a hardcoded password, and the other allowed eavesdroppers to decrypt intercepted VPN traffic. The flaws, which were smuggled into the source code of the firmware, were discovered on December 17 by Juniper, and patches were issued three days later to correct the faults.

The speculation is that there aren't many other actors other than the NSA who could have pulled this off.  Speculation, of course - there's no smoking gun, as you'd expect.

But everyone suspects them, which means they're incompetent: either they did this and got caught, or they didn't do this but have made everyone distrust them anyway.  Way to go!

"Nannycam" security so bad, there's a search engine for bedroom video monitors

I keep talking about how when it comes to the new "Internet Of Things", security wasn't an afterthought.  It wasn't thought of at all. Internet of Things security is so bad, there’s a search engine for sleeping kids:

Shodan, a search engine for the Internet of Things (IoT), recently launched a new section that lets users easily browse vulnerable webcams.

The feed includes images of marijuana plantations, back rooms of banks, children, kitchens, living rooms, garages, front gardens, back gardens, ski slopes, swimming pools, colleges and schools, laboratories, and cash register cameras in retail stores, according to Dan Tentler, a security researcher who has spent several years investigating webcam security.

We've seen Shodan here before.  It's the All Seeing Eye to identify which devices are connected to the 'net.  As you see here, there are a whole lot of devices that should not be connected to the 'net, at least without better security.  And for an easily understandable reason:

Tentler told Ars that webcam manufacturers are in a race to bottom. Consumers do not perceive value in security and privacy. As a rule, many have not shown a willingness to pay for such things. As a result, webcam manufacturers slash costs to maximize their profit, often on narrow margins. Many webcams now sell for as little as £15 or $20.

"The consumers are saying 'we're not supposed to know anything about this stuff [cybersecurity]," he said. "The vendors don't want to lift a finger to help users because it costs them money."

So what do you do?  One thing is simply not to get any of this sort of thing.  No Internet-connected webcams, security systems, light bulbs, refrigerators, TVs, etc.  Some of these products are frivolous, like Philips' Internet controllable light bulbs that change color via command from your iPhone app.

But others are not.  The Queen Of The World likes her Netflix and Amazon Fire TV, and we have a new TV that will give her than.  What's the risk?  I guess I need to figure that out.  What I'm thinking is to block outbound traffic at the Internet router.  Probably to do this I will need to build a box to put in front of that, with appropriate tools and logging.

That takes a pretty high skill set, and a lot of time.  That's not something that, say, Mom could do.  I'm thinking more and more that I should have gone to Law school.  This might make a good class action suit.

What's all this cold white stuff, Boss?

I guess we're not in Georgia anymore, Wolfgang ...

Snowmageddon, explained

I guess I need to point out that Maryland is south of the Mason-Dixon line.  And while that doesn't make it in the South, it does make everyone here officially a Snow Weenie™.  I mean, you don't see that in Pennsylvania, and that's only a half hour motorcycle ride* from here.

* Well, when all this Global Warming melts ....

Merle Haggard - If We Make It Through December

We've had near 20 inches of snow here at Castle Borepatch - it's hard to tell exactly how much because the wind is gusting and the drifts are filling in the moat.  I'd worry about being able to lower the draw bridge but the plow is nowhere to be seen (and likely won't be for some time).

But Country music has some great songs about winter, like this one which went to #1 on Billboard.



If We Make It Through December (Songwriter: Merle Haggard):

If we make it through December
Every thing's gonna be all right, I know
It's the coldest time of winter
And I shiver when I see the falling snow 

If we make it through December
Got plans to be in a warmer town, come summer time
Maybe even California
If we make it through December, we'll be fine 

Got laid off down at the factory
And their timing's not the greatest in the world
Heaven knows I've been working hard
Wanted Christmas to be right for my sweet girl 

I don't mean to hate December
It's meant to be the happy time of year
And my little girl won't understand
Why momma can't afford no Christmas here

So if we make it through December
Every thing's gonna be all right, I know
It's the coldest time of winter
And I shiver when I see the falling snow 

I don't mean to hate December
It's meant to be a happy time of year
and my little girl won't understand
Why momma can't afford no Christmas cheer.

If we make it through December.

I seem to be the Typhoid Mary of snow

Three weeks after I moved from Yankeeland to Atlanta, it snowed.  I've been in Castle Borepatch for three weeks and a day and it's snowmageddon.

I am now accepting offers from communities that never want snowfall.  For the right price, I will promise never to move to your fair locale.  I will also take offers from communities that want huge amounts of snow - for the right price, I'll move there.

Who knows, maybe I can get offers from both.  Winning!

Why we can't have nice things on the Internet, redux

The Silicon Graybeard brings an epic rant.  You really need to RTWT, but this gives you the flavor:

A running joke in the electronics hardware business is that software is going to cause the end of the world.  The way the software business is run is so fundamentally different from the way that hardware works that most of us are perpetually astounded.  Can you imagine buying a car where many features just don't work right, and the companies have you return to the dealer to install new hardware?  I suspect that would raise a pretty loud howl from their owners.  How is that different from a software patch to fix something that doesn't work properly?

Yup.  Another old saying is that if you screw with it long enough hardware eventually breaks; if you screw with software long enough it eventually works.  Kind of.  Sometimes.

That's why I won't ever have a self driving car.  I'll never be convinced they've screwed with it enough to make it work.

Attacks via Internet Dating sites

I can't really say I'm surprised at this:

At least five dating websites may be involved in an attack scenario that is spreading a worm to site visitors, infecting their home router and adding it to a botnet.

The worm is a variant of TheMoon, which was first discovered in February 2014, and works by taking advantages of weaknesses in the HNAP (Home Network Administration Protocol) protocol.

Attackers are using one-night stand dating sites to spread the worm. On each malicious website, the infection occurs via a two-step phase launched via a malicious iframe embedded on the page.

The iframe works by making different URL calls to see if the router runs the HNAP protocol and if it uses the 192.168.0.1 and 192.168.1.1 for router management and as gateway IPs.

It then calls home, informing its creators of its findings. Here is where the second attack stage happens, and where a second URL is loaded in the iframe, which delivers the actual worm, a Linux ELF binary.

What's interesting here is that the target isn't the computer, it's the home router.  Needless to say, it's a Bad Day when someone owns your home router.

It seems that the web sites were stood up using a stolen identity, so there are multiple layers of security fail involved.  If Online Dating is your bag, Baby, it's probably best to stick to a name brand site.  Err, not Ashley Madison, though.

Beware Linkedin invitations

It seems that there's a big spike in fake profiles on Linkedin.  These profiles are used by scammers to get information out of you that they then exploit for financial gain.  This technique has been called "Social Engineering" for a long time; the fact that it's been around for a long time tells you all you need to know about its effectiveness.

Linkedin has a good (despite being rather old) blog post about how to spot a fake profile.

My attitude has always been to ignore requests from Linkedin users who I don't recognize, and who don't craft a personalized invitation pointing out how I've worked with them (or someone I know) in the past.  "I'd like to add you to my professional network" messages from folks I don't recognize go straight to the bit bucket.

Fascist government goon says "What?"

Actually, he said that anonymity of the Internet should be against the law:

A senior Homeland Security official recently argued that Internet anonymity should outlawed in the same way that driving a car without a license plate is against the law. 

Erik Barnett, an assistant deputy director at U.S. Immigration and Customs Enforcement and attache to the European Union at the Department of Homeland Security, outlined his argument in an article titled “Whose Privacy Are We Protecting? Balancing Rights to Anonymity with Rights to Public Safety,” published in FIC Observatory, a French publication dedicated to debates about cybersecurity.

Because speech needs a license, just like your car does.  Or something.  And of course he rolls out the do-it-for-teh-childrenz excuse as justification.  Odd that he doesn't spend much time discussing government suppression of free speech, like the IRS audits of the Administration's political enemies.

Actually, he doesn't spend any time discussing that.  Must not be a problem*, or something.

* To him.

Entitled Internet reviewer is etitled

I thought I was going to High Tea but found myself at a biker bar ...

This is why we can't have nice things

Smartphone photo of lock keyways enough to produce ready-to-print CAD drawings for key:

Hackers have been gifted with an online web service that can produce blueprints for 3D printed keys from nothing more than a photograph of a lock.

Gah.

The KeysForge application developed by an academic trio drastically simplifies the complexities in developing keys, allowing amateurs to snap a photo of a lock and have the respective key 3D printed. 

University of Colorado infosec assistant professor Eric Wustrow and two colleagues revealed the work at the Chaos Communications Congress in Hamburg last month. 

"We made an automatically generating 3D model program [which] takes a single picture of the keyway (lock) and produces a model in CAS (computer assisted design)," Wustrow says, adding that a smart photo photo will suffice. 

"You can then take that model and print it on a 3D printer or ship it off to Shapeways or whatever.

Double gah.  It will cost you eight cents to print the key.

Happy Monday, everyone!

Now this is how nature documentaries should be narrated

With the "Internet Of Things" you got no stinkin' security

The "Internet Of Things" is where companies stuff tiny computers with wifi into basically all consumer products - refrigerators, light bulbs, toys.  This allow them to add "value add" services, like, err, well I really can't think of much.

Maybe it would let you remotely turn off your refrigerator if you had left it on, or something.

The punch line, of course, is that companies collect all sorts of data on you using these.  I've posted about this before:

Your "Smart" TV spys on you

But wait, there's more!  Et tu, Barbie?  Et tu?

Earlier this year Mattel unveiled "Hello Barbie," a $74.99 wi-fi equipped interactive doll. Users press a button on Barbie's belt to start a conversation and the recorded audio is processed over the internet so that the doll can respond appropriately. The doll also remembers the user's likes and dislikes.

Now Security Researcher Matt Jakubowski claims that he has managed to hack the Hello Barbie system to extract wi-fi network names, account IDs and MP3 files, which could be used to track down someone's home. "You can take that information and find out a person's house or business. It's just a matter of time until we are able to replace their servers with ours and have her say anything we want," Jakubowski warned.

Fortunately, the Black Hat hackers have a demonstrated track record of being respectful to those they hack.  Wh00t!

And it must be said: who ever would have seen this coming?

But wait - there's more!  Internet ads listen to you:

SilverPush is an Indian startup that's trying to figure out all the different computing devices you own. It embeds inaudible sounds into the webpages you read and the television commercials you watch.

Software secretly embedded in your computers, tablets, and smartphones picks up the signals, and then uses cookies to transmit that information back to SilverPush. The result is that the company can track you across your different devices. It can correlate the television commercials you watch with the web searches you make. It can link the things you do on your tablet with the things you do on your work computer.

Your computerized things are talking about you behind your back, and for the most part you can't stop them­ -- or even learn what they're saying.

Actually, you probably can stop this, but you'd have to use a desktop computer, unplug the built-in speaker, and make sure you haven't got a microphone plugged into the mic jack.  In other words, use 1990s technology.

Remember, if you're not paying for it, you're the product.

So what do you do?  Your mileage may vary, but I personally will never enable "smart" functions on things like TVs.  I won't use "smart" light bulbs.

But now for full disclosure: The Queen Of The World looks like she might like her some Netflix from the TV, which means that it's on the 'net.  Bah.

Short of blocking outbound Internet traffic from the TV to all but known locations, I'm not sure.  That wouldn't be simple.  That is a post for another day.

Homeland Security: Gee, it's awful that all these power plants can get hacked

Filed under "we're only surprised that you're willing to say this in public":

Utilities opening their infrastructure to the internet are creating an irresistible honeypot for criminals, says the US government's Industrial Control Systems Cyber Emergency Response Team. . 

In spite of often being billion-dollar operations with long-standing experience in their industrial control networks, critical infrastructure owners seem to think they can take advantage of the public 'net for connectivity without a care for security. 

While ICS-CERT's Marty Edwards, speaking to the S4 conference in Miami this week, didn't call such operators idiots, he may as well have done. According to Reuters, he came close, saying: “I am very dismayed at the accessibility of some of these networks … they are just hanging right off the tubes.”

That's OK - nobody would ever try to take down a power plant.  Oh, wait ...

R.I.P. Alan Rickman

Well, damn.

He was one of my favorite actors for years.  Truly, Madly, Deeply is a great performance of his from back in the Die Hard/Robin Hood days, but one that shows a depth that he carried with him throughout his career.  If you haven't seen that film, you're in for a treat.

Oh, yeah - I loved him in Galaxy Quest, too.

Thanks for the great performances, Alan - including this one which I've posted several times before but which assumes a particular poignance today.

Hillary Clinton: dead candidate walking

The news over the weekend was about how the FBI is expanding their investigation of Hillary's email server from mishandling of classified information to include investigation of corruption involving the Clinton Foundation.  Apparently there are dozens (maybe as many as a hundred and fifty) FBI Agents assigned to the case.  It seems that this will blow up during the height of the Presidential campaign this year.

This makes me go "Hmmmmm".

Consider: there are multiple leaks from inside the FBI.  But this administration has been harsher on cracking down on leaks than any in history.  They even investigated a journalist (James Rosen) who published a leak.  And yet there are multiple leakers.  Hmmmmm.

Consider: the Justice Department has been heavily politicized by this administration.  Maybe the FBI is motivated by simple a desire to see justice done and the laws enforced against all violators, however large or small.  Hmmmmm.

I don't buy it.  I think that Obama is behind this.  So what's the motivation?

I don't think it's because the Obama team and the Clinton team despise each other.  They do, but that doesn't seem to rise to the level of this sort of political risk.  After all, Obama is focused on his legacy and on what he'll do for the next 30 years after leaving office.  If the Democratic party thought that he threw Hillary under the bus for petty reasons, that would be a huge loss of status for him.

I think it's because they don't think that she can win.

But the primary is locked up for her.  The fix is in - sure, crazy old Bernie is gaining in Iowa and New Hampshire.  The Clintons raised a Billion dollars in the Clinton Foundation.  That won't sit in the bank.  Favors will be called in.  The nomination is a lock.

As is her defeat in the General Election.  I think that Trump put the nail in that coffin with his comments about Bill.  Turn out the lights, the party's over.

So what is Obama to do?  Indict Hillary, forcing her to step down, and stand up Vice President slow Joe Biden.  And rely on the Mainstream Media and the corrupt GOP establishment to squeeze Trump out so Joe runs against a typical sad sack.

I expect an announcement from her by March that she's stepping down due to "health reasons",  and Joe to enter a brokered convention.

Will any of this matter?  Only if Trump drops out, too.  A lot of people have considered him as a stalking horse for the Democratic Party.  I'm pretty skeptical - even if he threw his hat into the ring on a lark, it's pretty hard to see a guy like him walk away from a big lead.

And I suspect that his lead is bigger than anyone will admit - he polls well among Democrats and hispanics (!), so the polls represent a floor for his support.  The ceiling?  We'll have to see.  I expect it's in potential landslide territory.

Will he make a good President?  Beats me.  Will he cause the collapse of the Republican Party?  Beats me.

Will he get Obama to force Hillary from the race?  Hmmmm.

R00t, r00t, r00t for the home team

Filed under "not using your Powers for good":

The former scouting director of the St Louis Cardinals baseball club has admitted he illegally poked around in the player database of a Major League Baseball rival 

Chris Correa pleaded guilty on Friday at a Houston federal court to five counts of unauthorized access to a computer stemming from a 2013 infiltration of the email accounts and scouting database of the Houston Astros. 

Each of the counts carries a maximum penalty of five years in prison and $250,000 fine.

It seems that one of his scouts left St. Louis and went to the Astros.  Once there, the scout used the same password he had used at St. Louis.  Our Hero guessed that password, starting his date with Clud Fed.

It's idiots, all the way down.

I always suspected that Smart Cars ran on a V-Twin ...

The difference between Rangers and Special Forces

Sent to me by someone who was formerly in Special Forces:

Rangers vs Special Forces

The Chief of Staff of the Army asked his Sergeant Major, who was both Ranger and Special Forces qualified, which organization he would recommend to form a new anti-terrorist unit. The Sergeant Major responded to the General's question with this parable: If there were a hijacked Boeing 747 being held by terrorists along with its passengers and crew and an anti-terrorist unit formed either by the Rangers or the Special Forces was given a Rescue/Recovery Mission; what would you expect to happen?

Ranger Option
Forces/Equipment Committed: If the Rangers went in, they would send a Ranger company of 120 men with standard army issue equipment.

Mission Preparation: The Ranger Company First Sergeant would conduct a Hair Cut and Boots Inspection.

Infiltration Technique: They would insist on double timing, in company formation, wearing their combat equipment, and singing Jody cadence all the way to the site of the hijacked aircraft.

Actions in the Objective Area: Once they arrived, the Ranger company would establish their ORP, put out security elements, conduct a leaders recon, reapply their face cammo, and conduct final preparations for Actions on the OBJ.

Results of Operation: The Rescue/Recovery Operation would be completed within one hour; all of the terrorists and most of the passengers would have been killed, the Rangers would have sustained light casualties and the 747 would be worthless to anyone except a scrap dealer.

Special Forces Option
Forces/Equipment Committed: If Special Forces went in, they would send only a 12 man team (all SF units are divisible by 12 for some arcane historical reason) however, due to the exotic nature of their equipment the SF Team would cost the same amount to deploy as the Ranger Company.

Mission Preparation: The SF Team Sergeant would request relaxed grooming standards for the team.

Infiltration Technique: The team would insist on separate travel orders with Max Per Diem, and each would get to the site of the hijacking by his own means. At least one third of the team would insist on jumping in.

Actions in the Objective Area: Once they arrived , the SF Team would cache their military uniforms, establish a Team Room, use their illegal Team Fund to stock the unauthorized Team Room Bar, check out the situation by talking to the locals, and have a Team Meeting to discuss the merits of the terrorists' cause.

Results of Operation: The Rescue/Recovery Operation would take two weeks to complete and by that time all of the terrorists would have been killed, (and would have left signed confessions); the passengers would be ruined psychologically for the remainder of their lives; and all of the women passengers would be pregnant. The 747 would be essentially unharmed, the team would have taken no casualties but would have used up, lost, or stolen all the "high speed" equipment issued to them.

I can neither confirm nor deny any of this ...

Another musters out

One of the last original member of Merrill's Marauders has passed:

MSG Melillo served his country for over 20 years and served in both WWII and Korea. MSG Melillo was an original member of "Merrill's Marauders" Merrills Marauders was originally named the 5307th Composite Unit and was created to conduct long range, deep penetration missions behind enemy lines and specialized in jungle warfare. The unit carried the name of their brilliant commander, BG Frank Merrill. The Marauders became famous for operating for extended periods of time behind the Japanese lines and during operations in Burma walked hundreds of miles.

Retired MSGT Vincent Melillo, 97, was the last ORIGINAL Merrill's Marauder in Georgia out of around 40 who are still living. 

MSG Melillo was a member of the Ranger Hall of Fame as well as the Georgia Military Hall of Fame and was much beloved by the Ranger and Special Forces communities. Among his many awards and decorations were the Bronze Star Medal, The Purple Heart, WWII Victory Medal and Korean Defense Medal.

The Marauders were tough:

A week after Myitkyina fell, on 10 August 1944, the 5307th was disbanded with a final total of 130 combat-effective officers and men (out of the original 2,997). Of the 2,750 to enter Burma, only two were left alive who had never been hospitalized with wounds or major illness.

Every man in the unit was awarded the Bronze Star.

"Skin grows back. Varnish doesn't."

Watching the movers unload the van at Castle Borepatch, I hear Dad's voice whisper in the back of my head.

It will be nice to have something to sit on (other than the floor).

New Year's thoughts

Every new beginning comes from the end of some beginning. - Seneca

There is so much to say, but Seneca nailed it. This last year (or two) has been an exercise in pruning for me. Now we see new growth. Seneca would have nodded knowingly.

May this new year be as good to you and yours as it looks like it will be for the Queen Of The World and me.

The view from Castle Borepatch

I arrived with Wolfgang at 0200 this morning for the closing, armed with a cashier's check and a Power Of Attorney for the Queen Of The World. Time pressure made me leave a partially loaded truck behind with her, but 'tis done: Castle Borepatch is ours.

And when the Harley gets up here, we are bang in the middle of prime riding country.

But uff da, what a month It's been.

Camp Borepatch signing off

The movers are here. The first picture from here was very like this one.




Lots of water under the bridge since then. Wolfgang and I will head up north later today. He will stay with friends until the Queen Of The World and I get there at the end of the week.

Needless to say, blogging will be spotty.

Georg Frederick Handel - Messiah: Hallelujah Chorus

Not my favorite bit from that piece, but appropriate for the day.   It's been quite some time since I've been to a Handel Sing-a-long and likely can no longer sing the baritone part from memory.  But that's OK - in packing up Camp Borepatch I found my score.  The next time I have I have an opportunity, I shall be prepared.

Merry Christmas to all

Life is chaos, with the Queen Of The World and I both scrambling to get everything packed my Monday when the movers show up.  But there is something about this day that gives one pause, to ponder something bigger than oneself.

Even in the Trenches, 101 years ago on the Western Front.



Yeah, chaos could be much worse.  May the spirit of the season be with you and yours.

Dan Zimmerman. Intellectual property thief. Dead Hooker Magazine.

Putting stuff on your blog that someone else made is no problem if you give credit and link.  Not so much if you don't.

Trans-Siberian Orchestra - Christmas Eve in Sarajevo

Freedom means that you can do this even if your neighbors don't like it.

Airportblogging

Mid-afternoon at National Airport is PACKED. Traffic jam on the roads, traffic jam at the elevators in the parking deck, even at the bars by the gates.

I can't even imagine what it will be like this evening, or tomorrow. Glad I'm not going anywhere until after Christmas.

If you're planning on flying, give yourself an extra hour.

Nice gift wrap!

I wonder what the present is?

Airport security line whining

I got the closest parking place to the terminal that I think I've ever had. Then a massive delay at security theater. And Southwest Business Select didn't get me TSA Pre. Bah.

I liked it when I wasn't flying so much.

What the hell, Nabisco?

It seems like White Fudge Oreos are in stores for about a nanosecond, starting at some undefined moment after Thanksgiving.  The situation is so bad that scalpers are peddling boxes for $10 on Amazon and eBay.

$10 for cookies.

[blink] [blink]

I actually wouldn't care except these are the favorite cookies of the Queen Of The World.  You're putting your marketing tag line "By appointment to HM Queen Of The World" at risk.  And more importantly, I'm getting tired of driving from Kroger to Public to Target to see if maybe another shipment had arrived.

In future if you would endeavor to be less of an arrogant ass, I should be ever so much appreciative.

Law school professor: NFL's DeflateGate investigation "undermines the integrity and public confidence in the game"

Filed in an amicus curiae in the appeal of Tom Brady's suspension.  Also:

“If adverse inferences should be drawn from a party’s failure to produce relevant evidence,” Blecker writes, “the League’s failure to produce either gauge overshadows Brady’s failure to produce his cell-phone — especially when all phone records confirm that the NFL has all relevant texts.”

Even if you don't like the Patriots, the NFL's willful ignoring of the science and investigative process is pretty unsavory.

(via)

Nat King Cole - The Christmas Song

Perhaps the greatest Christmas song ever recorded.  They picked the right title ...

Go now - coolest Google doodle EVER

Google often puts up "doodles" to commemorate events of the day.  Go NOW to google.com to see the doodle they made in honor of Beethoven's 245th birthday.

Go now - it won't be there tomorrow, and it's as astonishingly magnificent as old Ludwig deserved.  I love the puzzles where you put together pages of sheet music for his songs - and must brag that I did the Ode To Joy on the first try.

For those of you who might miss this doodle, here's the Ode To Joy, done as only the Japanese can (yes, it's true, with a chorus of 10,000!).  Thanks, Ludwig.  And thanks, Google.  For a little while, you weren't evil.

World War II sabatoge manual looks like Dilbert

The OSS was the WWII precursor to the CIA. One of the things they did wad create a manual for prople in occupied Europe on how to sabatoge the war effort.

Direct sabatoge was dangerous, so the manual was long on passive-aggressive suggestions. Basically, it described a Dilbert future.

https://www.cia.gov/news-information/featured-story-archive/2012-featured-story-archive/CleanedUOSSSimpleSabotage_sm.pdf

Bing Crosby - Mele Kalikimaka

I sure wish there was Dean Martin's version on Youtube ...

George Thorogood - Rock 'n Roll Christmas

That's John Lee Hooker dressed as Santa.

Out of Chaos ...

... comes order.

I close on Camp Borepatch tomorrow.  It's been chaos.  I expect that to continue for a couple weeks.  I hope at the end that Chaos will catch a Greyhound Bus to the Coast ...

Chaos often breeds life, when order breeds habit.

- Henry Adams

Well, that was fun

The Harley wouldn't start, because the batteries in BOTH fobs were dead. Off to Home Depot - they were out of that type of battery. OK, off to Publix. Success!

Home. Swap batteries. Security system is happy..

Battery doesn't have enough juice to turn the motor over. Need to take the seat off to get to it; need to take the trunk off to get to the seat. Where did I put the tool to unlock the mounting lugs ....

Aw, screw it. I need some relaxing time after all this "relaxing time".