Needs bacon, though

And where does the ammo go?

Via Doug Ross.

Security Smorgasbord, vol 1 no 10

The year is ending not with a security bang, but with a security whimper.

There's been no security updates of note to point out for a week, so other than the usual perimeter security, you can stand down for the end of year festivities.

About the only thing worth pointing out is that it looks like GSM security has been broken. GSM is cell phone stuff, and is essentially used in any modern mobile phone. When it was introduced 20 years ago, its security was highly touted. Now it looks like a combination of inherent weaknesses in the algorithms as well as Moore's Law have caught up:

At a hacker conference in Berlin that runs through Wednesday, the cryptographers said they've cracked the algorithm that determines the random channel hopping and have devised a practical means to capture entire calls using equipment that costs about $4,000. At the heart of the crack is open-source software for computer-controlled radios that makes the frequency changes at precisely the same time, and in the same order, that the cellphone and base station do.

"We now know this is possible," said Karsten Nohl, a 28-year-old cryptographer and one of the members of an open-source project out to prove that GSM, the technical standard used by about 80 percent of the mobile market, can't be counted on to keep calls private. The attack "is practical, and there are real vulnerabilities that people are exploiting."

This means that you should realize that your cell phone is essentially a fancy two-way radio. If someone really wants to listen in, they can. Most readers already know this, probably.

20 years ago, Oracle's Larry Ellison caught quite a lot of flak for his comment "You got no privacy; get over it." Time is showing him to be more right than not.

Not much of a smorgasbord. But remember that when it comes to security, no news is good news.

Quote of the day

On the makeup of the anti-anti-gun-control (Right to Keep and Bear Arms) movement:

The pro-RKBA movement is a profoundly unnatural alliance. It’s as if Bible-thumpers, free-market pornographers, and atheistic Marxists needed to march shoulder-to-shoulder in support of freedom of the press against an opposition that wanted to outlaw literacy.

Heh.

From an interesting recent comment to an interesting post by Eric Raymond, from quite some time back.

Store window, Munich, December 1996. Taken with Pentax K1000.

It's not like I was in love with that camera, but it was ultra reliable, and would take the pictures if you knew how to work it. I took it everywhere, and it always delivered. Sure wish I could get a digital body for it.

#2 Son recommends ...

That you watch this, for an excess of cuteness and chuckles.



Yeah, I know there've been 18 million views. If you need cuteness and chuckles, this is the place to start. I mean, #2 Son wouldn't steer you wrong.

Blogroll updates

New Years Resolution: I will do better in keeping up with my blogroll.

Coordinated Illumination is a term I'd never heard before. The blog by that name breaks it down for me:

Illumination fires are often coordinated with HE fires to both expose the enemy and to kill or suppress him.

Sounds rather useful, that. Plus his caption of George Washington crossing the Delaware made me laugh out loud: AMERICA. We will kill you in your sleep on Christmas.

Sabra from Trailer Park Paradise is well known to many readers. Her recent rant on Women's Magazines had me hicoughing with laughter:

Note the primary headline, the one paired with the big picture: WALK OFF 20 LBS BY CHRISTMAS! Note, also, the somewhat smaller head: Cupcake fun!

Mr. B. at In the Middle of the Right is another shooter, and describes himself as "striving towards mediocrity". The older I get, the more I can relate. Sing it, brother ...

Welcome to the Borepatch Blogroll, everyone!

And to anyone out there who has be on their blogroll: if I haven't added you, send me an email and I'll add you here.

Well known to the local Constabulary

#2 Son. Started running with a tough crowd early.

Referrer Madness

It's odd what leads some folks to this little corner of Al Gore's Intarwebz.

Mac Fanboys vs Windows Fanboys vs Linux Fanboys

Cage match! I'm betting on the Linux fanboys, because they're used to fighting sneaky. Mac Fanboys are too emo, and the Windows dudes got no security.

i hacked neighbor's wifi. now what do i do?

It's customary to bring it back with a full tank. If you want to add a personal gesture of appreciation, you might get it washed, too.

damnyankee 2 words?

Like they say in Maine, ayuh.

Quote of the day

Some arguments should not be met with politeness.

The problem I have with this whole discussion is that it grants what is a monstrous totalitarian perspective a polite hearing rather than the sort of response it truly deserves. It strikes me to just dignify the proposition "the state should spay women and castrate men" with "wouldn't it be better if we just find a way to reduce the fuel we burn?" is to in effect tolerate the intolerable. A far better response, and dare I say a more ethical one, would be "your policy will indeed reduce the world's population because people like me will put a 10mm hole between the eyes of totalitarian scum like you."

I'm partial to .30-.30, myself.

I do wonder what sort of dinner parties Perry de Havilland finds himself at, though.

What does a Nobel Scientist say about the Greenhouse Effect?

Now you might think that a chemist wouldn't know anything about the science of global warming. You might think that the science of global warming is all complicated.

But Kary Mullis does know about the scientific method - experimental tests to provide evidence for or against a particular hypothesis. He also knows how research grant funding works, and how that effects the scientific method. And he said all of this seven years ago.

That's a powerful "consensus" right there.

Hat tip: The Dog Ate My Data.

The Infrastructure of the 21st Century is built from Moonbeams and Spun Sugar

That's a quote stolen from my old friend Ken Hardwick. Marcus Ranum explains why.



If you want to understand why Internet Security is so broken, this Ted Talk is a good introduction.

Beware the Jabberwock Wikipedia, my son!

The jaws that bite, the claws that catch!

Connolley took control of all things climate in the most used information source the world has ever known – Wikipedia. Starting in February 2003, just when opposition to the claims of the band members were beginning to gel, Connolley set to work on the Wikipedia site. He rewrote Wikipedia’s articles on global warming, on the greenhouse effect, on the instrumental temperature record, on the urban heat island, on climate models, on global cooling. On Feb. 14, he began to erase the Little Ice Age; on Aug.11, the Medieval Warm Period. In October, he turned his attention to the hockey stick graph. He rewrote articles on the politics of global warming and on the scientists who were skeptical of the band. Richard Lindzen and Fred Singer, two of the world’s most distinguished climate scientists, were among his early targets, followed by others that the band especially hated, such as Willie Soon and Sallie Baliunas of the Harvard-Smithsonian Center for Astrophysics, authorities on the Medieval Warm Period.

I've been meaning to post about this for a bit. The ClimateGate emails have exposed Wikipedia as being entirely unreliable regarding climate change. Entirely. Anthony Watts has been all over this for a while, but the situation is essentially a politically motivated editor at Wikipedia rewrote history via thousands of Wikipedia articles. The Wikipedia "system" broke down, as corrections to these articles were blocked, and the people correcting them were banned from Wikipedia.

Computer Security folks look at "Resource Poisoning" attacks as some of the most interesting - if you can convince a critical mass of users that something is untrustworthy, it will collapse.

Wikipedia has suffered a massive and public failure of transparency. The only question is which other bits of Wikipedia are as untrustworthy?

Via TJIC, who offers some insight into how the system is gamed to produce a certain result.

La Gabelle

The reason that history repeats itself is that nobody listens the first time.

It's surprising just how, well, un- educated today's intellectuals are. It's a failure of imagination, really - a failure to recognize that previous generations were just as clever, or beautiful, as ours.

Miss Martha Dana was a hottie. The future Mrs. William R. Mercer was painted by Anders Zorn in 1899, when she was 27. Understandably attached to the painting, she bequeathed it to the Boston Museum of Fine Arts, where I snapped it's picture with my iPhone.

Hawt.

People don't think about this, that previous generations weren't different from us at all. Sure, we have Quantum Theory and iPhones, but is it safe to assume - as most of today's intellectuals routinely do - that we think differently? That we see the world in deeper shades of color than they did?

More importantly, is it safe to assume that we're making new mistakes, rather than old mistakes?

La Gabelle was the most hated tax in France - indeed, it was so hated that it was one of the reasons that King Louis was not just shuffled aside into a Constitutional Monarchy role, but had some Quality Time with Madame Guillotine. You could call the tax a mistake.

So what was it about la Gabelle that made it so despised? After all, it was just a tax (in this case, a tax on salt). You don't like the tax, don't buy so much salt. Ah, there's the rub.

You had to buy the salt. By law, everyone ten years old or older had to buy salt, at a price set by the Crown. More infuriating, different parts of the realm paid different tax - favored regions got a break. Naturally, this led to a thriving smuggling trade, with increasingly draconian penalties as time went on. In the end, the cash was too important to the financially-strapped Ancien Regime to allow for reform, and the whole system collapsed.

Today's intellectuals (on the left side of the aisle) either don't know this, or have forgotten this. Most likely, they would think it's irrelevant, since they're Ever So Much More Clever Than Previous Generations.

And so the Senate just passed a Gabelle.

Soon, you will be forced by law to buy something (health insurance). Because people will naturally want to buy less of it, you'll have to buy as much as the government says, at a price set by them. Not everyone will have to pay the same - favorites of the Regime (the unions, in this case, but expect this list to be ever expanding) will get special deals. Regional differences will exist, but won't effect the price due to government prohibitions (ban on interstate insurance sales). As the New Deal and Great Society programs hit the budget in full fiscal force, the cash will be too important to the government to allow for needed reforms.

The analogy is (as all analogies are) imprecise, but what is fascinating is just how similar Obamacare is to la Gabelle. The Intellectuals don't get this.

They also don't get just how unpopular this will be. They're patting themselves on the back, and congratulating themselves on being on The Right Side Of History. That lack of intellectual awareness is also fascinating.

Things are fixin' to get, err, hot around here, toute suite.

Pygmalion didn't have to deal with this

When animations go bad.

It wasn't an "Intelligence" or "Security" failure

All weekend long, there's been a ton of stuff in print, on TV, and all through the Blogosphere about the terror attack on the Northwest flight from Amsterdam to Detroit. In many of these, it's being labeled an "Intelligence failure", or a "Failure of airline security". All this misses the point.

Which is Intelligence and airline security are bound to fail. Intelligence is - and will always be - imperfect in collection, and subject to poisoning by the adversary. Air travel is a porous target - repeated "penetration tests" show a 100% success rate in compromising the system. Look, any system that has to move several hundred million passengers a year is by necessity going to have all sorts of failure points.

Could the international Intel agencies have done better? Sure. Could TSA improve security and lessen hassles? Sure. Can either move the failure rate down significantly? I don't think so.

As long as you play defense, you're going to lose. If your adversary is clever, and patient, and well funded, he'll get you. He can study your defenses, pick a vulnerable target, and plan an attack to bypass your counter measures. In the long run, he'll win.

It will be a long, long time before the Intel archives of the last decade are declassified. In the cold light of day, it will be clear that a lot of the "thwarted" terror attacks were nothing of the sort. What will be clear is that Bush's decision to go on the attack - to take the battle to the Arab heartland where Al Qaeda had to respond, or lose relevancy to its intended supporters - was the decisive moment. Bush didn't "take his eye off the ball" by going to Iraq, he forced Al Qaeda to fight our battle, rather than them forcing us to fight theirs. Their resources went to operations other than attacking airliners.

It remains to be seen whether the Democrat's desire to withdraw from Bush's aggressive overseas engagements will put us on the defensive; certainly they want us on the defensive. I fear that Al Qaeda has been hurt, but not fatally.

Defense always loses in the long run. If we play defense, it's not a question of "if" - only "when" and "how".

UPDATE 28 December 2009 11:07: Unbeknownst to most people, there exists a set of immutable Laws of Security. Marcus Ranum described the first - and greatest - of these. Sometimes it's easier to not do something stupid than it is to do something smart. The TSA is fixin' to destroy that village air travel market in order to save it.

Don't let the cat out of the bag

The bag is barely holding all the cuteness as it is.

Boris and Natasha, 1989.

Munich Airport

Hasn't looked this good since December, 1996.


The bottle you see in the foreground was #2 Son's. I'm getting good results scanning photos at 120 dpi. Enough resolution to get decent pictures, but not so much that every bit of lint on the scanner bed is obvious.

You can't get there from here

Well, you can, but it's complicated.


The Cotswolds, autumn 1996. Photo taken with Pentax K1000.

Two thirds of USA gets a White Christmas

First ever blizzard in west Texas.

Europe hammered by snow; many dead.

Stranded London rail passengers rescued by Steam Train. The electric trains couldn't get through, since the blizzard took out the power lines.

Yes, yes. This is weather, not climate. You do know the difference, don't you?

Weather - a localized condition, unrelated to global climate change.

Climate - anything that proves Global Warming.

Via Watts Up With That. Picture via Theo Spark.

Bumper cars at the Mall

I love the bumper sticker.

Via Grouchy Old Cripple.