A metaphor on Megyn Kelly's approach to Donald Trump

Chrysler gets sued for lousy security

Three weeks back we saw that late model Jeep Cherokee autos could be hacked remotely.  The shoe that we've been waiting to drop, has dropped:

LAST MONTH’S JEEP hacking scandal has already been followed by a 1.4 million vehicle recall and a well-timed Senate bill. Now Chrysler faces that other inevitable punishment: a potentially massive lawsuit.

On Tuesday three Jeep Cherokee owners filed a complaint against both Fiat Chrysler Automobiles and Harman International, the maker of the Uconnect dashboard computer in millions of Chrysler vehicles. A security flaw in that cellular-connected computer served as the entry point for security researchers Chris Valasek and Charlie Miller when they showed WIRED last month that they could wirelessly hack into a 2014 Jeep over the internet to hijack its steering, brakes and transmission. Now the small group of plaintiffs is hoping to invite anyone with those vulnerable Uconnect systems in their car or truck to join them in their litigation. If their complaint is certified by a court as a class action, the broad spectrum of affected Chrysler vehicles means it could snowball into a case with more than a million potential plaintiffs.

What damages are assessed when it's no longer possible to have confidence in the security and integrity of your car?  What are the damages if you always wonder if you're about to die when you start it up?

U.S. Government wins coveted "My Little Pwnie" award for best hack of the year

H4x0Rz R m4g1C

 And by "coveted", I mean "really, really wish this hadn't happened":

Black Hat 2015 For the past nine years Black Hat has staged its Pwnie Awards, devoted to recognizing the best and worst aspects of computer security, and this year's winner of the least welcome award is the US government's Office of Personnel Management.

The OPM won in the "Most EPIC Fail" category after hackers, possibly from the Chinese government, ransacked the agency's servers to steal confidential information on up to 21.5 million past and present government employees.

"The OPM let you and everyone else down. So much so, that the USA government might actually be pulling covert agents out of foreign countries. USA #1," noted the panel of judges.

The hack caused the resignation of the OPM's head and a frantic effort by other government departments to get themselves protected. No one from the OPM was present to pick up their pony-shaped award.

Let's just let that run over the tongue, shall we?  No one from the OPM was present to pick up their pony-shaped award.

Lulz.

Epic, epic fail, and recognized as such.

Ah, the joys of getting the kids to clean up so I can sell the house

Going pretty well.

Yeah.  Going really well.

Lies the gun banners tell

Refuted by facts CrimeThink™

• Banning guns would not reduce murder and suicide
• No rise in mass shootings
• Gun Homicide Rate Down 49% Since 1993 Peak; Public Unaware

There are a bunch more.  Go and bookmark this one.

(via)

Keynesian Economics, explained

A parable:

Krugman and Bernanke are walking down the street and see a pile of dog s***. Bernanke says “I’ll give you twenty thousand dollars to eat that pile of s***.” Krugman does it, gets paid, and they keep walking. After a while they see another pile of s*** on the road. Seeing an opportunity for revenge, Krugman says “Tell you what, I’ll give YOU twenty grand to eat that pile of s***.”

Click through for the hilarious ending.  And it's 100% true, which makes it even better.

Why yes, I am getting more exercise lately

Samsung and HTC phone users: do NOT enable the fingerprint option

The phone doesn't protect your fingerprint data:

Four FireEye researchers have found a way to steal fingerprints from Android phones packing biometric sensors such as the Samsung Galaxy S5 and the HTC One Max.

Oh, Come on I hear you say.  This is a Security feature, I hear you say.  Just how bad can it be?

The team found a forehead-slapping flaw in HTC One Max in which fingerprints are stored as an image file (dbgraw.bmp) in a open "world readable" folder.

"Any unprivileged processes or apps can steal user’s fingerprints by reading this file," the team says, adding that the images can be made into clear prints by adding some padding.

Well there's your problem, right there ...

$5 gets you $10 that it's not just Samsung and HTC.  My advice is to turn off the damn fingerprint recognition and browse through the file system, deleting any .BMP files that look like biometrics.  And maybe run the phone through an industrial shredder ...

I went shooting on my birthday

I realized that I hadn't been shooting yet not just this year, but all of last year, either (!).  I've been making Baby Vulcan cry.

And so off I went.  Noise was made.  Holes were punched in paper.  I was both pleased at my marksmanship and disgusted at my marksmanship.  All in all, a normal range trip.

Somehow, I find that strangely reassuring.

New web browser privacy add-on

Privacy Badger is an add-on for the Firefox and Chrome browsers that will thwart a lot of online tracking that marketroids do:

EFF is excited to announce that today we are releasing version 1.0 of Privacy Badger for Chrome and Firefox.  Privacy Badger is a browser extension that automatically blocks hidden trackers that would otherwise spy on your browsing habits as you surf the Web.

...

As you browse the Web, Privacy Badger looks at any third party domains that are loaded on a given site and determines whether or not they appear to be tracking you (e.g. by setting cookies that could be used for tracking, or fingerprinting your browser). If the same third party domain appears to be tracking you on three or more different websites, Privacy Badger will conclude that the third party domain is a tracker and block future connections to it.

For certain websites, if Privacy Badger were to block an embedded domain entirely it would break the site's core functionality. For example, if Privacy Badger were to block 'licensebuttons.net,' Creative Commons buttons would no longer load. In these cases Privacy Badger blocks the domain from setting or receiving any cookies or 'referer' headers, but allows the embedded content to load.

Pretty neat.  I like the Electronic Frontier Foundation guys.  Recommended.

A birthday grumble.

It's my birthday.  Yay. /sarcasm

Damn.  Need a bigger cake.

My present is to work on fixing up Camp Borepatch to sell it.  Yay. /sarcasm

The older I grow, the more I distrust the familiar doctrine that age brings wisdom.

- H. L. Mencken

Friday Motor Madness - BMW Z1

This is the first of a new series of posts, highlighting oddball, unusual, and cool cars.  In this post, we go back to the future with the first car in BMW's Z line of roadsters.  It had so many unusual features that it led to the Z moniker itself, for Zukunft - "future".

Picture via Topspeed.com

Introduced at the 1987 Frankfurt Motor Show, the Z1's retractable doors and removable thermoplastic body panels made it the sensation of the show.  BMW quickly received 5,000 orders before manufacturing even began.

Picture via Topspeed.com

The panels contributed nothing to the car's structural integrity, and were explicitly designed to be removable and swappable.  BMW encouraged customers to purchase a second set of panels in a different color, letting them change their car themselves.  BMW's claim that the swap would only take 40 minutes was considered to be rather a joke (if you weren't a Bavarian mechanic).

Alas, only 8,000 were built.  The Z1 used a stock 2.5L engine (from the 325 series) and the 9 second 0-60 made this somewhat less than the ultimate driving machine.  Only built between 1989 and 1991, they are quite rare and prices are correspondingly high.  While this isn't by any means a performance car, it's terribly quirky - it's as close as BMW ever came to the Jeep Wrangler's removable doors.  In Europe it's legal to drive with the doors retracted (it seems that it's not legal to do this here in the USA).

If you're interested in this unique motor, I recommend you click through to the excellent article at Topspeed.com.

More on shooting down drones

I am not a lawyer, but some lawyers (well, law professors) are looking at this and think that it may be justified:

Robots can pose-or can appear to pose-a threat to life, property, and privacy. May a landowner legally shoot down a trespassing drone? Can she hold a trespassing autonomous car as security against damage done or further torts? Is the fear that a drone may be operated by a paparazzo or a peeping Tom sufficient grounds to disable or interfere with it? How hard may you shove if the office robot rolls over your foot? This paper addresses all those issues and one more: what rules and standards we could put into place to make the resolution of those questions easier and fairer to all concerned.

The default common-law legal rules governing each of these perceived threats are somewhat different, although reasonableness always plays an important role in defining legal rights and options. In certain cases - drone overflights, autonomous cars, national, state, and even local regulation - may trump the common law. Because it is in most cases obvious that humans can use force to protect themselves against actual physical attack, the paper concentrates on the more interesting cases of (1) robot (and especially drone) trespass and (2) responses to perceived threats other than physical attack by robots notably the risk that the robot (or drone) may be spying - perceptions which may not always be justified, but which sometimes may nonetheless be considered reasonable in law.

We argue that the scope of permissible self-help in defending one's privacy should be quite broad. There is exigency in that resort to legally administered remedies would be impracticable; and worse, the harm caused by a drone that escapes with intrusive recordings can be substantial and hard to remedy after the fact. Further, it is common for new technology to be seen as risky and dangerous, and until proven otherwise drones are no exception. At least initially, violent self-help will seem, and often may be, reasonable even when the privacy threat is not great - or even extant

And it's not just the profs saying this.  Homeland Security says it, too:

The US Department of Homeland Security issued an intelligence assessment to law enforcement agencies Friday warning that recreational drones "could be used by adversaries" to attack the United States.

...

The report added that drones "could be used by adversaries to leverage UAS as part of an attack" and that an "emerging adversary use of Unmanned Aircraft Systems present detection and disruption challenges."

Best to shoot it, just to be sure.  And remember to double tap.

New email attack in progress

OldNFO emails with breaking news:

I want to bring your attention to a potentially dangerous phishing email that contains a malicious link.  If you received any email from any of these email addresses: 

USAA.WEB.Acces.Activity@usaa.com

USAA.WEB.restricted@usaa.com

USAA.WEB.SECURE.Customer@usaa.com   

And the Subject Line is:  "Your USAA Account Computer/Device Preferences Notification." 

DO NOT OPEN the email.  DELETE THE EMAIL IMMEDIATELY.  Then DELETE the email from your Deleted Items folder.  The email contains a malicious link that can attack email and other Information Technology systems.

I have been getting email saying that I have a voice mail message.  I don't use the app that the email claims to represent.  If you get emails from what look like companies you don't use, they are almost certainly attacks.  If you get "security" emails from companies that you do financial business with, they are almost certainly attacks.

HAHAHAHAHAHA!

[gasp] [gasp] [gasp]

HAHAHAHAHAHA!

But this time, we'll vote ourselves out of this mess.  There will be the Leader on the White Horse to save us!  A Leader funded by the same Oligarchy, no matter which party [*cough* *cough* BUSH] [*cough* *cough* CLINTON] that Leader represents.

But relax, Citizen.  All is well.  The circus is amusing and the bread is free.  And the chocolate ration has been increased from 3 ounces to 2½ ounces ...

A parable on Obamacare

 

Here endeth the lesson.

More on Windows 10 and privacy

As a follow up to yesterday's post, here is an excellent, detailed walk through of what you should think about turning off when you install or upgrade to Windows 10.

Also, you will want to go to Microsoft's opt-out web page to get rid of targeted ads.

What will Obama's climate policy do to your electricity rates?

Quadruple them.  How do we know?  Because he said he wants the USA to get 28% of its electricity from renewables (vs. the current 4%)*.  There are multiple countries in Europe who get 30% of their electricity from renewables.  Guess what their electricity costs (and no fair peeking at the title of this blog post).

* The plan seems to exclude hydro power, which provides some more of our electricity.

Windows 10 doesn't have spyware

It is spyware:

I really want to upgrade to Windows 10, but have begun seeing stories come out about the new Terms and how they affect your privacy. It looks like the default Windows 10 system puts copies of your data out on the "cloud", gives your passwords out, and targets advertising to you. The main reason I am looking to upgrade is that Bitlocker is not available on Windows 7 Pro, but is on Windows 10 Pro, and Microsoft no longer offers Anytime Upgrades to Windows 7 Ultimate. However, I don't want to give away my privacy for security. The other option is to wait until October to see what the Windows 10 Enterprise version offers, but it may not be available through retail. Are the privacy minded Slashdot readers not going with Windows 10?

It's a pretty reasonable thread at Slashdot - meaning nobody accuses Bill Gates of putting puppies in a blender.  But the default Windows 10 privacy settings are really, really bad.  Basically they're Google snooping on everything that you do, except that they make you pay for the privilege of using their OS.

This is a good article on all the things you need to do to turn this off.  It's unclear whether the monthly Windows Update security fixes will reset the privacy settings to the defaults; Windows 10 users will want to check this each month.  It's less unclear whether Microsoft will share your usage habits with NSA - of course they will.

Or you can just switch away from Windows.  Microsoft is clearly looking for other ways to milk its customer base, and this snoop-o-matic presumably is only the first of many initiatives from Redmond.  Here's a balanced video from a couple years back discussing the pros and cons of switching to Linux from Windows.  Me, I made the jump a long, long time ago and have never looked back.



No built-in spyware on Linux, and you don't have to keep checking to see if some security fix just stealth changed your settings.  If you surf the web, read email and RSS feeds, and do Office app work, Linux will be fine for you.  If you game, why don't you have a Playstation?

Seikilos epitaph - Music from Ancient Greece

The Death of Paulus Aemilius at Cannae by John Trumbull, 1773

Two great battles were fought on this this day in the ancient world.  In 338 B.C. Philip of Macedon crushed the Greek city states at Chaeronea, setting the stage for his son the Great Alexander to embark against the Persian himself.  A century later in 216 B.C. Hannibal won perhaps the greatest victory of all time, utterly destroying  the Consuls Lucius Aemilius Pallus and Gaius Terentius Varro - and their eight legions - at Cannae in the southern part of the Italian peninsula.

What both of these locations had in common was that they were Greek, and would have recognized this music.  The Seikilos epitaph is an inscription from a tombstone outside the ancient Greek city of Ephesus.  While it may be the oldest musical inscription for which we have both the musical score and the lyrics, this is not entirely clear.

What is clear is that this musical style would have been familiar to both Philip of Macedon and many of the combatants at Cannae.  The lyrics are an epitaph from a man named Seikilos to his wife Euterpe.  They translate roughly as:

While you live, shine
Don't suffer anything at all;
Life exists only a short while
And time demands its toll.

Good words to live by, infused with the still robust stoic philosophy so prevalent in the ancient Greek world.