Good thing there's a "Living Wage"

Those Progressives and their $15/hour minimum wage.  All those waiters who saw their hours go to zero must be so grateful.

Seen at the bar at the airport last night.

Dale Ann Bradley - Run Rufus Run

Bluegrass is perhaps the soul of American music.  It certainly is as close to the original, ur-music of this land.  Here's one about leaving the coal mine to take up whiskey running. 

A moment of Zen

A haiku:

Repeat after me:
It is always a good flight
When you're going home.

Although it will be strange - #1 Son moved out while I was gone.  I seem to be shedding family as I age.

Good thing I'm aging gracefully.  /sarc

Maybe this "War On Drugs" is easier than I thought

Glad that's all wrapped up, then.

Microsoft security updates violate your privacy

Carl emails to point out some posts he's put up on his blog about security.  Now I've repeatedly advised readers to make sure that they have Windows automatic updates turned on, because Windows has a pretty bad security track record and this is an easy way for people to do something that helps out their security.

Except maybe Microsoft is abusing that trust:

I would hope all Windows users are aware of the deliberate snooping built directly intoWindows 10, and know not to “upgrade” to it. If not, the short form is that MicroNSA believes so strongly in the future of “cloud computing” that it’s going to make Win10 users do it whether they like it or not.

That’s bad.

Worse: It now appears that wasn’t good enough for the NSA’s corporate buttbuddy. They’re pushing a set of updates to Win7 and Win8 that implement some of the same file, email, browsing, and search data snooping to be found in 10.

If you must run Windows, do not upgrade to Windows 10. If you are running 7 or 8, turn off Automatic Updates immediately. Check your system (Control Panel=>Windows Updates=>View Update History) for the following updates:

• KB3068708
• KB3022345
• KB3075249
• KB3080149

Disable them.

If you aren’t on automatic, check the list of “Updates to install.” If you see them there, right-click on them and “Hide Update.”

These "security" updates are the ones that collect your browsing and usage history and send it to the Borg cloud.  This is a terrible, no good, very bad thing for a security tool to do.  And quite frankly, this is something that security guys have discussed for years, going all the way back to Ken Thompson's Turning Award speech Reflections On Trusting Trust.  For a Turning Award lecture, it's pretty accessible even to lay persons - just skip over the code bits to this part:

The actual bug I planted in the compiler would match code in the UNIX "login" command. The replacement code would miscompile the login command so that it would accept either the intended encrypted password or a particular known password. Thus if this code were installed in binary and the binary were used to compile the login command, I could log into that system as any user. 

It's an undetectable security backdoor introduced from a trusted source - trusted source code, in Thompson's thought experiment.  Microsoft has done something very like this.  "Trust us," they said. "We will keep you secure if you just turn on automatic updates."  And then that trusted channel becomes the means that your privacy is raped and pillaged to fatten their bottom line.

At this point it's clear that most people simply will not be able to keep their Windows computer secure.  People like Carl and myself certainly can, although it looks like we both run Linux Mint (and you should, too).  But people who aren't computer security nerds simply won't have the background to examine every single Microsoft security update and make a rational decision about the risks of installing it vs. the risks of not installing it.

Bottom line: as a security professional I cannot recommend that anyone should run Windows if they care about their security and privacy.  Trust can no longer be trusted, at least from Microsoft.  If there are certain Windows applications that you absolutely cannot live without, then keep a dual-boot system where you can boot up Windows for those times you absolutely need that app, but only run that app.  The rest of the time, run Linux, which won't sell out your privacy to fatten its bottom line.  It will never do that, because Open Source has no bottom line.

And you should read Carl's blog, which has a regular menu of techie geekdom, libertarian rants, and that sort of thing.  Plus humor like 50 Nerds of Grey.  Snerk.

Cargo Cut University

Hey, Wheetabix started blogging and didn't tell me.  He has a great post up about the return on investment from college:

Economics 101 discusses supply and demand.  The more you have of something, the less valuable it is.  Think how much you value packing peanuts and plastic grocery bags.  In my 20's, everyone had a high school degree.  The only people who ever wanted proof were the people in the admissions offices of the colleges I applied to.  It had almost no value to anyone else.  The same thing has now happened to college degrees.

High school teachers began to value education over the ability to make a living.  Colleges had a vested interest in increasing attendance.  Government got into the lucrative student loan game.  And education became a product instead of a path.  "A mind is a terrible thing to waste" sounds inspirational, but "be cool, stay in school" is more honest.  What it means now is "we won't let you work, and we have to store you somewhere."

Pretty smart there about more of something drives down its cost.  The only thing I would add is that there is more than  little whiff of cargo cult thinking here - in the 1960s and 1970s college graduates generally made good money.  So let's make more college grads out of whatever is at hand.  The cargo cuts  wanted the GIs to come back with all their stuff so they made GI stuff out of whatever was at hand.

Oh well, I'm sure this will work out fine for the colleges when they just tune their bamboo radios to the right frequency ...

Friends don't let friends upgrade to Windows 10

Seriously, they don't.

Is this the end of the Evil Black Rifle?

Marine Corps to modernize small arms, adding silencers to rifles among other things:

The Marine Corps’ Small Arms Modernization Strategyincludes some long-overdue elements: 

The Corps is considering allowing camouflage painted rifles for every Marine and suppressors for rifle squads, Woodburn said. It’s part of an effort to help Marines blend into their surroundings and communicate better.

My guess is that haters still gonna hate.

Thank you, Yogi. For the laughs, but more importantly for the baseball.

You weren't just great, you always made me laugh.

I'm a Boston Red Sox fan, forever and ever, Amen.  But bless me Father, for I have sinned.  I have been hard hearted .against New York players - despite your admonition to render unto Caesar, etc.  Yogi deserved - and I hope got - better.  Younger generations remember the jokes: Baseball is 90 percent mental and the other half is physical.  But the young punks don't realize that he may have been the greatest catcher of all time.

While perhaps not as much as Ted Williams, Yogi gave up good years for his country.  The 19 year old Berra found himself off Normandy on D-Day on the U.S.S. Bayfield.   Unlike Williams, Yogi didn't lose the best years of his hall of fame career.  But a hall of fame career it was:

[He] established Series records for the most [post season] games (75), at-bats (259), hits (71), doubles (10), singles (49), games caught (63), and catcher putouts (457). In Game 3 of the 1947 World Series, Berra hit the first pinch-hit home run in World Series history, off Brooklyn Dodgers pitcher Ralph Branca (who later gave up Bobby Thomson's famous Shot Heard 'Round the World in 1951).

Berra was an All-Star for 15 seasons, and was selected to 18 All-Star Games (MLB held two All-Star Games in 1959 through 1962). He won the American League (AL) MVP award in 1951, 1954, and 1955; Berra never finished lower than fourth in the MVP voting from 1950 to 1957. He received MVP votes in fifteen consecutive seasons, tied with Barry Bonds and second only to Hank Aaron's nineteen straight seasons with MVP support. From 1949 to 1955, on a team filled with stars such as Mickey Mantle and Joe DiMaggio, it was Berra who led the Yankees in RBI for seven consecutive seasons.

One of the most notable days of Berra's playing career came when he caught Don Larsen's perfect game in the 1956 World Series, the first of only two no-hitters ever thrown in postseason play.

But did I say laugh?  I'm not making this up.



Good night, sweet Prince.  And may flights of Angels sing thee to thy rest.  I hope St. Peter has tears of laughter running down his face.

The Lord broke the mould with him.

How do you know that it's time to update Adobe Flash?

Because it's a day who's name ends in "day":

Adobe has released a critical software update to fix nearly two-dozen security holes in itsFlash Player browser plugin. Separately, I want to take a moment to encourage users who have Adobe Shockwave Player installed to finally junk this program; turns out Shockwave — which comes with its own version of Flash — is still many versions behind in bundling the latest Flash fixes.

If you use and need Flash Player, it’s time to update the program (the latest version is 19.0.0.185 for Windows and Mac users). Google Chrome and Internet Explorer bundle their own versions of Flash (also now at v. 19.0.0.185); each should auto-update to the latest. Find out if you have Flash installed and its current version number by visiting this page.

Flash, of course, if the software that makes Internet video work, so basically all y'all are running it.  Scamper off to the Adobe link and get you some security goodness.

And if you're running Shockwave, you really should stop.  It's a sucking chest wound of security fail.

R.I.P. Jimmy Olsen

Actor Jack Larson who played that role on the TV show "Adventures of Superman", dead at 87.

Poor Internet Explorer

The kids all make fun of him all the time ...

Actually, you could replace "Speed" with "Security" and it would be even funnier.

Hat tip: Burt, via email.

Any readers in the Washington DC/Rockville area?

Leave a comment if you want to get together. I'm in town until Friday.

An unhackable computer?

Bluesun emails to point out this development:

The software that kept the helicopter’s computer secure was at the heart of its operating system, and it could be just what the world needs to make everything from pacemakers to insulin pumps and power stationsto cars immune to hacking.

“My hope is that in 10 years’ time, anything that is security critical is running on our system or some other one built on the principles we’ve established,” says Gernot Heiserfrom the newly formed Australian national research agency, Data61. One of its predecessors developed the crucial component of the “unhackable” operating system – its kernel.

...

Known as seL4, the kernel has a few highly secure properties: it can only do what it is designed to do; its code can’t be changed without permission; and its memory and data transfers can’t be read without permission. An earlier version of it, called OKL4, is now in millions of smartphones.

Heiser says that two features underpin seL4’s security, one of which is a new way of isolating data inside the kernel. But the key development was making the code capable of being checked mathematically. Other kernels might have these properties too, but it is impossible to know for sure without mathematical proof, says Heiser.

As devout Catholics say about miracles, that would be something.  Color me skeptical.

There has been a desire for provably secure operating systems for decades.  The first formalized efforts were captured in what was called the Orange Book, which defines what is required to do this.

The Orange Book pre-dates my 30+ career in computer security.  I've personally been involved in Orange Book evaluations of commercial products.  It was not a happy experience.  Lots of time spent, even more money spent, no return on the investment.

The problem is that what the security people want (security, duh) is not what the people budgeting for the computer want (functionality).  Sometimes the security people can impose standards that products have to meet (welcome to the Defense Department alphabet soup of FISMA, FEDRAMP, and JITC), but in the long run the security team will always lose the battle to the end users.

And this makes sense.  Just imagine if in 1950 the government established the Department of Computer Design, and all computers had to come from there.  Do you think you'd have an iPhone today?

And so my skepticism goes far beyond whether this truly is mathematically provably secure - I don't have the skills to really address that, although there's an old saying in cryptography that everyone knows enough to design a cipher that they can't crack (which doesn't mean that someone else can't).

My skepticism goes deeper - if this kernel is as secure as is claimed, then it can only be so because functionality is severely restricted.  If you restrict functionality, you make your end users very unhappy.  If some of these have stars on your uniform, you are unlikely in the extreme to be able to force them to use your system.

"My hope is that in 10 years’ time, anything that is security critical is running on our system or some other one built on the principles we’ve established"

Sorry, you don't get 10 years of reduced functionality - likely at significantly higher cost (those Computer Science PhDs don't pay for themselves).  Your users won't stand for it, or wait for you.

And so while an unhackable computer would be very nice indeed, this almost certainly isn't it.  Oh well, mustn't grumble - more work for Internet Security folks ...

Overheard

I read the recent poll on drug testing Congress and laughed.  The Queen Of The World asked what's up:

Me: New poll says that 78% of Americans want members of Congress to have to have random drug testing.

The Queen: Well, sure.  Who doesn't?

Me: Well, they pass all these drug laws.  Why shouldn't they have to pee in the cup?

The Queen: They should have to put their pee where their mouth is.

Me: Ewww.  Not saying that you're wrong, but ewww.

Heh.  You can have any sort of sense of humor that you want when you are Queen Of The World.

Giuseppe Matteo Alberti - Concerto for violin, strings & b c in G minor

Many people think that people in the past were less intelligent, or interesting than people today.  They clearly don't know about Giuseppe Matteo Alberti, a baroque Italian choirmaster who was married six times (!).

Ah, amore.

Sadly, the sum total about Signore Alberti's love life at il Wik is this:

He also was married six times.

His music was pure baroque.  If you like Vivaldi, you'll like this.

Louisiana's LeRoux - Take a Ride On a Riverboat

Library offers anonymous browsing software. Homeland Security objects.

Hilarity ensures:

In July, the Kilton Public Library in Lebanon, New Hampshire, was the first library in the country to become part of the anonymous Web surfing service Tor. The library allowed Tor users around the world to bounce their Internet traffic through the library, thus masking users’ locations.

Soon after state authorities received an email about it from an agent at the Department of Homeland Security.

“The Department of Homeland Security got in touch with our Police Department,” said Sean Fleming, the library director of the Lebanon Public Libraries.

After a meeting at which local police and city officials discussed how Tor could be exploited by criminals, the library pulled the plug on the project.

Funny, cars can be used by both honest citizens and criminals.  There's no word as to whether the motorpool also got a visit from Special Agent Friendly.

“Right now we’re on pause,” said Fleming. “We really weren’t anticipating that there would be any controversy at all.”

But word got out, and the community responded:

Update, Sept. 16, 2015: After this article was published, the library received overwhelming support from the community to restart its participation in the anonymous Web browsing project. The library board met Tuesday and decided to restart the effort.

Bravo to the good Burghers of Lebanon, NH for sticking up for privacy.

(via)

Where ASM826 gets his firewood

Long time readers will recall co-blogger posting about his wood stove that keeps his house warm in the winter.  But heating with wood is not for the faint of heart - it's a lot more expensive than you think.

Wanted: Groundskeeper for football stadium

Old groundskeeper couldn't tell the difference between fertilizer and weed killer.