Curmudgeons of the World, unite!

First, kill all the philosophers

Heh:

A runaway trolley is about to kill philosophy professors who invent trolley problems. Will you divert it? pic.twitter.com/mlfi0mydlZ

— Peter Krantz (@peterkz_swe) August 14, 2016

But not Aretae, who's a good guy (even if he is a philosopher).  And not the Bad Ass Philosophers.

The definition of passive-aggressive

Quote of the Day - End of the Republic edition

The Roman Republic fell, not because of the ambition of Caesar or Augustus, but because it had already long ceased to be in any real sense a republic at all,” he said. “When the sturdy Roman plebian, who lived by his own labor, who voted without reward according to his own convictions, and who with his fellows joined in war the terrible Roman legion, had been changed into an idle creature who craved nothing in life save the gratification of a thirst for vapid excitement, who was fed by the state, and who directly or indirectly sold his vote to the highest bidder, then the end of the republic was at hand, and nothing could save it. The laws were the same as they had been, but the people behind the laws had changed, and so the laws counted for nothing

 - Theodore Roosevelt

NSA hack: probably real. NSA had a mole.

Most likely a government.  Russia tops the list, but China is a suspect, too.  Certainly the text reads like it was written by Chinese-as-a-first-language person (for whatever that's worth).  This is the most interesting bit:

This just isn't something that can be faked in this way. (Good proof would be for The Intercept to run the code names in the new leak against their database, and confirm that some of the previously unpublished ones are legitimate.) 

This is definitely not Snowden stuff. This isn't the sort of data he took, and the release mechanism is not one that any of the reporters with access to the material would use. This is someone else, probably an outsider...probably a government. 

... 

Okay, so let's think about the game theory here. Some group stole all of this data in 2013 and kept it secret for three years. Now they want the world to know it was stolen. Which governments might behave this way? The obvious list is short: China and Russia. Were I betting, I would bet Russia, and that it's a signal to the Obama Administration: "Before you even think of sanctioning us for the DNC hack, know where we've been and what we can do to you." 

They claim to be auctioning off the rest of the data to the highest bidder. I think that's PR nonsense. More likely, that second file is random nonsense, and this is all we're going to get. It's a lot, though. Yesterday was a very bad day for the NSA.

I haven't looked at the stuff and have no intent to do so.  However, people whose opinion I respect are.  I find the file timestamps to be very interesting, and in fact is evidence that Snowden was not working for the Russians (but rather was a whistleblower, as he claims).  It looks like the Russians had a mole in NSA while Snowden was there, and their mole had to scramble to gather up what data he had after Snowden went public and NSA security got dialed up to 11.

ObDisclaimer: I worked at NSA for a few years starting in the mid 1980s, doing (defensive, not offensive) computer security.

The Tomb of Scipio

Image from Archeology News Network

Scipio Africanus was one of Rome's greatest soldiers, beating the great Hannibal himself in a stand up, toe-to-toe slug fest at Zama, ending a half century of Superpower war in the ancient world.

Even more, he was an honorable man, gracious to his foes.  For many years he tried even to protect Hannibal from a blood thirsty Roman Senate eager for vengeance.  When his troops captured the fiancee of a Nubian war chief, he had her restored to him, her (and his) honor intact.

Naturally, he had a legion of enemies in Rome.  Disgusted with the degenerate and vicious politics of his day, he left Rome for good.  His family tomb is shown here, but his own is a bit of a mystery - it is said that he asked that his be inscribed with his own epitaph:

Ingrata patria, ne ossa quidem habebis. (Ungrateful fatherland, you will not even have my bones).

He was followed by a viper's nest, one that ultimately broke the Republic through increasingly divided and violent political division.  It got so bad that 150 years after his death, a grateful Rome welcomed Augustus as Imperator simply because it meant the end of the incessant blood letting.

An honorable - if flawed - man, followed by the contemptible.

Comrade Misfit looks on the corruption in which this Republic finds itself mired.  It feels like an "end of the Roman Republic" time.  Sophisticates can compete to show their, well, sophistication in comparing various recent Presidents to Scipio (flawed but honorable men), and the current crop of rogues to those who followed Scipio - each competing for most corrupt, venal, and destructive to the res publica.

"I hung around with hackers for a week ..."

"... and now I'm completely paranoid."

Good introduction to security from someone who pretty clearly hasn't thought much about it before.

Did the NSA get hacked?

Rick emails to point out something pretty interesting:

(NEWSER) – An apparent hacking group calling itself the "Shadow Brokers" claims to have hacked the NSA and is asking for about $570 million to share the data. Two sets of files were posted online Saturday—one open, the other encrypted—which the group claims are from the Equation Group, an advanced group of hackers believed to be working with US intelligence. The open files contain "a series of tools for penetrating network gear made by Cisco, Juniper, and other major firms," along with code words found in documents leaked by Edward Snowden, reports Foreign Policy. They are "most likely … part of the NSA toolset," an expert tells Ars Technica. But the encrypted files are "the best files," says the Shadow Brokers, which is asking for 1 million Bitcoin, currently worth about $570 million, to release them.

I have no idea whether this is legit or not, but know people who are in the "cyber weapon" business.  The encrypted file is interesting - typically the most damaging information would go there along with an automated "dead man's switch" that would release the encryption key.  If the Feds put the snatch on the perps, the information could be disclosed anyway.

Should NSA disclose Zero Day security bugs

Interesting analysis says "no":

The point is that no sane person can argue that it's worth it for the government to spend $1 million per iOS 0day in order to disclose/fix. If it were in the national interest, we'd already have federal bug bounties of that order, for all sorts of products. Long before the EFF argues that it's in the national interest that purchased bugs should be disclosed rather than exploited, the EFF needs to first show that it's in the national interest to have a federal bug bounty program at all.

Conversely, it's insane to argue it's not worth $1 million to hack into terrorist iPhones. Assuming the rumors are true, the NSA has been incredibly effective at disrupting terrorist networks, reducing the collateral damage of drone strikes and such. Seriously, I know lots of people in government, and they have stories. Even if you discount the value of taking out terrorists, 0days have been hugely effective at preventing "collateral damage" -- i.e. the deaths of innocents.

iOS "Day Zero" bugs (ones where there is no patch to protect the target) sell for around a million dollars.  Less for Windows, maybe the same for Android.  There could be a billion dollars a year in this sort of bug bounty program.  So it is doable - pricy, but probably not in the grand scheme of NSA's budget.

Or you can use them to attack high value targets.

The worry, of course, is whether you can trust NSA to attack legitimate targets and not everybody else.  The author shares those concerns:

The NSA/DoD/FBI buying and using 0days is here to stay. Nothing the EFF does or says will ever change that. Given this constant, the only question is how We The People get more visibility into what's going on, that our representative get more oversight, that the courts have clearer and more consistent rules. I'm the first to stand up and express my worry that the NSA might unleash a worm that takes down the Internet, or the FBI secretly hacks into my home devices. Policy makers need to address these issues, not the nonsense issues promoted by the EFF.

The EFF is, of course, the Electronic Frontier Foundation.  This is pretty interesting stuff, so if you're a security nerd you should RTWT.

Automotive software: unsafe at any speed

The problem isn't that there's software bugs.  The problem is an engineering culture that ensures that security problems are designed in and not fixed:

One of every five software vulnerabilities discovered in vehicles in the last three years are rated “critical” and are unlikely to be resolved through after the fact security fixes, according to an analysis by the firm IOActive.

“These are the high priority ‘hair on fire’ vulnerabilities that are easily discovered and exploited and can cause major impacts to the system or component,” the firm said in its report, which it released last week. The report was based on an analysis of more than 150 vehicle security flaws identified over three years by IOActive or publicly disclosed by way of third-party firms.

Where do all these "hair on fire" vulnerabilities come from?

The bulk of vulnerabilities that were identified stemmed from a failure by automakers and suppliers to follow security best practices including designing in security or applying secure development lifecycle (SDL) practices to software creation. “These are all great things that the software industry learned as it has progressed in the last 20 years. But (automakers) are not doing them.”

So the auto makers have basically ignored what the rest of the world has learned over the last two decades.  Got it.

The result is that vehicle cybersecurity vulnerabilities are not solvable using “bolt-on” solutions, IOActive concluded. That is because they are caused by flawed engineering assumptions or insecure development best practices. “The most effective cybersecurity work occurs during the planning, design and early implementation phases of products, with the difficulty and cost of remediation increasing in correlation with product age and complexity,” IOActive’s report notes.

Err, so the auto makers have basically ignored what the rest of the world has learned over the last two decades ...

Still, auto firms remain wary of information security firms and wedded to the notion that keeping the details of their systems secret will ensure security (aka “security through obscurity”).

“Their general attitude is that they don’t want to  engage researchers or share their ‘secret sauce,'” Thuen said. “The attitude is anti-security in general. It’s the Ostrich approach – we’re going to stick our head in the sand and say that we can’t hear you, or that everthing you’re saying isn’t important.”

What could possibly go wrong?  Oh yeah, problems not fixable once you release ...

Resistance to the attentions of security researchers is rooted in an engineering culture that looks on software vulnerabilities as shameful – far different from software-based engineering that generally accepts vulnerabilities as an inevitable byproduct of writing code. “It’s not shameful to have vulnerabilities. What is shameful is to have them and not move forward to fixing them,” he said.

So failure is inevitable.  I cannot say more strongly that I will not buy any "connected" car, ever.  And I will not ride in a self-driving car, ever.  There are too may ways that this breaks and the culture that builds them simply doesn't care.

Hackers say: vote early, vote often

Electronic voting machines hacked in public demo.  Candy, babies:

But for the hackers at Symantec Security Response, Election Day results could be manipulated by an affordable device you can find online.

"I can insert it, and then it resets the card, and now I'm able to vote again," said Brian Varner, a principle researcher at Symantec, demonstrating the device.

And you can hack them after voting is done, remotely.  Communications isn't encrypted, presumably because the people who designed the systems were n00bs.  And there's likely no way to tell that the system was hacked:

CBS News learned that only 60 percent of states routinely conduct audits post-election by checking paper trails. But not all states even have paper records, like in some parts of swing states Virginia and Pennsylvania, which experts say could be devastating.

Confidence is not high in the integrity of our political system.

U.S. Military Officer Corps is worse than useless

Fundamentally transformed:

Four U.S. military officials told me that the 300 or so U.S. special operators in Syria are under very strict rules of engagement. Because such rules are highly classified, these sources have requested anonymity.

But the rules in place, known as "last cover and concealment," are highly restrictive compared to special operations missions in the war on terror before 2014. Those rules of engagement allowed for U.S. special operators to fight alongside the local forces they trained. The rules of engagement for Syria, according to one military officer, amount to: "don't get shot."

The Queen Of The World saw red when she read this in the Sunday paper.  I can't blame her.  What use is an Officer Corps that isn't interested in winning wars, or protecting their most valuable assets?

Sir Arthur Sullivan - The Lost Chord

Everyone has heard of Gilbert and Sullivan and their comedic operettas.  However, Arthur Sullivan was a successful composer in his own right, and indeed it was his independent compositions that won him his knighthood from Queen Victoria.

In 1877, Sullivan's brother Fred was on his death bed.  Sullivan composed this music while sitting at Fred's bedside, using the poem "A Lost Chord" by Adelaide Anne Proctor.  It became wildly popular, perhaps his most famous work outside of his operettas.  Thomas Edison recorded this on his new fangled phonograph on this day in 1888, one of the first musical recordings ever made.  Jimmy Durante recorded a song "I'm The Guy Who Found The Lost Chord" which inspired The Moody Blues to write "In Search Of The Lost Chord".

Jolly good Pith Helmet, Old Boy

The big wheel race at Frederick's BestFest.



Wonder if RobertaX is here ...

Festival time

The Queen Of The World and I are off to nearby Frederick's BestFest.  Live music along the canal, a biergarten tent, street vendors.  It's not just festive, it's BestFestive.

The fly in the ointment?  The forecast is for 96°.  Oof.

Oh, well.  Just because it's hot doesn't mean it can't be fun.

Quote of the Day - Political Correctness edition

Yeah, I know I've already done one today.  Samizdata recalls George Carlin's epic description of this scourge:

Political correctness is fascism pretending to be manners

– George Carlin

Do you have data on your computer that you care about?

No?  You can stop reading.  Everyone else needs to go here.

History repeats itself because nobody listens the first time.

Quote of the Day - Both parties stink edition

Michael Bane echoes my "a pox on both your houses" attitude:

I despise the Democratic Party for pretending they are not the Socialist Workers Party of America, and I despise the Republicans for their gutlessness and their willingness to throw us all under the bus to protect their dacha by the lake.

Amen.

Another passes

Yesterday saw the sendoff of another of the generation who saved the world.  Via Patriot Guard Riders:

Lt. Col. James D. Hammond, Jr. USMC(ret), WWII/Korea, Canton, GA 11 Aug 16

The family of Lt. Col. James D. Hammond, Jr. has requested the Patriot Guard to honor their loved one and our hero.  It is our honor to do so.  We will stand a flag line at Georgia National Cemetery for his interment service.

Lt. Col. Hammond graduated from George Washington High School and attended Virginia Military Institute.  He served in the Marine Corps during WWII with the 2^nd Marines and was part of the Saipan, Tinian, and Okinawa campaigns.  Lt. Col. Hammond served at Chosin Reservoir with Dog Company, 2^nd Bn, 7^th Marines, 1^st Marine Division in Korea.  He retired from active duty in 1965 and from the Marine Corps reserves in 1983.

Lt. Col. Hammond earned two National Defense Service Medals, a United States Service Medal, a Korean Defense Medal with 3 bronze stars, and a Korean Presidential Unit Citation.

Saipan, Tinian, Okinawa, Chosin.  There's an honor roll for you.  Rest in peace, sir.  And may flights of Angels sing thee to thy rest.

Professional Video Gamers

While #1 Son and #2 Son were here, they told me about the DOTA 2 International game championship currently under way.  Teams of gamers face off, for a share of a $20 Million prize pool.  Last year's winning team scored a cool $6M, out of an $18M pool.

[blink] [blink]

They sell out stadiums.  This was last year, with a capacity crowd at Seattle's Key Arena.

[blink] [blink]

I really don't know what to say.  The World is a stranger place than we can imagine.