Wednesday, October 25, 2017

Data, data - who's got the data?

Co-blogger and brother-from-another-mother ASM826 and I keep harping on how you should back up your data.  Like the saying goes about personal defense firearms, two is one and one is none.  More copies of your important data is better, because things go wrong sometimes.

So who do we know doesn't read this blog?  The New York Police Department:
A non-profit organization in NYC called Bronx Defenders wants to study the NYPD’s asset forfeiture records. They filed a request for this information (under New York’s Freedom of Information law) in 2014, and litigation is ongoing. 
The latest revelation? Not only is the NYPD saying they don’t have the technical capability to pull the data Bronx Defenders wants…
New York City is one power surge away from losing all of the data police have on millions of dollars in unclaimed forfeitures, a city attorney admitted to a flabbergasted judge on Tuesday.

Of course, it might be convenient for them to "lose" this data if a Court were to make them give it all back.


Tuesday, October 24, 2017

Salute!


Nicely done.

So what is Bitcoin, anyway?

Glen Filthie asked if I could do a post about crypto currencies - what's the big deal, and why does anyone care?  I'm not an expert, but here's a quick overview.

Why would anyone want a Cryptocurrency?

Most financial transactions are controlled by central banks like the Federal Reserve or Bank of England, etc.  Electronic transactions are done bank-to-bank through networks like the SWIFT network.  This is globally scalablable and very convenient, but is explicitly not anonymous - the central bank (i.e. the Government) knows where your money is going.

If you want anonymous financial transactions, you really need to use cash.  Credit cards (or ATM/Debit cards) transactions are all done through a centralized organization (your bank or MasterCard/VISA/AmEx/etc), and so are, again, explicitly not anonymous.

The problem with cash is that you have to be physically present to buy something.  You can't just go online to order something from Joe's Pretty Good Cake Shoppe.  You need to get in the car and schlep on down to Joe's.  That's inconvenient if you are in Oklahoma City and Joe is in London.

This is where Cryptocurrency in general and Bitcoin in particular come in.  It is a distributed, peer-to-peer currency based on encryption technology.  Since it is distributed, there is no central authority involved, i.e. the Government can't get all up in your business when you buy something.

How does Bitcoin Work?

Bitcoin, like all cryptocurrencies (well, the ones I've looked at) use a built-in ledger system.  When you spend a bitcoin, both you and the other party cryptographically sign the ledger transferring the coin.  The ledger is called the Blockchain and is maintained in a distributed manner by a number of Internet servers that essentially maintain a distributed database of bitcoins.  When you sign the blockchain, that transaction is broadcast to the network which validates the transaction and adds it to its transaction database (the blockchain ledger).

You will notice that the government is not involved in any of this, so you have the possibility of anonymous payment without having to physically hand over cash.  There's a pretty good introduction to how Blockchain works at Zerohedge.

So who "mints" Bitcoins?

Each cryptocurrency has its own way to cryptographically creating new coins.  This is called "mining" and is very CPU intensive.  The encryption algorithms used are designed to be highly resistant to forgery (as you can imagine this is an absolute requirement for a currency) but the downside is that you need to do a lot of calculations.

Interestingly, we're starting to see coin mining being used behind the scenes, as a replacement for web ads.  We are also beginning to see malware that does coin mining on your computer, rather than doing click fraud.  As always, it's the advertisers and Black Hats who figure out how to monitize the 'net.

Each cryptocurrency has designed a limit for how many coins can be mined.  Bitcoin will only allow 21 Million coins.  They expect this to be reached in 20 years or so.

How do I use it?

You need software (typically called a "wallet").  There are web-based wallets that maintain everything on the 'net, you can install software on your computer (remember to back up your data!), and there are hardware smart cards that will keep your bitcoins on an easily transported (and possibly harder for malware to steal) device.

You can spend Bitcoins wherever they are accepted.  Paypal does (or did) accept bitcoins, as do kind of a lot of other places.

C'mon Borepatch - you know this is just for buying weed, right?

Whenever you talk about Bitcoin, there's a lot of talk about the "Dark Internet", underground economy, and black market.  There's a problem with this.

Your Bitcoin identity is not anonymous like with cash.  You need a pseudonym to use it.  Depending on your operational security this may be easy or hard to link to your physical identity.  This gets into cloak and dagger tradecraft, which I won't go into here, but caveat emptor.  If you're looking to buy weed off the Dark Net then you'd want very good tradecraft indeed I would imagine.

Ransomware (like WannaCry) have demanded payment in Bitcoin, so there's attention in the Bad Guy community.

Other than Anarcho-capitalist techno-cred (which probably has peaked anyway), it looks like most of the action in Bitcoin is financial speculation.  This is really high risk because there are nearly a thousand different cryptocurrencies and most are very likely going to end up worthless.


Do Governments hate Bitcoin?

Probably.  Remember, it was designed to be distributed, not requiring a central bank.  Governments like central banks because it gives them a control point.  There's some speculation that governments will crack down, and China (at least) has outlawed purchase of physical goods using bitcoin.  Where this will go remains to be seen.

So there you have it, the world's shortest overview of Bitcoin.

UPDATE 20 December 2017 10:16: Robert Graham has some interesting thoughts on Bitcoin here.

Just how stupid is the GOP?

EPA Administrator Pruitt is receiving so many death threats that his security costs have ballooned:
Due to the enormous amount of death threats thrown at EPA Administrator Scott Pruitt, the government has amped up his security. Congress has asked if this is a waste of money, but it seems a legit concern.
That's not why the GOP is stupid, it's an example of how much of the Left has turned into fascists.  Here's what's stupid:
Last month, former EPA administrator Christine Todd Whitman implied that Pruitt is to blame for the these threats:
Whitman criticized Pruitt’s request for an expensive security detail while he also proposes deep cuts to the agency’s budget. 
“If he has had enough serious death threats, then he shouldn’t have proposed the deep cuts to the EPA budget,” she said in an interview. “What worries me is if these people are being used for protecting him, they are not cracking down on environmental crimes being committed by companies.”
Whitman is a Republican, serving as EPA Administrator under George W. Bush.  The GOP is so anti-Trump that even scaling back the EPA's Obama era massive overreach must be opposed, because Never Trump.  They are so anti-Trump that they don't care that left wing Brown Shirts are out for Pruitt's blood.  They'd rather see the security money go to implementing Obama's EPA overreach, because Never Trump.

The Re-Elect Trump 2020 Campaign thanks them, as another 50,000 GOP voters prepare to vote against the GOP Establishment next year.

I am really quite flabbergasted how so many people learned nothing from last year's elections.  They tried this sort of nonsense over an over then, certain that "this time it will work for sure".  And here they are doing it again.  But sure - this time it's bound to work ...


They have learned nothing, and forgotten nothing.  This is in great contrast with GOP voters, who have learned a lot but have forgotten nothing.  This strikes me as extremely unwise of the GOP Establishment.


Sunday, October 22, 2017

The classical music influence on Rock and Roll: Sergei Rachmaninoff and Muse - Butterflies and Hurricanes

Rachmaninoff is perhaps the greatest composer for Piano, excepting only Chopin himself.  He was perhaps the apex of the romantic movement, which made him a natural influence for Rock Opera.  Listen to the piano interlude at around 3:30 into their song, Butterflies And Hurricanes:



Compare with Rachmaninoff's Piano Concerto No. 1, around 2:45 into the performance:

Friday, October 20, 2017

Stevie Ray Vaughan And The Fabulous Thunderbirds--What I Say

Because it's Friday.



Party on, Garth.

And I would have got away with it, except for that meddling Zuhl


Something is very strange in the neighborhood ...

"An Empty Barrel makes the most noise"

If you haven't watched or listened to this statement from Gen. Kelly, it's well worth your time.



His comments on the loss of the sense of the sacred is very powerful.  His choice to only call on members of the Press who know a Gold Star family was a pointed comment.  It was nice to see that several members did know one (or claimed to, at least), and asked good questions.

The post title is how he described the current controversy, but he expanded his remarks to talk about other experiences he had where clueless politicians inserted their ego into what should have been a solemn memorial occasion.  It's probably too much to hope for that this Republic will take a step back from the Abyss of Madness which is staring into us, but this might be a start.


So let it be written, so let it be done.

Children's "Smart" watches are unsafe for children

New security analysis about "Smart" watches being marketed to children.  It seems that they're totally secure, other than:

  • Critical security vulnerabilities
  • "A false sense of security"
  • "Lack of respect for consumer rights"
Other than that, the security is awesome.

Since the holidays are coming up, you might want to rethink getting these for your kids or grandkids.


Thursday, October 19, 2017

People to See, Deliveries to Make - A Brigid Guest Post

I'm taking Dad's holiday gifts out to him in person and will hang out with him for a while during which time Partner in Grime finishes up some construction on our house.  I'll be back in a week or so as Dad has no internet and I have a flip phone (stubbornly clinging to my luddite status).

Until then, I leave you with Abby Normal the Lab anxiously awaiting trick or treating. Cheers! - Brigid

Wednesday, October 18, 2017

There's a reason that so much science is crap

Peter calls out attention to tens of thousands of scientific papers that are possibly (likely? who knows?) invalid.  This is not a surprise to anyone who is paying attention.  It comes from two very simple principles:

1. Success in a scientific career is determined by how frequently the scientist publishes papers in scientific journals.

2. Scientific journals are interested in novelty - new results that have not been published before.  It's pretty rare to see a paper published confirming the results of a prior paper.

In short, there's absolutely no need for results confirming other papers - these will never get published anyway.  Since there's no need for confirmation, a scientist can focus all his efforts on novelty.  Because novel results sometimes must skirt the edge of what is seemly, we can expect spillover into the unseemly.

So how much spillover do we get?  We don't know.  And quite frankly, neither does anyone who is engaged in "Science".  We've known for a long time that something is very wrong in the state of Science™, with the rate of major advances slowing noticeably.  It could very well be that the reason is that there is so much bogus science being done, that distracts young scientists from other more significant areas of study.  It may be that with no need to get reproducibility, it's just easier to put out novel garbage than it is to do more significant work.  And when you think about which of those two patch will be better for a young scientist's career, it's no surprise that we swim is a sea of scientific crap.

None of this has to be deliberate, or fraudulent.  It's just the way that the scientific game is played.

Science that is repeatable is called "Engineering" anyway.  Strange how you don't seem to hear about lots of retractions from engineering journals.  Science is like the stereotypical aging starlet still trying to get drinks in bars off of her old good looks and fame.

Veteran's Day weekend NFL protest

I'm all in on this:
MARK YOUR CALENDARS – National boycott of the NFL forSunday November 12th, Veterans Day Weekend. Boycott all football telecast, all fans, all ticket holders, stay away from attending any games, let them play to empty stadiums. Pass this post along to all your friends and family. Honor our military, some of whom come home with the American Flag draped over their coffin.

Tuesday, October 17, 2017

Stand firm, ye boys of Maine

Not once in a century are men permitted to bear such responsibilities for freedom and justice ...


Three roofers in Waterville, Maine stand at attention when the National Anthem is played at a neighboring football field.

The quote, of course, is from Joshua Lawrence Chamberson to the boys of the 20th Maine on Little Round Top at the battle of Gettysburg.  He knew that the battle was to be fought - and won or lost - there on that day.  The stubbornness of those boys has been preserved, at least in Waterville.

Hat tip: Rick, via email.

The most important security action you can take today

WiFi security is in the news (including here), but remember that an attacker has to be physically close to you to attack you with this new technique.  So keep calm and focus on a real security risk where someone can attack you from afar.

Flash is the first major internet video technology.  It is also a sewer of security vulnerabilities, and the single biggest attach vector used by the Bad Guys.  These days, Flash has been replaced by other more secure technologies, so you really don't want it on your computer.

Here are instructions on how to uninstall Flash.  This is without doubt the single most important security step you can take.

Monday, October 16, 2017

It's not just the roots of Gun Control are racist

Well, they are, but that's not my point.

The real problem is not the roots, but the vine:
A.J. Burgess, a 2-year-old boy born without functional kidneys, is in desperate need of a transplant. His father, Anthony Dickerson, a perfect match, was prepared to undergo transplant surgery until he was arrested for violating his parole.
Dickerson was "in possession of a firearm or knife during the commission of or attempt to commit certain felonies," according to WGCL-TV. He's been released from prison, but the hospital won't perform surgery until his parole officer gives the okay.
That could take three to four months—the hospital wants to revisit the issue in January. Of course, there's no guarantee Burgess will live that long. He has to undergo dialysis every day. His body is failing. He has to have bladder surgery. He needs a kidney now, and a highly motivated donor—his father—is willing to give him one.
But a little black kid needs to maybe die, sacrificed on the altar of gun control laws:
Not to put too fine a point on this, because there's plenty else going on—it sounds like Dickerson was involved in criminal activity, independent of his illegal gun possession—but I suspect liberals like to imagine stricter gun control means a peaceful and voluntary gradual disarmament of a gun-weary citizenry.
Maybe that's gun control in theory. In practice, stricter gun control means giving the government more reasons to interfere in the lives of black and brown people who are already wary of the police.
This is actually a great situation for a Black Lives Matter movement.  I won't hold my breath.

Different mindsets


Spotted by The Queen Of The World.

Oh great. WiFi security is pretty broken

This seems pretty bad:
This is my interpretation of the KRACK attacks paper that describes a way of decrypting encrypted WiFi traffic with an active attack.

tl;dr: Wow. Everyone needs to be afraid. It means in practice, attackers can decrypt a lot of wifi traffic, with varying levels of difficulty depending on your precise network setup. My post last July about the DEF CON network being safe was in error.

Details

This is not a crypto bug but a protocol bug (a pretty obvious and trivial protocol bug).

When a client connects to the network, the access-point will at some point send a random key to use for encryption. Because this packet may be lost in transmission, it can be repeated many times.

What the hacker does is just repeatedly sends this packet, potentially hours later. Each time it does so, it resets the "keystream" back to the starting conditions. The obvious patch that device vendors will make is to only accept the first such packet it receives, ignore all the duplicates.
This effects everything that has WiFi, which these days means just about everything.  There is a tool in circulation to exploit this.

The punchline is that I haven't heard of any patches being available for this.  I will let y'all know when they start coming out.

UPDATE 16 October 2017: 09:58: There's a great deal of practical information here:
  • www.krackattacks.com is now up!
  • Attacks against Android Phones are very easy! Oh dear 🙁 Best to turn off wifi on these devices until fixes are applied.
  • Windows and Mac OS users are much safer. Updates for other OSes will come quite quickly, the big problem is embedded devices for whom updates are slow / never coming
  • For the very technical, the CVE list is at the bottom of this post.
  • The main attack is against clients, not access points. So, updating your router may or may not be necessary: updating your client devices absolutely is! Keep your laptops patched, and particularly get your Android phone updated
Android phones get patched more slowly than iPhones do.  You should probably turn off WiFi on your Android phone until you get a patch.

Sunday, October 15, 2017

Priced by what the market will bear?


I'll take the Dutch pillow, thanks.

The classical influence on rock and roll: The Beatles - Penny Lane

I expect that all our readers will be familiar with the trumpet solo in "Penny Lane":



It turns out that it was inspired by Bach's Brandenburg Concerto #2:



This is a particularly interesting version of the concerto performed by the Freiburg Barockorchester using period (early 18th century) instruments.  You don't often see a recorder used in chamber music these days, although it was quite common in earlier days (English King Henry VIII composed a number of pieces for Recorder).  More to the point of the subject of the post, the trumpet isn't really a trumpet.  Rather, it looks like an antique variant of a coronet (I confess to being a little hazy on the type here despite being an old trumpet player back in school).  It has a higher pitch than today's trumpet, and in fact sounds very like the pitch of the Piccolo Trumpet used in Penny Lane.

The story is that Paul McCartney was watching a BBC show where the Brandenburg Concerto #2 was performed.  McCartney was transfixed by the trumpet performance by David Mason.  The music inspired McCartney to add a pseudo-baroque trumpet solo, and the rest is history.  McCartney asked Mason to record the solo on Penny Lane, which he did on January 17, 1967.

And thus we see that even The Beatles knew the truth of the old saying: if it's not Baroque, don't fix it.

Saturday, October 14, 2017

On Timing - A Brigid Guest Post

Doc Holliday:  What did you ever want?
Wyatt Earp:   Just to live a normal life.
Doc Holliday: There's no normal life, Wyatt, it's just life. Get on with it.
Wyatt Earp: Don't know how.
Doc Holliday: Sure you do. Say goodbye to me. Go grab that spirited actress and make her your own. Take that beauty from it, don't look back.  Live every second. Live right on to the end. Live Wyatt. Live for me.   Wyatt, if you were ever my friend -  if ya ever had even the slightest of feelin' for me,
leave now. Leave now... Please.

Timing is everything they say.

In ballistics certainly so. In the outcome of a day even more so.  I missed out on a flight  in a smallish plane some years ago, because I was suddenly sick to my stomach. All aboard died.  My stomach bug was not the flu but a not yet known and unplanned pregnancy.

How many of us, unknowingly, missed a vehicular accident, a violent crime or a whack from mother nature, simply because we forgot our phone and ran back into the house, decided to linger over that nice little .380 in the case, or simply had too much, or too little caffeine.
Timing.

Timing can be good.  It can also be lousy. Missed trains, missed job opportunities.  Missed dreams.  I've heard from more than one guy friend that he was bummed the "girl of his dreams" had found someone. Yet, he never asked her out, couldn't express the feelings until it was too late, sometimes remaining silent for months or even years, growing only older of bone and pride.

Timing.

When we were kids, we ran around with time simply carried in our pocket, as dense and round as a coin, many coins, that jingle as we ran. We are told by some grownups that we soon will have to grow up and leave childish dreams behind, but we don't listen, because we have nothing in our experience to gauge their caution by, to give the portent of a structured future any range and meaning.  Besides we are too busy, just doing things that kids do, even if that was just sitting and waiting for hours for a fish to bite a tiny hook.

Then, seemingly overnight, we fell into that grown up, carefully measured and timed world, picking up our watch in the process. The dreams of childhood passed behind as we jumped on board a fast moving train, losing our innocence before we even fully realized we possessed it.
As adults we are governed by time, watches, and cell phones and alarm clocks and schedules.  Mechanical clocks and biological ones. We rush headlong into actions without considerations, as if the sheer and simple arranged succession of days was not fast enough, constituted without capacity enough, so that weeks and months and years of living had to be condensed down into one moment, and it is today, now.  We as a society, and as individuals, do not seem to be able to closely watch and wait for that which is worth waiting for.  We feverishly work for things we do not need and we vote without thought for those that promise us prosperity without effort.

Everything is based on now. Do not pass GO, do not collect $200. What do you mean you haven't got a date, got a spouse, a house, a baby, and we need to talk to you about those 25 pounds.  Everything is on a time schedule and it's not necessarily ours. Meals are microwaved, we speed date, express wash, Kwik-e-Mart, and you know what? We find that in rushing towards what we're supposed to want, we missed the things that can truly change our lives.

Reset your clock.

Just once, turn off your computer turn off your cell phone, turn off Twitter, and Facebook and clear your calender for a few hours.

Pick up that old firearm that may have been your Dad's, or your Grandfathers and head out into the country.  If you don't hunt, then pick up a camera, a drawing pad and a pencil.  But take some tool that will open up the wilderness to you and go.
Go out into that rapid and fading back country that is retreating as the tide is, walk out into that land that was ours, is ours, field and forest, bayou and orchard, grain and dust, harbor and thicket. Go on out and decide what is important and what is not, among all the flotsam and jetsam in your life, where it is going and how much control you're going to give to others over it.

Go out into that land that still carries the tracks of those that crossed this nation to build, to grow; men, and women and children, bringing with them their tools and trades, goods and gear, by steamer, by wagon wheel by train, by big slow rivers that sometimes revealed no current and sometimes ran backwards, running not to hide, but to dream, all the way to the ocean. It was a land on which a man ate only by the sweat of his brow, the ability to plow a straight furrow or chop down a limb without removing one of his own.  It was a land of milk and honey, steelhead and gold, which offered itself up on rare occasion from the earth as compensation for torn lives and broken bones, payment which neither man nor his government proffered for the weak or the foolish.

Find a spot out in this expanse of history and sit and take it in.

There is so much that might have been, could have been, wrong place, wrong time, so boundless in capacity is man's imagination to burn and scatter away the refuse of probability, leaving only yearning and dreams. No time or space or distance can keep you from that what matters, even if to the world, your dreams of your life is and what kind of world you wish to live in, are little more than transparent scratchings on depthless glass.
I do not regret the days I sat by my brothers bedside as the chemicals went into his body that might or might not kill the cancer that was consuming him with fire that bears no warmth. There was the steady whoosh from machinery in the room, the movement of unsleeping blood, the intake of air. There were so many places I needed to be, so many things I needed to do, but in those hours, those days, being with him was the only thing on my calander.  The room was simple, but its corners and edges held the quiet, complex lives of two very secret people, who long ago escaped from a place that held only pain, there in that season between thunder and any thought of rain, finding their own shelter as we bonded not just as children, but for life.  There in those last days, we had no season, the hospital room alternating day and night in a vacuum in which light was only a hope.

In retrospect, I would not remembere those other things I should have been doing during that time, but I can recall like it was yesterday the sound of his voice there in that room, the feel of his hand holding mine as we said a prayer for more time.

As you sit out there in that countryside, think of these words. Stop and look and breathe. Pick up a discarded piece of wood. Think of what you have, what means the world to you, and what and who you will fight for, as an individual, as part of a family and as a citizen.
Then carve your name on that little piece of wood, carve the name of the one you fight for, or simply carve "Freedom", the letters bearing one clear unfettered voice that sounds out, through the delicate attenuation of your actions, through the ringing bells of your worth, through the tone that is the weight of silent guns - I WAS here, I AM here, there IS still time.

Then go back home to your home and your memories.  A heart shaped locket with a young woman and a man in an airman's uniform, months before war separated them for years. A shirt that could fit a thousand others but which only one wore so long that you will forever know its wearer by the simple feel of the fabric underneath your fingertips, the echo of sandalwood that clings to blue cotton. Go back to your present; a photo on the wall of those who still live to tell you their stories, to hold firm your past, memories that are borne on the air that you still breathe, invisible, yet essential as air itself. Go back to your future. A flag on a wall, one for which your loved ones gave up much of their life for, or even, life itself.

Go back and claim what is there, while there is still time.
 - Brigid