On the Shadow Brokers NSA leaks

The leaks published by The Shadow Brokers (Wikipedia, New York Times) are the perfect example of why we should minimize the sensitive information kept by the government. I posted about this in the context of encryption backdoors two years ago. But whether we’re talking about encryption backdoors, security vulnerabilities or hacking tools, the most reliable way to avoid data leaks is to not store the data in the first place. It can’t be stolen if it doesn’t exist.

A simplistic way to do risk analysis for data leaks is to ask “what are the chances this will happen?” But that’s wrong. Data leaks will happen. It’s not a question of “if” it’s a question of “how often and how severe.”

We can look at the WannaCry ransomware attack for a real-world example. The Wikipedia article cites damage estimates of hundreds of millions of dollars. We don’t know how long the NSA has been building hacking tools, but I’d be surprised if they started before the year 2000. Are we ok with $100 million dollars in damages/lost productivity worldwide every 17 years?
What if it was every 10 years? Every 5 years? What if the damages were worse?

I strongly believe the potential harm from withholding security vulnerabilities far exceeds the potential gain from attempting to keep them private. The NSA shouldn’t be stockpiling security vulnerabilities or building hacking tools, and they shouldn’t have backdoors into encryption. The advantages do not justify the disadvantages.

Posted in All, Computers | Leave a comment

Star Trek

I watched all episodes of the original Star Trek series over the last two years. It’s not amazing, but it has its moments. Some episodes are great, some are dumb, and some are boring. Episodes are almost entirely self-contained—no cross-episode story arcs.

I watched the “remastered” versions on Netflix. The quality is good, though I disliked basically every CG effect that was added. They look cheap and feel out of place from the rest of the show, which retains a 1960s look. The rotating colored lights at the tips of the warp nacelles are especially ridiculous.

I’ve now moved on to watching The Next Generation. Everything is better: the stories, the scripts, the sets, the lighting, the CG effects. The cast is bigger and characters are better developed. The cross-episode story arcs add a lot of depth (e.g. Wesley and The Traveler, The Borg, Data learning more about his origins and family).

It took me two years to watch all 79 episodes of the original series, so it’s gonna be a while before I finish watching/rewatching all 178 episodes of The Next Generation.

Posted in All | 2 Comments

Technology news briefs

There were three events last week that I thought didn’t get enough news coverage:

1. Good news: Proposed restrictions on warrantless electronic device border searches

Bills were proposed in the Senate and House to require a probable cause warrant before searching the digital devices of US citizens and legal permanent residents at the border. This is great. Customs and Border Protection have been asserting that they’re allowed to search travelers’ digital devices because they fall under the “border search exception” to the Fourth Amendment. However, digital devices contain vast amounts of personal information. It’s unreasonable to expect a person to reveal everything about themselves just to get back into their own country. Thank you Senators Wyden and Paul and Representatives Polis, Smith, and Farenthold! More info.

2. Bad news: Hacking into a smart TV by sending it radio signals

Apparently some guy got full access to a smart TV by sending it specially crafted radio signals. Some new smart TVs have built in video cameras. This means a hacker could turn on your TV’s video camera and watch you. This should terrify you. More info

3. More bad news: Remote execution bug in embedded Wi-Fi code in a tremendous number of mobile devices

It’s not clear how severe this is. In the worst case an attacker could execute code on your phone just by being near it. Or maybe it’s only possible if the attacker is connected to the same Wi-Fi network as your phone. In any case, you should apply software updates ASAP, and as always, avoid connecting to random Wi-Fi networks. Only use Wi-Fi at your house and your office. According to Google’s blog post, potentially affected phones are, at a minimum: all iPhones since the iPhone 4, Google Nexus 5, 6, and 6P, and “most Samsung flagship devices.” That’s a shit ton of phones and that’s not even a complete list.

More info: Google’s blog post, Ars Technica main article, Ars Technica iOS article, April 2017 Android Security Bulletin link 1 and link 2, and Samsung security update announcement.

A few takeaways:

  • Always update your software/firmware/OS as soon as possible.
  • Don’t connect to untrusted or non-password protected Wi-Fi networks. You’re putting yourself at risk.
  • Google Project Zero should try harder for coordinated and responsible disclosure. I’m using a Nexus 5X, one of Google’s own phones, and I don’t even have the fix yet. The latest security patch level available to me is March 5, 2017. Imagine how screwed all the normal people are whose mobile providers really suck at providing software updates. Also, maybe don’t provide attack code immediately? I understand the rationale for wide disclosure once one vendor makes the issue public (Apple released their security update on April 3rd), but you don’t need to give the attack tools to the entire world. Edit: I want to add that I’m extremely grateful to Google and the Project Zero researchers. They’re doing fantastic work and we’re absolutely better off because of them (unrelated to this issue, but by all accounts Tavis Ormandy is absolutely crushing it). I just wish this specific issue was a little more coordinated.
  • This feels like it’s only the beginning. Vulnerability testing of this type of code is difficult (read Google’s disclosure blog post if you don’t believe me). I suspect embedded code like this hasn’t gotten a lot of eyeballs and we’ll see an increase in these types of discoveries in the future.
Posted in All, Computers | Leave a comment

Two years with a Retrospec Mantra

I commuted a few miles a day for two years on a black Retrospec Mantra single-speed bike. I bought it from Amazon for $256 in October 2014.

Retrospec Mantra

(more photos)

It’s nothing special. Fairly low quality, but appropriately priced. The steel is heavy and the ride is dull. The plastic pedals are clunky and don’t spin particularly freely. The wheels are sturdy. The Kenda KWest K193 tires have been fine. I put ~1200 miles on them and had 2 or 3 flats. Not amazing, but not terrible considering the roads I was on.

I added front and rear fenders, a seat lock, and front and rear lights. Total weight including fenders, lights, tires, pedals, and saddle is 27 lbs 11 oz.

It comes with a flip-flop hub, which means it can be ridden as a fixed-gear or freewheel by swapping the rear wheel around. It arrived as fixed-gear. I rode it this way for a few weeks and didn’t like it. I found it inconvenient to not be able to coast and freely position the pedals when stopping. So I switched to freewheel. I added a rear brake for redundancy.

The original brake pads were awful. Poor braking power and they shredded to nothingness after less than 100 miles. I switched to Shimano BR-6700 Ultegra brake pads and holders and they’ve been great. The brake levers have some wiggle in them, but they work fine.

I’ve been happy with it. I don’t worry about it getting beat up on Caltrain. I don’t worry too much when locking it outside. Total cost of ownership has been low. I’ve done no maintenance other than replacing the brake pads and changing punctured tubes. I wish the gear was lower to make going uphill less annoying, but it’s been fine. Buying a single-speed for this commute was a good choice.

Posted in Cycling | Leave a comment

USS Hornet

On Saturday, Emily, Ruby and I visited the USS Hornet, a decommissioned Essex Class Navy aircraft carrier moored in Alameda, California. You get free reign to wander the flight deck, hanger deck, and a deck or two below. The passageways are cold metal, strewn with gauges, levers and knobs. Ceilings are low and stairs are steep. In addition to wandering, we also took a loosely-guided tour of the island, which I enjoyed.

Overall I thought it was great. Would recommend. A+++. Great shipping. Not stroller or wheelchair friendly. I think kids would like it, though they should be young enough to be worn or old enough to climb a ladder on their own safely.

You can see all our pictures on Flickr. Here’s a sampling:

USS Hornet (CV-12)

USS Hornet (CV-12) island

USS Hornet (CV-12) Primary Flight Control

Gauges

Posted in All | Leave a comment

Trump vs. Clinton

I voted for Clinton/Kaine. Clinton is the only qualified presidential candidate on the ballot. There are things I don’t like about Clinton, but…

Donald Trump is a worthless piece of shit. A lying [1][2][3], impulsive, megalomaniac, garbage excuse for a human being. The leader of a country should be: Intelligent. Thoughtful. Measured. Patient. Respectable. Sympathetic to opposing viewpoints. Credible. Trump is none of these. He regularly insults[4] huge portions of the population. No one benefits from these things, he’s just being an asshole. This does not engender collaboration.

It’s great that people are unhappy with our legislature. I respect that. The Senate and House function poorly because of over-adherence to party lines and pandering to corporate and wealthy interests (and spending absurd amounts of time raising money[5][6][7][8]). I’d love for members of the legislature to vote based on the best interests of their constituents rather than following party lines. These things suck and it would be great if they could change, but Trump is not the solution.

Would you want to work at a company where Trump was in charge? What if he was your immediate boss? Or a coworker? Do you think he would make sound, fair decisions?

There are reasonable ideas on Trump’s policies page, but I have no confidence he’d follow through on any of them. Everyone can agree that supporting the VA[9] is great, but increasing the size of the military [10] and aggressively pursuing ISIS [11] puts more of our soldiers in harm’s way. ISIS is a problem with no easy solution. I believe the benefit of building a 2,000 mile long wall on the Mexican border does not justify the cost (I’m skeptical of getting Mexico to pay for the wall). Also let’s not forget that it’s pretty easy to get over a wall with, you know, a ladder. Reducing government spending[12][13] is a noble cause, but it’s easier said than done.

Sure, there are things I don’t like about Clinton. I wish she’d own her mistakes instead of denying, hiding, and trivializing them[14]. I’m not at all confident that she doesn’t return favors for people who donate money to The Clinton Foundation, or her campaign, or who do favors for her. But these negative traits are trivial compared to Trump’s pattern of abuse and incivility.

Posted in All | Leave a comment

Safari invalid certificate handling sucks

Update 2017-11-03: Some of these issues have been improved on macOS Safari (I didn’t check iOS). Original post follows.

Last week I filed three bugs with Apple regarding how Safari handles invalid certificates.

Bug #1 (Mac OS and iOS): It’s way too easy for a user to bypass a certificate warning. There’s a bunch of text no one will read and a big friendly “Continue” button. Invalid certificates are serious and should not be ignored lightly. Your average user doesn’t know this. It’s the responsibility of the browser to treat invalid certificates with appropriate gravitas. Safari fails here.

Screenshot of Safari's invalid certificate warning on Mac OS

Screenshot of Safari’s invalid certificate warning on Mac OS

Screenshot of Safari's invalid certificate warning on iOS

Screenshot of Safari’s invalid certificate warning on iOS

Bug #2 (iOS): After continuing through a certificate warning, the address bar displays a closed padlock icon. This falsely indicates to the user that their interactions with the page are secure.

Screenshot of Safari after continuing through an invalid certificate warning

Screenshot of Safari after continuing through an invalid certificate warning

Bug #3 (iOS): If a user continues through a certificate warning, this decision should expire at some point. Maybe if the user visits the site in a new browser window. Maybe after a certain amount of time has gone by. As far as I can tell the cert bypass is remembered indefinitely.

Combined, these three issues greatly undermine the effectiveness of https on iOS. I’d wager that it’s significantly easier to perform a man-in-the-middle attack of an https site on an iOS Safari user than an iOS Chrome user.

Apple: You’re one of the biggest companies in the world. You command huge shares of the consumer computer and mobile device markets. Fix your shit.

Posted in Computers | 2 Comments

Nighttime music

When Ruby was a little younger, before we started sleep training, the three of us would sometimes sit in her room at the end of the day and listen to music. I tried to pick music that was soft and calming. Here’s the list of albums we listened to, one each night:

  • Sarah Harmer, You Were Here
  • David Gray, Greatest Hits
  • Gary Peacock Trio, Now This
  • Dave Matthews Band, Under the Table and Dreaming
  • Erlend Øye, Unrest
  • Hooverphonic, Sit Down and Listen to Hooverphonic
  • Marvin Gaye, What’s Going On
  • Rilo Kiley, Take Offs and Landings
  • Natalie Merchant, Ophelia
  • Marvin Gaye, Here, My Dear
  • Sade, Lovers Rock
  • Sting, Fields of Gold: The Best of Sting 1984-1994
Posted in All | Leave a comment