Voting for the 2016 Security Blogger Awards are now open, and this blog is nominated for most entertaining. Please don’t vote for us. Along with our sister blog, we’re aiming to dominate a new category next year, “most nominations without a win.”
Offered up without comment:
I was irked to see a tweet “Learned a new word! Pseudoarboricity: the number of pseudoforests needed to cover a graph. Yes, it is actually a word and so is pseudoforest.” The idea that some letter combinations are “actual words” implies that others are “not actual words,” and thus, that there is some authority who may tell me what letter combinations I am allowed to use or understand.
Balderdash. Adorkable balderdash, but balderdash nonetheless.
As any student of Orwell shall recall, the test of language is its comprehensibility, not its adhesion to some standard. As an author, I sometimes hear from people who believe themselves to be authorities, or who believe that they may select for me authorities as to the meanings of words, and who wish to tell me that my use of the word “threat” threatens their understanding, that the preface’s explicit discussion of the many plain meanings of the word is insufficient, or that my sentences are too long, comma-filled, dash deficient or otherwise Oxfordless in a way which seems to cause them to feel superior to me in a way they wish to, at some length, convey.
In fact, on occasion, they are irked. I recommend to them, and to you, “You Are What You Speak.”
I wish them the best, and fall back, if you’ll so allow, to a comment from another master of language, speaking through one of his characters:
‘When I use a word,’ Humpty Dumpty said, in rather a scornful tone, ‘it means just what I choose it to mean — neither more nor less.’
‘The question is,’ said Alice, ‘whether you can make words mean so many different things.’
‘The question is,’ said Humpty Dumpty, ‘which is to be master — that’s all.’
Looking for something festive, holiday-like and chaotic for the blog, I came across color-changing cats. The history of color-changing cats is a fascinating one, involving Carl Sagan and accurate predictions of unfathomable chaos over the next ten thousand years. Because while we don’t know what life will be like that far in the future, consider how much the world has changed in the last hundred, and square that.
Of course, 10,000 years matters because it’s both substantially longer than meaningfully recorded history (or even a meaning for meaningful recording of history), and because it’s a good approximation for how long certain radioactive isotopes will remain dangerous.
So the US government, producer of said isotopes in its nuclear weapons programs, has convened panels of the great and clever to consider how to ensure that those isotopes are protected. Solutions were proposed including a skull and crossbones and giant spikes surrounding the site.
Read or listen to “Ten Thousand Years ” on 99% Invisible to see why those won’t work. One fascinating solution involves the creation of both color-changing cats and songs about them, such as:
One of the few things that’s for certain, over the next ten thousand years, assuming people are around, some will continue to ache for control they cannot achieve, and produce crap like a DRM-enabled litter box.
I fell victim to an interesting attack, which I am recounting here so that others may avoid it.
In a nutshell, I fell victim to a trojan, which the malefactor was able to place in a trusted location in my search path. A wrapper obscured the malicious payload. Additionally, a second line of defense did not catch the substitution. I believe the attackers were not out to harm me, but that this trojan was put in place partially for lulz, and partially to allow a more-important attack on the systems RBAC mechanisms to succeed.
I was attempting to purchase a six pack of New Belgium Rampant IPA, shown immediately below.
I obtained the six pack from the canonical location in the system – a reach-in refrigerator in the supermarket’s liquor aisle. I proceeded to the cashier, who rang up my purchase, bagged it, and accepted payment.
I realized upon arrival home, that this was a trojan six pack, as seen below:
Clearly, the attacker to care to make his payload look legitimate. What I noticed later, was the subtle difference I zoom in on below
Yes, the attacker had substituted root beer for real beer.
Needless to say, this was a devious denial of service, which the perpetrators undoubtedly laughed about. However, this was likely not just “for the lulz”. I think this was the work of juvenile attackers, whose motives were to defeat the RBAC (real beer access control) system. Knowing that a purchase of real beer would be scrutinized closely, I believe they exfiltrated the target beer by hiding it in a root beer package.
Mitigations put in place by the system did not catch this error – the cashier/reference monitor allowed the purchase (and likely, the offsetting real beer as root beer purchase).
The keys to this attack were that the trojan was in the right place in the search path, and that it appeared legitimate. Obviously, this location must be readable by all, since items need to be fetched from it. However, allowing items to be placed in it by untrusted users is a definite risk. Technical constraints make the obvious countermeasure — allowing only privileged stocking, while permitting “world” fetching — presents serious usability concerns, and increases system cost, since the privileged stocker must be paid.
Nonetheless, such countermeasures are in place for certain other items, notably where the cost to the system — as opposed to the user — of an illicit item substitution is quite high.
Ultimately, system usability and cost tradeoffs put the onus on the end-user. Before taking a non-idempotent step, inspect the objects closely!
Two quick comments. First, the goat survived longer this year than usual. Second, I think it illustrates something. I’m not sure what. But my yule would be incomplete without a giant straw goat set ablaze.
Here’s a Friday Star Wars video for you.
As Austin Hill tweeted, “Conspiracy revealed! 7 min video that will change the way you think about one of the important events of our lifetime”
It is a truism that the Star Wars prequels sucked. (Elsewhere, I’ve commented that the franchise being sold to Disney means someone can finally tell the tragic story of Anakin Skywalker’s seduction by the dark side.)
But the issue of exactly why they sucked is complex and layered, and most of us prefer not to consider it too deeply. Fortunately, you no longer have to. You can simply get “Why the Star Wars Prequels Sucked, and Why It Matters,” a short “Polemic on Aesthetics, Ethics and Politics. With Lightsabers.”
Really, what else do you need to know?
An example? Ok, the diner scene, and how it compares to the cantina scene. The cantina exudes otherness and menace. The diner looks like it was filmed in 1950s and then had a few weird things ‘shopped in. The scene undercuts the world which Star Wars established. Or the casual tossing in that Anakin was a virgin birth, and how after tying to one of the most enduring stories in western culture, the subject is then never referred to again.
Or the utter lack of consequence of anything in the stories, since we already know how they’ll come out, and how, by focusing on characters whose fates we know, Lucas drains any dramatic tension of of the story. The list goes on and on, and if you want to know why you hated the prequels so much, this is a short and easy read, and highly worthwhile.
Oh, and you’ll learn how Lando Calrissian is Faust. So go buy it already.
One last thing. Delano Lopez? That’s a name I hadn’t heard in a very long time. But he and I went to school together.
There’s a giant rubber duck in Sydney Harbor right now:
It’s apparently by Florentijn Hofman, who does this sort of thing.
Via “Sydney Festival Launches Giant Rubber Duck in the Harbor“, Pedestrian TV. (I believe there’s a typo, and the duck is 13.8 meters, not 138 meters.)
What more do you want on a Friday?
Ok, here’s details.