Tag: shmoocon

NoJoMo 2

  1. Describe your year to date.

I’ve been thinking about the best way to approach this one. I also realize that I screwed up the first writing prompts entry. I’ll have to juggle things a bit. My HTML skills are rather rusty, and copypasta from wherever I wrote those originally didn’t quiet work as intended. Probably because of that, the Election Day prompt is now set to fall tomorrow, instead of the proper Tuesday. Hmmm. I’ll juggle as I write next new days.

Anyway, back to this year. This hasn’t been a good year, at all. There’s still some hope it’ll get better before it ends, but I’m not holding my breath. Please to be ignoring the bad paragraph structure, as I’m just going to write what I can in blocks by month.

January:
A bad year started with some promise. Having removed myself from the driver’s seat on account of my failing eyesight in late 2012, I finally sold my car, which had been marooned with my mother, between Christmas and New Year’s. While I didn’t get nearly what I thought it was worth, the buyer seemed like a nice enough guy, exceed to have it, etc.. The cash infusion provided some comfort, but there was still an unresolved problem that kept me from spending the proceeds. With the community event to help save the market across the street in the middle of December, it looked like they were going to be able to stay open. I loaned one of my powered antennas to the owner so he could watch the playoffs while he worked the counter, trying to keep the store afloat. Things with HR Geeks were moving along, but I hadn’t gotten a ticket to Shmoocon, so I figured I wasn’t going to go. I was a bit disappointed by that, but after the 2013 one, I really wasn’t too broken up about it. So, toil away at my thankless job, instead of taking much of the scant leave I had available. Perhaps by subconscious choice, I don’t have the slightest clue what we were working on at work. Whatever it was, we were doing it shoddily, in the name of meeting wildly outrageous schedule promises. This was kind of par for the course, and I’d been thoroughly reminded that, because I was such a lousy professional minesweeper player, didn’t have a ton of connections on LinkedIn, we would meet whatever stupid schedule we’d been committed to, and I wouldn’t say that it was impossible. I wasn’t qualified. So, despite my dissatisfaction with the job, I was going to stay and do it until…? My wife also was about to start school, which I thought was kinda cool. Being on campus with her for the new student orientation had me feeling very out-of-place as a spouse in amongst a ton of parents, but I was excited for her. We’ll stay in Norfolk until she finishes, then go wherever. With that attitude, out of the blue, around a week before Shmoocon, a longtime friend came through with a ticket for me. Schweet. Even better? Free of charge. So, the trip would cost me transportation (Amtrak to DC, various cab fares), and whatever a hotel room cost. I confirmed with my boss that things were in order through the end of the Federal fiscal year, and asked whether I could, despite not asking well in advance, have the time off to go to the conference. Yes. I can totally deal with that. The conference was great. I wasn’t angling to land a gig. t wrote vociferously. I ate good food with friends. I made it home feeling tired, but somewhat excited about where things were going. I didn’t work MLK Day, using it as a day to recouperate after an eventful weekend. I went to the market across the street, and, no, they probably weren’t going to make it after all. Damnitsomuch. Tuesday I went to work. And was informed that I was being laid off next Tuesday. Perhaps I should have been more upset about it, but it honestly felt like a relief to get out of there. Nope, the little market across the street is closing. Again, damnitsomuch. We tried to help. For me, busses and trains to the Employment Commission, filing for unemployment, etc. Carrying home PBR on public transportation in my hipster acetate-framed glasses, etc. If I’d had a velvet blazer, and a mesh condom on my head, I probably would have looked more the part.

February:
Snow. Lots of it. Few bites on my resume. More bus trips to the unemployment office. Seminars telling me what I was doing wrong. Started thinking about seeing what it’d take to reopen the market across the street. I finally, and officially, resolved the aforementioned outstanding issue. Got home from the post office, started playing with my phone, and noticed I couldn’t read really any of the text on the screen. Maybe I’m just exhausted from being out, hoofing around, etc.. Rest for a bit. Nope, vision is still blurry as hell. Great. Call the neurologist’s office. Uhh, we’ll talk to the doctor and call you back. A few hours later, back on the bus to the neurologist’s clinic for the first of three days of Solu Medrol. My wife got out of class, and met me there. I also started angling to maybe reopen the market across the street. I had a decent working draft of a business plan, but probably not enough startup capital to make it go.

March:
Involvement with various startup agencies. Other stuff, digging through emails to see…I was trying to help my wife through Calculus. Started considering applying for jobs with the Federal Government, something I never had seriously considered before. Totally surprised my wife by conspiring with her mom and sister to get a white, ice cold, Twilight-themed ice cream cake. Saw the neurologist, who decided to keep me on Tecfidera, after the Solu Medrol had taken care of my flare. My wife and I had decided to stop paying COBRA from the four-letter company, which was running us better than $1400/mo.. Essentially, same vision and dental, with medical insurance from a local provider for roughly half the cost.

April:
HR Geeks came back to Norfolk from its monthlong exile in VB. On the way up, my wife was almost run off the road by a couple of police who were probably street racing at the end of the afternoon rush. My wife was pretty shaken up after a cop yelled at her out of the window of his cruiser for not getting over in bumpter-to-bumper traffic. While waiting at the restaurant, I called and opened a complaint about the cop. More seminars about starting your own business. More applications.

May:
Not a lot I’m seeing in my sent items, other than trying to get setup for startup stuff. I chose to go ahead, and open up my own business, not the little store across the street, focusing on kind of my technical and analytic strengths. Bank account? Check. Business license? Check. Registered for this Chamber of Commerce seminar on starting your own business for early June.

June:
As I continued setup activities for my company, I found it tough to avoid the temptation to try to do things myself, manually. Trying to setup basic services and infrastructure is just something that seemed to come naturally to me. Well, sort of. I still really suck at some of it, and am unwilling to spend the money to do it correctly. So? Take my own damn advice, and find a third-party provider. Unfortunately, I scheduled a bunch of sales calls with things like bandwidth vendors, one of which, after still keeping the conference after knowing they couldn’t provide what I wanted, caused me to miss TEDx at ODU. I tried to watch some of it, and while there were some good points, I still thought the speakers I watched were sort of missing the point. I finally got my drunk-looking-dude discount for the bus, as well as my Schedule A letter.

July:
I registered to be a part of Hatch Norfolk’s 1000-4 program, hoping it’d generate some business leads for me. Started attending their meetings, going to social events, etc.. The premise is sound, though I think some of the ideas are a bit off-the-wall, but I’m sure they think the same of my idea.

August:
I applied for jobs, and got referred for several positions locally, and in DC. One of those referrals was for a pretty sweet-sounding gig as a GS-13. On a whim, in order to keep my unemployment benefits coming in, I applied for a very low-level position dealing with a system I’d worked with previously I ran out of unemployment, and money was starting to get tight..

September:
One of the things I haven’t written much about in this tome is my struggles to find adequate dental care this year. The dentist I’d been seeing since 1996 finally closed his Norfolk office when the building he was in was demolished. He was only keeping hors on Friday down at what had been the first of three offices he opened. If/when I needed anything major done, he’d see me at his larger, modern office half an hour north. (where I’d seen him since high school) I went to one of the local larger practices while I was working for the four-letter after I’d lost a filling. The guy I saw had dollar signs in his eyes, then his office staff screwed up the billing. I messaged my primary care doc, and asked for a recommendation. His verdict? A friend of his up north of ODU. I went for a cleaning, had trouble wresting control of my records from the money-grubber practice. He fixed a small issue I had, then recommended I go back to see the guy who’d done all the work on me. Pfft. I scheduled an appointment with the old guy, which required a trip up with my wife, basicallly costing her an entire day. While I was waiting in the dental chair, I got a call from that thing I’d applied for months earlier. They needed me. As soon as possible. So, I took the gig, and cancelled the next two HR Geeks meetings. I also went to the Start Norfolk event, blew my pitch, and only attended about half the conference, being exhausted from work, etc..

October:
Still at this job. Not happy about it. Still digging hard on GS jobs, though I still haven’t gotten an interview. Now five have been cancelled, and twenty-some applications outstanding.

TLDR; it’s been a pretty lousy year, overall.

NoJoMo 2

  1. Describe your year to date.

I’ve been thinking about the best way to approach this one. I also realize that I screwed up the first writing prompts entry. I’ll have to juggle things a bit. My HTML skills are rather rusty, and copypasta from wherever I wrote those originally didn’t quiet work as intended. Probably because of that, the Election Day prompt is now set to fall tomorrow, instead of the proper Tuesday. Hmmm. I’ll juggle as I write next new days.

Anyway, back to this year. This hasn’t been a good year, at all. There’s still some hope it’ll get better before it ends, but I’m not holding my breath. Please to be ignoring the bad paragraph structure, as I’m just going to write what I can in blocks by month.

January:
A bad year started with some promise. Having removed myself from the driver’s seat on account of my failing eyesight in late 2012, I finally sold my car, which had been marooned with my mother, between Christmas and New Year’s. While I didn’t get nearly what I thought it was worth, the buyer seemed like a nice enough guy, exceed to have it, etc.. The cash infusion provided some comfort, but there was still an unresolved problem that kept me from spending the proceeds. With the community event to help save the market across the street in the middle of December, it looked like they were going to be able to stay open. I loaned one of my powered antennas to the owner so he could watch the playoffs while he worked the counter, trying to keep the store afloat. Things with HR Geeks were moving along, but I hadn’t gotten a ticket to Shmoocon, so I figured I wasn’t going to go. I was a bit disappointed by that, but after the 2013 one, I really wasn’t too broken up about it. So, toil away at my thankless job, instead of taking much of the scant leave I had available. Perhaps by subconscious choice, I don’t have the slightest clue what we were working on at work. Whatever it was, we were doing it shoddily, in the name of meeting wildly outrageous schedule promises. This was kind of par for the course, and I’d been thoroughly reminded that, because I was such a lousy professional minesweeper player, didn’t have a ton of connections on LinkedIn, we would meet whatever stupid schedule we’d been committed to, and I wouldn’t say that it was impossible. I wasn’t qualified. So, despite my dissatisfaction with the job, I was going to stay and do it until…? My wife also was about to start school, which I thought was kinda cool. Being on campus with her for the new student orientation had me feeling very out-of-place as a spouse in amongst a ton of parents, but I was excited for her. We’ll stay in Norfolk until she finishes, then go wherever. With that attitude, out of the blue, around a week before Shmoocon, a longtime friend came through with a ticket for me. Schweet. Even better? Free of charge. So, the trip would cost me transportation (Amtrak to DC, various cab fares), and whatever a hotel room cost. I confirmed with my boss that things were in order through the end of the Federal fiscal year, and asked whether I could, despite not asking well in advance, have the time off to go to the conference. Yes. I can totally deal with that. The conference was great. I wasn’t angling to land a gig. t wrote vociferously. I ate good food with friends. I made it home feeling tired, but somewhat excited about where things were going. I didn’t work MLK Day, using it as a day to recouperate after an eventful weekend. I went to the market across the street, and, no, they probably weren’t going to make it after all. Damnitsomuch. Tuesday I went to work. And was informed that I was being laid off next Tuesday. Perhaps I should have been more upset about it, but it honestly felt like a relief to get out of there. Nope, the little market across the street is closing. Again, damnitsomuch. We tried to help. For me, busses and trains to the Employment Commission, filing for unemployment, etc. Carrying home PBR on public transportation in my hipster acetate-framed glasses, etc. If I’d had a velvet blazer, and a mesh condom on my head, I probably would have looked more the part.

February:
Snow. Lots of it. Few bites on my resume. More bus trips to the unemployment office. Seminars telling me what I was doing wrong. Started thinking about seeing what it’d take to reopen the market across the street. I finally, and officially, resolved the aforementioned outstanding issue. Got home from the post office, started playing with my phone, and noticed I couldn’t read really any of the text on the screen. Maybe I’m just exhausted from being out, hoofing around, etc.. Rest for a bit. Nope, vision is still blurry as hell. Great. Call the neurologist’s office. Uhh, we’ll talk to the doctor and call you back. A few hours later, back on the bus to the neurologist’s clinic for the first of three days of Solu Medrol. My wife got out of class, and met me there. I also started angling to maybe reopen the market across the street. I had a decent working draft of a business plan, but probably not enough startup capital to make it go.

March:
Involvement with various startup agencies. Other stuff, digging through emails to see…I was trying to help my wife through Calculus. Started considering applying for jobs with the Federal Government, something I never had seriously considered before. Totally surprised my wife by conspiring with her mom and sister to get a white, ice cold, Twilight-themed ice cream cake. Saw the neurologist, who decided to keep me on Tecfidera, after the Solu Medrol had taken care of my flare. My wife and I had decided to stop paying COBRA from the four-letter company, which was running us better than $1400/mo.. Essentially, same vision and dental, with medical insurance from a local provider for roughly half the cost.

April:
HR Geeks came back to Norfolk from its monthlong exile in VB. On the way up, my wife was almost run off the road by a couple of police who were probably street racing at the end of the afternoon rush. My wife was pretty shaken up after a cop yelled at her out of the window of his cruiser for not getting over in bumpter-to-bumper traffic. While waiting at the restaurant, I called and opened a complaint about the cop. More seminars about starting your own business. More applications.

May:
Not a lot I’m seeing in my sent items, other than trying to get setup for startup stuff. I chose to go ahead, and open up my own business, not the little store across the street, focusing on kind of my technical and analytic strengths. Bank account? Check. Business license? Check. Registered for this Chamber of Commerce seminar on starting your own business for early June.

June:
As I continued setup activities for my company, I found it tough to avoid the temptation to try to do things myself, manually. Trying to setup basic services and infrastructure is just something that seemed to come naturally to me. Well, sort of. I still really suck at some of it, and am unwilling to spend the money to do it correctly. So? Take my own damn advice, and find a third-party provider. Unfortunately, I scheduled a bunch of sales calls with things like bandwidth vendors, one of which, after still keeping the conference after knowing they couldn’t provide what I wanted, caused me to miss TEDx at ODU. I tried to watch some of it, and while there were some good points, I still thought the speakers I watched were sort of missing the point. I finally got my drunk-looking-dude discount for the bus, as well as my Schedule A letter.

July:
I registered to be a part of Hatch Norfolk’s 1000-4 program, hoping it’d generate some business leads for me. Started attending their meetings, going to social events, etc.. The premise is sound, though I think some of the ideas are a bit off-the-wall, but I’m sure they think the same of my idea.

August:
I applied for jobs, and got referred for several positions locally, and in DC. One of those referrals was for a pretty sweet-sounding gig as a GS-13. On a whim, in order to keep my unemployment benefits coming in, I applied for a very low-level position dealing with a system I’d worked with previously I ran out of unemployment, and money was starting to get tight..

September:
One of the things I haven’t written much about in this tome is my struggles to find adequate dental care this year. The dentist I’d been seeing since 1996 finally closed his Norfolk office when the building he was in was demolished. He was only keeping hors on Friday down at what had been the first of three offices he opened. If/when I needed anything major done, he’d see me at his larger, modern office half an hour north. (where I’d seen him since high school) I went to one of the local larger practices while I was working for the four-letter after I’d lost a filling. The guy I saw had dollar signs in his eyes, then his office staff screwed up the billing. I messaged my primary care doc, and asked for a recommendation. His verdict? A friend of his up north of ODU. I went for a cleaning, had trouble wresting control of my records from the money-grubber practice. He fixed a small issue I had, then recommended I go back to see the guy who’d done all the work on me. Pfft. I scheduled an appointment with the old guy, which required a trip up with my wife, basicallly costing her an entire day. While I was waiting in the dental chair, I got a call from that thing I’d applied for months earlier. They needed me. As soon as possible. So, I took the gig, and cancelled the next two HR Geeks meetings. I also went to the Start Norfolk event, blew my pitch, and only attended about half the conference, being exhausted from work, etc..

October:
Still at this job. Not happy about it. Still digging hard on GS jobs, though I still haven’t gotten an interview. Now five have been cancelled, and twenty-some applications outstanding.

TLDR; it’s been a pretty lousy year, overall.

Heartbleed

I saw this on the full disclosure list Tuesday, but didn’t think much of it.

Yes, a lot of sites are affected. Yes, there’s potential for account hijack. Do you need to panic, as is HuffPo’s advicepanic? No. (And I’ll spare teh soliquily about how their operation make MSNBC and Fox look like bastions of crediblity….)

My understanding is that this was a bug that popped up sometime in the past couple of years. Surprisingly, if you’re running old stuff (or Microsoft nonsense) server-side, you’re unaffected.

It’s something that unless the sites were using the vulnerable version, and you changed your password while they were using the buggy version, and someone happened to be hijacking your session when you changed your password, then you might be vulnerable.

Do the math on the probabilities.

I’ll spare the schadenfreude about the commercial sekurity products affected because they used a buggy verison of OpenSSL, though *cough*McAfee*cough*Barracuda*cough* the temptation is tough to completely pass up.

Only so many spoons

Since I’m not using a lot of them working right now, my brain is moving at an insane rate in this late hour.

Before Shmoocon 2013, I’d started on a CFP response, inspired by Mouse’s talk the year before about active defense. My scarred-up brain started down this path after seeing Mudge’s keynote the last year at the Marriott (aka Snowmageddonpacolypsewhatever).

When he was talking from his carefully-sanitized slides, he showed a common host. It had eight vulnerabilities via a Retina scan.

Someone about four rows back raised his hand. Before he was really recognized to speak, he pointed out that at least three of them were HBSS vulnerabilities.

So, after musing on those two talks some, my premise was, essentially, that building monolithic systems increases the attack vector. So, what do you do? Throw something else on top of that monolith to protect it.

Once the attacker is around the defenses, he’s got a target-rich environment to exploit the system.

Unfortunately, as I was walking through the rebuttal I could expect from the audience, I came across an argument I couldn’t refute — some of these defenses do actually close some holes. While the overall vector may be bigger, it’s less vulnerable to some of the more common attacks.

As I’ve been listening to my wife dig through her math coursework, I’ve been thinking about what the equation on this would look like.

The vector calculation would need to include the overall attack risk of the base OS, each application installed atop the OS, minus the holes patched by the sekurity measures (whether hard or soft).

What are the most common NVD for the OS? Which are closed by the security measures? Of the remaining, what are the of exploit for each?

Busted-ass WinXP box has a 38% chance of getting 0wned in a month. It has Flash and Java installed on it, which raises the chance to 60%. It has SuperSEkurSoftFW installed, which brings the XP number down to 33%, and knocks two points off Java and Flash, leaving 51%.

I wish I had more math skills to write a nasty-looking equation for all this. *sigh*

But the overall concept remains — the less stuff you stack on a host, the smaller the overall vector, regardless of whatever security middleware you throw on it to plug holes.

And the end

I’m home. I wrote this on the train, but the Amtrak WiFi wasn’t working when I went to post. Later, I saw that someone had had pretty much the same take I had about the lack of IPv6….

Final Shmoosings.

The last presentation prior to the closing was a bit hard to take. They (and Squidly1) insist they’re the good guys, and network admins shouldn’t take steps to stop their active probes.

Maybe I’d feel differently if the probes were passive, but these aren’t. (Coming from Punk Spider.) To me, you’d be a fool to let them continue to scan your network with impunity.

Yes, the Koreans they’re scanning might well be idiots. It doesn’t make the intrusion okay!

It’s things like this that make me wish iptables or pf had a –reject-with-diaf-blast flag. For some, –with-tcp-reset isn’t sufficient.

Summing up:

1. They’re treading on thin ice with their active probes. If they were using passive sniffing, it’d be one thing, trying to scan the entre Internet is another matter, altogether.
2. But they’re not scanning the entire Internet! IPv4 is a deprecated legacy protocol. If they were doing any sort of v6 scanning, things might be slightly more intriguing. Over at Users and Icecube, we’ve been getting scanned normally a couple of times a week over v6. I’m pretty certain nothing’s come of it. Obviously Cawcks doesn’t give us a native allocation, so we’re using a tunnel broker, but it’d likely be the same with a native connection.

But even with the biggest AWS node the world’s ever imagined, they wouldn’t have the horsepoer to scan the entire Internet over v6. And more and more of the backbone traffic actually is going that way. Maybe you can stay ignorant of that fact, but it doesn’t take much research to verify.

Received: from mail.netbsd.org (mail.NetBSD.org [IPv6:2001:4f8:3:7::25])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(No client certificate requested)
by users.757.org (Postfix) with ESMTPS id 7C795A9B6
for ; Thu, 2 Jan 2014 03:48:56 -0500 (EST)
Received: by mail.netbsd.org (Postfix, from userid 605)
id 0E08A14A12D; Thu, 2 Jan 2014 08:48:50 +0000 (UTC)
Delivered-To: netbsd-users@NetBSD.org
Received: from localhost (localhost [127.0.0.1])
by mail.netbsd.org (Postfix) with ESMTP id A6E4114A12A
for ; Thu, 2 Jan 2014 08:48:45 +0000 (UTC)
X-Virus-Scanned: amavisd-new at NetBSD.org
Received: from mail.netbsd.org ([127.0.0.1])
by localhost (mail.NetBSD.org [127.0.0.1]) (amavisd-new, port 10025)
with ESMTP id 9RaUQzm2pzs7 for ;
Thu, 2 Jan 2014 08:48:45 +0000 (UTC)
Received: from korriban.imil.net (korriban.imil.net [IPv6:2001:470:cbba::3])

So, that was Shmoocon. More than willing to discuss over a beer if someone is interested.

You don't have a clue

Watched this. Take-aways:

    I’m going to blame the speaker for being a Failcons’ fan. No, I don’t know that for sure, but he is from Georgia.
  • Rules of Evidence aren’t just a judge’s whim.
  • “Putting the air inside ping-pong balls is kind of an old school black programs inside joke.

Not going to hate too much, because it’s unfair.
1. Judges don’t just make snap decisions on evdience admissibility. These things are published. Since you don’t know that, it’d be smart for lawyers on both sides to try to exclude your evience just because you might testify.
2. The presentation focuses on admissibility of physical disks, and the data stored on them. Hashing ca work at the file level, then the machinations of what’s going on underneath aren’t important anymore. My question was: why would you ever go lower than the lowest admissible layer?
But I’m not going to hate too much. The last presentation is going on right now.

You don’t have a clue

Watched this. Take-aways:I’m going to blame the speaker for being a Failcons’ fan. No, I don’t know that for sure, but he is from Georgia.

  • Rules of Evidence aren’t just a judge’s whim.
  • “Putting the air inside ping-pong balls is kind of an old school black programs inside joke.

    • Not going to hate too much, because it’s unfair.

    1. Judges don’t just make snap decisions on evdience admissibility. These things are published. Since you don’t know that, it’d be smart for lawyers on both sides to try to exclude your evience just because you might testify.
    2. The presentation focuses on admissibility of physical disks, and the data stored on them. Hashing ca work at the file level, then the machinations of what’s going on underneath aren’t important anymore. My question was: why would you ever go lower than the lowest admissible layer?

    But I’m not going to hate too much. The last presentation is going on right now.

    Going for Broke

    Went and watched about forty minutes of this. After that long of the speakers not getting to the point about how they’re making attackers’ activities expensive, I gave up and left.

    Wow, that’s an awesome app signature tool you found in your Microsoft class! I’m sure its mere existence dissuades people from trying to write malicious things. I mean, it’s totes hard to get a copy of VS!

    Yes, you have to make it difficult for malicious stuff to run. I understand that. How are you costing the attackers anything? Their shit won’t run on your network; how are you costing them money, really? Quantify it.

    For things like malicious embedded attachments, bouncing group messages indiviually would quickly fill thier mail queues. Maybe an automated method to report them to ISC, get them added to blacklists galore?

    SMH.

    Two More

    I did get one response on Twitter about my keynote reax. I’ve written about Eddie the Ops Guy before, and don’t have much to say about him. Many of the “revelations” should be things people have long suspected.

    From my perspective, the question isn’t so much if or whether this sort of thing is done — it’s how much of it is admissible in court. Are people losing lives or property because of it? That’s a question the detractors seem to shy away from. To put it another way, I’ll be upset when Chris Dodd starts getting geoloc data, and the Air Force starts targeting Kim Dotcom.

    Schneier’s talk also focused on more encapsulation of data to prevent the government’s prying eyes. I think it’s something you can spend a bunch of time and money on without terribly concrete results.

    Would it be more effective to increase the data volume, making juicy things tougher to find? Go ahead and seed that UbuububububububnttuDebian Testing torrent. In 2GB chunks, it wouldn’t surprise me if it has the same effect as a 25M DB dump.

    Obviously, he’s got a lot of credibility in the Infosec world, so I won’t judge too harshly. I am slightly disappointed at the lack of political analysis, though. I can recall 2009, when the fresh-faced kids were all abuzz about how this new president was going to be fundamentally different. How quickly people forget.

    I also watched the talk on USB Mass Storage devices. Good talk, though I don’t have the time, money, or energy to do any of that stuff, myself, anymore. I never’d considered the information about the flash drives being downsized to meet the advertised capacities. Makes sense, but, just something I’d never thought of.

    I wonder if the same is true of SATA solid state drives; might could do some interesting things, then, if so….

    I sat in on the first part of DJB’s elliptical curves talk. Unfortunately, my body wasn’t cooperating with me, and it was reminding me of my futile attempts to help my wife with her calc homework earlier this week.

    The maths — they are not my strength.

    Hardware Crypto

    I went to see this after seeing this story a few weeks back.

    In my current gig (and I’m still more than open to something else *hint*), I’m planning to use these sorts of things for something.

    I guess what I was looking to see was whether it might still be possible to use these sorts of hardware crypto devices to augment software, even if they’re insecure. Yes, with my BSD mention, you might think that I’m a gray-bearded fat guy, but, I do remember the FDIV Bug. Even if you somehow still have one of those chips, there’s ways to work around the bug, but still use the co-processor, not turning your Pentium into a 586SX.

    I was hoping to see plans for something like that. On the lesser platforms that lack a buggy crypto device, you can still do everything in software.

    No dice; this was focused more on enterprise-grade crypto jank. Very few people ever find themselves using such hardware. Ever.

    But the presentation was still pretty good. I just think the target audience was rather limited.