Between Two Ferns

The final talk headed in to the closing.

These, plus discussions I had with friends afterward, kind of left me scratching my head.

A few things.

Bruce repeatedly implored people to try to get women and young people involved in the Infosec industry.

I think there was another instance where I really railed against predetermining outcomes in populations.

This is one of the areas where my frequent consumption of the Ancaps comes in. There’s no way to determine what the future IT labor force should look like.

Even more, it’s a waste of time to try.

Unfortunately, we’ve got this model that’s completely incapable of responding to whatever comes along.

I came from an industry, broadcasting, that’s nearly dead today. How many Boomers ended up in print journalism because they were really enamored with what Woodward and Berstein did with Watergate?

I knew a few of those folks when I was still in radio. They were making a career transition as the print media started dying. Most of them were ending up in sales.

Those lasted until the broadcast industry died, too.

A cynic might say, well, maybe it’s those people. No, I’m not going to go there. They’re good folk. But the audiences have changed, and they don’t have the stranglehold on the consumers the way that they used ot.

Higher education has a similar problem. I’ve talked about it, myself. I’m one of the last folks in Generation X. There weren’t very many of us to begin with, and with everyone worried about AIDS when we were reaching sexual maturity, we didn’t accidentally many babby.

So, those kids we didn’t have are filling up colleges. OK, Boomer, you’ve got tenure, and are planning on charging $100K for a BA in something?

Or how about a crash-course that lets you pass the minesweeper match to get letters after your name?

I also think of friends and acquaintanceship who paid a ton of money to buy a vendor’s certification.

I recall picking up a dated box from my old employer, and having a coworker absolutely amazed that it served as an email host for something like six domains without an expensive Microsoft license.

Uh, it runs FreeBSD, Exim, and Courier IMAP.

So you’re not running Exchange??!?

Uh, no.

I worry that pushing people towards security careers might be akin to pushing them towards careers in print journalism in 1996.

Would establishment higher even be able to produce people who can just pass multiple choice test, people who’ve the ability to adapt to whatever changes arrive on the scene?

I’m even more skeptical about that than I am about the idea that sparking interest in a particular part of an industry will increase the current interest in it, and entrench it for the future.

I was on the air when the millennium flipped with CBS Radio over a phone couplet.

I was ready to stay live if the communications failed when the clock flipped to 2000.

You might think that the experience I had, and the education I was recieving at the time would have me set up for life.

Yeah, about that.

The market will dictate demand. Whether or not that demand is met is not something that can be planned ahead of time.

So, there’s not a ton of young people terribly interested in locking down Windows servers.

Give me a minute to find the fuck I’m not giving. The company that employs me now have moved all that sort of stuff “to the cloud.”

So everyone who paid a ton of money to “obtain those skills” is now unemployable, in a ton of debt.

I got in a pretty passionate conversation for a few minutes, there.

But things are not designed the way they were in 2005. Or 2010. Or 2015.

Security is a part of everything.

The days of a squadron of firemen there to deal with problems introduced by designers not the least bit concerned about security isn’t a problem now, or in the future.

So why are we worried about the kids being interested?

About as interested as my millennial wife was when I showed her how to queue both a 45 and a 33 so they’d start cleanly. Just hit the triangle icon on the app you’re using.


Apologies for the rant. I did enjoy my time at Shmoocon.

I enjoyed being able to support a student’s attendance.

I enjoyed my time alone in the hotel where I could collect some of my thoughts and write.

Since I’m kind of beyond the point where I can really get around comfortably, I may just watch the stream next year, and write.

We’ll see.

Searching Your Jank

First Sunday talk.

Quite a bit of discussion about Russian botnet influence in 2016 election.

I posted something in the Slack channel about her being unhinged at one point.

Nobody has provided any evidence that what the Russian botnets did changed a single vote.

Wired had the best synopsis of what Muller’s indictments included, but even that doesn’t show that anyone was convinced not to vote for Hillary.

The majority of people who voted in the 2016 election voted for someone other than Hillary (including me; no, I didn’t support the President, but I definitely voted against Mrs. Clinton.)

She also had an implicit contention that the rash of stories about evidence of governments being agencies being afflicted with ransomware induced people to not vote.

Wait, what?

The local water department got hacked, so I’m not going to vote.

Lots of skepticism, there.

The third thing was a forceful encouragement to go vote.

While I normally do vote, for most of my life, I’ve gone specifically to vote against a particular candidate (see 2016, where I went to vote against Hillary and Trump).

I’ve also heard Katherine Mangu-Ward make several compelling arguments against voting. She wrote about this back in 2012.

As someone with views that don’t neatly-align with either of the two major parties, I appreciate it more these days.

It leads me to give credence to the Ancaps’ argument that maybe we’d all be better off with less government.

I worry a lot about what’s going to happen to me, personally, if on eof the Medicaid For All (yes, I know they call it Medicare, but it’ll be Medicaid). People like me will just not be treated, aside from palliative care.

Solu-metrol is cheap. So are various oral analgesics. Add in anti-depressants, and all is good. Worry less about the long-term effects; maybe we’ll die sooner, and save money.

Any publicity is good publicity

Next up was this one.

I was thinking about it as I listened to some of the systems engineers go back and forth about application of statistical analysis over my cube wall.

I did do this sort of thing previously.

I know that I’ve avoided some companies that have paid big settlements due to data leaks/breeches.

In so many instances, there’s settlements — you’ll get free credit monitoring for 24 months!

But what does one of these incidents do to a company’s share price?

NOT MUCH.

Completely counter-intuitive, really.

I was wondering afterwards whether there might be some sort of window where there’d be a chance to make money on a short.

As I’ve considered that more, however, I don’t care. There’s no quick way where I could make a buck and feel okay with it.

Last of the night

Watched the panel my Twitter friend moderated.

I had three main takeaways from the talk, two of which are the same thing.

  1. There was a strong contention that information shared with the media prior to the polls closing negatively affected voter turnout, and;
  2. The contention that information problems in other parts of government negatively affected voter turnout.

To reference my fellow CNU alumnus, https://i2.kym-cdn.com/entries/icons/medium/000/001/865/wikipedian_protester.png

I can see how that it might be commonly-thought that this is true, but where is the evidence to substantiate it?

Find me five people who are dissuaded from voting because the water utility’s shit got caught up in ransomware hell. I’ll be waiting.

The idea about media surpression, of course, is a flashback to Florida in 2000, where the media outlets were reporting, before the polls closed in East Alabama, that Gore had won the state.

Except, of course, that doesn’t really fit the narrative, considering how Republican the voters there are. So if the media had said Gore had won, Bush would have won by less?

(I kid about East Alabama. My wife was downloaded in the panhandle, I along the Space Coast. Neither of us would ever willing claim any Florida heritage.)

The third one I took issue with was the never-ending “go vote” mantra.

Listen, for some people It doesn’t matter in the least based on where they live.

I write this from Washington, DC; when’s anything other than a Democrat ever going to win here?

Never.

I will admit that my views on this have been greatly influenced by another DC resident, Katherine Mangu-Ward. Essentially, she said that if government is legitimate because it has the consent of the governed, if you refuse to provide consent by not voting, it isn’t okay for that government to exercise power over you.

So, yeah, I was gesticulating wildly in the back.

Hillary lost. It wasn’t because of the Russians. It wasn’t because of suppression efforts. She lost because she was a horrible candidate.

Nothing can be done that will change that fact, and any attempts made to remedy a problem that doesn’t really exist, will only serve to make elections worse.

Even More Moose than ever

I did blast off earlier about the nonsense I head with the DNS over HTTPS (somewhat appropriately initialized as “DOH.”)

The speaker summed it up pretty well in a Tweet response.

But on to today since we’re on a lunch break.

I’m going to go in reverse order since I have my notes on the last one up and in front of me. First up, since it’s freshest in my mind is this.

I did speak to the speaker following the address. My comments in the Slack channel were met with both bemusement and curiosity.

She got to the point of complete derangement toward the end. My initial question to her was whether the Russian disinformation campaign strategy she outlined actually makes a compelling argument agains “experience” candidates.

Though I didn’t vote for him in 2016, I find President Trump’s path to the White House fascinating.

Yet there’s a school of thought that says that he wouldn’t be there if the Russians hadn’t meddled.

Yes, that’s Sister Rachel The Woke’s line almost every single night on MSNBC.

There’s not a single thing that she, Chuck Todd, or anyone in the tech heads cabal can do to change that.

A magical meeting with Zuckerberg, et. al. won’t make sure the establishment’s anointed candidate is the plurality winner next time, either.

I could go on for hours about this, but what’s the point?

None of these be-all, end-all solutions is going to convince people that writing down passwords is a really bad idea, or that you would never get an email telling you where to change your password.

Immediately before that, I checked in to the hotel, and took a nap. I’m running on fumes. Maybe I should eat something. Or something.

But before check-in and nap, I watched this. Perhaps that influenced my thinking in the later one.

So much of what’s going on is conventional approaches to new problems.

Harkens back to one of Mouse’s presentations a few years ago about the Maginot Line.

Stop doing what you’ve always done, and be reactive in defense based on what the situation presents.

That is all for now. Off to watch more. More writing tonight, I’m sure.

Not doing myself any favors

I came home, and watched the rest of the presentations today.

I wasn’t feeling well. No, I don’t think I’ve got Coronavirus.

But the last firetalk was on this stupid stuff Mozilla’s (and others) have is doing with DNS-over-SSL.

The speaker brought up Cloud Flare as the DNS-over-SSL provider.

So I had to go look at the interview again.

Fuck the Neo-Nazis. But fuck guys like that, too.

Remember (or more Shmoo)

Cats hate people, and would kill them if they were big enough to do so.

Listening to this one, which ended up being more about ยง230 of the Communications Decency Act of 1996.

I’m not sure what to say about it. I get sidetracked by thinking about my idea that every law should expire after a fixed amount of time, and every regulation based on that law should similarly expire in a fixed period of time.

Then we wouldn’t have to worry about a law that’s nearly a quarter-century old in the case of the CDA.

Or care at all about any of the bad things that passed during the Wilson Administration. (See: The Jones Act, which is very bad for Hawaii and Puerto Rico).

Congress wants lots of content on the Intertubes. Well, the right content. You know, not bad stuff like prostitution ads, or kiddie pr0n.

Or Alex Jones; won’t someone think of the frogs??!?

Is there an answer? I’m skeptical, and it’s a lot easier for these 535 people to not work at all than to do anything that might not be permanent and effective.

Does there need to be protection for platforms? Yes. Are there some real problems with platforms? Yes. Have there been some instances where platforms are really overreacting due to both political and corporate pressure?

Absolutely.

The next one was this. As someone who’s not a professional code-slinger, I was having a bit of trouble following completely, and staying interested.

The commentary accompanying the livestream was fascinating.

I participated.

It is really incredible what people are doing with client-side code.

*slips on a-hole Sekurity Mastar pants*

You can fix a lot of that stuff with centralized management.

DoD, something which I am all too familiar, has managed to render nearly COTS browser basically unusable.

I’m actually okay with this.

And the next one. Very good talk, but I’m not sure I understand enough about where the “spam” calls are coming from to know whether this would actually be an effective solution.

It would seem to me that having a client/gateway setup would be nearly as effective. You could authenticate the device using something like a hardware token, then do the traffic over L2TP.

I understand there’s overhead there.

I also know that pure SIP voice traffic consumes very little bandwidth. Hell, I was doing GSM calls over a 9600bps INMARSAT connection nearly fifteen years ago.

Yes, the quality sucked.

But that was true of lots of things in 2006.

What this protocol does is encrypt the data channel, so very much like what would happen over L2TP.

Six of one, half-dozen of the other, I suppose.

Not going to write about the Firetalks. Just listen.

And the last one about robots storing data. Pepper and Mao isn’t a dish at your favorite Chinese joint.

Questions about privacy policy application; the robots are owned by someone else, and the data is sent offsite.

And you wonder why I don’t have an Alexa. Or why Siri is disabled on my Apple devices.

Her main point is she has concerns.

Maybe I’ll be feeling well enough to sit through things in person tomorrow.

I’m done for now. Hopefully I’ll be feeling well enough to venture in to the District for tomorrow’s talks.

Shmoo II; wildlife boogaloo

Watched the stream of this on moose and woodchucks.

I guess my big take-away is that in situations like that, increasing the size of the dataset actually probably does improve results.

The problem you run into, and I didn’t hear her address, is that eventually your dataset exceeds what you’ve got to analyze it.

You could build something that’s damn near perfect in differentiating between woodchucks and moose, but does that matter when it takes three years to do the analysis?

So Shmoo

Sitting around waiting for my short bus ride off to Shmoocon.

We’ll see how it goes.

My plan for this year is to watch, take notes, then write.

I think the past couple of times I went I laid out all the things I was going to see ahead of time, and wrote pretty much as I went.

Then I’d inevitably end up going to see something different than I’d originally planned.

I’ve perused the schedule, and put them in my phone calendar.

But there may be changes.

I just need to start drafting something as I sit there, then complete it after the talk.

I don’t have a hotel room for tonight, so I may have to take the WMATA Short Bus home tonight. We’ll see.

So off to it….

Six

This talk wasn’t any better than the sixth.

I understand the idea of encrypting all traffic, but it relies on two assumptions:

  1. All traffic needs to be private, and;
  2. End-user connectivity is every-expanding.

Let’s look at those assumptions one-by-one.

What’s the problem if I fetch Facebook’s favicon.ico? Why does that need to be private? There’s lots of things that people do online that aren’t the least bit objectionable. Does it matter to anyone that I ordered Pizza Hut for dinner last night? Whatever. I brushed my teeth twice yesterday, too, and used different brands of toothpaste. (The tube I took to Shmoocon was still in the suitcase, so I used the other one in the bathroom.)

Perhaps if I was looking at some nice, wholesome porn, I wouldn’t want people to know about it, but for the vast majority of my Internet use, I really couldn’t care less who could see. That that favicon.ico gets fetched multiple times per day by multiple people on my network is not a problem. Maybe there should be a way to cache that common content, so it doesn’t have to be fetched from the source every time. Like a shared cache? Squid, perhaps? Oh, but that doesn’t work when all content is encrypted. My professional experience shows that there’s many times when bandwidth availability does not increase, which brings me to point two.

There’s lots of instances where, despite your cable company bumping your cable modem speed, significantly that bandwidth has not increased.

In one of my not-too-distant past projects, we had remote sites connected by a 9600bps satellite connections. Much of the bandwidth available on these fifteen-minute-per-hour connections was spent just sending and receiving SMTP traffic How much less traffic would have been exchanged with the encryption overhead? Yes, maybe, there’s faster methods of communication available that would enable encrypted communications, but there’s also contracts in place binding payment of the slow services for years to come. Even on the ground, there’s contracts with telcos that can’t be broken, even in light of faster options. So maybe having cashe-friendly web content, and unencrypted email makes sense there? Maybe?

The EFF, and the blind promotion of arcane “net neutrality” rules don’t take any of that into consideration; they assume everyone is using a fast cable modem, or US-based cell network. No, there’s tons of people who aren’t.

So the solution is to hand the decision-making process over to an unelected group of bureaucrats relying on technology from the middle of last century?

GMAFB.

But, then, I guess I’m just not woke enough to know that I’m paying less for my mobile phone with far better data than I was before NN was repealed. Sorry ’bout that. I suppose, also, that the places with defined contracts also got faster with the FCC controlling things. Oh, they did. Totally. Those 9600bsp connections are now 10M full-duplex. Guess I missed that.