Category: Uncategorized

Two More

I did get one response on Twitter about my keynote reax. I’ve written about Eddie the Ops Guy before, and don’t have much to say about him. Many of the “revelations” should be things people have long suspected.

From my perspective, the question isn’t so much if or whether this sort of thing is done — it’s how much of it is admissible in court. Are people losing lives or property because of it? That’s a question the detractors seem to shy away from. To put it another way, I’ll be upset when Chris Dodd starts getting geoloc data, and the Air Force starts targeting Kim Dotcom.

Schneier’s talk also focused on more encapsulation of data to prevent the government’s prying eyes. I think it’s something you can spend a bunch of time and money on without terribly concrete results.

Would it be more effective to increase the data volume, making juicy things tougher to find? Go ahead and seed that UbuububububububnttuDebian Testing torrent. In 2GB chunks, it wouldn’t surprise me if it has the same effect as a 25M DB dump.

Obviously, he’s got a lot of credibility in the Infosec world, so I won’t judge too harshly. I am slightly disappointed at the lack of political analysis, though. I can recall 2009, when the fresh-faced kids were all abuzz about how this new president was going to be fundamentally different. How quickly people forget.

I also watched the talk on USB Mass Storage devices. Good talk, though I don’t have the time, money, or energy to do any of that stuff, myself, anymore. I never’d considered the information about the flash drives being downsized to meet the advertised capacities. Makes sense, but, just something I’d never thought of.

I wonder if the same is true of SATA solid state drives; might could do some interesting things, then, if so….

I sat in on the first part of DJB’s elliptical curves talk. Unfortunately, my body wasn’t cooperating with me, and it was reminding me of my futile attempts to help my wife with her calc homework earlier this week.

The maths — they are not my strength.

Hardware Crypto

I went to see this after seeing this story a few weeks back.

In my current gig (and I’m still more than open to something else *hint*), I’m planning to use these sorts of things for something.

I guess what I was looking to see was whether it might still be possible to use these sorts of hardware crypto devices to augment software, even if they’re insecure. Yes, with my BSD mention, you might think that I’m a gray-bearded fat guy, but, I do remember the FDIV Bug. Even if you somehow still have one of those chips, there’s ways to work around the bug, but still use the co-processor, not turning your Pentium into a 586SX.

I was hoping to see plans for something like that. On the lesser platforms that lack a buggy crypto device, you can still do everything in software.

No dice; this was focused more on enterprise-grade crypto jank. Very few people ever find themselves using such hardware. Ever.

But the presentation was still pretty good. I just think the target audience was rather limited.

Shmoo Keynote Reax

Disclaimer: I nodded off, and missed the first fifteen minutes of it.

With that said, I have doubts about whether it could have been much better than what I actually did see. Maybe somebody will tell me what amazing things I could have seen there that I failed to see in the last 45.

Major take-aways:

  • Most applications use insecure communications
  • Edward Snowden figured out that TOR isn’t sekur
  • TPM is infiltrated
  • A brower makes it harder to use a self-signed cert than it is for someone malicious to get a signed cert that the browser won’t complain about
  • Hardware manufacturers are lazy
  • Fuck you, right? Okay?

Yes, the last one is snark pure and simple, but it is one of my pet peeves. No, actually it isn’t right, and what you said doesn’t get smart just because you asked me if it was right after you said it.

My two major points:
1. Not all communications need to be secure, even if many endpoint devices have the muscle to support that. There’s a reason SIP uses UDP. There’s also a reason your mother uses http:// when she watches that cute cat video for the eightieth time.
2. It’s completely unrealistic to expect vendors to change to meet your amazing idea about the way things ought to be done.

Early Shmoocon Thoughts

I’m kind of hanging back in the room until the keynote, after watching the opening.

A single thought comes to mind — maybe the thing was better last year just because the “break it” track was gone?

One of the things that really bothered me a couple of years ago was the focus on destruction. To me, so much emphasis is placed on building these monolights that destruction becomes job number one

Maybe in the past it was smart to worry about how to get rid of things, keep them from prying eyes. I really wonder now if that’s true.

Thinking about my own gear I have with me. I get hacked, and…? Congratulations, you got some of my music library, and endless revisions of my resume.

Getting the former might entice you to go see them play a show. Getting the latter might entice you to call me for an interview. And?

The keynote appears to be about what steps you, as an individual, can take to prevent getting pwned. Guess what — you can’t completely avoid it, short of moving to a cabin somehwere in Montana. If the speaker focuses on what strategies are most effective, it’ll be a worthwhile talk.

I’m not holding my breath, intentionally, at least. (My diaphragm does its own thing from time to time.) I’d like to see something where someone actually does the research to quantify the risks and effectiveness.

So, your endpoint device is locked down tight? Give me a minute to find the fuck I’m not giving since nothing important is stored there these days.

Sunday Discontent

I’m not sure why I write more on Sundays. Football is on right now, but I really don’t care; I will root for whoever the AFC sends. Was disappointed in the Saints yesterday, but…. I will say this: Harbaugh and Steve Smith manage to make the Seachickens look downright classy.

Perhaps I write because I have time to reflect on what happened the week before. I marvel at some people’s commitment to doing the wrong thing, despite being shown what the right thing is. (And rant about willful ignorance redacted. I haven’t bought enough professional certifications to make my observations relevant. My experience is unimportant.)

Perhaps I’m fretting about the week to come.

Take your pick.

Feelin' Kinda Sunday

About to go out to brunch. Have enjoyed my time off, but still have a few more days. Am I recharged? I don’t know.
One of my colleagues posted this drivel about how one of the keys to success was not even looking at your email while you’re “off.” Along with working out, physically, during your lunch hour.
The corollary? If you can take more than a couple of days’ break without your input being missed, your input probably wasn’t that important in the first place. Just a hunch.
I do look at my email. I do answer the telephone. If that’ll make me unsuccessful in my career at a big company, I’m okay with that. I care more about being a good person able to look at himself in the mirror than I do about a fancy resume.
I also care a lot about putting out quality work — that makes me a liability; I’m pushing back.
But enough of that for now. There’s football I need to watch. The Failcons are doing what they do at halftime. Pfft.

Feelin’ Kinda Sunday

About to go out to brunch. Have enjoyed my time off, but still have a few more days. Am I recharged? I don’t know.

One of my colleagues posted this drivel about how one of the keys to success was not even looking at your email while you’re “off.” Along with working out, physically, during your lunch hour.

The corollary? If you can take more than a couple of days’ break without your input being missed, your input probably wasn’t that important in the first place. Just a hunch.

I do look at my email. I do answer the telephone. If that’ll make me unsuccessful in my career at a big company, I’m okay with that. I care more about being a good person able to look at himself in the mirror than I do about a fancy resume.

I also care a lot about putting out quality work — that makes me a liability; I’m pushing back.

But enough of that for now. There’s football I need to watch. The Failcons are doing what they do at halftime. Pfft.

Out of sync

I am when it comes to writing. It’s a combination of a paucity of available time, combined with unfamiliarity with my new tools. If I was getting paid to write, I’d probably be more attentive to it, but….

Money does enter the equation. I will never be satisfied delivering something that is of poor quality just so that I can get paid, especially when I do understand what good quality is. I will deliver something that’s not up to my standards if it meets the needs of those to whom it’s actually delivered.

Splitting hairs, perhaps. Maybe there’s some letters after my name I could buy that’d teach me to get over it.

On a somewhat related note, big media is reporting that RSA took payment to keep inferior products insecure. But it costs a lot so it must be goot! *sigh*

RSA

What can you say? Better products and methods are out there, but they don’t buy the colored shirts with white collars, pay the rental note from the bank, etc..

And God forbid someone actually spend the time and money engineering something different, better. Can’t have that.

“You’re pushing back.”

Saturday musings

This, like the past several, has been a rather trying week.

Previously, I’ve written copiously about how doing the wrong thing faster doesn’t suddenly make it the right thing.

I’m still seeing a lot of that. But buying additional letters after the doers’ names makes it more better, right?

I really don’t think there’s a way to fix this situation cleanly. I do admire some of the dedication I’ve seen with people I’m working with; others aren’t worth the C-4 it’d take to blow them up. It is what it is.

Speaking of that, in light of this evening’s game, Go Army!

Other stuff….

HR Geeks bordered on epic failure with the movement to Norfolk. I did like the food at Belmont, and would have spent more, but they didn’t have any lids for the growler of beer I ordered. *sigh*

My wife is registered for classes during the spring semester at ODU. Was kind of strange being at the transfer orientation in among a bunch of parents, many of whom were worried about their kids gettin’ it on (both voluntarily and involuntarily), snooping on grades, etc. I think I may have been the only spouse in the crowd.

Do I have a point with this entry? Not really, but then my blog sucks. I just need to get back into the swing of writing; it’s always been something cathartic for me.

Quiet

I have been since the end of NoJoMo. Perhaps I’m spent. Who knows?

I think one thing I have learned as I get older is that you don’t want to get caught pontificating about things you don’t understand. This is especially true when you’re dealing with people who are more knowledgable than you.

Do I judge/ Yes. Do I change my mind? Yes, if new evidence comes to light.

Maybe I don’t have the salesman’s flair to persist in being wrong.

Personality flaw, I suppose.