Author: sean

Next up was this one.

I was thinking about it as I listened to some of the systems engineers go back and forth about application of statistical analysis over my cube wall.

I did do this sort of thing previously.

I know that I’ve avoided some companies that have paid big settlements due to data leaks/breeches.

In so many instances, there’s settlements — you’ll get free credit monitoring for 24 months!

But what does one of these incidents do to a company’s share price?

NOT MUCH.

Completely counter-intuitive, really.

I was wondering afterwards whether there might be some sort of window where there’d be a chance to make money on a short.

As I’ve considered that more, however, I don’t care. There’s no quick way where I could make a buck and feel okay with it.

Watched the panel my Twitter friend moderated.

I had three main takeaways from the talk, two of which are the same thing.

1. There was a strong contention that information shared with the media prior to the polls closing negatively affected voter turnout, and;
2. The contention that information problems in other parts of government negatively affected voter turnout.

To reference my fellow CNU alumnus, https://i2.kym-cdn.com/entries/icons/medium/000/001/865/wikipedian_protester.png

I can see how that it might be commonly-thought that this is true, but where is the evidence to substantiate it?

Find me five people who are dissuaded from voting because the water utility’s shit got caught up in ransomware hell. I’ll be waiting.

The idea about media surpression, of course, is a flashback to Florida in 2000, where the media outlets were reporting, before the polls closed in East Alabama, that Gore had won the state.

Except, of course, that doesn’t really fit the narrative, considering how Republican the voters there are. So if the media had said Gore had won, Bush would have won by less?

(I kid about East Alabama. My wife was downloaded in the panhandle, I along the Space Coast. Neither of us would ever willing claim any Florida heritage.)

The third one I took issue with was the never-ending “go vote” mantra.

Listen, for some people It doesn’t matter in the least based on where they live.

I write this from Washington, DC; when’s anything other than a Democrat ever going to win here?

Never.

I will admit that my views on this have been greatly influenced by another DC resident, Katherine Mangu-Ward. Essentially, she said that if government is legitimate because it has the consent of the governed, if you refuse to provide consent by not voting, it isn’t okay for that government to exercise power over you.

So, yeah, I was gesticulating wildly in the back.

Hillary lost. It wasn’t because of the Russians. It wasn’t because of suppression efforts. She lost because she was a horrible candidate.

Nothing can be done that will change that fact, and any attempts made to remedy a problem that doesn’t really exist, will only serve to make elections worse.

I did blast off earlier about the nonsense I head with the DNS over HTTPS (somewhat appropriately initialized as “DOH.”)

The speaker summed it up pretty well in a Tweet response.

But on to today since we’re on a lunch break.

I’m going to go in reverse order since I have my notes on the last one up and in front of me. First up, since it’s freshest in my mind is this.

I did speak to the speaker following the address. My comments in the Slack channel were met with both bemusement and curiosity.

She got to the point of complete derangement toward the end. My initial question to her was whether the Russian disinformation campaign strategy she outlined actually makes a compelling argument agains “experience” candidates.

Though I didn’t vote for him in 2016, I find President Trump’s path to the White House fascinating.

Yet there’s a school of thought that says that he wouldn’t be there if the Russians hadn’t meddled.

Yes, that’s Sister Rachel The Woke’s line almost every single night on MSNBC.

There’s not a single thing that she, Chuck Todd, or anyone in the tech heads cabal can do to change that.

A magical meeting with Zuckerberg, et. al. won’t make sure the establishment’s anointed candidate is the plurality winner next time, either.

I could go on for hours about this, but what’s the point?

None of these be-all, end-all solutions is going to convince people that writing down passwords is a really bad idea, or that you would never get an email telling you where to change your password.

Immediately before that, I checked in to the hotel, and took a nap. I’m running on fumes. Maybe I should eat something. Or something.

But before check-in and nap, I watched this. Perhaps that influenced my thinking in the later one.

So much of what’s going on is conventional approaches to new problems.

Harkens back to one of Mouse’s presentations a few years ago about the Maginot Line.

Stop doing what you’ve always done, and be reactive in defense based on what the situation presents.

That is all for now. Off to watch more. More writing tonight, I’m sure.

I came home, and watched the rest of the presentations today.

I wasn’t feeling well. No, I don’t think I’ve got Coronavirus.

But the last firetalk was on this stupid stuff Mozilla’s (and others) have is doing with DNS-over-SSL.

The speaker brought up Cloud Flare as the DNS-over-SSL provider.

So I had to go look at the interview again.

Fuck the Neo-Nazis. But fuck guys like that, too.

Cats hate people, and would kill them if they were big enough to do so.

Listening to this one, which ended up being more about §230 of the Communications Decency Act of 1996.

I’m not sure what to say about it. I get sidetracked by thinking about my idea that every law should expire after a fixed amount of time, and every regulation based on that law should similarly expire in a fixed period of time.

Then we wouldn’t have to worry about a law that’s nearly a quarter-century old in the case of the CDA.

Or care at all about any of the bad things that passed during the Wilson Administration. (See: The Jones Act, which is very bad for Hawaii and Puerto Rico).

Congress wants lots of content on the Intertubes. Well, the right content. You know, not bad stuff like prostitution ads, or kiddie pr0n.

Or Alex Jones; won’t someone think of the frogs??!?

Is there an answer? I’m skeptical, and it’s a lot easier for these 535 people to not work at all than to do anything that might not be permanent and effective.

Does there need to be protection for platforms? Yes. Are there some real problems with platforms? Yes. Have there been some instances where platforms are really overreacting due to both political and corporate pressure?

Absolutely.

The next one was this. As someone who’s not a professional code-slinger, I was having a bit of trouble following completely, and staying interested.

The commentary accompanying the livestream was fascinating.

I participated.

It is really incredible what people are doing with client-side code.

*slips on a-hole Sekurity Mastar pants*

You can fix a lot of that stuff with centralized management.

DoD, something which I am all too familiar, has managed to render nearly COTS browser basically unusable.

I’m actually okay with this.

And the next one. Very good talk, but I’m not sure I understand enough about where the “spam” calls are coming from to know whether this would actually be an effective solution.

It would seem to me that having a client/gateway setup would be nearly as effective. You could authenticate the device using something like a hardware token, then do the traffic over L2TP.

I understand there’s overhead there.

I also know that pure SIP voice traffic consumes very little bandwidth. Hell, I was doing GSM calls over a 9600bps INMARSAT connection nearly fifteen years ago.

Yes, the quality sucked.

But that was true of lots of things in 2006.

What this protocol does is encrypt the data channel, so very much like what would happen over L2TP.

Six of one, half-dozen of the other, I suppose.

Not going to write about the Firetalks. Just listen.

And the last one about robots storing data. Pepper and Mao isn’t a dish at your favorite Chinese joint.

Questions about privacy policy application; the robots are owned by someone else, and the data is sent offsite.

And you wonder why I don’t have an Alexa. Or why Siri is disabled on my Apple devices.

Her main point is she has concerns.

Maybe I’ll be feeling well enough to sit through things in person tomorrow.

I’m done for now. Hopefully I’ll be feeling well enough to venture in to the District for tomorrow’s talks.

Watched the stream of this on moose and woodchucks.

I guess my big take-away is that in situations like that, increasing the size of the dataset actually probably does improve results.

The problem you run into, and I didn’t hear her address, is that eventually your dataset exceeds what you’ve got to analyze it.

You could build something that’s damn near perfect in differentiating between woodchucks and moose, but does that matter when it takes three years to do the analysis?

I’m watching the livestream from home because I’m not feeling well, and don’t have a bed tonight.

Of course, a lot of the standard administrivia, but Bruce did hit on some of the sorts of things I’ve been thinking and writing about for a long time.

For the vast, vast, vast majority of organizations, Infosec is a parasitic function on another parasitic function.

McDonalds doesn’t exist to do Infosec; don’t treat the folks behind the counter like morons because they don’t do Infosec.

I sure as hell couldn’t make the pink goo be very edible; why would I presume the guy who can is an idiot because he has to write down his 95-character password?

It is a tool that lets people do what they’re hired to do more effectively. If it gets to the point where we’re keeping them from operating at all, why the hell are they paying us?

And the next talk is starting, so I’m gonna go.

Sitting around waiting for my short bus ride off to Shmoocon.

We’ll see how it goes.

My plan for this year is to watch, take notes, then write.

I think the past couple of times I went I laid out all the things I was going to see ahead of time, and wrote pretty much as I went.

Then I’d inevitably end up going to see something different than I’d originally planned.

I’ve perused the schedule, and put them in my phone calendar.

But there may be changes.

I just need to start drafting something as I sit there, then complete it after the talk.

I don’t have a hotel room for tonight, so I may have to take the WMATA Short Bus home tonight. We’ll see.

So off to it….