Archive for the ‘Geek’ Category

Christmas is coming, the goose is getting fat…

Wednesday, December 12th, 2018

…please put a penny in the old man’s hat.

Or, you know, buy some books. (Yes, most of these links are Amazon links, and yes, I do get a kickback if you buy things through them.)

Books from Lame Excuse Books make fine presents for everyone on your list! Or, at least, every SF fan on your list. And if they are not an SF fan, books from Lame Excuse will make them one! If you sign up for the mailing list now, you’ll get the brand new Lame Excuse Books catalog absolutely free!

Speaking of SF fans on your list, I confess: I have not read these yet. But I backed the Kickstarter, am a big fan of the author himself, and have heard good things about the books, so I’d also suggest you consider Travis J. I. Corcoran’s The Powers of the Earth and Causes of Separation. The Powers of the Earth won the Prometheus Award this year: how could you go wrong with this choice? (Okay, maybe the SF fan on your list isn’t a Libertarian. Yet. Like I said, how could you go wrong?)

Also unread by me, but in my “to read” stack, and another person I like: Amy Alkon’s Unf*ckology: A Field Guide to Living with Guts and Confidence.

Here are some books I did read, and liked, this year, that don’t pertain to my more esoteric interests. (If that’s your cup of tea, you probably already have the book on Savage rifles: as a matter of fact, you probably bought it when Ian mentioned it was on sale at Amazon.) They didn’t necessarily come out this year (one did, and one was reprinted): these are just a few things I liked, and that I think deserve more attention. I know we’re getting close to Christmas, but many of these books are available in Kindle editions and can be delivered more or less instantly, if your recipient has bought into the Kindle lifestyle.

Under an English Heaven: The Remarkable True Story of the 1969 British Invasion of Anguilla, Donald E. Westlake: I wrote about this back when the book was first re-released, and I finished it not too long after the Amazon shipment arrived. This is every bit as good as I thought it was going to be: definitely more Dortmunder than Parker, but with the added bonus of being 100% true. Wikipedia really doesn’t do justice to the whole bat guano insane story, especially the British involvement in it: even after being repeatedly whacked across the nose with a metaphorical 2×4, the British government still failed to understand that the people of Anguilla didn’t want to be governed by a ruler who threatened to strip the whole island bare and reduce them to “sucking on bones”. Enthusiastically recommended, and not just for Westlake fans.

The Jesuit Guide to (Almost) Everything, Reverend James Martin, SJ: This was a Half-Price Books discovery. I feel obligated to note here that Rev. Martin is kind of a controversial figure on the Catholic Twitters. Briefly summarizing something that’s more complex, he represents and advocates for a more liberal Church, which puts him crosswise with certain other Catholics who I also respect greatly.

With that said, I thought this was a very good book. It’s not just about being a Jesuit (though there’s a lot of Jesuit history in it), but about applying the Jesuit way of thought and general principles in your daily life, whether you are a Catholic or not. You could be a Zen Buddhist or even an agnostic: Father Martin’s idea is that applying these principles can make you a happier, more spiritually balanced person. This is a book I want to go back to, perhaps next summer when I’m on a break from other activities.

The Geometry of Love: Space, Time, Mystery, and Meaning in an Ordinary Church, Margaret Visser: I loved Visser’s Much Depends on Dinner when I read it (mumble mumble) years ago (and I need to re-read it). I was unaware of this book, though, until TJIC retweeted someone quoting from it (everything comes back to TJIC), so I went out and found a copy on Amazon…

…and I’m delighted I did. Visser’s basic idea is to take a “typical” church (St. Agnes Outside the Walls, in Rome) and show how the design and architecture of the church feeds into the liturgy of the church, how the liturgy of the church feeds into the design and architecture of the church, and how “all the pieces matter”. (Yeah, I know, I’m mixing the sacred with the profane. So shoot me.)

When I was reading this book, there was something on almost every page that was moving or profound or stunning or funny or that I just simply wanted to make a quote of the day over here. This is the kind of book that I want to buy more copies of and give out to people: that’s how strongly I feel about it.

Walking Through Holy Week, Karen May: Disclaimers: Karen May goes to one of the churches I go to, and I got this book for free because of something I was involved in at that church. All of that aside, I thought this was a wonderful guide to the liturgy and meaning of Holy Week. If you’ve ever wondered “What does this mean?” or “Why do we do this?”, this is the book for you. It’s also a book that I plan to re-read during holy week next year.

How to Invent Everything: A Survival Guide for the Stranded Time Traveler, Ryan North: I backed the Kickstarter for this (it was also the last Kickstarter I backed before I deleted my account) so I got the signed package deal. But you can still get the book from Amazon, or probably from your favorite bookstore.

When I was young, we had a two-volume set around the house called something like “How Things Work” that explained the basics of how everyday objects (like car engines, generators, etc.) worked. North (also the guy behind Dinosaur Comics) seems to be trying to do a similar thing, but not just concentrating on mechanical objects. The book itself is contained in a sort of narrative: basically, it’s intended to be a guide for a stranded time traveler so that they can rebuild civilization from scratch (or near it) to the point where their time machine can be repaired. I found parts of that narrative to be slightly annoying, honestly. But that’s a minor part of the book, and it’s offset by North’s coverage of, basically, how stuff works: everything from brewing beer and distilling alcohol, to designing a Pelton turbine, to “inventing” music and logic.

One of the things I like about North’s book is his concept that there are five foundational “technologies” you need if you want to re-invent civilization: spoken language, written language, a “non-sucky” number system, the scientific method, and a calorie surplus. I haven’t seen things laid out in that way before, and it makes a lot of sense. Language lets you communicate ideas, the scientific method lets you test them, numbers let you do math to implement your ideas, and surplus calories let you sit around and have ideas, instead of trying to scratch survival out of the dirt.

There are also a off-the-wall ideas, like “instead of inventing clocks that work on ships, let’s invent radio!” that I’m not completely sure I agree with, but are interesting to consider. (In fairness, most of these, like the radio idea, are only being relayed by North.)

In a way, it reminds me of James Burke’s “Connections” (which I rewatched a few months ago), except instead of showing how invention proceeds in fits and starts, the idea is to bypass all the fits and starts and speed things right along. If you have a curious and reasonably mature child (there’s some factual material in here about human reproductive biology, so parental advisory), you could do a lot worse than to give them a copy of this book and a flash drive with all the episodes of “Connections” on it for Christmas.

If anybody else has any recommendations, please feel free to leave them in comments. Even if you’re plugging your own book: go ahead and do it, just don’t be obnoxious about it.

Obit watch: November 30, 2018.

Friday, November 30th, 2018

Lady Trumpington (Jean Alys Campbell-Harris).

She was a member of the House of Lords from 1980 to 2017, and held various other governmental positions.

But she gets her obit linked here because she was one of the Bletchley Park codebreakers.

This month, she was among a group of Bletchley Park veterans awarded the Légion d’Honneur, France’s highest honor, for their contributions to the liberation of France.
“Oh, I had such fun in Paris after the war,” she said after receiving the medal in a ceremony at her home. “While this award recognized my time at Bletchley, I still find it difficult to discuss my time there, as we were taught to never talk about it.”

…

During her husband’s tenure at the Leys School in Cambridge, Lady Trumpington kept up her society habits. “I smoked and drank and did everything naughty,” she said.
Once, when presenting awards to Leys athletes, she jumped fully clothed into the school’s swimming pool, followed by the students. “My husband was furious,” she said.

Random notes: November 18, 2018.

Sunday, November 18th, 2018

A few things I’ve stumbled across over the past couple of days:

“I Found the Best Burger Place in America. And Then I Killed It.” In which the author visits 30 cities, eats 330 burgers, names a burger place in Portand as having the best burger in the country…and five months later, the places closes.

Each time I was there, my story would somehow find a way into conversation, like the one with my Lyft driver who asked if I liked burgers. Yes, I said tentatively. “Well, we had a great one here,” he said, as we drove over the Burnside Bridge. “But then some asshole from California ruined it.” Or the time, while sitting at the bar at Clyde Common, the bartender came up to me and in a soft, friendly voice inquired if I’d planned on closing any more burger restaurants while I was in town.

I like this story: it’s a good discussion of the impact of criticism on dining establishments, especially smaller ones. But it’s also frustrating: as it turns out, there was more going on with the burger place than just simply being named “best burger in the country”.

Recently retweeted by Popehat:

I don’t like and don’t read the Huffington Post. But this (also by way of Popehat):

It was still dark outside when Amanda woke up to the sound of her alarm, got out of bed and decided to kill herself. She wasn’t going to do it then, not at 5:30 in the morning on a Friday. She told herself she would do it sometime after work.

Glybera is a drug developed in Canada. It’s a hugely effective treatment for a rare genetic condition, lipoprotein lipase disorder. People with this disorder can’t metabolize fat. Their blood literally turns white from all the suspended fat in their bloodstream.

One round of treatment with Glybera can fix this genetic condition. Only 31 people have ever been treated with the drug, and it is no longer available.

Why? One possible reason: a round of treatment costs one million dollars. (But a round of treatment, as far as anyone’s been able to determine, is a permanent cure. This is a drug that literally edits genes.) And this isn’t a “oh, health care in the US stinks” story: the drug was only used in Canada and Europe, pretty much on an experimental basis, before it was pulled.

On the historic significance of “Hee Haw”:

Obit watch: November 7, 2018.

Wednesday, November 7th, 2018

Kitty O’Neil, noted stunt woman and holder of the women’s land speed record.

The Motivator accelerated rapidly, though silently for Ms. O’Neil; she was deaf. Her speed peaked briefly at 618 miles per hour, and with a second explosive run measured over one kilometer, she attained an average speed of 512.7 m.p.h., shattering the land-speed record for women by about 200 m.p.h.

For Ms. O’Neil, her record — which still stands — was the highlight of a career in daredevilry. She also set speed records on water skis and in boats. And, working as a stuntwoman, she crashed cars and survived immolation.

Obit watch: October 16, 2018.

Tuesday, October 16th, 2018

For the historical record, and by popular demand: Paul G. Allen.

Obit watch: October 15, 2018.

Monday, October 15th, 2018

Catching up:

William Coors is dead at 102.

A grandson of the stowaway from Germany who founded the Adolph Coors Company in the foothills of the Rockies in 1873, Mr. Coors was chairman from 1959 to 2000 and vice chairman until 2002, building a regional brewery into the nation’s third-largest, behind only Anheuser-Busch and Miller.

…

Along with his younger brother, Joseph, a Coors executive who supported Ronald Reagan’s rise to the presidency, William Coors, although not as overtly political, championed bootstrap success and free enterprise, and was widely admired by conservatives.
But he alienated unionists, blacks, Hispanics, women and gays with views and policies that critics called racist, sexist and homophobic, and members of those groups joined informal boycotts of Coors beer in increasing numbers in the 1970s.

Jim Taylor, one of the great Green Bay Packers:

…the rugged Taylor is remembered as perhaps the last great fullback in professional football, a player tasked as much with carrying the football as blocking before the modern game divvied those responsibilities. He played nine seasons with the Packers from 1958-66 and departed Green Bay as the franchise’s all-time leading rusher.

NYT.

Cindy Lobel, food historian. I actually wasn’t familiar with her work, but I generally admire people who write about food and food history: I’m adding her book to my list. Plus: 48 is too damn young to die.

Betty Grissom, Gus Grissom’s widow. Thing I didn’t know: she ticked off a lot of people by suing North American Rockwell (the primary contractor for the Apollo program).

Her action brought Ms. Grissom considerable grief, with strangers accusing her of being unpatriotic and the close-knit space community shunning her.
The experience embittered the family, said Mark Grissom, who was 13 when his father died.
“We got the dark side of NASA,” he said in a telephone interview on Thursday. “People who were my friends were no longer my friends. A lot of people turned their back on us, and Mom got a lot of hate mail. They were like, ‘How dare you sue NASA?’ We were no longer part of the NASA family.”

…

She told an interviewer that her husband’s sacrifice had helped pave the way for future missions in which other astronauts made it to the moon.
Still, she said, “I’m pretty sure he got to the moon before they did.”
“Of course he didn’t make it,” she added, “but in spirit I think he was already there.”

Bagatelle (#8)

Tuesday, October 9th, 2018

The second most amusing thing I read yesterday:

…while our engineering teams have put a lot of effort and dedication into building Google+ over the years, it has not achieved broad consumer or developer adoption, and has seen limited user interaction with apps. The consumer version of Google+ currently has low usage and engagement: 90 percent of Google+ user sessions are less than five seconds.

“less than five seconds”. As a friend of mine put it, that’s “Oops, I clicked on the wrong link. (close)”

(If that’s second, what was the most amusing thing? The MLB RICO story, of course.)

Obit watch: September 23, 2018.

Sunday, September 23rd, 2018

Over the weekend, I was rewatching parts of “Project Grizzly” and I got to wondering what Troy Hurtubise was up to. I’d kind of lost track of him after the whole “Angel Light” thing.

Sadly, and completely unknown to me until yesterday, Mr. Hurtubise passed away in June, as the result of an automobile accident.

This is a damn shame. I’m extremely skeptical of “Angel Light” and “R-Light” (for obvious reasons), but Trojan armor seems like a logical extension of both the Ursus suits and the protective gear worn by bomb squad technicians. Firepaste doesn’t strike me as being too out there, either. I remember reading a book a while back about a famous magician who helped the Allies develop deception tactics during WWII. In his spare time, this guy also invented something that sounds very similar to Firepaste: the intent was that aircrews who anticipated a crash could apply the substance to exposed flesh and ideally get a little more time to flee a burning aircraft.

We extend our belated condolences to his people, and will pour out a 40 of something Canadian in his memory.

Anne Russ Federman, the last of the three daughters of Joel Russ, founder of Russ & Daughters (formerly Russ’s Cut Rate Appetizers).

Waxing rhapsodic in The New York Times Magazine in 2003, the editor and publisher Jason Epstein wrote that Russ & Daughters was “New York’s most hallowed shrine to the miracle of caviar, smoked salmon, ethereal herring and silken chopped liver.”

I’ve been reading Mark Federman’s book about Russ & Daughters, and I love the story behind the store. I also, as it happens, love me some smoked salmon, and I could go for a little herring, too. Next time I’m in New York City…

Obit watch: September 16, 2018.

Sunday, September 16th, 2018

Some from the past day or two:

David Yallop, author and journalist. He was perhaps most famous for In God’s Name: An Investigation Into the Murder of Pope John Paul I which argued that the Pope “had been poisoned by a cabal connected to a secret Masonic lodge that had infiltrated the church and the Vatican Bank.”

Peter Donat, character actor. He was Mulder’s father on “The X-Files”, but he also did a lot of theater: “Over the years he played Cyrano de Bergerac, Prospero, Shylock, King Lear and Hadrian VII.”

Also:

He worked regularly in television, guest-starring on series like “The F.B.I.,” “Hawaii Five-O,” “Mannix,” McMillan & Wife,” “Hill Street Blues” and “Murder, She Wrote,” on which he played three different roles over several seasons. On “Dallas,” he portrayed a doctor who treated the notorious Texas oilman J. R. Ewing (Larry Hagman) after he had been shot in a famous cliffhanger episode in 1980.

Walter Mischel, of “marshmallow test” fame.

In a series of experiments at Stanford University beginning in the 1960s, he led a research team that presented preschool-age children with treats — pretzels, cookies, a marshmallow — and instructed them to wait before indulging themselves. Some of the children received strategies from the researchers, like covering their eyes or reimagining the treat as something else; others were left to their own devices.
The studies found that in all conditions, some youngsters were far better than others at deploying the strategies — or devising their own — and that this ability seemed to persist at later ages. And context mattered: Children given reason to distrust the researchers tended to grab the treats earlier.

…

In the late 1980s, decades after the first experiments were done, Dr. Mischel and two co-authors followed up with about 100 parents whose children had participated in the original studies. They found a striking, if preliminary, correlation: The preschoolers who could put off eating the treat tended to have higher SAT scores, and were better adjusted emotionally on some measures, than those who had given in quickly to temptation.
The paper was cautious in its conclusions, and acknowledged numerous flaws, including a small sample size. No matter. It was widely reported, and a staple of popular psychology writing was born: If Junior can hold off eating a marshmallow for 15 minutes in preschool, then he or she is headed for the dean’s list.

Quote of the day.

Tuesday, August 21st, 2018

(This whole thread is gold, Jerry, comedy gold.)

Your loser update: pre-NFL edition.

Wednesday, August 15th, 2018

Actually, this sits at the weird intersection of a couple of things:

Bud Light is installing “Victory Fridges” throughout the Cleveland area that will unlock via WiFi following the Browns’ first regular-season win this season.

Which do you suppose is going to happen first: a Browns win, or someone hacks the fridges? My money is on the latter.

Cleveland hackers, you’ve got at least 25 days to prove me right.

More from the Entertainment and Sports Programming Network.

And how about a little musical interlude? We haven’t had one in a while.

Black Hat 2018/DEFCON 26 0 day updates.

Thursday, August 9th, 2018

Some of yesterday’s Black Hat presentations:

Some others that I didn’t get to the first time around:

  • “Software Attacks on Hardware Wallets” by Alyssa Milburn and Sergei Volokitin. “…we show how software attacks can be used to break in the most protected part of the hardware wallet, the Secure Element, and how it can be exploited by an attacker.” Slides. White paper.
  • “Screaming Channels: When Electromagnetic Side Channels Meet Radio Transceivers” with a whole big bunch of folks. “…we show that it is possible to recover the original leaked signal over large distances on the radio. As a result, variations of known side-channel analysis techniques can be applied, effectively allowing us to retrieve the encryption key by just listening on the air with a software defined radio (SDR).” Slides. White paper.

Ars Technica has a story up in advance of Justin Shattuck’s “Snooping on Cellular Gateways and Their Critical Role in ICS” presentation later today:

…many of the unsecured gateways were installed in police cars, ambulances, and other emergency vehicles. Not only were the devices openly broadcasting the locations of these first responders, but they were also exposing configurations that could be used to take control of the devices and, from there, possibly control dash cameras, in-vehicle computers, and other devices that relied on the wireless gateways for Internet connections.

There are a couple of other presentations from yesterday that sound interesting on second look, but the links to them are currently broken. Also, I haven’t had a chance to read through all of these yet: I did give a quick skim to “Stress and Hacking” and “Reversing a Japanese Wireless SD Card” and look forward to a more careful read of both.

I think I’m going to try to post a second update later this evening if the broken links are fixed and/or new content is available. We should also be getting close to the point where the DEFCON 26 media server has preliminary versions of the presentations up…

Edited to add: DEFCON 26 presentations are now live on the DEFCON media server.

Let’s go!

Friday, July 13th, 2018

More car related updates and thoughts.

First of all, RoadRich left an excellent and thoughtful comment on the last post which you should go read.

(more…)

Here in my car…

Thursday, July 5th, 2018

I bought a new to me car last Saturday. It’s a 2006 Honda Accord EX-L that had 82,000 miles on it (not bad, in my opinion, for a 12 year old car) and has quite few features I like: leather interior, sun roof, cabin air filter, power seats, and even seat heaters for that one month a year when those are actually useful in Texas. (Also ABS. I’m not clear on whether it has traction control or not. I checked the Honda-Tech VIN decoder and while it is useful, it doesn’t talk about traction control.)

Now that I have the car, I splurged on a couple of things. I got a dashcam for it: the Papago GoSafe 535, which is what the Wirecutter currently recommends. That one has gone up by about $13 in the couple of days since I ordered it, and it really wasn’t my first choice. I wanted the Spy Tec G1W-C, which was a previous Wirecutter choice that I bought for my mother’s car and have been happy with. But by the time I was ready to order, Amazon had sold out of the Spy Tec.

My other splurge item was a LELink Bluetooth Low Energy BLE OBD-II car diagnostic tool. Why? Several reasons:

(more…)

Dumber than a bag of hair.

Tuesday, June 19th, 2018

I missed the first part of this story last week, but I caught the second part when it came across the Hacker News Twitter feed.

There is a company called Tapplock that makes a $99 “smart” padlock. No, this isn’t the same company that makes a “smart” padlock that’s “completely invincible” to anybody that doesn’t have a screwdriver. Different company, different lock.

But it does have a fingerprint scanner and Bluetooth.

Part 1:

Among other features, you can set up multiple fingerprint profiles, so you can enable multiple people to unlock the padlock with their fingerprints.

Except: their protocol doesn’t gracefully handle revocation. The lock communicates over HTTP: there’s no encryption, and…

I could see that a string of “random” looking data was sent to the lock over BLE each time I connected to it. Without this data, the lock would not respond to commands.
But it was also noted that this data did not change, no matter how many times I connected. A couple of lines of commands in gatttool and it was apparent that the lock was vulnerable to trivial replay attacks…
…I shared the lock with another user, and sniffed the BLE data. It was identical to the normal unlocking data. Even if you revoke permissions, you have already given the other user all the information they need to authenticate with the lock, in perpetuity.

But wait, there’s more! It turns out that that random data, that unique key…is derived directly from the lock’s MAC address! The one that’s constantly broadcast by the lock so you can access it over Bluetooth!

I scripted the attack up to scan for Tapplocks and unlock them. You can just walk up to any Tapplock and unlock it in under 2s. It requires no skill or knowledge to do this.

Part 2:

But wait, there’s more! Another security researcher, who didn’t have a Tapplock (“I am out of IoT budget for this month as my wife has -kindly- informed me”), decided to play around with the Tapplock’s cloud based admin tools…

…and discovered that, once you logged in with a valid account, you could access any other account simply by incrementing the account ID.

As a result, Stykas could not only add himself as an authorised user to anyone else’s lock, but also read out personal information from that person’s account, including the last location (if known) where the Tapplock was opened.
Incredibly, Tapplock’s back-end system would not only let him open other people’s locks using the official app, but also tell him where to find the locks he could now open!

References:

The Pen Test Partners initial attack.

The Vangelis Stykas admin interface attack.

Sophos “Naked Security” blog: part 1. Part 2.