Archive for the ‘Geek’ Category

Random notes: November 18, 2018.

Sunday, November 18th, 2018

A few things I’ve stumbled across over the past couple of days:

“I Found the Best Burger Place in America. And Then I Killed It.” In which the author visits 30 cities, eats 330 burgers, names a burger place in Portand as having the best burger in the country…and five months later, the places closes.

Each time I was there, my story would somehow find a way into conversation, like the one with my Lyft driver who asked if I liked burgers. Yes, I said tentatively. “Well, we had a great one here,” he said, as we drove over the Burnside Bridge. “But then some asshole from California ruined it.” Or the time, while sitting at the bar at Clyde Common, the bartender came up to me and in a soft, friendly voice inquired if I’d planned on closing any more burger restaurants while I was in town.

I like this story: it’s a good discussion of the impact of criticism on dining establishments, especially smaller ones. But it’s also frustrating: as it turns out, there was more going on with the burger place than just simply being named “best burger in the country”.

Recently retweeted by Popehat:

I don’t like and don’t read the Huffington Post. But this (also by way of Popehat):

It was still dark outside when Amanda woke up to the sound of her alarm, got out of bed and decided to kill herself. She wasn’t going to do it then, not at 5:30 in the morning on a Friday. She told herself she would do it sometime after work.

Glybera is a drug developed in Canada. It’s a hugely effective treatment for a rare genetic condition, lipoprotein lipase disorder. People with this disorder can’t metabolize fat. Their blood literally turns white from all the suspended fat in their bloodstream.

One round of treatment with Glybera can fix this genetic condition. Only 31 people have ever been treated with the drug, and it is no longer available.

Why? One possible reason: a round of treatment costs one million dollars. (But a round of treatment, as far as anyone’s been able to determine, is a permanent cure. This is a drug that literally edits genes.) And this isn’t a “oh, health care in the US stinks” story: the drug was only used in Canada and Europe, pretty much on an experimental basis, before it was pulled.

On the historic significance of “Hee Haw”:

Obit watch: November 7, 2018.

Wednesday, November 7th, 2018

Kitty O’Neil, noted stunt woman and holder of the women’s land speed record.

The Motivator accelerated rapidly, though silently for Ms. O’Neil; she was deaf. Her speed peaked briefly at 618 miles per hour, and with a second explosive run measured over one kilometer, she attained an average speed of 512.7 m.p.h., shattering the land-speed record for women by about 200 m.p.h.

For Ms. O’Neil, her record — which still stands — was the highlight of a career in daredevilry. She also set speed records on water skis and in boats. And, working as a stuntwoman, she crashed cars and survived immolation.

Obit watch: October 16, 2018.

Tuesday, October 16th, 2018

For the historical record, and by popular demand: Paul G. Allen.

Obit watch: October 15, 2018.

Monday, October 15th, 2018

Catching up:

William Coors is dead at 102.

A grandson of the stowaway from Germany who founded the Adolph Coors Company in the foothills of the Rockies in 1873, Mr. Coors was chairman from 1959 to 2000 and vice chairman until 2002, building a regional brewery into the nation’s third-largest, behind only Anheuser-Busch and Miller.

Along with his younger brother, Joseph, a Coors executive who supported Ronald Reagan’s rise to the presidency, William Coors, although not as overtly political, championed bootstrap success and free enterprise, and was widely admired by conservatives.
But he alienated unionists, blacks, Hispanics, women and gays with views and policies that critics called racist, sexist and homophobic, and members of those groups joined informal boycotts of Coors beer in increasing numbers in the 1970s.

Jim Taylor, one of the great Green Bay Packers:

…the rugged Taylor is remembered as perhaps the last great fullback in professional football, a player tasked as much with carrying the football as blocking before the modern game divvied those responsibilities. He played nine seasons with the Packers from 1958-66 and departed Green Bay as the franchise’s all-time leading rusher.

NYT.

Cindy Lobel, food historian. I actually wasn’t familiar with her work, but I generally admire people who write about food and food history: I’m adding her book to my list. Plus: 48 is too damn young to die.

Betty Grissom, Gus Grissom’s widow. Thing I didn’t know: she ticked off a lot of people by suing North American Rockwell (the primary contractor for the Apollo program).

Her action brought Ms. Grissom considerable grief, with strangers accusing her of being unpatriotic and the close-knit space community shunning her.
The experience embittered the family, said Mark Grissom, who was 13 when his father died.
“We got the dark side of NASA,” he said in a telephone interview on Thursday. “People who were my friends were no longer my friends. A lot of people turned their back on us, and Mom got a lot of hate mail. They were like, ‘How dare you sue NASA?’ We were no longer part of the NASA family.”

She told an interviewer that her husband’s sacrifice had helped pave the way for future missions in which other astronauts made it to the moon.
Still, she said, “I’m pretty sure he got to the moon before they did.”
“Of course he didn’t make it,” she added, “but in spirit I think he was already there.”

Bagatelle (#8)

Tuesday, October 9th, 2018

The second most amusing thing I read yesterday:

…while our engineering teams have put a lot of effort and dedication into building Google+ over the years, it has not achieved broad consumer or developer adoption, and has seen limited user interaction with apps. The consumer version of Google+ currently has low usage and engagement: 90 percent of Google+ user sessions are less than five seconds.

“less than five seconds”. As a friend of mine put it, that’s “Oops, I clicked on the wrong link. (close)”

(If that’s second, what was the most amusing thing? The MLB RICO story, of course.)

Obit watch: September 23, 2018.

Sunday, September 23rd, 2018

Over the weekend, I was rewatching parts of “Project Grizzly” and I got to wondering what Troy Hurtubise was up to. I’d kind of lost track of him after the whole “Angel Light” thing.

Sadly, and completely unknown to me until yesterday, Mr. Hurtubise passed away in June, as the result of an automobile accident.

This is a damn shame. I’m extremely skeptical of “Angel Light” and “R-Light” (for obvious reasons), but Trojan armor seems like a logical extension of both the Ursus suits and the protective gear worn by bomb squad technicians. Firepaste doesn’t strike me as being too out there, either. I remember reading a book a while back about a famous magician who helped the Allies develop deception tactics during WWII. In his spare time, this guy also invented something that sounds very similar to Firepaste: the intent was that aircrews who anticipated a crash could apply the substance to exposed flesh and ideally get a little more time to flee a burning aircraft.

We extend our belated condolences to his people, and will pour out a 40 of something Canadian in his memory.

Anne Russ Federman, the last of the three daughters of Joel Russ, founder of Russ & Daughters (formerly Russ’s Cut Rate Appetizers).

Waxing rhapsodic in The New York Times Magazine in 2003, the editor and publisher Jason Epstein wrote that Russ & Daughters was “New York’s most hallowed shrine to the miracle of caviar, smoked salmon, ethereal herring and silken chopped liver.”

I’ve been reading Mark Federman’s book about Russ & Daughters, and I love the story behind the store. I also, as it happens, love me some smoked salmon, and I could go for a little herring, too. Next time I’m in New York City…

Obit watch: September 16, 2018.

Sunday, September 16th, 2018

Some from the past day or two:

David Yallop, author and journalist. He was perhaps most famous for In God’s Name: An Investigation Into the Murder of Pope John Paul I which argued that the Pope “had been poisoned by a cabal connected to a secret Masonic lodge that had infiltrated the church and the Vatican Bank.”

Peter Donat, character actor. He was Mulder’s father on “The X-Files”, but he also did a lot of theater: “Over the years he played Cyrano de Bergerac, Prospero, Shylock, King Lear and Hadrian VII.”

Also:

He worked regularly in television, guest-starring on series like “The F.B.I.,” “Hawaii Five-O,” “Mannix,” McMillan & Wife,” “Hill Street Blues” and “Murder, She Wrote,” on which he played three different roles over several seasons. On “Dallas,” he portrayed a doctor who treated the notorious Texas oilman J. R. Ewing (Larry Hagman) after he had been shot in a famous cliffhanger episode in 1980.

Walter Mischel, of “marshmallow test” fame.

In a series of experiments at Stanford University beginning in the 1960s, he led a research team that presented preschool-age children with treats — pretzels, cookies, a marshmallow — and instructed them to wait before indulging themselves. Some of the children received strategies from the researchers, like covering their eyes or reimagining the treat as something else; others were left to their own devices.
The studies found that in all conditions, some youngsters were far better than others at deploying the strategies — or devising their own — and that this ability seemed to persist at later ages. And context mattered: Children given reason to distrust the researchers tended to grab the treats earlier.

In the late 1980s, decades after the first experiments were done, Dr. Mischel and two co-authors followed up with about 100 parents whose children had participated in the original studies. They found a striking, if preliminary, correlation: The preschoolers who could put off eating the treat tended to have higher SAT scores, and were better adjusted emotionally on some measures, than those who had given in quickly to temptation.
The paper was cautious in its conclusions, and acknowledged numerous flaws, including a small sample size. No matter. It was widely reported, and a staple of popular psychology writing was born: If Junior can hold off eating a marshmallow for 15 minutes in preschool, then he or she is headed for the dean’s list.

Quote of the day.

Tuesday, August 21st, 2018

(This whole thread is gold, Jerry, comedy gold.)

Your loser update: pre-NFL edition.

Wednesday, August 15th, 2018

Actually, this sits at the weird intersection of a couple of things:

Bud Light is installing “Victory Fridges” throughout the Cleveland area that will unlock via WiFi following the Browns’ first regular-season win this season.

Which do you suppose is going to happen first: a Browns win, or someone hacks the fridges? My money is on the latter.

Cleveland hackers, you’ve got at least 25 days to prove me right.

More from the Entertainment and Sports Programming Network.

And how about a little musical interlude? We haven’t had one in a while.

Black Hat 2018/DEFCON 26 0 day updates.

Thursday, August 9th, 2018

Some of yesterday’s Black Hat presentations:

Some others that I didn’t get to the first time around:

  • “Software Attacks on Hardware Wallets” by Alyssa Milburn and Sergei Volokitin. “…we show how software attacks can be used to break in the most protected part of the hardware wallet, the Secure Element, and how it can be exploited by an attacker.” Slides. White paper.
  • “Screaming Channels: When Electromagnetic Side Channels Meet Radio Transceivers” with a whole big bunch of folks. “…we show that it is possible to recover the original leaked signal over large distances on the radio. As a result, variations of known side-channel analysis techniques can be applied, effectively allowing us to retrieve the encryption key by just listening on the air with a software defined radio (SDR).” Slides. White paper.

Ars Technica has a story up in advance of Justin Shattuck’s “Snooping on Cellular Gateways and Their Critical Role in ICS” presentation later today:

…many of the unsecured gateways were installed in police cars, ambulances, and other emergency vehicles. Not only were the devices openly broadcasting the locations of these first responders, but they were also exposing configurations that could be used to take control of the devices and, from there, possibly control dash cameras, in-vehicle computers, and other devices that relied on the wireless gateways for Internet connections.

There are a couple of other presentations from yesterday that sound interesting on second look, but the links to them are currently broken. Also, I haven’t had a chance to read through all of these yet: I did give a quick skim to “Stress and Hacking” and “Reversing a Japanese Wireless SD Card” and look forward to a more careful read of both.

I think I’m going to try to post a second update later this evening if the broken links are fixed and/or new content is available. We should also be getting close to the point where the DEFCON 26 media server has preliminary versions of the presentations up…

Edited to add: DEFCON 26 presentations are now live on the DEFCON media server.

Let’s go!

Friday, July 13th, 2018

More car related updates and thoughts.

First of all, RoadRich left an excellent and thoughtful comment on the last post which you should go read.

(more…)

Here in my car…

Thursday, July 5th, 2018

I bought a new to me car last Saturday. It’s a 2006 Honda Accord EX-L that had 82,000 miles on it (not bad, in my opinion, for a 12 year old car) and has quite few features I like: leather interior, sun roof, cabin air filter, power seats, and even seat heaters for that one month a year when those are actually useful in Texas. (Also ABS. I’m not clear on whether it has traction control or not. I checked the Honda-Tech VIN decoder and while it is useful, it doesn’t talk about traction control.)

Now that I have the car, I splurged on a couple of things. I got a dashcam for it: the Papago GoSafe 535, which is what the Wirecutter currently recommends. That one has gone up by about $13 in the couple of days since I ordered it, and it really wasn’t my first choice. I wanted the Spy Tec G1W-C, which was a previous Wirecutter choice that I bought for my mother’s car and have been happy with. But by the time I was ready to order, Amazon had sold out of the Spy Tec.

My other splurge item was a LELink Bluetooth Low Energy BLE OBD-II car diagnostic tool. Why? Several reasons:

(more…)

Dumber than a bag of hair.

Tuesday, June 19th, 2018

I missed the first part of this story last week, but I caught the second part when it came across the Hacker News Twitter feed.

There is a company called Tapplock that makes a $99 “smart” padlock. No, this isn’t the same company that makes a “smart” padlock that’s “completely invincible” to anybody that doesn’t have a screwdriver. Different company, different lock.

But it does have a fingerprint scanner and Bluetooth.

Part 1:

Among other features, you can set up multiple fingerprint profiles, so you can enable multiple people to unlock the padlock with their fingerprints.

Except: their protocol doesn’t gracefully handle revocation. The lock communicates over HTTP: there’s no encryption, and…

I could see that a string of “random” looking data was sent to the lock over BLE each time I connected to it. Without this data, the lock would not respond to commands.
But it was also noted that this data did not change, no matter how many times I connected. A couple of lines of commands in gatttool and it was apparent that the lock was vulnerable to trivial replay attacks…
…I shared the lock with another user, and sniffed the BLE data. It was identical to the normal unlocking data. Even if you revoke permissions, you have already given the other user all the information they need to authenticate with the lock, in perpetuity.

But wait, there’s more! It turns out that that random data, that unique key…is derived directly from the lock’s MAC address! The one that’s constantly broadcast by the lock so you can access it over Bluetooth!

I scripted the attack up to scan for Tapplocks and unlock them. You can just walk up to any Tapplock and unlock it in under 2s. It requires no skill or knowledge to do this.

Part 2:

But wait, there’s more! Another security researcher, who didn’t have a Tapplock (“I am out of IoT budget for this month as my wife has -kindly- informed me”), decided to play around with the Tapplock’s cloud based admin tools…

…and discovered that, once you logged in with a valid account, you could access any other account simply by incrementing the account ID.

As a result, Stykas could not only add himself as an authorised user to anyone else’s lock, but also read out personal information from that person’s account, including the last location (if known) where the Tapplock was opened.
Incredibly, Tapplock’s back-end system would not only let him open other people’s locks using the official app, but also tell him where to find the locks he could now open!

References:

The Pen Test Partners initial attack.

The Vangelis Stykas admin interface attack.

Sophos “Naked Security” blog: part 1. Part 2.

Some days you get the bull…

Friday, June 15th, 2018

I’m not a huge fan of bull riding (though I do think it is much more interesting than soccer), and I don’t care much for “People” magazine.

But, as an amateur medical geek, when I see a phrase like “first person to survive the procedure at the hospital this century”, it kind of makes me take notice.

Wyatt Bruesch was competing in an Idaho rodeo when the bull he was riding bucked him off and trampled him fatally.

After he was airlifted to the Portneuf Medical Center in Pocatello, he flatlined three times in the emergency room.

The emergency department decided on a hail mary pass: an “emergency department thoracotomy.”

“You don’t perform it until the patient is literally at death’s doorstep and about to die,” Drew McRoberts, Portneuf Medical Center‘s trauma director, told People. “The odds of surviving an ED thoracotomy are extremely low, which is why they’re rarely done.”

Here’s the Trauma.org page on the subject (it’s also linked in the article itself).

Emergency department thoracotomy is a life-saving procedure in a select group of patients. Exactly who these patients are is a matter of some controversy in the trauma literature. There is a significant amount of published data on the indications for and outcomes of resuscitative thoracotomy. However the results of interventions varies widely, as does each unit’s experience, puclished data ranging for 11 patients in 10 years to 950 patients in 23 years…
Overall survival of patients undergoing emergency thoracotomy is between 4 and 33% depending on the protocols used in individual departments. The main determinants for survivability of an emergency thoracotomy are the mechanism of injury (stab, gunshot or blunt), location of injury and the presence or absence of vital signs.

Anyway:

Acting quickly, trauma surgeon Jorge Amorim cut Wyatt’s chest open and massaged his heart by hand to get it beating again.
“He basically saved his life,” McRoberts said. “He also did something else. Dr. Amorim reached into the chest cavity and squeezed and held the hilum of the lung where the great vessels come into the lung. He continued to squeeze for 15 minutes, which stopped the bleeding as Wyatt was rushed to an operating room.”

Mr. Bruesch is at home, recovering. In addition to the injuries that required an emergency thoracotomy, he also broke three ribs and eight vertebrae. In spite of this, he says he’s going to continue bull riding.

Meanwhile, in Pocatello, there’s a trauma surgeon shopping for a wheelbarrow to carry his giant brass testicles.

Overthinking it.

Thursday, May 31st, 2018

Headline:

Please Don’t Roast Marshmallows Over the Erupting Hawaii Volcano, USGS Warns

At first, this sounds like a bunch of joyless fun suckers sucking all the fun out of life. But USGS’s argument actually makes sense: the H2S and SO2 present around a volcanic eruption would probably make the marshmallows taste bad.

But the idea of using something other than an open campfire to toast marshmallows has a certain appeal. What you want in the ideal toasted marshmallow is for it to be evenly browned, not burned. You’re looking for that perfect Maillard reaction all over the marshmallow. And that’s really hard to get in a campfire context.

So why not use an indirect heat source? Could you use something like a heat lamp or some sort of radiant heater to toast marshmallows, instead of radiated heat from hot molten rocks? Why not? Even better, what if your marshmallow toasting stick had a motor in it? Just some sort of small battery powered one that, when you pushed a button, rotated the marshmallow at a uniform speed over the indirect heat source until it was evenly browned.

I thought I’d check Amazon and…well…I found this, which instantly turned me off the whole idea. I’m not sure why: maybe the whole idea of a dedicated electric S’mores maker just seems antithetical to the whole idea of S’mores.

Maybe part of the appeal of a toasted marshmallow isn’t just the striving for an even Maillard reaction, but also the added flavors of wood smoke and the great outdoors.

Or, maybe, I’m just overthinking it.

(But I strongly encourage at least one of my readers to purchase this and report back on the contents.)