This week’s topics: The WannaCry ransomware worm, the president’s EO, Macron hacking, HP backdoors, laptop bans, Amazon releases, Chinese online commerce, CRISPR, Germany and renewable energy, beetles, dental health as social indicator, Reading superpowers, Net Neutrality, serverless, deep learning black box, The Three Body Problem, you can now support the site, The Mechanical Universe, TrueCaller, and more… This…
For a Life Upgrade, Swap TV Time for Reading Time
I have a lot of really smart friends, but I have few friends that read. Most of my friends watch TV. And when I say “TV”, I mean all its modern forms—actual broadcast television, DVR’d shows, Netflix, whatever. They watch lots of it. Probably 10-30 hours a week, if I had to guess, which ends up being hundreds…
Some Quick Takeaways from the 2017 Verizon DBIR
For those who lack the time to read the entire report, here are some of the key findings along with some comments. Attackers 75% of breaches done by outsiders. 25% involved internal actors. 18% state actors. 51% involved organized crime actors. I see 25% involving internal actors as quite high, but that depends on the definition of “involved”….
Robert Graham is Wrong About John Oliver Being Wrong About Net Neutrality
For example, he says that without Net Neutrality, Comcast can prefer original shows it produces, and slow down competing original shows by Netflix. This is silly: Comcast already does that, even with NetNeutrality rules.Comcast owns NBC, which produces a lot of original shows. During prime time (8pm to 11pm), Comcast delivers those shows at 6-mbps to its customers,…
My Current Predictions for Thinking Machines
I’ve been thinking a lot about what I called “Getting Better at Getting Better” in my book. It’s the idea of accelerating machine intelligence, where computers aren’t just getting better at solving problems, but the pace at which they get better increases drastically. I think this comes in two forms: Improved machine learning that improves as we provide…
A Look at Application Testing in a Near Future
For some silly reason I was just awoken by the following thoughts about how application tests will be done in the future. I’m thinking this starts phasing in over the next 3-10 years. The application will be decomposed using an automated tool to break it into the binary, the source, the network interfaces, the application-layer interfaces, and any…
How to Get Extracted Fields into Your Splunk Alerts
I’ve been continuing to improve my Splunk> game, and part of that has been improving the information that comes in email alerts. The image above shows the final result I am looking for, where you get custom information that’s contextual to the alert that was generated. The problem The issue is that this doesn’t work by default. You…
Embracing Female Oppression as a Sign of Feminism
The regressive left, or Lupus Liberals as I like to call them, are heroically confused about the Hijab. The source of the confusion seems to be that there are western people, especially men, who don’t like the Hijab for various reasons. Some are good, some are bad. Good reasons include not liking the fact that this is a…
Unsupervised Learning: No. 76
This week’s topics: Verizon’s DBIR report, Chipotle (again), USAF bounty, NSA surveillance hampered, Android hacks, Taser and computer vision, Google fights fake news, Exercise types & mental skills, Perfect pitch recording, Lifecasting, RF X-Ray, discovered links, and more… This is Episode No. 75 of Unsupervised Learning—a weekly show where I curate 3-5 hours of reading in infosec, technology,…
Why You Should Be Using More Emoji
If you’re over 30 you’re probably a bit averse to using emoji to communicate. You probably think it’s unprofessional, that it’s “not real language”, or that it’s a fad that will go away soon. My opinion is that it’s a permanent part of communication (although it’ll evolve into richer forms), and that if you’re not using it you’re…
The Jobs Most Vulnerable to Automation
Any parent or teenager not thinking very hard about this list is putting themselves at a severe disadvantage. And a lot of the jobs will surprise you. Being a waiter at a restaurant is remarkably resilient because the robots required to move around quickly, juggle lots of food, make quick adjustments, read peoples’ temperaments, attitudes, etc., and adjust…
Unsupervised Learning: No. 75
This week’s topics: DoublePulsar in the wild, vigilante IoT worms, Bose listening headphones, PoS hacking sentence, Google ad blocking, best anti-aging exercises, unqualified Indian engineers, , discovered links, and more… This is Episode No. 75 of Unsupervised Learning—a weekly show where I curate 3-5 hours of reading in infosec, technology, and humans into a 15 to 30 minute…
Monitoring SSH Bruteforce Attempts Using Splunk
I do lots of monitoring on my site (I’d rather watch logs than Netflix) which I’ll talk about in separate posts, but today I want to talk about SSH. I’m going to cover how I log, how I get those longs into Splunk, and what kinds of searches and alerts I have set up. Getting Splunk to monitor…
AWS IAM Security Terminology Primer
What is IAM IAM Users IAM Roles Access Keys IAM Policies Security Groups AWS naming can be a bit strange, and there are a lot of components within their security infrastructure, known as IAM. This page will introduce you to the various components are and what they’re used for. Keep in mind this is just a primer; there’s…
My Thoughts on ELYSIUM Basis
I’ve been into supplements since my early 20’s. I’ve just always been intrigued by the possibility of being a better version of myself, via whatever means. A supplement has emerged recently called ELYSIUM Basis that is generating significant chatter in a few circles, and the reason for that is it’s associated with anti-aging. It’s quite controversial, but it’s…
Unsupervised Learning: No. 74
This week’s topics: Shadow Brokers, fingerprinting Netflix traffic, Magneto vuln, Juniper advisories, Amazon speaker tech, Facebook’s 100Gbit optical switches, Google Hire, Minecraft currency, a solar-powered water harvester, OWASP Top 10 draft comments, remote SSH, EC2 and NAT firewalls, deep learning is a black box, discovered links, and more… This is Episode No. 74 of Unsupervised Learning—a weekly show…
Is Trump Pursuing Innovation at Any Cost?
I’ve been having a crazy thought the last couple of months that I couldn’t quite capture. Then my friend Saša hit me with a similar idea this morning. It’s kind of scary, and it goes like this: Trump believes that economic growth will heal all wounds in the country. He believes it’ll fix our position in the world,…
AWS EC2, Default NAT, and Security Groups
One of major differences I’ve noticed after making the switch from Linode to AWS is how network security works. On Digital Ocean, Linode, and most other VPS hosts, when you get an IP the IP is live on the internet. People can ping it directly, in other words (assuming you allow that in your OS itself), and any…
How to Connect to a Local Port on a Remote SSH Server
If you ever have a web server (or other type of server) running on a remote Linux box, and you want to connect to it using your local system, here’s how you do it. ssh -i ./.ssh/key.pem -N -L 8081:localhost:8000 user@host This reads as: Authenticate using a key. The port you’re listening on on your local system is…
Comments on the OWASP Top 10 2017 Draft
I’m going to make some comments about the proposed 2017 update of the flagship OWASP Project—the OWASP Top 10. Before I do, I just want to say that as a present and former leader of multiple OWASP projects (IoT Security, Mobile Top 10, Game Security Framework, etc.) over the last seven years, I empathize with the difficulty of…
On Forcibly Removing People From Your Private Business
There’s been another incident with United this week. This time they created their own overselling problem, let people actually board the plane and get seated, and then told them that four people had to get off the plane because employees needed to fly. Nobody volunteered to give up their seat—even after being offered increasing sums of money—so they…
Unsupervised Learning: No. 73
This week’s topics: Word 0-day, BrickerBot, iOS GIF, Russian arrested, Tizen, OilRig, APT10 MSPs, Dallas sirens, ATM drilling, Watson golf, Uber Italy, AI memory, links, projects, and more… This is Episode No. 73 of Unsupervised Learning—a weekly show where I curate 3-5 hours of reading in infosec, technology, and humans into a 15 to 30 minute summary. The…
A Few Thoughts on Creativity and Age
I just read this NYT article about a brilliant physicist who happens to be 94-years-old. The article basically said that it could be that people get more creative when they get older, which, as they explain, is in contrast to youth-worship that pervades Silicon Valley. I have some ideas about this. First, I think most of cognitive decline…
Adjacent Possibles
I had a great conversation with friend and colleague Josh Corman this weekend about various information security topics. Josh is one of those people who produces multiple packets of interesting speech and thought during the course of a conversation. He creates these bundles, collects them, and can employ them whenever needed. It’s quite remarkable. Anyway, one he had…
Bookstores vs. Check Cashing Places
I think the two most opposite geographic markers, in terms of income and class dynamics in the United States, might be bookstores and check cashing establishments. I was just driving in Fremont, CA and realized that there are no bookstores there. Same with Newark, Milpitas, Union City, etc. They have no bookstores, no Philz, no Apple Stores—none of…