Palin Speech: the less said the better

I didn't actually watch it (way past my bedtime) but my wife read it this morning (and the accolades from CNN and Yahoo News) and she was pissed, saying things that if a man said it, would be considered sexist.

The blogs have been pretty quiet on the speech, but Cognitive Dissonance caught my attention.

But I don't think the speech will be effective beyond the very near term (the next 3-7 days) at moving votes in McCain's direction, if it moves them at all. And here's why:

I think some of you are underestimating the percentage of voters for whom Sarah Palin lacks the standing to make this critique of Barack Obama. To many voters, she is either entirely unknown, or is known as an US Weekly caricature of a woman who eats mooseburgers and has a pregnant daughter. To change someone's opinion, you have to do one of two things. Either, you have to be a trusted voice of authority, or you have to persuade them. Palin is not a trusted voice of authority -- she's much too new. But neither was this a persuasive speech. It was staccato, insistent, a little corny. It preached to the proverbial choir. It was also, as one of my commentors astutely noted, a speech written by a man and for a man, but delivered by a woman, which produces a certain amount of cognitive dissonance.

In exceedingly plain English, I think there's a pretty big who the fuck does she think she is? factor. And not just among us Daily Kos reading, merlot-drinking liberals. I think Palin's speech will be instinctively unappealing to other whole demographics of voters, including particuarly working-class men (among whom there may be a misogyny factor) and professional post-menopausal women.

Let's hope so. And for "if God be for us, who can be against us" (and we all know God is on the side of George W. Bush and Sarah Palin, right?) crowd, no that is the only authority that is needed.

Chrome: Definitely Snappier for Google Apps

And they have cool comic book, style documentation too.

And you thought I was going to blog about Palin again.

Sheesh.

Since you were talking about Churches?

From Palestinian Attack In Israel Part of God's Judgment, Said Recent Guest At Palin's Church

In a talk entitled "The Jerusalem Dilemma," Brickner also went on to describe all of the problems in the Middle East as related to Jerusalem. "But what we see in Israel, the conflict that is spilled through the Middle East, really which is all about Jerusalem, is an ongoing reflection of the fact that there is judgment," Brickner told Palin's church, adding: "Judgment is very real and we see it played out on the pages of the newspapers and on the television. It's very real. When Isaac [Brickner's son] was in Jerusalem he was there to witness some of that judgment, some of that conflict, when a Palestinian from East Jerusalem took a bulldozer and went plowing through a score of cars, killing numbers of people. Judgment -- you can't miss it."

A Gamechanger All Right

Obama breaks 50% for the first time and Bush will talk about 9/11 again in his speech again tonight. That is a fastball ready to be hit out of the park.

"To protect America, we must stay on the offense, stop attacks before they happen and not wait to be hit again. The man we need is John McCain," Bush will say, according to the excerpts.

And Republican's will go after the media tonight. Yeah. Tell me where the the panic is. How did attacks against the "biased" media work for Hillary. I thought so.

Live by the sword. Die by the sword.

Tide (in media) is Turning v. Palin?

Yeah, definitely looks like the euphoria on Friday of the "bold choice" is wearing thin. Really quite sad to watch. Command of National Guard? Proximity to Alaska? Come on guys, dig the hole deeper. The real interesting thing is to see how this resolves itself. I wonder what is going on behind the scenes in the GOP? It is one thing to hear Hannity and Rush, but I heard Jack Kemp spewing the party line on Palin. The thing I wondered when McCain was introducing her, was did he really believe what he was saying. And if he didn't, did he really care?



Found on TPM

And regarding this whole Alaska Independence Party thing, that sort of thing doesn't surprise me one bit. There was quite a bit of that in Texas and I used to bring in news articles from these sorts of secessionist groups when I talk 7th Grade Texas History down in San Antonio.

Good to go back to work tomorrow so I can stop all this political soap opera, although truth be told I actually did a bunch of Python coding over the 3-day weekend and made it down to the Mall today and saw the WW II Memorial, which from ground level was sort of underwhelming, but once you go down next to the pool, it starts to grow on you.

Wiki as an Intel Source?

There was an interesting article in the NY Times on last minute edits to Palin's Wikipedia page

The fact that campaign officials or others sympathetic to the McCain-Palin ticket spiced up here Bio is not surprising -- but using Wikipedia (or other Open Source collaborative knowledge-bases) to predict events in the real world, is.

Last year, a graduate student, Virgil Griffith, created a clever Web site, WikiScanner, that made it easy to detect where anonymous editors of Wikipedia were accessing the site. In the process, companies, government agencies and, yes, politicians were caught in the act of spiffing up their Wikipedia entries, even as many assumed that anonymity would make them safe. (Wikipedia, incredibly and mercilessly, keeps a record of every change made to every article.)

YoungTrigg made the last edit Friday morning, hours before the news of the Palin selection became official. But in the wee hours the day before, when no one was really paying attention, YoungTrigg did contact other Wikipedians, who were initially impressed by the rapid improvements to the article.

Country First, Principles above Politics?

It's really sad. From Advisers Say Conservative Ire Pushed McCain Away From Picking Lieberman

For weeks, advisers close to the campaign said, Mr. McCain had wanted to name as his running mate his good friend Senator Joseph I. Lieberman of Connecticut, the Democrat turned independent. But by the end of last weekend, the outrage from Christian conservatives over the possibility that Mr. McCain would fill out the Republican ticket with Mr. Lieberman, a supporter of abortion rights, had become too intense to be ignored.

With time running out, and after a long meeting with his inner circle in Phoenix, Mr. McCain finally picked up the phone last Sunday and reached Ms. Palin at the Alaska State Fair. Although the campaign’s polling on Mr. McCain’s potential running mates was inconclusive on the selection of Ms. Palin — virtually no one had heard of her, a McCain adviser said — the governor, who opposes abortion, had glowing reviews from influential social conservatives.

This is the difference between McCain in 2000 and 2008. This is why folks that have never voted Democrat (like myself) will be doing so this year. Well, that and the small problem of the incompetent arrogance of Bush-Cheney.

The Joke Continues

Creepy, downright creepy... And since when do Republican's have "PEACE" in their slogan. As Clay Davis would say, "that is some shameful shit!"

And I thought he was reading her speech

From the Jed Report (of course). When I watched their speeches the first time, their presence together was really awkward and bizarre.



This is only one day in, and I'm sure there will be a lot more of this. It would be funny if it weren't so frightening.

Best McCain/Palin Analysis So Far

And the best line from the politico article

Nor can McCain argue that he was looking for someone he could trust as a close adviser. Most people know the staff at the local Starbucks better than McCain knows Palin.

Not Only did she play the flute she has a PoliSci Minor from the Univ of Idaho

Yeah, sure both inexperienced and have no foreign policy experience. Yeah definitely, worse than Quayle.

They don't call him Isane John McCain for nothing.

AccordingWikipedia entry

Palin was born Sarah Louise Heath in Sandpoint, Idaho, the daughter of Sarah Heath (née Sheeran), a school secretary, and Charles R. Heath, a science teacher and track coach.[2][3] She has English, Irish, and German ancestry.[2] Her family moved to Alaska when she was an infant.[3] She and her father would sometimes wake at 3 a.m. to hunt moose before school, and the family regularly ran 5 km and 10 km races.[3]

Palin attended Wasilla High School in Wasilla, Alaska, where she was the head of the school Fellowship of Christian Athletes,[3] and the point guard and captain of the school's basketball team. She helped the team win the Alaska small-school basketball championship in 1982, hitting a critical free throw in the last seconds of the game, despite having an ankle stress fracture at the time.[3] She earned the nickname "Sarah Barracuda" because of her intense play,[3] and was the leader of team prayer before games.[3]

In 1984, Palin won the Miss Wasilla beauty contest, then finished second in the Miss Alaska pageant,[4] which won her a college scholarship.[3] In the Wasilla pageant, she played the flute and also won Miss Congeniality.[5][6]

Palin holds a bachelor's degree in journalism from the University of Idaho, where she also minored in political science.[7] She married Todd Palin, her boyfriend since high school, on August 29, 1988. She then briefly worked as a sports reporter for local Anchorage television stations while also working as a commercial fisherwoman with her husband.[3]

Now Obama

Barack Hussein Obama II[1] was born on August 4, 1961, in Honolulu, Hawaii, to Barack Obama, Sr., a Black Kenyan of Nyang’oma Kogelo, Siaya District, Kenya, and Ann Dunham, a White American from Wichita, Kansas. His parents met while attending the University of Hawaii at Manoa, where his father was a foreign student.[2] They separated when he was two years old and later divorced.[3] Obama's father returned to Kenya and saw him only once more before dying in an automobile accident in 1982.[4] After her divorce, Dunham married Lolo Soetoro, and the family moved to Soetoro's home country of Indonesia in 1967, where Obama attended local schools in Jakarta until he was ten years old. He then returned to Honolulu to live with his maternal grandparents while attending Punahou School from the fifth grade in 1971 until his graduation from high school in 1979.[5] Obama's mother returned to Hawaii in 1972 for several years and then back to Indonesia for her fieldwork. She died of ovarian cancer in 1995.[6] As an adult Obama admitted that during high school he used cocaine, marijuana, and alcohol, which he described at the Saddleback Church Civil Forum on the Presidency as his greatest moral failure.[7]

Following high school, Barack Obama moved to Los Angeles, where he studied at Occidental College for two years.[8] He then transferred to Columbia University in New York City, where he majored in political science with a specialization in international relations.[9] Obama graduated with a B.A. from Columbia in 1983, then worked for a year at the Business International Corporation[10] and then at the New York Public Interest Research Group.[11][12]

After four years in New York City, Obama moved to Chicago to work as a community organizer for three years from June 1985 to May 1988 as director of the Developing Communities Project (DCP), a church-based community organization originally comprising eight Catholic parishes in Greater Roseland (Roseland, West Pullman, and Riverdale) on Chicago's far South Side.[11][13] During his three years as the DCP's director, its staff grew from 1 to 13 and its annual budget grew from $70,000 to $400,000, with accomplishments including helping set up a job training program, a college preparatory tutoring program, and a tenants' rights organization in Altgeld Gardens.[14] Obama also worked as a consultant and instructor for the Gamaliel Foundation, a community organizing institute.[15] In mid-1988, he traveled for the first time to Europe for three weeks then Kenya for five weeks where he met many of his Kenyan relatives for the first time.[16]

Obama entered Harvard Law School in late 1988 and at the end of his first year was selected as an editor of the Harvard Law Review based on his grades and a writing competition.[17] In his second year he was elected president of the Law Review, a full-time volunteer position functioning as editor-in-chief and supervising the law review's staff of 80 editors.[18] Obama's election in February 1990 as the first black president of the Harvard Law Review was widely reported and followed by several long, detailed profiles.[18] He graduated with a Juris Doctor (J.D.) magna cum laude from Harvard in 1991 and returned to Chicago where he had worked as a summer associate at the law firms of Sidley & Austin in 1989 and Hopkins & Sutter in 1990.[17][19]

The publicity from his election as the first black president of the Harvard Law Review led to a contract and advance to write a book about race relations.[20] In an effort to recruit him to their faculty, the University of Chicago Law School provided Obama with a fellowship and an office to work on his book.[20] He originally planned to finish the book in one year, but it took much longer as the book evolved into a personal memoir. In order to work without interruptions, Obama and his wife, Michelle, traveled to Bali where he wrote for several months. The manuscript was finally published as Dreams from My Father in mid-1995.[20]

Obama directed Illinois Project Vote from April to October 1992, a voter registration drive with a staff of 10 and 700 volunteers that achieved its goal of registering 150,000 of 400,000 unregistered African Americans in the state, leading Crain's Chicago Business to name Obama to its 1993 list of "40 under Forty" powers to be.[21][22]

Obama taught constitutional law at the University of Chicago Law School for twelve years, as a Lecturer for four years (1992–1996), and as a Senior Lecturer for eight years (1996–2004).[23]

In 1993 Obama joined Davis, Miner, Barnhill & Galland, a 12-attorney law firm specializing in civil rights litigation and neighborhood economic development, where he was an associate for three years from 1993 to 1996, then of counsel from 1996 to 2004, with his law license becoming inactive in 2002.[11][24]

Obama was a founding member of the board of directors of Public Allies in 1992, resigning before his wife, Michelle, became the founding executive director of Public Allies Chicago in early 1993.[11][25] He served on the board of directors of the Woods Fund of Chicago, which in 1985 had been the first foundation to fund Obama's DCP, from 1993–2002, and served on the board of directors of The Joyce Foundation from 1994–2002.[11] Obama served on the board of directors of the Chicago Annenberg Challenge from 1995–2002, as founding president and chairman of the board of directors from 1995–1999.[11] He also served on the board of directors of the Chicago Lawyers' Committee for Civil Rights Under Law, the Center for Neighborhood Technology, and the Lugenia Burns Hope Center.[11]

Even Pat Buchanan liked the speech

I always liked Pat Buchanan, even when I didn't agree with him. And he nails what I also thought was one of the most effective moments last night.



What all this change and hope stuff is about (in case you don't get it yet and which Obama explained aound "it is about you" lines in his speech) is the shedding of your cynical beliefs. It is abandoning the urge to tear things down.

The reason why people liked Reagan is because he inspired people. Words matter. Words inspire. Words bring people into action.

More Interesting than ModScan

From SCADA Scanning

I’ve you ever wanna try something fun, scan some frequencies that are assigned to local utilities. Sometimes you might happen upon some signals that sound like an old modem. It might surprise you to learn that some of these are actually modems that are transmitting data via analog signals. If you hook up the audio out from your scanner to the audio input on your notebook you can utilize various programs decipher or decode those transmissions. Below is a screen shot of a scanner program doing just that. The information that is in hex which would need to be converted to ascii to make it human readable.

Since I was not an intercept operator I don't know anything about this stuff.

McCain should return to Honor

I actually saw Return with Honor in the theatres back in the mid-late 90s (or whenever it was, all I remember is that I saw it in San Antonio). And as a child I remember reading Five Years To Freedom. Both good stuff.

It is really too bad "I was a POW" is McCain's answer to everything now. It makes a mockery of this experience and deservedly brings on mockery like this....

Something is Rotten with Gimp & Powerpoint

Gimp causes blue screens on Windows. It's happened a half-dozen times lately. IRQL something or other. Oh and and you can predictably crash Powerpoint 2003 and 2007 by pasting in cut's from Gimp.

Two-three hours gone. Powerpoint 2007 autorecovery (saving every 10 minutes) didn't work for shit.

Funny Thoughts On Why Folks don't go to SCADA Conferences

So the the latest on why someone isn't going to a SCADA conference comes from Walt on why he isn't going to PCSF this year.

I am not attending PCSF next week because of the press of work here. I have a 100 page magazine to get out by Friday of next week, and we are significantly behind schedule.

We'll I'm not going to PCSF (although I was invited to present, too) because I picked another SCADA CyberSecurity conference instead. Besides having bad memories of PCSF in 2006 (being told I was arming terrorists or something, I'm probably exaggerated) I have a bit of Cisco nostalgia, so I wanted to go to San Jose instead.

Of course the real reason I'm blogging on this is due to Joe's complaining about who didn't show up to his conference and Dale's post on why most SCADA conferences aren't worth attending.

Country First!

(I think I'm going to end all my posts with that until the election!)

Go To a Non-Technical (Non-Security) Conference, Dummy!

So I've been to a lot of conferences and trade-shows over the past 15 years, but the last two days at the SALT Interactive Technologies Conference in Crystal City has been refreshing and not just because I took the MARC down.

I also learned that taking public transportation from Western Maryland is sort of impractical, because each way the commute took over 2 hours. But I was able to work the majority of the time, so it wasn't wasted time and there were only a few places on the Brunswick Line the EVDO faded out.

My main objective in a attending the conference was to brush up on instructional design and get a jump start on e-Learning tools and technologies. But there were three things that I noticed that were refreshingly different from most of the technical security conferences I've been to as long as I can remember.

1) There weren't all the big egos.

2) The speakers could actually communicate effectively.

3) There was none of "the sky is falling"/"we are so F-d" talk that seems to be the norm.

Among the better presentations were by Marie-Pierre Huguet (on blending constructivism and behaviorism in instructional, a talk on thinking strategically (when developing eLearning solutions) by Mark Siegel.

There was also really good talk on rapid development of training using a modified spiral development model used quickly develop FISA training on the Protect America Act last summer. So you can guess the agency affiliation of these "DoD" and bah.com duo that gave the talk.

So if you've been doing security (or technology) for more than 5-6 years (that was about when I started to get restless and start wishing for a career change that would never come) I encourage you to find a business, or training, or knowledge management -- or something non-technical for a change of pace.

You won't regret it!

Awkward Teenage Cisco?

Here are some interesting quotes from CSO said Cisco security is growing up

Microsoft has been very public about how they changed the company to make security a priority. What's the story at Cisco? How did the security program get built?

We were probably in the same space. Many companies, including our own, started with building stuff first that solved communications problems and then thinking about the safety of communications afterwards.

About five years ago, we were fighting the company, my team. Mostly in the information security business. We were the "no" organization, the ivory tower. That's a dangerous place to be because my take is we ought to be a consultative fulfilment arm, not an adjudicator.

So we changed a lot of it and we started injecting things, like "You're going to have expertise in your team. We're not going to be even in the middle, so that way you can invest the expertise for what you need and we're not holding you up or bringing you into a slower position."

and

So did you do something like adopt a secure development lifecycles or change the way you built products?

We're not mature in this. We're in the awkward teenage phase. We're testing at the end of the development process and we're figuring out from that data how do you go backwards into the definition process. Now some definition happens anyway. So for example there are some baseline requirements of every product we built. However, I still say there's a lot to be learned. When you think you've got it right and you build it and you test it, the learnings from the test should benefit the next thing you build.

We haven't adopted a secure development lifecycle like Microsoft yet. We haven't nailed up equally on all product lines in a very consistent methodical measurable way, and that's why I say we're in that awkward teenage phase.

Comments on Saddleback

I missed the first part of Obama's conversation with Warren tonight at Saddleback, but caught all of McCain's. Definitely the best campaign discourse I've seen in a while. And McCain definitely was sharper that I expected

But I think one of Sullivan's readers nailed it on McCain.

While he is more animated than usual, he recites the tired talking points of his stump speech we all have heard a million times. Not conversational like Obama, he says nothing remotely original. His responses are set pieces he has seared in his memory from countless repetition.

Apart from the style and the generally "grandpa tell me a story" approach to McCain's answers, I think there was stark contrast on the following questions:

Supreme Court Justices - Obama carefully reasoned it out. Thoroughly. McCain just picked those he didn't agree with. I never thought I'd say this, but this is Bush III to a tee. No time for thinking, here. You are for us or you are against us. This is why folks like me (who in the past might have called themselves "conservative" but now are afraid to use the term) would even consider a Democrat this year. And this Democrat. And the answer on Roberts and Executive Power was right on the money. McCain is either not capable of this or sort of thoughtfullness or is not willing to show it. I'm not sure which is worse. We need competence, not ideology.

Taxes - How can the "Democrats will raise you taxes" work in 2008? I guess that is all Republican party have? I did happily find out I was middle class, though. I was sort of worried. McCain used humor to defuse his arrogance and ignorance and dodge the question. It's all about hope and optimism and other 20th Century cliches that will not rebuild our infrastructure or solve this century's problems.

Evil - McCain is delusional if he thinks AQI (or even AQ) is the greatest evil and that Iraq is where we will defeat evil. Evil can only be defeated by God. Obama stressed the need from humility and how evil can be done by those trying to do good -- to do God's work. It is Bush's (and Rumsfeld's) hubris that by hard power alone we can exact change that we can spread "freedom" (insert your best Dubya pronunciation here) The world does not work like that. In the 1980s (whether through luck or by strategy) talked about the "Evil Empire" and it appeared to work. The "Axis of Evil?" Not so much.

It was clearthat McCain's audience tonight was his base (how many times did he repeat "Judeo-Christian" and "Reagan" and he did not blink an eye about when life begins) and Obama had a much lower bar. Show up. Not appear Muslim or scary.

But seriously, Obama's confident closing pretty much summed up the differences and what is at stake this year. If the American people want 4 more years of simple, black-and-white (but ultimately delusional) answers to difficult problems then we will get McCain and we will deserve him.

Bring it on.

McCain (or the "millennial" McCain) would have made a fine president in the 80s or maybe even the 90s but the world is too complex, too interconnected, moves too fast and America is clearly much worse off than it was 10 or 20 years ago.

Iraq Vets on C-SPAN: Must Listen To Radio

I tried to convey my excitement about this series on C-SPAN but I think it is one of those things you really can't appreciate unless you were in the military. The positive attitude that these soldiers demonstrated, the lack of bitterness after incredible suffering

Unfortunately I couldn't find the female Sergeant who I heard last night washing dishes and again today on the commute home. But what I do remember was her disappointment in the media about "telling the truth" about what went on, her ambivalence about what is at state in this year's election, and so much more.

It's the kind of thing can simultaneously inspires and depresses you.

CPNI Secures the Internet

Wonder how much Fernando Gont got for writing this

This document aims to raise awareness about the many security threats based on the IP protocol, those that we are currently facing, and those we may still have to deal with in the future. It provides advice for the secure implementation of the IP, and also insights about the security aspects of the IP that may be of help to the Internet operations community.

And some profound statements like

Producing a secure TCP/IP implementation nowadays is a very difficult task partly
because of no single document that can serve as a security roadmap for the protocols.

Sure. Great. Uh huh. And it only took a year.

What next?

ARP?

How about Ethernet while you are it.

Oh no, definitely go for TCP.

L2 Bridge ACLs on Cisco 800 Series ISRs

So it's obvious from this blog I was never a CCIE.

Hell, I barely passed the CCNA 2.0 exam many years ago (not because my IOS skills were that lacking, it was a bad exam, I tell you)

So had a hell of a time finding the extremely simple way to filter MAC addresses on a bridge interface, such as what I'm using on my 851 at home on my kids subnet. Well it was just my kids subnet until the damn Verizons Westel started acting up so bad with WPA with my Linux boxes lately.


I'm too lazy to do WEP (although it does work) and I've never had any luck with WPA under IOS. And yeah the first thing I did was wipe the web interface from flash.

So I figured how hard could it be. But I couldn't find it anywhere until I ran across a CCIE study guide on bridge filtering. Duh.

851w#sh access-lists 700                                                        
Bridge address access list 700                                                  
    permit 0012.f0xx.xxxx   0000.0000.0000 (23 matches)                         
    permit 001d.7exx.xxxx   0000.0000.0000 (38 matches)                         
    permit 0013.e8xx.xxxx   0000.0000.0000 (1930 matches)                       
    permit 0013.5fxx.xxxx   0000.0000.0000   

I learned the hard way there is an implicit deny at the end. And with the 700 series ACLs you don't need to have the 0000.0000.0000

So then you just add "input-address-list 700" to your bridge group and viola!

interface Dot11Radio0.1                                                         
 encapsulation dot1Q 1 native                                                   
 bridge-group 1                                                                 
 bridge-group 1 subscriber-loop-control                                         
 bridge-group 1 input-address-list 700                                          
 bridge-group 1 spanning-disabled                                               
 bridge-group 1 block-unknown-source                                            
 no bridge-group 1 source-learning                                              
 no bridge-group 1 unicast-flooding    

Completely secure, because like the OpenBSD folks I don't rely on security at Layer 2 or 3. It's all in the OS and applications.

And I didn't try it (enough for one night, my reading glasses are already on) but I'm guessing I could do masks as well so I could filter out Apple or Dell MAC addresses and only allow Intel Wireless client adapters.

Now that would be really secure!

Bush as Carter / Georgia as Afghanisation '79

Andrew Sullivan nails it

Imagine that Bush is a Democrat (not that hard when you consider his fiscal record). Now imagine that a Democratic president had presided over the worst attack on American soil in history, a far stronger Iran on the brink of nukes, and a resurgent, aggressive Russia, willing and able to invade and terrorize a neighboring country in part because the president long believed that its president was a good man, and had looked into his soul.

I think they would have impeached him a few years ago, no? He would be viewed as the Carter to end all Carters

Then there is of course all the impotent tough talk against the Russians. We aren't going to do shit about Russia -- nor should we.

Russia's Georgian adventure is actually pretty brilliant. It demonstrates the impotence of an apathetic Europe that is probably suspicous of the East anyway and an overextended (oil-starved) America that is talking tough about NATO expansion and missle defense in Russia's backyard.

Start a small (or not so small) invasion of a pro-Western (maybe!) neighbor for a few days. Then back down when America agrees to stop all messing around in your backyard.

Brilliant, I tell you.

If you get invaded, bombed, shut off the net, start blogging!

So I guess we really have no way of knowing whether http://georgiamfa.blogspot.com is really the Ministry of Foreign Affairs of Georgia but here are the good parts

Georgian military forces were able to resist attacks by the Russian army and managed to push and keep Russian forces out of the South Ossetian town of Tskhinvali until very late into the night.

The fierce battles inflicted heavy damage on the Russian forces. During the course of the day, they lost about 40 tanks, as well as a number of smaller artillery pieces, APCs and soldiers.

Early in the morning, overwhelming Russian reinforcements were poured into the theatre, including dozens of tanks, APCs, and katyusha rocket trucks, supported by hundreds of troops.

Russian air forces have been attacking Georgian positions throughout the night in and around Tskhinvali, in a "burned earth" tactic reminiscent of the Russian devastation of Grozny, Chechnya, in the 1990s. As a result, Tskhinvali was largely reduced to rubble, and Georgian forces were forced to redeploy to the outskirts of the city, and unilaterally ceased returning fire. Nevertheless, Russian attacks continued.

Youtube videos please!

For the price of registering my 2001 Accord in Maryland I could get...

I really need to stop reading LinuxDevices because I continue to be intrigued by Netbooks although there is no way in hell I'm getting another laptop.

But on Amazon for $399... ASUS Eee PC 900 16G (8.9" Display, Intel Mobile CPU, 1 GB RAM, 16 GB Solid State Drive, Linux, 4 Cell Battery) Galaxy Black.

1 GB, 16 GB Solid State... sweet!

More Interesting than Modscan: .ru vs. .ge

If you've been following the Defcon SCADA silliness check out Dale's post then look at these on the Cyber aspect of the Georgia vs. Russia conflict.

Part I

As requested by community relay, the following is a report on the cyber war underway in parallel with conventional warfare. Many of Georgia’s internet servers were under external control from late Thursday, Russia’s invasion of Georgia commenced on Friday. It is further requested of any blog reader the information below is further relayed to the International Press and Community to ensure awareness of this situation. Also as much of Georgia’s cyberspace is now under unauthorized external control the following official press statement is circulated without modification. Report on the cyberwar below:

And part II

As an update; within the community, our friends in Germany had managed to pierce the siege and gain a direct routing to Georgia via AS3320 DTAG Deutsche Telekom for a few hours. this afternoon. For the time being AS8359 COMSTAR Direct Moscow region network CJSC COMSTAR Direct Smolenskaya Sennaya Sq, 27 block 2 119121 Moscow, Russia, have intercepted this and are redirecting this route of cyber traffic via their servers. The good news is other German servers are now also attempting to access Georgia servers directly.

McCain as Bush 3rd^H^H^H1st Term?

Whether it is rhetorically effective or not, I never cared much for the McCain as 3rd Bush term line of argument from the Democrats but the Bush 1st term makes a lot more sense

Obama’s statement put him in line with the White House, the European Union, NATO, and a series of European powers, while McCain’s initial statement—which he delivered in Iowa and ran on a blog on his Web site under the title “McCain Statement on Russian Invasion of Georgia,”—put him more closely in line with the moral clarity and American exceptionalism projected by President Bush’s first term.

I admit that I found this "moral clarity" appropriate following 9/11 but in hindsight it has obviously been flawed.

Obama as Reagan (inexperienced celebrity!)

Top 10 Worst TItles (and other thoughts on BlackHat 2008)

With each passing year I find it difficult to get excited about BlackHat (of course I don't attend) but regardless of the topics there are some real doozies in terms of lame titles (who cares about the content)

• SQL Injection Worms for Fun and Profit / Windows Hibernation File for Fun and Profit - nothing with "fun and profit" should be accepted in 2008
  
• Bad Sushi: Beating Phishers at Their Own Game - sushi is a security cliche, almost as bad as fuzzing
  
• Taking the Hype Out of Hypervisors - nice try
  
• Got Citrix, Hack It! - uh huh, sure.
  
• Black Ops 2008 -- Its The End Of The Cache As We Know It - I'm a big fan of eschatology but channeling REM is not cool
  
• Highway to Hell: Hacking Toll Systems - AC/DC is better than REM but rm the "hacking..." bit
  
• The Internet is Broken: Beyond Document.Cookie - Extreme Client Side Exploitation - if I hear the Internet is broken one more time...
  
• Pushing the Camel through the Eye of a Needle / Encoded, Layered, and Trancoded Syntax Attacks: Threading the Needle past Web Application Security Controls - they shouldn't have accepted two prezos with "eye of the needle"
  
• Satan is on My Friends List: Attacking Social Networks - without Dan Farmer it just doesn't work
  
• A Fox in the Hen House (UPnP IGD)

Which titles (if not necessarily the content) do I think work? No explanation is necessary.

• Leveraging the Edge: Abusing SSL VPNs
• REST for the Wicked
• Malware Detection Through Network Flow Analysis
• Braving the Cold: New Methods for Preventing Cold Boot Attacks on Encryption Keys
• Pointers and Handles, A Story Of Unchecked Assumptions In The Windows Kernel

Presentations that actually look interesting and I will probably look at the slides when they are out

• Passive and Active Leakage of Secret Data from Non Networked Computer
• SmartCard APDU Analysis
  
• Predictable RNG in the Vulnerable Debian OpenSSL package, the What and the How
• Side-channel Timing Attacks on MSP430 Microcontroller Firmware - anything that mentions JTAG is cool
  
• The Four Horsemen of the Virtualization Security Apocalypse - gotta check out the Hoff
  
• Circumventing Automated JavaScript Analysis Tools - I probably won't understand a lick of it
  
• Developments in Cisco IOS Forensics - go FX!
  
• Malware Detection Through Network Flow Analysis
• No More Signatures: Defending Web Applications from 0-Day Attacks with ModProfiler UsingTraffic Profiling - a Black Hat talk that actually proposes solutions!
  

McCain Ad Parody Roundup

and



and (although not a parody but or good as the Hillary one) still amusing

Is Digital Bond's SCADApedia arming attackers?

Unless you've subscribed to the RSS you've probably missed all the cool stuff like a list of control systems ports (watch out for typos or other errors though on Bacnet and Modbus/TCP of all things!) that is on SCADApedia. Several years ago I can a remember a fairly high level official in a government critical infrastructure protection group commenting that this sort of information should not be made public and of course I would guess that over 75% of the "real SCADA Security experts" (you know the ones that come out of an automation background, hold a PE, use the term "Cyber Security" without a trace of irony) would think this sort of information is dangerous. Or how about the members of the upcoming PCSF Panel on Vulnerability Disclosure (I ran the first one back in 2006 which led to some controversy).

It will be interesting to see how much (or how little) things have changed since then.

Lua is Not Perl so It Must Be OK (or maybe not!)

I'd heard of Lua before, but this week I kept on hearing about it and I have nothing better to do while waiting outside my daughter's door hoping, praying, she'll finally get to sleep.

Lua 5.0.3 Copyright (C) 1994-2006 Tecgraf, PUC-Rio
> print "blah"
blah
> print "blah"
blah
> d = [1,3,4]
stdin:1: unexpected symbol near `['
> d = (1,3,4)
stdin:1: `)' expected near `,'
> d = { 1,3,4 }
> d
>>
>> print d
stdin:3: `=' expected near `print'
> print d
stdin:1: `=' expected near `d'
> d
>> puts
stdin:2: `=' expected near `puts'
> print (d)
table: 0x8062df8
> type(d)
>
> print type(d)
stdin:1: `=' expected near `type'
> print (type(d))
table


The parentheses are weird, but I actually sort of like it, it feels sort of Pythonic but I'm sure its not so off to the Tutorials!

A few minutes later.

Yuck, but OO is bloody awful and after doing Ruby anything with __ just feels dirty, even Python.

OK, there is not point in bothering with Lua, but for a minute there it looked interested.

Move on, nothing to see here.

Punch, Counterpunch

leads to...



Regardless of what you believe on the "issues" (which are hard to distill into 30 second sound bites) tell me how doing a press conference on an oil rig (let alone a German sausage shop) makes sense. Or juxtaposing Paris Hilton, Brittany Spears? Or using 20th century cliches like "American Ingenuity" (McCain was throwing that around in his town hall this week) and talking about manufacturing jobs being the basis of the American economy. Obama will raise my Taxes? Oooh, that scares me.

Where is the John McCain that called a spade a spade and said those jobs aren't coming back?

CentOS 4/5 VMWare Guests

I pretty much will do anything to avoid running RHEL/CentOS on bare metal, but on guests it isn't so bad, because sometimes you have to choice:


Install and Configure VMWare Tools

# yum update
# yum install gcc
# yum install kernel-devel
# reboot
# vmware-config-tools.pl


Enable Time SYNC (you don't need X)

In your .vmx file (on the host obviously)

tools.syncTime = "TRUE"

Olbermann/Maddow v. McCain

Man I could use some Sausages

This place made me think of good old Schilo's in San Antonio on the Riverwalk.

Always There?

Except if you have to support Jim Webb's revised GI Bill.



But seriously, as attack ads go this is pretty weak and not much to get that excited about. And if this is the "character" attack (compared to what they tried on Clinton during the 90s and lost) don't see it working that well for them. And the "Country First" crap? So 20th century. They really think it is effective rhetorically. But I guess that's all they've got.

An interesting contrast to steady hands of Plouffe who appears to actually have a strategy.

Plouffe said that the trip made three important impressions on voters:

1) “Our sense is that voters are looking for a new direction in foreign policy, as well as they are on the economy. We think it’s important to make sure they understand the direction Barack Obama would like to lead us, in terms of foreign policy. The speech in Berlin was a pretty good window into that.”

2) “It’s important for voters to see that when he’s dealing with world leaders and military leaders, that he’s very comfortable and that he is someone who can represent the country well on that stage.

3) “Voters in this country really do want our relationship with the world strengthened and are unhappy that there’s some tension there. We’re going to lead with strength, and not compromise anything. But the fact that he is a potential president who can have a better relationship with our allies and the rest of the world is something that’s very important to voters. The Republicans, at their peril, scoff at that.”

Plouffe said one reason he does not expect a surge in polls is that both Obama and McCain “have pretty healthy bases, so there’s not that many voters really voters in play here, in terms of a swing voter.”

“A lot of them are not going to make a decision right now,” he said. “There’s a chunk of people in this country – probably close to 8 to 10 percent – who are going to sit back and wait for this to unfold.”

Hillary's negative attacks (if I recall correctly) were far more effective.

FredNeckSec 1: Next Thursday

I put the announcement up on citysec last week. I'll be at Barley & Hops around 7 +/- 30 minutes in the bar area. I'll have something with a Cisco logo on it and will probably be drinking one of their mediocre stouts. There should be handful that may make it, but it will be interesting how many security folks there are in this neck of the woods. Feel free to drop me a note or just show up.

PDP gets a Pwnie!

I quit reading GNUCITIZEN because it made me too angry and I would write snarky comments on my blog and the Adrian and PDP would leave comments and I would be forced to argue with those young whippersnappers that are smarter than I am -- but I'll break my vow of silence to congratulate them on their pwnie in the overhyped bug category, of course! I knew you could do it.

Spaf on Obama

Spaf's Blog on a recent security event at Purdue allows me to mix computer security and politics (for once).

Early in his statement, he deviated from his script as reproduced in the paper, and dropped my name as he was talking about cyber security. I was very surprised. He referred to me as one of the nation’s leading experts in cyber security when he mentioned Purdue being in the lead in this area. Wow! I guess someone I sent my email to pushed the right button (although my colleagues and our students deserve the recognition, as much or more than I do).

His further comments on officially designating the cyber infrastructure as a strategic asset is important for policy & legal reasons, and his comments on education and research also seemed right on. It was a strong opening, and there was obviously a lot in his comments for a number of different audiences, including the press.

and

I was really quite impressed with the scope of the discussion, given the time and format, and the expertise of the panelists. Senator Obama was engaged, attentive, and several of his comments and questions displayed more than a superficial knowledge of the material in each area. Given our current President referring to “the Internets” and Senator McCain cheerfully admitting he doesn’t know how to use a computer, it was refreshing and hopeful that Senator Obama knows what terms such as “fission” and “phishing” mean. And he can correctly pronounce “nuclear”! grin His comments didn’t appear to be rehearsed — I think he really does “get it.”

(Before someone picks on me too much…. I believe Senator McCain is an honorable man, a dedicated public servant, and a genuine American hero. I am grateful to have people like him intent on serving the public. However, based on his comments to the press and online, I think he is a generation out of date on current technology and important related issues. That isn’t a comment related to his age, per se, but to his attitude. I’d welcome evidence that I am mistaken.)

Senator Obama is a great orator. I also noticed how his speed of presentation picks up for the press (his opening remarks) but became more conversational during the panel.

Senator Obama kept bringing the panel back to suggestions about what could be done to protect the nation. I appreciated that focus on the goal. He also kept returning to the idea that problems are better solved early, and that investments without imminent threat are a form of insurance — paying for clean-up is far greater than some prudent investment early on. He also repeatedly mentioned the need to be competitive in science and technology, and how important support for education is — and will be.

Watch that send button?

I've gotten much better lately about intentionally sending career-limiting emails in moments of professional frustration (man I wrote some doozies at Cisco, heh) but this accidental White House email is pretty funny. Assuming this is true.

Can you find a John McCain without a Flag?

I'll admit voting for Dubya in '04 but we'll see if the flag waving works this year.

Just How White are You?

Washington Journal (on C-SPAN radio) is just too depressing these days so I've been listening to Elliot in the Morning during my commute and I heard an interview with Christian Lander. Some pretty funny stuff but I guess I'm out of it because I hadn't heard of Stuff White People Like.

Not all of them are funny but some of them are, and many of them are spot on. Unlike Central Austin, Skokie was not a big white people (meaning Liberal white yuppie) places. New Market is very white but it is pretty "country" and not "white" like Seattle/Austin "white."

But anyway, we are guilty as charged with #85: The Wire

If you need to impress a white person, tell them you are from Baltimore. They will immediately ask you about The Wire and how accurate it is. You should confirm that it is “like a documentary of the streets,” the white person will then slowly shake their head and say “man” or “wow.” You will be seen in an entirely new light.

and high school especially the bit about The cure:

If you cannot properly gauge the type of music a white person liked in high school, you should always say that you were really into The Cure. All white people know that liking The Cure in high school is an invitation to be tortured by the cool kids. This will bring about instant sympathy and respect.

as well as Not Having a TV.

The number one reason why white people like not having a TV is so that they can tell you that they don’t have a TV.

Yeah, I have almost every Cure CD before 1995. And we don't currently own a TV, and we watch The Wire on iTunes & Netflix and I have only communicated with one person I went to high school with in the last 20 years!

The Solution to My VMWare Keyboards woes?

I'm trying the fix mentioned here.

Strategy vs. Tactics

Not your usual democrat.

Now, all of us recognize that we must do more than look back - we must make a judgment about how to move forward. What is needed? What can best be done? What must be done? Senator McCain wants to talk of our tactics in Iraq; I want to focus on a new strategy for Iraq and the wider world.

It has been 18 months since President Bush announced the surge. As I have said many times, our troops have performed brilliantly in lowering the level of violence. General Petraeus has used new tactics to protect the Iraqi population. We have talked directly to Sunni tribes that used to be hostile to America, and supported their fight against al Qaeda. Shiite militias have generally respected a cease-fire. Those are the facts, and all Americans welcome them.

For weeks, now, Senator McCain has argued that the gains of the surge mean that I should change my commitment to end the war. But this argument misconstrues what is necessary to succeed in Iraq, and stubbornly ignores the facts of the broader strategic picture that we face.

In the 18 months since the surge began, the strain on our military has increased, our troops and their families have borne an enormous burden, and American taxpayers have spent another $200 billion in Iraq. That's over $10 billion each month. That is a consequence of our current strategy.

In the 18 months since the surge began, the situation in Afghanistan has deteriorated. June was our highest casualty month of the war. The Taliban has been on the offensive, even launching a brazen attack on one of our bases. Al Qaeda has a growing sanctuary in Pakistan. That is a consequence of our current strategy.

In the 18 months since the surge began, as I warned at the outset - Iraq's leaders have not made the political progress that was the purpose of the surge. They have not invested tens of billions of dollars in oil revenues to rebuild their country. They have not resolved their differences or shaped a new political compact.

"Slam dunk" to me. The key question of this election is whether Americans can understand the nuances of strategy -- or do they want a "chump to talk shit" (compare Obama's and McCain's responses to Iran's missle test for what I'm talking about) about threats and not take responsibility for a failed strategy.

Also seems pretty savvy politically, how does McCain respond to this -- assuming he can even string a few sentences together in a coherent manner. More open ended (emotional) saber rattling about how bad the bad guys are (they are Terrorists, after all) or whether he tries to to come up with a new packing for the old lack-of-a-strategy from Bush ("Goddammit, we are Americans, we are free, we want you to be free, and we'll kick your ass to make sure it happens." Which, in the short term, doesn't appear to have worked all the well in spite (and probably because of) all the chest thumping.

Supercool Verizon DSL, Missle Defense and the Power of Knowledge

DSL has come a long way. I put in an order with Verizon over the weekend and I'm up. Compare that to the first time I tried to get DSL back in 1999, and that was when I worked for Southwestern Bell Network Integration. It took like 5 months and I had quit by the time the order finally came through.

All in all no complaints. And more importantly my wife won't keep telling me how horrible our Internet his here. My short experiment of running 4-6 computers through a single EVDO connection is over. Too many user revolts and Verizon was too cheap.

A few minor glitches, had to call tech support, and their IVR was totally hosed, but the first tech I got solved the problem. Hell of a lot better than my experience with Comcast in Vernon Hills when it took over 2 hours after the initial install. RCN was good when it didn't snow, which was a bit of a problem in Chicago

But on the way home from work today listening to C-SPAN Radio, I heard some 3-star director of the the Middle Defense Agency briefing the folks at the Pentagon today. Very impressive and after hearing about this, I'm all for the interceptors they are putting in Eastern Europe. Silly Russians. He was rattling off stuff about azimuths, frequencies, correlation, simulations, various types of radars. Good stuff.

Who knows if it was accurate. The great thing technical knowledge (especially if it is classified) is you never know if they are right or wrong or even telling the truth, but this guy was a good briefer.

The Army and Self Critique

From age 10 to age 14, we lived in Edgewood Area, Aberdeen Proving Ground, Maryland. In the early 80s lots of cool stuff was going on at APG. They were testing the HMMV, the M-1, the Bradley's. Once we made it to one of the ranges and saw some demos.

In many ways it was an idyllic life. Living in a large early 20th Century White house with steam heat radiators, that overlooked the Gunpowder River, where we'd go down to "the beach" (next to the officer's club tennis courts) and throw rocks at the bloated carp that washed ashore until they were obliterated in the sand.

I remember skiing at night into the middle of the parade field with snow falling, knowing full well there would be no school the next day. And during the past two winters in Skokie, when I would look out at the streetlights as the snow streaked down, hoping there would be school I remembered how back in Edgewood I'd wished the opposite.

In summers, I'd drive around post with a special trailer on the back of my bike, where I'd put aluminum cans and cash them in for 29 cents a pound or whatever the price was back then. Once someone was throwing a bunch of those thick 10-ounce Coke bottles that you could get a dime back for each. In a single discover, I managed to get 25 to 30 bucks.

That was a lot of money back in 1982.

I spent a lot of time at the post library, and in particular I remember reading the official U.S. Army histories of World War II. Fascinating stuff. The Battle of the Bulge was always my favorite. But of course there were all the Jane's books and Aviation Week and Space Technology. And then there were those silly little cartoons on "preventive maintenance" (for nearly illiterate enlisted folks, no doubt) that I would only understand the I would only understand once I was enlisted myself. I don't know how many hours I spent at that old white building with decaying white paint, but I checked out a lot of books.

In 1988, back in Maryland again for my last year high school (fter a year at Ft. Leavenworth and two years in Kuala Lumpur, Malaysia, I enlisted (since he was an officer, my dad actually swore me in at the MEPS station not far from where I work now) in the Army Reserves and an Intelligence Analyst (98C) with the goal of joining a unit in Austin, Texas close to where I would be going to college at Texas A&M.

My original plan was to become a Linguist (98G) but a failed the DLAB so badly I went non-linguist route, just as my original plan was two go through ROTC and become an officer, but A&M Corps life was not for me. But I did end up making it to that CEWI Battalion that was attached to the 49th AD (TXNG) and stayed until after college, when I joined the USAR school in San Antonio and taught 98C (both 10 Level and BNCOC) to Reserve & National Guard troops in the summer's off, while a middle school teacher. In one class, I remember a bunch of Special Forces soldiers from Alabama and Mississippi. In 2001 I thought about them, wondering how many of them ended up going to Afghanistan during the final year of my enlistment.

While I'm not sure all of my military experience was so positive (I can remember a few times sleeping (hungover) with my head down next to a SPARC-5 in Camp Bullis, hoping the door code would wake me, or hiding out in the bed a 1.5 Ton Truck in the motor pool at Mabry to avoid "bullshit details"), one of the best lessons I learned from the Army was the AAR.

After you did a Warfighter or an RTEP, after you taught a block of instruction, after you did Annual Training -- there was a time where you conducted an "After Action Review" where (sometimes, unless the officers were gaming them) you 'fessed up what when right and what rent wrong. And why.

Too many times working in the private sector, I found AAR's (or something like them) don't get done. You slog through quarter after quarter wondering why you aren't making any progress.

* * *

Joining these various threads, David Ignatiaus has an an interesting article on the "lessons learned" that hopefully will show up in the history books:

But the Army learned from its mistakes. Rather than sulking about the Iraq mess, commanders made necessary changes. The Army developed a new doctrine for fighting a counterinsurgency; it learned how to work with Iraqi tribal leaders; it pursued al-Qaeda into every village of Iraq; it experimented with soft power, by working closely with Provincial Reconstruction Teams. "One could easily state that the U.S. Army essentially reinvented itself during this 18-month period," the historians write.

This study illustrates what's most admirable about the Army. It has maintained a tradition of intellectual rigor and self-criticism. That's nurtured in the Army's unique program of midcareer education. It's not an accident, but part of the Army tradition, that the current commander in Iraq, Gen. David Petraeus, took a doctorate in international relations at Princeton, or that the former Centcom commander, Gen. John Abizaid, had a stint as commandant of West Point. This tradition is exemplified, too, in the decision of Gen. George Casey, the current chief of staff, to publish this sometimes searing critique of his own service.

Politicians repeat, ad nauseum, philosopher George Santayana's maxim that "those who cannot learn from history are doomed to repeat it." The U.S. Army is that rare institution in American life that is actually putting this precept into practice.

One Mean Little Linux Machine (and how lame is RHEL/CentOS)

I've been wanting to get one these Ultra Slim Form Factor Optiplexes for months, but I finally got my hands on one on Saturday in preparation for the upcoming classes I'll be teaching in a week. So I have a couple of these boxes 3.0 Ghz Core 2 Duos with 4 gigs. Not bad. Small (as you can see) and very quiet. Perfect for a classroom environment.

I would show a nice lshw output, but of course CentOS 5.2 is so lame you can't even pull it from the standard repos, but I guess I'll have to figure out this DAG bullshit. And I struggled for 2 hours yesterday getting the box usable in what would have taken me 10-15. And I'm still struggling.

This is because I work in RHEL/CentOS shop, and ITS laid down CentOS 5.2 for me. That's another thing I'm experiencing some "personal growth" in letting ITS do their job. Definitely a bit of an adjustment when you are used to owning the hardware, the OS, the apps, to let somebody else to the lower layer in the stack. Also much harder to hide in a small company, especially if your office is adjacent to the Director of IT.

It's much easier (and far more pleasant) to do the whole "shadow IT" in big companies, use personal equipment, break all the rules that I'm used to doing in big companies (usually because I was in a "security group" and the rules didn't really apply.) Oh well, what can you do.

Samstag

Dancing 2008: Last Blog of the Night

How many of these exact places have you been?

Town Lake (the Stevie Ray Vaughn statue in Austin) and the Grant Park "jellybean" I remember the best. And most recently.

And the Vancouver, BC picture looks like so many places there. Perhaps the fountain in Auckland and I do remember seeing the Sydney Opera house but I don't remember making to that spot in Singapore in the 80s.

But nothing from KL or Moscow or anything from China that I could? Should have at least had the Temple of Heaven, Forbidden City, or the Great Wall.

Actually a Pretty Well Done McCain Ad

I've always been sort of anti-60s, so maybe that is why I like this ad. Not like it it well get my vote (and I'm not sure who it is targeting), but it's still pretty solid.

At least we were spared with the details of another randomness bug? For now.

So based on the Dark Reading article I'm not sure how scared I should be, but if in doubt I'll go with what Tom P says. He might not know how to keep his Volvo full of gas, but he knows everything else.

(Full disclosure: I was a few minutes away from walking along I-70 yesterday not knowing where the hell the nearest High's was)

But the world didn't end with CA-2001-09 or TA04-111 (the link to the original UNIRAS advisory was gone) so I doubt everything will come crashing down in the coming weeks, but we can only hope.

How many calls for DNSSEC or IPv6 or something tomorrow? And once again, this one of those bugs that its unclear if it is as old as the hills or something revolutionary. And whether it is a design flaw or an implementation bug. And if it is a design flaw in the protocol then why is everyone fixing their implementations? And you if you look at the affected vendors in the CERT advisory. Drum roll.... Doesn't look like the advisory is updated cause Debian already out. No status or FreeBSD or OpenBSD? MIA, again. Will the BSD's be affected?

But I'm glad I'm neck-deep (and nearly drowning) in hell-ish compliance standards for the near term so I don't have to worry about any of these hard questions!

Confusion? I'll show you confusion!

What year is it? What year did I first get involved in various control systems standards efforts. 2003 was it? Hell, I even co-chaired an SP-99 subcommittee. And in one (or probably a lot more than that) of the many quite entertaining CIAG Ops review how too many hours each week were "defining common terms so that everyone could work together."

That probably would have been 2004. And halfway through 2008, they are still at it

Three years ago, I helped establish the first International Standards Coordination Meting on Control Systems Cyber Security for DHS. As part if the effort, I was requested to give a presentation on definitions to demonstrate the lack of clarity and consistency and the need to more succinctly define terms for control system cyber security. I examined the terms "SCADA", "control systems", and "security" and compared the definitions in Wikepedia, Webopedia, AGA-12, NERC, ISA, IEEE, CIGRE, and CIDX. It was fascinating to see not only the lack of consistency, but
even more interesting was that some of these terms were not even defined. It seems like there is a need to resurrect this effort for the August Control System Cyber Security Conference.

Oh no, let's spend hundreds of more man hours on this obviously impossible-to-solve problem. And given the bill rate of a lot of the folks involved in this, think about what you could buy with the the time that has been spent in these groups trying to define terminology.

Give it up guys. Chalk one up for the bad guys.

Oh yeah, and another classic SCADASEC-L Apology. But at least this time, nobody got called an idiot (or a drug dealer) so they are making progress.

Dollar's to Doughnuts I bet it was some of the Canadian subscribers that complained, although quite honestly I found the "happy birthday America" post a bit sappy and out of place, but I've got bigger fish to fry.

Forget about Iron Chef, Go For Hells Kitchen

Instead of Iron Chef I think an angry arrogant British guy hurling insults at 20-something security researchers would be even more amusing: "You little fuzzer! Who do you think you are?!"

Killing Your VxWorks Linksys WRT54Gv6

So I have a v6 which currently runs VxWorks, but I just found this page on how to install dd-wrt and OpenWrt on these Broadcom-based routers.

1. Download [vxworks_prep_v03.zip] and extract.
2. Download [vxworks_killer_g_v06.zip] and extract, OR create a custom firmware image with your MAC address embedded in it. See the 'Changing your MAC address' section below for more information.
3. Download [DD-WRT micro generic]. You may want to check [DD-WRT] to make sure there isn't a newer version than v23 SP2 beta 08/03/06. Do not use the one labelled 'WRT54G' or 'WRT54GS', use the 'generic' version.
4. If you don't know how to use (or don't have) a console mode TFTP tool (i.e. tftp.exe), download the [Linksys TFTP transfer tool].
5. You will want to assign your network adaptor a manual IP address, since you may loose your automatically configured one and have trouble TFTP'ing the firmware. To do this see the troubleshooting section or google it. It's done at the properties dialog of your network connection, in the 'Internet Protocol (TCP/IP)' properties.
6. Go to your router's web based interface and enter the 'Administration' tab. Then select 'Firmware Upgrade' and choose the vxworks_prep_v03.bin file. Hit apply. After a minute, your browser window will go blank. At this point, power cycle your router.
7. Again point your web browser to http://192.168.1.1. You'll see a different sort of firmware upgrade screen. This is the Management Mode. Select and apply the vxworks_killer_g_v06.bin firmware upgrade. WAIT for your browser window to turn to report 'Success'. Have troubles? Try a different web browser, the http daemon in management mode is very finicky.
8. Now unplug the power cord of your router, then plug it back in. The power LED should now be blinking.
9. Now you need to do a binary mode TFTP transfer of DD-WRT micro generic to your router. To do this you can use the Windows TFTP console mode utility, the Linksys TFTP Windows GUI utility, or some other TFTP client. You may have to disable your firewall if by some chance it is blocking outgoing connections on port 69. Many TFTP clients don't default to binary mode, so be sure to specify it (i.e. the -i switch with the Windows console mode TFTP utility).
o For Windows TFTP console mode utility (example, adjust accordingly):
+ tftp -i 192.168.1.1 put dd-wrt.v23_micro_generic.bin
o For the GUI utility
+ simply enter your router's IP (192.168.1.1), select dd-wrt.v23_micro_generic.bin, leave the password field blank, and initiate the transfer.

Do NOT reboot your router after TFTP'ing, this will happen automatically. It takes a couple minutes after the TFTP transfer finishes for the firmware to actually be flashed.

Skip to 'finalizing' below, or 'troubleshooting' if you've run into problems.

It looks like here are all the files

Blog Code Repo & Revised EVDO Scripts

Since pasting code snippets into the Blogger is a real pain and I've been rebuilding a lot of my personal systems lately (and forgetting to save config files) I created a code repo for various stuff I want to have managed under revision control. Last night I added the EVDO (and wvdial) scripts I've been use on my Linux gateway as it has gradually moved from backup comms. I finally migrated over to the Ubuntu Hardy based box I built a few months ago because it has the airprime drivers which allow you to exceed the 500Kbps cap.

Man on the Moon McCain Mashup

We went to the moon because it was hard? What they hell are they thinking with this ad. Gen Xers might remember Col Steve Austin, Tang, and SkyLab, but the whole "moon race" meme just doesn't do much for us.

But it made me think of this scene from A Clockwork Orange where a drunk old man (blathering about morals and respecting the old) get his ass kicked by Alex and his droogs.

Used/Refurb Computer Stores in MD?

One of the [many] cool things about living in Central Austin was being minutes from Discount Electronics but the closest thing I can find appears to be PCRetro any other ideas?

Netgear fumbles (and recovers?) with their Open Source Router

Although I'm no stranger to running custom firmware on Broadcom wireless routers but I've definitely been intrigued by the WGR614L, but there was an interesting forum thread on the challenges of distributing (and supporting) new products but at least they 'fessed up to it and appear to be taking action.

I am the Product Line Manager for Wireless Products at NETGEAR and I apologize.

Please do send me your contact information and I will send you a WGR614L version out immediately. There had been an issue with one of our distributors and a few V9 versions was shipped out by mistake. We have recalled, but I guess you were one of the unfortunate ones to get a V9.

I guess I'll hold off a little longer. And see if I can find the old Dell 2300 AP when the movers come this week.

If you thought baiting BSD bigots was fun...

It is that kind of day, first I mess with BSD Bigots and then I run across the top 10 strangest terrorist patents and the great ad for retro bowling shirts.

New OpenBSD LiveCD

Looks like there is a new OpenBSD LiveCD distro called BSDanywhere. Having built both Linux and OpenBSD LiveCD's the latter is a definitely a pain in the ass, although it is possible.

Although I'm not sure *why* you would want to do it, because with the exception of PF there is no reason to actually use a BSD. But it would be cool if someone wrote a nice GNOME based installer for OpenBSD (like Ubuntu) just to piss off the zealots. Oh and throw in a 20th century package management system while you are at it.

(I did actually get dpkg working on OpenBSD 3.9 once, but never got to apt)

To Actually See the Sky Again!

Took the dog out one last time tonight and was surprised to actually see stars amidst the drone of traffic on I-70 and Maryland 75. Didn't I write about that in one of my first short stories, alluding to Robert Frost's lesser-known (and rather nihilistic, which somehow seems quaint approaching 40, although amazingly I got carded for a 6-pack of Shiner Hefeweizen tonight! ) poem, "Desert Places."

Snow falling and night falling fast, oh, fast
In a field I looked into going past,
And the ground almost covered smooth in snow,
But a few weeds and stubble showing last.

The woods around it have it--it is theirs.
All animals are smothered in their lairs.
I am too absent-spirited to count;
The loneliness includes me unawares.

And lonely as it is that loneliness
Will be more lonely ere it will be less--
A blanker whiteness of benighted snow
With no expression, nothing to express.

They cannot scare me with their empty spaces
Between stars--on stars where no human race is.
I have it in me so much nearer home
To scare myself with my own desert places.

Yes one more data point (as if all the white people didn't weren't enough) that we are actually back in "the country." Well, that and that the lack of the detergent-like smell that was so pervasive in Chicagoland. Like you were standing next to a dryer-vent. The air smelled like that.

Welcome Playbook!

In a past life, I had the pleasure of working with Max and some of the other Matasano folks (as a alpha/beta Playbook customer) so it is good to see it finally see the light of day!

If you know the pain^H^H^H^Hfun of managing rulesets on a large cross-platform firewall deployment, well you know why something like this is necessary.

Obama's Patriotism Speech (and the Call to Shop)

I need to be working on my slides and lab exercises for a course I'm going to be teaching later this month but text of Obama's patriotism speech is worth checking out.

Sadly, in recent years, in the midst of war on two fronts, this call to service never came. After 9/11, we were asked to shop. The wealthiest among us saw their tax obligations decline, even as the costs of war continued to mount. Rather than work together to reduce our dependence on foreign oil, and thereby lessen our vulnerability to a volatile region, our energy policy remained unchanged, and our oil dependence only grew.

On Sunday, as I was wandering the newly-discovered Sprawl in East Frederick, near the intersection of I-270 and I-70 I was thinking about the last 20 years and what had changed (funny how you only notice the changes when you leave a place) and I was thinking about Bush's call to shop after 9/11 and the growth in buying power (and debt) and decline of savings that occurred in the 90s. That still continues.

As I was entering (and exiting, having not purchased anything) the Best Buy, I thought about 1987, when I moved to Frederick, or even when we lived north of Baltimore in the early 80s. There was no Best Buy. For electronics (in the age of Atari and Commodore) you went to Service Merchandise. Where have they gone? There was no Fry's. There was no huge Walmart full of amazing cheap stuff from China. When did Whole Foods come about. This is the gift of Clinton. The excesses of growth.

In 1999 we bought our first house in Crestview (that's in a hip part of Central Austin where prices are still skyrocketing and is no longer the last affordable place inside 183) on the first day we saw it, the downpayment coming from Trident stock options from the Veridian acquisition. From 1994 to 2004 my yearly compensation increased almost 6-fold (I started low, as a public school teacher in Texas and there were some good bonus/stock option years after the "100 year flood") but in 2008 what do we Americans have to show for this prosperity?

In this so-called recession, this "crisis," (as I drive down I-70 I year ads for Information Assurance programs and CDW-G security solutions spiels, there is no crisis in my line of work) I'm amazed the parking lots of the big box stores are still packed full. Is this one last binge? Forget about Reagan's line about 4 years, are we really better off than 10 years ago? 20? What is the cost? For some reason, it is not hard to imagine the big box parking lots of the suburbs like Route 85 in Frederick, 183 near Cedar Park, or 1604 in San Antonio like in the The Road (not Kerouac) emptied in 50 or 100 years. The pace of the beloved 90s (all those Clinton-lovers) is simply not sustainable. Your losses cancel out your gains. Everything catches up with you sometime.

Sullivan: Ruthless

While my wife seeths about the Clintons and Clark-gate (of course a Navy squadron commander doesn't buy you much -- I'd say you need to be at least at Division commander) here is money quotes:

But Obama's post-primary pivot to neutralize all the usual GOP attacks - and reintroduce himself to Middle America - has been more than usually pronounced. He can live with FISA telecom immunity; he's flexible on troop withdrawal from Iraq; he's happy with executing child rapists; he doesn't need public financing; he'll out-patriot the Right; he's touting his support for welfare reform; he'll expand Bush's faith-based programs; and he's okay with the Supreme Court's view of the Second Amendment. Oh, and he'll reduce taxes on the middle class, while hiking them for the rich or successful or whatever you'll let me call them.

and

It's been clear for a long time: A man who beat the Clintons is as ruthless as they are. Just smarter, and less susceptible to losing his grip on the core principles he still believes in.