Sunday, October 23, 2016

Attack of the Killer Crib-Monitors !!

On the heels of the third Presidential “debate”, there was much hand-wringing and finger-wagging against Trump, for refusing to commit himself in advance to not contesting the election, no matter how it turns out.  Actually no rational candidate should do that -- there is always the possibility of a squeaker, in which the seemingly-losing candidate may demand a recount (most recently and notably in Bush v. Gore).   But additionally, there exists a scenario, unfortunately not science-fictional, in which Hillary  not only would, but should, contest the results, and indeed demand something more thorough-going than a mere recount.

Namely, as the candidate herself maintains (very plausibly):
(1)  Russian state actors hacked the DNC data as well as that of the chairman of her Presidential campaign.
(2)  Putin is said to have it in for Mrs Clinton.

So -- what if a state actor were to hack the vote-count, and throw it to Trump?

When I mentioned this scenario to people at work, they mostly preferred to shrug it off and keep their fingers crossed.  And indeed,  (1) + (2) do not entail that Putin either would, or could, pull of a vote-fraud on that scale.  But the very next morning, two news items caught the world’s attention.

(3) Russia sent its fleet through the English Channel.  As they passed Dover, they trained their guns on England.
(4) A wide variety of very prominent (and, one would imagine, relatively well-defended) Web sites  were -- a thing unprecedented -- simultaneously unreachable.

(3):  Would (Putin is not reticent about flourishing power). 
(4):  Could (rather than attacking such sophisticated well-fortified sites as Amazon and the New York Times, he need only get past the defenses of the clueless retired librarians and what have you  who run the elections in Mississipi et cetera).

As it turns out, the attacks were not quite as concerning as one could have been led to believe by vague early media accounts.   The attackers didn’t manage to hack their way into the sites in question, where they would be in a position to make mischief (say, to order one billion copies of The Art of the Deal with next-day shipping to the Clinton campaign).    Rather, they merely flooded the servers of a somewhat obscure DNS company (one which originated, in Wikipedia’s phrase, as “a community-led student project” at Worcester Polytech), which performs the humble domain-name service for various sites.   By way of comparison:  Anyone can temporarily block access to Fort Knox by burning a semitrailer on the entrance road;  that is quite different from actually breaking in and making away with the gold.   Specifically as applied to electronic vote-counting,  all that a DDOS attack could do would be to disenfranchise that fraction of Alaskan voters (they won’t be missed) and overseas servicemen  who are allowed to vote via the internet;  it wouldn’t change their votes to a different candidate, nor those of non-Internet voters.

Nevertheless, the attack was significant for the novelty of its Denial-of-Service robot army,  relying in large measure on the “Internet of Things” -- “smart” (read: idiot-savant) devices like late-model thermostats and baby-monitors.

"Smart" refrigerator,  plotting evil

Now, I have long been annoyed, in a grumpy curmudgeonly way, with contra-Okhamian appliances and interfaces, that try to do so many things that they perform their core function less well, and have multiple points of failure.   But I had not realized their potential for active lethality, in concert, a sort of globe-girdling zombie army.  So I contacted my old friend  Песец из Канады,  surveying the bedraggled march of history  from his perch in the frozen north:

> As a guy who used to program for limited-memory ROMs serving closed,
> pre-circumscribed-purpose platforms, perhaps you can answer this:   How
> can a single-purpose device like a thermostat  have the capacity to
> store, and then launch upon instruction, malware used for DDOS ??

He replied:

Nowadays, "limited memory" means gigabytes.  It actually costs *more* to make a product that is only capable of doing what it needs to do and is not also a mass-produced general-purpose computer.

For the moment, people still tend to buy products that "connect to the Internet!!!"  As more of these IoT disasters unfold, I expect that eventually people will learn that they must never allow Internet access from any computer whose program they are prohibited from replacing.  First off, "connects to the Internet!" is just a bullet-point on the packaging; manufacturers don't really want to pay what it would actually cost to develop a *secure* product that connects to the Internet.  Second, there are considerable social forces acting on manufacturers to engage in frankly-evil acts -- and one evil act can build upon another, leading to a DDOS attack.

Example: Samsung used to sell a television set that recorded all your voice conversations (for no reason) and sent them to a central server (for no reason) over an Internet connection (that a TV doesn't really need).  It offered a menu item for turning off this behaviour, but the Samsung TV was programmed to lie to its "owner" and claim that it had stopped spying, while actually continuing to do so under orders from its manufacturer.  In a perfect world, Samsung's corporate charter should have been revoked for this.  Instead, TV's are joining thermostats as IoT objects that can be co-opted by terrorists.  Isn't it nice of us to provide them with this free ammunition?

Microsoft's Windows 10 has the same problem -- it spies on you, offers an option to turn off the spying, then continues to do it anyway.  Windows 10 should not be used on any computer connected to the Internet, especially by a person who holds a security clearance from any country.  A computer that has been programmed to accept orders from "our spies" over the Internet is a computer that can be co-opted by "their spies" over the Internet.

GM's "OnStar" vehicles have the same problem: a car that can be remotely shut down by police is a car that can be remotely shut down by an assassin or a terrorist.  Wouldn't it be interesting to find out if it's technically possible to convince all the GM-branded cars on the Beltway to simultaneously shut off their brakes and steering while travelling at highway speeds?

Speaking of computers inexplicably connected to the Internet, *why* do American e-voting machines have Internet connections?  The only obvious reason to do that would be to allow the government to disclaim the result of an election that doesn't go their way: the American people didn't *really* vote for Donald Trump, that was just the Russians hacking our voting machines because they're evil demons who do evil things for no reason -- after we give them the necessary tools for no reason.  How dare the Russians "interfere" with our election by publishing the emails that Hillary insisted on letting them have!  And why is it that we are preparing for cyberwar against Russia, when it always seems to be China conducting cyberwar against the USA?  That's like invading Iraq because some Saudi dissidents based in Afghanistan attacked New York City.

I'm voting for Stein.  Thankfully, I will not have to move to Canada after the election.

That assertion about Windows 10 was startling.  I did not wish to post anything so denigrating about the LOVELY, PEACEABLE, TOTALLY NON-LITIGIOUS ALL-POWERFUL MEGA-ENTITY MICROSOFT (who can crush poor bloggers like a bug) without some supporting footnotes, which my correspondent kindly supplied:
    "You can’t fully disable telemetry on Home or Professional editions of Windows 10...  If you have a major philosophical problem with the fact that Windows 10 doesn’t let you avoid non-security updates or disable telemetry, don’t try to fix it. Instead, just switch to another operating system, like Linux..."
    A more alarmist article, claiming that even buying the Enterprise edition of Windows 10 still won't stop all the spying.
    Windows 10 keeps copies of everything you type and sends them to Microsoft's servers.  There is a button to turn this off, but Microsoft keeps sending out updates that turn it back on -- and you are not permitted to turn off those updates.

Those assertions are disputed elsewhere, e.g

The dispute is way above the pay-grade of this peaceful, penguin-loving site, and we take no stand on the matter.

Wholesome penguins, lacking Internet access,
don’t worry about any of this


Miscellaneous musings:

(1)  In the case of weaponizable appliances, we are faced with a double-bladed Tragedy of the Commons.   It is simply not in the interests of the various cost-cutting Asian-tiger gadget manufacturers to add in security (which in any even would be swiftly obsoleted;  and nobody’s going to pay for ongoing anti-zombie tech-support for Net-connected blenders and toasters).  Nor does the individual consumer particularly care (save in so far as heroically public-minded) whether his electr(on)ic toothbruth or Web-connected hamburgerbun sesameseed-applicator  was out on the town last night, ravaging Reddit (though they do seem a bit hung-over this morning).

(2)  When the DNC hack was pinned on Putin, pundits wondered aloud (or rather, aprint) whether we should retaliate by deploying our own cyberattack tools.  That was ill-considered.
(a) First, sanctions, to have any point, must be publically announced -- a tariff, an embargo, a finger-wagging on the New York Times editorial page, or what not.   The virtue of cyber tools is that they can be used stealthily and (with luck) deniably -- exactly the wrong scenario here.
(b) Cyberwar is serious business, and its means stand on the forefront of (secret) research.  You want to minimize exposure of your tools until they are needed to be deployed for real, and not just as a petulant gesture.

To retaliate against Putin (or anyone else), you select that arrow from your quiver that best meets the case; you don’t limit yourself to mimicking his moves, doing exactly what he did (as the lex talionis enjoined).

Which raises the question:  In Friday’s attack, cui prodest?   On the face of it, nothing positive was accomplished, just a few hours of snail-slow connection times.   And the attackers lost the element of surprise as regards a next such attack:  defenders now know that, in estimating the power of the next DDOS attack, they must reckon-in the gadget-bot army.    But it might have been worth it to the attacker, to see how vulnerable a crucial node like a DNS would be.   The sally would thus be the cybernetic equivalent of a ferret flight.

Tuesday, October 18, 2016

“Entre bleus”

Something potentially quite important happened in Paris last night, which  so far as I can tell  has not been reported by any American source (though it appears in a couple of English-language Russian ones).   A sort of “Blue Lives Matter” demonstration, held by saying they have had it was the increasing tempo of extremely violent (and often unpunished) attacks against les forces de l’ordre.   The demonstators began at the hospital where one of their number, badly burned from a Molotov cocktail launched by a mob of djeunes in the banlieue, was hanging ente la vie et la mort.  They then circled the Arc de Triomphe in their squad cars, sirens blaring -- and (thanks to a new counter-terror law that allows officers to retain their weapons while off-duty) fully armed.

The demo was set up by officers  without the backing of their own (housebroken) union, beginning with this message on social media:

Face à une hiérarchie carriériste, des élites syndicales enlisées dans leurs conflits, et une justice complètement désintéressée par notre sort, nous devons nous souder. Entre bleus.

This all might subside or (goaded by increasingly brazen attacks on them in the banlieues) it could develop rapidly, in a way that might catch the bien-pensant press with their pants down, reduced to a headline “French Government Falls in Coup”, which Americans will not have seen coming.  Check these out:

Trump and his supporters are late to the parade.  For some years now, Europe has been the crucible in which the Clash of Civilizations has been fought.

[Update 19 October 2016] Ça continue:

«Ras le bol ! »

[Update 20 October 2016] Ça continue encore:

Plusieurs centaines de policiers se sont réunis au Trocadero, en face de la tour Eiffel . Ils se sont dirigés ensuite vers les Champs-Elysées, en appelant les passants ou les habitants à venir les rejoindre.
«Cazeneuve t'es foutu, la police la police est dans la rue», scandaient les manifestants à l'adresse du ministre de l'Intérieur, ainsi que «Falcone démission» à l'adresse de Jean-Marc Falcone, le directeur de la police nationale.
En civil, certains portant un brassard ou un foulard masquant en partie leur visage, certains brandissaient des pancartes sur lesquelles on pouvait notamment lire: «Marre d'en prendre plein la gueule», «Ras le bol» ou encore «Soutien à nos collègues blessés».
Un petit nombre de personnes, munis d'affiches réclamant «la vérité» pour des proches victimes selon eux de violences policières, a rapidement été écarté par les forces de l'ordre.

[Update 23 October 2016]  The nightly demonstrations by fed-up police continue, in Paris and in provincial cities.  These have been peaceful -- unlike the anti-cop counterdemonstrators:

La manifestation, interdite par le préfet de la Loire, a pourtant bien eu lieu. Et a laissé des traces dans la ville. Samedi après-midi, le défilé d’un collectif pour « le désarmement de la police et la démilitarisation des conflits » s’est soldé par de nombreuses dégradations à Saint Etienne.
Des abribus, des distributeurs de banque, la vitrine d’une agence bancaire et le local de la fédération départementale du Parti socialiste ont notamment été saccagés. Devant la Bourse du travail, plusieurs prises de parole ont d’abord eu lieu pour « dénoncer les répressions policières sous toutes leurs formes et la guerre coloniale menée par la France au Moyen-Orient ».

Friday, October 14, 2016

The crown-bound brows of the Bard of Hibbing

Well I recall, in 1965, listening to the new album “Highway 61 Revisited” in my parents’ basement;  thinking:  This is the real deal.   Unlike much of the pop music my generation has enjoyed, this will last;  people will still be listening to it,  fifty years from now.

Then the decades went by, his career veered into less interesting avenues, and his voice lost some of its timbre and zing; I no longer followed his activities.

Yet lo -- Who would have predicted that, half a century from 1965, not only would people still be listening,  but the old codger would still be touring.  A lot.  Amazing.

And now the Nobel Prize.   Kind of out of left field, but one of the committee members made the valid point:  that, going back as far as Homer, poetry has been meant to be performed, even sung.  And this, in many different cultures.

The rustic troubadour, in a lyrical mood

So:  A tip of the stetson to you, old man.

~  [The genre now shifts  from memoir  to sotie] ~

It is not for us to add any groat’s-worth of comment to his abundantly documented biography.   Yet we do take comfort in having been, apparently, the only HRNS [highly-respected news site] to document Ibn-Guthrie’s  brilliant but little-known 1965 concert in Oslo:

[Footnote] I just checked the link for this song:
Remarkably, it is still available -- most songs by the Prairie Skald  have been deleted or disabled on YouTube by the Copyright Police.   The Norwegian lyrics of this one  apparently protected it -- de minimis non curat Attila.   If this trend continues, by 2076, all Internet content will be in the Norwegian language.


Meanwhile, the snarky, fairly brainy site Boulevard Voltaire, is underwhelmed:

Nobel de littérature : aujourd’hui Bob Dylan, demain un « twittérateur »

They offer a political décryptage for the Committee’s choice, which I leave to your perusal.  That the choice might be politically motivated is not out of the question:  certainly this year’s choice for the (always highly politicized) Peace Prize makes no sense at all aside from such a perspective.  (And it’s not the obvious one -- nothing to do with the FARC really.  But my keyboard is running out of pixels, so you’ll have to figure it out for yourselves.)


Back to the blind bard of the Achaeans.
Whatever might have been their origin in oral performance, some folks have felt that such hit ditties as “The Iliad” and “The Odyssey” read pretty well on paper too.  Whereas Zimmerman’s lyrics, so displayed, are thin stuff.  He himself took them seriously as poetry; the lyrics were printed in full on the backs of his albums of circa 1965. 
I recall in the late ‘sixties, when (excellent) bootleg albums  were appearing (like the Basement Tapes), a book of poems came out, Tarantula.    Still very much a fan, I almost bought a copy, but, glancing at it first, was obliged to toss it aside.  (Lennon’s In his own Write was actually amusing by comparison.  Heck, I even enjoyed Ono’s Grapefruit -- now there’s a collecter’s item.)

It is no knock on his song-lyrics as lyrics  to say that they fail to impress on the printed page.   One of the finest lines of all time, from the world of music, goes:

Bom ba-bom bom,  ba-dang ba-dang dang,
ba-ding ba-dong ding   BLUE MOON.

No seriously, it’s great;  but you have to hear it, not read it.

Okay, that said:  We could still defend the Committee’s decision on the grounds that it recognizes the oeuvre, not sub specie printed poetry, like that of the modern eye-poets, but as a Gesamtkunstwerk, the music no more abstractable from than lyrics  than flesh from bones, or “The Godfather” from its soundtrack.

Thursday, October 13, 2016

Where is an Arabic linguist when you need one ???

Germany is reeling from an improbable sequence of events.
Some good intelligence work leads the German police to the apartment of an immigrant, professedly Syrian.   They arrive in the nick of time:  the apartment turns out to be full of a powerful explosive, TATP, which has been used in numerous recent terrorist attacks in a number of countries.   But then things get weird.

* Even though they have surrounded the Plattbau (DDR-style prefab-modular apartment complex) with dozens of trained SWAT-team types, the suspect, seen nonchalently exiting his apartment, somehow manages to elude all his pursuers and besiegers.   All they managed to do was to get off a ‘warning’ shot, the signal for him to skedaddle.  (That sort of ineptness used to annoy me on “24”:  but at least the show had the excuse that the villains must not be caught before the final episode.)

Grenzschutzgruppe 9  on the job!

*  Despite an APB (including saturation--publicity on social media), the suspect manages to escape from Chemnitz to Leipzig uncaught and unmolested.

* There, he phones a Syrian acquaintance of his, asking “Hey man, can I crash at your pad?”    Sure, says the acquaintance (hereafter carried as “Mr BNB”)

* In the telling of Leipziger “Mr BNB”, he and two friends, having been alerted by social media to the identity of their guest  whom -- so he says -- he previously had never set eyes on, tie up the fugitive with electrical cord, and phone the police.  However, for lack of a translator (BNB’s German being poor), nobody can understand him, and essentially tell him “'Ain't nobody got time for this'.

Note that this was more than an inconvenience for the caller:  to show up in person at the Leipzig police station to make himself understood, would be to risk being spotted by local jihadis.  These don’t like snitches any more than do the thugs of Baltimore.  [Update:  And indeed, the Syrians have since complained of death-threats against them from local Muslims, and are being processed for a witness-protection program:]

* In the telling of Leipziger “Mr BNB”, he and two patriotic Syrian friends, having been alerted by social media to the identity of their guest  whom -- so he says -- he previously had never set eyes on, tie up the fugitive with electrical cord, and phone the police.  However, for lack of a translator (BNB’s German being poor), nobody can understand him, and essentially tell him “'Ain't nobody got time for this'.

* Dauntless, BNB goes to the police station in person.  There, they leave him cooling his heels for an hour, despite the fact that he is bringing them the most startling news and biggest coup of the year.  Again, lack of translator?

* The cops finally grab their prey, already trussed like a turkey, with an “Eid mubarak” ribbons around his ankles, and haul him off to the pokey.

* There,  he is put on suicide watch.  But then a psychologist interviews him; she concludes that this would-be suicide bomber is in no danger of, um, suicide, and the watch is relaxed.   Unsupervised in his cell, he frolics, smashing a lamp and messing with the electrical cord.  He is left unmolested.   Next thing you know, he has hanged himself.

That is unfortunate;  since, reportedly, instead of grilling the bastard around the clock as to who-all was in his network (you don’t get TATP just off the Internet; indeed, the stuff is devilishly hazardous to transport), the authorities had only one lone chat with him before he died, taking his secrets with him to the grave (and beyond, to Hell or Seventh Heaven, according to taste).  And once again, their excuse is:  Lack of a translator.

Am Dienstag führte eine Psychologin ein Gespräch mit dem Häftling. Er habe sich dabei "ruhig" verhalten, erklärte Rolf Jacob, Leiter der Justizvollzugsanstalt Leipzig (JVA). Die Intervalle zwischen den Kontrollen seien daraufhin auf 30 Minuten ausgedehnt worden. Dass al-Bakr später die Deckenlampe herunterriss und versuchte, an ein Stromkabel zu gelangen, ließ bei niemandem die Alarmglocken schrillen. "Man hat das mehr als Vandalismus ausgelegt, als er – warum auch immer – so gehandelt hat", erklärte Jacob am Donnerstag auf einer Pressekonferenz. Ein Gespräch mit dem Häftling konnte mangels Dolmetscher nicht stattfinden. Am Mittwochabend fand dann eine Auszubildende den Erhängten.

Solution:  Shower Arabic translators with mucho dollars, wherever they may be found.
(Contributions via this site;  bullion or Swiss francs only, please;  no dollars, pesos, or second-party food-stamps accepted.)
Arabic linguist  ponders an irregular verb

An Austrian reader agrees:

Eine Auszubildende macht den Rundgang?!

"Mangels Dolmetscher"?!

Also wenn ich den einzig gefassten mutmaßlichen IS-Selbstmordattentäter Deutschlands in meinem Gewahrsam hätte, dann würde ich ja mal auf der Stelle 50 Dolmetscher mit Helis einfliegen lassen und ihn von dutzenden GSG-9-Polizisten im Wechsel persönlich bewachen lassen bzw. einen Undercover-Zivilpolizisten in seine Zelle als Mithäftling schleusen.

For further thrilling tales of the true-life adventures  of those godlike beings, Arabic linguists, check out these fact-filled articles:

Wednesday, October 12, 2016

Debased Debates

My wife and I no longer even own a TV;  the only time we ever watch it  is if we are traveling abroad, or (sometimes) if in a stateside hotel.  The latter circumstance obtained the other day, as we found ourselves (on the second leg of a fortieth-anniversary celebratory trip, this one in the northern hemisphere) in a very nice Holiday Inn, on the night of the second “Presidential” “debate”.   It was futile, but sort of fun for a married couple to watch, over goat’s-cheese and cabernet, in a comfy fluffy pillow-filled  hotel bed.

My own political opinions being of absolutely no interest to anyone, even to myself, I’ll stick to mentioning a couple of telling points that either side might have made, but failed to, in the almost content-free flyting that, these days, passes for debate.  (If the word “disaster” were to disappear from the English language, Mr Trump’s public vocabulary would be sliced in half.)

* Mr.  Trump boasts he’ll wipe out ISIL, without hinting how.  Mrs Clinton was silent on this, but could well have countered by mentionng several singularly brilliant recent victories over ISIL leadership, widely reported in the press.  Plus Mosul and Raqqa are hanging in the balance. -- That by no means implies that the immediate threat of ISIL to Europe (and, to a lesser extent, to the US)  is diminished in the near term:  if you stomp on a wasps’ nest, the wasps (extra mad now) disperse.   So there is much to be done;  but this Administration (though I say it as shouldn't) has been doing a good job in CT overall.

* Both Democracts and Republicans have been culpably negligent as regards illegal immigration (and by that assertion is intended nothing debatably political, but apodictically universal:  If you have a law, either repeal it or enforce it;  that’s what “law” means).  President Obama and Mrs. Clinton further (and this is a political observation, rather than a logical  -- you can agree or disagree, without sinning against Aristotle) have lately imperiled the Republic by calling for (and implementing) additional (by Presidential fiat) legal immigration  from lands that have little to offer us but blood and chaos.   Several very recent developments in Europe underline this observation, including one in Germany (the Jaber al-Bakr affair) unfolding  even as the candidates spoke onstage;  yet Mr Trump failed to mention these. 

(If your wish to educate yourselves, you unfortunately will have to search on variant Romanizations of the Arabic name:  Jabir el-Bakr, Djabir al-Bakir, Dschaber al-Bakr, and so forth.  Pronounced JAB-ir al-BAK-er.)

All that was really only by way of leading up to a much more interesting story, that of the Suicide-Bomber who Unexpectedly Committed Suicide:

[Update 15 October 2016]  To those who would dismiss Jaber al-Bakr’s terror plot as the work of an isolated madman, with no coordination with ISIL and rejected by the Muslim immigrant community in Germany (and hence, nothing to get worked up about;  with the suicide, Case Closed), consider this:
Jaber’s brother has been talking to the press.   He is one of the “suicide skeptics”.  In an earlier interview, he conceded that, while his brother might have had ISIL ties, he would never have killed himself.  Now he is (lyingly) denying the ISIL ties, and accusing the German authorities of having bumped off his brother in jail.  So far from apologizing for Jaber’s planned atrocities, he is threatening revenge :

Bruder des toten Jaber Albakr "Meine Reaktion als Araber ist Rache"

Der Bruder des toten Terrorverdächtigen Jaber Albakr spricht im DW-Interview eine Drohung aus. Sein Bruder sei kein IS-Mitglied gewesen, sagt Alaa Albakr zudem. Im "Spiegel" klang das anders.

Der Bruder des toten Terrorverdächtigen Jaber Albakr sinnt auf Vergeltung für den Suizid seines Bruders. In einem Video-Interview der Deutschen Welle spricht er dabei auch indirekt eine Drohung gegen die drei Syrer aus, die seinen Bruder in Leipzig überwältigt und der Polizei übergeben hatten.

As for the three Syrian “heroes” (or not; the jury isstill out on this), they have disappeared from Leipzig and gone into hiding.

Wednesday, October 5, 2016

Paradox of Experience

Tout comprendre,  c’est ne plus en chaloir.

[Cf. the noted summary by physicist Steven Weinberg: "The more the universe seems comprehensible, the more it also seems pointless."]

Tuesday, October 4, 2016

Lakeside Insight

Tiny birds,     clustered on bare branches

thick as grapes