__jf__

This very difficult time in your life you appear to have in common with your collegues if I’m reading you right. Can you elaborate a little bit on your work and maybe other novel coping strategies you and your collegues evaluated?

Rsyslog could a Logstash replacement if you squint your eyes.

Trust boundaries make most sense when used in a data flow diagram, where for every flow between processes you ask yourself: “what could go wrong here?”

That question deserves additional attention if these flows reach processes controlled by different people, or are running under different privileges. That’s when they cross a trust boundary.

So a db server with local storage: single trust boundary around db and storage. But! But! What about the kernel!?

At this point it becomes important ask to another question: does the current abstraction level of the model help you think better about risk? It depends. Perhaps not if the db is part of a larger infrastructure with a global CDN, loadbalancers, webservers and some in memory caching layer.

I like the fact that malware authors also seem to have trouble setting up a (secure) software development lifecycle. On the other hand if they were to threat model it, expoiting weaknesses in the agent does not cross a trust boundery so why bother. Imagine this would be different for their command and control infrastructure.

S3 Glacier Deep Archive in a tar.gz.aes per calendar year.

That article is a gem! Thanks!

The author - a surgeon - describes his experience asking and getting a retired surgeon to coach him for self-improvement purposes. It works out really well although he does mention some minor uncomfortableness like having to talk through one almost-fsckup. Although the author lists this as a slight negative it is actually an endorsement of coaching: self-improvement.

This is a fascinating peek into the unglamourous administrative moving parts of supply chain risk management.

Octave [0], Cygwin [1] and GIMP [2] mailing lists were also fortunate enough to be included in this process. Given the timespan between the posts this seems to be taken rather seriously.

I also found the likely reason in [3]: since 2019 they have a new supply chain risk management proces. Slide 10 gives some additional background.

[0] https://octave.1599824.n4.nabble.com/Country-of-Origin-Verif...

[1] http://cygwin.1069669.n5.nabble.com/Country-Of-Origin-Verifi...

[2] https://www.talkend.net/post/75432.html

[3] https://csrc.nist.gov/CSRC/media/Projects/cyber-supply-chain...

Also did lots of things that didn’t scale!

The NYT experience is indeed the fastest way for a company to lose trust. It took me 3 tries to cancel. First rep said: yep cancelled all done. Except it wasnt: renewed at a discount. The 2nd rep: said sorry sorry and produced a chat transcript where I supposedly said thanks for the new discount, k thx bye (I didn’t). Said it was cancelled now. Surprise: it wasnt. Third rep got it done. For real this time. Still disappointed at how this played out.

There is an interesting talk [0] by Philipp Krenn (Elastic) on “Open Source as a Business. Strategy, struggle, success”. This talk takes the perspective of Elastic, the company behind the open source products Elasticsearch, Kibana, Beats, and Logstash, which makes its money with support, the commercial extensions, and cloud offerings. But we are also taking a look at how others are approaching this challenge, what worked, and what failed.

[0] https://media.ccc.de/v/froscon2019-2463-open_source_as_a_bus...

There should be a CIS [0] hardening guide for LinkedIn like there is for iOS, Safari and AWS.

[0] https://www.cisecurity.org/cis-benchmarks/

These 2 worlds increasingly overlap. For example the collateral damage of the 2017 NotPetya cyberattack made tens of multinational companies disclose material impact to their P/L. The retaliatory DDoS attacks following the Iran sanctions in 2012 had a big impact on banks worldwide. Based on these cherry-picked examples you could even say that the real world increasingly needs protection from military-policical fall-out.

“Using Internet scanning, we found a unique signature associated with the hostnames of Check Point firewalls used in Circles deployments. This scanning enabled us to identify Circles deployments in at least 25 countries.”

Nice OSINT find!

Thanks for the rabbit hole. It made me discover an interview [0] with Googles captain of moonshots. In it he also discusses other interesting moonshot management strategies, besides the monkey-pedestal one.

[0] https://www.wsj.com/video/astro-teller-on-moonshots-for-alph...

Decibels. 35 at home, 55-60 at the (open) office.

Maybe I’m overdoing it but like true Bayesians mine just don’t believe me anymore. Instead they will just believe troll stories from others.

Phase six-a: The open-source license disillusionee

Your project didn’t just scratch your own itch, but also that of a powerful large commercial entity. It copied your permissively licensed mouse trap into its moneymaking SAAS machine. You start questioning yourself using such words as fairness and attribution. You are annoyed that you’re unable to find that 2019 talk by a german Elastic guy on HN about the commercial realities of open source software.

Better late than never, says the optimist. If you break these numbers down by industry it looks like climate risk is primarily identified by (european) financials. Fiscal 2019:

             US  EUR APAC
   financls  12% 37% 16%
     energy   8% 20% 12%
  materials   8% 24%  7%
  utilities   3% 22%  7%
  industrls   3% 12%  3%
   consumer   5% 14%  4%
      telco   3% 12%  -
       tech   3%  8%  -
   healthcr   3% 11%  -

Source: own research after collecting and processing 14000 annual reports the last 2 years. Mostly for infosec purposes but it seems to be useful in other areas as well.

Meanwhile, awareness/disclosure of climate risk is rising sharply in large publicly traded companies, measured by counting the percentage of companies reporting "climate risk" in their 2019 annual reports:

- 26% of companies in EU

- 9% of companies in APAC

- 7% of companies in US

Still a long way to go obviously, but these numbers have doubled compared to fiscal 2017.

Yep from $99M to $65M to $18M. From their 2019 annual report:

In July 2019, the ICO issued a formal notice of intent under the U.K. Data Protection Act 2018 proposing a fine in the amount of £99 million against the Company in relation to the Data Security Incident (the “Proposed ICO Fine”). We mutually agreed with the ICO to an extension of the regulatory process until June 1, 2020 and the ICO proceeding is ongoing. In the 2019 second quarter, we recorded an accrual in the full amount of the Proposed ICO Fine for this loss contingency, and in the 2019 fourth quarter, we reduced the accrual to $65 million based on the ongoing proceeding.

From their 2018 annual report:

To date, we have not seen a meaningful impact on demand as a result of the Data Security Incident.

In 2018, we recorded $28 million of expenses related to the Data Security Incident, partially offset by $25 million of accrued insurance recoveries [...]

(EDIT) Also:

To date, approximately 100 putative class action lawsuits have been filed by consumers and others against us in U.S. federal, U.S. state and Canadian courts related to the Data Security Incident.

TLDR from the article:

“I’m not here to teach you how to write a Hollywood movie,” McKee said, the scorn in his voice sending a wave of reassurance through his well-educated audience. But then he drew a triangle on an overhead projector slide: at the top was “Classical Design” (stories with causality, closed endings, linear time, an external conflict, a single, active protagonist); in the other corners he wrote “Minimalism” (open endings, passive protagonists) and “Anti-Structure” (coincidence, nonlinear time). “This course is about the top, about classical design,” he said, pointing at the triangle. “Why? For your careers. As you move down the triangle, your audience shrinks.

The top of the pyramid describes his magnum opus “Story”. For anyone interested in the lower corners I can recommend “Me and You and Memento and Fargo” [1]. This gives an interesting counterpoint to McKee’s shrinking audience hypothesis.

[1] https://www.amazon.com/You-Memento-Fargo-J-J-Murphy/dp/08264...

Yep that pottery class also comes up as an anecdote in “Art and Fear: Observations on the perils and rewards of artmaking”:

https://www.amazon.com/Art-Fear-Observations-Rewards-Artmaki...

Envy is ignorance, imitation is fear. Fear is the mind-killer.

- Ralph Waldo Herbert

The blog post seems like a more applied, personalized and re-imagined version of "How to read a book". And shorter. I quote like it too.

“Hi” initiates the TCP equivalent of the 3-way handshake

From the article:

This check of Hive revealed quite a few defects and suspicious fragments. If the authors of Apache Hive come across this article, we'll be glad to help with the hard job of improving the project.

Yes, write short.

This is the title of one of the chapters in “Writing without bullshit”, hilariously followed by the first paragraph: “Use fewer words”.

Other tips from the book:

* Edit everything

* Aim for a word count

* Say what you really mean

* Start boldly

* Organize relentlessly

* Prune sections and arguments

* Use bullets or tables

* Use graphics

* Trim connective tissue

* Delete weasel-words and qualifiers

The Future of Violence [0] explores this further. Its TLDR is something like: technology enables distributed offensive capabilities leading to many-to-many threats. Technology also creates distributed vulnerabilities by increasing attack surface. Finally, technology also enables distributed defensive capabilities.

[0] https://www.amazon.com/Future-Violence-Robots-Hackers-Confro...