G R A N T   S T A V E L Y G R A N T   S T A V E L Y G R A N T   S T A V E L Y G R A N T   S T A V E L Y

My neighbor and I were victims of the ultimate network attack.

I was offline all weekend.

So first I finished Dan Geer’s Economics and Strategies of Data Security. Whoa. I bought it based on Richard Bejtlich’s review. My copy was large-type; I’m not sure if that is standard. I already lent it out to my supervisor and asked him to to pass it up to our director when he’s finished.

Then I read The Design of Everyday Things by Don Norman. I’m also mid-way through Bruce Tognazzini’s Tog on Interface, but I actually finished The Design of Everyday Things cover to cover this weekend – I had no internet or television. I still find user-centered interface concepts important and thanks to the efforts of Tog, Norman, and dare I say it, Neilson, most shops get it. But I don’t find it interesting anymore. Actually, I never found Neilson interesting, but Tog and Norman’s books, while both excellent, have become a bit dated.

It reminds me of when I finally read esr’s The Cathedral and the Bazaar a few years ago. I am reading these foundational works after they’ve been adopted and championed by thousands of other people. So many of them were successful that they created the world argued for in the text.

Well, shit!

Now the books aren’t as interesting!

These core, often cited works have become history books! User centered design eh? No shit! Open Source is really going to take off eh? Do you think?

As with catb, I devoured The Design of Everyday Things in an evening and a half.

Interesting is like “nice” or “cool”. It’s self-defined and weak at that, and always better replaced by actual data, but bear with me. Lately I’ve been unfairly categorizing non-interesting efforts as “Solved Problems”.

Antivirus? Oh that’s a Solved Problem. Solved so poorly yet paradoxically, adequately, and necessarily, that I don’t find it interesting at all. Firewalls? Solved Problem. User centered design? Solved Problem. Well, OK maybe the implementations aren’t demonstrations of solved problems but the knowledge is out there.

It’s pretty stupid of me, but I’m trying to figure out why I find what I do find interesting to be interesting, and there is a lot of noise out there. Wasting time polishing solved problems is pretty stupid. It rots the mind.

“Pretty Stupid” was my previous internal trite label for non-interesting efforts. Solved Problem is better than Pretty Stupid isn’t it?

After the design history book I went back to finish the last 20 pages of Brave New War by John Robb, which I borrowed from Ben a few months ago. Brave New War is so interesting I can’t read it very quickly – I keep putting it down to think, or to do something less intense.

Tonight my plan was to finish Brave New War so that I could return it to Ben, but I got an itch to check on the cable line behind my house. 72 hours without the web makes me something something. When I pulled on the line that runs from the pole in the alley behind my house over to my house, I discovered why my cable modem RECEIVE light had been blinking over and over.

A young vandal had cut the coax running down the back of my house in the alley in two places, with what looks to be dull lineman’s pliers.

Lineman's pliers. The ultimate firewall

It’s fun to make very specific guesses based on little evidence, Sherlock Holmes style. In this case the wire was definitely cut, not snagged or ripped because it the sheathing was still compressed. And I posit the cut was made with dull pliers because the sheathing wasn’t cut completely – somebody borrowed the pliers from dad’s toolbox.

The lines were cut Friday, and I actually checked for a physical attack Saturday, but the cuts were cleverly placed behind my gutter downspout.

I have the tools and hardware to terminate coax, so I fixed it.

How am I ever going to finish Brave New War now, when I’ve got Twitter and Facebook and Google Reader!?


Ben is dropping this invite in various places:

CharmSec


What
An informal meetup of infosec folks

When
Wednesday May 14th, 7:00pm

Where
The Wharf Rat @ Camden Yards
Bar side – look for geeky looking folks in black shirts

Why
Talk security with people who aren’t there just to get 3 CPE points!

I’ll be attending, and we already have a few committed guests so that it won’t just be Ben and I enjoying Oliver Ales. We spend all day in front of four or five monitors in small rooms with no windows interacting with the folks in the cubes around us over instant messenger. It’ll be like that only with beer, and a much much better screen.

I stopped using a (quake) handle years ago, but we don’t expect everyone there to talk openly about where they work or what they do. For future meetups, check the official CharmSec page.

Join us!


I am a “Certified IT Professional”, as of this morning. Just like you hear about on the radio advertisements! Yikes.

I’m on on the list and they published my 83% score on the test to become a SANS Certified Forensics Analyst.

I took the class six months ago and procrastinated on taking the test. I shouldn’t have because the test was a new version and covered new information not in my books – I got a 90% on the last practice test I took. =/

Do certifications matter?

Well it depends, and because it depends, the entire debate is not that interesting to me. But, I’m certified now, so I have to confront it.

Does my certification matter? To who? I dig that it validates that I can pass an open book, multiple-choice four hour exam in about an hour and forty minutes. I also dig that potential future people looking at my qualifications might give it some value.

Does it mean anything else? Will I add it to my e-mail signature and business cards?

Not really, and no.


The Wired article concludes...

From his seat at the defense table, Reiser seemed to offer supporting evidence for that so-called "geek defense" in the form of his own actions, frequently quarreling with his attorney, and interrupting DuBois' cross-examination. In January, Judge Goodman threatened to bar Reiser from his own trial. "I'm not sure whether you're doing this on purpose to screw up the process or it's just part of your nature," the judge said outside the presence of the jury. "I'm tired of you disrupting the courtroom."

DuBois made little effort to hide his frustration with his client. The biggest bone of contention was Reiser's insistence on taking the stand himself — a move that may have been Reiser's undoing.

On many of Reiser's 11 days on the stand, jurors were seen shaking their heads in disbelief, laughing to themselves and wearing skeptical looks.


Ok, I'm not one to hold a grudge but quoting myself from six years ago:

Welp, reiserfs has officially decieved me.

Kernel Panic: Unable to mount root filesystem on 03:07

reiserfsck —rebuild-tree /dev/hda7

[UNCORRECTABLE ERROR] SECTOR 110!

[UNCORRECTABLE ERROR] SECTOR 111!

[UNCORRECTABLE ERROR] SECTOR 112!

[UNCORRECTABLE ERROR] SECTOR 113!

[UNCORRECTABLE ERROR] SECTOR 114!


It then makes it to about 133 before aborting and dying. Good times indeed.

For those not in the know, that means, I just lost my / linux partition with all of my data on it. Suck suck suck.

Edit: No seriously—this fucking sucks. hard. =/


Six Months Later

advice: Do not use reiserfs.

ben: told you cough

@philip_daigle congratulations Philip!


Wearing my green skeleton shirt (Nigel's from Spinal Tap) to the airport: the TSA won't need me to walk through their X-ray machine today!


@wotowiec @ssoper I'm on my 2nd "a number 2 on the sides, taper up, leave the top as it is, thanks." I think I'm acting out. It's a phase.


@vurtyou: You're hair is very Flock Of Seagulls today. @grantstavely: Thanks, I like it too.


@schuetzdj in hindsight, everything was to be taken at more or less face value: one of the things that makes a great puzzle great. =] #DBIR


RT @therealKidKoala: free download available for the next 6 days. The Lost Solid Steel mix. it's sorta like Music to Draw to... enjoy: ...


@christopherkunz nice work! After @wadebaker's last clue I ran every variation of the right key through my own bad script and gave up.


@marcusjcarey thanks, I'm very much enjoying the Bay Area. The return of @dojosec/@dojocon streams is great news, I look forward to 'em.


I should use Entourage's auto-capitalization of the first word after e.g. to break myself of using latinate abbreviations. Instead: rage.


@kathybarnett way to go Kath!


Yes, yes, of course, but what is the zeroth law of the Road Runner and Wile E. Coyote? http://goo.gl/i2Jz


"They're talkin' about, weak induction. It's a motherfucker, don't you know?" —Sun Ra http://j.mp/cn5Gc2 (Link via @rands)


printf "# Or just go listen to a funky 60 minute DJ Food mix made for robots.\nUser-agent: *\nSuggest: http://snd.sc/aOT9a4 " >> robots.txt


@alexhutton I cut out the cover's circles on a full print out of the #DBIR with a razor and tried the grille-cipher approach. #nbioahd


The body language of appearing to be lost or have forgotten something is as effective as mind control. So is its inverse.


RT @electricfork: What keeps me up at night? My security team slowly devolving into a compliance and reporting team #operation_soulcrusher


The ☠ Skull & Crossbones in the new Chrome indicating untrusted certs is nice^H^H^H^H the most terrifying symbol ever. http://goo.gl/fQz1


I'm brewing an American IPA with @vurtyou. I need a fridge to keg this in! http://flic.kr/p/8sCgnr


I'm brewing an American IPA with @vurtyou. I need a fridge to keg this in!

Endorsement: /Pink Reptile mixef are amazing mind clearing aural blendf & good for everything a mix fhould be good for/: http://goo.gl/Y1L1