Thursday, July 24, 2008
Wednesday, July 23, 2008
My Little Pwnie
The 2nd Annual Pwnie Award Nominaitons are up.
Some interesting bits:
Pwnie for Best Client-Side Bug Nominees
Safari carpet bomb (CVE-2008-2540)
Discovered by: Laurent Gaffié, Nitesh Dhanjani and Aviv Raff
Nitesh Dhanjani discovered a design error in Safari that allows an attacker to automatically download files to the user's configured download directory (~/Downloads on Leopard, the desktop on previous versions of OS X and Windows). This can be used for a variety of attacks. First, you can litter the user's desktop with files or drop malware onto their desktop, hoping that the user will click run it. Or you can just let Internet Explorer load a planted DLL automatically. This vulnerability also has the dubious distinction of bringing the term "blended threat" into the security vernacular.
Slirpie
Discovered by: Dan Kaminsky, RSnake, Dan Boneh
Presented at Toorcon 2007, this attack used DNS Rebinding to bypass the Same Origin Policy and build a tunnel into a remote network using only a lured web browser (and its associated grab bag of Web 2.0 technologies like Flash, Java, and JavaScript). This vulnerability can best be described as a design bug in the Web 2.0 and we're all waiting for it to be fixed in Web 2.0 Service Pack 1.
Pwnie for Most Epic FAIL Nominee:
Todd Davis, Lifelock CEO for posting his SSN on the web
Todd Davis, CEO of a fraud-prevention company called Lifelock, had publicly posted his Social Security number (457-55-5462) to show his confidence in the services offered by his company. Of course, a clever marketing stunt does not mean that the protection is actually worth anything. As expected, it did not take long for Davis' identity to get stolen: somebody in Texas got $500 from an online payday loan company using Davis' SSN.
Windows Vista for proving that security does not sell
$100,000,000 invested in security and what does Microsoft have to show for it? Customers are revolting against Windows Vista and nobody who has a choice is choosing to upgrade. It doesn't matter that Vista really is the most secure Microsoft operating system ever made, all customers care about is the annoyance of the UAC prompts, the confusing user interface and the insane hardware requirements.
The good thing about the Vista debacle is that no other vendor will care to do such a security push, which means that we'll be able to easily own any piece of software for the foreseeable future.
Some interesting bits:
Pwnie for Best Client-Side Bug Nominees
Safari carpet bomb (CVE-2008-2540)
Discovered by: Laurent Gaffié, Nitesh Dhanjani and Aviv Raff
Nitesh Dhanjani discovered a design error in Safari that allows an attacker to automatically download files to the user's configured download directory (~/Downloads on Leopard, the desktop on previous versions of OS X and Windows). This can be used for a variety of attacks. First, you can litter the user's desktop with files or drop malware onto their desktop, hoping that the user will click run it. Or you can just let Internet Explorer load a planted DLL automatically. This vulnerability also has the dubious distinction of bringing the term "blended threat" into the security vernacular.
Slirpie
Discovered by: Dan Kaminsky, RSnake, Dan Boneh
Presented at Toorcon 2007, this attack used DNS Rebinding to bypass the Same Origin Policy and build a tunnel into a remote network using only a lured web browser (and its associated grab bag of Web 2.0 technologies like Flash, Java, and JavaScript). This vulnerability can best be described as a design bug in the Web 2.0 and we're all waiting for it to be fixed in Web 2.0 Service Pack 1.
Pwnie for Most Epic FAIL Nominee:
Todd Davis, Lifelock CEO for posting his SSN on the web
Todd Davis, CEO of a fraud-prevention company called Lifelock, had publicly posted his Social Security number (457-55-5462) to show his confidence in the services offered by his company. Of course, a clever marketing stunt does not mean that the protection is actually worth anything. As expected, it did not take long for Davis' identity to get stolen: somebody in Texas got $500 from an online payday loan company using Davis' SSN.
Windows Vista for proving that security does not sell
$100,000,000 invested in security and what does Microsoft have to show for it? Customers are revolting against Windows Vista and nobody who has a choice is choosing to upgrade. It doesn't matter that Vista really is the most secure Microsoft operating system ever made, all customers care about is the annoyance of the UAC prompts, the confusing user interface and the insane hardware requirements.
The good thing about the Vista debacle is that no other vendor will care to do such a security push, which means that we'll be able to easily own any piece of software for the foreseeable future.
Friday, July 18, 2008
Linus Torvolds: "I Don't Get Security"
This is a pretty stunning insight into the software development process for Linux:
The row erupted in the Gmane mailing list after a developer for the PaX Team, which patches the Linux kernel, accused Torvalds and other top Linux kernel developers of "covering up (the) security impact of bugs" by not clearly labeling them as security flaws.
Torvalds wrote that disclosing the bug itself was enough, without having to label each individual security flaw. He added that taking the bugs to the "security circus" level only glorified the wrong kind of behavior. "It makes heroes out of security people, as if the people who...fix normal bugs aren't as important," wrote Torvalds.
What was left behind for the developers were all the "boring" bugs, which Torvalds considered more important due to their volume.
All bugs do not have equal weight, which is why major software houses all tag bugs for things like "security effect" and try to do a fairly honest job of prioritizing fixes. What Torvalds has said, basically, is that they don't really have any kind of bug triage and its on an as-we-get-to-it basis. Now his comments need to be put in context, no major enterprise (and the vast majority of consumers who use Linux) dont actually use his version, they use a supported version from a vendor with more matrure software practices, so this doesn't mean much in real life.
OTOH if Bill Gates said something like this, he'd have been fired by the Board.
Also, this bit was good:
"I think the OpenBSD crowd is a bunch of masturbating monkeys, in that they make such a big deal about concentrating on security to the point where they pretty much admit that nothing else matters to them. To me, security is important. But it's no less important than everything else that is also important!" Torvalds concluded.
The row erupted in the Gmane mailing list after a developer for the PaX Team, which patches the Linux kernel, accused Torvalds and other top Linux kernel developers of "covering up (the) security impact of bugs" by not clearly labeling them as security flaws.
Torvalds wrote that disclosing the bug itself was enough, without having to label each individual security flaw. He added that taking the bugs to the "security circus" level only glorified the wrong kind of behavior. "It makes heroes out of security people, as if the people who...fix normal bugs aren't as important," wrote Torvalds.
What was left behind for the developers were all the "boring" bugs, which Torvalds considered more important due to their volume.
All bugs do not have equal weight, which is why major software houses all tag bugs for things like "security effect" and try to do a fairly honest job of prioritizing fixes. What Torvalds has said, basically, is that they don't really have any kind of bug triage and its on an as-we-get-to-it basis. Now his comments need to be put in context, no major enterprise (and the vast majority of consumers who use Linux) dont actually use his version, they use a supported version from a vendor with more matrure software practices, so this doesn't mean much in real life.
OTOH if Bill Gates said something like this, he'd have been fired by the Board.
Also, this bit was good:
"I think the OpenBSD crowd is a bunch of masturbating monkeys, in that they make such a big deal about concentrating on security to the point where they pretty much admit that nothing else matters to them. To me, security is important. But it's no less important than everything else that is also important!" Torvalds concluded.
Thursday, July 17, 2008
Obama Approved
Obama Releases List of Approved Jokes About Himself
Bid to Help Late Night Comics
A Christian, a Jew and Barack Obama are in a rowboat in the middle of the ocean. Barack Obama says, "This joke isn't going to work because there's no Muslim in this boat."
the rest here
Bid to Help Late Night Comics
A Christian, a Jew and Barack Obama are in a rowboat in the middle of the ocean. Barack Obama says, "This joke isn't going to work because there's no Muslim in this boat."
the rest here
Wednesday, July 16, 2008
Foe
In prepping for my lecture tomorrow, I learned a new term, the foe.
A foe is a unit of energy equal to 10^44 joules or 10^51 ergs, used to measure the large amount of energy produced by a supernova.[1]
The word is an acronym derived from the phrase [ten to the power] fifty-one ergs.[2] It was coined by Gerald Brown of Stony Brook University in his work with Hans Bethe, because "it came up often enough in our work".[3]
This unit of measure is convenient because a supernova typically releases about one foe of observable energy in a very short period (which can be measured in seconds). In comparison, if the Sun had its current luminosity throughout its entire lifetime, it would produce 3.827×10^26 W × 10^10 years ≈ 1.2 foe.
Jesus' shitballs!
A foe is a unit of energy equal to 10^44 joules or 10^51 ergs, used to measure the large amount of energy produced by a supernova.[1]
The word is an acronym derived from the phrase [ten to the power] fifty-one ergs.[2] It was coined by Gerald Brown of Stony Brook University in his work with Hans Bethe, because "it came up often enough in our work".[3]
This unit of measure is convenient because a supernova typically releases about one foe of observable energy in a very short period (which can be measured in seconds). In comparison, if the Sun had its current luminosity throughout its entire lifetime, it would produce 3.827×10^26 W × 10^10 years ≈ 1.2 foe.
Jesus' shitballs!
LSD for the Taste Buds
This is neat enough I'd liek to try it:
Back in May, The New York Times ran a story about an entrepreneur who was organizing "flavor-tripping parties" around a little red berry widely known as "miracle fruit," in part because of one of its components, a protein called miraculin, and in part because of its effects on the human palate. According to a university researcher who studied the berry, miraculin "binds with the taste buds and acts as a sweetness inducer when it comes in contact with acids."
In other words, it makes sour things taste sweet.
...
But like all magic, there is a heavy price to pay for dabbling with god's ordered universe:
Much less fun: the after-effects. The Times article neglected to mention that while miraculin makes vinegar and Tabasco sweet, it doesn't make either of them any easier on the lining of the throat or the stomach. By the end of the day, miracle or no, all of us certainly felt like we'd been drinking pickle-Tabasco-sauerkraut-radish-mustard-vodka cocktails.
Back in May, The New York Times ran a story about an entrepreneur who was organizing "flavor-tripping parties" around a little red berry widely known as "miracle fruit," in part because of one of its components, a protein called miraculin, and in part because of its effects on the human palate. According to a university researcher who studied the berry, miraculin "binds with the taste buds and acts as a sweetness inducer when it comes in contact with acids."
In other words, it makes sour things taste sweet.
...
But like all magic, there is a heavy price to pay for dabbling with god's ordered universe:
Much less fun: the after-effects. The Times article neglected to mention that while miraculin makes vinegar and Tabasco sweet, it doesn't make either of them any easier on the lining of the throat or the stomach. By the end of the day, miracle or no, all of us certainly felt like we'd been drinking pickle-Tabasco-sauerkraut-radish-mustard-vodka cocktails.
Some Much Wrong Packed in One Sentence...
... it threatens to form a black-hole and suck the reader into a parallel reality of over parenting, paranoia and mind-numbing dumbness. Really.
From review of WALL-E (which I quite liked):
“I didn’t think for a second that a movie about a little robot could have anything to do with weight. My son keeps making comments about ‘all of those fat, lazy people just sitting around doing nothing.’ We’ve seen a significant increase in [his] anorexic behaviors since we saw the movie yesterday.”
It never occurred to me that the "fat people" of WALL-E were the villains. I still have a hard time making that connection, possibly because it isn't true or I am not a moron. Not sure which.
From review of WALL-E (which I quite liked):
“I didn’t think for a second that a movie about a little robot could have anything to do with weight. My son keeps making comments about ‘all of those fat, lazy people just sitting around doing nothing.’ We’ve seen a significant increase in [his] anorexic behaviors since we saw the movie yesterday.”
It never occurred to me that the "fat people" of WALL-E were the villains. I still have a hard time making that connection, possibly because it isn't true or I am not a moron. Not sure which.
Astronomy Lecture on Thursday
I'm doing an informal astronomy lecture on Thursday, "The Deaths of Stars", talking about supernova, black holes, neutron stars etc.. I't sbeen awhile, and I find I have to do a bit of homework beforehand to remember some of the details after 20 years, e.g. is the Chandrasekar Limit 1.38M or 1.44M? (It turns out, it depends on the chemical structure of the star, but the metalicity effects the number of electrons available for supporting the star by electron degeneracy pressure).
It's a lot of fun, but I am starting to think I might need to go teach at the community collegefor a bit and work the rust out of my lectures.
It's a lot of fun, but I am starting to think I might need to go teach at the community collegefor a bit and work the rust out of my lectures.
PZ Death Threat Update
It turns out the guy who sent PZ Meyers an email death threat was using his wife's work account. She has been terminated from the company, sad but not unexpected.
Who does the guy blame? Himself? Not Really.
It is my hope that since the mystery is now removed, and now that the Identity of the horrible person who dared write such crude things to the mr. myers is known, that the same people who put so much effort into harming Melanie Kroll, will use as much effort to right the wrong that has been done to her.
When you worship victimhood, your highest calling is to be a victim yourself.
Who does the guy blame? Himself? Not Really.
It is my hope that since the mystery is now removed, and now that the Identity of the horrible person who dared write such crude things to the mr. myers is known, that the same people who put so much effort into harming Melanie Kroll, will use as much effort to right the wrong that has been done to her.
When you worship victimhood, your highest calling is to be a victim yourself.
Monday, July 14, 2008
Darwins!
[It says 2008, but I know at least one of these is recycled]
2008 Darwin Awards
You've been waiting for them with baited breath, so without further ado here are the 2008 Darwin awards.
Eighth Place In Detroit, a 41-year-old man got stuck and drowned in two feet of water after squeezing head first through an 18-inch-wide sewer grate to retrieve his car keys.
Seventh Place A 49-year-old San Francisco stockbroker, who 'totally zoned when he ran,' accidentally, jogged off a 100-foot high cliff on his daily run.
Sixth Place While at the beach, Daniel Jones, 21, dug an 8 foot hole for protection from the wind and had been sitting in a beach chair at the bottom! When it collapsed, burying him beneath 5 feet of sand. People on the beach used their hands and shovels trying to get him out but could not reach him It took rescue workers using heavy equipment almost an hour to free him. Jones was pronounced dead at a hospital.
Fifth Place Santiago Alvarado, 24, was killed as he fell through the ceiling of a bicycle shop he was burglarizing. Death was caused when the long flashlight he had placed in his mouth to keep his hands free rammed into the base of his skull as he hit the floor.
Fourth Place Sylvester Briddell, Jr., 26, was killed as he won a bet with friends who said he would not put a revolver loaded with four bullets into his mouth and pull the trigger.
Third Place After stepping around a marked police patrol car parked at the front door, a man walked into H&J Leather & Firearms intent on robbing the store. The shop was full of customers and a uniformed officer was standing at the counter. Upon seeing the officer, the would-be robber announced a hold-up!, and fired a few wild shots from a target pistol. The officer and a clerk promptly returned fire, and several customers also drew their guns and fired. The robber was pronounced dead at the scene by Paramedics Crime scene investigators located 47 expended cartridge cases in the shop. The subsequent autopsy revealed 23 gunshot wounds. Ballistics identified rounds from 7 different weapons. No one else was hurt.
HONORABLE MENTION Paul Stiller, 47, and his wife Bonnie were bored just driving around at 2 A.M. so they lit a quarter stick of dynamite to toss out the window to see what would happen. Apparently they failed to notice the window was closed.
RUNNER UP Kerry Bingham had been drinking with several friends when one of them said they knew a person who had bungee-jumped from a local bridge in the middle of traffic. The conversation grew more heated and at least 10 men trooped along the walkway of the bridge at 4:30 AM. Upon arrival at the midpoint of the bridge they discovered that no one had brought a bungee rope. Bingham, who had continued drinking, volunteered and pointed out that a coil of lineman's cable, lay near by They secured one end around Bingham's leg and then tied the other to the bridge. His fall lasted 40 feet before the cable tightened and tore his foot off at the ankle. He miraculously survived his fall into the icy water and was rescued by two nearby fishermen. Bingham's foot was never located.
AND THE WINNER IS...? Zookeeper Friedrich Riesfeldt (Paderborn,Germany) fed his constipated elephant 22 doses of animal laxative and more than a bushel of berries, figs and prunes before the plugged-up pachyderm finally got relief. Investigators say ill-fated Friedrich, 46, was attempting to give the ailing elephant an olive oil enema when the relieved beast unloaded. The sheer force of the elephant's unexpected defecation knocked Mr. Riesfeldt to the ground where he struck his head on a rock as the elephant continued to evacuate 200 pounds of dung on top of him.
It seems to be just one of those freak accidents that proves.. 'Sh't happens'
IT ALWAYS SEEMS IMPORTANT TO THANK THESE PEOPLE FOR REMOVING THEMSELVES FROM THE GENE POOL.
2008 Darwin Awards
You've been waiting for them with baited breath, so without further ado here are the 2008 Darwin awards.
Eighth Place In Detroit, a 41-year-old man got stuck and drowned in two feet of water after squeezing head first through an 18-inch-wide sewer grate to retrieve his car keys.
Seventh Place A 49-year-old San Francisco stockbroker, who 'totally zoned when he ran,' accidentally, jogged off a 100-foot high cliff on his daily run.
Sixth Place While at the beach, Daniel Jones, 21, dug an 8 foot hole for protection from the wind and had been sitting in a beach chair at the bottom! When it collapsed, burying him beneath 5 feet of sand. People on the beach used their hands and shovels trying to get him out but could not reach him It took rescue workers using heavy equipment almost an hour to free him. Jones was pronounced dead at a hospital.
Fifth Place Santiago Alvarado, 24, was killed as he fell through the ceiling of a bicycle shop he was burglarizing. Death was caused when the long flashlight he had placed in his mouth to keep his hands free rammed into the base of his skull as he hit the floor.
Fourth Place Sylvester Briddell, Jr., 26, was killed as he won a bet with friends who said he would not put a revolver loaded with four bullets into his mouth and pull the trigger.
Third Place After stepping around a marked police patrol car parked at the front door, a man walked into H&J Leather & Firearms intent on robbing the store. The shop was full of customers and a uniformed officer was standing at the counter. Upon seeing the officer, the would-be robber announced a hold-up!, and fired a few wild shots from a target pistol. The officer and a clerk promptly returned fire, and several customers also drew their guns and fired. The robber was pronounced dead at the scene by Paramedics Crime scene investigators located 47 expended cartridge cases in the shop. The subsequent autopsy revealed 23 gunshot wounds. Ballistics identified rounds from 7 different weapons. No one else was hurt.
HONORABLE MENTION Paul Stiller, 47, and his wife Bonnie were bored just driving around at 2 A.M. so they lit a quarter stick of dynamite to toss out the window to see what would happen. Apparently they failed to notice the window was closed.
RUNNER UP Kerry Bingham had been drinking with several friends when one of them said they knew a person who had bungee-jumped from a local bridge in the middle of traffic. The conversation grew more heated and at least 10 men trooped along the walkway of the bridge at 4:30 AM. Upon arrival at the midpoint of the bridge they discovered that no one had brought a bungee rope. Bingham, who had continued drinking, volunteered and pointed out that a coil of lineman's cable, lay near by They secured one end around Bingham's leg and then tied the other to the bridge. His fall lasted 40 feet before the cable tightened and tore his foot off at the ankle. He miraculously survived his fall into the icy water and was rescued by two nearby fishermen. Bingham's foot was never located.
AND THE WINNER IS...? Zookeeper Friedrich Riesfeldt (Paderborn,Germany) fed his constipated elephant 22 doses of animal laxative and more than a bushel of berries, figs and prunes before the plugged-up pachyderm finally got relief. Investigators say ill-fated Friedrich, 46, was attempting to give the ailing elephant an olive oil enema when the relieved beast unloaded. The sheer force of the elephant's unexpected defecation knocked Mr. Riesfeldt to the ground where he struck his head on a rock as the elephant continued to evacuate 200 pounds of dung on top of him.
It seems to be just one of those freak accidents that proves.. 'Sh't happens'
IT ALWAYS SEEMS IMPORTANT TO THANK THESE PEOPLE FOR REMOVING THEMSELVES FROM THE GENE POOL.
Saturday, July 12, 2008
Green Eyed Monster
I read through PZ's hate mail bag after his pointing out the a communion wafer is really just a cracker. There is quite a bit of it, and I can't say I read every bit of it (it gets boring after awhile).
2 Observations:
PZ might have a real problem here. Try as he might, his university is going to get hit with some of the fallout. He won't get fired or anything, but I think he might get a chewing out.
Many of the catholics who responded are both deeply afraid of, and very envious of Islam. You can tell from the tone (and the death threats) that they a) want to do a lot of violence in the name of their religion (but can't) and b) feel they are getting a poor deal compared to the Muslims. I've argued with a lot of catholics in my day, usually on a very civil level. Most kind of quietly assume that once I'm dead, I'll change over when I see the proof. To be fair, that might happen should I find myself in an actual afterlife. I'm betting the other way of course, that there isn't one, but I could be wrong.
A subset though seem to really be torn between what they want to do and their religion, and express this through a great deal of misplaced anger. I assume every group has maladjusted people and that's what comes out at times like this (there are plenty of maladjusted atheists, muslims, jews and Steeler's fans), it's just a little shocking to see it so openly.
2 Observations:
PZ might have a real problem here. Try as he might, his university is going to get hit with some of the fallout. He won't get fired or anything, but I think he might get a chewing out.
Many of the catholics who responded are both deeply afraid of, and very envious of Islam. You can tell from the tone (and the death threats) that they a) want to do a lot of violence in the name of their religion (but can't) and b) feel they are getting a poor deal compared to the Muslims. I've argued with a lot of catholics in my day, usually on a very civil level. Most kind of quietly assume that once I'm dead, I'll change over when I see the proof. To be fair, that might happen should I find myself in an actual afterlife. I'm betting the other way of course, that there isn't one, but I could be wrong.
A subset though seem to really be torn between what they want to do and their religion, and express this through a great deal of misplaced anger. I assume every group has maladjusted people and that's what comes out at times like this (there are plenty of maladjusted atheists, muslims, jews and Steeler's fans), it's just a little shocking to see it so openly.
Friday, July 11, 2008
Venture Brothers Quiz
I'm Phantom Limb!
You are an unsettling supervillain, with invisible but deadly limbs, who favors a purple spandex costume, and is still obsessed with Dr. Girlfriend. You haven't forgiven the Monarch for stealing her back. He should probably be worried.
Take the Which Venture Brothers character are you? Quiz at HeavyInk.com
Wednesday, July 09, 2008
Hate Crimes
The next time someone points out to me how only the "left" cries "hate crime" at the drop of a hat, I can point them to this:
Webster Cook says he smuggled a Eucharist, a small bread wafer that to Catholics symbolic of the Body of Christ after a priest blesses it, out of mass, didn't eat it as he was supposed to do, but instead walked with it.
...
"We don't know 100% what Mr. Cooks motivation was," said Susan Fani a spokesperson with the local Catholic diocese. "However, if anything were to qualify as a hate crime, to us this seems like this might be it."
We just expect the University to take this seriously," she added "To send a message to not just Mr. Cook but the whole community that this kind of really complete sacrilege will not be tolerated."
PZ summarizes my thoiughts well.
Webster Cook says he smuggled a Eucharist, a small bread wafer that to Catholics symbolic of the Body of Christ after a priest blesses it, out of mass, didn't eat it as he was supposed to do, but instead walked with it.
...
"We don't know 100% what Mr. Cooks motivation was," said Susan Fani a spokesperson with the local Catholic diocese. "However, if anything were to qualify as a hate crime, to us this seems like this might be it."
We just expect the University to take this seriously," she added "To send a message to not just Mr. Cook but the whole community that this kind of really complete sacrilege will not be tolerated."
PZ summarizes my thoiughts well.
Tuesday, July 08, 2008
Secret Project, Revealed!
I posted this a bit earlier, but I had jumped the gun. One of my "secret projects" became public today. On purpose.
This security update resolves two privately reported vulnerabilities in the Windows Domain Name System (DNS) that could allow spoofing. These vulnerabilities exist in both the DNS client and DNS server and could allow a remote attacker to redirect network traffic intended for systems on the Internet to the attacker’s own systems.
One of my guys just finished his press conference. I'll link a you tube video when it gets posted.
Bottom line: the internet is once again safe for spam and porn.
Update:
Dan is one of the folks on my pentest team and this has been pretty much his whole project since early March. Hear his podcast.
Also, read about "the largest synchronized security update in the history of the Internet"
These are the days when I'm glad I got out of my old job, even though I occasionlly miss it. Despite being "worldwide" we never pulled off anything of this magnitude, or made this much of a difference to so many customers. It was great, but I'm doing stuff now with real impact and it's very rewarding.
At least it is today. Ask me again next week and I might say something different.
This security update resolves two privately reported vulnerabilities in the Windows Domain Name System (DNS) that could allow spoofing. These vulnerabilities exist in both the DNS client and DNS server and could allow a remote attacker to redirect network traffic intended for systems on the Internet to the attacker’s own systems.
One of my guys just finished his press conference. I'll link a you tube video when it gets posted.
Bottom line: the internet is once again safe for spam and porn.
Update:
Dan is one of the folks on my pentest team and this has been pretty much his whole project since early March. Hear his podcast.
Also, read about "the largest synchronized security update in the history of the Internet"
These are the days when I'm glad I got out of my old job, even though I occasionlly miss it. Despite being "worldwide" we never pulled off anything of this magnitude, or made this much of a difference to so many customers. It was great, but I'm doing stuff now with real impact and it's very rewarding.
At least it is today. Ask me again next week and I might say something different.
Thursday, July 03, 2008
Death of a Guilty Pleasure
The CAP Ministries is going to close.
The bottom line is that we are broke. Our donor base is now four regular donors giving $165 per month (we lost a $200 per month donor). And that equates to a new release analysis about once every two months ... and no help in providing for my family while I work the ministry, except for maybe butter-n-egg money for a month (for ten people: 6 adopted children, two foster babies, my wife and I) plus a tank of gas.
The CAP has been a guilty pleasure of mine for quite a long time. I'd occasionally go check out how perfectly innocent movies would set up this wonderful approach-avoidance conflict within the reviewer where he was clearly fascinated by what he was seeing, but at the same time punishing himself for this joy. All this under the guise of watching the movies to "protect children". Seemingly, even the least clued christian parent would understand that a movie called The Texas Chainsaw Massacre (rated R) is not something you would take a 6 year-old to see. Yet bravely, and with total deference to Jesus, the CAP reviewer would throw himself on such a beast, braving the violence, sex and blasphemy, some would say risking his very soul, to detail in exacting precision the complete catalog of god offenses and explain why this is a Weapon of Satan aimed at the delicate sensibilities of the Bob the Builder crowd. Why said christian parents, while fully savvy of the Internet and it's godless dangers, would fail to understand that the subtle warning ensconced the title phrase "CHAINSAW MASSACRE" is left as an exercise for the student.
So, okay, he liked to go to the movies and loved to feel the righteous indignation only true believers can. And he like folks to pay for this. Props for that. My hobbies usually cost me money and don't generally come with moral superiority so he out strips me there.
But, he even hates kids movies.
A terrific example is Mr. Magorium's Wonder Emporium. Probably the blandest pablum the Hollywood vomit machine has ever snorted out it's nose. No god, no crime, no gangsta, no sex, no crippling existential angst. Nothing. What's the problem with Mr. Magoo?
Natalie Portman wearing a dress that exposed a large gap over her chest. Such a display of skin normally not seen is clearly sexual: clearly intended to tease, to incite lust in the male viewer. If she had worn a dress that covered the gap, the Sexual Immorality investigation area score would have been 100. Sure, some highfalutin, high society performers wear such clothing for such affairs, but does that make such a cultural-specific display acceptable? If you think "Yes" then the fact that some cultures eat other people makes it acceptable since it is a cultural-specific behavior. Don't argue with me about what is morally acceptable. Argue about it with God. He will give you a much better Answer than I ever could. [1Cor. 8:9, Matt. 5:28]
Wow! I could never have made something like that up. He had raised righteous indignation to a form of high art.
Unfortunately, he could not raise to the level where it paid all his bills. You need a cable show to do that.
Will I miss CAP Ministries? I will. I went there this morning to see what could possibly be offensive in the film Wall-E, which I quite enjoyed. I figured god has to hate robots (since it is man imitating god and robots can have souls since that is gods providence or some shit), and he has to hate robot sex even more! Alas, he is closing shop, at least for now.
Does this sadden me? A little. OTOH I am pretty stoked that the appetite for this kind of silliness, at least as non-parody, is too small to be self-supporting.
The bottom line is that we are broke. Our donor base is now four regular donors giving $165 per month (we lost a $200 per month donor). And that equates to a new release analysis about once every two months ... and no help in providing for my family while I work the ministry, except for maybe butter-n-egg money for a month (for ten people: 6 adopted children, two foster babies, my wife and I) plus a tank of gas.
The CAP has been a guilty pleasure of mine for quite a long time. I'd occasionally go check out how perfectly innocent movies would set up this wonderful approach-avoidance conflict within the reviewer where he was clearly fascinated by what he was seeing, but at the same time punishing himself for this joy. All this under the guise of watching the movies to "protect children". Seemingly, even the least clued christian parent would understand that a movie called The Texas Chainsaw Massacre (rated R) is not something you would take a 6 year-old to see. Yet bravely, and with total deference to Jesus, the CAP reviewer would throw himself on such a beast, braving the violence, sex and blasphemy, some would say risking his very soul, to detail in exacting precision the complete catalog of god offenses and explain why this is a Weapon of Satan aimed at the delicate sensibilities of the Bob the Builder crowd. Why said christian parents, while fully savvy of the Internet and it's godless dangers, would fail to understand that the subtle warning ensconced the title phrase "CHAINSAW MASSACRE" is left as an exercise for the student.
So, okay, he liked to go to the movies and loved to feel the righteous indignation only true believers can. And he like folks to pay for this. Props for that. My hobbies usually cost me money and don't generally come with moral superiority so he out strips me there.
But, he even hates kids movies.
A terrific example is Mr. Magorium's Wonder Emporium. Probably the blandest pablum the Hollywood vomit machine has ever snorted out it's nose. No god, no crime, no gangsta, no sex, no crippling existential angst. Nothing. What's the problem with Mr. Magoo?
Natalie Portman wearing a dress that exposed a large gap over her chest. Such a display of skin normally not seen is clearly sexual: clearly intended to tease, to incite lust in the male viewer. If she had worn a dress that covered the gap, the Sexual Immorality investigation area score would have been 100. Sure, some highfalutin, high society performers wear such clothing for such affairs, but does that make such a cultural-specific display acceptable? If you think "Yes" then the fact that some cultures eat other people makes it acceptable since it is a cultural-specific behavior. Don't argue with me about what is morally acceptable. Argue about it with God. He will give you a much better Answer than I ever could. [1Cor. 8:9, Matt. 5:28]
Wow! I could never have made something like that up. He had raised righteous indignation to a form of high art.
Unfortunately, he could not raise to the level where it paid all his bills. You need a cable show to do that.
Will I miss CAP Ministries? I will. I went there this morning to see what could possibly be offensive in the film Wall-E, which I quite enjoyed. I figured god has to hate robots (since it is man imitating god and robots can have souls since that is gods providence or some shit), and he has to hate robot sex even more! Alas, he is closing shop, at least for now.
Does this sadden me? A little. OTOH I am pretty stoked that the appetite for this kind of silliness, at least as non-parody, is too small to be self-supporting.
Wednesday, July 02, 2008
An Especially Hot Pit in the 8th Circle is Waiting for
Billy Graham.
His lasting damage, I offer as an aside, was to persuade the young George W. Bush to abandon his wastrel ways, at which he excelled, and instead seek the path that has led him to where he is now, a calamity for the nation and the world. Graham's burden is heavy indeed.
I don't beleive in gods but I do believe we should explore the limits of what we're good at.
It is better to do your Dharma poorly than do another's well.
-The Bhagavad Gita
His lasting damage, I offer as an aside, was to persuade the young George W. Bush to abandon his wastrel ways, at which he excelled, and instead seek the path that has led him to where he is now, a calamity for the nation and the world. Graham's burden is heavy indeed.
I don't beleive in gods but I do believe we should explore the limits of what we're good at.
It is better to do your Dharma poorly than do another's well.
-The Bhagavad Gita
Tuesday, July 01, 2008
Republican Strategy for Candidates
Brief and accurate, from TPM:
Continues to boggle my mind what a difference 4 years can make to the conservatives.
1996: Bob Dole is a war hero! Clinton is a draft dodger! WORSHIP THE WAR HERO!
2000: Forget the war! Ignore the potential Vietnam-era AWOL-ness of our candidate, and his complete lack of foreign policy knowledge! He's got integrity!
2004: So what your candidate actually fought and was injured in the same war during which our candidate was so very much NOT AWOL! We mock his service and question the legitimacy of his injuries! Have a purple band-aid to wear at our convention!
2008: Only a certified war hero can lead this country! WORSHIP THE WAR HERO!
You want to bet if I wore a purple band-aid to mock McCain's service I'd be roasted alive?
Continues to boggle my mind what a difference 4 years can make to the conservatives.
1996: Bob Dole is a war hero! Clinton is a draft dodger! WORSHIP THE WAR HERO!
2000: Forget the war! Ignore the potential Vietnam-era AWOL-ness of our candidate, and his complete lack of foreign policy knowledge! He's got integrity!
2004: So what your candidate actually fought and was injured in the same war during which our candidate was so very much NOT AWOL! We mock his service and question the legitimacy of his injuries! Have a purple band-aid to wear at our convention!
2008: Only a certified war hero can lead this country! WORSHIP THE WAR HERO!
You want to bet if I wore a purple band-aid to mock McCain's service I'd be roasted alive?
Monday, June 30, 2008
Subscribe to:
Posts (Atom)