Lunchtime roundup:
- Author John Scalzi gives the STBXPOTUS a colossal take-down on his blog today: "We don’t have to wait on history, but as it happens, this is how history will remember Donald Trump: Not as a forceful, charismatic authoritarian, but as a corrupt and pathetic wretch, who spent the final days of his presidency shouting at the walls about how the world is against him."
- Alexandra Petri: "Now is not the time to point fingers, Julius Caesar. Now is the time for healing." ("I am frankly appalled when I think of all the things that have been said on both sides, like, 'Death to Caesar!' and 'Ouch!'")
- National security experts, including the former chief research psychologist for the US Secret Service, advise treating the STBXPOTUS "like he's a terrorist leader."
- It appears that Ivanka and Jared wouldn't let the people protecting them into the house to pee, forcing the US Secret Service to spend nearly $100,000 over the past few years renting an apartment close by.
- Republicans in Congress supported intrusive security for everyone else in the past, but now that it affects them personally, they don't like it. How surprising.
- Since the Senate has recessed, presumably so Mitch McConnell can avoid an impeachment trial, President-Elect Biden still has no confirmed cabinet officials, forcing the incoming administration into an alternative plan after taking power next Wednesday.
- Chicago teachers locked out of the Chicago Public Schools online learning platform because they refused to return to unsafe classrooms found a poetic way of expressing their displeasure: they taught from the Board of Education President's front lawn.
- Chicago's regional heavy-rail system approved a $1.8 bn purchase of 500 slick new rail cars, which should start to arrive in 2024.
Finally, the authors of The Impostor's Guide, a free ebook aimed at self-taught programmers, has a new series of videos about general computer-science topics that people like me didn't learn programming for fun while getting our history degrees.
The Economist's Bartleby column examines how Covid-19 lockdowns have "caused both good and bad changes of routine."
Security is hard. Everyone who works in IT knows (or should know) this. We have well-documented security practices covering every part of software applications, from the user interface down to the hardware. Add in actual regulations like Europe's GDPR and California's privacy laws, you have a good blueprint for protecting user data.
Of course, if you actively resist expertise and hate being told what to do by beanie-wearing nerds, you might find yourself reading on Gizmodo how a lone hacker exfiltrated 99% of your data and handed it to the FBI:
In the wake of the violent insurrection at the U.S. Capitol by scores of President Trump’s supporters, a lone researcher began an effort to catalogue the posts of social media users across Parler, a platform founded to provide conservative users a safe haven for uninhibited “free speech” — but which ultimately devolved into a hotbed of far-right conspiracy theories, unchecked racism, and death threats aimed at prominent politicians.
The researcher, who asked to be referred to by their Twitter handle, @donk_enby, began with the goal of archiving every post from January 6, the day of the Capitol riot; what she called a bevy of “very incriminating” evidence.
Operating on little sleep, @donk_enby began the work of archiving all of Parler’s posts, ultimately capturing around 99.9 percent of its content. In a tweet early Sunday, @donk_enby said she was crawling some 1.1 million Parler video URLs. “These are the original, unprocessed, raw files as uploaded to Parler with all associated metadata,” she said. Included in this tranche of data, now more than 56 terabytes in size, @donk_enby confirmed the raw video includes GPS coordinates, which point to the locations of users when the videos were filmed.
Meanwhile, dozens of companies that have donated to the STBXPOTUS and other Republican causes over the past five years have suddenly started singing a different tune:
The expansion of unemployment benefits combined with sensible precautions against transmission of Covid-19 have made criminals' lives much easier:
From March through the end of November, there have been more than 2 million initial claims filed for regular state unemployment benefits, according to the agency. That figure excludes people filing claims under five federal pandemic jobless aid programs the state implemented last year.
The agency has said the rise in unemployment fraud is likely due to large corporate data breaches and is not the result of any state system breaches. Past breaches including one in 2017 involving Equifax exposed the personal data of millions of people, including names, Social Security numbers, driver’s licenses number, dates of births, addresses and credit card information.
People who have not filed for benefits but receive a letter from the state unemployment agency saying a claim has been filed under their name should immediately report it through the IDES website or by calling 800-814-0513.
Don't even get me started on the calls about my car's warranty...
We had a relatively quiet day yesterday, but only in comparison to the day before:
Meanwhile, here in Chicago:
Finally, Bruce Schneier advises the incoming administration on how to deal with the SolarWinds intrusion.
See? Yesterday was quiet.
The Times continues its coverage of the SolarWinds breach, and adds a detail that explains why the Russians continue to eat our lunch:
Employees say that under [SolarWinds CEO Kevin] Thompson, an accountant by training and a former chief financial officer, every part of the business was examined for cost savings and common security practices were eschewed because of their expense. His approach helped almost triple SolarWinds’ annual profit margins to more than $453 million in 2019 from $152 million in 2010.
But some of those measures may have put the company and its customers at greater risk for attack. SolarWinds moved much of its engineering to satellite offices in the Czech Republic, Poland and Belarus, where engineers had broad access to the Orion network management software that Russia’s agents compromised.
So many things went wrong in this case that singling out one CEO for taking profits over security may seem myopic. But the SVR must love the poetry of it: a greedy American CEO tries to increase his paycheck by hiring engineers easy for them to compromise, leading to the largest network intrusion in history.
I want to see Congress investigate this, and I want to see Thompson reduced to penury for his greed. Not that anything will change; until we have rational regulation of software security—hell, until we have any regulation of software security—criminals and our adversaries will keep exploiting companies like SolarWinds.
We're so close to ending 2020 that I can almost taste it. (I hope to be tasting tacos in a few minutes, however.) True to form, 2020 has apparently decided not to leave quietly:
Finally, the Washington Post's Michael Rosenwald reports that Bloom asked 28 historians to determine whether 2020 was the worst year ever. It wasn't even close.
Thank you, Tom Lehrer, for encapsulating what this season means to us in the US. In the last 24 hours, we have seen some wonderful Christmas gifts, some of them completely in keeping with Lehrer's sentiment.
Continuing his unprecedented successes making his the most corrupt presidency in the history of the country (and here I include the Andrew Johnson and Warren Harding presidencies), the STBXPOTUS yesterday granted pardons to felons Charles Kushner, Paul Manafort, and Roger Stone. Of the 65 pardons and commutations he has granted since becoming president, 60 have gone to people he knows personally and who have committed crimes on his behalf. Maggie Haberman and Michael S Schmidt say he's at his most unleashed as he tries to avoid leaving office the loser he is.
In other news:
Finally, enjoy this performance of the "Hallelujah" chorus from Händel's Messiah released just a few moments ago by the Apollo Chorus of Chicago:
It's 11°C outside and I have a fuzzy houseguest for the day, so there will be walks! At least until the 20°C temperature drop starts around 6pm... So while I'm enjoying the last above-freezing day of the year with a very sweet and very strong office companion, I've got a few things to occupy my time.
At the top of my list today, we find that the STBXPOTUS has pardoned 15 truly awful murderers and grifters, including the four assholes who slaughtered unarmed Iraqi civilians in 2007. It's possible these are the worst pardons ever granted by a US president. (I wonder if Bill Moyers would agree.)
Next we have Bruce Schneier explaining just how bad the SolarWinds penetration really is.
And finally, US Surgeon General Dr Jerome Adams said Chicago's coronavirus vaccine rollout was the best in the nation. Go us!
I will now finish my lunch, guarded vigilantly by my neighbor's dog who hopes against all evidence that some of my ham sandwich will find its way to her snout.
Welcome to the (abbreviated) lunchtime roundup:
Finally, Julie Nolke for the fourth time explains the pandemic to her past self.
FireEye, a cybersecurity firm, revealed last week that unknown parties had penetrated its network and that its clients, including the US Government, were at risk. Bruce Schneier has technical details about the attack. Former Homeland Security Adviser Thomas Bossert lays out the scope of it:
The attackers gained access to SolarWinds software before updates of that software were made available to its customers. Unsuspecting customers then downloaded a corrupted version of the software, which included a hidden back door that gave hackers access to the victim’s network.
This is what is called a supply-chain attack, meaning the pathway into the target networks relies on access to a supplier. Supply-chain attacks require significant resources and sometimes years to execute. They are almost always the product of a nation-state. Evidence in the SolarWinds attack points to the Russian intelligence agency known as the S.V.R., whose tradecraft is among the most advanced in the world.
According to SolarWinds S.E.C. filings, the malware was on the software from March to June. The number of organizations that downloaded the corrupted update could be as many as 18,000, which includes most federal government unclassified networks and more than 425 Fortune 500 companies.
The magnitude of this ongoing attack is hard to overstate.
The Russians have had access to a considerable number of important and sensitive networks for six to nine months. The Russian S.V.R. will surely have used its access to further exploit and gain administrative control over the networks it considered priority targets. For those targets, the hackers will have long ago moved past their entry point, covered their tracks and gained what experts call “persistent access,” meaning the ability to infiltrate and control networks in a way that is hard to detect or remove.
The logical conclusion is that we must act as if the Russian government has control of all the networks it has penetrated.
Now, if only we had an administration that believed its experts and a majority party in the Senate that would pass a Defense Reauthorization Bill...