
New limited run tshirt design!
Jackpot is a 10-minute film by Adam Baran about a gay teen in 1994 who goes looking for a stash of abandoned gay porn mags. Baran says:
I really made the film because I loved teen movies and never really saw one for gay kids that both addressed their sexuality in the way that straight movies like Weird Science or American Pie or Superbad did, and let them get what they want. Jack in my film learns that he has to fight back for what he wants, even if it means he has to take a couple of licks. I think that’s a resonant message for gay kids everywhere.
I mentioned the Kickstarter completion bid for this a couple of years ago then promptly forgot about it so it’s good to find that the film got made, and won Best Short at the 2013 Miami Gay and Lesbian Film Festival. The whole thing can now be watched on Vimeo where Baran is trying to raise money to expand Jackpot into a feature. Via Towleroad.
If someone has a cat, I believe they like cats.
If someone has five cats, I believe they love cats.
But if someone has 19 cats, I’m no longer convinced they love cats. I’m suspicious, rather, that they’re some kind of hoarder.
Someone who needs 19 cats and counting, rather than settling for just the five cats of the cat-lover, is someone who apparently could not find satisfaction with those first five cats and acquired the next five in a desperate, but apparently unsuccessful, attempt to fill some aching need.
And then, finding even 10 cats still insufficient to satisfy this need to derive whatever it is they’re attempting to take from these cats, they were then compelled to acquire five more, and then to acquire four more after that.
Such compulsive, insatiable acquisitiveness does not suggest that this person loves cats. It suggests, rather, that this person has been unable to give and receive love with those first 18 cats, and that their prospects for being able to give and receive love from the 19th also seem pretty slim.
Perhaps such a person somehow needs cats. Perhaps they desire to control cats or to possess cats. But it does not seem likely that they love cats.
And that’s pretty much my take on the “Quiverfull” movement.
Chris Pattle has constructed Simpsons characters completely out of CSS.

We've come a long way from #cccccc and the Simpson No-Nos.

When you read the title of this video, "Super Cub landing on windy mt. top", you're thinking, ok, there's a runway on the side of this mountain and it's gonna be a little dicey but not a big deal. But then the video starts and there's just a steep snowy mountain and no runway and it's uphill and you're like, WHAT JUST HAPPENED?
I looked up info on the plane and if you're going to land on the side of a mountain, the Super Cub is the plane for you. It can take off in as little as 200 feet, land in 300-400 feet, and has a stall speed of only 43 mph. The guy lands uphill and takes off downhill in this video and looks like he needed less than 100 feet in each case. (via ★mouser)
Tags: flying videoElizabeth Kolbert on yet another report which says that the future effects of anthropogenic climate change will be irreversible and catastrophic.
Promoting "preparedness" is doubtless a good idea. As the executive order notes, climate impacts -- which include, but are not limited to, heat waves, heavier downpours, and an increase in the number and intensity of wildfires -- are "already affecting communities, natural resources, ecosystems, economies, and public health across the Nation." However, one of the dangers of this enterprise is that it tends to presuppose, in a Boy Scout-ish sort of way, that "preparedness" is possible.
As we merrily roll along, radically altering the planet, we are, as the leaked I.P.C.C. report makes clear, increasingly in danger of committing ourselves to outcomes that will simply overwhelm societies' ability to adapt. Certainly they will overwhelm the abilities of frogs and trees and birds to adapt. Thus, any genuine "preparedness" strategy must include averting those eventualities for which preparation is impossible. This is not something that the President can do by executive order, but it's something he ought to be pursuing with every other tool.
In linking to the piece, Philip Gourevitch notes:
This is simply the most important & urgent issue in our time & will be for as long as there is a foreseeable future
I wonder... what it's gonna take for the world's governments to lurch into action on this? Or will they ever? Years of iron-clad scientific consensus isn't doing it. Sandy didn't do it. Heat waves, wildfires, and floods seem to have little effect. The melting Arctic, ha! The risk to food and water supplies? Not really. For fun, here's a Guardian piece from six years ago on 2007's IPCC report, the same report Kolbert is referring to above.
Sea levels will rise over the century by around half a metre; snow will disappear from all but the highest mountains; deserts will spread; oceans become acidic, leading to the destruction of coral reefs and atolls; and deadly heatwaves will become more prevalent.
The impact will be catastrophic, forcing hundreds of millions of people to flee their devastated homelands, particularly in tropical, low-lying areas, while creating waves of immigrants whose movements will strain the economies of even the most affluent countries.
'The really chilling thing about the IPCC report is that it is the work of several thousand climate experts who have widely differing views about how greenhouse gases will have their effect. Some think they will have a major impact, others a lesser role. Each paragraph of this report was therefore argued over and scrutinised intensely. Only points that were considered indisputable survived this process. This is a very conservative document -- that's what makes it so scary,' said one senior UK climate expert.
It's the same shit! It's absurd.
Tags: climate Elizabeth Kolbert global warming Philip Gourevitch politicsA video from Microsoft Research showcases a system that uses the Kinect motion sensing input device to translate between American Sign Language and other sign and spoken languages.
You can read more about the system at Microsoft Research.
Tags: American Sign Language Kinect videoThis is fun: a selection of pop songs separated into their component tracks (vocals, bass, drums, etc.). You can turn parts on and off as the songs play. Featured artists include The Beatles, Spice Girls, Radiohead, and Amy Winehouse.
The text/interface is in French...just click the dark grey link labelled "> Chanson" for the song listing. (via @ajsheets)
Tags: musicIn an interview accompanying a Frontline episode on drug-resistant bacteria, an associate director for the CDC, Dr. Arjun Srinivasan, says that "we're in the post-antibiotic era".
The more you use an antibiotic, the more you expose a bacteria to an antibiotic, the greater the likelihood that resistance to that antibiotic is going to develop. So the more antibiotics we put into people, we put into the environment, we put into livestock, the more opportunities we create for these bacteria to become resistant. ...We also know that we've greatly overused antibiotics and in overusing these antibiotics, we have set ourselves up for the scenario that we find ourselves in now, where we're running out of antibiotics.
We are quickly running out of therapies to treat some of these infections that previously had been eminently treatable. There are bacteria that we encounter, particularly in health-care settings, that are resistant to nearly all -- or, in some cases, all -- the antibiotics that we have available to us, and we are thus entering an era that people have talked about for a long time.
For a long time, there have been newspaper stories and covers of magazines that talked about "The end of antibiotics, question mark?" Well, now I would say you can change the title to "The end of antibiotics, period."
We're here. We're in the post-antibiotic era. There are patients for whom we have no therapy, and we are literally in a position of having a patient in a bed who has an infection, something that five years ago even we could have treated, but now we can't.
You know how when you first hear a joke it's the funniest thing ever and then you hear it a second time and it's less funny and then a third, fourth, and fifth times and it just keeps getting less and less funny until you're not laughing at all and it actually becomes annoying? That's how antibiotics work across the entire human population. And if Dr. Srinivasan is correct, we're transitioning into the not laughing stage and the annoying stage where lots of people start dying can't be far behind (unless we get some new jokes/treatments).
Yesterday, Mark Sample tweeted about disasters, low-points, and chronic trauma:
"Low point" is the term for when the worst part of a disaster has come to pass. Our disasters increasingly have no low point.
After the low point of a disaster is reached, things begin to get better. When there is no clear low point, society endures chronic trauma.
Disasters with no clear low point: global warming, mass extinction, colony collapse disorder, ocean acidification, Fukushima.
To which I would add: drug-resistant infectious diseases. (via digg)
Tags: Arjun Srinivasan Mark Sample medicine scienceGlen Weisgerber is a wizard at the art of hand-lettering. Make sure you watch all the way through for the big flourish-y finish.
(via colossal)
Tags: design Glen Weisgerber typography video
Zack Zdrale | Myth | Oil on canvas | 24” x 36” | 2012
Amy K. Nelson's Slate story (with video) about Holly Maniatty, "a self-described Vermont farm girl who holds degrees in both American Sign Language linguistics and brain science" and specializes in being a sign language interpreter for rock and rap concerts, is a fascinating read:
Watching her work is an amazing experience.Signing a rap show requires more than just literal translation. Maniatty has to describe events, interpret context, and tell a story. Often, she is speaking two languages simultaneously, one with her hands and one with her mouth, as shell sometimes rap along with the artists as well. When a rapper recently described a run-in with Tupac, Maniatty rapped along while making the sign for hologram, so deaf fans would know the reference was to Tupacs holographic cameo at Coachella, not some figment of the rapper's imagination.
Maniatty, a first-degree black belt in taekwondo, also conveys meaning with her body, attempting to give her signs the same impact as the rappers spoken words.
Several times I was surprised at the end of a meal by suddenly hearing my overtures; than at the restaurant window, indulging in this feeling, I did not know what was having a more intoxicating effect upon me, the incomparable, magnificently illuminated square filled with countless, strolling people or the music bearing all of this as if in roaring transfiguration.Wagner recounts his time in Venice in Richard Wagner in Venedig by Friedrich Dieckmann. The quote is used in the notes for the Uri Caine Ensemble's arrangements of Wagner for string quartet, piano and accordion recorded live at the Gran Caffè Quadri in the Piazza San Marco, Venice. Forget about the unconventional forces, this is a first-rate and often surprisingly moving Wagner disc which I am sure the Master himself would have approved of. Out of the three great composers celebrating anniversaries this year, Wagner and Verdi reached huge audiences thanks to their common touch being exploited in arrangements for popular forces. Britten comes from a very different era, but can anyone name a popular cover version of a Britten work? Is it because times have changed and social media has replaced café musicians as the preeminent popularising force? Or does Britten's music lack the common touch? But please read on before answering those non-rhetorical questions. Because in a depressingly po-faced centenary year it was refreshing on Saturday to find the Britten thought police taking the evening off and six musicians from disciplines as diverse as folk, house, techno and electronica being invited to reinterpret Britten at Snape. Listen to a demo of Britten's arrangement of the folk song O Waly Waly in what Wagner would term "a roaring transfiguration via this link. Then do share your views on whether great classical composers need the common touch.
As I recently reported in the Guardian, the NSA has secret servers on the Internet that hack into other computers, codename FOXACID. These servers provide an excellent demonstration of how the NSA approaches risk management, and exposes flaws in how the agency thinks about the secrecy of its own programs.
Here are the FOXACID basics: By the time the NSA tricks a target into visiting one of those servers, it already knows exactly who that target is, who wants him eavesdropped on, and the expected value of the data it hopes to receive. Based on that information, the server can automatically decide what exploit to serve the target, taking into account the risks associated with attacking the target, as well as the benefits of a successful attack. According to a top-secret operational procedures manual provided by Edward Snowden, an exploit named Validator might be the default, but the NSA has a variety of options. The documentation mentions United Rake, Peddle Cheap, Packet Wrench, and Beach Head -- all delivered from a FOXACID subsystem called Ferret Cannon. Oh how I love some of these code names. (On the other hand, EGOTISTICALGIRAFFE has to be the dumbest code name ever.)
Snowden explained this to Guardian reporter Glenn Greenwald in Hong Kong. If the target is a high-value one, FOXACID might run a rare zero-day exploit that it developed or purchased. If the target is technically sophisticated, FOXACID might decide that there's too much chance for discovery, and keeping the zero-day exploit a secret is more important. If the target is a low-value one, FOXACID might run an exploit that's less valuable. If the target is low-value and technically sophisticated, FOXACID might even run an already-known vulnerability.
We know that the NSA receives advance warning from Microsoft of vulnerabilities that will soon be patched; there's not much of a loss if an exploit based on that vulnerability is discovered. FOXACID has tiers of exploits it can run, and uses a complicated trade-off system to determine which one to run against any particular target.
This cost-benefit analysis doesn't end at successful exploitation. According to Snowden, the TAO -- that's Tailored Access Operations -- operators running the FOXACID system have a detailed flowchart, with tons of rules about when to stop. If something doesn't work, stop. If they detect a PSP, a personal security product, stop. If anything goes weird, stop. This is how the NSA avoids detection, and also how it takes mid-level computer operators and turn them into what they call "cyberwarriors." It's not that they're skilled hackers, it's that the procedures do the work for them.
And they're super cautious about what they do.
While the NSA excels at performing this cost-benefit analysis at the tactical level, it's far less competent at doing the same thing at the policy level. The organization seems to be good enough at assessing the risk of discovery -- for example, if the target of an intelligence-gathering effort discovers that effort -- but to have completely ignored the risks of those efforts becoming front-page news.
It's not just in the U.S., where newspapers are heavy with reports of the NSA spying on every Verizon customer, spying on domestic e-mail users, and secretly working to cripple commercial cryptography systems, but also around the world, most notably in Brazil, Belgium, and the European Union. All of these operations have caused significant blowback -- for the NSA, for the U.S., and for the Internet as a whole.
The NSA spent decades operating in almost complete secrecy, but those days are over. As the corporate world learned years ago, secrets are hard to keep in the information age, and openness is a safer strategy. The tendency to classify everything means that the NSA won't be able to sort what really needs to remain secret from everything else. The younger generation is more used to radical transparency than secrecy, and is less invested in the national security state. And whistleblowing is the civil disobedience of our time.
At this point, the NSA has to assume that all of its operations will become public, probably sooner than it would like. It has to start taking that into account when weighing the costs and benefits of those operations. And it now has to be just as cautious about new eavesdropping operations as it is about using FOXACID exploits attacks against users.
This essay previously appeared in the Atlantic.
In a book called All Things Considered published in 1915, G.K. Chesterton deftly skewers the glut of books by gurus, articles linked to from Hacker News, and conference talks by entrepreneurs about how to be successful.
That a thing is successful merely means that it is; a millionaire is successful in being a millionaire and a donkey in being a donkey. Any live man has succeeded in living; any dead man may have succeeded in committing suicide. But, passing over the bad logic and bad philosophy in the phrase, we may take it, as these writers do, in the ordinary sense of success in obtaining money or worldly position. These writers profess to tell the ordinary man how he may succeed in his trade or speculation-how, if he is a builder, he may succeed as a builder; how, if he is a stockbroker, he may succeed as a stockbroker. They profess to show him how, if he is a grocer, he may become a sporting yachtsman; how, if he is a tenth-rate journalist, he may become a peer; and how, if he is a German Jew, he may become an Anglo-Saxon. This is a definite and business-like proposal, and I really think that the people who buy these books (if any people do buy them) have a moral, if not a legal, right to ask for their money back. Nobody would dare to publish a book about electricity which literally told one nothing about electricity; no one would dare publish an article on botany which showed that the writer did not know which end of a plant grew in the earth. Yet our modern world is full of books about Success and successful people which literally contain no kind of idea, and scarcely any kind of verbal sense.
Chesterton continues:
It is perfectly obvious that in any decent occupation (such as bricklaying or writing books) there are only two ways (in any special sense) of succeeding. One is by doing very good work, the other is by cheating. Both are much too simple to require any literary explanation. If you are in for the high jump, either jump higher than any one else, or manage somehow to pretend that you have done so. If you want to succeed at whist, either be a good whist-player, or play with marked cards. You may want a book about jumping; you may want a book about whist; you may want a book about cheating at whist. But you cannot want a book about Success. Especially you cannot want a book about Success such as those which you can now find scattered by the hundred about the book-market. You may want to jump or to play cards; but you do not want to read wandering statements to the effect that jumping is jumping, or that games are won by winners.
That Chesterton's observations ring so true today is not an accident. The last time income inequality in the US was as high as it is today? The 1910s and 1920s. (via mustapha abiola)
Tags: All Things Considered books G.K. Chesterton
Roberta Marrero | Every Man And Every Woman Is a Star
Via Iridic's MetaFilter post, a glossary of an early (the earliest?) conlang, Lingua Ignota: "Below is a semi-complete alphabetized English glossary of the Lingua Ignota - a secret language constructed by twelfth century polymath, Hildegard von Bingen. I grew fascinated with this constructed language a while back and was chagrined that there wasn't a freely available online list of the entire extant glossary." It may or may not be useful, but it's certainly a lot of fun.
A Financial Times essay by Harry Eyres describes clearing out his parents' home, saying "It may sound trite, but the house, and our lives in it, would not have been the same without books.... The rooms suddenly look diminished, denuded, uncomfortably bare":
Books Do Furnish a Room is the oddly memorable title of one of the volumes in Anthony Powells A Dance to the Music of Time, a sequence of novels about the goings-on among a group of toffs, literati and others before and after the second world war. The statement (made in the novel by a character called Bagshaw, the editor of a post-war literary journal) has an undertone of surprise: how can books furnish a room, when they have no obviously practical value, in the way that chairs and tables and sofas and curtains do?I confess I raised my eyebrows when I got to "The only rooms in our house without books were the dining-room and the bathrooms": can you really call yourself a book lover if there are any rooms without books? (I'll never forget the day my younger grandson, exploring the bathroom, opened the bottom drawer to find, yes, a little stack of books—he let out a delighted "Ah!") Thanks, Paul!I always rather took it for granted that books furnished a room. The only rooms in our house without books were the dining-room and the bathrooms. Otherwise there were books everywhere: in all the bedrooms (and one of the pleasures of sleeping in different bedrooms was finding books I hadnt seen for decades, like old friends), in the drawing-room where the books seemed more formal and unapproachable and in the piano room-cum-office which became my parents comfortable winter snuggery.
Coinbox Hero and Cookie Clicker both break the idea of the video game down into the bare essentials: perform an action to get points, use points to power up, repeat. They're games that show you how games work. (See also Cow Clicker.)
In Cookie Clicker, you click to make cookies until you have enough cookies to hire a cursor to click for you and eventually you get enough points to buy cookie mines, time machines, and antimatter condensers capable of generating millions of cookies a second. There doesn't seem to be a goal per se...presumably you can keep upgrading until you're generating trillions of cookies a minute. It's like Bitcoin except with cookies.
In Coinbox Hero, you start similarly, jumping into a Super Mario-esque coinbox to get coins to buy workers to collect more coins for you. Unlike Cookie Clicker, there's a clear objective: earn 1,000,000 points to buy a device that will destroy the coinbox.
I found both of these games very satisfying to play, which suggests that a significant amount of my enjoyment of games derives not from the gameplay but from the amassing wealth and power, which, man, I guess I have something to talk to my therapist about this week. (via waxy)
Tags: video gamesAnother excellent link from Quora's weekly newsletter: What is the best sacrifice in the history of chess? A game played in 1934 featured the sacrifice of the queen & both rooks and was over so quickly (14 moves) that it's referred to as The Peruvian Immortal. I found it easier to follow the game by watching it:
Tags: best of chess games video
[Image: The west coast of North America as it appeared roughly 215 million years ago; map by Ron Blakey].
[Image: The west coast of North America, depicted as it would have been 130 million years ago; the coast is a labyrinth of islands, lagoons, and peninsulas slowly colliding with the mainland to form the mountains and valleys we know today. Map by Ron Blakey].







[Image: A painting by Ron Blakey depicts a geological landscape near Sedona, Arizona].
A little while ago, I was planning on writing a book about psychological thrillers. I thought it might have been a good idea because I wanted to read a book about psychological thrillers but nobody appeared to have written one. While the project was eventually dissolved by the dawning realisation that nobody would publish a book about psychological thrillers written by me, my attempt to pull together a list of great psychological thrillers brought me into contact with Rene Clement’s Plein Soleil. Based on Patricia Highsmith’s classic existential novel The Talented Mr Ripley, Plein Soleil struck me as a fascinating misprision… a failure to comprehend the original intent of a work that nonetheless produced something of considerable beauty. FilmJuice have my review of Plein Soleil, which is now available in the UK for the first time in altogether too long.
Set in the strange demimonde created by wealthy American socialites slumming it in Italian hotels, Plein Soleil tells of a penniless young man who attaches himself to a much wealthier man with a far more forceful personality. In Highsmith’s original text, the relationship between Ripley and his prey is a sort of existential magnetism, a void that attempts to fill itself by consuming a much more substantial person. Intriguingly, Clement and Delon present Ripley not as an existential void but as a sort of unquenchable hunger… a man with nothing who wants everything and who will stop at nothing in order to get it. Indeed, even Anthony Minghella’s stylistically dull adaptation of the book presented Ripley as a sexless figure whereas Delon’s Ripley is all about Marie Laforet’s fragrant Marge:
Delon’s Ripley is an absolute masterpiece, a creature of malign and yet unfettered grace, the male libido chiselled into marble and made socially acceptable by the strategic use of smart haircuts and tailor-made suits. Think Bond unhitched from Queen and Country.
Another thing that struck me since filing the review is that Plein Soleil has a very similar setting and cast of characters to Antonioni’s now burdensomely-canonical L’Avventura; both are about beautiful people in a beautiful place and both films use that beauty to highlight the beautiful people’s complete lack of interiority. In L’Avventura, the mediterranean is a dull grey slate dotted with jet black protuberances while that of Clement is a washed-out nightmare where only the most brutal and beautiful fear to tread.
Re-visiting Plein Soleil was a real treat that only continues to confirm my feeling that Anthony Minghella’s Oscar-nominated and BAFTA-winning Talented Mr Ripley is actually the weakest of all the Ripley films while Clement’s adaptation and Liliana Cavani’s take on Ripley’s Game remain sadly under-rated.
What does it feel like to soar majestically like an bird? Maybe something like this video, shot with a camera strapped to the back of an eagle flying near Chamonix in France:
See also first-person footage of a peregrine falcon diving and killing a duck in mid-air. (via @gavinpurcell)
Tags: videoThis is really interesting research: "Stealthy Dopant-Level Hardware Trojans." Basically, you can tamper with a logic gate to be either stuck-on or stuck-off by changing the doping of one transistor. This sort of sabotage is undetectable by functional testing or optical inspection. And it can be done at mask generation -- very late in the design process -- since it does not require adding circuits, changing the circuit layout, or anything else. All this makes it really hard to detect.
The paper talks about several uses for this type of sabotage, but the most interesting -- and devastating -- is to modify a chip's random number generator. This technique could, for example, reduce the amount of entropy in Intel's hardware random number generator from 128 bits to 32 bits. This could be done without triggering any of the built-in self-tests, without disabling any of the built-in self-tests, and without failing any randomness tests.
I have no idea if the NSA convinced Intel to do this with the hardware random number generator it embedded into its CPU chips, but I do know that it could. And I was always leery of Intel strongly pushing for applications to use the output of its hardware RNG directly and not putting it through some strong software PRNG like Fortuna. And now Theodore Ts'o writes this about Linux: "I am so glad I resisted pressure from Intel engineers to let /dev/random rely only on the RDRAND instruction."
Yes, this is a conspiracy theory. But I'm not willing to discount such things anymore. That's the worst thing about the NSA's actions. We have no idea whom we can trust.
Now that we have enough details about how the >NSA eavesdrops on the Internet, including today's disclosures of the NSA's deliberate weakening of cryptographic systems, we can finally start to figure out how to protect ourselves.
For the past two weeks, I have been working with the Guardian on NSA stories, and have read hundreds of top-secret NSA documents provided by whistleblower Edward Snowden. I wasn't part of today's story -- it was in process well before I showed up -- but everything I read confirms what the Guardian is reporting.
At this point, I feel I can provide some advice for keeping secure against such an adversary.
The primary way the NSA eavesdrops on Internet communications is in the network. That's where their capabilities best scale. They have invested in enormous programs to automatically collect and analyze network traffic. Anything that requires them to attack individual endpoint computers is significantly more costly and risky for them, and they will do those things carefully and sparingly.
Leveraging its secret agreements with telecommunications companies—all the US and UK ones, and many other "partners" around the world -- the NSA gets access to the communications trunks that move Internet traffic. In cases where it doesn't have that sort of friendly access, it does its best to surreptitiously monitor communications channels: tapping undersea cables, intercepting satellite communications, and so on.
That's an enormous amount of data, and the NSA has equivalently enormous capabilities to quickly sift through it all, looking for interesting traffic. "Interesting" can be defined in many ways: by the source, the destination, the content, the individuals involved, and so on. This data is funneled into the vast NSA system for future analysis.
The NSA collects much more metadata about Internet traffic: who is talking to whom, when, how much, and by what mode of communication. Metadata is a lot easier to store and analyze than content. It can be extremely personal to the individual, and is enormously valuable intelligence.
The Systems Intelligence Directorate is in charge of data collection, and the resources it devotes to this is staggering. I read status report after status report about these programs, discussing capabilities, operational details, planned upgrades, and so on. Each individual problem -- recovering electronic signals from fiber, keeping up with the terabyte streams as they go by, filtering out the interesting stuff -- has its own group dedicated to solving it. Its reach is global.
The NSA also attacks network devices directly: routers, switches, firewalls, etc. Most of these devices have surveillance capabilities already built in; the trick is to surreptitiously turn them on. This is an especially fruitful avenue of attack; routers are updated less frequently, tend not to have security software installed on them, and are generally ignored as a vulnerability.
The NSA also devotes considerable resources to attacking endpoint computers. This kind of thing is done by its TAO -- Tailored Access Operations -- group. TAO has a menu of exploits it can serve up against your computer -- whether you're running Windows, Mac OS, Linux, iOS, or something else -- and a variety of tricks to get them on to your computer. Your anti-virus software won't detect them, and you'd have trouble finding them even if you knew where to look. These are hacker tools designed by hackers with an essentially unlimited budget. What I took away from reading the Snowden documents was that if the NSA wants in to your computer, it's in. Period.
The NSA deals with any encrypted data it encounters more by subverting the underlying cryptography than by leveraging any secret mathematical breakthroughs. First, there's a lot of bad cryptography out there. If it finds an Internet connection protected by MS-CHAP, for example, that's easy to break and recover the key. It exploits poorly chosen user passwords, using the same dictionary attacks hackers use in the unclassified world.
As was revealed today, the NSA also works with security product vendors to ensure that commercial encryption products are broken in secret ways that only it knows about. We know this has happened historically: CryptoAG and Lotus Notes are the most public examples, and there is evidence of a back door in Windows. A few people have told me some recent stories about their experiences, and I plan to write about them soon. Basically, the NSA asks companies to subtly change their products in undetectable ways: making the random number generator less random, leaking the key somehow, adding a common exponent to a public-key exchange protocol, and so on. If the back door is discovered, it's explained away as a mistake. And as we now know, the NSA has enjoyed enormous success from this program.
TAO also hacks into computers to recover long-term keys. So if you're running a VPN that uses a complex shared secret to protect your data and the NSA decides it cares, it might try to steal that secret. This kind of thing is only done against high-value targets.
How do you communicate securely against such an adversary? Snowden said it in an online Q&A soon after he made his first document public: "Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on."
I believe this is true, despite today's revelations and tantalizing hints of "groundbreaking cryptanalytic capabilities" made by James Clapper, the director of national intelligence in another top-secret document. Those capabilities involve deliberately weakening the cryptography.
Snowden's follow-on sentence is equally important: "Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it."
Endpoint means the software you're using, the computer you're using it on, and the local network you're using it in. If the NSA can modify the encryption algorithm or drop a Trojan on your computer, all the cryptography in the world doesn't matter at all. If you want to remain secure against the NSA, you need to do your best to ensure that the encryption can operate unimpeded.
With all this in mind, I have five pieces of advice:
Since I started working with Snowden's documents, I have been using GPG, Silent Circle, Tails, OTR, TrueCrypt, BleachBit, and a few other things I'm not going to write about. There's an undocumented encryption feature in my Password Safe program from the command line; I've been using that as well.
I understand that most of this is impossible for the typical Internet user. Even I don't use all these tools for most everything I am working on. And I'm still primarily on Windows, unfortunately. Linux would be safer.
The NSA has turned the fabric of the Internet into a vast surveillance platform, but they are not magical. They're limited by the same economic realities as the rest of us, and our best defense is to make surveillance of us as expensive as possible.
Trust the math. Encryption is your friend. Use it well, and do your best to ensure that nothing can compromise it. That's how you can remain secure even in the face of the NSA.
This essay previously appeared in the Guardian.
EDITED TO ADD: Reddit thread.
Someone somewhere commented that the NSA's "groundbreaking cryptanalytic capabilities" could include a practical attack on RC4. I don't know one way or the other, but that's a good speculation.
I'm not particularly interested in my kids being programmers or computer people. I'd rather they be interested in life and totally geeked about something. If that's computers, fine. If that's ballet, also fine.
That said, I think if they are going to be effective users (If not builders) I think they should have a basic sense of how electronics work.
I bought them a basic set of Snap Circuits, specifically Snap Circuits Jr. SC-100, which is just about US$20 on Amazon.
These are brilliant. Check this picture, as it's worth a thousand words and you'll get its genius immediately.
The 5 year old loves the motor and fan, as well as the speaker and noise makers. The boys have made doorbells, a light-controlled fan, lit-up LEDs and made an AM radio. Here's an Instagram Video of the 5 year old explaining his creation:
The pieces snap onto the grid with little buttons. The pieces are plastic and the wires run through them. They're not extremely resilient, in that they can break, particularly the capacitors, but it's actually nice to be able to see the resistors and other parts exposed through the plastic. It strikes a reasonable balance between being friendly to little hands, being sturdy, and actually working reliably as electronic components.
The 5 year old is no prodigy, to be clear, but he's already getting a general sense of electrical movement. He'll say that the resistors "slow down the electricity" and that the capacitors "store it up." He knows positive and negative, and how to use a multimeter to measure voltage. (I recommend a $10 multimeter as well for debugging your projects.) He's starting to look at doorbells and remote controls differently now, which means these little projects have already achieved my goal in just a few weeks. I anticipate they'll play with them for some months, forget about them, and then rediscover Snap Circuits every few years. These toys are great for a 5 or 6 year old, but even a 12 to 14 year old could totally appreciate them. I'm even running through some of the experiments and using the millimeter to remind myself of long-forgotten concepts.
We quickly outgrew the 30 parts in the Snap Circuits Jr. Even though it has 100 projects, I recommend you get the Snap Circuits SC-300 that has 60 parts and 300 projects, or do what we did and just get the Snap Circuits Extreme SC-750 that has 80+ parts and 750 projects. I like this one because it includes a computer interface (via your microphone jack, so any old computer will work!) as well as a Solar Panel.
The Snap Circuits SC-750 is a bargain at prices like US$75 if you can find it, especially considering how many tablets, Kindles and iPads some kids have.
The next Snap Circuits kids we're considering are either Snap Circuits "Light" that includes LEDs and Fiber Optics, although the 5 year old is pressuring me for the Snap Circuits Robot Rover. It'll likely be the Rover for the holidays around here.
I have no relationship with Snap Circuits, I bought these kits on my own and am reviewing them because they are awesome. If I could invest in Elenco Electronics, I would. The links here are Amazon affiliate links. If you use them, I can buy more Snap Circuits! ;)
Sponsor: Big thanks to Infragistics for sponsoring the feed this week! Download Your Free HTML5/jQuery Grid: Prepare to launch eye-popping, performance-driven HTML5 applications with Ignite UI. Believe your eyes - you can download the world's fastest, most reliable jQuery Grid now - no strings attached!
Kevin Delaney, the head of Wayland High School's history department, gave his 11th grade students an interesting challenge: find out everything you can about the person who owned a dusty briefcase full of papers that Delaney had found in the storage room. The man, Martin Joyce, turned out to have a life that spanned many significant events in history and his story provided the students with a personal lens into history.
Inside were the assorted papers -- letters, military records, photos -- left behind by a man named Martin W. Joyce, a long-since deceased West Roxbury resident who began his military career as an infantryman in World War I and ended it as commanding officer of the liberated Dachau concentration camp. Delaney could have contacted a university or a librarian and handed the trove of primary sources over to a researcher skilled in sorting through this kind of thing. Instead, he applied for a grant, and asked an archivist to come teach his students how to handle fragile historical materials. Then, for the next two years, he and his 11th grade American history students read through the documents, organized and uploaded them to the web, and wrote the biography of a man whom history nearly forgot, but who nonetheless witnessed a great deal of it.
"Joyce became the thread that went through our general studies," Delaney says. "When we were studying World War I, we did the traditional World War I lessons and readings. And then stopped the clocks and thought, 'What's going on with Joyce in this period?'"
As the class repeatedly asked and answered that question, they slowly uncovered the life of a man who not only oversaw the liberated Dachau but also found himself a participant in an uncommon number of consequential events throughout Massachusetts and U.S. history. In a way Delaney couldn't have imagined when he first popped open the suitcase that day, Joyce would turn out to be something akin to Boston's own Forrest Gump -- a perfect set of eyes through which to visit America's past.
Fantastic, what a great story. My favorite tidbit is that after all the wars and stuff, he and his wife were on the Andrea Doria when it was struck by the Stockholm and sunk. Part of the students' project was building a web site pertaining to Joyce's life and includes scans of all the papers they discovered...it's well worth looking through. (via @SlateVault)
Tags: Andrea Doria Kevin Delaney Martin Joyce war World War I World War II