Files
memex/inbox-posts.org

1.1 MiB
Raw Permalink Blame History

TODO Posts [24/2053]

DONE The "most important century" blog post series
  • State "DONE" from [2023-12-13 Wed 10:45]
DONE Is Death Real | Scientific Discovery Raises Questions About Death
  • State "DONE" from [2023-12-13 Wed 10:38]
DONE The Middle Class Is Dead. Long Live the Long Tail Class.
  • State "DONE" from [2023-12-13 Wed 09:53]
DONE Vices Are Not Crimes | Mises Institute
  • State "DONE" from [2023-12-11 Mon 15:23]
DONE The Surprising Geography of Gun Violence - POLITICO   guns us
  • State "DONE" from [2023-12-11 Mon 13:24]
DONE My techno-optimism   resilience decentralization
  • State "DONE" from [2023-11-28 Tue 13:16]

This Vitalik article coincides with my ideas on Atoms, Bits and Cells. The US is the ultimate Switzerland, a defensable island, even improved if absorbing Canada to the North and everything to the Panama Canal and the Caribean to the South.

DONE The Last Time I Saw Yaakov - Boston Review   zionism judaism israel
  • State "DONE" from [2023-12-11 Mon 15:23]
DONE How China can avoid the Japan trap | Financial Times

CLOSED: [2023-09-30 Sat 08:34]

TODO Stanford CRFM   ai computer

Stanford CRFM optimising Alpaca 7B to perform as well as GPT-3.5. Possibly the beginning of historical times.

TODO How Honduras Can Pull Off Five Centuries Of Legal Reforms In A Decade : Planet Money : NPR

Today, it is widely assumed each country must establish the rule of law on its own. There's just one problem with this prescription, which Gordon Brown summed up nicely: in establishing the rule of law, the first five centuries are always the hardest.

DONE Beginner - 6 Week Series (DC) — Fabrica Tango Academy   tango

CLOSED: [2023-06-18 Sun 21:31] SCHEDULED: <2023-05-04 Thu 20:00-21:00>

  • State "DONE" from "WAIT" [2023-06-18 Sun 08:36]

1230 9th St NW, Washington, DC 20001

TODO Cairo Freeze!   rottenURI
TODO Shaghel Baly!   rottenURI
TODO .: Subversion at the border   rottenURI
TODO {{{Mary}}}: bye bye   rottenURI
TODO مين وائل عباس؟   rottenURI
TODO مكتبة نيرفانا   rottenURI
TODO مدونو طنطا   rottenURI
TODO DON'T FREE FOUAD   rottenURI
TODO السياسى   rottenURI
TODO Daily Star Egypt - Full Article   rottenURI
TODO Daily Star Egypt - Full Article   rottenURI
TODO Daily Star Egypt - Full Article   rottenURI
TODO إلغاء الدعم: هل يكون القشّة التي تقصم ظهر الحكومة المصريّة؟ | جريدة الأخبار   rottenURI

:PROPERTIES: :Title: إلغاء الدعم: هل يكون القشّة التي تقصم ظهر الحكومة المصريّة؟ | جريدة الأخبار :URI: http://al-akhbar.com/ar/node/57351 :CREATED: [2016-09-02 Fri 19:27] :Modified: [2021-12-21 Tue 11:45] :ORG_GTD: Projects


:END:

TODO نهضة العرب   rottenURI
TODO `·.¸¸.·´´¯`··   rottenURI
TODO Wandering Scarab   rottenURI
TODO Petition on Tuition   rottenURI
TODO Daily News Egypt - Full Article   rottenURI
TODO this was never 'ours'   rottenURI
TODO this was never 'ours'   rottenURI
TODO untitled   rottenURI
TODO #Jan 25   rottenURI
TODO untitled   rottenURI
TODO untitled   rottenURI
TODO Untitled   rottenURI
TODO Untitled   rottenURI
TODO Full Text Electronic Journal List   rottenURI
TODO Full Text Electronic Journal List   rottenURI
TODO XKEYSCORE: NSA's Google for the World's Private Communications   website

[2023-08-03 Thu 13:00]

TODO Article

One of the National Security Agency's most powerful tools of mass surveillance makes tracking someone's Internet usage as easy as entering an email address, and provides no built-in technology to prevent abuse. Today,  The Intercept is publishing 48 top-secret and other classified documents about XKEYSCORE dated up to 2013, which shed new light on the breadth, depth and functionality of this critical spy system — one of the largest releases yet of documents provided by NSA whistleblower Edward Snowden.

The NSA's XKEYSCORE program, first revealed by The Guardian, sweeps up countless people's Internet searches, emails, documents, usernames and passwords, and other private communications. XKEYSCORE is fed a constant flow of Internet traffic from fiber optic cables that make up the backbone of the world's communication network, among other sources, for processing. As of 2008, the surveillance system boasted approximately 150 field sites in the United States, Mexico, Brazil, United Kingdom, Spain, Russia, Nigeria, Somalia, Pakistan, Japan, Australia, as well as many other countries, consisting of over 700 servers.

These servers store “full-take data” at the collection sites — meaning that they captured all of the traffic collected — and, as of 2009, stored content for 3 to 5 days and metadata for 30 to 45 days. NSA documents indicate that tens of billions of records are stored in its database. “It is a fully distributed processing and query system that runs on machines around the world,” an NSA briefing on XKEYSCORE says. “At field sites, XKEYSCORE can run on multiple computers that gives it the ability to scale in both processing power and storage.”

[[https://theintercept.com/wp-content/uploads/2015/06/int-ink-2-540x442.jpg]]

Illustration: Blue Delliquanti and David Axe for The Intercept

XKEYSCORE also collects and processes Internet traffic from Americans, though NSA analysts are taught to avoid querying the system in ways that might result in spying on U.S. data. Experts and privacy activists, however, have long doubted that such exclusions are effective in preventing large amounts of American data from being swept up. One document The Intercept is publishing today suggests that FISA warrants have authorized “full-take” collection of traffic from at least some U.S. web forums.

The system is not limited to collecting web traffic. The 2013 document, “VoIP Configuration and Forwarding Read Me,” details how to forward VoIP data from XKEYSCORE into NUCLEON, NSA's repository for voice intercepts, facsimile, video and “pre-released transcription.” At the time, it supported more than 8,000 users globally and was made up of 75 servers absorbing 700,000 voice, fax, video and tag files per day.

The reach and potency of XKEYSCORE as a surveillance instrument is astonishing. The Guardian report noted that NSA itself refers to the program as its “widest reaching” system. In February of this year, The Intercept reported that NSA and GCHQ hacked into the internal network of Gemalto, the world's largest provider of cell phone SIM cards, in order to steal millions of encryption keys used to protect the privacy of cell phone communication. XKEYSCORE played a vital role in the spies' hacking by providing government hackers access to the email accounts of Gemalto employees.

Numerous key NSA partners, including Canada, New Zealand and the U.K., have access to the mass surveillance databases of XKEYSCORE. In March, the New Zealand Herald, in partnership with The Intercept, revealed that the New Zealand government used XKEYSCORE to spy on candidates for the position of World Trade Organization director general and also members of the Solomon Islands government.

These newly published documents demonstrate that collected communications not only include emails, chats and web-browsing traffic, but also pictures, documents, voice calls, webcam photos, web searches, advertising analytics traffic, social media traffic, botnet traffic, logged keystrokes, computer network exploitation (CNE) targeting, intercepted username and password pairs, file uploads to online services, Skype sessions and more.

TODO Bulk collection and population surveillance

XKEYSCORE allows for incredibly broad surveillance of people based on perceived patterns of suspicious behavior. It is possible, for instance, to query the system to show the activities of people based on their location, nationality and websites visited. For instance, one slide displays the search “germansinpakistn,” showing an analyst querying XKEYSCORE for all individuals in Pakistan visiting specific German language message boards.

As sites like Twitter and Facebook become increasingly significant in the world's day-to-day communications (a Pew study shows that 71 percent of online adults in the U.S. use Facebook), they become a critical source of surveillance data. Traffic from popular social media sites is described as “a great starting point” for tracking individuals, according to an XKEYSCORE presentation titled “Tracking Targets on Online Social Networks.”

When intelligence agencies collect massive amounts of Internet traffic all over the world, they face the challenge of making sense of that data. The vast quantities collected make it difficult to connect the stored traffic to specific individuals.

Internet companies have also encountered this problem and have solved it by tracking their users with identifiers that are unique to each individual, often in the form of browser cookies. Cookies are small pieces of data that websites store in visitors' browsers. They are used for a variety of purposes, including authenticating users (cookies make it possible to log in to websites), storing preferences, and uniquely tracking individuals even if they're using the same IP address as many other people. Websites also embed code used by third-party services to collect analytics or host ads, which also use cookies to track users. According to one slide, “Almost all websites have cookies enabled.”

The NSA's ability to piggyback off of private companies' tracking of their own users is a vital instrument that allows the agency to trace the data it collects to individual users. It makes no difference if visitors switch to public Wi-Fi networks or connect to VPNs to change their IP addresses: the tracking cookie will follow them around as long as they are using the same web browser and fail to clear their cookies.

[[https://theintercept.com/wp-content/uploads/2015/06/int-ink-3-540x442.jpg]]

Illustration: Blue Delliquanti and David Axe for The Intercept

Apps that run on tablets and smartphones also use analytics services that uniquely track users. Almost every time a user sees an advertisement (in an app or in a web browser), the ad network is tracking users in the same way. A secret GCHQ and CSE program called BADASS, which is similar to XKEYSCORE but with a much narrower scope, mines as much valuable information from leaky smartphone apps as possible, including unique tracking identifiers that app developers use to track their own users. In May of this year, CBC, in partnership with The Intercept, revealed that XKEYSCORE was used to track smartphone connections to the app marketplaces run by Samsung and Google. Surveillance agency analysts also use other types of traffic data that gets scooped into XKEYSCORE to track people, such as Windows crash reports.

In a statement to The Intercept, the NSA reiterated its position that such sweeping surveillance capabilities are needed to fight the War on Terror:

“The U.S. Government calls on its intelligence agencies to protect the United States, its citizens, and its allies from a wide array of serious threats. These threats include terrorist plots from al-Qaeda, ISIL, and others; the proliferation of weapons of mass destruction; foreign aggression against the United States and our allies; and international criminal organizations.”

Indeed, one of the specific examples of XKEYSCORE applications given in the documents is spying on Shaykh Atiyatallah, an al Qaeda senior leader and Osama bin Laden confidant. A few years before his death, Atiyatallah did what many people have often done: He googled himself. He searched his various aliases, an associate and the name of his book. As he did so, all of that information was captured by XKEYSCORE.

XKEYSCORE has, however, also been used to spy on non-terrorist targets. The April 18, 2013 issue of the internal NSA publication Special Source Operations Weekly boasts that analysts were successful in using XKEYSCORE to obtain U.N. Secretary General Ban Ki-moon's talking points prior to a meeting with President Obama.

[[https://theintercept.com/wp-content/uploads/2015/06/int-ink-4-540x442.jpg]]

Illustration: Blue Delliquanti and David Axe for The Intercept

TODO XKEYSCORE for hacking: Easily collecting user names, passwords and much more

XKEYSCORE plays a central role in how the U.S. government and its surveillance allies hack computer networks around the world. One top-secret 2009 NSA document describes how the system is used by the NSA to gather information for the Office of Tailored Access Operations, an NSA division responsible for Computer Network Exploitation (CNE) — i.e., targeted hacking.

Particularly in 2009, the hacking tactics enabled by XKEYSCORE would have yielded significant returns as use of encryption was less widespread than today. Jonathan Brossard, a security researcher and the CEO of Toucan Systems, told The Intercept: “Anyone could be trained to do this in less than one day: they simply enter the name of the server they want to hack into XKEYSCORE, type enter, and are presented login and password pairs to connect to this machine. Done. Finito.” Previous reporting by The Intercept revealed that systems administrators are a popular target of the NSA. “Who better to target than the person that already has the keys to the kingdom?'”  read a 2012 post on an internal NSA discussion board.

This system enables analysts to access web mail servers with remarkable ease.

The same methods are used to steal the credentials — user names and passwords — of individual users of message boards.

Hacker forums are also monitored for people selling or using exploits and other hacking tools. While the NSA is clearly monitoring to understand the capabilities developed by its adversaries, it is also monitoring locations where such capabilities can be purchased.

Other information gained via XKEYSCORE facilitates the remote exploitation of target computers. By extracting browser fingerprint and operating system versions from Internet traffic, the system allows analysts to quickly assess the exploitability of a target. Brossard, the security researcher, said that “NSA has built an impressively complete set of automated hacking tools for their analysts to use.”

Given the breadth of information collected by XKEYSCORE, accessing and exploiting a target's online activity is a matter of a few mouse clicks. Brossard explains: “The amount of work an analyst has to perform to actually break into remote computers over the Internet seems ridiculously reduced — we are talking minutes, if not seconds. Simple. As easy as typing a few words in Google.”

These facts bolster one of Snowden's most controversial statements, made in his first video interview published by The Guardian on June 9, 2013. “I, sitting at my desk,” said Snowden, could “wiretap anyone, from you or your accountant, to a federal judge to even the president, if I had a personal email.”

Indeed, training documents for XKEYSCORE repeatedly highlight how user-friendly the program is: with just a few clicks, any analyst with access to it can conduct sweeping searches simply by entering a person's email address, telephone number, name or other identifying data. There is no indication in the documents reviewed that prior approval is needed for specific searches.

In addition to login credentials and other target intelligence, XKEYSCORE collects router configuration information, which it shares with Tailored Access Operations. The office is able to exploit routers and then feed the traffic traveling through those routers into their collection infrastructure. This allows the NSA to spy on traffic from otherwise out-of-reach networks. XKEYSCORE documents reference router configurations, and a document previously published by Der Spiegel shows that “active implants” can be used to “cop[y] traffic and direc[t]” it past a passive collector.

TODO XKEYSCORE for counterintelligence

Beyond enabling the collection, categorization, and querying of metadata and content, XKEYSCORE has also been used to monitor the surveillance and hacking actions of foreign nation states and to gather the fruits of their hacking. The Intercept previously reported that NSA and its allies spy on hackers in order to collect what they collect.

Once the hacking tools and techniques of a foreign entity (for instance, South Korea) are identified, analysts can then extract the country's espionage targets from XKEYSCORE, and gather information that the foreign power has managed to steal.

Monitoring of foreign state hackers could allow the NSA to gather techniques and tools used by foreign actors, including knowledge of zero-day exploits—software bugs that allow attackers to hack into systems, and that not even the software vendor knows about—and implants. Additionally, by monitoring vulnerability reports sent to vendors such as Kaspersky, the agency could learn when exploits they were actively using need to be retired because they've been discovered by a third party.

TODO Seizure v. searching: Oversight, audit trail and the Fourth Amendment

By the nature of how it sweeps up information, XKEYSCORE gathers communications of Americans, despite the Fourth Amendment protection against “unreasonable search and seizure” — including searching data without a warrant. The NSA says it does not target U.S. citizens' communications without a warrant, but acknowledges that it “incidentally” collects and reads some of it without one, minimizing the information that is retained or shared.

But that interpretation of the law is dubious at best.

XKEYSCORE training documents say that the “burden is on user/auditor to comply with USSID-18 or other rules,” apparently including the British Human Rights Act (HRA), which protects the rights of U.K. citizens. U.S. Signals Intelligence Directive 18 (USSID 18) is the American directive that governs “U.S. person minimization.”

Kurt Opsahl, the Electronic Frontier Foundation's general counsel, describes USSID 18 as “an attempt by the intelligence community to comply with the Fourth Amendment. But it doesn't come from a court, it comes from the executive.”

If, for instance, an analyst searched XKEYSCORE for all iPhone users, this query would violate USSID 18 due to the inevitable American iPhone users that would be grabbed without a warrant, as the NSA's own training materials make clear.

Opsahl believes that analysts are not prevented by technical means from making queries that violate USSID 18. “The document discusses whether auditors will be happy or unhappy. This indicates that compliance will be achieved by after-the-fact auditing, not by preventing the search.”

Screenshots of the XKEYSCORE web-based user interface included in slides show that analysts see a prominent warning message: “This system is audited for USSID 18 and Human Rights Act compliance.” When analysts log in to the system, they see a more detailed message warning that “an audit trail has been established and will be searched” in response to HRA complaints, and as part of the USSID 18 and USSID 9 audit process.

Because the XKEYSCORE system does not appear to prevent analysts from making queries that would be in violation of these rules, Opsahl concludes that “there's a tremendous amount of power being placed in the hands of analysts.” And while those analysts may be subject to audits, “at least in the short term they can still obtain information that they shouldn't have.”

During a symposium in January 2015 hosted at Harvard University, Edward Snowden, who spoke via video call, said that NSA analysts are “completely free from any meaningful oversight.” Speaking about the people who audit NSA systems like XKEYSCORE for USSID 18 compliance, he said, “The majority of the people who are doing the auditing are the friends of the analysts. They work in the same office. They're not full-time auditors, they're guys who have other duties assigned. There are a few traveling auditors who go around and look at the things that are out there, but really it's not robust.”

In a statement to The Intercept, the NSA said:

“The National Security Agency's foreign intelligence operations are 1) authorized by law; 2) subject to multiple layers of stringent internal and external oversight; and 3) conducted in a manner that is designed to protect privacy and civil liberties. As provided for by Presidential Policy Directive 28 (PPD-28), all persons, regardless of their nationality, have legitimate privacy interests in the handling of their personal information. NSA goes to great lengths to narrowly tailor and focus its signals intelligence operations on the collection of communications that are most likely to contain foreign intelligence or counterintelligence information.”

Coming next:  A Look at the Inner Workings of XKEYSCORE

Source maps: XKS as a SIGDEV Tool, p. 15, and XKS Intro, p. 6

Documents published with this article:

TODO The Great Change: Charting Collapseniks   website

[Y-08-03 Thu 15:%]

TODO Article
TODO Tuesday, January 14, 2014

<<9222068244903913448>>

TODO Charting Collapseniks

"Rather than spurning financial system terrorists, Holmgren urges activists to become “terra-ists”; to directly bring down the system by thousands of acts of economic disobedience."
\\

[[//2.bp.blogspot.com/-atrcJlyGpUA/Ut2O_tpPSnI/AAAAAAAAHU8/g115pr76Sgw/s1600/taking+a+drink.jpg]]

A ferment in the environmental movement, brewing for many years, has now bubbled up into the blogosphere. We are dipping our ladle in here to take a little taste of it, even though we are quite certain it is not done fermenting.
\\ Bill McKibben has been stirring the wort of whether social activism can save us for many years. In Eaarth: Making Life on a Tough New Planet, as in The End of Nature a quarter century earlier, he poignantly waffled, in elegant prose, between hope and despair. Since launching 350.org — “the first political action with a number for a name” — he has urged those of us with any remaining shred of hope for our children's future, given what we now know about climate change, to step up and lay our lives on the line. Get arrested. Risk lengthy jail terms and even death to stop this atrocity. Do not go gentle into that good night.
\\ Words to this effect we have heard much longer and louder from Derrick Jensen, another eloquent writer, the difference being that McKibben advocates for non-violence in the mold of Gandhi and King, while Jensen has no qualms about advocating violence. Naomi Klein, another stirring writer with an arrest record, calls for acts of resistance large and small. McKibben is tepid about taking on capitalism's growth imperative, as though it were not a major contributing factor, while neither Holmgren, Klein nor Jensen have any such reservations.
\\ Thus we are tasting many different flavors of leadership, or literary guidance, in the shaping of the nascent climate resistance movement.
\\ Scientists themselves have been growing politically more active and radicalized, as Klein described in her October New Statesman essay. If you go back enough years you'll find scientists like Dennis Meadows, Howard Odum and James Lovelock, all of whom correctly foresaw the impending collision between consumer civilizations and natural systems. Lovelock made a series of climate-and-society predictions that went unheeded for 20 years but hold up well in retrospect.
\\ Joining the chorus of climate Cassandras with more structured harmonies are the peak-oilers and financial collapsarians. These thoughtful writers straddle a continuum that is both time-sensitive (near-term, middle term, long-term) and outcome ambivalent — they are undecided as to whether the future they foresee will be a good thing, a bad thing, or even survivable.
\\ Guy McPherson has staked out the lonely position for near-term human extinction, which might be a good thing or a bad thing, depending on how you look at it. Richard Heinberg, Nicole Foss and Steve Keen all see financial constraints as the leading edge of whatever storm is forming, and are not making predictions about how or when, but are planting gardens and putting up canned goods nonetheless.
\\ Michael Ruppert, James Howard Kunstler and Dmitry Orlov are also decoupling from whatever economic grids they may be attached to, but do not foresee a particularly happy outcome in all this. Social unraveling is not a pretty picture, as Orlov describes in his Five Stages of Collapse.
\\ Still clinging to the possibility of some salvageable human prospect are cultural and technical optimists like Amory Lovins, David Orr and Rob Hopkins. We personally would also favor this idea of an ecotopian future, and have been working to bring it about it for half a century now, but our own position is that collapse is likely unstoppable now, given, as Nicole Foss puts it “the excess claims on underlying real wealth.”
\\ What suddenly bubbled up from the blog vat at the start of 2014 was a white paper authored by David Holmgren, one of the founders of permaculture, reversing a position he had long espoused. Instead of associating himself with peaceful change by calling for restraint on overconsumption and gradual adoption of the degrowth economic paradigm, extending it ever outward until it became the mainstream culture, Holmgren abruptly called for “ Crash on Demand//www.blogger.com/null or a strategic decoupling by masses of youth (and elders) from the economic system that is the crashing the planet's ecological stasis, by simply walking away.
\\ “Rather than spurning financial system terrorists [a.k.a. banksters or the 1/10th-percent],” Holmgren urged activists to become “terra-ists”; to directly bring down the system by thousands of acts of economic disobedience. “The urgency for more radical action to build parallel systems and disconnect from the increasingly centralized destructive mainstream is a logical and ethical necessity whether or not it contributes to a financial collapse,” he wrote provocatively.
\\ This immediately inspired a flurry of thoughtful responses, as might be expected. One of the most impassioned came from one whose positions Holmgren had just abandoned. Writing for Transition Culture January 13, Rob Hopkins responded, “to state that we need to deliberately, and explicitly, crash the global economy feels to me naive and dangerous, especially as nothing in between growth and collapse is explored at all.”
\\ Hopkins main truck with Holmgren is his readiness to toss away all notions of mainstreaming permaculture and transition towns. “I may be naive,” he writes, “but I still think it is possible to mobilise that in a way that, as the Bristol Pound illustrates, gets the support and buy-in of the 'City/State' level, and begins to really put pressure and influence on 'National' thinking. I may be naive, but it's preferable to economic collapse in my book, and I think we can still do it.”
\\ Concerned that a hard line position would expose social change agents to the full weight of state security as well as to the blame cascading from an angry populace, and that sewing the seeds of civil discord is always dangerous, Nicole Foss wrote on The Automatic Earth January 9 that financial collapse is already well underway and there is no need to expedite the process. “While I understand why Holmgren would open a discussion on this front, given what is at stake, it is indeed dangerous to grasp the third rail' in this way. This approach has some aspects in common with Deep Green Resistance, which also advocates bringing down the existing system, although in their case in a more overtly destructive manner.”
\\ “Decentralization initiatives already face opposition, but this could become significantly worse if perceived to be even more of a direct threat to the establishment,” Foss concluded.
\\ Having these positions staked out was useful for the discussion of strategy that change agents need to be more engaged with. Klein and McKibben seem to think that if we just have enough “Battles for Seattle,” the economic system of global civilization will be radically restructured. Our own experience in joining dozens of massive marches and actions of civil disobedience but nonetheless failing to end the Vietnam War has perhaps jaundiced our views in this regard. Moreover, Holmgren and Foss make clear that that's not going to happen.
\\ Even the recently unveiled strategy of fossil fuel divestment, as promising as it is, and as grounded in investment reality of the stranded, overvalued assets unable to ever be burnt, stands little chance of being able to arrest climate tipping points that may have been triggered decades ago.
\\ Foss is not especially concerned for the climate, apparently clinging to the position Holmgren had some years ago, that collapse of energy and economics will augur in a low-carbon future, although she does acknowledge the lurking unknowns from reversed global dimming. “We need to get down to the business of doing the things on the ground that matter, and to look after our own local reality. We can expect considerable opposition from those who have long benefited from the status quo, but if enough people are involved, change can become unstoppable. It won't solve our problems in the sense of allowing us to continue any kind of business as usual scenario, and it won't prevent us from having to address the consequences of overshoot, but a goal to move us through the coming bottleneck with a minimum amount of suffering is worth striving for.”
\\ Our own view is that the likelihood that a runaway greenhouse effect is now underway is greater than it has ever been, and to call what is coming a bottleneck is a poor choice of words except perhaps in the sense of the genetic bottleneck experienced 70-80 thousand years ago in connection with a supervolcano that reduced our hereditary lines to fewer than 5000 individuals worldwide. While we understand the concern she raises about unduly politicizing the issue, we'd say that cat has left its bag and keeping silent for fear of numbing the population makes no more sense for climate change than it does for Ponzi economics. Indeed, the parallels between the overdraft on Earth's atmosphere and the excess claims on fictional central bank assets are striking — neither is going to go away simply by ignoring them. In both cases, the cake already baked.
\\ This prompts us to make a new grid to categorize the range of opinions amongst peakists, collapseniks, politicos and anarchists. It goes something like this, at first drawing, and we welcome corrections, especially from those named.
\\ Holmgren's change of position can be charted this way:
\\ \\

[[//3.bp.blogspot.com/-NGrBpvZwr24/UtVpZ2OJ5-I/AAAAAAAAHRo/x4Nw9KwklYI/s640/3Collapseniks.001.jpg]]

\\

\\ If we plot the respective positions of other change strategists, they look something like this:
//3.bp.blogspot.com/-Xn84Ld-0paY/UtVaRfSIdnI/AAAAAAAAHRM/Ta2ZIK7Ml6M/s1600/CCollapseniks.002.jpg
\\ \\ \\

[[//3.bp.blogspot.com/-I8YaCP7Q6uk/Utb9QXrDHII/AAAAAAAAHTM/YYB0nzx3BIc/s1600/7bCollapseniks.002.jpg]]
This is revision #7 since our original post

\\ Our own position in this matrix , outlined in two books since 2006, is off to the left and centered on the line, meaning that while we are adamant in our advocacy for peaceful transformation, we are doubtful as to whether ecotopia is possible without collapse. Those seem to us to be a coupled pair. Likewise, McKibben is in favor of a new green economy but stuck vacillating between more peaceful and less peaceful means of getting there, while McPherson is deeply wedded to inevitable collapse without caring any more about social responses.
\\ Not surprising, given what they know, scientists like Lovelock, Ken Anderson, and Howard Odum all fall below the line dividing Ecotopia from Collapse. Odum, we suspect, would have been in favor of peaceful transformation, while the others would like us to push harder and force the issue.
\\ Naturally those most concerned with Holmgren's shift would be those closest to his former position, including Rob Hopkins. Those closest to him now — Kunstler, Anderson, Hansen and Klein — would be the most likely to approve.
\\ What is missing from Holmgren's paper are the advances in terrestrial carbon sequestration — as opposed to Ponzi geoengineering — in no small measure reaching fruition by dint of permaculture design. While permaculturists like Rob Hopkins, Declan Kennedy and Max Lindegger pursued innovations in social structures — transition towns, complimentary currencies and ecovillages — other permaculturists — Darren Doherty, Richard Perkins, Joel Salatin and Ethan Roland, to name just some — have pushed the envelope to see how much carbon can actually be returned to the soil. This revolution is the subject of Courtney White's new book, Grass, Soil, Hope: A Journey Through Carbon Country, scheduled for release in June.
\\ Would we have ever learned that a mere 2% increase in the carbon content of the planet's soils could offset 100% of all greenhouse gas emissions going into the atmosphere if we had not been so frightened of climate change by Al Gore and other scaremongers? Speaking as one who wandered deep into Amazonian history to discover this new paradigm, we reply: probably not.
\\ We've added some color coding and sector analysis with this third iteration:
\\ \\

[[//2.bp.blogspot.com/-cnLxngbUXYc/Utb6oENq9_I/AAAAAAAAHTE/TtHLBf-znUw/s1600/7aCollapseniks.003.jpg]]
This is revision #7 since our original post

\\ Now lets step back and add a whole nother layer to this.
\\ There is a really good cultural transformation going on, with ecovillagers, ecological restorationists, soil remineralizers and post-empire econometricists. Simultaneously, there is a really negative übertrend of banksters and purchased or annointed politicians enriching themselves off oil, nuke and the wealth of nature, then turning all that surplus into the worst kinds of pollution the kinds that take millennia to degrade and even then impair gene pools for untold generations.
\\ These two conflicting transformations coexist against the backdrop of almost immeasurably immense climatic and biosystemic change that will severely affect, if not drive, our world in the future. We all exist in the context of ecosystems and yet these familiar norms are being utterly destroyed while we write this. The tiny little good ecovillagers, permaculturists and transition towners do pales in comparison to the scale of damage of unrestrained growthaholism that seems almost a genetic imperative of our species — and we are the keystone species in ecosystem Earth. Holmgren has this right, and it is undeniably frightening.
\\ We're sure there may be more thoughtful readers who can add to this analysis and produce more insights than we have, but as we say, we're just grateful to be having this kind of discussion. The conversation continues in our next post, Recharting Collapseniks.
\\ After co-teaching a permaculture course in Belize with Nicole Foss next month, we will be vetting this analysis with Dmitry Orlov, Dennis Meadows, John Michael Greer, Gail Tverberg, KMO and others at the Age of Limits conference in Pennsylvania in May. \\

Posted by

Albert Bates at

10:48AM [[https://resources.blogblog.com/img/icon18_email.gif]] [[https://resources.blogblog.com/img/icon18_edit_allbkg.gif]]

Email This BlogThis! Share to Twitter Share to Facebook Share to Pinterest

Labels: Age of Limits, Albert Bates, capitalism, carbon farming, collapse, degrowth, Dmitry Orlov, ecovillage, Holmgren, Kunstler, MacPherson, McKibben, Naomi Klein, Occupy, permaculture, Rob Hopkins, supervolcano, writing

<<comments>>

TODO 26 comments:

<<c7909048387351472339>>

[[//www.blogger.com/img/blogger_logo_round_35.png]]

Alexander Ac said…

Hello Albert,
\\ thanks for this nice analysis!
\\ My question is if/where would you put Dave Cohen (retired peak-oiler and now retired blogger), who wrote around +1500 blogs on our collctive predicament during the last 3 years of the Decline of The Empire.
\\ I also miss Ugo Bardi :-)
\\ Best,
\\ Alex

January 14, 2014 at 11:43AM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c6187748830063867484>>

https://resources.blogblog.com/img/blank.gif

//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjEyynmGGP-RwLWfdYV_M6TBzditmOsDkjQPvY_5qdLvrMebZsEt0Rc9gjiYvJdjpS_ZybSlPcytC3VBY8SCSa9r6M8_RNJkgw75lautJdcXVuO_MwsKRw5P03m_hFRgTM/s45-c/skintnick.jpg

skintnick said…

John Michael Greer mentioned but not on your graph

January 14, 2014 at 2:20PM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c3142451119757862765>>

https://resources.blogblog.com/img/blank.gif

//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_f8--yWjCCYOYasZgakTyF0NcV0KDcnqklSsRiuIgO2tPAurx7DaoTVbigy3Ag9LOFLc1d4IvyOZJMkV49HJ1zzSX_X0vcd-EHDZDJ-xsF1B_D3i_aaZoQGCwM9XDbg/s45-c/Nicole+2013.jpg

Stoneleigh said…

It's not that I'm not concerned about climate or that I'm denying in any way that climate chaos is occurring. I do think there's more uncertainty in the science than most people seem to, but uncertainty and complexity intrigue me. I am fully supportive of biochar and other small to medium scale carbon sequestration methods. They're a complete win-win. I would add industrial scale sequestration efforts to my list of things likely to be counter-productive, as anything on an industrial scale is going to be carbon intensive, and could well make things worse. I'm not suggesting shutting down conversations on the science or any such thing. It's mass awareness and fear that I think are likely to be counter-productive , especially if they lead to large scale 'policy responses'. I have zero faith in the ability of the political system to address any systemic threat in a constructive way.

January 14, 2014 at 4:35PM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c3916722856280867694>>

https://resources.blogblog.com/img/blank.gif

//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8udqo5xse5I-e3wxsnqpb8Hg5yYqV5VPH2wN37yuHOLBJKAOiqLcWCpkLCk63jqIxS9vtFia0xhnfEgnmC7PYL5189RD3TNOTJ2fkHFYI1Ie9izWQKZMBLQOs9L4hagI/s45-c/copy+2018+%281%29+joe+snow+Hslaw+DSC_0349+%282%29.jpg

philsharris said…

Hi
I look forward to reading the presentations at the Limits to Growth conference in W Virginia.
\\ I don't fly these days.
\\ And as Alex asks - where is Ugo Bardi (the Chemistry Prof)?
\\ best
Phil H4

January 14, 2014 at 5:11PM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c1604867517561561571>>

https://resources.blogblog.com/img/blank.gif

//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi5nXy6vmdAUx_m_vBw2iJh0PyoN8b-8fmKjUDgWxgHPXshdWy0EaE9vjuQff4dG6cUfso1Rdyl_ZIPskzXGWKwkV7zOhmSi40ERCmFTVuSpUB-Ix0AY38KVJBPBAV5rQ/s45-c/Headshot-9-19.jpg

Dan Miner said…

Hi Albert,
\\ This is an awesome analysis. Great work!
\\ I'm still grasping at the possibility of influencing some people, so I gravitate to the positions of Bill McKibben, Rob Hopkins, and others, including Heinberg and yourself. As far as which narratives can be either helpful or accurate, only time will tell.
\\ Dan Miner
NYC

January 14, 2014 at 10:17PM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c4962458476165106344>>

https://resources.blogblog.com/img/blank.gif

//1.bp.blogspot.com/-_DSyMmKvnSg/YPAzaHkuC3I/AAAAAAABS2k/aNsLk02PJeEdAmdg0LN0o_Xod3Qg6IUKQCK4BGAYYCw/s35/profile2021.jpg

Tom Wayburn said…

Where am I?
\\ http://tomwayburn.net/#_Net_Energy_Analysis
\\

January 15, 2014 at 3:45AM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c674504807192831972>>

[[//www.blogger.com/img/blogger_logo_round_35.png]]

David Eggleton said…

Thank you. This is valuable and will be increasingly useful if/as the mentioned folks respond and clarify.
\\ I sit in the midst of Holmgren, Bates and Heinberg.

January 15, 2014 at 7:35AM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c7499218153424173045>>

https://resources.blogblog.com/img/blank.gif

//3.bp.blogspot.com/_crhQq5DZNPI/Sat79oIbiNI/AAAAAAAAByE/9X9WWMuq8qI/S45-s35/499160146_49b88627e3.jpg%3Fv%3D0

Josh said…

To trigger the crash and reset to a lower level of GGE, Holmgren's piece calls for pulling pins out of the global financial system through household and local initiatives aimed to cut consumption, relocalize economies and build community resilience. This, he says, is to be undertaken by a committed minority of people in affluent countries. Some readers may be appalled at Holmgren's suggestion that it might be appropriate to intentionally crash the system. But this assumes that we could "crash the system," if we so chose. Many committed individuals and organizations (small and large) have been working at all levels (grassroots, corporate, government, NGO, urban, rural, "inside" and "outside" "the system," etc.) for decades now in effort to "cut consumption, relocalize economies and build community resilience." These laudable efforts have yet to arrest or even slow the global economy, let alone crash it. Such have been the stated objectives of various "green groups" for so long now; so why hasn't it already happened? The global economic status quo has enormous inertia, and Holmgren alludes to our widespread paralysis in the face of this. Additionally, vast sums of money and tremendous political forces are arrayed to propping up the status quo at all costs. This suggests that even if a "committed minority of people in affluent countries" came to agreement that it is necessary to "crash the system," they would not be able to do so. I question whether Holmgren is suggesting that green groups do anything they have not already been doing for years now, albeit perhaps with the altered explicit intention of "crashing the system." Even that does not seem new, as many green activists find the system abhorrent and have been explicitly trying to sink it all along. Is the realization that "We can't crash the system even if we wanted to" less palatable, even, than what Holmgren proposes? Western (white) middle-class children are taught from a young age, "You can grow up to be whatever you want - you can change the world!" I find that this attitude has been carried forward into a lot of (white) middle-class environmental and social justice movements. An overdeveloped sense of personal empowerment has apparently led many to believe that they have a responsibility to "make the world a better place" - what is implied is that they have the power to do so. This becomes too teleological (not to mention hubristic and Messianic): we become green activists because "We Must Win!" Holmgren makes the allusion to a "not-so-slow moving train crash." This is an apt analogy because once the train crash has begun, there's nothing anyone can do about it. Likewise, we do not have the power or control to "crash" the global financial system in the manner we choose and according to our preferred timeline. What happens is what happens, over whatever time period it turns out. Our job is still to "cut consumption, relocalize economies and build community resilience." But we are better off doing so non-teleologically. We do it because it's the right thing to do, and the best thing to do under the circumstances, not because "We Must Win!"

January 15, 2014 at 9:41AM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c7992672941867613987>>

https://resources.blogblog.com/img/blank.gif

//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmH6Omw79VoBkhSw3l3DGafouzO7jNcOSy57twASUPePo9cHbKQY_s3-LYJfPSk6ycZvFUuDihSzIurKjxgK0vKvK5Yrdjvc7SNy3sDBz54Gclj37A-8wcbwtlq9lvakM/s45-c/AlbertHeadshot2021

Albert Bates said…

Josh,
\\ While I heartily agree it does no good to over-estimate your ability to alter the course of history, I have to say every now and then I feel that humongous boulder budge a little, and damn but doesn't that feel good!

January 15, 2014 at 10:06AM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c1671804389061526852>>

https://resources.blogblog.com/img/blank.gif

//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmH6Omw79VoBkhSw3l3DGafouzO7jNcOSy57twASUPePo9cHbKQY_s3-LYJfPSk6ycZvFUuDihSzIurKjxgK0vKvK5Yrdjvc7SNy3sDBz54Gclj37A-8wcbwtlq9lvakM/s45-c/AlbertHeadshot2021

Albert Bates said…

Nicole,
\\ I don't know how anyone could come away from a careful reading of IPCC-5 or any of the newer papers published in Science, Nature, or the specific journals for the climate field and still say "I do think there's more uncertainty in the science than most people seem to." I just have to shake my head at that, as I do for the "best thing is to say nothing" remark.\\

January 15, 2014 at 10:10AM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c8141859129543773217>>

[[//www.blogger.com/img/blogger_logo_round_35.png]]

Unknown said…

This article provides a very helpful framework for discussion. I have a contribution to make to the discussion about stakeholder engagement/collaborative problem solving processes designed to maximize citizen participation in local efforts to overcome the challenges of our times.
\\ \\ This writer has contributed (in many places) a “List of Ten Critical Challenges” (1 page)(condensed from compilation of excerpts assessments over many years)(accessible at http://cpcsc.info/tipping-point-action/ ). He feels that almost all of the challenges in the list—especially halting global warming before unprecedented negative feedback loops set in—will involve whole cultures needing to find contentment and quality of life using much less materials goods and ecological services. One important point on that list which is absent from many other critical challenge assessments he has seen is #7 “A Marginalization of the Treasured Wisdom of Religious, Spiritual, and Moral Traditions” (with a not unrelated, and more widely cited, challenge being #2 “Cultures of Violence, Greed, Corruption, and Overindulgence”).
\\ While there are many people who are cynical about the value of such treasured wisdom, those who have experienced such wisdom know that “The satisfaction of one's physical needs must come at a certain point to a dead stop before it degenerates into physical decadence.” (Mahatma Gandhi). Most people would agree that there are many people who do not understand that kind of wisdom now—but how many people would also agree that “their help will be needed” to avoid disastrous global warming outcomes?
\\ Thus, if one is cynical about whether many people can—or are willing to—deliberately cultivate the above traditions for the treasured wisdom, they may also disregard the potential for collaborative problem solving which would attempt to engage “people who do not understand that kind of wisdom”, (as irrelevant, since they dismiss the idea that “their help” will ever be forthcoming).
\\ My main point here would not be that all we need are more collective kumbaya experiences (as in why can't we all just get along?)—but that there are gritty, nuts and bolts grind it out do your homework and build trust in stakeholder engagement/collaborative problem solving processes which can be adopted into use in many different kinds of communities and cultures. And if one does believe—for whatever reason—that even with the unprecedented challenges ahead, we can arrive at a positive outcome, then it is common sense practical, and has much to commend itself in the long run, to 1) deliberately cultivate the religious, spiritual, and moral traditions for the treasured wisdom, and 2) increase our efforts in research, advocacy, and best practices sharing of stakeholder engagement/collaborative problem solving models which are designed to maximize citizen participation.
\\ \\ There are many ways to build momentum for such collaborative problem solving processes.
\\ In December, 2013, this writer [as the primary organizational person for the Community Peacebuilding and Cultural Sustainability (CPCS) Initiative] launched a campaign called “Tipping Point Action: Citizen Participation in Times of Unprecedented Challenges”.
\\ The three primary outreach documents for that campaign—and much information about how volunteers can contribute—can be accessed at the “Outreach for the Tipping Point Action Campaign” webpage, at the website for the Community Peacebuilding and Cultural Sustainability (CPCS) Initiative.
\\ \\ Closing comments:
\\ The more people know about organizations, initiatives, and campaigns which have their eyes wide open about the challenges, but are nevertheless doing the gritty, nuts and bolts grind it out do your homework and build trust in thinking and doing which will help matters—the more likely they will be to choose those options to participate in.

January 15, 2014 at 11:19AM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c544630940587990578>>

https://resources.blogblog.com/img/blank.gif

//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfuknUOMFN_DDp7-8kCaswVJrMVcu7TkIx986Ud9PXav9NOdyOjwBtbl2J7Jvw67elx2PlO5nEBHWxP9JrTyjMccEy2T3BM-7A8q6pwX5GoUA9Fz8PorYzPCzHSASD2A/s45-c/Author+Photo.jpg

Walter said…

Albert - I have great respect for you (even though you are a permacultist!) because of your focus on real work with the soil. You are the only person, besides myself, that I have ever heard say, "We can make soil. We don't have to rely on the 1000-year per inch process." I also appreciate that you have read widely in anthropology and genetics (e.g. mentioning Jorde and Harpending). However, I think your argument is as simplistic as Holmgren and Hopkins. Putting analysts on a neat little chart with four sectors lacks nuance. We just don't know what is going to happen do we? Keep feeding people and building alternatives for the future. That's real change.

January 15, 2014 at 11:53AM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c5566155378636332224>>

https://resources.blogblog.com/img/blank.gif

//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmH6Omw79VoBkhSw3l3DGafouzO7jNcOSy57twASUPePo9cHbKQY_s3-LYJfPSk6ycZvFUuDihSzIurKjxgK0vKvK5Yrdjvc7SNy3sDBz54Gclj37A-8wcbwtlq9lvakM/s45-c/AlbertHeadshot2021

Albert Bates said…

Walter -
\\ I agree that the map is not the territory, and this is especially true of mind maps. I am just an impulsive doodler.
\\ John Michael Greer and Ugo Bardi got enough requests that I added them in the 6th revision. I also placed Ted "Unibomber" Kaczynski in the upper right quadrant. See: http://peaksurfer.blogspot.mx/2013/06/the-unibomber-in-age-of-limited-options.html

January 15, 2014 at 12:46PM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c4700782067941213386>>

https://resources.blogblog.com/img/blank.gif

//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_f8--yWjCCYOYasZgakTyF0NcV0KDcnqklSsRiuIgO2tPAurx7DaoTVbigy3Ag9LOFLc1d4IvyOZJMkV49HJ1zzSX_X0vcd-EHDZDJ-xsF1B_D3i_aaZoQGCwM9XDbg/s45-c/Nicole+2013.jpg

Stoneleigh said…

Well, at least you needn't worry that I'll be going around talking about it ;)

January 15, 2014 at 2:11PM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c4718841119393762633>>

https://resources.blogblog.com/img/blank.gif

//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_f8--yWjCCYOYasZgakTyF0NcV0KDcnqklSsRiuIgO2tPAurx7DaoTVbigy3Ag9LOFLc1d4IvyOZJMkV49HJ1zzSX_X0vcd-EHDZDJ-xsF1B_D3i_aaZoQGCwM9XDbg/s45-c/Nicole+2013.jpg

Stoneleigh said…

By the way, I think the best place for me on your graph would be to place me roughly at the intersection of a horizontal line drawn through Odum and a vertical line drawn through Bardi. I try my best to encourage peaceful transformation, but that doesn't mean I think it all that likely when supply chains are so vulnerable and financial crisis can be very abrupt. Basically, I'm trying to push from where I indicated on your graph towards where you initially put me. The odds of success I rate as low, but the effort is absolutely worth it.
\\ Also I think it would be good to put David Korowicz on the graph. He's a very serious thinker on these issues. I'll ask him to suggest where he thinks he would fit.

January 15, 2014 at 2:24PM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c6065025678853795252>>

https://resources.blogblog.com/img/blank.gif

//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmH6Omw79VoBkhSw3l3DGafouzO7jNcOSy57twASUPePo9cHbKQY_s3-LYJfPSk6ycZvFUuDihSzIurKjxgK0vKvK5Yrdjvc7SNy3sDBz54Gclj37A-8wcbwtlq9lvakM/s45-c/AlbertHeadshot2021

Albert Bates said…

Accepting still more feedback, I have readjusted Nicole Foss's position to her specification, repaired Guy McPherson's spelling, and added Ray Kurzweil to the upper left quadrant, staking out a polar opposite position from Ted Kaczynski. James H. Kunstler suggests a good sort criteria might be whether the individual expects a mere demise of society or of the entire human prospect. I concur, but don't know that many, other than Guy McPherson and James Lovelock, are willing to reveal that.

January 15, 2014 at 3:26PM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c8565946356000940864>>

https://resources.blogblog.com/img/blank.gif

//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqBGupjVMTb6VGCm-c8bR3wnHA8ZI1NrTeSJW3Up_TLNYsmWH9aCJbqskoPjOj3hvB09nVeP_pCEgr88yTaQHXBvVoz7afmxJBwc-lTHgyFqtsfv4Feg_26A2A5Wl9_Q/s45-c/portrait-2020a.png

Dave Pollard said…

Thanks Albert. This is somewhat along the lines of a chart I posted last year reviewing David Graeber's book, which is a bit more complex.
\\ I would say the right side of the chart should be "Active Resistance" not "Violent Revolution". In the lower right quadrant, that active resistance is holding actions, done to lessen but not with any hope of preventing collapse. With that clarification, I'd put James Hansen, Nicole Foss and Naomi Klein in the lower right, and shift Lovelock in the lower left. Those above the line are not Collapsniks but what I have called Salvationists.
\\ I'd sometimes put myself close to the lower right corner (when I'm angry) and sometimes in the lower left corner (when I'm more at peace with the inevitability of collapse). With time, 'gravity' will, I think, move everyone down in your chart until it only has one dimension left.

January 15, 2014 at 6:41PM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c5927522714581744274>>

[[//www.blogger.com/img/blogger_logo_round_35.png]]

Gard said…

I think Charles Eisenstein deserves a spot as amongst the peaceful collapsenik.

January 16, 2014 at 2:56PM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c875825926665637601>>

[[//www.blogger.com/img/blogger_logo_round_35.png]]

Unknown said…

I thought the world to be in an awful mess when I came to The Farm Community in 1973 feeling it was a spiritual activism to demonstrate community based on loving care for one another and I was not disappointed. I agree Charles Eisenstein deserves a place on the graph as I think he holds that view. We had no idea how bad it would get but I still think the solution is the same. However hard it is to convince the population that they need to create local economies to shield themselves from the economic collapse the accompanying ecological collapse will likely drive us all to that out of necessity. But central to it all I think will be a new spiritual/religious fervor to reunite with nature and get back in balance with our planet, to reconnect as a species, a desire that will emerge simultaneously world around, because our bodies of a trillion intelligent cells simply won't allow it all to go down. One could call that faith, I call it a simply a choice. I am still involved with the Green Party despite understanding that the current political system will never effectively respond to our needs. I can't help but to continue to push toward a new political economy.

January 16, 2014 at 5:54PM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c6602392862282748890>>

[[//www.blogger.com/img/blogger_logo_round_35.png]]

Unknown said…

Prosecution: Objection, your Honor. Counsel for the Defense is requesting he be allowed to tell a story—without any indication that the story is relevant to this post.
\\ Defense: Your Honor, with storytelling it is often better to let the story unfold without saying what is coming—that is helpful to realizing the dramatic effects of the story. However, I will give two indications that this story is relevant. First, there is a short song at the end of the story. It is titled “A Harvest Song”. It goes like this (sings softly, and plays a soft rhythm on one of the court railings):
\\ Long ago
We we're sown
Now we're here
Hear our song
\\ A question of relevance here is “What is our song?”
\\ A second indication that this story is relevant: the story is a creation myth, and as such it brings up the question “What are we?” I submit that our answers to the question “What are we?” are very much related to what kind of charts we make, and where we want to be on such charts.
\\ Judge: Objection overruled. Counsel may proceed with his story.
\\ Defense: The story is titled “The Spirit of the Sacred Hoop”. It is 9 pages long. For people who would rather read the story it is accessible at the “Collected Writings of Stefan Pasti” section of the Community Peacebuilding and Cultural Sustainability (CPCS) Initiative website (at www.cpcsc.info) (see Alt. Navigation Menu) (or http://bit.ly/1eGS4t4) (direct URL is too long). The story begins in this way:
\\ “Many years ago there was a sun that warmed up a sphere made of rocks, and created some water where only rocks had been before. As the warmth of the sun continued, some of this water evaporated and became air. The sphere of rocks then seemed to soften, and continued to change, as climate patterns developed, and daily and seasonal variations in the weather occurred. By this process what was once just a sphere made of rocks became….”

January 17, 2014 at 10:07AM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c4539121081881834432>>

[[//www.blogger.com/img/blogger_logo_round_35.png]]

Danny C said…

What's interesting about all these approaches, is that they are all in agreement that this show can't go on in it's destructive way without creating an accelerating "collapse". If this be the case, to hasten it without giving hope to some of us latecomers would be in itself an attack/punishment for not being here sooner. I would rather proceed to an alternate way which in itself retracts my involvement with the "system". That is a silent and peaceful way which will not alienate those who are fence sitters or who just are in the dark. The house is already burning…..there's no need to light an additional match to it.

January 17, 2014 at 2:24PM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c5031593421158730810>>

https://resources.blogblog.com/img/blank.gif

//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWwZCE-eTevxFnGLIuffakotA6ljIOj4oHS23LxVd6yRfm23e-h3VXQ9EsNICGrVwa0VH_OXaG7xr19Wu0mwWV6LYy09jHtvz0WDAM8xoJjVOcslC2I3Vy4bdwZlwTrw/s45-c/Alex+Studio+Smaller+DSC_0260++SQUARE.jpg

Alex Smith said…

What if I am a non-violent pessimistic collapsenik?
\\ That's what I am, but it doesn't fit on this chart?
\\ Alex Smith
host of Radio Ecoshock

January 20, 2014 at 12:44PM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c3048216510560404567>>

https://resources.blogblog.com/img/blank.gif

//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqBGupjVMTb6VGCm-c8bR3wnHA8ZI1NrTeSJW3Up_TLNYsmWH9aCJbqskoPjOj3hvB09nVeP_pCEgr88yTaQHXBvVoz7afmxJBwc-lTHgyFqtsfv4Feg_26A2A5Wl9_Q/s45-c/portrait-2020a.png

Dave Pollard said…

I am too, Alex. Thats why I created my chart. You may be what I call an 'existentialist'.

January 22, 2014 at 3:58PM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c463675549237759051>>

[[//www.blogger.com/img/blogger_logo_round_35.png]]

Hugtheworldbetter said…

I think Graeme Sait should be added to the map. He's the greatest speaker I've heard on getting carbon and life back into the soil. Graeme is working hard and trying to ignore the potential hopelessness of it all, in case we still have time.

January 23, 2014 at 9:23PM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c5883784927931448299>>

https://resources.blogblog.com/img/blank.gif

//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhymPNxGPERPaEdD396ptNZxxdZLpiu98W1ItWVKSFAuouOndDITd2HSO2KeRFUNYArCpNIEBaXvSvWrYJFsx5u5hJqZKTjGptxq7mxurCNb7u2MZ6WiDUa6FCYFRmCem4/s45-c/*

Andrea Muhrrteyn said…

You may wish to include the MILINT Earth Day crowd; if you wish.

January 31, 2014 at 7:32PM [[https://resources.blogblog.com/img/icon_delete13.gif]]

<<c404578561839141295>>

//resources.blogblog.com/img/blank.gif

Anonymous said…

I would say that, in all likelihood, some confluence of many, if not most, of these views and predictions is going to take place. It is difficult to make accurate predictions during a time like this, when technological development is tremendous and accelerating, while, at the same time, environmental disasters are becoming more and more frequent and severe, and the pace at which they occur is accelerating with the overall direction of climate change and ecological destruction; resource depletion threatens to overwhelm global food and water security (and thus energy, infrastructure, and resultant technological growth); and over-consumption, overpopulation, and economic inequality only serve to make matters worse.
\\ The problem, for me, is a lack of cohesion. I read many, many news reports on climate change, overpopulation, resource depletion, technological development, and future trends. The number of stories, and the opinions their writers (or associated scientists, researchers, and academics) espouse varies considerably. (I stay away from the "work" of deniers and lukewarmers, of course, but even among those who agree with the science there is a considerable difference in opinion.)
\\

  • RVS (E.S.)

June 12, 2015 at 10:53AM [[https://resources.blogblog.com/img/icon_delete13.gif]]

Post a Comment

Newer Post Older Post Home

Subscribe to: Post Comments (Atom)

TODO Friends

//1.bp.blogspot.com/_Yww18kST3h8/SeJAU3LRABI/AAAAAAAABhs/-hXLlBl9cRY/S1600-R/facebookfriends.jpg\\

TODO Dis-complainer

The Great Change is published whenever the spirit moves me. Writings on this site are purely the opinion of Albert Bates and are subject to a Creative Commons Attribution Non-Commercial Share-Alike 3.0 "unported" copyright. People are free to share (i.e, to copy, distribute and transmit this work) and to build upon and adapt this work under the following conditions of attribution, n on-commercial use, and share alike: Attribution (BY): You must attribute the work in the manner specified by the author or licensor (but not in any way that suggests that they endorse you or your use of the work). Non-Commercial (NC): You may not use this work for commercial purposes. Share Alike (SA): If you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one. Nothing in this license is intended to reduce, limit, or restrict any rights arising from fair use or other limitations on the exclusive rights of the copyright owner under copyright law or other applicable laws. Therefore, the content of
this publication may be quoted or cited as per fair use rights. Any of the conditions of this license can be waived if you get permission from the copyright holder (i.e., the Author). Where the work or any of its elements is in the public domain under applicable law, that status is in no way affected by the license. For the complete Creative Commons legal code affecting this publication, see here. Writings on this site do not constitute legal or financial advice, and do not reflect the views of any other firm, employer, or organization. Information on this site is not classified and is not otherwise subject to confidentiality or non-disclosure.

TODO Nuclear Power Must Make a Comeback for Climate's Sake - Scientific American   website

[Y-08-03 Thu 15:%]

TODO Article

James Hansen, former NASA climate scientist, and three other prominent climate scientists are calling for an enlarged focus on nuclear energy in the ongoing Paris climate negotiations.

"Nuclear, especially next-generation nuclear, has tremendous potential to be part of the solution to climate change," Hansen said during a panel discussion yesterday. "The dangers of fossil fuels are staring us in the face. So for us to say we won't use all the tools [such as nuclear energy] to solve the problem is crazy."

He was joined by Tom Wigley, a climate scientist at the University of Adelaide; Ken Caldeira, a climate scientist at the Carnegie Institution for Science; and Kerry Emanuel, a professor of atmospheric science at the Massachusetts Institute of Technology.

Their stance clashes with those of environmental groups such as Greenpeace that advocate against nuclear energy.

As nations have proposed emissions curbs in Paris up to 2030, scientists have computed that there is a 1-in-2 chance that their collective ambition would raise temperatures in 2100 by between 2.7 to 3.7 degrees Celsius. Nations would like to limit temperature rise to 2 degrees Celsius, and stabilize atmospheric carbon dioxide levels at 450 parts per million (ppm).

There is 400 ppm of CO2 in the atmosphere at present.

So scientists have now turned their attention to what would be needed after 2030 to meet a 2 C goal: an energy system transformation that emits less carbon. For this, all technology options need to be on the table, including nuclear, the scientists said.

At present, there is a worrisome groundswell of opinion that renewable energy is sufficient to hit that target, Wigley of the University of Adelaide said. He is the owner of a zero-asset company, South Australian Nuclear Energy Systems, that educates people on the technology but is not involved with the nuclear industry.

"We are alarmed by people who want to close the door on nuclear, and so that is why we are more outspoken than we might have been a few years ago," he said in a phone interview.

Very few nations, at present, mention nuclear in their greenhouse gas emissions reduction pledges, he said. Given the long time needed to build a nuclear power plant, nations should prioritize the technology immediately, he said.

The scientists stressed that even a 2 C target might not be effective. Hansen has previously emphasized that sea-level rise could threaten coastal areas even if that target is met.

Can new nukes be a cheaper alternative?
If nations meet their Paris pledges, called intended nationally determined contributions, or INDCs, and continue decarbonizing beyond 2030 at a rate of 5 percent, there is more than a 3-in-4 chance that a 4 C temperature rise could be avoided. That much warming could trigger irreversible tipping points in the Earth system and catastrophic climate change. The findings were published in Science.

The United States' INDC up to 2030 would require the nation to decarbonize at a rate of 6 percent. China will have to decarbonize at 4 percent.

The Paris pledges make it more probable than before that nations will meet 2 C, provided that the world decarbonizes rapidly after 2030, said Allen Fawcett, chief of U.S. EPA's Climate Economics Branch and lead author of the study. Nations are negotiating in Paris mechanisms to review their climate goals every five years and ratchet up their ambitions.

"Paris is a steppingstone to a better climate future," Fawcett said. "Each additional contribution and each additional increase in ambition that countries make under the Paris framework will help improve our chances of limiting future warming."

Beyond 2030, nations would need a portfolio of technology options to decarbonize, said Gokul Iyer, a researcher with the Pacific Northwest National Laboratory's (PNNL) Joint Global Change Research Institute and a co-author of the study.

"That is going to entail premature retirements of fossil fuel power plants, and also additional renewable, nuclear and carbon capture and sequestration power plants," Iyer said.

If the nuclear energy option is ignored, nations would have to pay a larger bill to achieve their goals, Fawcett said.

"The more technology is available and the more different opportunities you have for reducing emissions, the less costly those pathways [to 2 C] tend to be," he said.

Or can renewables go it alone?
Mark Jacobson, a professor of civil and environmental engineering at Stanford University, is optimistic that the world can meet the 2 C target and, in fact, stabilize emissions at 350 ppm instead of the 450 ppm that the United Nations aspires to, using solely renewable energy.

The technologies for this transformation wind, water and solar energy already exist, he said. They could entirely replace the world's fossil fuel-based energy system by 2050, if governments will it to be so, he said.

"The only obstacles are social and political," he said. "The only reason why it can't get implemented is because there are people against it."

In Jacobson's energy matrix, nuclear energy does not play a role. Nuclear plants need two decades to build, and the mining of uranium fuel is carbon-polluting, he said.

"It is a a whole distraction, and people should know better than to propose nuclear energy, because people who are working in this field know it is not going to go anywhere," he said.

Instead, Jacobson proposes that the world overcome its sociopolitical barriers and install 80 percent renewables by 2030 and 100 percent by 2050. During times when the wind does not blow or the sun does not shine, he proposes using hydropower to make up the gap.

He said the costs of the transformation would be worth the benefits: 22 million net jobs, the costs of global warming, avoiding unstable energy prices and energy security.

"We can have 100 percent reliable grid across the U.S. without nuclear, without natural gas, without biofuels, with only wind, water, solar, with low-cost storage," he said.

Quick, factory-built nuclear power plants?
Other scientists would like to see more research and development to bring down the costs of the energy transition. The Bill Gates-led Breakthrough Energy Coalition last week announced a $2 billion fund for clean energy research.

"Technological change is going to be a critical element in controlling costs of achieving these stringent targets," Iyer of PNNL said.

Wigley of the University of Adelaide sees improvements on the horizon for nuclear technologies, particularly in China, where modifications of Westinghouse technology could allow new plants to be set up in two to three years.

"There are technological innovations in the wings at the moment that will make it much quicker to build nuclear power stations," he said. "There are technologies that involve modular systems where the components for a large number of power stations can be built in a factory and taken to a site and assembled together."

Every attempt to increase national ambitions would help the world meet the 2 C target, Fawcett of EPA said.

"[It] will have a real and tangible benefits in terms of improving the odds of a better climate outcome, reducing the chance of extreme outcomes, improving our changes of limiting the warming to the lowest levels we can," he said.

Reprinted from Climatewire with permission from Environment & Energy Publishing, LLC. www.eenews.net, 202-628-6500

TODO LinkedIn
TODO Untitled
TODO On Silos
TODO Blog
TODO The Nile
TODO Blog
TODO CircleID
TODO CircleID
TODO x
TODO x
TODO CircleID
TODO Politics
TODO WIRED
TODO Feature
TODO HIGH TECH
TODO Ghosting
TODO Shareable
TODO The BLT
DONE Getting started with Readability for Android

CLOSED: [2023-02-16 Thu 16:46]

DONE You are being Tracked!!   computer hacking security

CLOSED: [2023-01-17 Tue 03:33]

By: Harmless Strategies <https://canadiantom.com/menu.htm>

Corporations and government are able to go inside your computer and violate your privacy anytime they want! The creator of the Windows operating system , has conveniently imbedded some interesting files inside each computer keeping track of all your movements. Here is a small excerpt from the tutorial on the BruteForce cd-rom

Want proof? Win95/98

Launch windows explorer. Under "Tools" click on "find" Now, look for these files on your hard drive; if you decide to view them, use a good editor like Ultra Edit to see what is inside. Normal editors like Notepad will not show you what is contained.

SYSTEM.INI

Contains details about the locations and software that you are running on your system, as well as other personal things that might be helpful for rogues to find out - like preferences and the like.

USER.DAT

This is an important file! Inside this monster there are masses of data about you: The last few dozen places you've visited on the Internet; Your name; email address, telephone number, various user ID's and passwords, details about software you use and your preferences, locations of files and folders, and literally hundreds of other personal things! Even the unencrypted names of the usenet groups you have been playing with lately…

Have a look at your own user.dat using an editor like ultraedit. This should freak you out. Most of the file is encrypted but you can make out enough references that are in plain text to give you a scare. You can get a free editor here ( www.completelyfreesoftware.com )

Details Make a local copy of it (from your c:\windows\profiles\Yourself) and browse it using an"editor". You'll be amazed at the wealth of information about yourself that this huge database holds… among other things all the search strings you have recently used! There is a lot of encrypted stuff here as well! The question you have to ask yourself is, "Why is this file there?" Don't alter it in anyway! Windows will not work right if you do. They do notwant you to change it!

SYSTEM.DAT

Even worse, Once again, lots of personal details, including the location of all your windows passwords (login, screen saver, network, LAN, etc.), every conceivable thing about your computer, its hardware and setup, and full details of all the software you're using or you have ever used. You'll have the surprise of finding all the names of applications you have installed in the last couple of years on your computer! Again, you will have to use "edit" to inspect these files yourself.

*.PWL (pwl) Located by knowing your user name, or by looking up the above file. Inside here are all your passwords. These are easily decrypted (if necessary)

nsform??.TMP All the data inside every Netscape form you've ever submitted, with and without Secure Socket Layers.

Inbox, Outbox, Sent, Trash A complete copy of all your incoming, outgoing, sent, and soon-to-be-deleted email. All in plain text without any encryption.

MsWord, Excel, Access, Power Point All these programs, as well as windows itself, cache the filenames of the most recent documents you have been working on. This leads any attacker directly to your recent work!

You are being Tracked .. Without looking inside the software, we would have no idea that many programs give critical access for filing and writing into the registry of our operating systems. This is buyer beware tactics on behalf of corporations (with government happily looking on, calculating the potential for their own misuse.) There are even more details on what

Microsoft is doing with your information whenever you allow the program called "RegWhiz" to collect information.

See essay "RegWiz"

In the world of reverse engineers, the operating system is slave to the owner. Not it's creator!

Here is an example of easy to learn reverse engineering using a Harmless Strategy

Do not buy software to do something you can easily do for yourself!

That is a simple rule of thumb. Why would you pay for software to eliminate cookies when you can follow the simple directions below or download one of many free software products to do the job for you? This is a fine example of the media's ability to promote a commercial product rather than a practical suggestion.

The best way to eliminate all cookie planting, is to create a directory "cookies.txt" inside Netscape's directory (where the file cookies.txt originally is). This directory will get priority over the targeted file, and all cookies will be sent to..wherever!

Hyperspace….. Once you have created this new cookies.txt directory, reset "Options"/ "Network""preferences""protocols"/"show an alert before accepting a cookie to NO, in fact, the sites that you visit will "believe" that they planted their cookies in your hard disk, and let you through without delay. Only you will know that no cookie was planted!

Wanna get into really scary things? Read this!

The registration wizard ::- (by Andrew Schulman, Senior Editor, O'Reilly & Associates)

The "Online Registration" feature of Microsoft's Windows 95 (Win95) (also in Win 98), also known as the "Registration Wizard" (RegWiz), has been the subject of much rumor and more or less idle speculation. Of special concern is RegWiz's ability to collect information on applications (both Microsoft and non-Microsoft) that a user has installed on their hard disk, and to send this information back to Microsoft via the Microsoft Network (MSN). As explained below, the internal name for this process is "Product Inventory": it is a feature of the PRODINV.DLL module included with Win95.

That Win95 can apparently tell what applications you have installed has generated numerous angry reactions online. For example, a posting in the comp.risks newsgroup claims that Win95 "transmits your entire directory structure in [the] background" to MSN. (MSN). Similar claims have appeared on Microsoft's forums on CompuServe, under headings such as "WIN95: Bye, ByePrivacy" and "Computer espionage by M$".

Ralph Nader's Consumer Project on Technology has even urged President Clinton "to prevent federal agencies from buying Windows 95 until the information gathering features of the 'Registration Wizard' are disabled or modified".

Microsoft has responded with a white-paper clarification (https://www.microsoft.com/windows/pr/regwiz.htm - Microsoft white paper clarification on Windows 95 Online Registration Wizard) which acknowledges that the Win95 Registration Wizard (RegWiz) collects the names of applications, but which also points out that the user must explicitly consent before this information is sent via modem to MSN, and that the information can be viewed in the file REGINFO.TXT. While the Microsoft clarification states that RegWiz "is simply an electronic version of the paper-based registration card," this appears not to be true. RegWiz's apparent ability to sniff out what applications you have is not matched by the printed registration card, which merely asks for general information on the sorts of software you use with your computer (Reference & Education, Games & Entertainment, Personal Finance/Organizer, etc.).

To see exactly what happens during Windows 95 "Online Registration," I used a utility called FILEMON (File Monitor), by Stan Mitchell (73227.1463@compuserve.com), "Monitoring Windows 95 File Activity in Ring 0," Windows/DOS Developer's Journal, July 1995, pp. 6-24. Mitchell is writing a book on the Windows 95 file system, to be published by O'Reilly & Associates in 1996. FILEMON lets you completely monitor all file-system activity under Windows 95 This makes it perfect for getting to the bottom of the the rumors that have been circulating about RegWiz. The bottom line is that RegWiz, far from conducting an indiscriminate search of a user's hard disk, instead searches for about 100 specific applications, both from Microsoft and from its competitors. RegWiz is launched by clicking the "Online Registration" button in WELCOME.EXE, which is a small program that provides the initial "Welcome to Windows 95" tips and options. Clicking "Online Registration" launches a program named \WINDOWS§YSTEM\REGWIZ.EXE (the full command line is "regwiz -i Software\Microsoft\Windows\CurrentVersion". REGWIZ.EXE in turn loads a dynamic-link library, \WINDOWS§YSTEM\PRODINV.DLL This is the "Product Inventory DLL," normally used for compliance checking of upgrades to Microsoft Office programs such as WinWord. (In fact, PRODINV.DLL's internal module name for "COMPLINC," for "compliance checking.")

Of course, when you buy the upgrade edition of something like WinWord, there needs to be a mechanism to check that in fact you really do have some previous word processor be it a previous version of WinWord, or a competitor's word processor, such as AmiProc or WordPerfect. So there's an encrypted database (the reasons for this encryption are discussed below) inside PRODINV of about 100 or so products, indicating that if a given EXE of a given size range is found within a given subdirectory, then you've got a given product, and are entitled to the reduced-price upgrade. Examining the file PRODINV.DLL turns up some intriguing-sounding strings, such as "Registry Search", "INI File Search", "Big Search", and "Hard Disk Search". The DLL exports a function called "RegProductSearch," which is called by REGWIZ.EXE. Examining the file REGWIZ.EXE turns up the names of the people who worked on it:

  • Software development: Tracy Ferrier
  • Program management: David Gonzalez, Peggy Angevine
  • Quality assurance: Sharmilli Ghosh
  • Special thanks to: Evelyn and Lauren

RegWiz will list up to twelve applications that a user owns; these are stored in the text file REGINFO.TXT and in the registry, and are uploaded via MSN. The product inventorysection of one REGINFO.TXT might look like this:

Product Inventory 1 = Microsoft Word for Windows Product Inventory 2 = Personal Oracle 7 Product Inventory 3 = Borland C++ for Windows Product Inventory 4 = Microsoft Visual C++ Product Inventory 5 = Putt Putt Product Inventory 6 = Treehouse Product Inventory 7 = Lotus Notes Product Inventory 8 = CompuServe Product Inventory 9 = Product Inventory 10 = Product Inventory 11 = Product Inventory 12 =

It's worth noting that the sample "Product Inventory" screen in Microsoft's white-paper clarification shows only Microsoft programs. But the upset generated by RegWiz has been due, of course, to its collection of information regarding non-Microsoft programs. The applications in which RegWiz takes an interest are as follows (the names come directly from the PRODINV product inventory): Applications Detected by Win95 Registration Wizard: (probably more in Win 98)

3-D Dinosaur Adventure Aldus Pagemaker for Windows Aldus Persuasion America On-line AmiPro for Windows Approach for Windows Bookshelf 94 for Windows Borland C++ for Windows Borland Dbase Borland Delphi Borland Paradox for DOS Borland Paradox for Windows CA - Visual Objects Charisma Charisma for Windows Clipper Complete Baseball for Windows Comptons Multimedia Encyclopedia CompuServe Corel Draw for Windows Crayola Art Studio Creative Writer Creative Writer - Ghost Mysteries DataEase DataEase for Windows dBase for Windows Director's Lab DOS Encarta Fine Artist Flight Simulator FoxPro for DOS FoxPro for Windows - Standard Freddi Fish Gupta SQL Windows Harvard Graphics Haunted House Internet In A Box Kid Pix DOS Kid Pix WIN Lion King Print Studio Lion King Story Book Lotus 123 for Windows Lotus Notes Lotus123 for DOS Mathblaster Episode 1 Mathblaster Episode 2 Microsoft Access Developers Toolkit Microsoft Access for Windows Microsoft Access Upsizing Tool Microsoft Encarta '95 Microsoft Excel for Windows Microsoft Money Microsoft Office for Windows Microsoft Powerpoint for Windows Microsoft Project for Windows Microsoft Publisher Microsoft Visual Basic Professional Microsoft Visual C++ Microsoft Visual FoxPro for Windows Microsoft Word for DOS Microsoft Word for Windows Microsoft Works for Windows Mind Your Money Money MSB - Human Body MSB - Solar My First Encyclopedia NCSA Mosaic for Windows Oregon Trail Oregon Trail 2 Personal Oracle 7 PGA Tour 486 Playroom PowerBuilder Enterprise 4 for NT PowerBuilder Enterprise 4 for Windows PowerPlus Print Shop Deluxe for Windows Prodigy Putt Putt Quattro Pro for DOS Quattro Pro for Windows Quick C for Windows Quicken for Windows Rabbit Ears - Leopard Reader Rabbit 1 Reader Rabbit 2 Relentless Scenes Spider Man Cartoon Maker SuperBase Treehouse Turbo Pascal for Windows Where in Space is Carmen San Diego Where in the USA is Carmen Where in the World is Carmen San Diego Wine Guide WordPerfect for DOS WordPerfect for DOS WordPerfect for Windows

While there are many Microsoft applications listed here, note that there are also many from other vendors. Some major commercial applications, such as Lotus Freelance Graphics, do not appear on the list, while many programs for children, such as Treehouse and Reader Rabbit, are included.

Given that RegWiz ships this information over the Microsoft Network (MSN), it's interesting to note that RegWiz is checking for the major online services that compete with MSN, such as America On-line, CompuServe, and Prodigy. Two Internet-related products, NCSA Mosaic for Windows and Internet in a Box, appear on the list, but Netscape does not. Most striking, of course, is the presence of many non-Microsoft productivity applications, such as AmiPro for Windows, Borland Dbase, Borland Paradox, Gupta SQL Windows, Lotus Notes, Lotus 123, Personal Oracle 7, Quattro Pro, and WordPerfect. Is all this a cause for concern? After all, as Microsoft points out, the user must explicitly allow RegWiz to upload this information to Microsoft. The user can choose not to run Online Registration at all. They can, without any harm to Win95, delete REGWIZ.EXE and even WELCOME.EXE.

But what is a Microsoft Office upgrade mechanism doing as part of the operating system's online registration? Why is the operating system being used to collect customer lists and/or statistical information on applications that compete with those from Microsoft? The Registration Wizard appears to be yet another case in which Microsoft has blurred distinction (whatever distinction remains) between its applications and operating-system divisions. Were I a Microsoft competitor whose product appeared in the encrypted PRODINV database, I wouldn't be particularly happy with Microsoft acquiring (for free) a good chunk of my customer list, via online registration for Windows 95, which is supposed to be a platform supporting my product.

So, it's not really an invasion of privacy issue, but is very possibly an anti-competitive problem: Microsoft is using its control over the operating system to gain information about applications that compete with its own applications. How does PRODINV determine that you have one or more of the products in its encrypted database? Running the FILEMON utility alongside RegWiz revealed that a large number of directory names were being checked. The output from FILEMON looks like this (… indicates that lines removed for brevity):

Extract from FILEMON Output 031 Open [c1065964] {c104ca54} C:\WIN95\WELCOME.EXE … 060 Open [c10658b4] {c104ca54} C:\WIN95§YSTEM\REGWIZ.EXE … 098 Open [c10646d0] {c104ca54} C:\WIN95§YSTEM\PRODINV.DLL … 175 e GetAttrib {c104ca54} C:\ACCESS 176 e GetAttrib {c104ca54} C:\MSOFFICE\ACCESS 177 e GetAttrib {c104ca54} C:\WORLDMPC 178 e GetAttrib {c104ca54} C:§PACE 179 e GetAttrib {c104ca54} C:\CAVO 180 e GetAttrib {c104ca54} C:\DBASEWIN\BIN 181 e GetAttrib {c104ca54} C:\DELPHI 182 e GetAttrib {c104ca54} C:\DELPHI\BIN 183 e GetAttrib {c104ca54} C:\DISNEY\LKASB 184 e GetAttrib {c104ca54} C:\LKSTUDIO 185 e GetAttrib {c104ca54} C:\MYMWIN2 186 e GetAttrib {c104ca54} C:\ORAWIN\BIN 187 e GetAttrib {c104ca54} C:\PB4 188 e GetAttrib {c104ca54} C:\PB4NT 189 e GetAttrib {c104ca54} C:\TLC\RR1 … 251 e GetAttrib {c104cc68} E:\AOL20 252 e GetAttrib {c104cc68} E:\WAOL 253 e GetAttrib {c104cc68} E:\BC4 254 e GetAttrib {c104cc68} E:\CSERVE 000 e GetAttrib {c104cc68} E:\AMIPRO 001 e GetAttrib {c104cc68} E:\PRODIGY 002 e GetAttrib {c104cc68} E:\ALDUS 003 e GetAttrib {c104cc68} E:\IBOX 004 e GetAttrib {c104cc68} E:\DBASE … 107 e GetAttrib {c104cc68} E:\KA\TREE 108 e GetAttrib {c104cc68} E:\TREEHSE

Simplifying the FILEMON output, here is a complete list of the directories for which RegWiz (actually, the ProdInv "product inventory" module) searches: Directories Scanned by Win95 Registration Wizard \123R4D \123R4W \ACCESS \ALDUS \AMIPRO \AOL20 \APPROACH \BASEBALL \BC4 \BS \CAVO \CHARISMA \CIE \CLIPPER5\BIN \CLIPPER5\LIB \CRAYOLA \CSERVE \DBASE \DBASEWIN\BIN \DEASE \DELPHI \DELPHI\BIN \DEWIN \DINO3D \DISNEY\LKASB \ENCARTA \EXCEL \FLTSIM5 \FOXPRO2 \FOXPROW \FPW26 \GUPTA \HG \HG3 \HGW \IBOX \KA§PIDERCM \KA\TREE \KIDPIX \LKSTUDIO \LOSTCITY \MBWINCD \MECC\OTII \MOSAIC \MSKIDS \MSKIDS\LEAOPARD \MSMONEY \MSOFFICE \MSOFFICE\ACCESS \MSOFFICE§ETUP \MSPUB \MSTOOLS \MSTOOLS\C\DLAB \MSVC20\BIN \MSWINE \MSWORKS \MYMWIN2 \NOTES \OFFICE\WPWIN \ORAWIN\BIN \OTWIN \PB4 \PB4NT \PDOX45 \PDOXWIN \PERSUASI \PGA486 \PLAYWRLD \POWERPNT \PRODIGY \PROJ \PSDWIN \PUTTPUTT \PWPLUS \QCWIN \QPRO \QPW \QUICKENW \RELENT §B4W §CENES §PACE \TLCWIN\RR2WIN \TLC\RR1 \TPW \TREEHSE \VB \VFP \WAOL \WINDOWS \WINDOWS\CHARISMA \WINDOWS\CORELDRW \WINPROJ \WINWORD \WINWORD\C\DLAB \WORD \WORKS \WORLDMPC \WP \WP50 \WP51 \WP60 \WPWIN \WPWIN60

If these directories actually existed, it makes sense that RegWiz would start looking for specific files within these directories. So the next step was to write a batch file which created all these directories, and then rerun RegWiz alongside FILEMON. Now FILEMON revealed RegWiz searching for specific files within directories. For example:

Extract from FILEMON Output (2) 085 e FndOpen {c104cc68} E:\AOL20\WAOL.EXE 086 GetAttrib {c104cc68} E:\WAOL 087 e FndOpen {c104cc68} E:\WAOL\WAOL.EXE 088 GetAttrib {c104cc68} E:\BC4 089 e FndOpen {c104cc68} E:\BC4\BCW.EXE 090 GetAttrib {c104cc68} E:\CSERVE 091 e FndOpen {c104cc68} E:\CSERVE\WINCIM.EXE 092 GetAttrib {c104cc68} E:\AMIPRO 093 e FndOpen {c104cc68} E:\AMIPRO\AMIPRO.EXE 094 GetAttrib {c104cc68} E:\PRODIGY 095 e FndOpen {c104cc68} E:\PRODIGY\PRODIGY.EXE 096 GetAttrib {c104cc68} E:\ALDUS 097 e FndOpen {c104cc68} E:\ALDUS\ALDSETUP.EXE 098 GetAttrib {c104cc68} E:\IBOX 099 e FndOpen {c104cc68} E:\IBOX\AIRMOS.EXE 100 GetAttrib {c104cc68} E:\DBASE 101 e FndOpen {c104cc68} E:\DBASE\DBASE.EXE …

Extracting filenames from the FILEMON output and sorting them, yielded the following list of filenames in which RegWiz (again, actually the Win95 PRODINV.DLL "product inventory" module) takes a direct interest:

Files Scanned by Win95 Registration Wizard \123R4D\123.EXE \123R4W\123W.EXE \ACCESS§CWIZ.DLL \ACCESS§ETUPWIZ.MDB \ACCESS§WU2016.DLL \ACCESS\WZCS.MDA \ALDUS\ALDSETUP.EXE \ALDUS\PR2.EXE \AMIPRO\AMIPRO.EXE \AOL20\WAOL.EXE \APPROACH\APPROACH.EXE \BASEBALL\BASEBALL.EXE \BC4\BCW.EXE \BS\BS94.EXE \CAVO\CAVO.EXE \CHARISMA\CHARISMA.BIN \CHARISMA\CHARISMA.EXE \CIE\CIE.EXE \CLIPPER5\BIN\CLIPPER.EXE \CLIPPER5\LIB\CLIPPER.LIB \CRAYOLA§TUDIO.EXE \CSERVE\WINCIM.EXE \DBASEWIN\BIN\DBASEWIN.EXE \DBASE\DBASE.EXE \DBASE\DBASEIV.ICO \DEASE\DE16M.EXE \DEASE\DEASE.EXE \DELPHI\BIN\DELPHI.EXE \DELPHI\DELPHI.EXE \DEWIN\DEWIN.EXE \DINO3D\KAWIN.EXE \DISNEY\LKASB\LIONKING.EXE \ENCARTA\ENCART95 \EXCEL\EXCEL.EXE \FLTSIM5\FS5.COM \FOXPRO2\FOXPRO.EXE \FOXPRO2\FOXPROX.EXE \FOXPROW\FOXPROW.EXE \FPW26\FOXPROW.EXE \GUPTA\C\DLAB \GUPTA§QLWIN50.EXE \HG3\HG3.EXE \HGW\HG20.EXE \HGW\HGW.EXE \HGW\HGW1.DLL \HGW\HGW2.DLL \HGW\HGW20.EXE \HGW\HGW2EXP.DLL \HGW\HGW3.DLL \HGW\HGW4.DLL \HGW\HGWPLAY.EXE \HG\HG.EXE \IBOX\AIRMOS.EXE \KA§PIDERCM§PIDERCM.EXE \KA\TREE\TREE.EXE \KIDPIX\KIDPIX.EXE \KIDPIX\KPWIN.EXE \LKSTUDIO\LIONKING.EXE \LOSTCITY\LOSTCITY.EXE \MAIN123W.EXE \MBWINCD\MB4.INI \MECC\OTII\OTIILB.EXE \MOSAIC\MOSAIC.EXE \MSKIDS\ARTIST.EXE \MSKIDS\GWICON.IC \MSKIDS\HHOUSE.ICO \MSKIDS\LEAOPARD\LEOPARD.EXE \MSKIDS\MSBHUMAN.EXE \MSKIDS\MSBSOLAR.EXE \MSKIDS\WRITER.EXE \MSMONEY\MSMONEY.EXE \MSOFFICE\ACCESS§CWIZ.DLL \MSOFFICE\ACCESS§ETUPWIZ.MDB \MSOFFICE\ACCESS§WU2016.DLL \MSOFFICE\ACCESS\WZCS.MDA \MSOFFICE\MSOFFICE.EXE \MSOFFICE§ETUP\OFF40_BB.DL_ \MSOFFICE§ETUP\OFF42_BB.DL_ \MSOFFICE\WINWORD\WINWORD.EXE \MSPUB\MSPUB.EXE \MSTOOLS\WORD.COM \MSVC20\BIN\MSVC.EXE \MSWINE\WINEGDE.EXE \MSWORKS\MSWORKS.EXE \MYMWIN2\MYMWIN.EXE \OFFICE\WPWIN\WPWIN.EXE \OFFICE\WPWIN\WPWIN61.EXE \ORAWIN\BIN\ORAINST.EXE \OTWIN\OREGON.EXE \PB4NT\PB040.EXE \PB4\PB040.EXE \PDOX45\PARADOX.AUX \PDOXWIN\PDOXWIN.EXE \PERSUASI\(C)ALDUS.'92 \PERSUASI\PR2.EXE \PGA486\PGA486.COM \PLAYWRLD\PLAYROOM.EXE \POWERPNT\POWERPNT.DLL \POWERPNT\POWERPNT.EXE \PRODIGY\PRODIGY.EXE \PSDWIN\PSDWIN.EXE \PUTTPUTT\PUTTPUTT.INI \PWPLUS\PWPLUS.EXE \QCWIN\QCWIN.EXE \QPRO\Q.EXE \RELENT\RELENT.EXE §B4W§B4W.EXE §CENES§CENES.EXE §PACE\CARMEN.EXE \TLCWIN\RR2WIN\RR2WIN.EXE \TLC\RR1\RR1.EXE \TPW\TPW.EXE \TREEHSE\TREEHSE.EXE \VB\VB.EXE \VFP\VFP.EXE \WAOL\WAOL.EXE \WIN95\LOTUS.INI \WINDOWS\CHARISMA\CHARISMA.EXE \WINDOWS\CORELDRW\CORELDRW.EXE \WINDOWS\HEGAMES.INI \WINWORD\WORD.COM \WORD.EXE \WORD\WORD.EXE \WORKS\WORKS.EXE \WORLDMPC\CARMEN.EXE \WP50\WP.EXE \WP51\WP.EXE \WP60\WP.EXE \WPWIN60\WPWIN.EXE \WPWIN\WPWIN.EXE \WP\WP.EXE

This list should lay to rest the idea that RegWiz scans your entire hard disk. On the contrary, it has specific things it is looking for. Indeed, the list is so specific that one might ask what happens when a user installs product in a directory other than the vendors' recommended directory: how then would RegWiz find it? We'll get to that later. For now, the important thing is that RegWiz (via PRODINV) does not do an indiscriminate search of your hard disk, but has specific targets in mind.

The next obvious step was to try to create some of these files, and see if RegWiz decided that I now had a given product. However, creating dummy (0-byte) files with the correct names, or files with arbitrarily-chosen contents but with the correct names, did not induce RegWiz to believe the corresponding product was installed. Evidently, RegWiz needed something other than directory and file names: perhaps afile checksum, size, date, or a particular pattern of bytes within the file.

To find how RegWiz (ProdInv, actually) was deciding that a user had a product, I needed to find where it kept information associating directory/file names with product names. However, a full search of my hard disk turned up no occurrences of strings such as "TREEHSE" or "TREEHSE.EXE" or "CARMEN.EXE", aside from the ones that showed up in the FILEMON logs. Evidently, then, the actual "product inventory" is kept on disk in compressed and/or encrypted form, and is de-encrypted in memory only when PRODINV is loaded.

The next step was to run RegWiz under the Soft-ICE Windows debugger (https://www.numega.com/WWW/numega/newsidx.html - NuMega Technologies), and stop the program when it is calling the operating-system functions that search for directories and files. The key such function is FindFirstFileA, provided by KERNEL32.DLL. I set a debugger "breakpoint" on this function, ran RegWiz, and clicked "Online Registration."

Sure enough, I could see passing in the names of the directories and files that showed up in the FILEMON output. I was then able to "walk back" to the place from where FindFirstFileA was being called: it turned out, not surprisingly, to be inside PRODINV.DLL. From there, I had to step back again to see from where these names were coming. I finally located a buffer in memory that looked like this:

Debugger Hex Dump of PRODINV Product Inventory Break Due to BPMB #013F:009AFA0C W DR3 C=01 :d eax 013F:004436C5 77 6F 72 64 2E 63 6F 6D-2C 5C 77 69 6E 77 6F 72 word.com,\winwor 013F:004436D5 64 2C 31 35 30 30 2C 39-30 30 30 30 2C 33 30 3A d,1500,90000,30: 013F:004436E5 4D 69 63 72 6F 73 6F 66-74 20 57 6F 72 64 20 66 Microsoft Word f 013F:004436F5 6F 72 20 44 4F 53 09 0A-77 6F 72 64 2E 63 6F 6D or DOS..word.com 013F:00443705 2C 5C 77 69 6E 77 6F 72-64 2C 31 35 30 30 2C 39 ,\winword,1500,9 013F:00443715 30 30 30 30 2C 33 30 3A-4D 69 63 72 6F 73 6F 66 0000,30:Microsof 013F:00443725 74 20 57 6F 72 64 20 66-6F 72 20 44 4F 53 09 0A t Word for DOS..

At this point, it was trivial to locate the beginning and end of the buffer, and write it to disk. (Recall that the database is stored on disk in encrypted form; this is why a search of the entire hard disk did not find it.) Here are some selected portions of the PRODINV product inventory:

PRODINV Product Inventory: Extracts winword6.ini,Microsoft Word,programdir,1 winword.exe,3000000,4000000,2:Microsoft Word for Windows win.ini,embedding,Word.Document.6,3,,3000000,4000000,2:Micro oft Word for Windows win.ini,Microsoft Word 2.0,programdir,1, winword.exe,1000000,2000000,2:Microsoft Word for Windows win.ini,embedding,WPWin6.0,3,,10000,25000,3:WordPerfect for Windows lotus.ini,Lotus Applications,amipro,1,amipro.exe,1000000,1500000,20:AmiPro for Windows win.ini,AmiPro,dictionary,1,amipro.exe,1000000,1200000,20:AmiPro for Windows win.ini,extensions,nsf,1,notes.exe,,,43:Lotus Notes … waol.exe,\aol20,12000,15000,54:America On-line waol.exe,\waol,12000,15000,54:America On-line bcw.exe,\bc4,850000,920000,45:Borland C++ for Windows wincim.exe,\cserve,850000,890000,56:CompuServe amipro.exe,\amipro,700000,2000000,20:AmiPro for Windows prodigy.exe,∏igy,550000,560000,57:Prodigy aldsetup.exe,\aldus,280000,290000,46:Aldus Pagemaker for Windows airmos.exe,\ibox,600000,650000,75:Internet In A Box dbase.exe,\dbase,0,500000,21:Borland Dbase dbaseiv.ico,\dbase,0,2000,21:Borland Dbase …

The first set of entries reference .INI (initialization) files, which in turn reference file and/or directory names. For example, "win.ini,embedding,WPWin6.0,3,,10000,25000,3:WordPerfect for Windows" means to look for a WPWin6.0= entry in the [embedding] section in WIN.INI, and to treat the third comma-delimited field as a full directory/filename. If that file is between 10,000 and 25,000 bytes, RegWiz decides you have WordPerfect for Windows. Thus, the following WIN.INI entry:

[embedding] WPWin6.0=foo,foo,C:\FOO\FOOBISH.EXE,foo along with a file named C:\FOO\FOOBISH.EXE, whose size is between 10-25,000 bytes, will trigger RegWiz to display "WordPerfect for Windows" as one of the products on the user's machine. The use of .INI allows RegWiz to detect some applications installed in non-standard directories.

However, the bulk of the product inventory directly references directory and file names, without an intermediary .INI file. For example, the last two entry shown above indicate that, if a user has \DBASE\DBASE.EXE (size anywhere from 0 to 500,000 bytes) OR if they have \DBASE\DBASEIV.ICO (size anywhere from 0 to 2,000 bytes), then they have product #21, "Borland Dbase." So why is the PRODINV "product inventory" encrypted? I suspect because it was originally written for Microsoft Office (a nearly-identical module named WRD95INV.DLL comes with WinWord, for example). Because it would be trivial to fool this "wizard" (hmm…) simply by creating an appropriately-sized file with the appropriate name in the appropriate subdirectory, the database is encrypted.

This makes perfect sense for application upgrades. But does it make sense for the operating system's online registration?

Microsoft's white-paper clarifications says: "Registration enables Microsoft to send information about Microsoft programs that are tailored for users needs and interests." (yeah, right) While there is nothing wrong in Microsoft seeking to interest WordPerfect or AmiPro users in Microsoft Word, surely they could find a more appropriate venue in which to do so than the online registration of Windows itself, which is supposed to support ALL applications, not just those from Microsoft.

Be Scared…Be very scared….now the new york times tells us about realnetworks doing it to all of us who listen to MP3's check this page out! <https://canadiantom.com/realplayer.htm>

<https://canadiantom.com/realplayer.htm> tom-

This article has been used with the permission of Harmless Strategies <https://canadiantom.com/menu.htm>

TODO Dymaxion: Secure Application Development for NGOs and Others: Part II   website

[Y-08-03 Thu 15:%]

TODO Article
TODO Secure Application Development for NGOs and Others: Part II

[[//dymaxion.org/graphics/cuboctahedron-normal-transparent-200x200.png]]

TODO Dymaxion.org

This is a Patreon-supported essay. Drafts of all of these essays go out a week early to my $10 and up subscribers. Building secure applications is hard, and for organizations that have never done it before, it's often unclear where to even start. Worse, organizations that have some development experience often underestimate the work required to ship secure code. My goal with this essay is to make the landscape more legible and give NGOs and other organizations an idea of where to start. This is a part two of a four part essay; part one is here, part three is here, and part four is here.

[[//dymaxion.org/graphics/patreon-badge.png]]I have a Patreon, here, where you can subscribe to support my security and systems-focused writing. You sign up for a fixed amount per essay (with an optional monthly cap), and you'll be notified every time I publish something new. At higher support levels, you'll get early access, a chance to get in-depth answers to your questions, and even for more general consulting time.

Dymaxion.org is me. Along with writing, I consult, give talks, make art, take photographs, and work on a number of public projects. You can hire me to do all of these things.

©2023 Eleanor Saitta.

[[//dymaxion.org/graphics/feed-icon-14x14.png Feed for essays and talks]]

TODO Introduction to Part II

This is part two of my guide to secure software development for NGOs and other organizations. You can find part one here and parts three and four here and here. In the previous section, we looked at the lifecycle of software, the organization creating it, and the design process and how it impacts security. In this section, we'll look at everything that comes between design and actually writing code.

TODO Threat Modeling and Security Objectives

Once you understand the requirements the system is intended to implement, it's time to start building your threat model. A threat model is a formal, human-readable model of all of the security-relevant, in-scope parts of the system.

Threat models come in two partsthe requirements model and the architecture model. In the requirements model, you want to understand everything that can go wrong in the system at the level of user tasks and goals, how bad those negative outcomes are, relatively speaking, and what the system's response should be if an adversary tries to make one of those negative outcomes happen. The requirements model also enumerates all of the roles in the system, the assets (the things you're trying to operate on or protect), and who's allowed to do what to what. The requirements threat model draws on and complements requirements documentation, especially the security requirements and identified security properties. The threat model formally shows what those security properties mean within the rest of the requirements and the architecture.

The goal of the requirements-level threat model is to create a set of security objectives. The security objectives concisely encapsulate the security-relevant responses of the system to adversaries and will shape mitigations selected during architectural design.

If you did your work correctly while developing the requirements, the threat model should go quickly. You shouldn't wait to finish the requirements to start threat modeling, however, even if you aren't doing agile development. The requirements and the threat model should be developed together iteratively. If you are doing agile development, the threat model must be a living document and threat model updates should be a part of every user story. In all cases, the threat model should be a key element for communicating security goals across the development team.

A world on formalitywhen I say formal in a threat model, I mean something where you can understand procedurally if your threat model is complete and internally consistent. This isn't the same as “formal verification”, which attempts to create mathematical proofs of correctness from source code. Threat models are just models, and there's some intentional fuzz between the model and the implementation. The goal of a threat model is to represent architecture and security intentions in detail so they can be analyzed and compared against the implementation, not to directly operate on the implementation. Among other things this means we can build threat models in a reasonable amount of time, something rarely true of proofs. That layer of fuzz means we can spend more time thinking about the complexities of human intent, which is the hard part of analyzing requirements and architecture for security.

TODO Architectural Design

Architecture is where the hand-off from the design team to the development team starts. Of course, the idea that either design or architecture can occur in isolation from each other is a myth. The design team needs to know what architecture and development can support or enable. The more novel the system, the more interaction there will need to be between design and architecture.

During architectural design the system is decomposed into a set of components that interact to satisfy the requirements. In agile development, the basic structure of the core architecture will still probably be determined up front, even if low-level components are swapped out as development progresses. In general, architectures mirror team structure. Open source applications developed by distributed teams will often look more like loosely-coupled sets of libraries, and applications created by unified development teams working together in person are more likely to be single unified systems. Neither model will necessarily result in a better or more secure outcome. A good fit between team and architecture can lead to a smoother development process.

The architectural design process is where security properties specified in the design phase must be turned into first system-wide technical design problems and then, as these are solved, into concrete implementation specifications. The kind of system you're building determines how much detail is needed in architectural documentation. That said, more thorough and readable documentation will help bring new programmers onto the team more quickly and make security testing easier, provided it's kept up to date as the system evolves. Good architecture documentation helps programmers write code with fewer bugs. At the very least, all security concerns and all places where system rules need to be enforced must be documented.

TODO Protocols and Parsers

All systems involve parsing some kind of input, whether that's a binary image format like a JPEG, input a user types on a keyboard, or JSON data received over the Internet. All systems involving operations over a network (and even many that don't) have to worry about protocols, whether they're speaking HTTPS on the web or sending data to another device over a USB port. The protocols you choose constrain the security properties your system can provide. Be certain you understand what the security properties of the protocols you use are and what the requirements for maintaining those properties are, both for developers and users. Developing new protocols is hard and time-consuming work. If you don't need to do it, don't.

Parsers, the code that recognizes input data and manages the state of protocols, are the single biggest source of low-level vulnerabilities in systems. Every input format you use and every protocol your application speaks needs to have a formal specification, and every parser you use should be programmatically generated from such a specification. If you get this right up front you'll make your life much easier later. There are libraries that can handle the parser generation for you, but during the architecture stage, you need to write or adopt specifications for your protocols. It can be tempting to skip this step, especially if you're planning on just using third-party libraries that already implement protocols for you. While in general you should never implement a protocol yourself if a good, tested implementation exists that meets your needs, all else being equal, favor implementations that use generated, known-complete and correct parsers over those that use hand-written parsers. If you want to know more about parsers and security problems, talk to @maradydd and the folks at langsec.org.

TODO Cryptography

Your system almost certainly does not require any novel cryptographic primitives. If it does, you have likely misunderstood the problem. If you are doing anything more complex than using off-the-shelf cryptographic libraries in well-documented ways, you definitely need expert help. In some specific scenarios, there may be a need to combine existing cryptographic primitives in less-common ways. If so, the section "Selecting Cryptographers" below is for you. Under no circumstances should your team ever attempt to implement cryptographic primitives themselves. Doing so guarantees you will screw up, probably tragically, and cause significant harm if your application sees wide adoption.

When selecting which primitives and key sizes to use, it's important to do the research into what's currently recommended as these things do change somewhat regularly. The list of things that you need to think about also varies depending on which primitives you're using. While you always need to know, for instance, that you're using a cryptography-appropriate random number generator, you only need to remember to sign first and encrypt second if you aren't using an authenticated encryption scheme that solves this for you. Especially for cryptography, favor systems that require you to keep track of fewer security-critical properties.

In general, whatever @hashbreaker and @matthew_d_green can agree on is what you should use. If they disgree, @mattblaze can be a tiebreaker. If you're building centralized systems that don't use end to end encryption (where clients control the keys themselves), you should probably just use TLS and make sure that you get an A grade from SSLLabs.com. If you're doing anything else, you want libraries that have already done most of the thinking for yousomething like the NaCL library already has most of the choices you might otherwise struggle with baked in with sensible defaults. The less cryptographic code you write yourself, the fewer chances you have to screw up, assuming the library you use is well-tested and vetted. That last part is a big caveat. OpenSSL, while standard across the industry, has still had many serious bugs recently because it wasn't as well-tested as we thought. Worse, it gives you a lot of ways to shoot yourself in the foot. All else being equal, smaller, simpler libraries are often more useful, especially if they protect you from low-level details.

The cryptographic systems and protocols that you adopt heavily influence the security properties of your system. You need to be thinking about cryptography and protocols in general terms starting from at least the security design phase of development. Changing protocols or swapping a primitive out for something that's not directly equivalent can, from a security perspective, be as large a change as completely re-architecting your system on the back-end.

TODO Selecting Cryptographers

As Matt Green and Dan Bernstein are often busy, if you need to do any low-level cryptographic implementation or review you'll probably need to go with someone else. The best way to figure out who to hire is probably to delegate the decision to a reputable security auditing firm, preferably one who does nothing other than security. Like evaluating cryptographic primitives, evaluating cryptographers is hard for folks who don't spend all their time paying attention to who's doing what kind of work.

If you do have to do this selection directly, look for folks with solid track records as both publishing academics and system implementers. Any working cryptographer who isn't inside an intelligence service will be publishing in academic journals. However, many purely academic cryptographers don't have the implementation experience required to write correct, production-grade primitive implementations or to evaluate the use of a primitive in context. Cryptography is a very small field; if you're not sure about the person you're thinking of hiring, ask for references and ask around.

TODO More Threat Modeling

As you begin the architecture design process, you'll also be beginning the next phase of threat modeling, the architecture model. In this level of the threat model we enumerate all of the components of the system in sufficient granularity to capture all of the trust boundaries in the system and map their connections. Next, we look at all the actions the system is intended to support at the requirements level and see how those actions flow through the system. We also model all of the supporting actions required to implement those requirements-level events, like login flows. With this model, we then look at how each step of each action could fail and whether that failure could compromise any of the security objectives of the system or any of the security properties it attempts to maintain. If flaws are found, mitigations are added and documented or the architecture is adjusted.

This detailed architectural threat model has a number of benefits. First, it ensures the architecture of the system is documented (a common failure mode). It also ensures that the location of enforcement for every rule in the system (such as access control or resource limitation) is documented, understood, and agreed upon. A proper threat model demonstrates concretely that, if implemented correctly, the system as-architected can meet its security objectives.

With agile processes an architectural model is still constructed and fully fleshed out for the initial architectural concept before any code is written. In many cases, the start of development will, in addition to the selection of frameworks, include a lump of development work to get the system to a point where it has enough of a coherent whole that further features can be seen as discrete additions. While this initial work may be understood as a set of sprints or user stories, it's also often planned as a unit. It's this unit that should undergo architectural threat modeling. Once the initial model is constructed, each additional user story or feature addition can then be seen as a corresponding addition to the threat model.

Once the (initial) architectural threat model is complete, development can move forward, as the team can now understand the security requirements for each module in the system.

TODO Selecting a Development Team

If you're not in a position to build a development team in-house with the experience required to deliver secure applications, you'll need to bring in an external team. Many organizations may be familiar with working with development teams in general, but less familiar with the specific demands of higher-security applications. Development, like design, has different specializations, but the security specializations for development are more common. Who you need and the size of the team will be driven by the scope of the application and its complexity. When hiring a development team, while the usual markers around budget and delivery ability matter, you're looking for a few specific things when it comes to security.

Any external team you bring in should be able to explain things like how they'll handle threat modeling, security architecture development, security standards and frameworks selection, and testing. Any team that doesn't have solid answers to questions like these should not be considered. Having them talk you through the kinds of security vulnerabilities they'd expect to see in a system like yours and how they'd mitigate those vulnerabilities may be useful. It's also worth asking for samples of previous work and indications of the kinds of security concerns they've dealt with in that work. If they're able to share them, asking to see audit reports from reputable security auditors for previous work may prove useful.

Applications aimed to help high-risk and specifically-targeted users have different security considerations than your run-of-the-mill enterprise IT tool or consumer application. What might be a small privacy concern elsewhere can be a complete showstopper. Development organizations that have not previously built applications for high-risk users should not be selected, nor, as a rule, should advertising or media agencies with no experience in the field.

At the end of the day, it's difficult to package up the kind of evaluation framework used to judge if a development team will be capable of producing highly-secure applications above and beyond their prior work without also passing on the knowledge needed to review code and application architectures for security. If you're in the position of needing to evaluate whether a development team is likely to be able to deliver sufficiently secure applications, I'm happy to come in as a consultant to help. If you have a security consultant who specializes in application security who you've worked with before, they should also be able to help.

TODO Frameworks

No one writes code from scratch. During the architectural design process, one or more frameworks or library sets will almost certainly be selected. The development frameworks you select, like the protocol and encryption choices you make, will determine both the features available to speed development and the kinds of vulnerabilities you're exposed to. For instance, in web applications there may be cross-site scripting (XSS) bugs where a user can submit JavaScript code to be rendered in the context of another user's session on a site. If an attacker triggers an XSS bug, they can then take control of all of their victim's interactions with the site. This is a framework issue (and in this case, one closely related to the parser issues described above). Properly built frameworks make issues like this impossible if used correctly.

Selecting secure frameworks is complicated, for the same reason that selecting secure protocols is. Few frameworks have chosen to start development from the perspective of trying to provably eliminate categories of low-level bugs. Many other things also inflect the choice of frameworks, including compatibility with other parts of the system, whether they're actively maintained, developer productivity, interactions with other libraries or frameworks, and how familiar a team is with them. Unlike protocols, you may be using a number of different frameworks together in the same context. The interactions between frameworks can create new security vulnerabilities neither framework has alone.

Choosing to use a framework that does not eliminate all classes of low-level bug to which it's vulnerable add security requirements to your development process. If you know your frameworks can leave you exposed, you have to build the fix yourself, either in code or in standards and processes. It is an absolute requirement of writing secure code to fully understand all the classes of problems that your choices of platform, language, and frameworks make you potentially vulnerable to and to ensure you have a strategy for dealing with each of them.

Ideally, you'll fix each issue class generically at the code level by writing library that you use the framework through, removing the possibility of the problem. If you do this and do it correctly (you'll need to both test this code carefully and have outside experts review it), then all you need to do is make sure is your library is used correctly everywhere it needs to be and that no one uses the framework directly. This isn't as good as having the fix integrated into the framework, but at least it means there's one simple thing to remember to do instead of a bunch of potentially complex things. However, writing code like this can be hard and time-consuming and there are times when teams must make tradeoffs. If you can't make it easy for your developers, you'll have to manage the risk via coding standards.

TODO Standards

Every team and every individual developer has coding standards. The standards may or may not be written down, and if the team doesn't have consistent habits, they may not follow their own standards, but they're there. For teams working together, it's important to align standards for how things are done for many reasons, including team members being able to read each other's code quickly and reliably. When trying to write secure code, standards become even more important, both for initial development and for correctly understanding the security implications of parts of the system during maintenance and refactoring.

While the set of standards required for a development team will vary by the problem space, language, frameworks, methodologies, and processes used, some security considerations remain the same. It's important to have and document a standard for how you're handling every class of security issue that your environment and frameworks leave unhandled. That means that not only should you have general documentation for the solution, but there should be a standard way that instances of the solution are called out in comments. This is especially important for more complex solutions so reviewers and others can identify what's going on and check for correctness. Similarly, all per-module requirements (see part three) that your threat model and similar artifacts help you generate should be documented.

Standards act as reminders as well as agreements. If, for instance, you have a piece of code that needs to be called on every page of a site to check for access control and for some reason you can't automate this at the framework level, this should be called out in the project standards. Standards don't have to be heavyweightthey can be as simple as a checklist with a half-dozen items to remember for each new module if that's all you need.

Subtle security issues can also happen from things like unclear or inconsistent variable naming resulting in bugs where the wrong values are used in the wrong places. Standards can't fix this completely, of course, but they can both help and make these issues easier to catch. How thorough your standards and policies for development need to be will depend on the size of your team. Faster-paced development and larger teams require more emphasis on standards to keep the process manageable.

TODO Third-Party Libraries

When you select a framework or a set of libraries to use in your system, you're adding dependencies between your system and that external codebase. Not only that, but the libraries you use probably have dependencies on other libraries, too, and in some cases they may have just copied an old version of that library's code into their source tree so you won't be able to tell easily. It's critical that you have a list of all the third-party code in your system, both what you're using directly and what's included indirectly, and that you know the security state of all of it. If there are open vulnerabilities in any of this code you need to make sure you've fully mitigated them, and you need to make sure you patch when patches are available. If code you use depends on old versions of libraries with known bugs, you need to replace those dependencies or find another solution. In general, you want to be using the newest sufficiently-stable versions of your dependencies, even if there aren't known vulnerabilities. There may be security-relevant features (like upgrades to SSL handling) that are missing in older versions.

Most libraries should have at least a bug tracker and hopefully also an announcement listideally one that's focused just on security. You need to have someone reading those lists and watching those bug trackers for as long as you're maintaining and using the system you build. At any moment a vulnerability could be announced in one of your dependencies that puts your users at risk, and you need to be ready to patch or mitigate in a timely manner. We'll see more on this in part four in “Incident Response” and “Long-Term Maintenance”.

It's worth knowing if your third-party dependencies have been audited. If they have, you should ask to see the audit reports and look at the kind of bugs that have been found and what the response was. If a number of bugs of one type have been found and no concerted effort has been made by the library's development team to eliminate others like them, there may be more. If you're going to get your system audited, you'll need to choose how much third-party code is included in that audit. Knowing which libraries have already been looked at can help with that decision. If you do audit third-party code, make sure you and your security team know how to privately file security bugs with the upstream development team. It may also be worth notifying them you're doing the audit so they can prepare development resources to fix bugs or to integrate your patches if you're planning on developing mitigations yourself.

TODO Hosting, Third-Party Services, and Centralization

Just like libraries, third party services and hosting services you interact with also add dependencies to your system. Unlike libraries, you have little control over what these dependencies do. While a good hosting provider will keep their systems as secure possible and won't do anything without telling you, they may still be compelled by law enforcement to take down your system, to reveal any data they can, or even potentially to try to modify the systems your code is running on. Even excluding law enforcement, providers can be compromised or can decide to take potentially harmful actions for political or commercial reasons.

With third-party services, you often have far less visibility or control than with hosting services. You send the service some data and they send back a response and/or do something in the world, but whether they'll do the same thing tomorrow or what else they do with that data is not necessarily clear. Legal agreements can help add clarity, but as with hosting services, there are limits to that clarity. If you're integrating with a third-party service that requires you to install and run their code (especially if they control updates), you have very little control over the effective security of your execution environment. This includes hosted JavaScript libraries.

In more traditional enterprise or consumer environments, reliance on third-party services is common and increasing. In higher-risk environments, centralization and third-party services can be extremely dangerous. Of particular note are user behavior-tracking systems. Many designers and developers are used to relying on third-party tracking tools to understand how people are using their system. Many of these tools attempt to identify users, leak their data and behavior, and sell that data to third parties. Including these tools in systems intended to maintain user privacy is directly counterproductive. The behavior of all third-party systems and the particular risks they entail should be included in all threat models.

Decentralization and reducing dependencies on third-party services and hosting providers can effectively reduce the exposure of the system. Centralized systems always rely on some level of security by policy, which is only effective until policy changes. Replacing that with security by design allows you to make stronger statements about system behavior over time.

TODO Continue to Part III

If you liked this essay, you can sponsor me writing more. I've started a Patreon where you can pledge to support each essay I write. I'm hoping to put out one or two a month, and if I can reach my goal of having a day of writing work funded for every essay, it will make it much easier for me to find the time. In my queue right now are a the next two pieces of this series, more updates to my piece on real world use cases for high-risk users, and a multi-part series on deniability and security invariants that's been in the works for some time. I'd much rather do work that helps the community than concentrate on narrow commercial work that never sees the light of day, and you can help me do just that.

Thanks again!
Eleanor Saitta
2015.11.27
London

DONE What App am I Using for What and How?

CLOSED: [2023-01-15 Sun 10:45]

DONE wisdom/wisdom.md at master · merlinmann/wisdom · GitHub

CLOSED: [2023-01-29 Sun 17:11]

DONE Regular expression - Wikipedia

CLOSED: [2023-03-07 Tue 20:11]

TODO How YouTube Created the Attention Economy | The New Yorker
  • State "DONE" from "READ" [2023-08-03 Thu 15:08]
TODO Blitzkrieg
TODO Mussels Escabeche Recipe   food
TODO An Update on Al Baydha 7 Years Later   permaculture
TODO Speaking Freely: Ethan Zuckerman | Electronic Frontier Foundation
TODO Swiss Physicists “Big Hack” for Intel 4004s 52nd Anniversary
TODO Anarplex
TODO Gerard Nolst Trenité - The Chaos - Wikisource, the free online library   poetry

Beautiful poem about the weird language that is English.

TODO Gaming Election Law - David Friedmans Substack

Wonderful games. US constitutional democracy is exceptionally fragile and archaic.

TODO Chapter 1: Introduction - Lapwing for Beginners   typing stenography
TODO Welcome to Fedimint | Fedimint   money

A modular open source protocol to custody and transact bitcoin in a community context, built on a strong foundation of privacy

TODO How to Dictator-Proof Your Money | Journal of Democracy
TODO GitHub - ofou/graham-essays: 📚 Download the full collection of Paul Graham essays in EPUB, PDF & Markdown for easy reading.
TODO Mefo bills - Wikipedia

This may be useful for an economic revival in Egypt without triggering inflation.

TODO Evergreen notes

Entry point to Andy Matuschak's great resource on Evergreen Notes.

TODO Wealth Without Money - RepRap   atoms 3dprinting

The original Reprap release manifesto.

DONE قصة: وجوه في الماء | مدينة

CLOSED: [2024-02-09 Fri 20:31]

TODO Cuckold egypt | xHamster   sex video
TODO Public Degeneracy | eFukt.com   sex video
TODO NOTHING is Impossible | eFukt.com   sex video
TODO The Documentary Podcast - Our House: Stories of the Holocaust - BBC Sounds

Jo Glanville's documentary on her mom's childhood Berlin

TODO File:Development of Political Parties in the United States.svg - Wikipedia

This infograph is very telling. The US voted the more progressive party most of the times: Quincy Adams, Harrison, Taylor, Cleveland, Cleveland, Taft, Harding, Coolidge, Hoover, Eisenhower, Eisenhower, Nixon, Nixon, Reagan, Reagan, Bush, W. Bush, W. Bush, Trump.

TODO OUM - Lágrimas Negras @Loustic Sessions .lyrics - YouTube

واخا نتا خليتيني و لحالك مشيتي واخا كاع ماتت معاك آمالي و احلامي والله ما نغضب عليك والغضبة دايزة فيا فمنامي ندعي ليك، فمنامي نفرش ونغطيك بالستر و الرضى شوف كيف انايا نتشوا راه في صدري كيا قليبي مضرور نتا فينك كاع ماحاس بحالو ونبكي ونتا ماجايب خبار للي دايز فبكايا دموعي انايا سودا، دموعي انايا سودا كيف يامي Wakha nta khalitini w lihalik mshiti Wakha ga matet maeak amali w ahlami Wlah ma naghdib alik Wlghdbaat dayza fiya Fmnaami nadrei lik F mnami nfrish wanaghtik b sitr w alrudaa Shouf kif ana ya ntshwa rah fi sadri kiya Gliybi madroor wntaya fink gahma has bihalu Ouu nbkii ou nta ma jayb khibbar li dayz fabkaya Dmouei anaya souda Dmoueii anaya souda kif koul yami _ Aunque tú me has echado en el abandono Aunque ya han muerto todas mis ilusiones En vez de maldecirte con justo encono En mis sueños te colmo En mis sueños te colmo De bendiciones Sufro la inmensa pena de tu extravío Siento el dolor profundo de tu partida Y lloro sin que sepas que el llanto mío Tiene lágrimas negras Tiene lágrimas negras Como mi vida Tú me quieres dejar, yo no quiero sufrir Contigo me voy mi santo aunque me cueste morir Tú me quieres dejar, yo no quiero sufrir Contigo me voy mi santo aunque me cueste morir

TODO Episodes
TODO The 31 Day Household Detox {2016} - Clean and Scentsible
  • Day 1: Paperwork
  • Day 2: Front entry way and coat closet/mudroom
  • Day 3: Purse
  • Day 4: Cleaning supplies
  • Day 5: Fridge and Freezer
  • Day 6: Pantry and other dry food storage
  • Day 7: Free for All
  • Day 8: Kitchen Cabinets
  • Day 9: Medicine Cabinet/First Aid Supplies
  • Day 10: Dining Area
  • Day 11: Entertainment Area
  • Day 12: Magazines and Books
  • Day 13: Junk drawer
  • Day 14: Free for All
  • Day 15: Desk
  • Day 16: Bathroom cabinets
  • Day 17: Linen closet
  • Day 18: Make-up
  • Day 19: Jewellery
  • Day 20: Bedroom closet
  • Day 21: Free for All
  • Day 22:  Sock and underwear drawer
  • Day 23: Nightstand
  • Day 24: Kids Toys
  • Day 25: Kids Closets
  • Day 26: Craft space
  • Day 27: Laundry Room
  • Day 28: Free for All
  • Day 29: Basement
  • Day 30: Garage
  • Day 31: Car
TODO يقين | مؤتمر وزير الاتصالات للإعلان عن حقيقة الاطاحة برئيس الشركة المصرية للإتصالات - YouTube

وزير الاتصالات: 8 تيرابايت سعة الكابلات التي تمر في مصر. مصر تصل ل0.2 تيرابايت منها

TODO الحلقة الرابعة من «الحل إيه؟» د. رباب المهدي تستضيف د. أحمد درويش الوزير الأسبق للتنمية الإدارية - YouTube

خلاصة الأزمة المصرية في الدقيقة 22:10: الدكتور أحمد درويش يعرف الفرق بين التسعة أضعاف و التسعة أمثال، و بقية مصر لا تعرف

TODO Open sourcing Cody   AI
TODO Day at a museum : trashyboners   sex video
TODO Have the Liberal Arts Gone Conservative? | The New Yorker

Part of the problem with the inclusion narrative is that the need for feeling included is itself a majoritarian position rooted in the need to be part of the overclass. Minorities asking for inclusion are uncomfortable being in the minority.

To contrast, in a culture made up of a mosaic of minorities, for example the Eastern Mediterranean, inclusion is a non-issue because it is normal that everyone is in the minority in some sense. It's possible that losing this minority culture is what caused the downfall of the near East.