f- | 8 years ago
f-'s comments
f- | 8 years ago
So I posted something along these lines in another, now-duped thread... but I know that many folks were caught completely off guard and started wondering what they would have done in case of a real threat. Many just cracked Twitter jokes about dying in a blaze of glory.
For folks who want to understand the actual dangers and survivability of an ICBM strike, I strongly suggest a book from the 1960s written by one of the folks involved in the US nuclear program during the Cold War:
http://www.madisoncountyema.com/nwss.pdf
It cuts through many of the Hollywood-perpetuated myths - the certain and painful death in case of a nuclear strike, or the 10,000-year radioactive wasteland that's going to be left behind.
For example, it discusses why the oft-ridiculed duck-and-cover strategy is actually surprisingly effective. The primary threat from an air burst is very conventional - a shockwave and an intense burst of thermal radiation. Shelter - any shelter - greatly improves your survival odds.
The fallout from air bursts is comparatively modest (i.e., tends to be far lower than from an event such as Chernobyl) and while lethal, it decays very rapidly - dropping to reasonably safe levels in a matter of days, not centuries. Staying sheltered for 2-10 days greatly improves your odds, and the thickness of material between you and any surfaces that gather dust (roofs, ground) matters more than anything else. Here's a handy chart:
http://static3.businessinsider.com/image/58cc34b9112f7043268...
In other words, having enough food and water in your home to weather out a nasty stowstorm also makes you well-prepared for the nuclear apocalypse. Mattresses and bulky furniture provide decent shielding when all other options fail.
The long-term effect of fallout tend to be exaggerated, too; water from streams, deep lakes, or wells should be safe or get safe very quickly. Removing a layer of topsoil allows relatively safe crops to be grown. Mild radiation sickness, at the levels where people start experiencing vomiting and hair loss, is actually pretty survivable and has a relatively modest impact on your odds of developing cancer later in life.
(Plus, keep in mind that more than 2,000 nuclear tests have been conducted so far, including around 900 in Nevada alone; while they had some statistically observable negative effects, they have not turned the world into a nuclear wasteland.)
Of course, don't get me wrong - even a single nuclear strike would be awful, and a large-scale confrontation would mean untold damages and loss of life. But the important point is that a lot of people would survive and would be able to do well in the aftermath - more so if we teach them about some common-sense preparedness steps.
The main reason why our understanding of the nuclear risk is so lopsided is because for decades, many nuclear disarmament activists (including many prominent screenwriters, celebrities, and pundits) had a vested interested in portraying the already-awful outcomes of a potential nuclear war as far less survivable and far more hopeless than in reality; the mockery of duck-and-cover, the "barren wasteland" imagery in the movies, and the largely-discredited scientific theories like the "nuclear winter"... all helped to advance (otherwise noble) goals, but at the expense of teaching people that there's nothing they can do save themselves.
Plus, of course, after Cold War, we have fewer reasons to worry. It's hard to top the Cuban Missile Crisis. There's plenty of politicized hyperbole around nuclear tensions right now, but the reality is that a large-scale strike on the US is a lot less likely than throughout a good part of the 20th century.
PS. I have a short summary of NWSS and some other points about this topic (and other, more mundane but plausible hazards) in my "Doomsday Prepping for Less Crazy Folk" - http://lcamtuf.coredump.cx/prep/
f- | 8 years ago
That is actually reasonably well-established - check out this:
http://static3.businessinsider.com/image/58cc34b9112f7043268...
Not common knowledge, though, in part because nuclear hazards have been painted in an exaggerated light by Hollywood (basically, no point in trying to survive, because everybody is going to die and what's going to be left is a 1,000-year lethal nuclear wasteland), and in part because we stopped worrying after the end of the Cold War.
Despite the goofy title, this is a remarkably good book from the 1960s, citing some actual science, that helps grasp the actual dangers and the survivability of nuclear attacks or accidents:
http://www.madisoncountyema.com/nwss.pdf
PS. For folks interested in less apocalyptic emergency preparedness tasks, I maintain a handy guide:
f- | 8 years ago
But wait, there's more! I also make tables [1] and doomsday predictions [2].
f- | 8 years ago
As others have said, you're not gonna be drinking it every day...
Stuff like BPA is not acutely toxic. There are some concerns about long-term ("subchronic") exposures spanning a decade or more, and even there, there is basically no clear evidence of adverse effects on humans.
Besides, BPA and its ilk are a concern chiefly with a variety of fancier, transparent plastics. Food-grade HDPE and polypropylene jugs are of relatively little concern. They are just not particularly pretty, so they don't sell.
Steel and glass are two other options, although many steel bottles are lined with epoxy or other coatings. Plus, in a car accident, I'd rather have a soft HDPE jug flying around...
f- | 8 years ago
[Author here]
The mindset is actually a large component of this guide, and it intentionally delays any discussion of "prepper gear" until it gets through a long laundry list of lifestyle tips and discussing the need to plan ahead, figure out what is likely, what can go wrong, what the decisions points may be, etc. In contrast to most other prepping docs, weapons are literally the last thing discussed, and only in a perfunctory way.
That said, I think that your view of emergency preparedness is far more narrow than what I aimed for in the guide. A significant focus of the doc is dealing with small-scale but common adversities, such as recessions / unemployment, house fires, backed-up sewage, and other "boring" but life-altering contingencies. Basically, the stuff that almost everybody will need to face at some point in their lives.
I'd wager that for 90%+ of the events that a typical person in the US is likely to experience, heading into the woods to forage on berries and hunt wildebeest is not the way to go.
f- | 8 years ago
[Author here]
> [...natural disasters...] Pretty much always in the sames typical places though...
Most people live in "typical places" without realizing it, though. I mean, you know when you're in the tornado valley, but tornado / hurricane risk is relatively high for basically the entire eastern half of the US. And wildfire risk is very significant for the entire western half. Add to this earthquakes, etc, and it turns out that most people live in a place that is likely to experience a major regional disaster every couple decades or so.
Still, the guide is not really about that; or rather, it covers natural disasters to some extent, but it puts a lot more emphasis on personal preparedness - being able to cope with another run-of-the-mill recession, a house fire, and other likely occurrences of this sort. More general preparedness is almost a side effect of that.
> [...economic crises and armed conflicts...] Ditto. See: countries with a perpetual history of dictators and authoritarianism (although westerners and capitalism/socialism typically receive the blame in popular depictions)
Well... Greece, Iceland, etc?
f- | 8 years ago
It's very common when fuzzing. That's why you normally want to place memory limits on the target process, to avoid bringing the system down. AFL does that automatically, most other fuzzers have a config option.
f- | 8 years ago
I had pretty good results fuzzing SQLite back in the day:
https://lcamtuf.blogspot.com/2015/04/finding-bugs-in-sqlite-...
I think they eventually incorporated AFL into their continuous testing and squashed several dozen bugs. OSS Fuzz scales it up, but yup - the bottom line is that you might think you have 100% test coverage, but you really still need to fuzz =)
f- | 9 years ago
I hate to be negative, but I've been working in the security industry for several decades now and... the article reads to me like a collection of condescending platitudes that attribute malicious intent or extreme incompetence to just about any person other than the author. Jumping back and forth between Snowden, PDF attachments, and C memory safety does not help.
The online world is not particularly horrible; we overwhelmingly use it by choice, not out of necessity, and the benefits far outstrip the risks. Sure, it's also far from being great, and the genuine difficulty of designing complex systems in a secure way plays a role in this (heck, between all the interested parties, we can't even really define what "secure" means in practical terms). But it's not because everybody else is dumb.
While I generally hate analogies like this, I think there are quite a few parallels between the online world and the physical realm, where we seldom settle on absolute security. You have a $10 door lock that can be opened with a paperclip, protecting probably in excess of $5,000 in electronics within your home. In that realm, we are far better accustomed to the trade-offs, in part because we have more intuitive data about what can go wrong. We also take a more dim view of a burglar than of a hacker, which makes us assign the blame a bit differently.
In any case, with online security in particular, there some paths forward, including fairly plausible incremental strategies (better UX in the browsers and operating systems, better developer guidance, better mitigations, a culture of fuzzing and other security testing as a part of QA, etc). There are also some ambitious revolutionary dreams ("New everything! In Rust!") that may actually pan out if enough people get behind them. But I'm not sure what this article is hoping to achieve.
f- | 9 years ago
The last time this story made rounds on HN, quite a few readers were ripping into the people described in the article, and it sure feels good to do so, but... I don't know about you, but if I had more money than I conceivably ever needed, I sure would contemplate having a helicopter on standby and a luxury compound in some scenic part of the world. You know, just for fun, just in case.
In fact, I suspect that once you're in that particular wealth bracket, it's no longer about people who have contingency plans versus the ones who don't. I'm pretty sure that almost every Fortune 100 CEO has private security parked in front of their house and a plan to get out quickly something bad were to happen. There are many security consulting companies that cater exclusively to this segment - and they are doing very well. It's just that most of the CEOs won't talk about it to The New Yorker - partly because of opsec concerns, but partly because such revelations would make it even easier for us to vilify them.
And before we assume that their plans are lopsided and irrational, I think it's worth keeping in mind that the article is written to be entertaining. The author wants to tell us about the stuff that is out of ordinary and out of reach of mere mortals. That doesn't mean that the people featured in the article don't also have a fire extinguisher and some tarp and nails in their garage. Heck, perhaps 95% of their prepping goes toward more pedestrian risks? Perhaps they practice defensive driving and situational awareness? Perhaps they go camping or hiking every other week? Perhaps they take EMT courses and participate in community preparedness drills? Who knows... that stuff is boring. ICBM silos and helicopters are fun.
We should also remember that unlike many many of the stars of "Doomsday Preppers" who seemed inexplicably frightened by the prospect of social unrest in the US, the ultra-rich may actually have something to worry about. When angry masses take it to the streets, it's not the cookie-cutter, mixed income, urban sprawl neighborhoods that are going to be set ablaze. We had quite a few big revolutions, and it's usually the heads of the variously defined aristocracy that roll. It's not ancient history, too.
Lastly... one viewpoint presented in the article is that it's somehow immoral for the CEOs to worry about self-preservation instead of trying to give back to the community. I think that's a non-sequitur - is it also immoral for them to buy a fire extinguisher or install sprinklers before making the world a better place? - but more importantly, the two goals are not mutually exclusive.
PS. Disclaimer - I'm the author of http://lcamtuf.coredump.cx/prep/, so I might be not entirely impartial.
f- | 9 years ago
The "top ten" list you linked to includes accidents (such as poisonings and falls), suicide, and influenza.
I do not mean to be a jerk and I am no meat apologist - but is meat consumption playing a direct, notable role in at least two out of these three?
f- | 9 years ago
Off-topic, but my personal work sometimes ends up on the front page, and I'm always amazed how much reposting there is on HN - probably more than on Reddit and similar sites. Say, here's my stuff:
https://news.ycombinator.com/from?site=lcamtuf.blogspot.com
https://news.ycombinator.com/from?site=coredump.cx
The process seems quite random; sometimes, the same link is submitted four times and lingers at score 1, and then some random dude's fifth attempt goes to #1. May be an interesting thing to graph (and get a #1 story on HN out of =).
f- | 9 years ago
One important consideration here is that the phishing attack as described here could be pulled off even if the targeted site did not support redirects - and in general, it would be exploitable without any identifiable fault on the part of the "vulnerable" web app.
This property is an artifact of how browsers work, and it's not something that's likely to change soon. Basically, if you visit evil.com, evil.com can always load accounts.some-trusted-domain.com in a new window, give you enough time to examine the address bar and confirm that it's legit - and then sneakily navigate that window to a phishy location that looks the same as our legit login prompt, but is controlled by the attacker.
(The evil site can also detect certain events, such as navigation, and deliver the payload only at that point.)
For my whimsical demo for Chrome and Firefox (dating back to 2011!), see: http://lcamtuf.coredump.cx/switch/
(Disclaimer: I kinda wrote a book about this stuff. Also, I work for Google.)
f- | 9 years ago
Author here. Rookie mistake! It's actually a golden-mantled ground squirrel.
https://en.wikipedia.org/wiki/Golden-mantled_ground_squirrel
A chipmunk would have a stripe going across the eye.
(Today, you learned your first squirrel fact!)
f- | 9 years ago
Not sure I follow - especially if it already depends on IM, how is it different from 'convert -compose difference' or a similar operator?
f- | 9 years ago
Although the emphasis on the actual abuse of newly-introduced APIs is much needed, it is probably important to note that they are not uniquely suited for fingerprinting, and that the existence of these properties is not necessarily a product of the ignorance of browser developers or standards bodies. For most part, these design decisions were made simply because the underlying features were badly needed to provide an attractive development platform - and introducing them did not make the existing browser fingerprinting potential substantially worse.
Conversely, going after that small set of APIs and ripping them out or slapping permission prompts in front of them is unlikely to meaningfully improve your privacy when visiting adversarial websites.
Few years back, we put together a less publicized paper that explored the fingerprintable "attack surface" of modern browsers:
https://www.chromium.org/Home/chromium-security/client-ident...
Overall, the picture is incredibly nuanced, and purely technical solutions to fingerprinting probably require breaking quite a few core properties of the web.
f- | 10 years ago
> Assault with a hand is much less likely to end in serious injury than assault with a weapon.
Really? I'd take pepper spray over fists. I'm talking specifically about non-lethal choices, especially for people who do not stand a chance in a fist fight.
Most of Europe does allow pepper spray, stun guns, and similar tools, and they really don't see more violence than the UK. In fact, violent crime in the UK is fairly high in comparison with many EU states.
f- | 10 years ago
I think this is pretty similar to the rest of the western world, and certainly to the legal frameworks in much of the US. The interpretation is probably very different, though. So is the legality of carrying weapons in anticipation of an assault...
f- | 10 years ago
Interesting. Lethal weapons are banned in much of the world, but based on my reading of it, the UK seems to be pretty radical when it comes to non-lethal tools, compared to most of Europe. Looks like pepper spray, stun guns, or really anything else is not legal to carry.
Legal self-defense tools apparently include bright flashlights / strobes (I kid you not) and personal alarms.
It's actually a pretty extreme doctrine, no? The UK does not enjoy a particularly low rate of assault or rape, compared to most other western countries. If unarmed self-defense is the only thing you can try, this would seem to put smaller-framed women, the elderly, and less physically fit people at a distinct disadvantage. Weird.
In some cases, these were inaccurate simply because it resulted in a better movie or a novel; but in many other cases, they were probably informed by anti-war or anti-proliferation sentiments. I don't think this deserves any special ire, TBH; it's just our reality. I loved Dr. Strangelove, but it sure affected public perception in a particular way.