Done Since 2021-10-10

[mdlbear]

It's been a rough week for some of you -- let's just say that the links I posted Thursday (see notes) were needed by more than one person on my reading list. It hasn't been too bad for me, though there were a couple of sad anniversaries that I posted about on Tuesday, and the Mukilteo-Clinton ferry route drops to one-boat service, which sucks for everyone (including me) who needs to go between Whidbey Island and the mainland.

Some links: White papers like Bugs in our Pockets: The Risks of Client-Side Scanning should not be necessary. Apple should know better. White papers (rants?) like Can light gray text on light gray backgrounds please stop being a thing? should also be unnecessary.

And in news of the stupid, Missouri governor demands prosecution for data breach report • The Register. The "breach" in question was using "view source" on a state Department of Education web app, which revealed about 100,000 full social security numbers.

Notes & links:
1010Su
  * Up 6ish; S=6:49, BP=125/74, P=62;
  : 11am Raining pretty heavily
  * pack:  * angle brackets for bathroom shelf  * tissue paper  * antibiotic ointment
  % spent all afternoon reading Foundation's Edge

1011Mo Columbus Day
  * up 7:15; S=7:45; 
  * before leaving:  * order bagels  * remove CPAP humidifier tub
  * before leaving RE collect  * night guard  * drugs  * CPAP
  * Bagels: 4 salt, 2 everything, 1 cinnamon raisin. 6 plain 2 tubs plain cream cheese
  * SL: antibiotic ointment;  angle brackets
  @ The rise of VR and the metaverse could pose unique risks to children.
  % meloxicam with pm drugs 9:45ish

1012Tu Colleen: 3 months
  & awake 2:40; CPAP in weird state.  "SD card error: remove and restart".  Took that plus
    a power cycle.  Still don't trust it much
    -> back to (attempted) sleep 4:15
    -> CPAP broken -> card can be mounted but `ls /mnt/P-SERIES` fails with i/o error
       does not appear to work at all without card - re-boots.
    -> several hours later, works with the card removed.  Put new card in; appears to have
       initialized it (took a long time); appears to work.
  : 8-12 window for fridge repair person  -> needs a part; 1 week.  Defrosting should help
  @ jwz: Can light gray text on light gray backgrounds please stop being a thing? (andrewducker)
    MacOS 11, but widely applicable.
  * posted River: State of the Bear: Three months after
  @ SHA-1 'Fully and Practically Broken' By New Collision | Decipher Eeeek!
    SHA-1 is a Shambles [PDF]
    First Chosen-Prefix Collision on SHA-1 and Application to the PGP Web of Trust
  % 10ish meloxicam with pm drugs

1013We
  * Up 6:30ish; S=7:28; heat
  @ Alexithymia: Do You Know What You Feel? | Psychology Today
  * 6:30pm Mac+Cheese for dinner.   start cooking 6pm
  % 10:15ish meloxicam with pm drugs, as usual
  @ VersionPress Documentation
    How to Use Git with WordPress - DreamHost

1014Th
  * up 6ish; S=6:45;
  @ The Most Influential Sci-Fi Books Of All Time
  * posted mdlbear | River: Links for the Recently Widowed
  @ The Most Important Personality Trait You’ve Never Heard Of | Psychology Today
    Externally-Oriented Thinking
    " People high in alexithymia are poor candidates for psychotherapy, while at the same
      time having higher risk for a variety of psychological disorders. "
  @ canva.com:  Collaborate & Create Amazing Graphic Design for Free
  % feeling a bit flaky.  Low blood sugar?  Low blood _pressure_? (probably not, but...)
  @ Missouri Gov. Parson vows to prosecute Post-Dispatch reporter | STLPR 
  % meloxicam with pm drugs

1015Fr
  & awake 4:11; S=5:07; heat, attempt to deal with itching -> down 5:05
  * up 7:45; S=7:44;.
  * pack in the morning
  * before leaving RS collect  * night guard  * drugs  * CPAP
  * 11ish get hugs 
  * 11:15 leave for dentist.  23 minutes from RS via I5 and 405
  * noon dentist -> ned deep cleaning: 2 2-hour appts
  * go up to Whidbey after dentist.
  * Back on Whidbey:  * buy stamps  * let N know that I'm home.
  : Amazon sent me a _PAPER CATALOG_ of gifts for kids.  Addressed to "resident"  Sheesh!
  @ Missouri governor demands prosecution for data breach report • The Register 
  * after arrival: * water orchids  * sort mail
  * make a payment or do other paperwork  -> */15   pay AX card, Molly
  * */15   CPAP:  change paper filter, wash tub

1016Sa
  & Awake 4:50; S=5:47; down 5:45
  * up 7:15; S=6:59, BP=122/73, P=60; 
  @ How Facebook Hides How Terrible It Is With Hate Speech | WIRED
  @ Mukilteo-Clinton ferry route drops to one-boat service | South Whidbey Record
  @ Bugs in our Pockets:  The Risks of Client-Side Scanning impressive author list:
    Hal Abelson Ross Anderson Steven M. Bellovin Josh Benaloh Matt Blaze Jon Callas
    Whitfield Diffie Susan Landau Peter G. Neumann Ronald L. Rivest Jeffrey I. Schiller
    Bruce Schneier Vanessa Teague Carmela Troncoso
  $ C $50 to National Wildlife Federation  UB Checking
  $ C $75 to Union of Concerned Scientists UB Checking
  % several times this weekend (and previous weekends, though I don't think I mentioned
    it) while sitting at my desk I've had the momentary feeling that Colleen was here,
    sitting in her recliner, just out of sight.

Comments

[fuzzyred]

I'm not a very tech savvy person, but if "view source" lets you see social security numbers, isn't that a flaw in the website/app that should have been fixed on the programming side?

[mdlbear]

It is, and it was, very shortly after it was reported to them. The newspaper story didn't come out until after that.

from: https://news.stlpublicradio.org/government-politics-issues/2021-10-14/missouris-governor-vows-to-prosecute-a-reporter-who-told-the-state-about-a-data-security-risk --

During the media briefing, Parson said that he is sending information to the Cole County prosecutor along with the Missouri State Highway Patrol’s Digital Forensic Unit and that the reporter acted against the state agency in “an attempt to embarrass the state and sell headlines.”

...

Parson said because the reporter who found this vulnerability did not have the authorization to access or decode the data, the actions are defined as a hack. He said that in addition to criminal charges, a civil suit could be possible.

According to the Post-Dispatch report, it discovered the vulnerability in a web application that allowed the searching of teacher certification and credentials. Social Security numbers were found in the HTML source code in the involved pages.

Looking at the HTML for the page is, of course, a browser feature that has been there from the very beginning. Calling it "unauthorized" is sheer idiocy.

[fuzzyred]

That sounds like an awful lot of government idiocy, and retaliating because someone "made them look bad."

[spiffyvoxel]

My big news this week is that I've finally gotten myself a personal budget, thanks to You Need A Budget (YNAB). I tried various personal finance apps over the years, but gave up over their inability to reliably connect to my bank accounts. Ironically, the fact that YNAB won't work with any UK financial institutions forced me to manually enter current balances for my accounts and work forwards instead of backwards in time. That turned out to be the key, as I'm not dwelling on past mistakes. Hopefully no more bill-shock! 🤞🏼

I hadn't realised it was possible to use WordPress with Git, I've pinned those two links for further reading. Having said that, I'm considering the feasibility of moving to a static site generator; the sticking points are currently finding broken links and archiving pages and posts with the Internet Archive, both currently handled by plugins on my site.

[mdlbear]

Yay! I need to update my budget spreadsheet -- it's several years obsolete.

Those sound like useful plugins too; I'm in the process of setting up a WP site in connection with a project that N and I are working on. There are almost certainly equivalent stand-alone programs that you can use with a static site generator at build time.

[spiffyvoxel]

WordPress's plugin ecosystem is both a blessing and a curse: while there's lots of choice and something for just about any need, it's easy to grind your site into an unresponsive mess if you install too many or choose poorly. And the Gutenberg editor is a bit like Marmite, you either love it or hate it.

[madfilkentist]

As usual, a Web search fails to turn up followup stories in the Missouri case. Once they've got their headline, they don't care. I wonder if the governor went to a prosecutor, whose recommendation was that the governor needs to lay off the booze.

[mdlbear]

Followup story: https://news.stlpublicradio.org/government-politics-issues/2021-10-20/gov-parson-said-fixing-a-security-flaw-would-cost-50-million-democrats-doubt-that

More followup; the latest story is dated yesterday: Headline rewind: Governor threatens Post-Dispatch after discovery of data vulnerability | Politics | stltoday.com