Month: April 2018

Reality Check – The VA

Alternative Fact: “We can talk about experience but the VA, when you think about 13 million people, you could take the head of the biggest hospital corporation of the world and it’s peanuts compared to the VA. So nobody has experience” — Trump on Fox & Friends this morning.

Real Fact: The VA does not have thirteen million employees, they’ve just just under 400k. By their own documentation, they have nine million enrolled veterans. Unless this number does not include dependents who *quality* to receive services *and* there are an additional four million qualified dependents … thirteen million is another Trump-ed number. Even if they’ve got thirteen million people enrolled in their health plan, the number of patient *visits* (i.e. one guy comes in every week, that’s fifty patient visits a year), a standard metric within the health care industry, is more useful (and, honestly, impressive sounding). They had 95 million outpatient visits and 700k inpatient admissions in 2015.

Now that’s a lot of employees , but Amazon has more. Amazon also has something like 300 million active customers. So it’s not like anyone anywhere is this size. But OK, he’s limiting it to hospital corporations.

Hospital Corporation of America has like 200 thousand employees and handles twenty seven million patient visits a year. Less, sure, but how many employees and patient visits does the White House doctor handle? It’s not like Trump went with the Cleveland Clinic guy who oversees fifty thousand employees and seven million patient visits and defends the choice saying anyone’s experience is going to need to scale when joining the VA.

The Truth Is Out There

Hey, they *track* where aircraft go. Darn deep-state retroactively hacking into FAA data archived on third party sites to make Trump look bad! Turns out Trump was technically honest in telling Comey that he didn’t sleep in Moscow after the pagent – had the plane leave that night! No one asked about the night or two previous to the padgent.

I’ve pondered Trump’s ability to lie all.the.time without consequence – and it seems (to me) to hinge on the difference between “I outsmarted you” lying and “we’re all in on this one” lying. Will lying to an FBI agent be deemed OK because he’s part of this deep state out to get Trump? Will lying to the public to cover his own posterior be deemed OK because ‘the media’ (liberals, East coast elites) are out to get Trump? Will “they’re out to get me, so I had to lie” be a new class of falsehood approved by his supporters?

Data Privacy

Facebook is getting a lot of attention for the information it gathers and how well it secures personal data you provide. We should look just as intently at other companies. Some provide services to individuals in exchange for advertising data, and some provide advertising targeting services without offering anything to the individuals being tracked.

LinkedIn — Maybe because “professional” information about oneself does not feel as private as that which is shared on Facebook, LinkedIn gets overlooked a bit. The companies I’ve worked for and titles I’ve held almost seem like public records. You can download a copy of “your data” (like Facebook, this is not apt to contain meta-data they’ve gathered regarding you – just data you have submitted to the site). In your settings, use the privacy tab and scroll down to “How LinkedIn uses your data” – the first selection is to download your data.

Nothing stunning – a list of contacts, my various employers and titles. But LinkedIn is trying to slurp in my entire contact list, maintain a web of people who know people, and allow advertisers to target users. There’s a whole tab apart from your privacy settings to control how your data is used for advertising purposes. “Advertisers” seem to be corporate hiring agents and recruiters, so this marketing is not always mentally classified as “advertising”.

LinkedIn also has a setting which allows you to opt-out (mine was on, and I’ve never opted in so I assume it is an opt-out deal) of having some of your data made available to third parties for policy and academic research.

And remember that Facebook Pixel? LinkedIn wants to track information about “websites you’ve visited” and “information you’ve shared with businesses” to show you more relevant jobs and ads.

Beyond the data feeling less private, having high-paying jobs that need my exact skill set and tend to hire people with my browsing history … well, that feels like a score compared to Facebook’s ad trying to coerce me once again to buy a pair of roller skates I already decided wouldn’t work for my daughter. Even if you’re not actively interested in changing jobs, it is nice to feel wanted. But that’s a nice veneer to data hording, analysis, and target marketing. They’ve even got a peculiar setting under the “Communications” tab that wants to use algorithms to analyze your messages to formulate suggested replies. This too seems to be an opt-out setting.

Google — no one uses Google+ (pity, that) but Google amasses information from searches, e-mails, Hangouts, Android phones. You can request an archive of your data through https://takeout.google.com — it takes a long time for the archive to be built, and it was an incredible amount of data. A few +1s from mis-clicks that there is no immediately obvious way to delete. “Bookmarks” that all appear to be map locations. A calendar that apparently was syncing with my home server back in 2009 since that’s the create date on all of the items. A whole folder for Chrome with 75 meg of browsing history and another meg of bookmarks (a meg of text is a *lot* of data, but I *love* that my bookmarks sync between devices). A handful of contacts that I assume my husband created in our shared account. The totality of every conversation I’ve ever had in Hangouts. Some Google Keep notes that I also assume are my husband’s from our shared account. My entire GMail mailbox, which is an obvious data source. The very tiny set of profile data I actually shared with Google.

Hell, Google has years worth of location data that I guess comes from my phone (it’s got fairly accurate lat/long coordinates, so GPS is the likely source). Following Google’s directions to delete the data didn’t work either (on the map, hit the hamburger menu then scroll ALL THE WAY DOWN to the ‘history’ selection”. Google both claims to have no history data for me and has 423 places on my timeline. Sooo, yeah, that would be history data. I finally managed to delete the stuff through my phone. There is a “Google Settings” app. Select “Location” from it, then “Google Location History”. There is a “Manage Activities” selection (use Google Maps to open it). Confirm you don’t want to use location history because, of course, it asks you to turn it on. Then use the hamburger menu button and select “Settings”. Waaay down at the bottom, there’s an option to delete all history or a date range of history. A couple of warnings later, the timeline map shows no data.

Then there are the photos. Gig after gig of photos. I had an Android phone that went into a reboot loop. I spent a few days wiping and reloading my phone, then failed back to an old phone. One of those iterations, evidently, slurped up all of the photos on my SD card because companies *want* your data. So the initial phone setup pushes you to backup your data, sync up your media, and generally upload ‘stuff’. One erroneous click and they’ve got metadata they’ll be able to keep forever. And there’s no readily apparent way to delete everything at once either. I’ve spent days on the web site deleting a couple hundred photos at a time. Not fun. Click the first picture, scroll down a bit, hold shift and click another picture. If you’re lucky, you didn’t select more than whatever the limit is (guessing 500) and you’ll get “389 Selected” in the upper left hand corner. At which point, you can click the delete and remove that chunk of photos. If you are not lucky, you get “2 Selected” and have to try again.

Ceasing data collection is much easier than removing data they’ve already grabbed. From your account settings, elect to “Manage your Google activity”. Then go into “Go To Activity Controls” and turn off (well, pause) whatever you want to turn off.

And I assume any bucket into which they’ve placed you based on previously gathered information will be retained even if you’ve deleted the underlying data.

 

Sendmail In CHROOT Jail

Running our sendmail mail relay in a chroot jail, ‘make’ does not update sendmail config files with changes. While I’m certain there’s a way to sort that, it’s a lot easier to go back to the old-school way of updating sendmail.cf and sendmail’s hash files.

Modifying Sendmail Configuration (sendmail.mc) on Servers with CHROOT Jailed Sendmail

  1. SSH to server using your ID
  2. Change to the sendmail service account (e.g. sudo /bin/su – sendmail)
  3. Change directory to the jailed sendmail /etc/mail locatio (e.g. cd /smt00p20/sendmail/etc/mail)
  4. vi sendmail.mc
  5. Make requisite changes and save file
  6. m4 sendmail.mc > sendmail.cf
  7. Under your ID, restart sendmail using “sudo systemctl stop sendmail stop;sudo systemctl start sendmail”
  8. Validate changes

Modifying Sendmail Data Files on Servers with CHROOT Jailed Sendmail

  1. SSH to server using your ID
  2. Change to the sendmail service account (e.g. sudo /bin/su – sendmail)
  3. Change directory to the jailed sendmail /etc/mail locatio (e.g. cd /smt00p20/sendmail/etc/mail)
  4. vi filetoedit
  5. Make requisite changes and save file
  6. makemap hash ./filetoedit.db < ./filetoedit
  7. Under your ID, restart sendmail using  “sudo systemctl stop sendmail stop;sudo systemctl start sendmail”
  8. Validate changes

Where filetoedit is the name of the data file. For example, run “makemap hash ./access.db < ./access” to update the changes to the access file into access.db

New Soap Molds

I’d seen some incredibly intricate soap molds online – the individual posting the pictures was wondering if anyone who had purchased some could verify the results were as beautiful as the product photos on the store site. No one knew. I don’t have any silicone molds that make a decent sized bar of soap. I’ve got a few that make really thin bars, and Anya loves the little bunnies and fairy. Scott has joked that I could improve some of my ‘cute’ crafts if I’d just put a dragon on it (I assume not a puffy baby dragon), and the seller has a number of dragon molds. So I bought a few molds and they were finally delivered!

Anya was so excited to see them – the soap was removed waaaaaay too soon and it hadn’t hardened. Unfortunately the intricate nature of the mold means your soap should be hard before unmolding. The upper right-hand corner broke off. But the soap is just as intricate looking and cool as the product picture.

Context

I’ve walked into conversations mid-way and missed an important bit that completely changed the meaning of what I overheard – context matters. ABC’s interview with James Comey provides context for the odd announcement of finding Clinton’s e-mails on Weiner’s laptop. As background, prosecutors decide if the particulars of an event warrant filing charges. An extreme example is a manslaughter case with a self-defense argument. In a clear-cut situation, the prosecutor might never charge the individual — why waste tax payer money and juror time adjudicating a situation where there are a dozen independent witnesses who saw an attack and lethal force used as defense? In a murkier situation, like Zimmerman killing Martin in Florida, the prosecutor will charge the individual; and a jury determines if the lethal force was used in legitimate self-defense. The question being investigated by the FBI wasn’t just if there were classified materials inappropriately handled – the deeper question was if there was criminal negligence in the handling of classified materials. Did someone say “now, you need to keep all classified electronic materials on a State Department server” but the messages were still moved to a private server? Were the classified documents sensitive enough that the need to secure the information would be self-evident? From the messages on the seized server, the classified material was not high value (the bar for being stamped ‘classified’ is not particularly high). While it would have been possible for someone to send an email saying “you shouldn’t be doing this”, the personal server was not apt to contain any conversation leading up to the installation of the server — it didn’t. The FBI deemed Clinton’s handling of classified material as careless but not criminal.

Finding a cache of e-mails from the period preceding the installation of her personal server — well, as Comey says:

‘She used a Blackberry for the first three months or so of her tenure as secretary of State before setting up the personal server in the basement. And the reason that matters so much is, if there was gonna be a smoking gun, where Hillary Clinton was told, “Don’t do this,” or, “This is improper,” it’s highly likely to be at the beginning.’

Did the FBI “sit” on the information for weeks? He claims that someone mentioned finding Clinton’s emails on Weiner’s computer and he thought it sounded wrong (even assuming he knew the relationship between Clinton, Abedin, and Weiner … do you expect to find my manager’s emails on my husband’s computer?) and pretty much didn’t think about it until called into a meeting a few weeks later.

Context. Even as a long-time IT person, I could see thinking someone mis-spoke if they just mentioned in passing that seemed illogical. If the illogical thing were true, I would expect more attention to be called to it (i.e. the “in passing” bit is a salient fact). And the messages coming from the period before the personal server was built, and thus possibly containing conversations regarding the propriety of doing so (or, as she claimed, the “Hi, I used to be Sec of State and here’s how we handled things … get a personal email server” could have been there too).

A fellow who feels he has a “duty to correct” … if he recently stated that nothing was found and the case was being shelved, then discovered new evidence? Seems pretty reasonable to mention “hey, you remember that case we were shelving? Turns out we have some new, unique, evidence that we want to look at”. Now why he failed to mention the federal investigation into Russian interference in the election and possible involvement of the Trump campaign, the October FISA warrant for Carter Page … haven’t heard any rational for that one yet beyond “it looks bad for the Democratic president to be investigating the Republican campaign during an election year”.

Those who still do not know history …

Having been a teen asking for a motorbike when she really wanted to go to a concert, I understand the negotiating tactic where one asks for something outright silly with the intent of giving oneself “negotiating room” (i.e. if you ask for what you want, compromise means not getting what you want). Joanna Hendon requests that the president review documents seized from Cohen’s office and hand over anything he considers unprivileged.

First of all, a guy who thinks a conversation having a lawyer involved instantaneously creates a privilege situation is obviously unqualified to evaluate the privileged nature of documents. Also, way to make the ostensible President of the country seem like he’s got heaps-o time on his hands that can be spent in, say, depositions.

But beyond that, didn’t Nixon talk A.G. Elliot Richardson into something similar. Nixon would summarize the tapes and have Sen Stennis (not exactly an unbiased third party) listen to the tapes and verify nothing of substance had been omitted. Cox didn’t agree, and I’m sure Judge Wood will similarly find the proposal outlandish. A third party review, or a third party in conjunction with the taint team, is possible. It’s called answering a subpoena if you review documents and hand over what you think matches the request and isn’t privileged.

Cheddary Cheesy Buttermilk Biscuits

Ingredients:

  • 2 cups all-purpose flour
  • 1 tablespoon sugar
  • 1 tablespoon baking powder
  • 2 teaspoons Northwoods seasoning
  • 1 cup buttermilk (or put 1 tablespoon of vinegar in measuring cup & fill to 1 cup with milk)
  • 1/2 cup unsalted butter, melted
  • 1 1/2 cups shredded sharp cheddar cheese
  • Optional add-ins like diced scallions, sautéed onions, diced spicy peppers

Method:

  1. Preheat oven to 450 degrees F.
  2. Mix dry ingredients together in a bowl.
  3. Combine buttermilk and melted butter, mix well.
  4. Pour milk/butter into dry ingredients and stir to form a sticky dough.
  5. Gently stir in cheddar cheese and any optional add-ins
  6. Divide into sixteen equal pieces, roll and flatten to form biscuit
  7. Bake for 15-18 minutes, until golden brown and puffy.

Those who do not know history …

Those who do not know history compound errors by using phrases with loaded meanings or abysmal histories. As the World Meteorological Organization’s Hurricane Committee retires names so no one has another Katrina approaching them, I assumed politicians would retire phrases which haunt their predecessors. Then there’s this guy:

With a narrowly defined ‘mission’, sure it’s true. But GW stood in front of someone else’s sign and “mission accomplished” still hasn’t escaped the new connotative meaning.

Corporate Privacy

We had the Senate & House Facebook thing playing Tue/Wed – kind of background noise because anyone who didn’t realize a billion dollar corporation offering a “free” service was making money somehow on the back-end … well, didn’t bother thinking about it. But there were a few interesting tidbits (not the least of which being how many things one can claim, before a Congressional panel, to be ignorant of in spite of the topic being germane to the core operation of one’s company). The thing that stood out most to me through two days of testimony is that no one questioned the validity of the underlying service – consumerism is good, hence serving ads more likely to convince a person to buy the product is good too. I’ve got friends exclaiming that they’ve found products they’d never have known existed without targeted ads — which to me sounds like you’ve spent money on “stuff” that you didn’t need enough to go out and research something to fill that gap. Not a bad thing per se, but certainly not the laudable endeavor they make personalized advertising out to be. The flip side to presenting me ads that are more likely to convince me to buy something (assuming this is true, which dunno … sounds good on the face of it, but I tend to be put off by it and less likely to buy something) is, well, me buying more ‘stuff’ which is not always to my economic benefit.

But when they got onto the topic of Facebook Pixels (which work around people who block third party cookies), it got me thinking about the lack of control we all have over metadata. A lot of companies serve a menagerie the third party cookies from their site, and then execute a couple of third party JS trackers too. Because, as a company, it provides those third parties with data that potentially help drive sales. In theory. But do those marketing companies have some kind of non-compete clauses included in the contract they write with WIN? Can FB, Adobe, Google, etc have code embedded in a telco’s site, take the info they gather from my telco’s embedded JS code, and use it to promote non-telecom services? Cable TV even though it competes with a component of our business? An alternate telecom even though it’s a major line of our business? Is there a meta-category of “people who looked at my site but also looked at two competitors sites” v/s “people who have only looked at my site”?  At least that’s governed by contract and might be tightly controlled — although I doubt an org like Facebook tracks the provenance of each bit of metadata it collects to isolate its usage, that’s based on a feeling rather than any knowledge of their internal algorithms.

Employees visiting various sites — what data to we leak and how can that be used? It’s not like my company has any sort of agreement in place to control how CompanyX uses data gathered as our employees use CompanyY’s web site. My super paranoid brain goes to the potential for abuse — a competitor using our information against us. Not the marketing company directly – like FB doesn’t sell my name and data (that’s what they make their money on after all, using my data to throw me into advertising buckets) … but the company gathering the data can get acquired. Quite a few companies use Triblio – some niche B2B tracking thing as well as Google Analytics. Now Google isn’t a big acquisition target, but some small B2B marketing company? VZ bought Yahoo, so it’s not like the only thing they’re buying is towers and fiber. VZ buys Triblio and we’re in the beginning stages of forming some new product line through some company that uses Triblio. VZ doesn’t exactly know what we’re planning to sell in six months … but they’ve got a good idea. Or even industrial espionage — it’s getting to the point it makes a lot more sense to target one of these data brokers than to target a specific company.

I get that’s a little far-fetched and more than a little paranoid. Is targeted marketing effective for companies too – are company-targeted ads convincing the company’s employees to buy more stuff on the company’s behalf?

As a company are we benefiting, harmed, or indifferent to information being gathered from our employees as they navigate the web. Employees are going to show up from an assigned netblock most of the time (i.e. from the office or VPN), so it isn’t like it’s a super-hard-to-ascertain where the individual works. Is there benefit to blocking the tracking ‘stuff’ on a corporate level (and maintaining a default browser config that blocks third party cookies)? Is there harm in blocking the trackers? The parade of horrors approach would say with Facebook/Google specifically, widespread blocking would necessitate some other revenue stream for the company (i.e. we’d end up buying 1$ hundred search passes or something). Dedicated targeted advertising companies – beyond putting a company out of business (e.g. Triblio which seems to be a dedicated marketing data company) or reducing revenue (e.g. Adobe since they’ve got other profitable lines of business), not much direct impact. A vividly imagined parade would be worldwide recession as psychologically engineered spending prompts disappear and consequently consumer spending retracts. Worst thing I can come up with is being perceived as a bunch of hypocrites who track everything customers do on their site but specifically took efforts to prevent employees from being tracked around the web.