• 2 Posts
  • 238 Comments
Joined 2 years ago
cake
Cake day: June 7th, 2023

help-circle


  • I’m not going to defend everything the TSA does. And they do have a lot of problems. But, the lines at the checkpoint are the result of trade-offs in security. For all things security related, it’s about managing risk. You will never eliminate risk, so you need to pick and choose where to apply controls to reduce the worst risks and accept some risk in other areas.

    Think about the possible outcomes from terrorist attacks on airports. There are several possible scenarios:

    1. The attacker kills a few people in the airport using a direct weapon (gun, knife, etc.)
    2. The attacker kills a lot of people in a small area with a area weapon (bomb, gas, chemical, etc.)
    3. The attacker destroys an airplane in flight, killing everyone onboard.
    4. The attacker hijacks the airplane and takes everyone onboard for ransom.
    5. The attacker hijacks the airplane and uses it as a weapon, killing everyone on board and more people on the ground.

    We could probably come up with other cases, but I think this covers the bulk of it. So, let’s dive into managing these risks. What are the effects of such attacks, if successful?
    Looking at case 1, how many people are likely to be killed? Well, that depends on the police response time and the effectiveness of the attacker’s weapon. But, based on other mass casualty events, this probably falls into the range of 10-30 people. It could move outside this range, but this is pretty typical of such situations. To pick a number in the middle, will say they the expected loss for such an attack is around 20.
    With Case 2, again there is variability. But, it’s also something we have analogs for and may be able to put a range of casualties on. The Boston Marathon bombing in 2013 killed 6. The attack on Kabul Airport in 2021 during the US evacuation killed 182, though that also included multiple gunmen attacking after the explosion. Let’s put the loss rate around 50 for as single bomb, assuming a very packed area and a very effective bomb.
    For Case 3, the numbers are a bit easier to get a handle on. Typical airliners carry anywhere from 100-200 passengers. The 737 MAX 8-200 is designed for 200, while the Airbus A200-100 carries around 100 passengers. We’ll pin the loss rate here at 150, as attackers are likely to target larger aircraft for this sort of attack.
    Case 4 is basically Case 3, but with an optional loss of only money. For that reason, I’m going to remove this case, but wanted to mention it to avoid the “well akshuly” crowd, since this is a historic problem.
    That leaves Case 5. And it’s Case 4’s situation, plus some number of people on the ground. Certainly, not every such use of an airplane as a weapon will be as successful as the attack on 9/11. And that also involved multiple successful attacks. But, let’s assume that such attacks will hit populated buildings and cause significant damage. We’ll pin the expected loss at 200, This is 150 for the airplane and 50 on the ground, somewhat equivalent to Case 2 with a bomb in a crowded area.

    Ok, so we have expected losses, now lets talk about how often we expect such attacks to happen? And yes, this is a rough guess. But, since terrorists are unlikely to publish their plans, it’s the best we can do. We also face a difficulty in that these are still (thankfully) pretty rare events. And trying to extrapolate from a small set of data points is always a fraught exercise. So, fell free to quibble over these numbers, but I don’t think any numbers which fall into a reasonable range will change things much.
    Case 1 - This attack as a pretty low barrier to entry. If a person can be found to perform the attack, arming them isn’t terribly hard. So, we let’s assume we get 2 of these attacks a year. I don’t think we’re actually getting that, but out goal is just to get into the right ballpark.
    Case 2 - This attack takes a touch more work, bomb making isn’t that hard, but making a really effective one isn’t easy either. This type of attack does have the advantage that it doesn’t always require the attacker to die in the process. So, it might be easier to find someone willing to engage in such an attack. Let’s call this 1 per year.
    Case 3 - This also requires a bomb, but it may not need to be quite as big to be effective. Granted, modern aircraft can be amazingly resilient (see Aloha Flight 243). This attack also results in the attacker dying, so that can be a bit harder to source. So, lets say this happens once every other year, or 1/2 per year.
    Case 5 - So, no bomb this time, but you have to have an attacker not only willing to die in the process, but also go through enough flight training to fly the aircraft to it’s target. And you need the training itself. Plus, the attacker needs to get a weapon onto the aircraft. And since they need to overpower 100-200 people who might just take exception to the hijacking, you probably need multiple attackers willing to die in the attack. This is a pretty high bar to clear; so, let’s say that these attacks happen at a rate of 1 every 5 years.

    Ok, so let’s consider our Annualized Loss Expectancy (ALE) with what we have:

    Case Loss Expectancy Frequency ALE
    1 20 2 40
    2 50 1 50
    3 150 0.5 75
    5 200 0.2 40
    Total - - 205

    Alright, so lets start talking about controls we can use to mitigate these attacks. By raw numbers, the thing we should care about most is Case 3, as that has the highest ALE. So, what can we do about bombs on airplanes? Making them more resilient seems like a good start, but if we could do that, the military would have done it long ago. So, really the goal is to keep bombs out of airplanes. And that’s going to mean some sort of screening. We could just say “no carry on, period” and move the problem to the cargo hold. This would reduce the frequency of Case 3 and Case 5, as it would be much harder to get a bomb or weapon onto an airplane, without a bag to hide them in. But, travelers are not likely to give up all carried on bags. So, that really leaves us with searching bags and controlled checkpoints to do it. Of course, as has been noted, this would likely mean that Cases 1 and 2 become deadlier. Let’s put some numbers to it. Let’s say that checkpoints reduce the frequency of Cases 3 and 5 by a factor of 4 and increase the Loss Expectancy of Cases 1 and 2 by 1.5.

    Case Loss Expectancy Frequency ALE
    1 30 2 60
    2 75 1 75
    3 150 0.125 18.75
    5 200 0.05 10
    Total - - 163.75

    And we could push the numbers around for the effect of the checkpoints. And we could look at other controls or controls in combination. But, this is the sort of risk analysis which would need to be done to make such decisions. And, ideally, the numbers chosen would be done with a bit more care than my rectal extraction method. Can I say that anyone at the TSA/DHS/etc did this sort of analysis? No, but I suspect there has been some work on it. And it probably does lead to the conclusion that the expected loss is lower for airports with checkpoints than airports without. Though, that doesn’t excuse the TSA’s abysmal track record for tests done by the FBI.


  • I think it depends on what you want to print. Personally, most of my prints fit within a much smaller footprint. So, I don’t usually need my first layer to be perfect across the full bed. However, when trying to print something larger, I can absolutely tell how terrible my first layer is. It sucks to end up reprinting the first layer half a dozen times, because one small area keeps failing to adhere.

    A large part of my issue is the printer I have just isn’t all that good. And, when I get less lazy, I’m going to just build a Voron. At that point, I’ll probably be one of those folks tweaking it until I get a perfect first layer. Because I want to be able to start a print and not spend the next hour fighting first layer problems.




  • A brick and mortar store has a lot of overhead. And, even with merch sales, GameStop doesn’t have enough to offer to differentiate itself from online stores for that same merch. Why would I take the time to walk/drive over to the GameStop to buy some cheap crap from China, when I can go online and buy that same cheap crap from China for less online. Especially, when I can often get it direct from China (via AliExpress or the like) for even less? Without the sales of physical media and the used game market, there just isn’t a viable business case for GameStop anymore. Sure, I found the whole GameStop stock meme funny too. And it sucked that some big fund tried to short them into the dirt. But, looked at from a dispassionate perspective, the current business model is doomed.


  • It’s not nice as something to target, but it makes sense. Employment is about more than just straight money. When evaluating an employer, I consider everything from the top line salary, to benefits, work culture, work life balance and work environment. The non-tangible factors can mean that I would be willing to take a lower salary. That is why companies will do things like decked out rec rooms or the like. And ya, I might consider a lower salary to be part of something I love or believe in. E.g. If NASA were looking for remote cybersecurity workers, I might consider a lower salary that I would get elsewhere, just to get to be part of NASA.

    Employment is a negotiation between you and your employer. And while I do think technical folks could really use a trade union (something like the IBEW for electricians), for now you have to represent yourself and make sure you get what you are worth. And this might mean not working on the thing you are really passionate about. Especially if the people in charge of it are a bag of dicks.




  • I was lucky that, despite being somewhat religious, my parents were fine with me being an atheist. We would even debate the merits of religion and they did not have any issues with my questioning of their beliefs. Both were Lutheran and they had raised me in that tradition. I went to Sunday school, attended the Lutheran Catechism and reached the point of Confirmation. And that was right about the time I realized that the whole thing seemed to be based on a bunch of old stories with no more evidence than elves or faeries. And that was always the crux of my issue with their religion, and one they could never argue past.

    When it came to my kids, they have been raised with my complete lack of belief and my wife being agnostic. We spend our Sunday mornings sleeping in and not going to any sort of church/temple/forest altar. Though, that last might happen, if it’s ruins at the end of a nice hike. My parents never expressed any disapproval and the lack of religion was never an issue. Technically, my mother is still kicking about and could suddenly go off the deep end, though I strongly doubt that’s in the cards.

    At the same time, my wife and I had discussed religion before we had kids and what we might do in the event it became an issue. The simple answer was, “fuck 'em”. I love my parents, but my kids come first. If my parents had decided to get stupid over us not indoctrinating our kids in their fairy tales, then I would have just removed them from my life a few years before death did it anyway. Sure, it would have meant the kids never knowing their grandparents. But, there are lots of assholes in this world, I don’t see the need to personally inflict them all upon my children.

    The best thing you can do is talk to your partner and have a plan. I would say that, if you expect it to be a point of contention with your parents, you might want to talk with them about your views on religion before it gets to that point. It doesn’t need to be anything confrontational, just be up front and say, “I don’t believe what you do”. You don’t need to go on a Dawkins style, “your religion sucks and you are morons for believing it.” Just make it clear that you don’t believe. It’s still entirely possible to have a warm, loving relationship with folks who don’t believe as you do. It just requires that each side treats the other with basic human decency and respect.


  • I generally use the OS which fits what I am trying to do. For my desktop PC, I run Arch Linux as it lets me game, run VMs and have a high level of control over what the system is doing. The VMs are mostly Windows for testing stuff and one running Ubuntu as a host for PolarProxy. My server runs Ubuntu, though really just as a platform to host docker containers. That was a decision I made years ago when I knew a lot less about Linux and was looking for something which was more turnkey. My work laptop is Windows, because my work is mostly a Microsoft shop. But, I have WSL running both Ubuntu (for the SANS Sift framework) and Kali.

    An Operating System is a tool. Don’t get wedded to any one OS.



  • Popular beliefs influences people’s beliefs, which reinforces popular beliefs. Step back even farther from the question for a moment and ask, “why do you think of ghosts as dead human spirits at all?” That a “ghost” is some sort of dead human spirit is a concept that has been built into Western society for a long time. It is something we just accept in story telling and mythological belief systems because it’s been in them so long and is told to us via authoritative figures in our lives from an early age. To tell a story where a ghost is anything other than a dead human spirit or the echo of a dead human, makes people call bullshit on the story, because the story has broken a long standing societal expectation. Sure, some stories can get away with it, and more so in the modern age where we are starting to appreciate stories which subvert long standing expectations. But, we still tend to fall back on old tropes and devices which we can expect readers to understand, without having to spend too much time on building a world. It’s far easier to save the term “ghost” for something much like a dead human spirit and just create a new term when trying to describe something else.