CISA’s exploited vulnerabilities report for 2011

The US CISA published its annual report on Wednesday:

This Joint Cybersecurity Advisory was coauthored by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Australian Cyber Security Centre (ACSC), the United Kingdom’s National Cyber Security Centre (NCSC), and the U.S. Federal Bureau of Investigation (FBI).

This advisory provides details on the top 30 vulnerabilities—primarily Common Vulnerabilities and Exposures (CVEs)—routinely exploited by malicious cyber actors in 2020 and those being widely exploited thus far in 2021.

There’s nothing too surprising here if you’ve been following the industry’s adventures over the past twelve months, but it’s always appreciated getting a well-cited summary, and some context around which were most exploited. It’s interesting comparing these with what the popular tech press chose to cover, and how often.


Train journey bucket list, via @JKloss4

Jim Kloss shared some Australian train journey videos from the BBC’s wonderful Michael Portillo, and asked if I’ve ever been on one. No sooner had I read that tweet, than Clara and I watched a video from Geoff Marshall who mentioned an occasion where he’d managed to photobomb one of his filimg trips! Alas, while Clara and I have many of Michael’s blu-rays exploring Australia and Europe, we have yet to go on them.

The Ghan stretches about 3,000 km from my old uni stomping grounds in Adelaide up through the Red Centre to Darwin via Alice Springs. The Indian Pacific starts at Perth on the west coast and snakes its way through South Australia and eventually to Sydney over 4,300 km of track. I’ve long wanted to both, but cost has always been the primary issue. Isn’t it always?

Jim’s comment got me thinking though: which other trips would I want to do with Clara as well?

The biggest for us is, unsurprisingly, Japan. I could enumerate every single little rural railway, Shinkansen route, inner-city metro line, and tourist train, but I’d be here all day. Suffice to say, Japan takes their trains seriously, and there are some incredible journeys in which to partake. Everything from the Nozomi Express to the beautiful little Randen Arashiyama tram and the suburban far exceeded even our hyped expectations. I’ve written many of the rural train articles for the English Wikipedia, and I’d love to actually go on them.

(Sitting in the driver’s cab of a maroon Hankyū looking out at the blooming sakura trees in semi-rural Kyotō is among the highlights of my life).

View out the drivers cab of a Hankyu suburban train of a train platform and blooming sakura trees.

Not far behind is the Empire Builder in the north-western United States. I’ve talked about it in detail here a few times, but suffice to say it travels from Seattle eastward through the Rockies to the Whitefish ski resort town. I can’t tell you how many times I’ve taken the route in the original Train Simulator, and in Dovetail’s version of the game. There’s an alternate-reality Ruben out there who moved to the pine-covered mountains of rural Montana and became a telecommuter. Oh oh, I’m an alien, I’m a legal alien, I’m an… Australian in a tree?

Speaking of the Rockies, Canada’s Rocky Mountaineer looks even more spectacular, heading from Vancouver to Banff. It looks exceedingly expensive like those Australian trains, but looks worth it given the documentaries and photos I’ve seen. My old man may have travelled on part of during a business trip to Alberta in the early 2000s, much to my chagrin.

One day I also want to take a train journey across Germany to see all the villages and cities where my dad’s side of the family came from. ICE trains also duck 🦆 into Austria too, which would be great to explore. Geoff Marshall has also reinvigorated my interest in British railways as well.

As for nostalgia, I do want to go with Clara on the KTMB service from Woodlands in Singapore to Kuala Lumpur. Not because it’s especially nice by fancy train standards, but because I took it as a kid so many times for school excursuions and camps. The original station in Tanjong Pagar is no longer in use, but much of the route and rolling stock look exactly the same now as they did back then.

Now that I think about it, there are few train trips I wouldn’t want to take.


This site is mobile friendly

I ran this site through Google’s Mobile-Friendly Test yesterday, a tool I can appreciate on account of having correct hyphenation. I’m looking at you, open source software.

Tested on: 28 Jul 2021 at 13:42
Page is mobile friendly
This page is easy to use on a mobile device

That’s good to know.


Mental health at the Olympics

Sean Eagle filed this in the Guardian yesterday:

The American gymnast Simone Biles, the biggest star at the Tokyo Olympics and the greatest athlete in the sport’s history, last night walked away from the women’s team competition after admitting she had “freaked out in a high stress situation”.

[..] Biles said that the influence of Japanese tennis star Naomi Osaka, who pulled out of the French Open citing mental health concerns, had really helped her speak freely. Osaka, who was seen as the Japanese face of the Games and lit the Olympic cauldron, was knocked out in the third round of the women’s singles at the Olympics on Tuesday and admitted that pressure was a factor.

Simone Biles is amazing. If you’ve haven’t seen one of her routines, she imbues them with such individualism and personality in addition to being technically excellent. I could only hope to have both qualities here, and I’m not exactly performing in front of billions of people.

(As an aside, check out Katelyn Ohashi’s 2019 routine for another excellent example. Gymnastics is awesome because the best examples demonstrate skill and artistic flair. A Russian gentleman I knew in Singapore was able to do this too, and the mix of respect and jealously I felt was palpable)!

I hope this doesn’t sound crass or opportunistic, but these reports actually give me a glimmer of optimism. I’m glad these are being reported for what they are, and that people like Simone can be honest about her thoughts and position. I get the distinct impression that other factors would have been blamed even a decade or so ago by an Olympic team or country.

My hope is we’re finally starting to turn a corner on identifying and being honest about mental health, and that being open about it will encourage others to come forward. Then, eventually, we’ll be able to drop the word “mental” from the phrase, because it’s a health issue regardless of the body appendage in which it manifests.


A FreeBSD Puppet refresher by Romain Tartière

I mostly live in Ansible land for automation, but I was looking for a quick refresher on Puppet. I didn’t have to look far; FreeBSD’s Romain Tartière did a talk at BSDCan 2018, and his slides are still available. This made my morning!

Thanks to BSDCan for continuing to make these resources available.


Fourier transforming X-ray diffraction patterns before computers

I came to newbedev’s site for some help solving a specific FreeBSD problem, but stayed over lunch reading chemistry Q&A posts. I’m glad someone out there set the record straight on the efficacy of vinegar and bicarb soda as cleaning products, for example.

Here’s their answer for how x-ray diffraction patterns were deciphered before computers:

Diffraction data was measured on film, with gray-scales to assess intensity of signals. To calculate a Fourier transform, pre-computed tables were used, such as the Beevers-Lipson strips. As Andselisk commented, Fourier transform was used late in the 20s, and initially for problems that were one- or two-dimensional.

Not just in the ’20s but up to the ’90s at least, the d-spacings were estimated by hand measurements of diffractometer peaks or film lines and applying the Bragg formula.

I had to look up what a Beevers-Lipson strip was:

Beevers–Lipson strips were a computational aid for early crystallographers in calculating Fourier transforms to determine the structure of crystals from crystallographic data, enabling the creation of models for complex molecules [..] The approach converted the sizable calculations of multi-dimensional Fourier summations needed in crystallography analysis into sums of more manageable one-dimensional values.

I still can’t get over how much civil and commercial engineering was done with slide rules, pencils, carrying 1s, and thick volumes of constants and pre-computed values. My dad was a chemist, maybe one day he’ll let me rifle through his prized Merck tomes.

Cryptography is the closest analogue (hah!) I can think of in my line of work, assuming that I went from maintaining and building computer systems to shipping physical envelopes around if computers ceased to exist. RSA is easy to grok, but imagine having to encrypt a packet with AES and encrypting that key with RSA for secure transmission… by hand. I suppose we wouldn’t need such bullet-proof ciphers if we weren’t threatened by fast computers that could make light work of them.

So much of our world is dependent on maths being handled elsewhere, transparently or otherwise.


Ashe on motivational interviewing

In early June I wrote about motivational interviewing as a positive way to affect change. Berating yourself to change a habit usually doesn’t work, so why do we think that doing that to others will be any different?

Asherah Connor of kivikakk.ee (web feed here) emailed me a while ago (sorry!) with an article in Psyche by Angela and Ralph Wood, who help to break it down:

How can we find more motivation to make positive changes in our lives?

MI practitioners use their counselling skills, such as open-ended questions and ways to reflect, to evoke what’s called change talk – a conversation about what clients are unhappy about and how they’d like to change. Through an accepting, collaborative and guiding style, this approach seeks to strengthen the person’s commitment to goals they identify for themselves.

This is the best summary I’ve read about the approach. Now we just need, as Ash says, the motivation to do it.

(And as a pointless aside, I think the stock photo they included in the article is of Tania Cagnotto, an Italian Olympic diver. That’s the second mention of sport today. Is this a new record here)?


Harukana Receive, and Olympic sports

This is a bit of a disjointed post, but I’m in a bit of a disjointed mood! We start with Erin Riley’s Bird Site comment this evening that I can’t fault:

I saw someone comment on a friend’s thread on FB yesterday that every Olympic event should include one random person selected from the crowd, just for context, and I am 100% here for that.

The Price is Right, but for athletics! Wait, did I just date myself?

That then reminded me of a conversation I was having with Matt of Digitally Downloaded last week, who ranked Olympic sports:

  • Handball
  • Kayak
  • Rhythmic Gymnastics
  • Beach Volleyball
  • Bouldering

Diving was in my top 5 but then Bouldering debuted this Olympics. Volleyball’s awesome too but Beach Volleyball is better.

I’d only make a couple of small tweaks:

  • Put Diving back in and sub out Kayak. I can’t help but admire the patience, skill, and guts it would take to jump off a platform that height and navigate those impossible maneuvers. I also respect the fact that making the smallest splash possible is the antithesis of bombastic showboatyness.

  • Replace Handball with Table Tennis, because Singapore. This also brings in Badminton as an honourable mention. The mechanics and speed of both seem so utterly implausible, they’re the most gripping sports I’ve ever watched. Why they don’t get more publicity in the West confounds me.

I also second Matt’s enthusiasm with Bouldering becoming an Olympic event. I barely pay attention to sport normally, but I love that the Olympics showcases events that don’t involve kicking a ball. Or if they do, it’d likely be an accident, incredibly painful for the male player, and/or worthy of a penalty.

Which leads us to Beach Volleyball, and probably the briefest anime review I’ve ever done here. I watched Harukana Receive back in 2019 after reading a synopsis by Dee over at The Anime Feminist which gave me an appreciation for the sport I didn’t have before.

Screenshot from the opening of Harukana Receive

The series takes places around the island of Okinawa (I still find it funny that I want to explore the north of Japan, and Clara keeps wanting to island hop in the south! I’ll bet the weather is warmer). The colours and landscape backdrops are so bright and optimistic, I ended up using some as desktop backgrounds last winter.

Our protagonist Ōzora Haruka is enamoured with a couple of players she spots on the beach. She befriends and wins back a former player with a troubled past in the sport, and they all train together for a tournament over the course of the series. We learn about the rules and strategy in a surprisingly respectful and engaging way, like all good sports anime. The fan service is mild given the subject matter, though I’ll admit I wouldn’t have thrown together that quick montage below at a coffee shop (cough).

I won’t lie (as opposed to other times?), it gave me K-On! does Beach Volleyball vibes, with the same emphasis on friendship and personal growth among a cast of likeable and relatable characters (Haruka gave me serious Yui vibes). Episode 8’s shrine and coffee shop wanderings were my favourite, not that I’m predictable or anything. That’s my second mention of coffee shops in a post nominally about something else. I miss going to coffee shops.

Screenshots from Harukana Receive, including my favourite scene at the coffee shop in the lower-right.

Maybe now I can appreciate the real thing a bit more. Does this also mean I need to watch Iwa-Kakeru! (the first search result for “bouldering anime”) too? There’s really a series for everything. Would the Free! boys consider diving at some point?

This wasn’t among the most disjointed posts I’ve ever written, but it has to be up there. Before the ball reaches the ground.


Michael Franks, Heart Like an Open Book

Today’s Music Monday takes me back to this site’s musical roots. Frankly I’m surprised it took this long for him to reappear. Get it, because his name is Michael… ah shut up.

Michael Franks has been my favourite singer/songwriter since I was barely old enough to understand what half his witty lyrics meant. Online guides pigeonhole him as a latin jazz musician, but his repotoure repotoire (damn it) repertoire has also included various forms of jazz funk, fusion, and even a sprinkling of pure 1980s electronica. His music never fails to bring a smile to my face every time he comes up on random.

Play Heart Like An Open Book

“Heart Like an Open Book” comes from his 1999 album Barefoot on the Beach. It was the first album of his that came out when I was old enough to leave the house and rush to the music store to buy it. My music player brought it up twice this afternoon, such was its motivation to remind me of its awesomeness.

These Porta Pro headphones recently lead me to rediscover the great bassline and drums on this specific track. Michael always had such excellent backing musicians.


The need for personal iRL concurrency

Concurrency… con currency… is that Bitcoin? Badda boom boom tish! Tish tish! Badda.

While I’m on a bit of a tear talking about rituals and metal thought processes, I thought I’d also mention something I started to do as a teenager. I’m not sure if programming made me think this way, but even today I have to see pretty much everything I do through the lens of what I can run in parallel.

(That was supposed to be mental thought processes, not metal. I can’t stand metal music. I’m enamoured with the material in laptops and structural framing, though. I miss Apple hardware back when they used magnesium, that was amazing. But I digress).

Take the morning routine I was rambling about over the weekend. I know that it takes a couple of minutes for the shower to warm up, so I shave my face while waiting. I know it takes me as much time to get dressed as it does to boil water, so I put the kettle on first. The kettle only runs when I’ve pre-ground the coffee the day before, otherwise I start grinding first, then boil the water while I’m tipping the grounds into the Aeropress so the water is the optimal temperature.

More specifically during Covid Times, I only go down to reception to pick up mail while I’m on my way back from buying groceries, to limit my use of shared lifts and hallways. I do an embarrassing amount of my podcast production and listening while cleaning. I watch engineering and Hololive YouTube while I eat and exercise.

And yes, it spills over to IT. I can’t update one FreeBSD jail, I have to do them concurrently in different tabs. Audio-only conference calls—the best kind—are when I also mindlessly sort and organise email.

Doing these things concurrently, and at the same time (as my illustrious dad would say) presumably came from the desire for efficiency. It doesn’t take a rocket surgeon or the sharpest spoon in the drawer to realise you complete a bunch of tasks faster if you do as many of them at once. It’s another manifestation of my need to feel like I have control over my environment and circumstances, something that is especially true during These Covid Times.

Unfortunately, it introduces the chance for error. My mental orchestrator is a well-oiled machine when things are predictable and going to plan, but throw a spanner in the works and suddenly all the spinning plates wobble and crash around my feet. The metaphors today are all over the place, like lipstick on a pig. That one didn’t even make sense.

There’s also a sense of paralysis when I have to make a decision about what to do, because I can’t perform tasks in isolation. What could I do at the same time morphed into what should I do, and now its what must I do. Yes, I conform my brain to RFC 2119, like a gentleman. Seeing the world through this rigid framework is frustrating, and leads to dissatisfaction and a sense that I’ve failed if I only perform a single task.

I’m also starting to realise that the gains I thought I was making from these increasingly complex processes are feeding anxiety in ways I didn’t understand until recently. There’s a reason mindfulness exists as a concept; there’s value in being deliberate, and excelling at one thing before moving onto the next.

Learned habits are hard. There are some things I’ll keep doing in tandem, but I need to give myself permission to smell the roses. By themselves, not while attempting to water them or perform gymnastics above them with a conference call going on my phone.