Integrating Red and Blue InfoSec teams

InfoSec typically divides some their people into Red (attack) and Blue (defend) teams. While I agree with the general idea, I’ve often thought it wasn’t sufficiently granular and left a lot out of the InfoSec equation. Up comes this article (https://danielmiessler.com/study/red-blue-purple-teams/) which really digs into what’s missing and how to tie things together. A Purple “team” integrates and facilitates communication between the Red and Blue teams. Further, a Yellow team (builder) and then the combination of the various colors in the Build Attack Defend pyramid, leading to Orange and Green teams, in addition to the Purple team.

WHile it ay overly complicate the picture, the idea is sound, I think – encourage, faciitate, and integrate communications between the various teams/groups. Share knowledge and use that sharing to build a stronger security posture.

Integrating Red and Blue InfoSec teams Read More »

An hub and incubator for food startups

Yeah, that’s right…food startups! I don’t even know how to categorize or tag this but this article (https://www.eastbaytimes.com/2022/03/14/food-innovation-hub-kitchentown-grows-impact-driven-bay-area-startups) explains the concept pretty well. It’s been in operation since 2014 and is helping some pretty interesting startups. You can get more info from the source at https://kitchentowncentral.com/.

An hub and incubator for food startups Read More »

3 new (to me) linux (mac, android,windows) tools

I’ll cut right to the chase, Copyq, syncthing, and tldr.

Copyq, at https://hluk.github.io/CopyQ/, is a clipboard manager for Linux, Windows, MacOS, AND ChromeOS in the Linux environment! It has a GUI as well as a command-line interface and in the ChromeOS environment, captures clips from BOTH Linux and ChomeOS! CHeck out the docs.

Tldr, at https://github.com/tldr-pages/tldr, provides a cheat-sheet-like summary of command options. It’s not as full function as a man page but can often provide just that one bit of info you need. It provides info on Android, Linux, MacOS, Windows, Sun OS(!), and a set of common commands like 2to3 (convert python 2 code to python 3), adb (Android Debug Bridge which can be installed on many different platforms), and atom (a cross-platform editor).

Syncthing, at https://syncthing.net/, is an open source, multi-platform, authenticated, continuous file synchronization program with communications secured by TLS. It works on MacOS, Windows, Linux, Android among many others.

3 new (to me) linux (mac, android,windows) tools Read More »

Understanding (?) time crystals (?)

Yeah, sure. If you can follow everything in this article you’re a better thinker than I am. Nonetheless, I found it a “fun” read (yeah, I have an interesting definition of “fun”). Nonetheless, check out https://nation.lk/online/10-easy-steps-to-half-understanding-time-crystals-173866.html and see if you think it’s a fun read.

Understanding (?) time crystals (?) Read More »

A step closer to a quantum internet

In essence a team of scientists have made great strides in helping two distant quantum computers to become entangled, which is one of the steps necessary to reach a quantum internet. Read more at https://phys.org/news/2022-03-giant-quantum-internet-bell-state.html (but not too much more…it is an article for us normal folks),

A step closer to a quantum internet Read More »

Proof of work vs proof of stake

Energy, in the form of electricity, is how bitcoin and ethereum transactions are validated today. The faster a “miner” can solve a math problem to approve a transaction, the more likely they are to be rewarded with some of the cryptocurrency. And they do that by using a bunch of computers all working together – hence, using electricity. That’s called “proof of work” and is the original idea behind the whole crypto thing. But there’s another idea that’s been catching on – proof of stake – and one that Ethereum has been planning to adopt for quite a while (there are other cryptocurrencies that already use this method). In proof of stake, a prospective validator puts up a stake (a given amount of the cryptocurrency) then one of the prospective validators is chosen algorithmically to validate the transaction. Once validated, another group (“attestors”) confirms and accepts the validation. This is an asttempt to rein in the massive electricity use.

Read more about it at https://www.technologyreview.com/2022/03/04/1046636/ethereum-blockchain-proof-of-stake if you’re interested.

Proof of work vs proof of stake Read More »

Making my bash history more informative

I’m a long time bash user and have found that I really want more information in my bash history file … more than just the typical command number and command line. So, to my .bashrc I’ve added a time stamp, process id, and tty to the history output by setting HISTTIMEFORMAT like so

export HISTTIMEFORMAT="%F %T %Z %z $$ $TTY "

which produces something like

957 2022-03-02 10:37:05 PST -0800 684 /dev/pts/0 history | tail

As you can see, this adds, after the command number, the date as YYYY-MM-DD, the time with timezone and GMT offset, the process id and the tty on which it was entered. I also like to keep track of the commands that are entered when I’m in a certain directory (useful for git and, well, all sorts of things) so I add

export PROMPT_COMMAND="${PROMPT_COMMAND:+$PROMPT_COMMAND ; }"'echo $TTY $$ $USER \
$PWD "$(history 1)" >> ~/.history/$(basename $PWD)'

This appends a history line to a directory in ~/.history which corresponds to the last component of the directory in which the command was entered. So, if my current working directory is ~/dev/git, commands are also appended to ~/.history/git along with the tty on which they were entered, the current process id, the current user and the full working directory which gives me something like

/dev/pts/1 1806 user /home/user/git 951 2022-03-02 10:47:00 PST -0800 1806 /dev/pts/1 ls -l ~/.history

Note, I don’t change HISTFILE so everything is still in one history file. And I use an alias to show history for the current directory

alias cathist='cat ~/.history/$(basename $PWD)'

And, while I’m at it, I enable host name completion with shopt -s hostcomplete and also ask bash to try to save a multiline command in one history entry with shopt -s cmdhist. And if I have lots of space, I allow my history file to grow as large as needed by setting (or unsetting) HISTFILESIZE and HISTSIZE. So I end up with the following lines added to my .bashrc

export HISTSIZE=
export HISTFILESIZE=
shopt -s histappend
shopt -s cmdhist
shopt -s hostcomplete

export HISTTIMEFORMAT="%F %T %Z %z $$ $TTY "
TTY=$(tty)

export PROMPT_COMMAND="${PROMPT_COMMAND:+$PROMPT_COMMAND ; }"'echo $TTY $$ $USER \
$PWD "$(history 1)" >> ~/.history/$(basename $PWD)'

alias cathist='cat ~/.history/$(basename $PWD)

I picked this up from various sources and modified it to fit my needs. Feel free to use or hack as you see fit.

Making my bash history more informative Read More »

What is Web 3.0 and how does it differ from current?

The article at https://www.makeuseof.com/web-2-vs-web-3-whats-the-difference gives a good high level overview of web3 and its differences from our current web/internet (web2 or web 2.0). What it misses is that all those machines that participate in the chain still need to be paid for along with any hosting and network charges, not to mention the additional resource required to validate and add blocks to the chain.

How are they paid for now, in web2? Generally 2 methods: 1 direct subscription fees (New York Times, Wall Street Journal, etc), 2 your personal information (Google, Facebook, LinkedIn, etc). Could this same model be used? Sure but what I’ve seen put forth in many instances is, in order to protect privacy, users directly pay for the resource using some cryptocurrency. In a privacy-focused web, that’s certainly the most private but how much will you be charged for a “transaction” (i.e. a visit to a site, a page refresh, etc.).

I’m not sure any of this has been sorted out yet. Depending on the level of anonymity desired (and expected) by web3 users, it may not be possible to “pay” with your personal information. Some companies are working on directories whereby a user can control what information is made available to all sites, certain sites, etc but, again, this all is still in a major state of flux. I anxiously await the sorting out.

What is Web 3.0 and how does it differ from current? Read More »