Zimmie

https://infosec.exchange/@bob_zim

Dan Kaminsky once said I know how computers work.

Pronouns: he/him

Public Key

npub1vrszqnlexnn3k4fqcumntuenrlymzlc39glt76j09shzhjl55qwshwke3h

NIP-05 Address

bob_zim_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsxpcpqflunfecm25svwde47ve3ljd30ugj504ldf8jct3te062q8gprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmnt2frpkk

Publishing to

relay.momostr.pink

Author Public Key

npub1vrszqnlexnn3k4fqcumntuenrlymzlc39glt76j09shzhjl55qwshwke3h

Show more details

Last Notes

2026-05-12 14:55:10 UTC

- reply

The FCC notice is painful to read. This is my interpretation of it:
2025-12-22: The FCC changes rules to prohibit import of foreign-made UAVs.
2026-01-21: Waivers are issued to allow UAV vendors to continue updating devices already in the US. These waivers expire on 2027-01-01.
2026-03-23: The FCC changes rule to prohibit import of foreign-made routers. Waivers are issued to allow vendors to keep updating routers until 2027-01-01.
2026-05-08: All the waivers’ expiration is pushed back until 2029-01-01, and the division of the FCC which issued them (the OET) is recommending the rules be changed to allow updates forever without a waiver.

2026-05-12 13:40:53 UTC

- reply

> The agency also extended a deadline for foreign-made drones to continue receiving software and firmware updates to January 1, 2029 from January 1, 2027.
First, I remain curious why so many people write sentences like that which go backwards in time as you progress through the sentence. Financial news is always like that, too. “Price target adjusted to ____ from ____”. Ridiculous.
Second, that reads like the FCC is saying drones *must* receive software updates until at least 2029? My understanding is the opposite.

2026-04-27 22:10:58 UTC

- reply

I’m thinking like kay-SA-dee-uh.

2026-04-27 21:53:54 UTC

- reply

And to be sure everybody gets mad, “quesadilla” like how “Cascadia” was formerly pronounced.

2026-03-17 15:53:15 UTC

- reply

Is there not a way to run some innocuous command (get the hostname, or uptime, or something) to get the exact number of affected systems ahead of time?

2026-03-06 13:54:03 UTC

- reply

That combination should work for SATA drives, though there’s doubtless a simpler way to power it.
It might work for SAS drives if you could fine some adapter to let SAS cards use SATA plugs, but I don’t know of one offhand. Pretty much every SAS cable goes to connectors common on SAS backplanes.

2026-02-04 21:01:11 UTC

- reply

A lot of the US is heavily racist. After slavery was limited to prisoners, states used a variety of techniques to prevent Black people from voting. Poll taxes and poll tests (literacy tests, civics tests with biased answers) were favorites. The Voting Rights Act of 1965 explicitly made poll taxes illegal for federal elections. The Supreme Court of the United States also declared poll taxes unconstitutional in 1966.
Incidentally, the literacy tests are where the terms “grandfather clause” and “grandfathered in” come from. Many states allowed a man to skip the literacy test and vote if his father or grandfather had voted before 1867, a date selected to exclude most Black men.

2026-02-04 20:00:07 UTC

- reply

“Legal name” in this case is talking about the voter registration. We register to vote at the US state level. The registration involves name and address (to determine which county, city, town, etc. elections we vote in). We get a registration card (mine arrived two days ago) which lists all of the information about which districts we vote in, and we’re added to the voter rolls available to polling places.
Since US states run their own elections, they all have different rules about how to determine who someone is so they can use their ballot. Many have been adding photo ID requirements, and the name on the photo ID has to match the name on the voter roll. This proposed law is saying beyond just a photo ID, you also have to prove you’re a citizen using documentation with a name which matches the photo ID and the voter registration.
A passport is both a photo ID and proof of citizenship, so it fills both requirements. Everybody else would need to bring a birth/naturalization certificate. When people change their names, they often don’t go down to the county registrar’s office to get a new copy of their birth certificate. They usually just keep the original one and a copy of the name change documentation, as that’s enough for everything else we use a birth certificate for.
It’s ultimately a poll tax, just like the photo ID requirement. Blatantly unconstitutional, but we have an illegitimate Supreme Court.

2026-02-04 17:15:24 UTC

- reply

Births are registered at the local level (county/parrish, below US state), but they confer citizenship at the federal level. The US federal government is the entity which issues passports and social security numbers (basically our national ID number for financial purposes). Driver licenses and most other non-passport IDs are managed by the US states. Depending on who is asking for identity and why, we may need a birth/naturalization certificate, passport, social security number, driver license/state ID number, or a paper utility bill (sometimes needed to prove residency for state and local elections).
US states run their own elections, so rules for voting are all over the place (which is why the USA doesn’t meet the minimum standards for election monitoring by the Carter Center).

2026-02-04 16:07:44 UTC

- reply

Yeah, the EU+UK situation is separately awful, since there’s no super-state authority you can directly be a citizen of (i.e, you can’t be a citizen of the EU directly, only of a state within it). Instead, there’s a mess of individual states all with their own individual idiosyncrasies. Most allow non-resident citizens to vote. Some allow non-citizen residents to vote. Ridiculous, inconsistent documentation standards like the passport situation you mentioned. All based on imaginary lines on the ground.

2026-02-04 14:02:52 UTC

- reply

People with new identities courtesy of witness protection get birth certificates for their new names.
Very few countries allow asylum-seekers to vote in national elections at all, regardless of how well-documented they are. If one becomes a US citizen, they get a certificate of naturalization, which is explicitly listed as acceptable proof of citizenship in the bill.
This proposed law is awful, but those two specific concerns aren’t affected either way.

2025-12-30 20:38:43 UTC

- reply

I like the P (plug) and R (receptacle) on the NEMA identifiers. The IEC situation is annoying, but at least the odds are plugs and the evens are receptacles.

2025-12-19 03:31:15 UTC

- reply

https://infosec.exchange/@bob_zim/115743805762692383

2025-12-08 19:00:39 UTC

- reply

That’s one of the procedural aspects they got right. FBI agents typically use light they bring with them rather than lights in an untrusted building because somebody might have tampered with the building light. For a while, it was relatively common for the kind of people the FBI investigate to connect bombs to their light sockets, so turning on the building lights destroys evidence and potentially kills people. The risk is small, but it’s safer to simply not interact with the light switches at all.

2025-11-25 01:16:35 UTC

- reply

One of the irritating aspects of this is that infighting above you can completely torpedo your work at building that credibility.
But when you’re able to build it, you can do some impressive stuff. My team owns tons of infrastructure other teams depend on. Due to the effort we’ve put into building understanding and relationships, we’re able to do things like roll out updates with speed which seemed impossible two or three years ago.

2025-11-19 23:03:40 UTC

- reply

Solar’s waste problem is worse than nuclear’s for two reasons: nuclear waste becomes less dangerous on its own over time where solar waste (broken panels) doesn’t, and solar produces about two orders of magnitude more hazardous waste by volume than nuclear per TWh.
These photos show all of the waste from the Maine Yankee Nuclear Power Plant. They include both spent fuel (MYNPP was once-through, so no reprocessing) and GTCC steel and concrete from the generator. It produced a little over 126 TWh over its lifetime, which is enough to power New York City (~20M residents) for about 2.3 years.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/578/843/301/493/379/original/8fa2058767b3ffc2.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/578/843/299/494/400/original/45f46a4f90f88fb5.jpeg

2025-11-04 04:21:18 UTC

- reply

I’ve decloaked a few of my pseudonymous identities to coworkers. In one particularly amusing instance, somebody was trying to use part of a thread on a vendor forum to argue with me, but didn’t realize I had already addressed what they were saying later in the thread months earlier.

2025-10-27 11:17:31 UTC

- reply

“A bit” is more than a bit of an understatement. Several years ago, I posted musing about when we might see ransomware spread from public EV chargers to the cars. Zitron started a pile-on basically calling me an idiot because he didn’t understand anything about how EV charging works.

2025-09-27 03:42:54 UTC

- reply

Ah yes, but how many times did that survivorship bias diagram get misclassified?

2025-07-29 10:58:03 UTC

- reply

It’s a 3.5” discassette, of course.

2025-07-15 02:02:34 UTC

- reply

Regarding ART, consider the characterization of Hal in 2001, GERTY in Moon, or (and I think this is the style they’ll use) Lucy in Killjoys. Giving faceless objects a personality is more challenging, but it’s definitely doable.

2025-07-09 21:09:13 UTC

- reply

For anybody not wanting to visit Facebook, it’s 1976 County Road 655 in Farmersville, TX 75442.
Decisions were certainly made on that kitchen. Great house for three couples who can’t stand looking at each other.
And that kid’s bedroom with the decapitator running right over the bunk.

2025-06-25 21:41:28 UTC

- reply

Unfortunately, doesn’t work like it does on TV. Bullets are a lot softer than locks, so it’s mostly a way to end up with a lot of bullet fragments in your face.

2025-06-19 15:43:58 UTC

- reply

Guy on the right is holding a leopard. Cheetahs have distinctive “tears” running down from their eyes.

2025-06-17 20:51:51 UTC

- reply

I’d be okay with cops disabling bodycams as long as anything which happens while the bodycam is off is legally the cop’s fault.
Somebody dies in custody while the cop’s bodycam is off? Cop is automatically guilty of murder 2. Somebody says money disappeared? Cop stole it.
Make them *want* to keep their bodycams on and in good repair.
Of course, getting there seems about as likely as getting rid of qualified immunity.

2025-06-16 18:20:43 UTC

- reply

There are tons from various brands (Dell, EMC, HPE, IBM, Netapp, Promise, Sun, Supermicro). A 2U enclosure fits 12 3.5” drives. 3U fits 15 vertical or 16 horizontal.
4U gets into Backblaze Storage Pod territory. Up to 60 drives per enclosure (sometimes more with weird layouts).

2025-06-04 19:45:22 UTC

- reply

As opposed to the cost of dealing with photovoltaic waste, which we offload onto developing nations. Watt for watt, they produce 2-3 orders of magnitude more waste in both mass and volume than nuclear power does. And the waste from photovoltaic panels doesn’t get less dangerous with time.
Or the cost of dealing with wind turbine waste, which is likely to never be recyclable (turbine blades are fiber-reinforced composites). Right now, the best disposal method is to grind the blades into chips and burn them for process heat. Less toxic than photovoltaic waste, and the risks to workers (like silicosis from grinding the blades into chips) are mostly manageable.
The only power generation methods which makes less dangerous waste than nuclear are geothermal or hydroelectric, both of which depend heavily on geography.

2025-05-25 11:52:12 UTC

- reply

It will work, but raidz1 with spinning drives makes me nervous. Especially big ones. Resilvering after a failure takes a long time, and a second fault on a raidz1 is fatal to the data. Said second fault may not kill the whole set, but it’s likely to.
It can be fine as long as you back everything up and test your ability to restore from those backups.

2025-05-17 01:42:02 UTC

- reply

It seems like the first season of the show will cover All Systems Red (the first book). The last episode is coming on 2025-07-10.
The first two episodes of the show absolutely nailed the feel for me. Some things happen in a different order. The show seems to be spending more time developing the other characters than the book did.
I would wait until the end of the first season, then start on the books so you aren’t actively following two tellings of the same story.

2025-05-14 18:47:30 UTC

- reply

If you need a *lot* of storage capacity (more than eight drives’ worth), take a look at 45Drives. They make physical enclosures based on the Backblaze Storage Pod design. Their main line has rows of 15 3.5” drives (the original design had three rows, hence the name). They make boxes with one, two, three, or four rows. Even the single-row box is pretty big, but all the active parts are off-the-shelf, so it’s very serviceable. No dependency on a particular vendor.
You can get similar results building a system yourself with a desktop case, but the 45Drives systems are a bit nicer.

2025-05-14 18:26:11 UTC

- reply

Not to mention mRNA vaccines and CRISPR-CAS9 germline manipulation (we could *fix* genetic problems like sickle cell disease forever!).

2025-05-12 21:05:00 UTC

- reply

Yeah, the complexity is that at the most basic level, a NAS is just a server connected to one or more disks. Some vendors like Synology, Qnap, and so forth produce an operating system meant to make a few services much easier to manage. A little knowledge of what’s actually going on underneath goes a long way.
I personally trust ZFS the most with my data. btrfs is okay. Those two filesystems have internal checks for the integrity of data which other filesystems don’t have. They may not be able to *fix* data corruption (depends on the deployment), but they can at least spot it and tell you the file is broken and should be restored from a backup. Many Synology models offer btrfs. Qnap’s high end (QuTS Hero) offers ZFS. A separate operating system called TrueNAS can be installed on your own hardware (or hardware from some vendors), and it offers ZFS.

2025-05-12 18:43:18 UTC

- reply

Absolutely!
Note that you can also get used/refurbished devices to save some money, or even build a storage server for yourself to meet your exact requirements.
I’m also a big fan of “refurbished” server drives for primary storage. Modern high-capacity hard drives are filled with helium instead of air, and they are expected to last millions of hours.
There’s a technology called SMR which is used to increase capacity at a performance cost most find unacceptable. It’s mostly used on consumer drives rather than server drives, but you should still look for datasheets on drives and check for it. CMR or PMR are good.

2025-05-12 11:58:25 UTC

- reply

For that much data, you’ll need more than a mirror or two. I would go for an enclosure with at least six drive bays (eight or more if you want smaller, cheaper drives or some more headroom), and I would run the drives in RAID6 or raidz2 (both can tolerate two simultaneous drive failures).
Most of the smaller players like Netgear do devices with 1, 2, or 4 drive bays, but rarely more. Buffalo, Thecus, and Ugreen have models with enough drive bays, but without ECC RAM, so I would personally skip them.
That pretty much leaves Qnap (desktop or rackmount) and iXsystems (mostly rackmount). In Qnap’s current lineup, that would be a TS-632X (6 bays, can’t use ZFS), TS-673A (6 bays + 2 M.2), TS-873A (8 bays + 2 M.2).

2025-05-12 03:12:34 UTC

- reply

About how much data do you need to store? What region of the world are you in? What other requirements do you have?
Qnap sells direct in most territories as far as I’m aware. There are a bunch of other smaller vendors which do, too.

2025-04-26 20:27:42 UTC

- reply

Does the closet have ventilation? That’s generally the biggest limit on how quiet you can get a system.
I’d 4U the max space available? A liquid cooling loop with plates for the video cards plus 2-3U of radiator space on top would let you keep it no louder than the drives pretty easily. Less radiator height could work too, just with more careful placement and fan routing.

2025-04-26 01:51:35 UTC

- reply

In this house, we don’t dial 811.

2025-04-05 12:47:37 UTC

- reply

That would help reading out the codes from the current system, but wouldn’t help with the density or memorability problem. Limiting to 25 distinct Latin letters and nine distinct digits (no i as it’s too easy to confuse with j in lowercase or one when uppercase, and no zero as it’s too easily confused with o), that’s 34 possible values per symbol, or 5.09 (log base 2 of 34) bits of data per symbol. With a list of 4096 words selected to avoid ambiguous pronunciation or spelling (only one of “their” or “there” with input of the other mapped to the selected one), each symbol would represent 12 bits of data, or more than twice as much.

2025-04-05 02:15:53 UTC

- reply

Lat/lon and grid reference are at least standardized. Anybody can interpret them.
What3words doesn’t share the word list, let alone the algorithm to map locations to words or words to locations. They’re the only ones which can tell you which location a given phrase refers to. If their service is down, you’re out of luck. It’s a good idea, but for something as important as location, the implementation is not good enough.

2025-04-05 01:32:12 UTC

- reply

It’s an interesting system, but *super* proprietary. It also has several major issues such as ambiguity due to regional accents and pronunciation differences. Unsuitable for emergency use, yet emergency services keep trying to push it.

2025-03-15 19:32:29 UTC

- reply

This gets into the dichotomy of “cloud”. It’s used to refer both to hugely valuable techniques which can be implemented everywhere like reproducible deployments or fine-grained object storage, and also to shared hosting. The hosting part can be valuable, but in far fewer ways:
1. It’s great for small companies which don’t yet have the ability to forecast demand. Your product becomes an unexpected hit? You don’t have to take the latency of buying more hardware, waiting on shipping, waiting on setup, etc.
2. For big companies, it bypasses crusty old business practices. Microsoft doesn’t care what your patch testing cycle is or what your maintenance windows are; if you store data in their hosted SQL server, they patch it when they feel like it.
3. Accounting witchery. I don’t understand why, but companies are happier to spend more money if it’s on a monthly basis rather than every few years.

2025-02-16 01:52:52 UTC

- reply

Please try to enjoy all casting equally.

2025-01-30 20:48:56 UTC

- reply

Apparently the civilian plane was banking and couldn’t see the military helicopter, and the helicopter thought they saw the civilian plane but they were looking at some other civilian plane.
Not sure if it’s the case here, but military flights routinely have ADS-B disabled. Something something national security something.
The collision was at just 91m altitude. TCAS generally mutes advisories below 300m, right? Otherwise, aircraft would get constant “Climb! Climb!” from reflections and ground clutter as they land.

2025-01-16 20:58:05 UTC

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/840/027/515/673/218/original/a82eca3e18612aae.jpeg

2024-12-20 14:45:48 UTC

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/685/681/262/849/841/original/414e0c1cd8157416.jpeg

2024-12-17 03:24:58 UTC

- reply

Yeah, I drive a *tiny* car, and I almost always let the cars to my sides go into the intersection well before I do.

2024-12-11 17:26:09 UTC

- reply

Factory Five. 😉

2024-11-29 17:44:55 UTC

- reply

Excuse me, but I follow for corn content.
Post cob!

2024-11-27 19:03:15 UTC

- reply

Fortunately, SATAv3.3 (irony alert!) released in 2016-02 and officially declared that pin is now for power disable. There’s still a risk somebody followed the old spec, but it’s getting lower over time. Backplanes and power supplies built in the last few years generally don’t put 3.3v on the pin.
What really irritates me is they could just as easily have said pulling the pin low reboots the drive. Then drives would just work in whatever enclosure.

2024-11-27 18:43:55 UTC

- reply

Yep! Modern drive heads’ fly height is somewhere around 500 picometers. The van der Waals diameter of a helium atom is about 140 picometers, so the head basically rides on top of a bed of helium atoms which act like ball bearings.

2024-11-27 16:52:45 UTC

- reply

Hard drives still need *something* to keep the head from physically touching the platter. With hard vacuum, they would vacuum cement together in a fairly short time.

2024-11-27 15:10:18 UTC

- reply

Yeah, refurb helium-filled datacenter drives are extremely reliable and pretty cheap. 12 TB seems to be the current best price:capacity ratio. I got a pile of 12 TB HGST Ultrastars earlier this year for about $80 each.
For use in an enclosure, you have to watch out for the “Power Disable” feature. It repurposed a pin in the power connector from 3.3v supply to the drive to instead *reboot the drive controller* when it’s pulled high. The idea is to let datacenter operators reboot drives remotely without needing someone to go pull the drive and reinsert it. When you plug a drive which has this feature into a backplane which predates it, the drive’s controller will continually reboot which manifests as the drive never spinning up.

2024-11-27 14:54:45 UTC

- reply

draid is a really cool new-ish feature which is *great* for big deployments like that. It gives you the simplicity of a single vdev (you don’t have to care about the *wrong* three drives failing at once), the IOPS of multiple vdevs, but the headline feature is the distributed spares.
The problem with resilvering in general is that it’s limited to the performance of a single drive: the one you’re resilvering to. By distributing the spare capacity between all of the drives in the vdev, you can resilver *much* more quickly and regain your fault tolerance. You still need to replace the failed drive eventually, but when you do so, you’re already at your design fault tolerance, so it mostly doesn’t matter how long that takes.

2024-11-26 17:59:03 UTC

- reply

With 44 drives and that weird setup, I’d probably use draid2:8d:44c:4s. You lose four drives off the top as distributed spares, then the remaining 40 are split into groups of 8 data plus 2 fault tolerance for 4 groups x 8 drives per group x 12 TB per drive => 384 TB usable before compression.

2024-11-22 23:44:59 UTC

- reply

Yep, it’s excellent. Have you seen Constellation? Also extremely good.
Silo’s second season just started, and it’s just about perfect.

2024-11-18 17:15:19 UTC

- reply

This kind of shot is almost always done with a pinhole camera. You leave the camera in place for a year. Each day, you go out and uncover the pinhole at the same time for a few seconds.

2024-11-13 21:03:20 UTC

- reply

He’s allergic against competence.

2024-11-10 03:20:36 UTC

- reply

An example of why clarity of goals matters. They pushed for fewer pay toilets, when they should have pushed for more free toilets.

2024-11-06 01:06:45 UTC

- reply

My point with the imaginary number is that everybody’s first introduction to them is feeding a negative real number to square root, and a pair of imaginary numbers popping out. Totally different category of value. Any imaginary number is neither less than nor greater than any real number until you do some other work to make them comparable.
“{2,-2}” is a single value for any useful definition of “value”. Just feels like people who make the assertion that square root isn’t a function “because it returns multiple values” have never touched lambda calculus or formal logic.

2024-11-05 23:12:05 UTC

- reply

For as long as I can remember, I was told square root consumes a number and returns a list of two numbers. That’s not multiple values. Each input produces exactly one output, the output just happens to be a list instead of a number. The ability of square roots to return outputs which don’t belong to the same category as the input should be obvious to anybody who has heard of imaginary numbers.
Most of algebra fundamentally wouldn’t work if functions had to return the same category of value they consumed.

2024-11-01 14:19:12 UTC

- reply

At this point, I would put off Severance until December. The new season starts in January.

2024-10-21 14:04:43 UTC

- reply

That’s likely the Birmingham Wire Gauge. Its origins are lost to time, as the numbering was in use before the system was formalized. They are believed to relate to the number of wire drawing operations.
American Wire Gauge descends from the first known attempt in 1855 to make a formal wire gauge measurement system starting from the measurements instead of starting from physical wires. The AWG numbers follow a geometric progression not because of the number of wire drawing operations, but because the system was arranged as a geometric progression. This yields the logarithmic progression of resistance.

2024-09-30 15:54:46 UTC

- reply

Yeah, an open source developer strike would probably look an awful lot like this:
https://en.m.wikipedia.org/wiki/Npm_left-pad_incident

2024-09-29 19:26:36 UTC

- reply

Agreed, adjusting the timesharing to support more clients per tower at the expense of latency and throughput would be a a decent step. Limit each terminal to maybe 2 megabits of data per second, and you have time slots to work with more terminals.
The downside is still that cell connectivity depends on centralized infrastructure. 24 hours of power is massive overkill in almost all situations, yet it’s also far too little for a lot of the natural disasters we’ve been seeing. It can take multiple weeks for power to be restored in some areas, but it’s impractical to require two weeks of backup power at every cell site, especially when 90% of cell sites are likely to go years without ever tapping the backup power. At least since cell towers are pretty tall they can use non-battery power storage (such as a motor connected to a very large concrete block).

2024-09-25 21:10:32 UTC

- reply

WhatsApp belongs to Facebook, which is much more likely to add legislated scanning tech in the endpoint application. Signal would be more likely to stop distributing their client in the EU.

2024-09-25 20:14:08 UTC

- reply

I maintain calling these proposals “encryption backdoors” is dangerously misleading. The encryption is still end-to-end, but these proposals make the ends betray the users. Accuracy here matters, as it explains which part you would need to replace to be safe again if the proposals succeed. For example, you might need to replace WhatsApp, not Signal, even though they ostensibly talk the same protocol.

2024-08-31 18:01:55 UTC

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/057/934/680/096/985/original/a3d276d495ccd4a7.jpeg

2024-08-25 20:58:32 UTC

- reply

I personally think that’s unlikely just because FPGAs are *HUGE* compared to gates implementing the same design. Tons of companies run chip fabs at 100nm and bigger, which is fine for basically everything other than processor (CPU, GPU, TPU, DSP, etc.) cores. It’s also fine for situations where the processor cores don’t need to be fast, and their power consumption is dwarfed by other parts of the system (e.g, the computer in an oven, washing machine, heat pump, printer, home theater receiver, brushless motor driver, etc.).
To switch to FPGAs for most chips, you would need to either accept dramatic reduction in supply (by using small-node capacity) or dramatic increase in size and power consumption of the chips. Both options would come with a dramatic increase in price for all but the smallest production runs.