Josh Wieder

Below, I've included what would have been the first post in a series of posts I wrote about the  badBIOS  controversy in October 2013. I found the evidence in support of badBIOS to be unconvincing and I was concerned by how popular badBIOS became despite those obvious shortcomings. This wasn't a situation where an overexcitable press ran with a story that turned out to be inaccurate; the most early and adamant believers in  badBIOS  weren't reporters, they were ITSEC professionals. How were so many of us publicly duped by what was essentially a conspiracy theory? This post doesn't address badBIOS directly. However, badBIOS was presumed to somehow involve the manipulation of computers using acoustic transmissions. This post provides some historical context behind a strain of computer science research in this field and shows how commonly held beliefs about the feasibility of these attacks were generally inaccurate at the time of writing. In future posts I would ha...

Lets say we have a form. The form is straight-forward: HTML radio buttons that posts to a PHP processing script that saves the results to a database. The radio buttons correspond to bindary responses to questions - Yes/No, True/False. These truth values are mapped to the integers '1' and '0', which are then stored in the database. When such a form is creating new records, this is about as brainless as web-development gets. But things get more complicated when the form is used to update existing records. A useful update form will typically have a few basic features; among them, the option to update all of the data in the form or just some of the data. To do this, we have to check whether a variable is being updated or not. One approach to checking on variable updates is to create an array with all of the variables to be considered, like this:  $stuff = array( 'fee' => $_POST['fee'], 'fi' => $_POST['fi'], ...

This is the latest update of the list of windows license keys for key management service activation I publish every few years. Reference the KMS activation post I wrote for Windows 2012 for help installing one of the keys (` slmgr /ipk yourkeyhere` from a command prompt as an administrator)   Windows Server Semi-Annual Channel versions Windows Server, version 1909, version 1903, and version 1809 Windows Server, version 1909, version 1903, and version 1809 Operating system edition KMS Client Setup Key Windows Server Datacenter 6NMRW-2C8FM-D24W7-TQWMY-CWH2D Windows Server Standard N2KJX-J94YW-TQVFB-DG9YT-724CC Windows Server LTSC/LTSB versions Windows Server 2022 Windows Server 2022 Operating system edition KMS Client Setup Key Windows Server 2022 Datacenter WX4NM-KYWYW-QJJR4-XV3QB-6VM33 Windows Server 2022 Standard VDYBN-27WPP-V4HQT-9VMD4-VMK7H Windows Server 2019 Windows Server 2019 Operating system edition KMS Client Setup Key W...

I can recall listening to a radio program some 10-15 years ago. The host of the show believed that it would soon be possible to build a faster-than-light communications system using quantum entangled particles, and interviewed several people from a company who were seeking funding to somehow make that happen. But why not?  There would be tremendous value in some sort of "quantum phone" of entangled particles that allowed for transferring messages faster than the speed of light.  Quantum computers are a real thing now. Quantum key distribution could very well revolutionize public key cryptography. Yet if anything, quantum computing is a misnomer because it understates how fundamental quantum mechanics has been on recent technological innovation. Quantum mechanics has been around for a century now and all modern computers rely to some extent on the principles of quantum mechanics to function. But there will be no quantum phone. Let's start by explaining how the quantum ph...

I watched  Rob Eastaway's 2019 for the Royal Institute today. Everything from RI is great and worth checking out, but Eastaway delivered a statistic I hadn't come across before: 90% of all spreadsheets contain errors. Mr Eastaway himself had only come across the statistic from another source, the European Spreadsheet Risks Interest Group (or EuSpRIG for short). This is not a trivial issue. EuSpRIG's website has a "horror stories" section that demonstrates the gravity of errors in the wrong type of spreadsheet. Even if we discard the few stories involving malware embedded in spreadsheets like  the BlackEnergy power plant shutdown  - for many reasons it makes sense to count and study malware separately from unintentional human and formulaic errors - the EuSpRIG lists dozens of separate incidents that involve massive financial losses . Taxes, criminal and medical records are all stored on spreadsheets. Single digit error rates have major repercussions. Claims put...

I needed to setup a quick Cassandra environment in Windows today, but I ran into a problem when executing the quick start guide from Cassandra's (excellent) website . The quick start assumes a working Docker environment. Because this is in Windows, WSL 2 has been configured, and the Docker for Windows binary has been properly installed: docker pull cassandra:latest  docker network create cassandra docker run --rm -d --name cassandra --hostname cassandra --network cassandra cassandra From here you can either load data into Cassandra from a file or start a prompt. A prompt is supposed to be opened like this per the documentation: docker run --rm -it --network cassandra nuvo/docker-cqlsh cqlsh cassandra 9042 --cqlversion='3.4.4' This produces an error:   Error messages like this can be a little intimidating. There's a hint, though, in the last line. ValueError and 'invalid literal for int()...

We tend to overestimate the reliability of authority figures, and this impacts how we should analyze data for public policy. Public data is an intrinsic appeal to authority The CDC's WONDER database keeps track of causes of death within the United States . When a death certificate is created for a person in the United States, the certificate includes a special code indicating the cause of death. Through a lengthy process, that information makes its way from the funeral home or hospital to a state registry to the National Vital Statistics System and finally to the CDC. CDC tracks that information in WONDER, which can be partially queried by the public. WONDER is used by scientists, researchers and journalists for all sorts of reasons. It was data from WONDER that largely provided the justification for the claim the the United States has been undergoing an epidemic of heroin addiction. And by any measure, the US has a serious problem with heroin and abuse of other opiate drugs. But W...