Eric Grosse

I feel the same about today's NYT piece on location. Don't hope Congress will solve it. Install few apps, only allow fine-location while in use for purposes like traffic-aware navigation, and leave the phone in your car or turned off most of the time. Prefer messaging over calls.

If "Be extra careful, there is a red team exercise underway" makes you change your behavior, you're doing it wrong. Find practices you can follow all the time, or forfeit the right to outrage when your data is lost.

The surprising lesson of that era was that even ordinary low-level civilians, without any military or criminal or political ties, are now legitimate targets of espionage under prevailing international norms, either as paths to more valuable targets or simply as collateral damage.

On this tenth anniversary of Operation Aurora, I'm grateful for not losing my holiday season to cyberattack.

Kudos to @damienmiller @openssh for FIDO Security Key support in ssh. Works splendidly!

As a backup option in the NC3 modernization effort, I argue for a small, open source hotline: https://www.tech4gs.org/nc3-systems-and-strategic-stability-a-global-overview.html …

Backup isn't strictly infosec advice, just a basic life skill. Pilots are taught to have a Plan B and C, to thoroughly understand safety-critical systems they use, and to minimize single points of failure. That's why the 737 MAX MCAS debacle is so uncharacteristic of Boeing.

In both cases: the error was no shock to the code author, but a surprise to me several layers of abstraction away; open source, but so complex it would have been a pain to recompile; high value secret keys were involved so easy workarounds were deliberately unavailable.

Twice in past month, I almost suffered major loss even though backed up offline in several ways. Data was intact, but patched software would no longer read it. I was saved by extreme backup: old unpatched computers in cold storage. These enabled quick diagnosis and recovery.

In wake of the ASUS debacle, @mattblaze reiterates the very good security advice to continue to patch and to backup. I strongly agree, but the combination may be surprisingly harder than it looks.

My first election as a Santa Clara County precinct officer; setting up tables soon. Be sure to vote tomorrow! https://eservices.sccgov.org/rov/ 

Good book,@SangerNYT. I pick "to so harden our defenses". Our country's unique openness then changes from a net liability to an advantage. Actual, known, serious loss is the strongest demonstrated motivator for improving defense.

http://www.wsj.com/articles/data-breaches-will-soon-cost-companies-in-europe … As someone who had a hand in making enterprise breach notification more open over the past decade, I predict this EU policy would have the opposite of the intended effect.

busy week in security announcements from Googlehttps://twitter.com/thinkpanzer/status/835209162699096064 …