The RISKS Digest
Volume 32 Issue 53

Friday, 12th February 2021

Forum on Risks to the Public in Computers and Related Systems

ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

Please try the URL privacy information feature enabled by clicking the flashlight icon above. This will reveal two icons after each link the body of the digest. The shield takes you to a breakdown of Terms of Service for the site - however only a small number of sites are covered at the moment. The flashlight take you to an analysis of the various trackers etc. that the linked site delivers. Please let the website maintainer know if you find this useful or not. As a RISKS reader, you will probably not be surprised by what is revealed…

Contents

Confusing computer-interface complexity causes train crash
Mark Brader
Expectations of GPS accuracy contribute to train derailment
Mark Brader
Boeing calls for global grounding of 777s with Pratt&Whitney engines
NYTimes
NOAA begins transition exclusively to electronic navigation charts
Gabe Goldberg
Weather Service set to discontinue ‘advisories' for hazardous weather in 2024
WashPost
Never seen anything like this': Chaos strikes global shipping
NYTimes
New Browser Attack Allows Tracking Users Online With JavaScript Disabled
The Hacker News
Calling All Ham Radio Operators (
????
Kentucky mom alleges hospital workers missed her cancer, then
????
Microsoft's dream of decentralized IDs enters the real world
WiReD
What the worldwide shortage of semiconductor chips is really
????
Why a YouTube chat about chess got flagged for hate speech
WiReD
Farms are going to need different kinds of robots
bbc.com
The robots are coming for Phil in accounting
NYTimes
Spy agencies have big hopes for AI
The Economist via Ross Anderson
A new type of supply-chain attack with serious consequences is flourishing
Ars Technica
Google will remove facts if they think they're harmful
geoff goodfellow
Thousands of Android and iOS Apps Leak Data From the Cloud
WiReD
Hackers are finding ways to hide inside Apple's walled garden
Techology Review
ICE investigators used a private utility database covering millions to pursue immigration violations
WashPost
L.A. sheriff's office gets warrant for ‘black box’ in Tiger Woods' crashed SUV.
NBC News
Amazon has become a prime revolving-door destination in Washington
Mother Jones
Too much choice is hurting America
Paul Krugman via Richard Stein
CDC Links Restaurant Dining with Spread of Covid-19 in U.S.
Jonathan Spira
Those fever scanners that everyone is using to fight covid can be wildly inaccurate, researchers find
WashPost
The problems with anti-vaccers' precautionary principle arguments
The Logic of Science
You got a vaccine. Walgreens got your data.
Vox
Research highlights impact of Digital Divide
University of Houston
ES&S hashcode testing is wrong in 3 ways
Andrew Appel
At least 30,000 U.S. organizations newly hacked via holes in Microsoft's email software
geoff goodfellow
Texas PUC to electricity users who received outragrous bills from grid mismanagment during winter storm: SCREW YOU!
NPR via Lauren Weinstein
Rookie coding mistake prior to Gab hack came from site's CTO
Ars Technica
What lies beneath… on disaster respone
NYU Tandon
Re: Post Office scandal
Peter Bernard Ladkin
Re: Fed outage shuts down U.S. payment system
John Levine
Re: his lights stayed on during Texas's storm. Now he owes $16,752
John Levine
Info on RISKS (comp.risks)

Confusing computer-interface complexity causes train crash

Mark Brader <msb@Vex.Net>
Thu, 4 Mar 2021 19:19:11 -0500 (EST)

In November 2019, the driver of an “Intercity Express” class 800 train was heading into the maintenance depot at Neville Hill, near Leeds, England. Another empty train was in front of him on the same track into the depot, so he waited for it to start moving, then put on power at the lowest setting.

About 30 seconds later the two trains collided. (There were no injuries, but his train was derailed and both trains needed repairs.)

Although an experienced driver, the man was relatively unfamiliar with the class 800, and didn't realize that even the lowest power setting would accelerate this train so fast. So he'd assumed it was safe to look down at the computerized controls for a little while.

The reason he needed to do this was that, partly for political reasons, the class 800 is equipped both with on-board diesel engines and with a pantograph for overhead electric power. So the pantograph should be raised, and the diesels turned off, if and only if there is an overhead wire. Rather than leave the control of this to fallible humans, it is implemented by computer (“Automatic Power Changeover” or APCO).

Trackside beacons mark the key positions where things have to be done, and the specific train service must be identified to the computer by the driver typing its 4-character code into the control console touchscreen.

The train's previous code of 5D29 had expired when it got to Leeds, and the driver should have changed it to 1D29 to go into the depot, but the system would not accept it. This was because, after typing the 4 characters, he was supposed to touch a “Check Stops” button, which would cause the computer to display a list of the stops for this train service, and then a “Home” button to return the console to the home screen. Well, the driver knew there weren't any stops before getting to the depot, so he skipped Check Stops and just touched “Home”. But what his training on the controls had not mentioned was that this canceled the change of code.

Seeing that this hadn't worked, and not wanting the diesels to come on unnecessarily, he used the controls to disable the APCO, and then when he passed the last beacon before the depot, re-enabled it—as he had been trained to, so that the next driver wouldn't be confused. And it was the re-enabling step what distracted him from avoiding the crash.

More detail in “Modern Railways” magazine, January 2021, pages 30-32. Full report, raising a number of points I haven't mentioned here, at: https://assets.publishing.service.gov.uk/media/5fb3c146d3bf7f63e1b6f55a/R132020_201118_Neville_Hill.pdf


Expectations of GPS accuracy contribute to train derailment

Mark Brader <msb@Vex.Net>
Thu, 4 Mar 2021 20:26:16 -0500 (EST)

In January 2020 a freight train derailed on an overpass over a road in north London, England. There were no injuries, but the train was damaged as well as a considerable length of track.

The track on the bridge was supported on wooden beams running lengthwise under the rails (like on the old Great Western Railway) and connected by steel cross-members. This design is lighter than conventional track and therefore allowed the bridge to be more lightly built, but the long-term plan is to eliminate it from use.

In this case the configuration did not allow the wood to be easily inspected, and it had deteriorated, but this was not known. What could readily be done, and was done regularly, was to check the position of the rails by running a track-recording train over the line, and repair any problems seen.

On several occasions in the preceding months, this train had reported a problem in the area of this bridge: the rails were wide to gauge, i.e. too far apart. Crews were sent out to the location it reported, repaired some faults they saw in the track, and then checked that the rails were within the allowed tolerance of the correct gauge.

But the train had reported its position using GPS, and while this was claimed to be accurate to 1 meter, it wasn't. Crews were expected to use handheld GPS devices to locate the same position within 3 meters, but the work they did was a few meters west of the bridge, not where they might have seen the actual problem.

This wasn't the only cause of the accident, but it is the one I'm mentioning here. Full report at: https://assets.publishing.service.gov.uk/media/5faea3a68fa8f55de55af7c9/R122020_201116_Wanstead_Park.pdf


Boeing calls for global grounding of 777s with Pratt&Whitney engines (NYTimes)

Richard Stein <rmstein@ieee.org>
Sat, 6 Mar 2021 23:32:14 +0800

https://www.nytimes.com/2021/02/21/business/faa-boeing-777-engines.html

“Boeing said on Sunday that all 128 of its 777 jetliners powered by a particular Pratt & Whitney engine model should be grounded worldwide until the Federal Aviation Administration determines the best way to inspect the engines.”

Several hundred passengers experienced “the flight of their lives” in two incidents, apparently due to engine blade fracture from metal fatigue.

Curiously, discloses the FAA met a few days before the UAL 328 incident on 20FEB2021 to discuss airline engine inspection frequency. https://edition.cnn.com/2021/02/24/politics/faa-meeting-engine-inspections/index.html

The investigatory dust will eventually settle. A revised Pratt & Whitney jet engine inspection protocol will become regulation standard operating procedure.

The flying public relies on trained and qualified professionals to certify an aircraft as safe-to-fly. Their ethics, competence, and professional judgment are key to sustain aircraft maintenance life cycle, and the air transportation industry reliability. Public safety depends on inspection to determine essential aircraft maintenance actions.

Aircraft maintenance is an example of the “expert service problem.” It is a well-known subject in economics. See “When Trust in an Expert Is Unwise,” via https://www.nytimes.com/2007/11/07/business/07leonhardt.html

“…the same expert who is diagnosing the flaw is the one who will be paid to fix it. In most of these cases, consumers aren't sophisticated enough to make an independent judgment. That's why they went to the expert.”

Jet engine blade fracture from metal fatigue exemplifies the expert service problem. Jet mechanics and engineers apply procedures and tools to diagnose engine problems and recommend maintenance. They are paid to repair engines to achieve safety compliance.

Consumers rely on jet engine maintenance experts to sustain safe-to-fly readiness. Faulty, or compromised, expertise can intensify consumer air transportation risks. These incidents are notable, and sometimes spectacular.

Aircraft maintenance records are apparently analogous to personal medical records: they constitute confidential information requiring protections against disclosure. Devastating economic consequences would materialize if aircraft maintenance records were stolen, manipulated or falsified, and leaked.

Hypotheticals:

How many passengers involved in these two incidents would have chosen to book a different flight if they knew the engine blades on their flights were identified as vulnerable to fracture from metal fatigue? How many passengers would be deterred from booking the flight given the chance to examine the engine inspection records at the point-of-sale?

Risk: Aircraft maintenance record disclosure.


NOAA begins transition exclusively to electronic navigation charts (NOAA)

Gabe Goldberg <gabe@gabegold.com>
Thu, 4 Mar 2021 15:23:34 -0500

As Lauren Weinstein says: [What could go wrong?] NOAA begins transition exclusively to electronic navigation charts

> Well, let's see. How about, if your device battery goes dead or the device
> dies in other ways. Or gets wet maybe and shorts out? You don't have a
> chart any more. Yeah. Great thinking, NOAA! -L

And keep in mind, to be useful, printed charts need to be larger than letter-size paper. So now NOAA expects people to print their own pages and tape them together? Wow.

https://www.noaa.gov/media-release/noaa-begins-transition-exclusively-to-electronic-navigation-charts


Weather Service set to discontinue ‘advisories' for hazardous weather in 2024 (WashPost)

Monty Solomon <monty@roscom.com>
Thu, 4 Mar 2021 22:41:32 -0500

It's part of a larger hazard simplification effort; watches and warnings will remain.

https://www.washingtonpost.com/weather/2021/03/04/national-weather-service-advisories/


Never seen anything like this': Chaos strikes global shipping (NYTimes)

Gabe Goldberg <gabe@gabegold.com>
Sat, 6 Mar 2021 23:15:53 -0500

The pandemic has disrupted international trade, driving up the cost of shipping goods and adding a fresh challenge to the global economic recovery.

https://www.nytimes.com/2021/03/06/business/global-shipping.html

The risk? Everything is connected…


New Browser Attack Allows Tracking Users Online With JavaScript Disabled (The Hacker News)

geoff goodfellow <geoff@iconia.com>
Fri, 12 Mar 2021 11:19:07 -1000

Researchers have discovered a new side-channel that they say can be reliably exploited to leak information from web browsers that could then be leveraged to track users even when JavaScript is completely disabled.

“This is a side-channel attack which doesn't require any JavaScript to run,” the researchers said. “This means script blockers cannot stop it. The attacks work even if you strip out all of the fun parts of the web browsing experience. This makes it very difficult to prevent without modifying deep parts of the operating system.”

In avoiding JavaScript, the side-channel attacks are also architecturally agnostic, resulting in microarchitectural website fingerprinting attacks that work across hardware platforms, including Intel Core, AMD Ryzen, Samsung Exynos 2100, and Apple M1 CPUs =E2=80=94 making it the first known side-channel attack on the iPhone maker's new ARM-based chipsets.

The findings <https://arxiv.org/abs/2103.04952>, which come from a group of academics from the Ben-Gurion Univ. of the Negev, the University of Michigan, and the University of Adelaide, will be presented at the USENIX Security Symposium in August 2020.

Side-channel attacks typically rely on indirect data such as timing, sound, power consumption, electromagnetic emissions, vibrations, and cache behavior in an effort to infer secret data on a system. Specifically, microarchitectural side-channels exploit the shared use of a processor's components across code executing in different protection domains to leak secret information like cryptographic keys.

Additionally, studies have also previously demonstrated fully automated attacks such as Rowhammer <https://arxiv.org/pdf/1507.06955v1.pdf> that rely on nothing but a website with malicious JavaScript to trigger faults on remote hardware, thereby gaining unrestricted access to systems of website visitors. […] https://thehackernews.com/2021/03/new-browser-attack-allows-tracking.html


Calling All Ham Radio Operators

Rebecca Mercuri <notable@mindspring.com>
Mon, 8 Feb 2021 11:30:40 -0500

I'd have thought if they were smarter they'd have used a more obscure code, but this was readily available and reasonably ubiquitous.

https://www.bleepingcomputer.com/news/security/new-phishing-attack-uses-morse-code-to-hide-malicious-urls/

Writer Lawrence Abrams describes the attack as follows:

An email includes an HTML attachment named in such a way as to appear to be an Excel invoice for the company. These attachments are named in the format ‘[company_name]_invoice_[number]._xlsx.hTML.’ The attachment includes JavaScript that maps letters and numbers to Morse code. For example, the letter ‘a.-’ and the letter ‘b’ is mapped to ‘-..​.’, etc.

The script then calls a decodeMorse() function to decode a Morse code string into a hexadecimal string. This hexadecimal string is further decoded into JavaScript tags that are injected into the HTML page.These injected scripts combined with the HTML attachment contain the various resources necessary to render a fake Excel spreadsheet that states their sign-in timed out and prompts them to enter their password again.

Once a user enters their password, the form will submit the password to a remote site where the attackers can collect the login credentials.

This campaign is highly targeted, with the threat actor using the logo.clearbit.comservice to insert logos for the recipient's companies into the login form to make it more convincing. If a logo is not available, it uses the generic Office 365 logo.


Kentucky mom alleges hospital workers missed her cancer, then covered up their mistake (NBC News)

Monty Solomon <monty@roscom.com>
Wed, 3 Mar 2021 20:09:16 -0500

https://www.nbcnews.com/news/us-news/kentucky-mom-alleges-hospital-workers-missed-her-cancer-then-covered-n1258533


Microsoft's dream of decentralized IDs enters the real world (WiReD)

Gabe Goldberg <gabe@gabegold.com>
Wed, 3 Mar 2021 20:23:10 -0500

The company will launch a public preview of its identification platform this spring—and has already tested it at the UK's National Health Service.

For years, tech companies have touted blockchain technology as a means to develop identity systems that are secure and decentralized. The goal is to build a platform that could store information about official data without holding the actual documents or details themselves. Instead of just storing a scan of your birth certificate, for example, a decentralized ID platform might store a validated token that confirms the information in it. Then when you get carded at a bar or need proof of citizenship, you could share those pre-verified credentials instead of the actual document or data. Microsoft has been one of the leaders of this pack—and is now detailing tangible progress toward its vision of a decentralized digital ID.

https://www.wired.com/story/microsoft-decentralized-id-blockchain/


What the worldwide shortage of semiconductor chips is really teaching us (guardknox.com)

Richard Stein <rmstein@ieee.org>
Sat, 6 Mar 2021 11:18:36 +0800

https://blog.guardknox.com/what-the-worldwide-shortage-of-semiconductor-chips-is-really-teaching-us

“After the start of development, every change request requires a lengthy process to approve, as suppliers are attempting to increase the impact of the change (due to financial and risk considerations) and the OEMs are trying to downplay the change (to reduce costs). This leads to a very inflexible process. This is made worse by the fact that introducing additional suppliers or specialized suppliers to solve a particular issue, is almost impossible. This is true for software level changes, and even more so for hardware level changes.”

“The Resilient Enterprise: Overcoming Vulnerability for Competitive Advantage,” by Yossi Sheffi teaches that whipsawing multiple suppliers on price and quantity procurement affords a reflexive means to sustain manufacturing capacity. (https://www.amazon.com/Resilient-Enterprise-Overcoming-Vulnerability-Competitive/dp/0262693496)

But if there's a supply shortage? One cannot whipsaw during a supply deficit without procurement cost escalation (aka biding war).

The semiconductor manufacturing shortage reveals a global capacity gap arising from pandemic-driven demand signals, similar to commodity shortages (oil or rare earth metals) when demand out-paces supply. Semiconductor manufacturing is principally performed in Asia; the US and Europe dominate semiconductor design, but find greater profit margins from license royalties.

What drove the semiconductor manufacturing exodus from US and European shores? Follow the money: “The Private Equity Party Might Be Ending. It's About Time,” @ https://www.nytimes.com/2021/02/28/opinion/business-economics/private-equity-reckoning.html.

Risk: Market-driven industrial policy


Why a YouTube chat about chess got flagged for hate speech (WiReD)

Gabe Goldberg <gabe@gabegold.com>
Wed, 3 Mar 2021 20:38:09 -0500

AI programs that analyze language have difficulty gauging context. Words such as black, white, attack can have different meanings.

Last June, Antonio Radic [with superscript c overstrikc '], the host of a YouTube chess channel with more than a million subscribers, was live-streaming an interview with the grandmaster Hikaru Nakamura when the broadcast suddenly cut out.

Instead of a lively discussion about chess openings, famous games, and iconic players, viewers were told Radic's video had been removed for harmful and dangerous content*. Radic saw a message stating that the video, which included nothing more scandalous than a discussion of the King's Indian Defense, had violated YouTube's community guidelines. It remained offline for 24 hours.

Exactly what happened still isn't clear. YouTube declined to comment beyond saying that removing Radic's video was a mistake. But new study suggests it reflects shortcomings in artificial intelligence programs designed to automatically detect hate speech, abuse, and misinformation online.

https://www.wired.com/story/why-youtube-chat-chess-flagged-hate-speech/


Farms are going to need different kinds of robots (bbc.com)

Richard Stein <rmstein@ieee.org>
Sun, 7 Mar 2021 10:43:41 +0800

https://www.bbc.com/news/business-56195288

“From autonomous harvesting robots and drones that can spray crops, to artificial intelligence, and the use of ‘big data’, farmers around the world are turning to high-tech solutions to address issues ranging from food insecurity, to climate change, and pandemic-induced staff cuts.”

“Collectively, this increased use of technology in agriculture is known as ‘precision farming’, and it is a booming industry. One report suggests that its global value will reach $12.9bn (£9.1bn) by 2027, with average annual growth of 13% between now and then.”

US Department of Agriculture estimates 2019 agricultural and food sector economy @ US$ 1.1T. The farm contribution to this US$ 1.1T figure is ~US$ 125B with the food service industry (restaurants, primarily) contributing ~US$ 400B. https://www.ers.usda.gov/data-products/ag-and-food-statistics-charting-the-essentials/ag-and-food-sectors-and-the-economy/)

I cannot locate farm expense breakdown (labor, seed, fertilizer, pesticide, irrigation, equipment, insurance, power) to estimate rate of robotic substitution for human harvest given the projected 13% ‘precision farming’ growth rate.

Robotic farm operations will emerge as corporate cost reduction strategies are pursued.

Risk: ‘Precision farming’ practices reduce ecosystem genetic diversity, promote pesticide resistance


The robots are coming for Phil in accounting (NYTimes)

Gabe Goldberg <gabe@gabegold.com>
Sat, 6 Mar 2021 14:58:48 -0500

Workers with college degrees and specialized training once felt relatively safe from automation. They aren't.

The robots are coming. Not to kill you with lasers, or beat you in chess, or even to ferry you around town in a driverless Uber.

These robots are here to merge purchase orders into columns J and K of next quarter's revenue forecast, and transfer customer data from the invoicing software to the Oracle database. They are unassuming software programs with names like Auxiliobits DataTable To Json String, and they are becoming the star employees at many American companies.

Some of these tools are simple apps, downloaded from online stores and installed by corporate I.T. departments, that do the dull-but-critical tasks that someone named Phil in Accounting used to do: reconciling bank statements, approving expense reports, reviewing tax forms. Others are expensive, custom-built software packages, armed with more sophisticated types of artificial intelligence, that are capable of doing the kinds of cognitive work that once required teams of highly-paid humans.

https://www.nytimes.com/2021/03/06/business/the-robots-are-coming-for-phil-in-accounting.html

Great. It's bad enough now having errors introduced by undebuggable spreadsheets, now there'll be black-box apps massaging numbers. It'll all be gospel, of course. What could go wrong.


Spy agencies have big hopes for AI

Peter Neumann <neumann@csl.sri.com>
Thu, 4 Mar 2021 11:34:13 PST

[Thanks to Ross Anderson]

The Economist has just run a piece that's bang on topic:

https://www.economist.com/science-and-technology/2021/03/02/spy-agencies-have-big-hopes-for-ai

Spy agencies have big hopes for AI; This isn't their first attempt The Economist, 2 Mar 2021

When it comes to artificial intelligence (AI), spy agencies have been at it longer than most. In the cold war, America's National Securit Agency (NSA) and Britain's Government Communications Headquarters (GCHQ) explored early AI to help transcribe and translate the enormous volumes of Soviet phone-intercepts they began hoovering up in the 1960s.

Yet the technology was immature. One former European intelligence officer says his service did not use automatic transcription or translation in Afghanistan in the 2000s, relying on native speakers instead. Now the spooks are hoping to do better. The trends that have made AI attractive for business—more data, better algorithms, and more processing power to make it all hum—are giving spy agencies big ideas, too.

On February 24th GCHQ published a paper on how AI might change its work. “Machine-assisted fact-checking” could spot faked images, check disinformation against trusted sources and identify social-media bots. AI might block cyber-attacks by “analysing patterns of activity on networks and devices”, and fight organised crime by spotting suspicious chains of financial transactions.

This sort of thing is now commonplace. The Nuclear Threat Initiative, an NGO, recently showed that applying machine learning to publicly available trade data could spot previously unknown companies suspected of involvement in the illicit nuclear trade. But spy agencies are not restricted to publicly available data.

Some hope that, aided by their ability to snoop on private information, such modest applications could pave the way to an AI-fueled juggernaut. “AI will revolutionise the practice of intelligence, gushed a report published on March 1st by America's National Security Commission on Artificial Intelligence, a high-powered study group co-chaired by Eric Schmidt, a former executive chairman of Alphabet, Google's parent company; and Bob Work, a former deputy defence secretary.

The report does not lack ambition. It says that by 2030 America's 17 or so spy agencies ought to have built a "federated architecture of continually learning analytic engines" that crunches everything from human intelligence to satellite imagery to foresee looming threats. The commission points approvingly to the Pentagon's response to covid-19, which integrated dozens of data sets to identify covid hotspots and manage demand for supplies.

Yet what is possible in public health is not always so easy in national security. Western intelligence agencies must contend with laws governing how private data may be gathered and used. In its paper, GCHQ says that it will be mindful of systemic bias, such as whether voice-recognition software is more effective with some groups than others, and transparent about margins of error and uncertainty in its algorithms. American spies say, more vaguely, that they will respect ‘human dignity, rights, and These differences may need to be ironed out. One suggestion made by a recent task force of former American spooks in a report published by the Centre for Strategic and International Studies (CSIS) in Washington was that the Five Eyes intelligence alliance—America, Australia, Britain, Canada and New Zealand—create a shared cloud server on which to store data.

In any case, the constraints facing AI in intelligence are as much practical as ethical. Machine learning is good at spotting patterns—such as distinctive patterns of mobile-phone use—but poor at predicting individual behaviour. That is especially true when data are scarce, as in counter-terrorism. Predictive-policing models can crunch data from thousands of burglaries each year. Terrorism is much rarer.

That rarity creates another problem, familiar to medics pondering mass-screening programs for rare diseases. Any predictive model will generate false positives, in which innocent people are flagged for investigation. Careful design can drive the false-positive rate down. But because the "base rate" is lower still—there are, mercifully, very few terrorists—even a well-designed system risks sending large numbers of spies off on wild-goose chases.

Even the data that do exist may not be suitable. Data from drone cameras, reconnaissance satellite and intercepted phone calls, for instance, are not currently formatted or labeled in ways that that are useful for machine learning. Fixing that is a “tedious, time-consuming, and still primarily human task exacerbated by differing labeling standards across and even within agencies”, notes the CSIS report. That may not be quite what would-be spies signed up for.


A new type of supply-chain attack with serious consequences is flourishing (Ars Technica)

Tom Van Vleck <thvv@multicians.org>
Sun, 7 Mar 2021 11:21:02 -0800

https://arstechnica.com/gadgets/2021/03/more-top-tier-companies-targeted-by-new-type-of-potentially-serious-attack/

Ars Technica article by Dan Goodin:

The goal of these attacks is to execute unauthorized code inside a target's internal software build system. The technique works by uploading malicious packages to public code repositories and giving them a name that's identical to a package stored in the target developer's internal repository.

Two attack mechanisms are mentioned in the article: putting evil code in a module with the same name as a target developer's code but with an apparently newer version, or putting the evil code in a post-install script which is part of the fake package.

The people tricked by these attacks trusted external repositories and package manager programs that turned out to be vulnerable. Ken Thompson's 1984 "Reflections on Trusting Trust" is a clear description of the risk. "The moral is obvious. You can't trust code that you did not totally create yourself." https://dl.acm.org/doi/pdf/10.1145/358198.358210

(In the 1990s I worked for Silicon Valley companies that had a strongly enforced policy against using any kind of code obtained from the Internet, public domain or not. This rule was justified as a way to avoid intellectual property disputes.)


Google will remove facts if they think they're harmful

geoff goodfellow <geoff@iconia.com>
Fri, 5 Mar 2021 15:48:08 -1000

https://twitter.com/sullydish/status/1367951537260072961


Thousands of Android and iOS Apps Leak Data From the Cloud (WiReD)

Gabe Goldberg <gabe@gabegold.com>
Sat, 6 Mar 2021 22:12:00 -0500

It's the digital equivalent of leaving your windows or doors open when you leave the house—and in some cases, leaving them open all the time.

For years, simple setup errors have been a major source <https://www.wired.com/story/amazon-s3-data-exposure/> of exposure <https://www.wired.com/story/magecart-amazon-cloud-hacks/> when companies keep data in the cloud. Instead of carefully restricting who can access the information stored in their cloud infrastructure, organizations too often misconfigure their defenses. It's the digital equivalent of leaving the windows or doors open at your house before going on a long vacation. That leaky data problem applies to more than just the web services that typically grab headlines. Mobile security firm Zimperium has found that these exposures pose a major problem for iOS and Android apps as well.

Zimperium ran automated analysis on more than 1.3 million Android and iOS apps to detect common cloud misconfigurations that exposed data. The researchers found almost 84,000 Android apps and nearly 47,000 iOS apps using public cloud services—like Amazon Web Services, Google Cloud, or Microsoft Azure in their backend as opposed to running their own servers. Of those, the researchers found misconfigurations in 14 percent of those totals — 11,877 Android apps and 6,608 iOS apps—exposing users' personal information, passwords, and even medical information.

https://www.wired.com/story/ios-android-leaky-apps-cloud/


Hackers are finding ways to hide inside Apple's walled garden (Techology Review)

Monty Solomon <monty@roscom.com>
Thu, 4 Mar 2021 21:49:15 -0500

https://www.technologyreview.com/2021/03/01/1020089/apple-walled-garden-hackers-protected/


ICE investigators used a private utility database covering millions to pursue immigration violations (WashPost)

Monty Solomon <monty@roscom.com>
Thu, 4 Mar 2021 22:11:11 -0500

ICE's use of the vast database offers another example of how government agencies have targeted commercial sources to access information they are not authorized to compile on their own. One researcher called it a ‘massive betrayal of people's trust': “When you sign up for electricity, you don't expect them to send immigration agents to your front door.”

https://www.washingtonpost.com/technology/2021/02/26/ice-private-utility-data/


L.A. sheriff's office gets warrant for ‘black box’ in Tiger Woods' crashed SUV. (NBC News)

Monty Solomon <monty@roscom.com>
Wed, 3 Mar 2021 20:12:29 -0500

https://www.nbcnews.com/news/us-news/l-sheriff-s-office-gets-warrant-black-box-tiger-woods-n1259450


Amazon has become a prime revolving-door destination in Washington (Mother Jones)

Gabe Goldberg <gabe@gabegold.com>
Wed, 3 Mar 2021 20:44:25 -0500

Its interests probably transverse the U.S. government more than any other company.

Everything about Amazon is big. It's the second-biggest retailer in the world. Its founder, Jeff Bezos, possesses the biggest fortune in the world. And the company has developed a big revolving door in Washington through which government officials and employees whisk and land in well-paying jobs at Amazon, which has a big list of interests it seeks to protect and advance in the nation's capital.

A Mother Jones investigation has identified at least 247 US government officials and employees—with about 150 hailing from the intelligence, cybersecurity, law enforcement, and military fields—who were hired by Amazon in the past 10 years or so. About 200 of them have been retained by the fast-growing company since the start of 2017. This list is not comprehensive and represents what is likely only a portion of federal employees who left government service for Amazon. It was compiled by searching LinkedIn and locating people who, according to their profiles, had worked in the federal government directly before moving to Amazon; it relies on information provided by the platform's users. There are no public records that track all the US officials and employees hired by Amazon or other firms.

https://www.motherjones.com/politics/2021/03/amazon-has-become-a-prime-revolving-door-destination-in-washington/

“transverse”?


Too much choice is hurting America (NY Times)

Richard Stein <rmstein@ieee.org>
Thu, 4 Mar 2021 11:28:03 +0800

https://www.nytimes.com/2021/03/01/opinion/deregulation-health-care-electricity.html

"But the argument that more choice is always good rests on the assumption that people have more or less unlimited capacity to do due diligence on every aspect of their lives—and the real world isn't like that. People have children to raise, jobs to do, lives to live and limited ability to process information."

Due diligence fulfillment is exhausting, and requires specific subject matter expertise to competently pursue. A consumer cannot conceivably comprehend all supply chain intricacies that either promote or suppress product risks. Restricted product information disclosure conceal industrial trade secrets or other intellectual property, information essential to aid consumer safety or health determination. The law and regulation, when enforced, usually deters irresponsible and harmful products from entering the marketplace.

Public trust abuse accrues from product failures. These unfortunate, often spectacular, events elevate awareness of product risks. Public trust erodes when these incidents are traced to industry-influenced political decisions and legislation directing regulators to cede approval authority. Self-certification authority is a political choice that empowers businesses to deprioritize public health and safety interests.

Krugman concludes, "So the next time some politician tries to sell a new policy—typically deregulation—by claiming that it will increase choice, be skeptical. Having more options isn't automatically good, and in America we probably have more choices than we should."

Self-certification accelerates product approvals and marketplace introduction, but diminishes consumer protections to a legal thread dangling by "terms of service," a frail substitute for independent oversight and skilled judgment of product safety—the last line of consumer defense. The self-certification juggernaut might sail on, but disaster trails its wake.

Risk: Deregulation.


CDC Links Restaurant Dining with Spread of Covid-19 in U.S.

<jonathan.spira@accuramediagroup.com>
March 7, 2021 4:34:42 JST

[Definitively]

This is more definitive than what has been “speculated” in the past.

CDC Links Restaurant Dining with Spread of Covid-19 in U.S.

“…In cases where counties in the United States allowed on-premises dining, case and death rates sped up. … In counties where states required masks, case and death rates slowed…”


Those fever scanners that everyone is using to fight covid can be wildly inaccurate, researchers find (WashPost)

Richard Stein <rmstein@ieee.org>
Fri, 5 Mar 2021 12:39:52 +0800

https://www.washingtonpost.com/technology/2021/03/05/fever-scanner-flaws-covid/

"A flood of thermal scanners hit the market last year with promises to detect the signs of possible infection. But many of the devices use software that can make a feverish person appear perfectly well."

False positive/false negative thermometer readings can endanger public health and cause unnecessary inconvenice.

The FDA's Total Product Life Cycle platform assigns product code FLL to regulate devices identified as "Thermometer, Electronic, Clincial." The product code captures medical device reports for oral thermometers, tympanic thermometers, and screening thermographic devices.

See https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfTPLC/tplc.cfm?id=2611 for a list of equivalent devices and recalls. The page identifies ~41 unique suppliers.

The last recall was in 04FEB2020 for a Cardinal Health 200, LLC tympanic thermometer unit. For recall content, see: https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfres/res.cfm?start_search=1&event_id=84202

The top-10 device problems traced to medical device reports, in CSV format:

Device Problems,MDRs with this Device Problem,Events in those MDRs
Thermometer,132,132
Adverse Event Without Identified Device or Use Problem,80,80
False Negative Result,64,64
Insufficient Information,60,60
Power Problem,33,33
Incorrect, Inadequate or Imprecise Resultor Readings,31,31
Battery Problem,29,29
Product Quality Problem,27,27
Nonstandard Device,27,27
Device Issue,22,22
Device Operates Differently Than Expected,18,18

The top-10 patient problems traced to medical device reports, in CSV format:

Patient Problems,MDRs with this Patient Problem,Events in those MDRs
Fever,143,143
No Known Impact Or Consequence To Patient,116,116
No Consequences Or Impact To Patient,25,25
Seizures,17,17
No Information,12,12
No Patient Involvement,8,8
Patient Problem/Medical Problem,6,6
Blood Loss,5,5
Foreign Body In Patient,5,5
No Code Available,4,4

The problems with anti-vaccers' precautionary principle arguments (The Logic of Science)

Gabe Goldberg <gabe@gabegold.com>
Sat, 6 Mar 2021 23:25:47 -0500

Invoking the precautionary principle is a favorite tactic of anti-vaccers, anti-GMO activists, and various other groups that are prone to opposing scientific advances, but there are numerous issues with this strategy. The exact definition of the precautionary principle is a bit amorphous and variable, but the general concept is that before taking an action that has potential risks (particularly with the application of something new), the burden of proof should be on the proponent to demonstrate the safety of that action before taking it. There is certainly an element of validity to this. I absolutely agree, for example, that new medications should be tested and shown to be safe before being made publicly available (indeed, that is part of why we have organizations like the FDA that regulate the approval of new drugs). Similarly, months ago when COVID vaccines were in early stages of testing, I and many other ardent pro-vaccers stated that while the vaccines were promising, we wanted to see the results of the tests before drawing any conclusions. That is a completely rational, evidence-based way to approach the situation. New drugs, vaccines, and technologies certainly have the potential to cause harm. So, it is not unreasonable to want safety testing prior to their use.

Where this becomes problematic, however, is in determining what constitutes reasonable evidence. Groups like anti-vaccers have a tendency to stretch the precautionary principle to unreasonable limits and use it as an excuse for science-denial, rather than a legitimate decision-making tool. Usually, what I see is an incorrect insistence that the precautionary principle demands absolute assurance of safety and that it should be used in a strictly binary decision tree where any possible risk means that the thing in question should not be used, regardless of the known benefits. This is very bad risk assessment and ignores important aspects of how science actually works. As I'll explain, science is about probabilities, not absolutes, and you must consider both the risk and benefit of an action.

https://thelogicofscience.com/2021/03/02/the-problems-with-anti-vaccers-precautionary-principle-arguments/


You got a vaccine. Walgreens got your data.

Monty Solomon <monty@roscom.com>
Fri, 5 Mar 2021 12:06:21 -0500

Retail pharmacies are now giving out Covid-19 vaccines, and some of them are using it as an opportunity to profit off your information.

https://www.vox.com/recode/22310281/covid-vaccine-walgreens-cvs-rite-aid-walmart-data


Research highlights impact of Digital Divide

ACM TechNews <technews-editor@acm.org>
Fri, 5 Mar 2021 11:44:09 -0500 (EST)

University of Houston News, 3 Mar 2021 via via ACM TechNews, 5 Mar 2021

Researchers at the University of Houston, Rutgers University, and Temple University found that people with basic IT skills are more likely to be employed, even if their jobs are not explicitly associated with those skills. In addition, the researchers found that people with more advanced IT skills tend to earn higher salaries. The researchers said, "Workers who possess relevant IT skills might have an edge in an increasingly digital economy." The University of Houston's Paul A. Pavlou said the study highlights the need for strong public policy to enable people more likely to deal with employment discrimination, like women and older workers, to obtain basic IT skills. Pavlou said, "Workers are expected to obtain these IT skills themselves, in order to get a job in the first place. And the less-privileged population they are, the harder time they have obtaining these skills that require computer equipment and Internet access."

https://orange.hosting.lsoft.com/trk/click?ref=znwrbbrs9_6-29c88x228ff6x068077&


ES&S hashcode testing is wrong in 3 ways

Andrew Appel <appel@princeton.edu>
Fri, 5 Mar 2021 06:52:38 -0500 (EST)

We just published this article: Andrew Appel and Susan Greenhalgh Voting Machine Hashcode Testing: Unsurprisingly insecure, and surprisingly insecure https://freedom-to-tinker.com/2021/03/05/voting-machine-hashcode-testing-unsurprisingly-insecure-and-surprisingly-insecure/

The accuracy of a voting machine is dependent on the software that runs it. If that software is corrupted or hacked, it can misreport the votes. There is a common assumption that we can check the legitimacy of the software that is installed by checking a hash code and comparing it to the hash code of the authorized software. In practice the scheme is supposed to work like this: Software provided by the voting-machine vendor examines all the installed software in the voting machine, to make sure it's the right stuff.

There are some flaws in this concept: it's hard to find “Call the installed software in the voting machine,” because modern computers have many layers underneath what you examine. But mainly, if a hacker can corrupt the vote-tallying software, perhaps they can corrupt the hash-generating function as well, so that whenever you ask the checker “does the voting machine have the right software installed,” it will say, “Yes, boss.” Or, if the hasher is designed not to say “yes” or “no,” but to report the hash of what's installed, it can simply report the hash of what's supposed to be there, not what's actually there. For that reason, election security experts never put much reliance in this hash-code idea; instead they insist that you can't fully trust what software is installed, so you must achieve election integrity by doing recounts or risk-limiting audits of the paper ballots.

But you might have thought that the hash-code could at least help protect against accidental, nonmalicious errors in configuration. You would be wrong. It turns out that [ https://www.essvote.com/ | ES&S ] has bugs in their hash-code checker: if the “reference hashcode” is completely missing, then it'll say “yes, boss, everything is fine” instead of reporting an error. It's simultaneously shocking and unsurprising that ES&S's hashcode checker could contain such a blunder and that it would go unnoticed by the U.S. Election Assistance Commission's federal certification process. It's unsurprising because testing naturally tends to focus on “does the system work right when used as intended?” Using the system in unintended ways (which is what hackers would do) is not something anyone will notice.

Until somebody does notice. In this case, it was the State of Texas's voting-machine examiner, Brian Mechler. In [ https://ftt-uploads.s3.amazonaws.com/wp-content/uploads/2021/03/03172500/brian-mechler-ESS-exam-report-EVS6110-aug.pdf | his report dated September 2020 ] he found this bug in the hash-checking script supplied with the ES&S EVS 6.1.1.0 election system (for the ExpressVote touch-screen BMD, the DS200 in-precinct optical scanner, the DS450 and DS850 high-speed optical scanners, and other related voting machines). (Read Section 7.2 of [ https://ftt-uploads.s3.amazonaws.com/wp-content/uploads/2021/03/03172500/brian-mechler-ESS-exam-report-EVS6110-aug.pdf | Mr. Mechler's report ] for details).

We can't know whether that bug was intentional or not. Either way, it's certainly convenient for ES&S, because it's one less hassle when installing firmware upgrades. (Of course, it's one less hassle for potential hackers, too.)

Another gem in Mr. Mechler's report is in Section 7.1, in which he reveals that acceptance testing of voting systems is done by the vendor, not by the customer. Acceptance testing is the process by which a customer checks a delivered product to make sure it satisfies requirements. To have the vendor do acceptance testing pretty much defeats the purpose.

When the Texas Secretary of State learned that their vendor was doing the acceptance testing themselves, the SOS's attorney wrote to ES&S to admonish them about it, pledging to ensure all Counties amend their procedures to ensure local officials conduct acceptance testing. The attorney may encounter a problem, though: the ES&S sales contract specifies that ES&S must perform the acceptance testing, or they [ https://ftt-uploads.s3.amazonaws.com/wp-content/uploads/2021/03/04141319/48428_2018-241-Contract.pdf | will void your warranty (see clause 7b) ] .

There's another little gem in Mr. Mechler's report, Section 7.3. The U.S. Election Assistance Commission requires that “ [ https://www.eac.gov/sites/default/files/document_library/files/VVSG.1.0_Volume_1.PDF | The vendor shall have a process to verify that the correct software is loaded, that there is no unauthorized software, and that voting system software on voting equipment has not been modified, using the reference information from the [National Software Reference Library] or from a State designated repository. The process used to verify software should be possible to perform without using software installed on the voting system. ] ” This requirement is usually interpreted to mean, “check the hash code of the installed software against the reference hash code held by the EAC or the State.”

But ES&S's hash-checker doesn't do that at all. Instead, ES&S instructs its techs to create some “golden” hashes from the first installation, then subsequently check the hash code against these. So whatever software was first installed gets to be “golden”, regardless of whether it's been approved by the EAC or by the State of Texas. This design decision was probably a convenient shortcut by engineers at ES&S, but it directly violates the EAC's rules for how hash-checking is supposed to work. So, what have we learned?

We already knew that hash codes can't protect against hackers who install vote-stealing software, because the hackers can also install software that lies about the hash code. But now we've learned that hash codes are even more useless than we might have thought. This voting-machine manufacturer

As a bonus we learned that the EAC certifies voting systems without checking if the validation software functions properly.

Are we surprised? You know: fool me once, shame on you; fool me twice, shame on me. Every time that we imagine that a voting-machine manufacturer might have sound cybersecurity practices, it turns out that they've taken shortcuts and they've made mistakes. In this, voting-machine manufacturers are no different from any other makers of software. There's lots of insecure software out there made by software engineers who cut corners and don't pay attention to security, and why should we think that voting machines are any different?

So if we want to trust our elections, we should vote on hand-marked paper ballots, counted by optical scanners, and recountable by hand. Those optical scanners are pretty accurate when they haven't been hacked—even the ES&S DS200—and it's impractical to count all the ballots without them. But we should always check up on the machines by doing random audits of the paper ballots. And those audits should be “strong” enough—that is, use good statistical methods and check enough of the ballots—to catch the mistakes that the machines might make, if the machines make mistakes (or are hacked). The technical term for those “strong enough” audits is [ https://freedom-to-tinker.com/2019/05/23/how-to-do-a-risk-limiting-audit/ | Risk-Limiting Audit ]

Andrew W. Appel is Professor of Computer Science at Princeton University. Susan Greenhalgh is Senior Advisor on Election Security at [ http://www.freespeechforpeople.org/ | Free Speech For People ] .


At least 30,000 U.S. organizations newly hacked via holes in Microsoft's email software

geoff goodfellow <geoff@iconia.com>
Fri, 5 Mar 2021 16:05:23 -1000

At least 30,000 organizations across the United States—including a significant number of small businesses, towns, cities and local governments — have over the past few days been hacked by an unusually aggressive Chinese cyber-espionage unit that's focused on stealing email from victim organizations, multiple sources tell KrebsOnSecurity. The espionage group is exploiting four newly-discovered flaws in Microsoft Exchange Server email software, and has seeded hundreds of thousands of victim organizations worldwide with tools that give the attackers total, remote control over affected systems.

On March 2, Microsoft released emergency security updates to plug four security holes in Exchange Server versions 2013 through 2019 that hackers were actively using to siphon email communications from Internet-facing systems running Exchange. <https://krebsonsecurity.com/2021/03/microsoft-chinese-cyberspies-used-4-exchange-server-flaws-to-plunder-emails/>

In the three days since then, security experts say the same Chinese cyber espionage group has dramatically stepped up attacks on any vulnerable, unpatched Exchange servers worldwide.

In each incident, the intruders have left behind a “web shell,” an easy-to-use, password-protected hacking tool that can be accessed over the Internet from any browser that gives the attackers administrative access to the victim's computer servers.

Speaking on condition of anonymity, two cybersecurity experts who've briefed U.S. national security advisors on the attack told KrebsOnSecurity the Chinese hacking group thought to be responsible has seized control over hundreds of thousands of Microsoft Exchange Servers worldwide—with each victim system representing approximately one organization that uses Exchange to process email.

Microsoft said the Exchange flaws are being targeted by a previously unidentified Chinese hacking crew it dubbed Hafnium, and said the group had been conducting targeted attacks on email systems used by a range of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. […]

https://blogs.microsoft.com/on-the-issues/2021/03/02/new-nation-state-cyberattacks/ https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/


Texas PUC to electricity users who received outrageous bills from grid mismanagment during winter storm: SCREW YOU!

Lauren Weinstein <lauren@vortex.com>
Sat, 6 Mar 2021 15:12:54 -0800

https://www.npr.org/2021/03/06/974417969/texas-wont-reduce-16-billion-in-electricity-charges-from-winter-storm

and later this one:

https://www.khou.com/article/news/local/puc-overcharge-winter-freeze-electricity-ercot/285-134ee343-7389-4f33-8284-19ea88959968


Rookie coding mistake prior to Gab hack came from site's CTO (Ars Technica)

Gabe Goldberg <gabe@gabegold.com>
Wed, 3 Mar 2021 19:40:26 -0500

Site executive introduces, then removes, insecure code, then hides the evidence.

https://arstechnica.com/gadgets/2021/03/rookie-coding-mistake-prior-to-gab-hack-came-from-sites-cto/

Funny comments…


What lies beneath… on disaster respone (NYU Tandon)

Gabe Goldberg <gabe@gabegold.com>
Sat, 6 Mar 2021 22:14:35 -0500

NYU Tandon-led effort sheds light beneath the surface for NYC disaster response (NYU Tandon School of Engineering)

Project gets NSF City Innovation Challenge award to help communities respond to floods, storms and other disasters by making info on underground infrastructure viewable, usable and shareable.

https://engineering.nyu.edu/news/nyu-tandon-led-effort-sheds-light-beneath-surface-nyc-disaster-response


Re: Post Office scandal (RISKS-32.52)

Peter Bernard Ladkin <ladkin@causalis.com>
Sun, 7 Mar 2021 14:46:26 +0100

The issues with the Post Office Horizon POS system and prosecutions and convictions of subpostmasters for alleged fraud has led to what I believe is the largest referral of possibly-unsafe cases to the Criminal Cases Review Commission in UK history.

I and a number of colleagues, namely Martyn Thomas, Bev Littlewood, Harold Thimbleby and barrister Stephen Mason, have written individually and collectively, and more recently with others, a number of recent papers about these cases, published in the University of London School of Advanced Study's journal Digital Evidence and Electronic Signature Law Review, which Stephen edits.

Volume 17 contains four papers on this issue by Ladkin et al, Ladkin, Marshall and Christie https://journals.sas.ac.uk/deeslr/issue/view/578 . Paul Marshall was invited in 2020 to submit some considerations about the probity of computer evidence to the Parliamentary Under-Secretary of State for Justice in the UK Ministry of Justice, Alex Chalk MP. A public version of this submission (Marshall et al) has been published by DEESLR at https://journals.sas.ac.uk/deeslr/article/view/5240

There are deeper issues involved in this series of cases than that some people were unsafely convicted. Readers of the above articles will see that a certain presumption in English law (since a Law Commission recommendation in 1997) about the correct/incorrect operation of computers comes into question (addressed by Ladkin et al, and in the MoJ submission by Marshall et al). Some of the argumentation used in court was technically spectacularly poor (cf. Ladkin on “Robustness”). And it came to light in a civil case brought by a large number of suffering subpostmasters against Post Office Limited that the developers and operators of the system (Fujitsu and Post Office Limited) had not disclosed pertinent information about the dependability of the Horizon system to defendants that Post Office Limited had prosecuted. Indeed, it is as a result of the superb judgment by Justice Sir Peter Fraser in that civil case that the large number of convictions were referred to the CCRC as possibly unsafe. Fraser J's judgment is at https://www.judiciary.uk/wp-content/uploads/2019/12/bates-v-post-office-judgment.pdf

It is over 300pp long but bears close reading for those interested in the behaviour of large IT systems; I anticipate it will become a "landmark judgment".

Because of these deeper issues, I anticipate that these cases will continue to reverberate for some time in the English judicial system. Some people have worked on this matter for decades. Stephen Mason is one. He obtained and published the transcript in DEESLR of the criminal case of subpostmaster Seema Misra. It is because of Stephen's persistence that Martyn, Bev, Harold and I became involved. A blog with extensive, detailed references is maintained by Nick Wallace at https://www.postofficetrial.com


Re: Fed outage shuts down U.S. payment system (Ars Technica)

“John Levine” <johnl@iecc.com>
7 Mar 2021 12:44:41 -0500

Re: https://arstechnica.com/tech-policy/2021/02/fed-outage-shuts-down-us-payment-systems-for-more-than-an-hour/

The ACH system suffers from having been cutting edge when it was set up, and is now aging badly. The U.S. is also unique in having over 4000 banks and 5000 credit unions. Some are large and well known but there is a long tail that are very small and not very sophisticated. (By comparison, France and the UK each have about 400 banks.) I hear that some of the small banks still do their ACH transfers with a daily FTP session.

The Federal Reserve is working on a faster and more modern payment system called FedNow, but the rollout will be slow as all of those tiny banks and credit unions have to figure it out and get connected. Since this is the US, some big banks have a competing system called TCH which they claim is just as good, no need for FedNow, but it is unlikely to reach all those small banks, at least not at a price they can afford.


Re: his lights stayed on during Texas's storm. Now he owes $16,752 (RISKS-32.52)

“John Levine” <johnl@iecc.com>
6 Mar 2021 23:16:11 -0500

It must be interesting to live in a world where insurance does not exist.

For the most part, it's true, paying the marginal price is more cost effective. But there is a huge difference between "the most part" and “always”. For the most part, it is more cost effective to pay your medical bills as they occur rather than paying for insurance. But then you're hit but a bus, your bills are a million dollars and you do not have a million dollars. Now what? The market solution is too bad, you die.

In the middle of the freeze, there was no market clearing price. Much of the cheaply built generation system failed so there was no more power to be had, while people with electric heat can't just turn it off or they and their water pipes will freeze. That's why the other 49 states spend money to make their electric system resilient even though it makes the day to day costs a little higher. Ask people in El Paso whether they think they'd be better off with cheaper ERCOT power.

Please report problems with the web pages to the maintainer

x
Top