Book review: Too Close to Home by Seraphina Nova Glass

Posted on by
Reply

book cover for Too Close to HomeThis novel by Seraphina Nova Glass was appealing. A car bomb goes off killing one of the characters in this idyllic suburban town, and then things start to go immediately wrong. It is an interesting take on the genre I like to call “cul de sac murders” and while there are a bit too many characters for my taste, the plot points are moved along and the mysteries start to pile up. The moms who are sleuthing things are living a double life of detective and raising their kids, and the younger generation is also involved in some of the town’s mysteries. The novel is well written with lots of descriptive devices and keeps you guessing as to who is at the center of all the mayhem and murder up until nearly its end. Highly recommended.

For entrepreneurs, it’s about ecosystem, not exits

Posted on by
Reply

We’ve had another successful exit here in St. Louis for a company that I have been following since its early startup days. It didn’t grab the headlines, it had little to do with AI, but it was significant in that it illustrated just how deep our startup ecosystem has become. The company is GiftAMeal, and it got acquired by another company that you probably have never heard of either, SwipeSavvy.com.

I have witnessed the growth of our local startup community for many years, and this latest acquisition was just another proof point. I’ve known GiftAMeal’s founder since he was in college, where I met and mentored him as he turned his idea into reality. The core idea is that restaurant patrons take pictures of their meals and trigger a series of events that ends up supporting foodbanks. The “supply chain” if you will, is the business logic in GiftAMeal’s software. Restaurants pay them to be a part of the gifting network, which now includes 1200 restaurants and chains and reaches almost every state. I’ve documented their rise in several posts in a local blog (here, here, and here).

The restaurant business has been rocky, especially since the pandemic transformed their business model from dining rooms to takeout and delivery staging areas. And this means that their back office software has to do more with fewer employees. That is where SwipeSavvy comes into focus: they provide a constellation of services, including point-of-sale terminals, kitchen ticketing, loyalty rewards, and customer opinion tracking applications. Point of sale used to be a way to lock a business into a particular piece of hardware. Now with Apple and Google Pay, and contactless payment cards, it has become an integrated software play.

Here you see GiftAMeal’s founder, Andrew Glantz on the left with Swipe Savvy’s CEO Jason Mayoral. They met at a restaurant conference, where discussions eventually led towards the acquisition. “The merger with Swipe Saavy really enabled us to put our foot on the gas, and grow even faster, both to help expand our partner restaurants and continue to build our mission,” Glantz told me.

Since its founding, GiftAMeal has donated nearly three million meals and worked with 185 different food banks. “Hunger can happen to anyone at any time,” said Glantz. “One out of six kids will experience food insecurity on their next meal. It is not anybody’s fault.”

But another part of Glantz’ story is how he has both embraced and been supported by the St. Louis startup ecosystem. In addition to winning various contests, such as Arch Grants (a local funding competition) and  Capital Innovators (a local venture capital firm), he has given back to this ecosystem in spades. “I have mentored many companies as a judge for the Wash U business school and elsewhere. I have also been a guest lecturer at several local college business classes. I am happy to pass along my knowledge and what lessons I have learned to these students and pay it forward.”

Glantz got his idea about ten years ago. His journey shows how rich St. Louis’ startup ecosystem has become, and how a key element is to feed its human pipeline of mentors and supporters with both money and skills. While the exits and acquisitions are important, they don’t tell the whole story, and why I am glad to have helped and kept in touch with Glantz over time.

Book review: Code War: How nations hack, spy and shape the digital battlefield

Posted on by
Reply

Code War: How Nations Hack, Spy, and Shape the Digital BattlefieldAllie Mellen has written an interesting book that takes the reader through a comprehensive historical narrative of the past several decades’ worth of state-sponsored cyber attacks. While there have been numerous books on this topic, what makes this book unique is that she examines attacks that have been attributed to the US, Russia, and China, and shows their common and different approaches, and how they mix cyber warfare with their on-the-ground kinetic battles, such as what is happening in Ukraine over the past several years. 

Mellen comes to this from a deep experience with cybersecurity, including five years as an analyst at Forrester Research and several jobs for private cybersecurity vendors. 

Code War covers a lot of ground – from the earliest days of history to the present era, and how the modern digital age is just another way to repackage some of the ancient analog exploits. That deep historical coverage sets this book apart from other efforts that just skip lightly over the details and relevance of these antecedents. 

Each country has separate ways that they approach cybersecurity, both from offensive and defensive positions. Each also has different contexts in which it evaluates its cyber efforts. The US context is to ensure its national security, maintain a strong economy, and support various freedoms. China wants to maintain its regime stability, protect its national interests, and regain control and influence in Asia. Russia wants to maintain economic stability, ensure its citizens are loyal to the regime, and remain a world superpower. These mixed goals compete and conflict with each other. And while it is great to have goals, the contradictions and conflicts among them make it hard for each regime to clearly evaluate and execute its cyber efforts. 

Part of the problem, when seen in this tripartite context, is that the role and nature of the internet is vastly different among the countries. China’s internet is an instrument of state power, cultivated by absolute control. Russia’s internet is part of an hybrid digital/analog background of warfare against the world’s democracies. And in the US, the internet is part of maintaining a defensive and resilient digital ecosystem. 

One element in common with these efforts is their work to isolate their residents from the global internet community. These “splinternet” efforts restrict  freedom of speech and as Mellen notes, it “becomes more difficult to spread democratic values globally.” She chronicles the key steps of isolation and control of the internet with a series of well-researched case studies.

Mellen proceeds to deconstruct operational playbooks of the three nations, and how they have used cyberattacks to fulfill their social contracts with their citizenry. The American chapters cover a wide range of cyber misdeeds, including one chapter that tells the stories about how Nathan Van Buren and Aaron Swartz independently ran afoul of various federal laws about computer network security. Swartz got caught illegally copying millions of academic research articles in his campaign to make this information more publicly available, eventually killing himself rather than cop a plea. Van Buren was a Georgia cop who was charged with illegally unauthorized access to law enforcement databases, a case that went to the Supreme Court.  

Another historical luminary is a story of how Ben Franklin constructed one of the first disinformation campaigns. Granted, the internet was yet to be invented, but his playbook – using racist overtones – is very similar to many of the present day’s digital campaigns. “Disinformation operations have always been part of the US experience, they are just more easily scalable with the internet,” she writes.

Another story concerns how in the mid-1800s, Edgar Allen Poe was part of an abysmal voting practice called cooping, whereby people voted early and often, receiving free booze for their efforts. Mellen uses this to take a closer look at how American voting practice has become more secure, despite exaggerated recent claims to the contrary. This includes the efforts of the Cybersecurity and Information Security Agency that was once a leader in securing our elections before it lost its mission, its director Chris Krebs and at least a third of its staffers in 2024. 

Most IPJ readers are familiar with the stories about how Iran and Russia hacked our 2016 and 2020 elections, but Mellen dives into the details, showing how Iran for example tried to alter the final voting tabulations in 2020. Also a familiar tale for many readers is the plight of Phil Zimmerman, inventor of Pretty Good Privacy and how it became a legal lightning rod and the first technology to be designated a war-based munition. This has echoes of the current day whereby the Defense Department can designate Anthropic’s AI similarly (and perhaps equally unjustly).

Most of us are familiar with China’s Great Firewall, but Mellen describes its companion isolation and protective programs including the Golden Card Project (its own online financial network) and the Golden Shield Project (its national surveillance and censorship network). Some of these containment efforts have been abject failures, such as the Green Dam software that was a required application begun in mid-2009 to be installed on all Chinese computers and phones. The software was buggy and so unwieldy that the state eventually gave up the project within a few months.

Mellen analyzes numerous Russian attacks and susses out four common elements of their playbooks:

  1. denial of service attacks, including GPS and satellite jamming,
  2. Traditional espionage operations,
  3. Psychological operations, such as phishing, disinformation, and audio/video deepfakes, and 
  4. Malware-based data wipers.

Each of these elements has evolved over time, and carries its own hybrid physical attack vectors to amplify the attack. As I mentioned earlier, Ukraine is where all four of these elements were brought together alongside the physical warmaking machinery to form a single continuous battlespace.

Mellen’s tour through history and technology shows how political leadership has failed to live up to promises with its citizenry to maintain and improve their respective social contracts: China’s prosperity is crumbling, Russia’s safety is evaporating, and America’s economic divide continues to worsen. By having this deep historical dive, the reader can see where things went off the rails, and why.

Missing from her excellent treatment of world powers is a focus on Iran, although it is mentioned briefly in several case studies. Also missing is more than a passing glance at AI. 

Mellen concludes with a dark vision of the “fourth power,” that of the major tech companies who treat their users as “digital peasants living in a world of corporate feudalism. Users till the soil (creating data), pay taxes (such as subscription fees), and live in castles (the digital platforms themselves), having no say in how the kingdom is governed.” The real nation states like China, Russia and the US and the digital nation-states such as Google, Apple, and Meta all want your data and your attention so they can exploit you and leverage your resources.

The Hacker News: Masters of Imitation: How Hackers and Art Forgers Perfect the Art of Deception

Posted on by
Reply

Unmasking impostors is something the art world has faced for decades, and there are valuable lessons from the works of Elmyr de Hory that can apply to the world of defensive cybersecurity. Before you dismiss this wonderfully written lede, you should know that during the 1960s, de Hory gained infamy as a premier forger, passing off counterfeit masterworks of Picasso, Matisse, and Renoir to unsuspecting collectors and renowned museums. Over the next several decades, more than a thousand of his works slipped past experts who relied on trusted signatures, familiar patterns, and reputable provenance.

I wrote a piece for The Hacker News about how finding fake network traffic is an important aspect of your cyberdefense.

Moving day

Posted on by
4

Back in 1993, I took the radical (at the time) step of requesting a new domain, strom.com. I say request because back then there wasn’t any actual “purchase” – the internet was still relatively new to the general public, and all it took to become master of your domain was a simple email request, which was satisfied within minutes. Let us pause to remember and honor these simpler times.

As you well know, over the 32 years I have used that domain for my own promotion and business. But the time has come for me to sell the domain. And for those of you that are thinking about doing this, I am writing an article about the experience for the Internet Protocol Journal. I found that it wasn’t a simple or straightforward process, and my goal with this article is to help you think it through before you finalize your own domain sale. To help with my reporting, if you have sold or bought a domain name and want to share your own lessons learned, I would love to hear from you.

BTW, my new email is david@webinformant.com. Please change your address books now.

This isn’t the first time I sold my digital assets. In 2020 for IPJ, I wrote about selling an unused IPv4 address block. The process for selling a domain is both more complex and also depends on your particular situation, which I will get into in my article. I was lucky enough to have a short last name, to only use it for my domain, and for having chosen a dot com, which is still the most marketable suffix. For years I regretted that I didn’t own davidstrom.com – that would have been a better choice for my brand, but not as fungible as just my last name. Why? It turns out “strom” is used in a variety of non-English languages and a variety of businesses. One advantage to owning my own name is that I got to come across many other namesakes whom I have e-met or met f2f over the years, along with composing a column with one of them who is a conservative blogger.

I began this transition last year, when I was contacted by a domain broker that I have known for many years. Before I could even begin to contemplate selling, I first had to take stock of my entire digital footprint. That first step was to examine my password manager, which had more than 500 login accounts, many of which used my strom.com credentials as their username. Weeding through that collection was very time consuming and tedious. It would have helped things if before I started the weeding, I had picked what my new email address was going to be. Well, nobody is perfect. I am sure some smarter person would just program something in Python or some AI tool, but I did it the old fashioned manual way of logging into a site, finding where I had to change my user name, and then coping with the flurry of emails confirming that this change was anticipated and not some North Korean hacker that was attempting to use my identity for ill-gotten gains. The good news is that I was able to eliminate more than 150 unused logins.

This part of the migration showed me (and by extension, now you) how brittle our email infrastructure is. I know: tell me something that we don’t know. Some of the login changes required confirmations from both the old and new email address. Some of the logins used a non-email username but hide the email address used to send notifications somewhere in their settings screens. Of course my initial pass through my password vault I forgot about those. For example, with one account (my cell provider), I needed to call them to change my email address. On the phone.

Email addresses also lurk in various dark corners of your digital infrastructure for less obvious notifications. For example, LinkedIn has primary and secondary email addresses, and I forgot to change the latter one, and as I was writing this also remembered that I also had to change the link to my new website.

I am glad now that I took the time and effort to go through all of this. One interesting fact: unlike moving my house, moving my website required no actual transportation of the bits themselves. Thanks to how my hosting provider Pair.com originally designed things, the move was accomplished with a few phone calls and simple commands to link the old website to the new domain. To some of you, that seems obvious, and you are probably smirking as you read this. But to me it was a revelation, and I am thankful that the Pair support folks had the patience to walk me through things.

So moving forward, strom.com will soon be something else and someone else’s property entirely. Part of me is somewhat sad, as I have had that domain for so long, along with a trademark for the webinformant name that I also got back then. (These email newsletters began a year earlier, in 1995.) That reminds me about a story that I can tell you about that name. When I got my mark, I had no idea that it would become a point of contention with a publishing firm that had already begun a series of other “informants.” They contested my mark, claiming that it interfered with their own. I forget the exact legal back-and-forth that I had to go through, but eventually it was a moot point: the company moved on from publishing, as far as I can tell.

The week where I nearly fell victim to scammers

Posted on by
5

Last week I was under attack., and it was completely my own doing. I nearly fell victim to two separate and independent scams. And while I pride myself on recognizing and avoiding these things (perhaps too much, given these situations), it just shows you how anyone can be manipulated.

Let’s talk about the one involving a major sale of Taschen art books. You have seen these coffee table beauties, they typically are quite expensive and cover a wide range of art (including movies and art posters). There was an ad running through my Facebook feed (a sample shown below) that promised all sorts of things, such as “to make room for new editions and updated print runs, we’re clearing a limited selection of archive titles from our warehouse.” Clicking on the ad’s “Shop Now” buttons brought you to an attractively designed page that showed book covers and sale prices that were around $5 a book. There were several warning signs that I ignored, because I was so excited about getting some bargain books: First, paltry descriptions. Second, the domain was a .shop one that didn’t seem to have any relationship with any Taschen brand itself. And the FAQ page looked like it had been written with AI, certainly not on the level of quality that I knew this publishing house was known for.

Now, you can find these books in many used book stores, and they go for at least $25 a piece . But I was blinded by the bargains and so I proceeded to order three books. With shipping, it came to about $30 total. Enter my credit card, and wait — the card was rejected. The name of the vendor was khdfaienceflume. The company was based in Hong Kong, and the purchase was originally in HK$. Okay, something phishy here. I went back and looked up the domain, where I found it was registered a week ago. (Big red flag.) Taschen is based in Germany, btw. So i was saved by my credit card company’s fraud screen. I should have seen these warning signs, and should have followed the cardinal rule: if someone is selling something so cheap that is too good to be true, it probably is.

My second scam was a lot more involved, and it took me a week to figure it out. I got an email from Deven saying that “he was on Spotify and came across my2023 podcast interview.” He claimed to be able to help place me with interviews on other “big-name podcasts,” and mentioned the names of some of his clients that he has helped in the past. None of the names meant anything to me, but I figured what the heck and booked some time with him the following week. All seemed on the up and up until I started getting more than a dozen messages and texts suggesting that I watch some of his promotional hints and tips to making more money doing podcasts, leading up to the day of our eventual virtual meeting. I was starting to get annoyed, but I was eager to hear more about his “sure fire methods.”

Again, I was blinded by the “make money fast” message and missed a few of the cues: some slight misspellings in his messages, the lack of any actual pricing for his services (other than hints that he was expensive), and a failure to check out any of the “big name” clients. I actually connected to the pre-arranged meeting but Deven was a no-show. Then I started investigating: After checking into his clients’ websites, they all shared a common thread: they make a lot of money, they don’t show pricing, and they also don’t have contact info. It all was an elaborate hoax. (You can see a partial screenshot of one of these clients here.) All of the clients had very attractive websites that reflected a lot of time to create their own testimonials and detailed strategies on how they can help you “earn seven figures.” Yeah, right.

I am not sure how Deven was going to get my money, but once again, a major fail.

So: take a moment before you get sucked into the phishing vortex. And let my experiences in Scamville be a potent lesson to you. I n the meantime, I guess I am back to browsing the used book stores in person too.

Book review: How to get away with murder

Posted on by
Reply

Meet Denver Brady, avowed serial killer and author of a book with the same title as this novel. His work forms the book-within-a-book, more of a step-by-step instruction on how to off someone and escape to do it again and again. The book is found in the novel’s primary murder victim’s hands at the start of the novel, which begins the manhunt by inspector Samantha Hansen, who is coming off compassionate leave and back on the force. Sam, as she likes to be called, is beset with loads of problems, both emotional and physical, and has trouble concentrating on clues that should be obvious to her (maybe not for all readers however) as she tries to solve the novel’s murder. She reads along the how-to book and tries to align the clues in the book with the ones she uncovers during the course of her investigation. The novel mostly takes place in and around London, and has loads of plot twists and turns, right up to its very end. I won’t give away any of these because they are deliciously put together. Many murder mysteries run out of gas towards the end but this book — or should I say the combined books — holds your attention until nearly the last page. I highly recommend this novel by Rebecca Philipson.

At least Clippy was cute

Posted on by
3

I was not a fan of Microsoft’s Clippy. But I was waxing somewhat nostalgic about the little paper clip reading all the negative reviews of Microsoft’s latest foray into helpful assistants, its AI-based Copilot. David Linthicum wrote today on LinkedIn about the enterprise backlash, saying, “The company’s decision to introduce new licensing models, charge premium prices for AI features, and encourage hardware upgrades created deep skepticism.” He cited its intrusive design, general unhelpfulness and AI hallucinations, and evidence that just a small percentage of adoption by Office users as major obstacles and says it is a cautionary tale: Microsoft needs to listen more and impose less on its users.

The Rise and Fall of Clippy: From Microsoft's Bold Vision to Internet LegendSome wags (including Marc Benioff) have called Copilot Clippy 2.0. I don’t think that is a fair fight. We should at least bump up the version to 10.0. In many respects, Clippy was ahead of its time (read this historical look back to see why this author called it cutting-edge AI for 1996.)

I haven’t spent much time with Copilot, because I would rather do my internet lookups when I need them, not be distracted by some automated nag. True, Copilot can generate a lot of text with just a simple request. But a lot of AI slop, as it is called. Does it do a better job than Clippy in understanding context? Yes, but it still interrupts the creative flow, or at least my creative flow.

Over the many decades that I have become a not-so-famous writer I have learned how do my searches for the data and links in my stories. Now I type in complete sentences, rather than find three unique words that will drive better results. (That reminds me of What3words.com, which is a fascinating site, but I digress. See how annoying interrupting things can be? Sorry.)

So at least Clippy was cute. It had its detractors too, but also fans such as this short video that showed its future that is surprisingly fresh for something done a decade ago.

And for those of you who want to reanimate Clippy, here is some code that will bring it back to your desktop.

I will leave you with some words of wisdom from a colleague, Theresa Szczurek, who talks about finding joy and fear in AI in her latest newsletter: “You choose when to use AI. You decide where it adds value. You define ethical boundaries. You determine how it supports — not supplants — your strengths. AI is one tool among many. You are still the strategist. The leader. The creator.”

The Hacker News: My Day Getting My Hands Dirty with an NDR System

Posted on by
Reply

As someone relatively inexperienced with network threat hunting, I wanted to get some hands-on experience using a network detection and response (NDR) system. My goal was to understand how NDR is used in hunting and incident response, and how it fits into the daily workflow of a Security Operations Center (SOC). Corelight asked me to write a sponsored piece for The Hacker News about my experience using their Investigator threat hunting software (screenshot below).

While I’m new to threat hunting, I do have experience looking at network traffic flows. I was even an early user of one of the first network traffic analyzers  from Network General called Sniffer. Sniffers were specialized PCs equipped with network adapters designed to capture traffic and packets. These computers were the foundation on which more advanced network monitoring platforms were built. That Wikipedia link shows you how far we have come with designing useful control interfaces.

My day getting down and dirty with Corelight’s Investigator taught me valuable lessons on how to create threat hypotheses, understand how threats move about a network, and, more importantly, gave me an opportunity to learn more about how networks operate and how they can be defended in the modern era.

The future generation of news looks very different from today

Posted on by
2

A new research report from a combined effort of Financial Times Strategies and the Knight Journalism Lab at Northwestern University is now out. Entitled “Next Gen News” it describes a very different future for the way news is gathered, packaged, and consumed. And if I haven’t grabbed you in the seconds it took to read my lede, then too bad and so sad for me.

The report is the second such effort from this collaboration and uses online surveys of 1,000 subjects in each of five countries: Brazil, India, Nigeria, the UK and the US. They also took more in-depth interviews of 84 random subjects aged 18-28, and 19 news producers across the world drawn from both solo creators and larger news sites. The 80-page report is well worth your time, and shows what is happening in the world of news. Some of it is obvious, but a lot of it isn’t, and the insights will surprise you.

If you have never heard of Lisa Remillard, The Pudding, Morning Brew or Climate Adam, then you need to pay a lot more attention to this report and the market that they represent. News sites are embracing novel ways to attract, orient and engage readers. Sites are tailoring their content to produce a mix of sources, notifications, story types and ways to adjust their algorithms to provide the best engagement. That much you probably know, but there are many tips and tricks on how to get from the old news world to the modern era.

To that end, they identify seven different modes of engagement, as shown in the diagram below.

For example, the sifters can scroll through a list of news items. They have about two seconds for video and maybe 15 or so seconds for reviewing the text to select the stories or topics that breakthrough. Seekers use overall websites to guide their discovery process. Each of the seven modes is explored in detail, with numerous examples from sample websites from the five countries.

One of the interesting things is how different the news environment is across the world. Nigeria, for example, is the most digitally engaged country, for example. The study’s authors explain why they picked the places they did, and document who they did additional interviews at length.

The challenge for modern news producers is that there is a broader definition of what news is for modern readers. It can contain civic info, but it also has a personal impact on the reader and is both entertaining and non-fiction. The researchers found that the best producers have turned the trad journalism model on its head: they start from being distributors, master the language and style of their platforms and design their content so it can travel across their own news ecosystem. Being distribution first means that engagement isn’t just a by-product of solid journalism but built-in up front. Publishing is the start of a conversation between the site creators and readers, not the endpoint of what was once the legacy process. The old news style began with an idea and then worked through research and writing the story and ended with distribution. The modern workflow starts with distribution and then tests several ideas before moving into editing and publication, all in the service of community engagement.

No longer are news producers trying to shoehorn content into a distribution platform (like TikTok or YouTube), with results measured in page views or likes. Instead, the content is designed to be native to a platform in terms of style, focus, and news content. And forget about the inverted pyramid scheme for writing stories: there are numerous examples of what next-gen news uses, such as building recurring inside jokes to make complex topics more approachable.

This means that the modern newsroom is filled with what the researchers call “full stack creators.” This doesn’t mean that they know everything from HTML to Cursor, but that they have a mix of skills including on-camera presence, visual storytelling, script writing, being able to package the product with descriptions and thumbnails, and understanding the basic analytics that will be used in their stories. That is a tall order. But wait, there is more: the modern newsroom needs to be a working, cross-functional pod that can cover multiple platforms too.

Back when Twitter was still a trusted breaking news source, we had to learn the ins and outs of socializing our content. And to some extent, this is still the case, just now the socializers are just one of the seven modes mentioned earlier. But now the producer has to start with the assumption that they have to build content that people actually want to share with their peers, and understand how different platforms distribute their shared content. To be effective, this content has to resonate emotionally, be simple to grasp, and easy to report. Seems obvious, right?

Not mentioned in the report is that content creators have to navigate the dangerous waters of AI and understand that traditional SEO and being an “influencer” are both dead concepts. Cybersecurity expert Daniel Miessler recently posted that “The main viable path for knowledge worker professionals is to start seeing themselves as free agents. And to start behaving that way in terms of how they present to the world. It’s about to be essential that you’re visible, that you have a portfolio of work you can show/talk about, that you have a domain. A website.” Everyone will be an influencer, and its our job as scribes to find, target, and feed our particular audiences.