Jul 272024
 

As a dual citizen of Canada and Hungary, I am of course delighted to hold an EU passport. Even though I have no plans to do so in the foreseeable future, it is nice to know that I have freedom of movement within the EU, and that in most places I could also claim permanent residence and work.

Unfortunately, as a person firmly committed to the values and interests of our Western alliance, I am increasingly concerned about Viktor Orban’s antics. His coziness with Russia’s dictator, his willingness to embrace undemocratic, “illiberal” policies for the sake of holding on to power, his warm relationship with Trump, his misuse of his position as Hungary holds the rotating EU presidency, exemplified by his rogue visits to Moscow and Beijing… Plain and simple, he is becoming a security threat to the Western alliance.

I have often called Orban in the past a horse trader (a particularly apt expression in the Hungarian language is “lókupec”). The implication, of course, was that even as Orban is deeply corrupt and unscrupulous, he is driven in the end by rational self-interest, and thus remains predictable and reliable.

But lately, I’ve been wondering if that is still true. What we are witnessing, I do not fully comprehend. Is he a Putin asset? Did he simply bet on the wrong horse this time around, now doubling down on a bad bet?

Whatever it is, he is not only doing tangible harm to his own country and, of course, the Western alliance, he is also making amateurish mistakes. The most recent example concerns his journey to Kyiv and Moscow. Parading around as a champion of peace, he forgot to talk to his hosts about the one thing that can severely impact Hungary’s economy: The uninterrupted supply of Russian oil through a pipeline that traverses Ukrainian territory. Oops!

Orban is now widely despised in the West and with good reason. At home, however, he remains firmly in charge. The secret, beyond his “illiberal” concentration of powers and his success at undermining independent media and the independence of the judiciary, is the flawed historical self-assessment of his nation. Many Hungarians still view themselves as victims of the Paris peace treaty of 1919, which they see as massively unfair, robbing the country of roughly two thirds of its historical territory. Which undeniably happened, of course, but context is everything. The last time those historical borders of Hungary existed as the borders of an independent political entity was in 1526, when Hungary suffered a devastating loss fighting the Ottoman Empire (a self-inflicted wound, arguably, as it was Hungary that broke a peace treaty with the Ottomans.) Fast forward to the 20th century: we have a map created by a famous Hungarian cartographer, Károly Kogutowitz who, using data from the last pre-war census of 1910, compiled this ethnographic map of the country:

Although there are clearly visible areas of the map outside the country’s present-day borders that had majority Hungarian populations, the borders are roughly in the right place. We can argue about specific patches of land in the border regions of Slovakia, in northern Transylvania, and a few other locations (hey, my father’s family is from Temesvár, now Timisoara, Romania, and I’ve had friends and relatives from famous, formerly Hungarian towns like Kolozsvár/Cluj or Marosvásárhely/Tirgu Mures, so it’s not like I am unaware of their plight, especially under Ceausescu’s regime), but one thing is clear: most of the territory of the historical Kingdom of Hungary was not dominated by a Hungarian ethnic majority. Should not be surprising: medieval kingdoms were not ethnic nation-states. Whether or not it is wise to base borders on ethnicity is another question, but so long as we accept that premise, the borders speak for themselves: they may not be fair but they certainly represent ethnic realities far more closely than the historical borders many Hungarians still dream about.

Orban of course can whip up nationalist feelings. He can easily explain his stance on Ukraine to his domestic audience by alluding to how badly ethnic Hungarians are supposedly treated in that country. The Orban of the past: the young leader of a youthful movement (Fidesz stands for Alliance of Young Democrats in Hungarian) is long forgotten. Instead, we now have a leader that adores Russia’s dictator. A leader whose actions appear to echo a past when, nearly a century ago, another Hungarian leader, Horthy, maneuvered the country into a foreign policy cul-de-sac. I fear that something similar is going to happen again, and the country will suffer, just as it suffered during that fateful winter of 1944-45 when it was ravaged by war and by brutal Nazi rule, only to be followed by more than four decades of communist oppression.

 Posted by at 11:25 pm
Jul 252024
 

I heard a rumor: Russia was significantly less affected by the CrowdStrike cyberoutage. Could it be that they were behind it?

Of course not. Never attribute to evil that which you can explain by stupidity. But in this case, backwardness was also on Russia’s side. You might have seen memes about Southwest Airlines, largely unaffected on account of the fact that many of their systems still run on Windows 3.1. Well, it Russia it’s… like that, even more so. As an example, here’s a CrowdStrike-affected display panel from a few days ago at JFK airport in New York City:

In contrast, here’s a departures board from a small Russian airport:

Kind of hard to hack, that one.

 Posted by at 12:29 am
Jul 192024
 

So everyone is talking about the major IT outage today (which actually turned out to be two unrelated outages, the second due to a since-remedied issue with Microsoft Azure platform), namely the fact that millions of physical computers and virtual machines around the world are crashing due to a driver failure in what is known as CrowdStrike Falcon.

I admit I have not heard of CrowdStrike Falcon before. I had to look it up. So I went to the most authoritative source: the company’s Web site.

“Cybersecurity’s AI-native platform for the XDR era,” it tells me, and “We stop breaches”. XDR is supposedly “extended detection and response”. Wikipedia tells me that “the system works by collecting and correlating data across various network points such as servers, email, cloud workloads, and endpoints”. Microsoft tells me that XDR “is a holistic security solution that utilizes automation and AI to reduce response time across multiple workloads”.

Going back to CrowdStrike, I learn that it yields $6 of return for every $1 invested. (How?) That it identifies 96% more potential threats. (More than what? More dentists use…) It tells me that it is leads to 2x as effective security teams with 66% faster investigations… compared to what?

Okay, scrolling down… it’s “cloud-native”, “single-platform” and an “open and extensible ecosystem”. It is “data-centric” and “AI-native” with “workflow automation”.

So far there is one thing I have not yet learned: What the bleepety-bleep does it do?

Of course I can guess. I know what security solutions are supposed to do, and I have no doubt that CrowdStrike delivers… more or less, probably not any better than its major competitors. But they certainly have good marketing, with all the right buzzwords!

Unfortunately, behind these buzzwords there is a flawed mentality. The implication that all it takes is a fancy software solution to protect your enterprise. Never mind that a good chunk of the threats (I was going to say, “vast majority”, but I have no data to back that up) are not in the form of malware. If I communicate with a senior manager at a bank and convince them to initiate an important transfer that later turns out to be fraudulent, no cybersecurity is going to prevent that.

And as today’s example shows, protection from malware and other technological threats is just one element of a successful cybersecurity policy. A comprehensive policy must be based not just on prevention but also the recognition that sometimes, despite your best efforts, excrement can hit the ventilator. How do you detect it? What do you do?

That leaves us to these main points that must be on everyone’s cybersecurity checklist, whether you are a small company or a major international enterprise. Here, in no particular order, and I am sure I left some things out:

  • Threat prevention (technological prevention, such as antivirus software, network firewalls, real-time monitoring)
  • Data collection (comprehensive logs that may be used for threat detection, forensic analysis, mitigation)
  • Compartmentalization (user privileges, user access management, network architectures)
  • User relationships (user education, use management — treating users as partners not as threats)
  • Backup and recovery procedures and policies, tested (!) and validated
  • Intrusion detection
  • Intrusion response (emergency operations, fallback operations including manual operations if needed, notification policy)
  • Mitigation, self and third-party impact
  • Recovery
  • Forensic analysis and prevention
  • Auditing and risk analysis (including third party dependence)

I mean, come on, CrowdStrike’s graphic is eye-catching but I swear I drew much more informative diagrams well over a decade ago when educating customers about the need for comprehensive security. Like these, for instance.

Sure, comprehensive cybersecurity technology can help with some of these points. But not all. For instance, no cybersecurity solution will help you if broad dependence on a third-party component in your enterprise suddenly causes a widespread outage. That dependence can be anywhere, could be a simple messaging app or a complex cybersecurity suite. If it causes systems to crash, and you have no proven, tested policies and practices to detect, mitigate, and recover from an event like that, you’re in deep doo-doo.

Oh wait. That’s exactly what happened to far too many companies today.

 Posted by at 6:33 pm
Jul 192024
 

I admit I almost lost it last night.

I was attempting to sign up as an author with a notable scientific journal (who shall remain nameless as I am cowardly and I hope to remain in their good graces.) I was confronted with a questionnaire asking about some personal details.

Okay, so they want to know about my name, e-mail address, office phone and institution. All perfectly reasonable, even though I do not have a formal affiliation which sometimes means going through extra hoops, trying to convince the software that I am nonetheless legit. Then came more personal questions such as my gender and age. But then… race, ethnicity, sexual orientation…

Sexual orientation???

I beg your pardon?

Say what? I apologize for language that’s rude and crude, but what the fuck do my scientific contributions have to do with the privacy of my bedroom and how is that your fucking business?

I generally consider my ideological affiliation left-of-center, which is to say more likely leaning towards a progressive liberal attitude. But this? Granted, there was the option, “prefer not to answer”. Nonetheless, I was beyond offended. In this context, the question is downright creepy. What are they going to ask next from prospective authors? How often do you masturbate? Do you prefer conventional or unconventional positions while copulating? Are you into S&M?

I mean, seriously, all I am trying to do is to submit a physics paper to a scientific publication. Not interrogated about my bedroom habits.

Of course I know the answer. This is checkbox-driven DEI virtue-signaling. Someone, somewhere, will write a report about how well (or how badly) this scientific publication represents various communities. Never mind that the actual science should have absolutely nothing to do with race, ethnicity, or sexual orientation. They now have checkboxes, and no doubt, folks patting themselves on the back being proud of what they have accomplished, making the world more inclusive and all.

Except that they didn’t. Except that these forms of aggressive, self-serving episodes of virtue signaling achieve the exact opposite: instead of steering the world towards a future in which such superficial characteristics no longer matter, instead of a world in which we are all judged by the content of our character, they not only keep divisions alive, they are actively deepening them.

And that’s why we can’t have nice things anymore.

 Posted by at 6:16 pm
Jul 132024
 

This is a picture perfect moment. For all the wrong reasons, but this image is destined for the history books.

July 13, 2024. I have the feeling that it will be remembered like a day almost precisely 80 years ago, July 20, 1944, when another defiant leader emerged, mostly unscathed, from an assassination attempt.

Assassinations do not restore or strengthen democracy. We’ve known that at least since the times of ancient Rome, since Marcus Junius Brutus and co-conspirators assassinated Julius Caesar almost two thousand years ago. Rather than saving the Roman Republic, they hastened its demise.

The only thing worse than the assassination of a tyrant (or a would-be tyrant, as some see Trump) is a failed assassination. Which is what happened 80 years ago in the famed Wolf’s Lair. Ironically, Hitler was also injured in his ears. But far from weakening him, the assassination attempt likely played a role in Germany fighting all the way to the bitter end, as Hitler viewed his survival as a divine moment. What the fallout from the attempt on Trump’s life will be is yet an open question, but there is one thing of which I am sure: it’s going to be bad news for his political opponents and, by extension, for all of us who worry about the future of the Western democratic world order.

 Posted by at 11:27 pm
Jul 102024
 

Throughout her life my Mom earned a living as a artisan textile dyer in Hungary. Nothing fancy, her usual work involved bringing home to her workshop a few hundred, e.g., silk sheets, hand-dying them with predetermined, preapproved patterns (mostly fashionable headscarves, which were very popular in Europe in the 1960s, 1970s), then returning them to the warehouse, which then sent them out for further processing (steam fixing, hemming, etc.)

One day in 1984 she was asked to do something different: To prepare several silk sheets, using the designs, and under the supervision, of a well-known artist (Judit Szabó), for public display in a community hall in a small Hungarian town (Földeák).

She was reminded of this during our recent conversation. Though I had no high expectations, I searched for it using the name of the town and the artist. To our no small astonishment (and to my Mom’s great delight), I found it. The silk sheets are still there (or at least, they were back in 2021), adorning the walls of the town’s wedding hall. Not only that, someone actually took the trouble to take some decent photographs of it and publish it on a nice Hungarian-language Web site.

 Posted by at 1:13 pm
Jul 102024
 

I was so busy with things like Linux updates, I forgot to celebrate. My main Internet domain, vttoth.com, was 30 years old just ten days ago.

$ whois vttoth.com | grep "^Creation Date"
Creation Date: 1994-06-30T23:00:00Z

To be sure, it’s not the oldest domain in existence, not by a longshot.

$ whois oracle.com | grep "^Creation Date"
Creation Date: 1988-12-02T05:00:00+0000

But then, look at these guys:

$ whois facebook.com | grep "^Creation Date"
Creation Date: 1997-03-29T05:00:00Z
$ whois google.com | grep "^Creation Date"
Creation Date: 1997-09-15T07:00:00+0000
$ whois whitehouse.gov | grep "Creation Date"
Creation Date: 1997-10-02T01:29:32Z

So yes, I suppose I’ve been around. Here’s the earliest version of my Web site as remembered by The Wayback Machine:

Well, I suppose Web sites have become a tad more sophisticated since then.

 Posted by at 1:12 am