This is dedicated to all the hackers and the crackers, to the hackers and the crackers.
I see in binary, I speak source code, step on my toes, I'll post a million jpegs of you
in a fag pose, in your digital stance, getting firewalls hoes, cause I'm riding the net in
my six foes, I was a dick with my 56, now with my cable I'm able to get that stable,
on the out, my name is Ace and I'm a Leo, on the digital highway, my name is Neo and
I'm a hero, in a flash, I'll screw you on burning dreamcast, you need some ISO, let me through
my hard drive rifle, our exchange you could never stifle, and a digital hug, you just caught
the love bug, I bootlegged your CD, I caused the fight between Un and Jay-Z, cause CG, it's
all gonna be free, whether we take it by force or we take it nicely, you feel that rattle
it in your bones, when I tell you we just packed out Jones, and NASDAQ leaves you flat
on your back, cause I am he who loves to hack and crack, cause I am he who loves to hack
and crack, this is dedicated to the hackers and the crackers, serial phones, source codes,
ISO, RAM, SIS, this is dedicated to the hackers and the crack, this is dedicated to the hackers
and the crackers.
Hello, and welcome to Binary Revolution Radio, episode 172.
Today's date is November 7th, 2006, and last week it was Halloween, and today's election
day, for those of you listening in the United States, and for those of you who don't have
like ass-backwards law, of which it was somehow like another previous election, I don't know,
there's crazy stuff.
I'm Black Ratchet, your host for the evening, and with me this evening is Stank Dog.
Yay!
Hooray voting!
I feel like half the audience was like, oh crap, he's back, click.
Yeah, exactly, damn it, I thought we got rid of Stank Dog.
Yeah, well, actually, someone sent me an email saying, oh my god, I can't believe you're
back, it's wonderful.
Yeah, I was just like, wow, I guess people like me, I don't know who that, I think, actually,
I think he's in the email this week, but just not that email.
So, yeah, I thought I had a filter on that blocked out all those messages of people like
you, but I guess one slipped through.
Yeah.
Oh, well.
Anyway, so, what is this, episode 172?
172.
And since this is voting day, that's, I guess, our theme for the show today?
Yes, yes, actually it is, that's why we actually decided to bring it up.
By the way, I loved last week's episode with the sound effects and stuff in the background
for Halloween, that was classic, that was good stuff.
Isn't, wouldn't that be like our first Halloween special, like that was actually airing on
Halloween?
I don't, I think so, we might have made some allegations, but I think that was the first
time it aired on Halloween that I can think of, I guess we have to check the archives,
but.
Yeah, so I just like, it was like, it just occurred to me, oh man, when I'm editing all
this stuff up, let's go put some crazy sound effects in there, and I just wanted to get
like, I actually, I was just playing like, do it like once or twice, and I really got
carried away.
Yeah, there were a couple points where it like, overlaid the talk, it was obviously
an afterthought, but.
Oh yeah, totally.
The first time it came through, I was laughing out loud, pretty, I was, I was, I was lolling
at that one.
He was lolling, he was doing the loller skates and the roffle copters.
No, I wasn't roffle, I wasn't in the roffle copter, but I was loller skating.
Oh.
Yeah.
In my headphones at work.
Everyone thought Stank was insane at work, going, oh my god, I don't know what he's
listening to.
Oh, they already all know that, don't worry.
That has been previously established.
Hey, you know what, let's do, let's do, we have kind of a theme for the show, but let's
do kind of an old school show, because like, I have a couple other little things, let's
do housekeeping this time, I know we don't, we kind of cut that out, but let's do some
housekeeping later on, what do you think?
Well, see, I do housekeeping, because it's always like, fun to address issues that have
been previously brought up, but I didn't have any housekeeping this time, do you want
to like, bring something up right now, or do you want to wait later?
Like, no, we can wait until later, like, remember back in like season one of the show, it used
to be like shotgun style, I used to call it, where it was like multiple topics, and you
know, the long time listeners know that I read entirely too much, so like I get a bajillion
magazines, and I would bring up some of the articles I thought were interesting or worth
talking about on the show, and I had an article I wanted to talk about, and I had a kind of
a physical hacking thing I wanted to talk about, so we'll save it until later on when
we get there, but yeah, let's do kind of an old school throwback show to see if you want.
Well, actually, we got a pretty good physical security email in the mailbag this week, so
perhaps you can actually might work that in there.
Well, so what do you think, housekeeping email, you push the show, I'm just going to sit back
and be quiet.
All right, well, I'm like, oh crap, who was that guy from Greek mythology who rolls up the
stone up the hill all day, and then has to like, see, this is why, this shows you I
read entirely too much, because I know the answer to this question.
That would be Sisyphus.
Sisyphus, thank you.
Who would roll it up one side of the hill, only to have it roll back down, and he'd have
to roll it back up the other side of the hill, and continually caught, so yeah.
Well, would you rather be Sisyphus, or how do you pronounce his name, or the guy that's
basically tied up, and his, like a bird eats his liver every day, and then it grows back?
Well, you know, there's six of one, half a dozen of the other.
I'd rather roll the broccoli.
Yeah, me too.
I tell you what, listen, I've got to be honest with you right now, I'm going through a little
torture myself.
You have cats, right?
Yeah.
Well, actually, I don't currently have catfart.
Man, I've got to close the door or something.
Jeez.
Man, there's nothing in the world worse than a catfart.
I can't say that I ever have actually smelt my catfart, or perhaps I just missed it on
somebody else.
Maybe it's all that Florida food you feed.
Yeah, we feed our cats beans and sausages down here.
No, man, all I feed my cats is pixie sticks.
I'm eating right now, baby, leftover from Halloween.
Hey, it's Halloween, man.
I'm in my house, and I'm eating my tubes of pixie sticks.
Beautiful tubes.
All right, we've gone way off topic here.
Let's steer it back to shore there, Ratchet.
Oh, come on, it'd be fun.
Pixie sticks are fun.
I know.
Like, you know, feeding a pixie stick to a ferret and just watching it break Mach 1.
It's like an episode of Family Guy.
It's like that time, and then we go to some weird segue.
All right.
Okay, let's let one.
That was my Peter Griffin.
Going way off course here.
All right, do you want to go into email here to start a salvage an episode?
Sure, let's do it.
All right, so you start the email.
I'll read some if you get tired.
I'll read some if you want, but you go ahead and start.
Okay, our first email is from Vector, and I actually think this is the guy who sent me the email.
Oh, my God, it's Black Ratchet.
Hey, I just wanted to let you guys know that I fucking love BinRev.
It's my homepage.
I stumbled across BinRev about five months ago looking for a good hacking podcast or net radio show or whatever people call them.
I've been hooked ever since.
I recently started hanging out in the forums, and I've got to say, they are great.
I'm there every fucking day, and I know this probably sounds retarded.
Are you retarded if you can't spell retarded probably?
Sorry, Vector, I had to take the jab.
Yeah, it was sitting right there.
I had to stop myself from saying something.
This probably sounds retarded, but I actually get excited when Tuesday comes, because I know the new episode comes out.
I've learned a lot listening to the past episodes and talking to people on the forums.
I just wanted to say that BinRev fucking rocks, and I love it, and keep up the awesome work.
Oh, fuck that.
The BinRev haters, they lick my balls.
Vector.
Lick my balls, Mr. Garrison.
I don't know.
I'm in a voice mood today.
I'm warning all the listeners that I might be throwing in a lot of my patented, terrible, terrible, terrible impersonations or whatever.
That's just an authentication tool that we know it's you.
Yeah, exactly.
That's how you know it's the real stank.
Well, thanks, Vector, for giving us mad props there, I guess.
But if he really makes the BinRev homepage his homepage, perhaps StankDog might want to update it a little more often.
Yeah, it's the foo.
Yeah.
That's the whole point of the blog.
We're posting all our news on the blog now.
The B-L-A-W-G, the blog.
Do you want to do one?
Instead of having to update.
Because we see, the thing is, the thing with the BinRev site is that it's on our list, first of all,
to kind of re-engineer the whole thing, redesign the whole thing.
But it's low on the list because we've got so many other things going on.
But it's all custom code.
So to actually update the homepage on the thing, you have to go in and actually edit the HTML and add all this news and stuff.
And it's not like it's hard or anything.
It just takes a little time as opposed to going over to the blog.
HTML.
Yeah.
As opposed to going over to the blog and just adding a new post entry or whatever,
which actually sometimes that can be a pain in the ass too, but that's a whole other topic.
I liked when we were running WordPress, whatever it was, 1.5 or whatever the previous major release was
because I do not like their new AJAX, you know, JavaScript, crazy-ass editor.
Yeah, well, it's security problems in the 1.5 and we probably jumped to 1.2.0.
Yeah, we probably jumped to 2.0 pretty quickly.
Yeah, by the way, I'm just waiting and watching day by day for the inevitable attacks on the site
for people who think we have a vulnerable envision thinking we're running it in maintenance mode.
It's kind of fun.
Every time some new zero day comes out, oh, of course we keep everything patched and all that kind of good stuff.
No, no, no.
I mean, have we seen anybody?
I would hope that we have it patched.
Thank you very much.
Yeah, yeah, yeah.
That's taken care of.
And I watched the logs.
I haven't actually looked to see.
It just came out a couple days ago.
But we were never – actually, there was no patch to be – I mean, we're not affected by it.
I mean, who runs it?
It's attacking boards.
That's the funny thing is people don't even understand or realize what it does.
They just see it in the skitties, get a hold of it, and they just go Google search for
Powered by Envision 2.0 whatever, whatever, and then they just start running it blindly.
They don't even understand what it does.
That's what skitties do.
That's why we ate the script kitties because they'll go out there, and sometimes it'll work
even though they don't know what they're doing.
But in this case, the exploit itself – I don't know if I'm dragging this off topic here,
but the exploit itself basically affects only if you go into – I guess let's call it
maintenance mode.
I think there's a different term for it.
But when you go into maintenance mode or a certain debug level, you only turn that on
where you're like doing testing of the forums or anything like that.
You'll turn it on, and it basically shows a lot more debugging information on every page.
Like debugging information, meaning like if you ever notice at the bottom of some pages
it says page rendered in however many milliseconds or whatever like that.
It'll give you a lot more information like what tables is being hit, if there's any log,
if there's any slowdown, and what the exact thread ID, just different information to help
you kind of isolate and debug problems.
Nobody leaves it or runs it in that mode.
I mean, it's just like that exploit is only going to affect those people who have it in
that mode, and you just don't.
Even if we wanted to do debugging and testing, we have a whole other instance that's completely
off the server or somewhere else, completely password protected that we go in and we do
all that testing ahead of time before we roll anything into production.
So it's never going to be – that type of attack is never going to be an issue.
But again, the skitties that don't read that and pay attention to what it does are certainly
going to go out there and try to just execute it, run it against us, and fail miserably.
Like, remember all those ones that we saw on the forums that were like that swing of gibberish?
Oh, my gosh.
Well, actually, I distinctly remember that because I get a – it's like 6 a.m. in the morning.
Well, actually, no, I think it was closer to 7.
And it was a weekday, and I'm getting on the bus going up to Boston because that's how
I commute in every day, or used to at that point.
And I get like – I check my – I do what I usually do.
I sit down, and I, you know, situate myself, and I rip out my hip top, which my hip top
has been retired, by the way.
We'll get into that in personal hacking stories.
And I see like, you know, 15 billion reported posts.
Like, literally, it was a full screen of them.
And I'm going – I'm checking them out.
I'm like, you know, someone's reporting me as, you know, attempted exploit, attempted
exploit, attempted exploit.
And I'm like, oh, ooh, that's not good.
And I go check out Millworm, and I say, you know, envision PowerBoard exploit, you know,
we'll, you know, do all these evil things.
And I'm like, oh, crap.
So I call up Stank, and I think I called you at like, you know, 710, and you're like,
hello?
Yeah, come on.
Who'd be calling me at the butt crack of dawn like that?
Well, you know, it was just one of those things.
I'm like, well, you know, there's an envision – oh, okay.
I'll go check it out.
I'll call you back.
Yeah, no, I get up at 715 anyway.
We all know.
It's all good.
And, yeah, we patched it right away.
It had nothing to it.
It was – but, again, the skitties get out there and get to it first and start blindly
running it.
And the next thing you know, we're hacked by Chinese!
Hacked by Chinese!
Oh, God, I remember that.
Oh, it's so funny.
I remember when, like, you know, that was a Code Red thing.
I think we discussed that in the last episode when Code Red started coming out.
And, actually, you actually sometime went to Windows Update, depending on what load balance
server you got.
You went to – you got the big sign that says, hacked by Chinese!
I'm like, oh!
The Chinese have invaded Microsoft!
All right.
Well, anyway, now that I sidetracked the show once again –
Hey, why not?
It's a shotgun episode.
Shotgun episode.
That's right.
But thanks, Vector, for making the show on page.
That's pretty cool.
Yeah, I know.
I've got to say, I actually think he was –
Lying?
Well, no, no.
I don't think he was lying.
I think he probably made the forums his homepage.
Yeah, a lot of people deep-linked.
That's one thing I've noticed.
A few people go to the front page anyway, which is yet another reason not to worry about
updating it frequently or anything.
And the only thing I want to post on that front page is, like, BinRev-specific announcements.
You know, and, you know, we haven't really had anything BinRev-specific related lately
that I haven't already posted.
So I do have something to put up there kind of soon.
But, again, we post most of that stuff in the forum, so it's nothing really new to anybody.
Eventually, we'll redesign the whole thing.
We'll get making an XML feed, an RSS feed for the whole thing or something.
But, yeah, that's way down on the to-do list right now.
We have a to-do list?
Well, I have, like, a to-do book.
I remember those.
I have one now.
But anyway, our next email is from Jeff.
Hi, Stank, Dizzy, and all the DDP crew.
I'm a long-time listener and a huge fan of the show.
I think that all of you do a great job, so fuck the haters.
Now that I've just said that, I want to hack for a career.
I love security and exploits in just about every aspect of hacking.
I find every show enjoyable and entertaining.
And I believe that I do have what Stank calls the hacker mindset.
My problem is that I don't know how to turn this into a career.
And being 25, I really need to get moving in some direction,
whether it be coding, network security, et cetera.
I have no hacking friends.
Most of them barely know how to burn a CD,
and let's forget about teaching them how to use a BitTorrent.
No offense.
You know who you are.
So, I must turn to the DDP.
Any help and suggestions would be greatly appreciated.
Thanks, much love, and keep up the fabulous work.
Jeff.
Have we ever been called fabulous before?
Actually, I've never seen the word enjoyful before.
Enjoyful.
Not enjoyable, but enjoyful.
Well, I didn't actually catch that up.
You know, we've been called everything at some point in time, so.
We're fabulous.
Well, I'll take fabulous.
Yes.
Fabulous.
Yeah, you didn't have to emphasize it like that.
Fabulous.
I used to have a great, you know, lisp to it.
I used to be able to really freak people out back when I was in high school.
But, ah, the skill sets that we used to have that are no longer needed.
No longer needed?
What are you talking about?
Well, now it's a sexual harassment lawsuit.
Oh, yeah, true.
It'll come in handy on a resume.
Yeah.
Well, we actually did an episode of the show to talk about this email as far as moving in the security to become a security professional, so to speak.
And just the only thing that I, and I get asked this actually at conventions a lot.
I've had people come up to me after presentations and stuff and just generally say, hey, you know, I've heard you talk about security professionals on the show and how I have some issues with some of them and stuff.
And, you know, there's nothing wrong.
And I know I have a lot of friends and hacking friends who are security professionals who are still hackers.
Just don't sell out when you go.
But the only thing that I like to always remind people that they may not realize is that being a security professional is not being a hacker for money.
You're not getting paid to hack.
And that's the biggest misconception I see from hackers thinking they want to go out and become security professionals for a living.
If you think that you're going to go get paid to hack, very rarely.
There are a couple jobs that will pay you to do penetration testing and things like that.
There are even fewer jobs still.
Like my good friend asked us, you know, if I was ever going to do a job to get paid for hacking, it would be that sort of thing where it's researching vulnerabilities and stuff like that.
But there's very few of those sites.
You know, and that's why, like at DEF CON or Black Hat, you'll see people that are under their company name presenting.
And that's usually the few jobs where they pay you to do actually hacking.
You know, defining hacking, of course, is taking things apart, breaking them down, looking for vulnerabilities, writing code, writing script, figuring out weaknesses and vulnerabilities, that aspect of hacking.
So there are very, very few and far between.
Like that old cliche about, you know, athletes.
You know, one out of all of the kids that go to college or, excuse me, young people, man, I'm getting old, that go to college, only one or two of them will ever make the pros.
You know, that old cliche.
It's the same thing with this.
I mean, there's a lot of hackers out there, and there's certainly not enough jobs hacking, so to speak.
Now, there's plenty of security jobs, security professional jobs, but know that what you're getting yourself into with that,
you're getting yourself into rolling out patches on mass scales to all the computers in a company.
That's a security professional job.
So if you're okay with that kind of mass maintenance and what I would call boring work, you know, system administrator type stuff that's not really hacking,
it's rolling out patches, checking for vulnerabilities, scanning your networks, and finding, oh, no, there's somebody who's running this server over on the other side of the company.
I have to roll out a patch to them, or I have to call them and tell them to upgrade the newest version of whatever.
That's going to be a lot of your security stuff, writing and enforcing policies.
You're going to have to sit down and write up documentation that says, official password policy.
You must choose number case and lower case letters, and it must contain a number, and you're going to have to write that sort of stuff up and enforce it.
There's a lot of bureaucratic and stuff that goes along like that, so just know what you're in for.
I mean, if you're still interested in it, yeah, then there's plenty of stuff out there.
Go get just your computer degree and do some security research and get some stuff like that on your resume
and try to get you an entry-level job somewhere and go forward with it.
And, like, getting back to what Sang was saying about, you know, when you start scanning out all this stuff and mass rolling out patches,
I mean, yes, that's about, like, a good 90% of the job, but at the same time, it's what we refer to as firefighting.
You're either sitting around with your thumbs up your ass or you're running around with a chicken with their head cut off.
Like, for example, like, there was a – when Code Red – was it Code Red or was it Sasser?
I forget what it was.
I don't think we really hit Code Red, but I think the – one of our developers –
back when I was a Wii PFY working at my job, and we actually got – I think it was Sasser because it was –
Sasser was, like, you know, multi-pronged.
And I believe one of our developers, who was stupidly running IIS on his machine,
despite our insistence that he did not do that, was not patching it and got hit with the web version of it,
and then the web version propagated across all of our network shares.
Oh, boy, that wasn't fun.
And actually, we did pretty good because we were actually up on – because we were actually aware of patches,
and we realized all this crap, and I saw this patch saying,
oh, a remote code execution via the buffer overflow in one of the network services.
This isn't good.
And I said, yeah, we need to roll out this patch like yesterday.
So by the time it hit, we are actually mostly patched because this was actually before mass rollouts,
and you actually had to walk across to every machine and hit it.
So Sasser basically came in and said, I'm inside your network, and I'm rooting your noobs.
Yes, exactly.
Is that exactly how it went?
Exactly.
I mean, that's what it says.
We got an email from the Sasser buyer that said, I'm in your network.
I'm rooting your noobs.
Oh, my God.
Yep, that's about all I have to say about that.
Well, actually, our next email is – I guess the Hearst email is kind of elated because, I mean,
we're not trying to knock Jeff here because, you know, lots of people quickly type out emails,
and they don't actually think about what they're typing about.
But, you know, there were some typos,
and there were some problems actually understanding the concepts behind it.
But our next email actually addresses some of that.
And this is from – he gives his full name here.
I mean, he actually signs it sincerely, so-and-so.
Well, we're just going to give his – no, we're just going to give his first name, of course, on the air.
But, you know.
All right.
I never know how to handle these.
So our next email is from Frank.
And he actually starts off with, Dear BinRev homies,
I love the episode on risk assessment since it is something that is usually not discussed in the scene.
Most hackers think of security in firewalls, honeypots, and ports.
In fact, most people that have security-related – IT security-related jobs don't think of security much past that either.
The bean counters and managers of the business world don't care that Linux is fundamentally more secure than Windows.
That statement alone is more than enough to lose people in a meeting.
Presenting assessments, calculation, and numbers is the way to make a business case for security.
It's a way to translate what you know into what they know.
The techniques discussed don't always have to be applied into multi-state NOCs.
On a smaller scale, they're a good way to make a business case for smaller items,
such as extra backup devices or an extra firewall.
All too often, I see in forums and in IRC chats about the younger hackers – and some older ones, too –
talking about how they can't find work using their hacking skills.
I believe that many of them are lacking in business skills to work in a professional environment.
Take penetration testing, for example.
There are many talented people lurking in the mid-ref forums, many of whom would love to do penetration testing for a living.
Where have I heard this before?
Yeah, this is a good segue into the next scene.
That was a good one.
Okay, go ahead.
While many have the technical skills to penetrate networks and find the holes, this is only half the job.
The other half is presenting the information to the company that you've assessed,
where their security holes are, and what the risk assessment of these holes are.
Making the business case is the skill set that many hackers are missing and they're completely unaware of
when they think about making a profession their hobby – making a profession of their hobby.
I've used the term business case quite a few times in this email.
All too often, people with technical skills could care less about the business side of security
while it is the business side that gets you a paycheck.
Learn what to fight for the money that you need to get your job.
Learn how to build a business case in existence and in the professional world.
It is how you sell your services and your skills.
Sincerely, Frank.
Frankie boy.
Thank you, Frankie.
Actually, I did not know that was coming up.
Or I should say, I forgot that was coming up.
That was in the email for this week.
But yeah, I kind of re-emphasized a lot of the things I said.
Specifically, to re-re-emphasize, you're going to be doing a lot of documentation,
filling out a lot of fucking TPS reports.
Like someone knows that.
I actually – for the longest time, I actually had no clue – I mean, up until today,
I had no clue what exactly a TPS report was.
What?
I've never had to do a TPS report.
I've always been a very small developer.
I've never actually worked on these massive developing houses.
Yeah, well, we have to fill out full-on technical specifications that are – in some cases,
I've seen some of them that were 100-plus pages.
But yeah, the one I was – see, Rack just referring to the fact that I was kind of whining
or complaining a little bit earlier about having to do one of those today.
I've been documenting all day, filling out TPS reports.
Did you get the new cover sheet?
The new TPS cover sheet?
Yeah.
Can you have a memo about that?
I'll go ahead and send that again.
Yeah, I'll go ahead and resend you that memo if you could use that in the future.
Yeah.
So yeah, I had about, I don't know, 15 pages or so.
So you're going to be doing a lot of documenting, a lot of documentation, a lot of –
now, and that's – to go a step further, a lot of the professional tools like Core Impact
and some of the high-end expensive tools, which, of course, are nothing more than glorified
Metasploit.
But anyway, these higher-end tools actually have add-ons or plug-ins or just built-in support
to make nice reports automatically generate them for you.
So that's helpful as well.
But yeah, I think – I don't know.
I think Frank pretty – did a pretty good job of explaining most of it there.
So I don't know that there's really much more for me to add.
Frank did a great email, and he definitely did hit the nail on the head when he said
a lot of hackers lack the skills to survive in the business world.
Yeah, that's true.
Yeah.
I mean, personally, I think one of the reasons that everyone at my place of business, they
always – I used to be the IT guy, and then I changed my job to be a developer, which
I would not – well, I would be in IT, but I wouldn't be like a system mini type.
And our help desk got absorbed by the giant conglomerate help desk upstairs because, you
know, it would save money and stuff.
And people still prefer me as opposed to the help desk monkeys that come down from upstairs
because, A, they really don't know what they're doing.
But anyway, I think one of the reasons they prefer me is that I can actually explain the
problems that they have in easy-to-understand terms that, you know, they actually grasp.
And I think that that's – if you can really master that skill, you can really write your
own ticket.
I mean, translating, you know, very abstract computer hardcore subjects to, you know, manager
speak, for lack of a better term, is a really – it's something that's very sought after.
Well, and not even – not even necessarily – not even only managers.
Not even – that made no fucking sense.
Let me just rewind.
Not only managers, but being able to speak to just general users.
I mean, you've got to keep in mind that not everybody's technical.
And that's – you know, that's not a bad thing.
Not everybody wants to be a programmer, you know.
People that are in accounting or people that are in other departments and whatever, they
just don't – they don't need to be.
Maybe they don't want to be.
It doesn't interest them.
That's why they're not IT professionals.
But they do need to understand certain things.
And you've got to be able to patiently explain things.
And I think that comes a little bit with age, I guess, and time and experience.
A lot of the stuff in the business sense.
Patience is always a virtue.
It certainly is.
You can't start flipping out on users when they ask you, why can't I display a 50,000 record
data – a 50,000 record data set on my screen in Access?
Yeah.
Something like that.
You just smile and nod and say –
Speaking of Access, that's going to come up later on in the show, by the way.
But okay.
Anyway.
I don't want to know.
No, yes.
It's good stuff.
Yeah.
Well, when I say good stuff –
You were the expert on this whole virtualization thing, and you did this episode.
Do you want to read the next email?
I'll read it.
I don't know how much of an expert I am.
Actually, it was not there.
I really noticed most of it, and I have limited experience.
But sure, I'll read it, and we'll see what we can do here.
Hey, gents.
One virtualization software package you failed to mention in Episode 1.
There's no name on this.
Why is there no name on this?
I don't think you can actually find a name.
But go ahead and check it out, and I'll just double-check.
All right.
So I'm going to call him Joe Bob.
Joe Bob says,
One virtualization software package you failed to mention in Episode 169 is XEN.
That's X-E-N.
It's an open-source virtualization solution that has better performance than VMware with some caveats.
First, we should probably clarify some terminology.
Virtualization is when you create virtual hardware in order to allow for, quote, multiplexing, unquote, on physical hardware.
The idea here is to impose as little overhead as possible, which is one of the things I brought up in the episode.
So that's the ultimate goal, of course.
But generally, historically, that's been the big hurdle.
So this is easier if the CPUs have hardware support for it.
PowerPC, Core Duo, Core2 Duo, some of the newer AMD CPUs, et cetera.
Examples, Xen, VMware, and Mac on Linux.
Emulation is when you pretend to be something you're not, down to the processor level.
Examples of this are PearPC, QEMU, and Box, B-O-C-H-S.
Is that Box?
Box.
I've never heard of Box, I have to admit.
Oh, wait a minute.
Yeah, I know Box.
Yeah, okay.
No Box.
I've never actually heard of it.
I think I've seen that mentioned in the forums.
Again, I'm not as familiar with this.
It's not Terry who's probably tried all of those and then some.
So this is an important distinction.
What the StankDog here is trying to do is he's trying to emulate a virtualization expert.
Exactly, exactly.
This is an important distinction and helps reduce confusion.
So virtualization versus emulation.
So good point, clarification there.
Okay, second, you can stop acting like this is a new thing any time now, smiley face.
Yeah, I don't think we ever insinuated that it's a new thing now.
Don't get me wrong.
But it's never been done on our show before, so maybe it did come across that way.
But no, no, no, no, certainly not.
It's been available on big iron servers, particularly IBM Power Architecture servers, for like 20 years.
It's only new in the PC space.
Yeah, well, you know, how many of our listeners actually have the heavy metal machines?
But point taken.
Anyway, now on to what I'm doing with it.
On the business side, one server consolidation.
Right now we've got six racks of Sun machines, most of them running four to eight CPUs at about 500 megahertz.
And huge disk arrays running way too many SCSI drives, none larger than 36 gigabytes, most of them about nine.
These are supported by large banks of UPSs and a huge HVAC unit, which, for those who don't know, is heating, ventilation, and air conditioning.
We're going to replace all of these with one bank of multi-processor core two duo servers using larger capacity SATA drives.
The power savings on just the servers will be over $300 a month.
This doesn't include the cooling savings, which can be two to three times the electricity savings.
Wow, I didn't realize that.
That's a nice little bonus.
That's a good point.
Wow, I didn't even think about that.
I wonder what he's going to do with all those sun servers.
I mean, if he's looking to get rid of them, you know.
Send them our way.
That's right.
Hey, I'm all over it.
Plus, with Solaris 10 being free, you know, that would be a nice little combination.
Two, still under the business side of things, the second thing is compartmentalization.
Wow, that's a good Scrabble word.
As you touched on in episode 169, you can snapshot these machines at periods in time.
You can also set up a bunch of servers which are logically separate.
You can move them from physical box to physical box.
You can clone one server, change its IP, and test upgrades changes to it.
If a box gets hacked, you can snapshot it for forensics, then go back to a backup.
Before it was hacked, patch the broken service, then spin it up again.
Yep, again, we kind of – actually, I don't know that we clarified that is a good idea of taking a snapshot for forensic purposes.
I don't think we mentioned that.
That's another good idea.
And on the hacker side, as mentioned in episode 169, I think all these – you can use it to sniff traffic between machines.
This is easier than dropping a hub in line between two machines and sniffing the traffic between them because you can do it completely inside one physical machine.
So, yeah, a lot of those things we touched on, and you added a lot of new ideas in there, too, that we hadn't.
So we always welcome email like that, certainly.
So thank you – what did I call him?
Joe Bob?
Joe Bob.
Joe Bob's what we're going on.
Unless you found a different one.
He didn't sign his name, but –
Well, we'll just – let's go with Joe Bob.
It doesn't matter.
Joe Bob, you know who you are.
Thanks for the email.
And actually, let me see.
Now, I'm going to wing this off the cuff here, Ratchet, if I may, because I think there was one other email that I wanted – yeah.
Can I do one more email?
Do we have time?
I'll make it quick.
Yeah, sure.
Go ahead.
All right.
This email just came in recently.
It's from Thunderstruck.
Thunderstruck says, guys, I'm not the type to use labels, and I hate the term hacking personally, quote, unquote, hacking personally.
But really, it should be defined correctly.
Hacking most certainly is not, quote, thinking outside the box, end quote, or simply, quote, exploiting systems vulnerabilities, end quote, as you guys have defined it, nor is it the act of running a script, which you did not write, to attack the vulnerability that you did not find on a system located with a ping sweeper port scanner that you downloaded off of the web.
This type of person is not a hacker at all, but rather what we call in our community a script kitty.
Someone who takes from the community but does not give.
The media should not portray this type of individual as a hacker, but rather what he or she is, a criminal.
Hacking is the act of modifying, altering, or exploiting a technology to perform outside the scope of its original intended use.
It's really quite simple.
In the context of your show, I may exploit the server messaging block, SMB protocol, on an IIS server in order to allow me to administer access to the server using a Perl script I wrote.
But the Perl script is not the hack, but rather the exploitation of the vulnerable protocol on the server.
You see, I'm extending the technology of the IIS server beyond its intended scope by convincing the server to grant me access.
Likewise, the kernel on my Linux system was not designed to handle my Wi-Fi network interface, so I hack the kernel source code to enable support for the device.
I flip or hack the boot page on my TiVo in order to trick the machine into not loading a handicap bootstrap, which prevents me from running homemade software of its hardware.
I solder a new basic input-output system, or BIOS, onto my Xbox, which allows me to bypass the crippled BIOS so I can play emulators, Xbox, Media Center, and other homemade software on my Xbox.
Essentially, one can hack anything, as long as it retains a technical connotation and as long as it extends or exploits the intended scope of something.
This dates all the way back to the homebrew computer club, and it applies in the same manner today.
So, enough of all this good cop, bad cop, white hat, black hat, hacker definitions.
Hacking is far broader than just network hacking, and I wish other types of hacking, such as hardware and consumer electronics hacking, got paid more attention to since, in my opinion, they're far more interesting than network hacking.
Anyhow, great show. It's a noble effort, and if I have some free times, perhaps I will volunteer to be a mentor at some point in the future.
Thunderstruck. So, thank you very much, Thunderstruck, for that email.
However, let me just back up, because, and I think even one of the earlier emails referred to it, and actually, let me go back and look at that earlier email,
because I was very careful to word that. I don't know which episode you may have heard.
I mean, I've said before I do have a pretty liberal definition of what hacking is and is not.
But we did do an episode recently where I tried to go into a good clarification and kind of make a final opinion, I guess it is,
because no one can ever define a word like hacking because it's so variable and so ever-changing.
I think Webster's did.
Well, I'm sure they tried, but we did, I know I did an episode, and I went out of my way to try not to say that it is this or it is that,
and I certainly didn't say, and I'm trying to look, I think it was this, one of these earlier emails, let me see.
I do, okay, so this was from Jeff earlier email who said,
I believe that I have what Stank calls the hacker mindset.
And what it sounds like you're describing there is what I described as the hacker mindset,
and I do stick by that definition.
Absolutely, to be a hacker, okay, and I will, I'll stick to this, I'll go down swinging with this,
is you can't be a hacker if you do not have that mindset of curiosity and tinkering with things
and taking them apart and pushing things beyond their boundaries, seeing what they can and can't do.
Don't accept no for an answer.
Pushing things where they weren't intended to go.
That is absolutely the foundation, the hacker mind, the mindset upon which one can become a hacker.
If you don't have that, I'm sorry, I do not see anyone without that mindset ever being a hacker.
So I've never said that that single alone thing makes you a hacker.
What I've said is that that's the building blocks that can make you and take you into being a hacker.
I do think you can teach security.
You can teach hacking to a limited extent.
You can teach hacking techniques, you know, and absolutely, I don't even,
the definition he made of skitties and hackers, I don't disagree with any of it.
I think that's exactly what we've said, but I do believe that there is a fundamental building block
of what makes, what can make a hacker.
Let's say a good hacker.
If you can't think outside of the box, you can't think outside of the lines
and push beyond what normally people, what normal people would stop,
then you don't have the building blocks to become a hacker.
And that's all I've ever really said along those lines.
So I don't know if maybe you want to go back and listen to that particular,
I don't even know which episode that was.
Or maybe he's listening to an older episode that maybe wasn't as in-depth as that one we did fairly recently.
Well, I think back about, I don't even remember when it was,
back a while back, one of my early episodes during season two,
we had like, you know, how not to be a skiddy or something like that.
Yeah, okay, yep.
I remember that one.
And, yeah, we covered a lot of the basic stuff,
but that really doesn't actually talk about how to be a hacker.
It's more of how to, like, not to fall into common pitfalls certain people,
you know, getting snared in.
Right.
And you know what?
We started episode one of this show four years ago with the what is a hacker,
a little bit of a what is a hacker thing.
So it's never going to be defined.
It's constantly changing.
You're shooting at a moving target anyway.
And, you know, it's kind of like, yeah, I mean,
I think we've said all that needs to be said about it,
and everybody's going to have different opinions and different definitions,
and that's okay.
It really is.
Actually, it's okay that people have that.
That's what hackers do.
If you all agreed on a definition, then none of us have the mind of a hacker.
How ironic is that?
So, anyway, I think that's all the email for at least that I had.
Did you have anything?
I actually don't remember actually seeing that email that you read,
so I'm going to have to, like, look at it back on all my stuff and see what I missed.
Because, I don't, like, this spam problem is getting out of freaking control.
Yeah, well, it's like spam assassin picks up quite a bit,
but then you also have to have good filters on your client because some of it slips through.
And, yeah, it's a mess.
It's a mess.
Well, it's like, I mean, ever since, what is it, like September for me,
like, and apparently, like, these pump and tum stock scams have been, like, going crazy.
And I guess someone actually looked some research into it,
and someone wrote about it online.
Apparently, it's like, you know, these, like, five major botnets all started doing all this all at once.
Like, they were purchased by the same person.
Same nefarious person.
Dum, dum, dum.
And that's what's causing all the, well, causing all the issues,
which really freaks me out personally.
But, let's not go in there.
We covered that last week.
Yeah, yeah.
All right, well, I guess let's move on.
How much, how are we on time here?
We've got to probably pick it up a little bit, yes?
Eh, we're about 45 minutes in or so.
40 minutes, probably, I guess.
Well, how about you tell me?
You're driving.
Oh, you want to do a personal show and tell next,
and personal hacking stories and all that wonderful stuff?
Or do you want to just segue right into the shotgun topics?
Well, to me, they were going to be kind of one and the same.
I guess I'll, I tell you what, you start if you've got any,
and then I'll kind of segue in and then drive us into the main topic.
How about that?
Well, my big news, and I'm sure not theory is absolutely, you know,
rejoicing over this news.
I haven't told them yet, but I've dropped the sidekick.
I'm now running a T-Mobile MDA or a, I think it's HTC Wizard,
for those who don't know.
It's a sweet little thing.
I've only got a credit for a couple of days,
and I'm still, you know, working out everything and figuring everything out.
But I got all the BINREV email today at work on my lunch break without plugging into the work email address
or work internet because I don't want them to sniff BINREV email and see where I'm going.
And technically, you're not supposed to use other unapproved email accounts.
So I had it plugged into my MDA, and I was using the T-Mobile dial-up.
And it was pretty good.
I was pulling out about 20K a second.
I actually downloaded a BINREV radio show just to see how fast it was going.
It was going about, it topped out, I think, at 20.9K.
It was usually hovering around 19.5 to 20.
How did you measure the speed?
I was pleased.
How did you measure the speed?
I downloaded a BINREV episode, and I just see how fast it was going.
Oh, you just, okay, so you just kind of did the math.
Yeah.
Yeah, gotcha.
It was saying 20.0K a second.
And I was like, okay, there's my average speed.
Ah, there you go.
I'm good like that.
There you go.
So, yes, it was pretty sweet.
Plus, you know, riding home on the train this afternoon, I was checking out all my email.
Is that Windows Mobile 5 powered?
Yes, Windows Mobile 5.
It's a 195 megahertz OMAP processor, which I'm not exactly sure who makes it.
And it's made by a company called Q-Tech, which I believe is based in Taiwan.
Yeah, they make good stuff, though.
They do.
They make some nice phones.
I mean, the one complaint, I think, I always wanted to have like a cell phone roundup show
and just, you know, get various people on here with all kinds of different phones and, you know,
let them all duke it out.
Yeah, we've done that, but they've been scattered amongst episodes as we all change here and there.
Yeah.
But, yeah, I dig the MDE.
So far, I give it a thumbs up, but tentative.
Well, yeah, exactly.
I did it first also with the Trio, and then, of course, it kind of went downhill from there.
And actually, since we're talking about it, I'm not real happy with the Trio again right now
because it got better when I upgraded.
They made a software upgrade.
So I downloaded and installed all that and, of course, rebooted the phone,
which is always funny to reboot Windows, even if it's on a phone.
And it was working fine for a while.
Now, all of a sudden, it will not connect to the global interweb automatically.
It's almost like it's constantly in flight mode or something.
But I've looked at all the configurations, and it's definitely set up right.
It's just a flaming piece of shit is what it is.
So I'm not happy about that.
So my e-mail, I have to manually make a connection to the global phone interweb
and then check my mail.
So I'm not getting, like, the instant notification,
which is one of the reasons I bought the phone in the first place.
Oh, actually, I'll go toss this out here.
For you and technically everyone else, there's a website out there,
and it's called www.portport, the number 8 and the number 8, port88.org.
And I don't know what the hell he's actually doing it on and how legit it is,
but he's an avid poster in sort of the developer forums for this group of people
set up a bunch of developer forums for all the HTC QTEC stuff.
And he set up basically a free Exchange 2003 server.
You'll get an account, and he'll use the direct push e-mail service,
which essentially is what Microsoft clone of the BlackBerry system.
It'll set it up for you.
And I'm not sure exactly he can read your e-mail or whatever,
but I'll definitely give him props for, you know,
at least sponsoring a good community service.
Nice.
Yeah, yeah, props to him.
I think his name is Austin or something.
That was my Borat impression.
Yeah.
It is nice, yeah?
It's nice.
I like this.
Yes, back in Kazakhstan, we use our direct push e-mail to get the prostitutes.
How annoying would it be if we did a whole episode in that voice, of all things?
Dude, that would rock.
We've done the prawn episode.
We've done the rock and roll.
That was the funnest one.
Not theory, not doing our rock and roll voices.
We did the pirate day.
We did, oh my gosh, we've done a lot of them come to think of it.
Oh, we're a bunch of losers, aren't we?
Yeah, we're going to have to add Borat to the list.
And Ollie G.
That's like some reporters.
Yeah.
Anyway, well, actually, I'll just talk about one thing I've done recently, physical security
here.
I actually have a Viper alarm system on my car.
And specifically, the 791XV, if anybody wants to go out there and try to own it.
Oh, it's got the X in it.
That means it's like extra cool.
That means it's, yeah, this one, it is kind of cool.
It's got the, it's not a pager.
I call it a pager, which is not good terminology, but it's got a little RF, it's got a little
antenna in there that if somebody does try to go in the car, not only does it set the
alarm off, but it sets my pager, my key fob off.
So if I'm in the office and somebody tries to break into it, it'll vibrate and it's got
a little LED on the front that'll tell me where, what set the alarm off.
Was it the door?
Was it the trunk?
Was it the hood?
Was it the whatever?
But simple point being that if it goes off, I run outside and kick somebody's ass.
That's the whole reason.
That's the point.
I got it.
No, no, no, no, no.
Say it like it is.
You run outside and get your ass kicked.
No, I'm glad.
Hey, no, you mess with my car and you get fucked up.
See?
There's no, there's no playing around with that.
You fuck with my car, that's your ass.
It's that simple.
Gang, bang, or stink.
That's right.
Gang, bang, I don't know about all that now.
So, well, what has happened?
You see, what had happened was, I was, you know, it was like this.
See, here's what happened.
All right, so here's how it went down.
You ready?
Here's what happened.
I lost the key fob.
First of all, the key fob's a piece of crap.
It falls apart easily.
I lost the back of the battery case a long time ago, so I was walking around with the
battery sliding in and out all the time, which is annoying because it makes a noise
every time it does.
And then I tried to scotch tape it together, and of course, that doesn't last long.
And then you've got to change the battery, and it ruins it anyway, every month or two.
And anyway, yada, yada, yada.
I finally got to the point where I lost it, so I was signed to buy a new one.
So, interesting process, I thought.
I'm like, this is kind of interesting.
What's to stop me from, you know, ordering one of these replacement key fobs online and,
you know, going out and owning someone else's car?
So, I'd never really known how the process worked.
So, those of you who do, and you can just kind of fuck off now, and I'm going to tell
the story to those of you who don't.
Basically, what you have to do is you get this transmitter, and of course, you're going
to have to reprogram it to the frequency that the alarm is using, right?
So, I thought to myself, well, that would be really cool if that's all there is to it,
what's to stop me from syncing it up with someone else's car, you know, and thereby
owning their car just with my new programmable remote entry unit.
I don't know, key fob, I'm going to keep calling it, because I don't know what else to call it.
Key fob, no, that sounds right.
Transmitter, it's a remote transmitter is what it is.
So, well, here's actually how it works.
It's very secure, as it turns out, and I just did not know this, because I've never
been through it before, but to reprogram this thing, you have to do a couple of things first,
and this is why I kind of preface it with physical security.
First of all, you have to have a door open.
Well, that alone, okay, that's kind of a problem.
I mean, I guess you could get a door open.
What if somebody left their car unlocked?
You could obviously open it very easily, so that's not a problem.
But that is pretty detrimental if somebody's car is locked.
You'd have to jury-rig it.
You'd have to slip your Slim Jim in there, which, you know, I have one in my trunk at all
times.
I don't know about everybody else, but get the door open.
So, there's step one.
My trunk's full with that, Hooker's.
Well, yeah, but you have room for the Slim Jim, don't you?
I mean, you've got room for the bat to knock him out.
You should certainly have room for a little Slim Jim.
No, no, no.
I just have chloroform in my pocket.
Oh.
Snap into a Slim Jim!
So, the second part of this, not only do you have to have the door open, you have to
have the key in the on position.
Well, there's a big problem.
If you've got the key, well, you know, it's kind of like having physical access to a computer.
You know, if you can sit down in front of an unlocked computer, you know, you've got
the key or you've got the password.
There's not really much of a challenge left to it.
So, that's another big detriment physically to getting in the car.
So, you actually have to open the door.
You have to put the key in the on position.
And then, you have to look up on this little chart.
Now, these are probably available online, but it gives you a little chart because this
transmitter can be used for several different models.
So, you'll have to put in a little code that associates with your particular model.
So, you have to punch in a little code to it.
And there's also what they call, what I call anyway, a valet switch.
In their directions, they were pretty vague.
They didn't, they called it something else.
But there's a little switch that you can put in your car.
Irrelevant of this, when you get the alarm put in the first place, there's a little switch
you can put in at the bottom because this model also has the remote start feature.
Well, sometimes you don't want other people remote starting your car.
So, there's a little, basically, an override switch, an override button.
They call it a valet switch.
So, if you give your car to valet, they can't remotely start your car.
So, you have to flip that over into the off position as well when you program your car.
So, you've got to go through three stages of pretty intense physical access.
And if you've got that kind of physical access, you pretty much already got the car, right?
So, long story short, you can't really own somebody's car with this program over remote
control as easily as you would think because it won't even go into listening mode or programming
mode without doing all of those things.
Now, once you do it, punch in a code, you wait for a few seconds and it reprograms itself
in a matter of two seconds, if that, and you're done.
And it's all synced up and ready to go.
Now, don't ask me why or how I got an automatic start on my stick shift car.
That's a whole other story altogether.
I didn't know you drove sticks.
Come on, real men drive sticks.
Oh, whatever.
I do four wheels and it goes.
Oh, please.
You've got to have control over the automobile.
See, you know how much crap I got for the car hacking.
We're not going to go off into that segment on the radio show, too.
Nobody likes to car hacking.
Well, no, it was cool.
We're not going into it.
Do you want to go segue into the main topic here?
Yeah, and actually that is kind of a segue as far as physical security somewhat relates
to our main topic insofar as e-voting.
And specifically, I guess, I don't know, the best way to approach this, I would think,
and I don't know, tell me what you think.
I did watch this HBO special.
It's kind of somewhat been in the news lately called, I think it's called Hacking the Vote
or something like that.
Hacking Democracy or something?
Yeah, it is.
Hacking Democracy.
That's what it's called.
So there was some controversy.
It's been in the news because there's a little bit of controversy where it is pretty much
what you're assuming it's about.
It's about the Diebold machines and the vulnerabilities and how easily they can be defrauded or how
inaccurate they can be.
I guess it's probably a better way to approach it.
So this documentary just aired, I think, three days ago when you're listening to this
probably.
I think it aired on Sunday or premiered on Saturday or Sunday.
And I guess Diebold and other companies were trying to fight it being released, telling
HBO they couldn't air it or something like that.
And HBO was like, it's the foo.
And they aired it anyway.
Get back to voting.
Yeah.
So she voted, watched it, and it was actually pretty decent.
It was pretty good.
Did you see it by chance?
No, no.
I know not of these premium channels that you speak of.
Oh, yes, yes.
You have to get the HBO and HD.
But, yeah, it was pretty interesting.
And a lot of it, here's the thing.
I had kind of a little discussion, we'll say.
Debate?
Argument?
No.
We had a discussion with someone at work about, at the end of this thing, I kind of, there's
a lady at the end of it, basically, and I'm not giving away the ending or anything, but
she was kind of putting on these crocodile tears or the kind of fake, I don't know if it
was fake, but she started crying about, oh, my gosh, all our democracies are gone.
I don't know if all our bases belong to Diebold, whatever.
I'm in your voting machines.
I'm stealing your democracies.
I'm stealing your votes.
It's like, yeah, I mean, it's kind of sad and pathetic, and it just, I don't know, it
came across, come on, you're really crying?
I mean, listen, I don't, I'm ashamed that our democracy has turned to this and it's a
fucking joke also, but this is not new.
You know, it's like, I guess she'd heard it for the first time or didn't realize that
this was not like a hacker who was in the know.
This was a, you know, a lady who was trying to get down to the truth and all that kind
of stuff.
So she was kind of, I don't know, I thought it was a little overly dramatic by self,
but it's like, this is not news to anybody.
So if you're looking at this thinking you're going to see anything new, it wasn't a whole
lot new exactly, but it was very well put together, very well done.
And I guess basically, should I just kind of walk through it maybe and you jump in?
Because I know there's some, we're going to tie this into some e-voting topics in general,
right?
Yeah, yeah.
As we go along or?
Well, I have a couple of talking points written down here in the show notes.
Okay, well, I think, I think, I mean, from what I've heard, I mean, I haven't heard, I
have, like I said, I haven't watched it, but I've heard a bunch of people talking about
it and apparently, it's a lot like you, apparently a lot of people agreed that it was pretty good,
it was nonpartisan, it wasn't, you know, too inflammatory.
Inflammatory?
I don't know, that's not the word I'm looking for.
Too, it's not, it's not as much as, you know.
It's biased towards any party or anything.
The sky is falling, you know.
No, no, it was really an analysis, it was an analysis, it was a start to finish study
and let's see if we can prove it kind of thing.
And actually, the opening I thought was really cool because it's a lady that runs, I think
the site is blackboxvoting.org, I'm pretty sure about that.
And the lady that runs that, it was basically, she's a non-techie, she's actually a writer
if I remember correctly.
She's a non-techie and she was from here in Florida, if I remember correctly as well,
where we had a lot of the voter problems in 2000.
So the documentary itself, I thought, and let me preface again, we're talking about this
from a technical standpoint, analytical standpoint, kind of a review.
We're not going to go party lines, we're not going to go into politics, we're not going
to do any of that.
And I have to say, the documentary, I think, did a fairly good job.
They did drop a few names, but for the most cases, they were in factual statements and
comments.
So, you know, I guess that's perfectly fine.
But, that being said, they went in and basically, you know, she was driven by the 2000 election
and the outcome being so close and the questionable votes and the hanging chads and yada, yada,
yada, all those stories.
So, she kind of went on this little quest of trying to figure out, hey, did my vote really
count?
Which is extremely admirable, in my opinion.
So, the first thing that she did...
I actually think she went to DEFCON 12, I believe it was.
Well, and here's the funny thing.
They referred in the documentary later on that she went to a hacking security conference,
but they didn't mention the name.
And I was there.
Oh, yes.
So, wait a minute.
Did I...
No, I presented at 13, right?
Yeah, anyway.
I don't know.
You weren't there for 12.
I don't think I made that one.
Anyway, she...
The thing started off, I thought, really cool.
First thing she did is she just started going out into global interweb and doing some research.
Of course, like anybody should start doing when they're doing any kind of hacking, go do
your research first.
Do some homework.
She went out there and basically went searching for Dibold.
She did a Google search.
And when she got the Google search, she clicked on the page.
And she wasn't actually taking to a webpage or a website.
She was taking to an FTP site.
The FTP site was run by Dibold and it contained the source code for their system.
So, now, I would have had a fucking ball with that myself.
I would have eaten that shit alive.
But her, being a non-techie, she didn't really know exactly what she had stumbled across.
And she spent a long time...
I think he would have pooped himself.
What's that?
I think he would have pooped himself.
Absolutely.
I would have never...
I would have been in the house all week.
I would have called in sick to work.
Anyway.
She did not really know what she had because she was not a techie.
She was not a programmer.
She couldn't decipher this code.
And that's one of the things that ended up leading her to this unnamed security conference,
DEFCON 12.
She went looking for someone who could help her out and to decipher this.
And she found someone.
And my gosh, I should have the name and I don't.
So I horribly apologize to him if he's listening.
But I believe it was a Dutch...
He was a European hacker who had done some research on the devices.
And some people who did some...
Helped her decipher the code itself and how it was working and how simplistic it was.
And remember earlier when I referred and said, you know,
Microsoft Access would come back up later?
Well, guess what it's powered by?
I'm guessing Microsoft Access.
You got it.
Ding, ding, ding, ding, ding.
Microsoft Access.
So the code itself, first of all, was out there and publicly available.
And it apparently was very simplistic.
Another cool thing is the documentary itself.
And the very opening and credits and the very opening scenes,
they were scrolling some source code on the screen as they talked,
you know, for dramatic effect and whatnot.
And if you can actually read C, C++, you can read code.
As it's scrolling by, I'm looking at it.
I'm like, damn, that's not just fake cookie cutter code that they threw up there for effect.
I can see kind of what that code's doing.
That's legitimate code.
That's something to do with voting stuff right there, which I guess makes sense.
They're owning Dival because he just saw the code.
Hey, you find...
Listen, let me tell you something else.
On HDTV, you do some freeze frames and you can see some stuff on screens that people might not have thought of or realized before.
Back to my, what was my presentation that enters own?
And then again, that Hope was looking and finding all the information on the screenshots and things that are...
Oh, my gosh, I was going to see a presentation I saw the other day where somebody had screenshots with lots of docs in it.
But anyway, so the documentary started off with that, how she went out to Google, downloaded these things.
Well, Divald accuses her of breaking in and stealing them.
Gee, any hackers out there can't relate to that story?
Let's see, it's out there on Google, it's on the global interweb, it's on your site with no password,
and it's just sitting out there playing to be found, yet somebody broke in.
No, you're a fucking moron.
Okay, so they still hold, and I guess they're still fighting with her, trying to punish her, saying that she broke into it.
I guess it's still something that's ongoing, or they alluded to it being anyway.
But they couldn't do anything about it, I guess, so she had it, was out there shopping it around.
The genie is out of the bottle.
Exactly, you can't put the shit back in the horse.
So, that, as well as, that drove her even further, what she did is she went down to the voting precincts,
to Volusia County, Florida, which is where the big fiasco was before, and did some dumpster diving.
And not only there, lots of other precincts as well, but that one, she started that,
and she got hit the jackpot with lots of registries, lots of reports, lots of things that showed some incorrect information.
Printouts that showed that Al Gore had negative so many thousand votes.
Why is there even a fucking negative, why is subtract even a function in these programs?
There's no, it's an impossibility.
Because Al Gore sucks that much.
Well, true, true, but we won't go there.
See, why'd you have to go and bring politics into this show?
No, I'm not, I'm not saying, I'm just saying Al Gore, I'm not saying anything about any other,
I'm not saying politically, I just can't stand the man.
That little wooden boy, come on, he invented the interweb.
Him and Cliff LeBlonski.
But they basically found all these documents, all these registries, lots of printouts and stuff like that,
that legally, they're supposed to be held for X number of years in storage,
but they were already being thrown out.
They were inaccurate to what the results were showing.
They were showing negative numbers, which, of course, pushed her further to go confront Diebold and say,
hey, how did this happen?
You know, how do you have negative votes?
You know, that's just ridiculous.
It's kind of like when I mess with people when I go into the everything's a dollar store.
Every time I go into the everything's a dollar store, I always ask the lady at the cash register,
I'm like, how come you don't just have one big button that says one on it?
I mean, everything's a dollar, right?
Just hit the one button over and over again, but I digress.
And don't write any email.
I know why they have them.
That's a joke, people.
So it's like these brought up more questions.
She went and tried to confront Diebold, who, of course, are defensive about it, deny the whole thing,
claim that, you know, it doesn't mean anything, that just because a report generated this,
that the results were accurate, et cetera, et cetera.
Well, she got some cooperation from another precinct here in Florida,
and they did some testing and found out, again, that, like I said earlier,
that it was powered by Microsoft Access on the back end.
And they went in and looked at the reports for the voting, did some tests,
and they're like, okay, we're going to do some tests.
Here's how many votes.
So it's from a local high school election.
They said this person got this many votes, this one got this many.
You know, fine, right?
Well, watch how easy this is.
They went, double-clicked on the MDB, or I think it was an MDB, Microsoft database format,
Excel fired up.
They went and browsed the table with the votes, typed in 5,000 instead of 500.
Bam, instant vote change.
Completely changed the election by simply going as anybody could have gone in
at any precinct around the world that used that 4.0 version of the software
and changed the votes that easily.
And this was just a few years ago.
This was after the 2000 election.
We don't know what happened with any of those voting machines.
It could absolutely have happened.
And how would we ever know?
Well, that's where her question was.
Well, a lot of people are saying, oh, you know, this could happen, this could happen,
this could happen.
And, I mean, yeah, okay, I will agree.
Yes, all of those stuff are theoretical possibilities.
But the question is, I mean, it's more of a concern that if, getting back to the
Physical Security Act's point of it, you know, you need to make sure that these boxes are
secured and all this kind of stuff.
And I think that part of the problem is, is that they're expecting, you know,
Diebold, you know, or, you know, I'm not even going to say Diebold, you know,
Jim Bob's, you know, voting machine, you know, manufacturing plant, you know,
when they hire this developer, he's expecting it not to have all of this.
You know, he's not hardening it.
He's assuming that certain things are going to happen.
Like, you know, say, for example, you know, they lock these machines up every, you know,
for like, you know, 354 days a year.
And a lot of these things just don't happen because, you know, you're talking to your
local elections commissioner.
He doesn't have any idea about computers.
Right.
He's usually a political appointee.
Yeah, but you know that all I have to do myself is to walk down there and become a
volunteer at the precinct.
And who knows what they might, I tell them I have computer experience.
That may be what they assign me to do.
Do you want me in charge of that box that calculates the votes?
Actually, yeah, I trust you a lot more than what I have to do.
Well, that's a whole other topic.
But anyway.
Well, no, no, no, no.
I mean, political leanings aside, I mean, I would trust you a lot more than I would trust,
you know, some random schmo off the street.
Aw, that makes me feel special.
Aw.
I have a chubby.
I've got a chubby checker.
Anyway.
But honestly, this is a valid point.
I mean, joking aside, I mean, yes, it's like you're playing the coulda, woulda, coulda game,
you know, coulda, woulda, shoulda game.
Which is very easy to do in retrospect and stuff like that.
But let's acknowledge that at least the possibility exists.
And when you're talking about one of the greatest things that we have to execute our powers of democracy,
and that is voting, you can't leave holes like that open.
You can't do it.
And the overall problem here, and I'm not going to delve into politics,
but one of the overall comments of the show was this is what happens when you start privatizing.
Privatizing meaning giving private corporations control over public events and things like voting where they don't really,
it's not open source, they hide all, they would not release anything.
All these demands and questions people made on them, die bold, deny, deny, dodge, duck, deny.
They would not give up the source code.
There's no auditing done.
They followed up on the auditing process in this documentary as well.
They went to the auditing company that signed off on it, confronted the guy,
and the guy basically said, look, all we do is write reports.
They give us a list of check this, does it work, check that, does it work, check that, does it work,
and we check it.
Guess what the one thing on the list that said N.A., do not check?
Security.
So security was never checked outside of die bold, only internally.
Well, that's, again, we've, hackers for years, have talked about the dangers of closed source for things like that, you know?
So what are you going to do?
You can't privatize something like that, in my personal opinion, but we'll back away from that,
and that was one of the other messages and tones of the documentary.
Well, so that's one aspect of it was getting access to the server and how ridiculous it was
and that anybody and anyone that had access to the computers could have easily done that.
Well, the second thing they did was some of the newer die bold machines that used the little memory card.
Now, as far as I could tell, it didn't look like any memory card I'd really seen before.
It could have been just a PCM, CIA, POW, JJ, Walker, I don't know what the hell, one of those laptops.
I think it's a PC card.
It looked like it at first glance.
They didn't mention it on the show, but it wasn't anything small like an SD or a compact flash.
It was something larger, some sort of memory card.
And this is where she went to DEFCON or the unnamed security conference and had someone contact her from Europe
saying that he had gotten his hands on one of those cards and a card reader and was going to do some testing on it.
And he came to the conclusion that the card actually has executable code on it,
that when you put the card in, it boots up and runs something off the card, which, of course, is a security vulnerability
because you could put your own card in there and execute your own arbitrary code, arbitrary code injection physically.
So he pointed this out.
Die bold, of course, deny, deny, deny.
And another thing that die bold had been doing is, you know, when they were occasionally caught in a lie,
what their spin control was, was, oh, well, the person we answered that question was a salesman.
They didn't know or didn't understand the question, and that's why they said this.
That's how they'd spin out of it.
So they confronted the head engineer who designed the whole thing and said, hey, here's another concern.
Is it possible that somebody could load software onto the card?
Does it execute anything off the card?
And he got right up in front of the people and said, nothing is executed on the card.
There's no executable code.
Well, that was a flat-out lie.
And don't sue me, die bold.
I'm reporting a review of the documentary.
That's all I'm doing.
Stank dog versus die bold.
Die bold versus stank dog.
So what this gentleman who had the card reader and writer was doing is he went and kind of altered it a little bit
with a different algorithm that would not only just boost votes or vote for the other person when you put it in.
And, of course, I kind of skipped over some of the non-technical part.
There were glitches that they pointed out, too, where sometimes people would touch screen on one candidate
and the other one would light up, or some candidates simply wouldn't let you touch them.
They would just be as though they were blocked out.
They just wouldn't take the vote.
So there were other glitches.
I could really just toss up references to Mark Foley right here,
but I'm not going to do it with that whole, you know, some candidates don't want you to touch them.
Yeah, yeah, yeah.
We'll leave that alone.
So there was some of that in there, but for the most part I'm focusing on what I thought was the cool part.
And this was this card.
So what this gentleman did was he wrote his own little exploit code, I guess, onto the card,
and he did not have access to the server to test it on.
So they brought him over here.
He brought his card jacked up with his algorithm,
and Diebold claimed that even if there was code put on the card that the server wouldn't allow it to execute.
The server wouldn't allow the votes to be changed or whatever.
Well, he put in the card, and basically what he did with his card was every time somebody voted,
it would have a little algorithm in there, and I don't know the details,
but basically it was kind of doing a two votes for one type thing.
Or on some occasions it would work fine, but other occasions it would add,
subtract a vote from somebody else and add two to the other person and vice versa.
It had a little algorithm, but long and short of it was the way the algorithm was written,
whatever the total votes were would match.
It would just occasionally take one from the other person and give it to the other candidate.
That way it didn't look odd when you've got a county that has 5,000 people and there were 20,000 votes.
That could actually be caught by the human eye, somebody who's paying attention.
It's better voting.
Right.
That's what only happened in Chicago.
Well, yeah, in Ohio and Florida.
They ran a little test impromptu.
They made up a fake election that said, can the Dybulb voting machine be hacked?
And it was a little OCR scanner, and they filled in their bubble sheet.
And eight of them said no, and one of them said yes, I think is what it was.
No, two of them said yes.
And when they slid it through, the results were, I think, nine to one opposite of what they actually voted.
So it was proof that, yes, with his hacked card, with his arbitrary code, it executed and counted the votes wrong.
When they printed off the receipt from the individual machine, it was absolutely not what was recorded as the proper votes.
So they then said, okay, well, we've proven that, but maybe Dybulb's claim about how the server wouldn't accept it is different.
Maybe the report was hacked.
The function that generates the report was able to generate fake results, but the actual vote data is still intact.
So they took it to the server that I mentioned earlier, powered by the access thing, which supposedly they had fixed in later versions.
Powered by access.
Yeah.
Dude, if my voting machine said powered by access, I'd be like, dude, give me a piece of paper right now.
Yeah, exactly.
I don't want the paper vote.
Give me two stones, and I will bang them together, preferably on the machine.
Hanging chads, right.
Well, I don't know about you, but when I went, we had the touchscreens when I voted the last time for the presidency, and I was doing the four corners.
I was dragging and dropping.
I was trying to click everywhere, but I couldn't break it.
I couldn't crash it.
Well, I mean, for me, at least in Massachusetts, I know.
I've been told that, you know, I know for a fact that where I used to live had this, and I'm pretty sure down here has this as well, where I live now.
We have basically giant scantron, which is, you know, take the pencil, fill in the bubble, count your vote.
Yeah, and that's the one they were focusing on at the end of the documentary.
Oh, really?
The big scantron side where they fill in the bubble, and then the thing generates a little printout like a receipt tape.
I'm getting owned.
Yep.
Yep, you're the vulnerable one.
Yeah, and I think that's part of the problem is that there's been electronic voting for quite a while now, and people just don't realize it.
They think, oh, electronic voting, touchscreens, you know, stuff like that.
I think a lot of people don't realize that electronic voting also counts in along the lines of, you know, these scantron sheets.
I didn't know they actually covered that in the documentary.
I'm glad they did.
And even going back to, like, you know, 2000 and where they used to have butterfly ballots, it was – I mean, those are all electronic, too.
I mean, for those of you who don't know, I am a political junkie.
I mean, you know, Election Tuesday is my Super Bowl Sunday junior.
I am covering, like, you know, at least 20 different races that have nothing to do with me in the grand scheme of things, but I'm just, you know, absolutely excited.
And I hope that everybody listening right now voted today, by the way.
I know I did.
Will did.
Actually, well, I guess if you're on the West Coast, you still have a chance.
I did as well.
I will admit I did not vote in my primary, but there was absolutely nothing to vote for, quite literally, in my primary.
The Democrats had it.
And seriously, Massachusetts, we're having a governor's election, and the Republican nominee, who's the lieutenant governor now, is a stiff.
And I am voting for this.
I, actually, I'm not going to name names.
I was going to give my endorsement for them, but the independent nominee solidified my vote by running a cartoon ad that basically said, that basically showed all of the political people in Massachusetts with their heads up their asses.
Owned.
Yeah, you really, like, do a, I'm not going to say anything, but hold on, I got another phone call.
One ringy dingy dingy dingy.
Well, I'll continue going on with it a little bit.
The way the thing basically ended was at the end of the whole documentary, they showed all these vulnerabilities and whatnot, and by the time the documentary was over, as Black Ratchet answers the phone in the background, by the time the whole thing was over, the last thing they did is after finding all this evidence out that they were absolutely flawed, the potential exists for damage, is they went to California to, I don't remember who the person was,
but one of the larger districts in California who was in the process of signing a $22 million, I think it was, $22 million deal with Diebold to purchase these new machines, and basically this lady from blackboxvoting.org, again, I can't pimp the site enough, of course,
and her group of people, they went with their evidence and said, hey, look, this is a problem, hey, look, this is a problem, hey, look, this is a problem, so this was towards the end of the documentary, it wasn't the end, but towards the end, and they basically showed this person in California, hey, here it is.
You're buying stuff that's flawed, they can't deny it, they can't argue, they were telling you up front what it is, and they did end up spending the $22 million on these new, broken, Diebold voting machines anyway.
So it's almost like, and that's why a lot of times hackers get frustrated and go underground with a lot of their findings or release things anonymously, because we know that people aren't listening.
Even if we tell them sometimes, they still go and do it anyway. I mean, if you tell somebody that something's insecure, you tell somebody that there's a problem and they ignore it, what are you going to do?
It's like my Star Search article I released in 2600. I notified those people like a dozen times, and they never bothered to fix it or cared to fix it or never reached them or whatever the case may be.
You know, and that happens a lot to people. You try and you try to tell them that they have problems, and if they just refuse to acknowledge it,
what else can you do about the whole thing?
I mean, well, to be honest, I mean, what's the alternative right now besides not doing anything about it,
which unfortunately I think a lot of people aren't going to do, period.
I mean, you know, everyone says, okay, Diebold sucks. We're not going to use Diebold.
But they're not the only player in the game.
Well, they're not the only player in the game.
They aren't?
They're the predominant one. The documentary specifically mentioned three total, including Diebold.
Now, Diebold and one of the other companies own 80% of the market share.
So it is certainly a predominant amount, but they're not the only one out there.
And secondly, why not develop, you know, custom solutions?
Why not develop stuff in-house?
Why not go the open source route, maybe get a consortium together?
I mean, there's lots of things that you can do.
And you know what?
When you're talking about $22 million contracts with Diebold for one precinct,
imagine how much that adds up to across the United States,
and you'll get an idea what a huge company we're talking about with Diebold,
and how can they possibly skimp on these security and have these kind of problems?
What are they doing with all that money?
Listen, why not make a government program?
Let me throw out a proposal here.
Why not make a government program?
And generally, I'm against making any new government programs,
but why not take the money that you were going to do
and maybe even pull it with other precincts or other states or whatever
and hire people and develop an open source system with that same money?
You'll probably come out way ahead in the long run financially,
and you'll end up with something that's more secure.
Well, I mean, yes, but we're only looking at it from the software side of things.
I mean, part of the issue is that you have to have a voting machine.
It's not a voting software.
You can't have, you know, J Random user logging in from his website,
which would be cool, but that's a major issue.
Come on, look at how many different kiosk things there are out there,
and a lot of them are very flexible, very powerful.
How hard could it be to develop something like that as well?
Well, touch screen screens have dropped in price dramatically.
I mean, I'm not saying it's an easy solution.
Don't get me wrong.
I'm just saying, like, people need to think.
You know, let's stop just blindly grabbing.
You know what happened is Diabol got their foot in the door,
and then what generally happens in the public sector, meaning governments,
anything government-run, government programs, state government, federal government, etc.,
what happens is once one place does something, it's a Diabol effect.
Everybody tends to follow suit.
And I'm telling you this, I can't say in detail,
but I can tell you from absolute inside experience that this happened.
One place does it.
The next place that comes along says, hey, we need to do something like this.
Do we know any other precincts that have done it?
They contact that precinct.
They say, what did you do?
Oh, well, we just ordered from Diabol, and they came and they installed them,
and it was easy.
We just set them up like this.
And they're like, oh, well, we'll do that too.
That sounds easy.
We don't want to do any work.
And it perpetuates it.
Well, yeah, I mean, you're not even talking about public sector.
That's private sector too.
Yeah, it's really bad in the public sector.
You know, you have two guys who know each other, and you say, oh, you know, I need to do this.
Oh, well, you know, this company came in and solved all of our problems.
Oh, okay, I'll use them.
And I think Diabol had its foot in the door a bit earlier than that because who makes all the ATM machines in the world?
Or a very large amount.
I guess that would be Diabol?
Yes, yes.
Well, I mean, at least around here.
I'm not sure if it's the same down by you.
But if you look at your ATM machine, you'll see a Diabol, look for a Diabol trademark.
Yeah, I think it's almost the same in the private sector, but it goes a little bit – in the public sector, it's like, well, we're lazy.
We don't do any work.
We'll just copy what you did.
In the private sector, it's more, here, I'll give you season tickets to the Knicks if you buy our software.
Okay, that works too.
I'll give you some kickback.
Wait a minute.
Who wants to see the Knicks?
Yeah, even people in New York don't want to see the Knicks.
Oh, man, I'm going to get hate mail.
Damn it.
Oh, well.
No, no, I think we'll have a lot of people agreeing with you.
Let's not get into this topic.
Exactly.
Because I can rant about this.
I mean, just the car wrecks that are in the Knicks right now.
To go back to the main topic, because I'm pretty much done with the documentary.
I think that's a pretty good summary of the whole thing.
But you made a good point earlier about it's not new.
I mean, this has been around for a while.
And I think you said this, but it's certainly worth reemphasizing.
There's nothing wrong with it necessarily.
It's very helpful.
It helps things go faster.
And truthfully, if there's another pet peeve of mine in there, truthfully, I'd rather take a little time and hand count them if you have to.
That's always an option to do something manually.
And if it's more accurate and it'll get it right, I mean, certainly there's room for corruption there too.
I'm not naive.
But if it means getting it right and spending a week to hand count them and report them all in and armored car the results or whatever it takes, I'm all for that.
I'd rather have it accurate than have all this controversy and bullshit, because then people harbor resentment for life.
And that's not the guy I voted for and he's not my president and all this other stuff.
And it just is a bad thing on society in general that all stemmed from something that could have been prevented and could have been helped.
Do it manually if you have to.
If anything, I'm going to go back and point a finger at the media a little bit, because the media, you know why they rush it and they try to get all these things done electronically and get it all counted and they close the polls at 7 o'clock and turn people away?
You know why?
Because it makes good television that night to find out who won.
That's why.
That's one of the reasons why.
But anyway, that's the –
Closing the polls and everything.
It's just more of, you know, okay, we're closing the poll.
It's been open for 12 hours, people.
If you haven't voted yet, you know, tough nogies.
Oh, true.
If you're going to come in, absolutely.
But, like, I mean, going back to what you're saying, oh, you know, I want to make it, you know, hand counted.
Well, okay, yeah, that's wonderful.
But you're probably going to make a lot more of the seats than the computer did.
Well, I don't know.
I guess it's available.
If that's the case, why is that the backup process?
If we want to do a recount, it's a manual recount.
I don't know.
Potentially, potentially it could be more.
Because when you have, you know, okay, well, I mean, let's go back to the Scantron machines.
You have, you know, some user who's never actually, you know, done a standardized test in his or her life.
You know, they're from – let's say they're from Poland or – actually, I'm not going to say Poland.
Well, let's say they're from Slovakia and they don't, you know –
Kazakhstan.
There we go.
They've never voted before.
And they have their American citizenship.
And they see this thing to fill out and they don't read the instructions right.
They don't speak English too well.
They have people in the polls.
And instead of filling in – yeah, and so – well, instead of – he doesn't ask.
He just does it.
Well, that's his problem.
That's his or her problem.
I don't have any pity for that.
But, yeah, but at the same time, he just, like, you know, makes a small little mark in the hole instead of filling it all up.
Yeah, and, I mean, you know, that's going to be – it's not going to count that vote in the recount.
I mean, you'll notice that when you're in a hand thing, but when you're doing this electronically, there's no way to recount that.
Ignorance is no excuse.
Yeah, I mean –
And that's what all the problem was back with the hanging chads debacle.
Some people didn't punch the chads out of the way.
I mean –
When my father was basically the political junkie that got me started on all of this, was when I voted to him, he always used to tell me,
always make sure when you take out your butterfly ballot that everything is empty because it won't count that.
And, I mean, you know, going back to where it was, we were just looking at it going, God, we know all this stuff already.
I mean, people don't know.
Well, you know, to a certain extent, that's, you know, there's lots of instructions.
They send out mail instructions ahead of time.
You can do your research.
If you take it seriously, then you won't make those mistakes.
And if you do make those mistakes, you didn't take it seriously enough, and I don't pity you losing your vote.
I don't.
I just – I'm sorry.
I don't.
I mean, I feel sad at the same time.
Sad, yeah.
But at the same point, I just go – yeah, I mean, it's sad that you didn't get the vote.
It's not that you didn't get to do in the process and everything.
But at the same time, you just want to go up to them and go, what's that wrong with you?
Yeah, and there are people there to help you, and there are signs explaining it.
And the directions on the damn screen says, punch out completely, and come on.
Plus, you know what?
If you're voting, you should know the language.
But that's a whole other political topic.
So let's get off of that.
Okay, let's just stop right here because we're actually delving into –
kind of more political spectrum here.
Exactly, exactly.
So let's back off.
But yeah, the whole point being, you know, there's nothing wrong with electronic voting.
It just needs to be more secure.
And I think that is the global message here.
Even the overly dramatic HBO documentary, I do think that was their overall message,
was that there are problems in this.
You're privatizing something, and by doing so, it's protected under trade secrets,
and no one can ever view the source.
No auditing can be done on it.
And we're taking these people's word for it.
And in their opinion, not mine, but in the documentary, they basically inferred that these people are liars.
They've caught them in several lies or several mistruths, however you want to call it.
I'm just going to call it liars, what they're insinuating and getting across.
And we're supposed to trust these liars to be telling us, yes, we fixed it.
Yes, it's secure without letting anyone audit it.
But that's just not, you know, that was the overall review of the documentary.
So take that for what you're worth, form your own decisions on it.
But certainly if you do have HBO or can get it or know a friend that has it,
it's worth going to someone's house.
It's an hour and a half long.
Go over to your buddy's house and watch it.
TiVo it.
You know, I can't say go find it on a website, torrent site, something like that.
But, you know, watch the thing.
It's definitely worth watching, and it was well done.
And then I do give it two thumbs up on the stank scale of watchworthiness.
How's that for making up a word?
Well, that's a stank and e-bird.
That was a very, you know, that word was very enjoyful that you just made up.
Enjoyful.
Thank you very much.
Isn't that right?
All right.
We're kind of actually running out of time here.
Oh, man.
Did we cover any topics we missed that we didn't want to about e-voting in general?
I think we did a pretty good job.
I think we mostly just concentrated on the documentary, but I think we brought up the topics that we wanted to cover and, you know, at least got the word out.
Because, I mean, I really want to actually see this documentary now, and I think a lot of people in our listening audience would like to go see it or see it, listen to it, whatever.
I sincerely do suggest people watch it.
It was really, really well done.
The only other thing, I'll now make this quick because I know we're running low, and I can summarize this.
If these are the problems we're having with e-voting at this stage of the game, hardware and physically going in, does anybody listening really think we're ready for voting on the global interweb yet?
I mean, come on.
Come on.
Seriously.
Do people actually think we're ready for voting on the global interweb yet?
Because that's going back to my two rocks theory.
You know, I'll take two rocks, and I'll vote that way.
Thank you.
Exactly, and that's what my point is.
If we can't even get this part of electronic voting right, let alone voting over the global interweb, there's so many more potentials for damage, especially if people are going to be a closed source and all these arbitrary and, yeah.
I just don't see that happening anytime soon.
So take that in perspective.
If we can't even get this right, they don't even need to be thinking about online voting yet.
And I kind of was going to go into some stories about online voting at, like, individual websites, you know, like, what was it, podcastalley.com.
I had some good fun with them.
They had a voting system up.
And I put BinRev up to the number one radio show on the site, you know, within minutes because it had vulnerabilities, and it was easily scripted.
And I hammered the thing out, and we jumped up to the top of their podcast listing for a day.
Of course, I emailed the webmaster and told him about the vulnerability and worked with him to fix it.
Now he's fixed it, and it's not vulnerable anymore.
So, I mean, that's just a podcasting website.
We can't treat our vote for our elected officials the same way.
So I guess it's – I don't know.
I think that's all the points really to talk about.
I think that's all I've got anyway.
All right.
Well, do you have any announcements to make?
Because I sure as heck don't.
Announcements?
I think we did everything up top.
The mentor program is still going really well, which is good.
So my email mentioned that.
Send your email to mentorship at binrev.com.
And I guess if we're at that point in the show, I guess I can segue into Shouts to Verbal for working on that.
And Kyle L., I think, has been helping out.
Tom, some of whom you may be hearing from in the future, to Savant.
I don't know.
Zero DB down there, vegging out.
I don't know.
That's about it.
Now I'll send Shouts out to Savant, too.
And I'll send Shouts out to T-Mobile for their MDA, which is pretty good.
And Q-Tec, that's who people makes it.
Pretty bitchin' phone.
I'm locked into freaking Verizon for another year, year and a month, I think, before I can go.
Oh, I'm locked into T-Mobile for two years.
So I paid my pound of flesh, that is for sure.
Yeah, yeah.
Well, you know, we can always move to one of those out-of-the-way places where they don't have coverage and they'll pay.
Oh, yeah, well, I was in this out-of-the-way place in Texas, short story, out-of-the-way place in Texas where my, instead of saying Verizon Wireless Network on, it just said, it didn't say roaming, but it was said, oh, man, it didn't say unknown network.
It was some other message on there.
Darn it, I forgot what it was.
But I remember going, what the hell does that mean?
Because I only had, like, two bars the whole time out in this little small town, so some carrier had a tower, but I don't know whose it was.
It didn't, usually if it picks up on a singular tower, it will say, you're on a singular network, even though I'm Verizon.
You know, they can piggyback, and they'll pay the roaming fees to singular for using their towers.
So this one didn't say singular, it didn't say AT&T, it didn't say Verizon, it didn't say any, you know, so I don't know whose network I was on.
So, no shots for you.
You never know, it could have been, like, you know, Mexicano Network or something.
It may have been, for all I know.
Oh, yeah, and all the pay phones.
Do I have time to talk about the pay phones in Mexico?
No, I don't think we have time to talk about anything.
All right, go.
Sadly enough.
All right, closing, do you have any closing music?
Oh, I have a side of the week.
Oh, what's side of the week?
Oh, crap, hold on, I've got to go right in.
The side of the week, this week for November 7th, as I stall for a second, is called RiffTracks, R-I-F-F-T-R-A-X, RiffTracks.com.
Anybody knows I'm a big fan of MST3K.
You can now download MST3K audio for new movies and overlay it.
So if you want to watch your movie on mute and play the MP3 track of the Mystery Science Theater style jokes, RiffTracks.com.
R-I-F-F-T-R-A-X.
You got it.
Okay.
Good job.
Oh, that sounds cool.
I'll have to actually check that out.
That sounds interesting.
Not politically related.
Closing music?
You'll find out in a moment and check out our link.
I never do closing music.
It was more of like, we were talking earlier before the show, like, oh, it's for closing music tonight.
I'm like, I didn't remember.
Damn it.
All right.
So, hey.
It's something really cool and it's going to be a surprise and you're all going to love it.
Yeah, sure they are.
Anyway, thanks for having me on the show again.
It's fun being on this side of the phone.
Oh, yeah.
Thanks a lot, man.
I'll send shouts out to you, too.
Shouts for coming on the show.
Oh, wow, please.
Yeah.
And shouts to my friend Jack, by the way.
Okay.
That's all.
Last minute shout outs.
What can you do?
Yeah, you know, shout outs.
It should be something like to have, like, an entire show of shout outs.
Boy, that would be the worst episode ever.
Well, it'd be interesting.
You know, have, like, fun anecdotes and all the little short things.
You know, shouts out to so-and-so from Hope2k4 who helped me change my tire.
I don't know.
Shouts to the guy that hung out with us at White Castle.
And for everybody there, you know what I'm talking about.
That was crazy.
All right.
So I guess that's kind of wrapping up the show.
And I guess we'll see you next week.
Same hack time?
Same hack channel?
I think so.
Yeah.
I think so.
Thank you.