***THREAD***

I’ve been on the phone with colleagues about the hack all morning. None of us can figure out why #CISA chose this particular response to the breach. Couple of things struck us as curious.

The agencies targeted are not responding how you might expect...

One of my purposes for 2021 is to simplify Docker for beginners.

Let's start with some definitions:

🏠Docker host
⚙️Docker engine
❓ Docker client
📝Dockerfile
📑Docker Image
🐳Docker Container
🐙Docker Compose
🪣 Docker Registry
🐳🐳🐳Docker Swarm

Definitions Below 👇

🏠Docker (Active) Host

A computer with Docker installed and the daemon running.

It can process Docker and non-Docker workloads.

⚙️Docker Engine

A Client-Server application. It has 3 components:

- "daemon process": A server that is a type of long-running program.

- "Rest API": to specify interfaces that programs can use to talk and interact with the daemon.

- "CLI": A command-line interface client

❓Docker Client

It sends commands to dockerd, using the Docker API.
It can communicate with multiple daemons.

📝Dockerfile

It's a text document that contains all the commands a user could call on the command line to assemble an image.

There has been speculation that changes to the way the internet is implemented will be rolled out to allow access only to authorized sites.

Some think this is impossible

I'm here to tell you it is not, and very likely.

Allowing access only to white listed IP addresses is easy.

The vast majority access the internet via their Internet Service Provider, and ISP's can easily block client access to any IP address they choose.

China has been doing this for years.

This is how firewalls work, and is much lower level than DNS blocking.

I would imagine this will be rolled out to 'Combat the ever growing threat of Cyber Attacks'.

Most people only use a few thousand services like Twitter, Facebook, Amazon, Google, Microsoft, TikTok, Snapchat, Instagram, Reddit etc, Walmart, Costco, Tesco, Morrisons etc. as it is.

It will be easy over time to require 'legal registration' for any and all other services and sites.

We already took a step toward this years ago anyway, so this is just the logical next step.

As 5G technology is rolled out in your city, more and more control is being introduced at the street level, using what are known as 'Edge Servers'.

While making services faster to access, it also allows an additional layer of security and access control at the local level.

X : Can you apply pace layers to maps?
Me : You can but what is where evolves. However, same rules apply to things, practices, data, knowledge and ethical values. All are forms of evolving capital. In the mapping world, we refer to this with pioneers, settlers and town planners.

X : What's the robot for?
Me : Image from an older presentation slide, don't worry it has no relevance.
X : Is this linked to diffusion?
Me : Not simply. Evolution of a single component can consist of many hundreds of diffusion curves i.e. a virus diffuses but it also evolves.

X : Why have you got DevOps in legacy? We haven't even started yet.
Me : That's not my problem. I would take a look at serverless.
X : DevOps is serverless.
Me : Some of the practices maybe co-opted (see ITIL vs DevOps) but the new faction will decide what it is or isn't.

X : I also disagree with your methods graphic.
Me : Do you mean this? As applied to the following map?
X : Yes. Lean is suitable for innovation.
Me : Ah, that depends upon what you mean by innovation. If you mean Genesis then lightweight XP has it beat.

X : I disagree.
Me : Well, I've had 15 years of people telling me that Agile works everywhere or Lean works everywhere or Six Sigma works everywhere and why all the competing methods don't. I have no interest in the conversation. Use appropriate methods based upon context.

Explanation of differences between corvettes, frigates, destroyers and cruisers (as recorded from a Quora discussion):

Minesweeper: it's job to to find and remove mines to clear a harbor or other restricted waters for maritime access and egress. There can also be minelayers which do the opposite.

Corvettes: They were smaller sailing vessels used for coastal commerce and and defense. They were fast and maneuverable. Today some navies use these in a similar way but they are not sail powered. The US Navy has similar vessels called Littoral Combat Ships.

Now to Frigates, Destroyers and Cruisers. These range from smallest to largest in the same order. Cruisers tend to be picket ships specializing in air defense. They also have Tomahawk missiles that can be launched against land or sea targets.

Destoyers are smaller than Cruisers and used to be more for submarine warfare and then became a smaller version of a cruisers with much the same mission. Frigates were the smallest. They were primarlily anti-submarine platforms.

I did more research into the Parler dump. What probably happened was not so much a "hack", but this: When Twilio/Okta shut them down, they just disabled email/phone verification to create an account. This means anyone could directly create huge amounts of accounts via their API.

Someone also found out that fetching Parler posts could be done by enumerating IDs (e.g 1, 2, 3) instead of random IDs that can't be guessed. Unclear if this was via the ordinary API endpoint, or that they found a separate one by monitoring app network traffic.

So you combine these two things and you can create a script to scrape all the posts on the entire platform, using a lot of different accounts to avoid suspicion. Anyone could download and run this script to spread it out over many IP addresses as well.

What I'm still not sure about is whether deleted (meaning flagged as deleted, it's common that services never actually delete data) posts could be fetched without any special handling.

The verdict: The people who wrote Parler are fucking amateurs.