• Risks Digest 32.53 (2/3)

    From RISKS List Owner@21:1/5 to All on Sat Mar 13 01:03:00 2021
    [continued from previous message]

    grab headlines. Mobile security firm Zimperium has found that these
    exposures pose a major problem for iOS and Android apps as well.

    Zimperium ran automated analysis on more than 1.3 million Android and iOS
    apps to detect common cloud misconfigurations that exposed data. The researchers found almost 84,000 Android apps and nearly 47,000 iOS apps
    using public cloud services -- like Amazon Web Services, Google Cloud, or Microsoft Azure in their backend as opposed to running their own servers. Of those, the researchers found misconfigurations in 14 percent of those totals
    -- 11,877 Android apps and 6,608 iOS apps -- exposing users' personal information, passwords, and even medical information.

    https://www.wired.com/story/ios-android-leaky-apps-cloud/

    [Also noted by Monty Solomon. PGN]

    ------------------------------

    Date: Thu, 4 Mar 2021 21:49:15 -0500
    From: Monty Solomon <monty@roscom.com>
    Subject: Hackers are finding ways to hide inside Apple's walled garden
    (Techology Review)

    https://www.technologyreview.com/2021/03/01/1020089/apple-walled-garden-hackers-protected/

    ------------------------------

    Date: Thu, 4 Mar 2021 22:11:11 -0500
    From: Monty Solomon <monty@roscom.com>
    Subject: ICE investigators used a private utility database covering millions
    to pursue immigration violations (WashPost)

    ICE's use of the vast database offers another example of how government agencies have targeted commercial sources to access information they are not authorized to compile on their own. One researcher called it a `massive betrayal of people's trust': ``When you sign up for electricity, you don't expect them to send immigration agents to your front door.''

    https://www.washingtonpost.com/technology/2021/02/26/ice-private-utility-data/

    ------------------------------

    Date: Wed, 3 Mar 2021 20:12:29 -0500
    From: Monty Solomon <monty@roscom.com>
    Subject: L.A. sheriff's office gets warrant for 'black box' in Tiger Woods'
    crashed SUV. (NBC News)

    https://www.nbcnews.com/news/us-news/l-sheriff-s-office-gets-warrant-black-box-tiger-woods-n1259450

    ------------------------------

    Date: Wed, 3 Mar 2021 20:44:25 -0500
    From: Gabe Goldberg <gabe@gabegold.com>
    Subject: Amazon has become a prime revolving-door destination in Washington
    (Mother Jones)

    Its interests probably transverse the U.S. government more than any other company.

    Everything about Amazon is big. It's the second-biggest retailer
    in the world. Its founder, Jeff Bezos, possesses the biggest fortune in the world. And the company has developed a big revolving door in Washington
    through which government officials and employees whisk and land in
    well-paying jobs at Amazon, which has a big list of interests it seeks to protect and advance in the nation's capital.

    A Mother Jones investigation has identified at least 247 US government officials and employees -- with about 150 hailing from the intelligence, cybersecurity, law enforcement, and military fields -- who were hired by
    Amazon in the past 10 years or so. About 200 of them have been retained by
    the fast-growing company since the start of 2017. This list is not comprehensive and represents what is likely only a portion of federal
    employees who left government service for Amazon. It was compiled by
    searching LinkedIn and locating people who, according to their profiles, had worked in the federal government directly before moving to Amazon; it relies
    on information provided by the platform's users. There are no public records that track all the US officials and employees hired by Amazon or other
    firms.

    https://www.motherjones.com/politics/2021/03/amazon-has-become-a-prime-revolving-door-destination-in-washington/

    "transverse"?

    ------------------------------

    Date: Thu, 4 Mar 2021 11:28:03 +0800
    From: Richard Stein <rmstein@ieee.org>
    Subject: Too much choice is hurting America (NY Times)

    https://www.nytimes.com/2021/03/01/opinion/deregulation-health-care-electricity.html

    "But the argument that more choice is always good rests on the assumption
    that people have more or less unlimited capacity to do due diligence on
    every aspect of their lives -- and the real world isn't like that. People
    have children to raise, jobs to do, lives to live and limited ability to process information."

    Due diligence fulfillment is exhausting, and requires specific subject
    matter expertise to competently pursue. A consumer cannot conceivably comprehend all supply chain intricacies that either promote or suppress
    product risks. Restricted product information disclosure conceal industrial trade secrets or other intellectual property, information essential to aid consumer safety or health determination. The law and regulation, when
    enforced, usually deters irresponsible and harmful products from entering
    the marketplace.

    Public trust abuse accrues from product failures. These unfortunate, often spectacular, events elevate awareness of product risks. Public trust erodes when these incidents are traced to industry-influenced political decisions
    and legislation directing regulators to cede approval
    authority. Self-certification authority is a political choice that empowers businesses to deprioritize public health and safety interests.

    Krugman concludes, "So the next time some politician tries to sell a new
    policy -- typically deregulation -- by claiming that it will increase
    choice, be skeptical. Having more options isn't automatically good, and in America we probably have more choices than we should."

    Self-certification accelerates product approvals and marketplace
    introduction, but diminishes consumer protections to a legal thread dangling
    by "terms of service," a frail substitute for independent oversight and
    skilled judgment of product safety -- the last line of consumer defense. The self-certification juggernaut might sail on, but disaster trails its wake.

    Risk: Deregulation.

    ------------------------------

    Date: March 7, 2021 4:34:42 JST
    From: jonathan.spira@accuramediagroup.com
    Subject: CDC Links Restaurant Dining with Spread of Covid-19 in U.S.

    [Definitively]

    This is more definitive than what has been "speculated" in the past.

    CDC Links Restaurant Dining with Spread of Covid-19 in U.S.

    ``...In cases where counties in the United States allowed on-premises
    dining, case and death rates sped up. ... In counties where states required masks, case and death rates slowed....''

    ------------------------------

    Date: Fri, 5 Mar 2021 12:39:52 +0800
    From: Richard Stein <rmstein@ieee.org>
    Subject: Those fever scanners that everyone is using to fight covid can be
    wildly inaccurate, researchers find (WashPost)

    https://www.washingtonpost.com/technology/2021/03/05/fever-scanner-flaws-covid/

    "A flood of thermal scanners hit the market last year with promises to
    detect the signs of possible infection. But many of the devices use software that can make a feverish person appear perfectly well."

    False positive/false negative thermometer readings can endanger public
    health and cause unnecessary inconvenice.

    The FDA's Total Product Life Cycle platform assigns product code FLL to regulate devices identified as "Thermometer, Electronic, Clincial." The
    product code captures medical device reports for oral thermometers, tympanic thermometers, and screening thermographic devices.

    See
    https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfTPLC/tplc.cfm?id=2611
    for a list of equivalent devices and recalls. The page identifies ~41 unique suppliers.

    The last recall was in 04FEB2020 for a Cardinal Health 200, LLC tympanic thermometer unit. For recall content, see: https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfres/res.cfm?start_search=1&event_id=84202

    The top-10 device problems traced to medical device reports, in CSV format:

    Device Problems,MDRs with this Device Problem,Events in those MDRs Thermometer,132,132
    Adverse Event Without Identified Device or Use Problem,80,80
    False Negative Result,64,64
    Insufficient Information,60,60
    Power Problem,33,33
    Incorrect, Inadequate or Imprecise Resultor Readings,31,31
    Battery Problem,29,29
    Product Quality Problem,27,27
    Nonstandard Device,27,27
    Device Issue,22,22
    Device Operates Differently Than Expected,18,18

    The top-10 patient problems traced to medical device reports, in CSV format:

    Patient Problems,MDRs with this Patient Problem,Events in those MDRs Fever,143,143
    No Known Impact Or Consequence To Patient,116,116
    No Consequences Or Impact To Patient,25,25
    Seizures,17,17
    No Information,12,12
    No Patient Involvement,8,8
    Patient Problem/Medical Problem,6,6
    Blood Loss,5,5
    Foreign Body In Patient,5,5
    No Code Available,4,4

    ------------------------------

    Date: Sat, 6 Mar 2021 23:25:47 -0500
    From: Gabe Goldberg <gabe@gabegold.com>
    Subject: The problems with anti-vaccers' precautionary principle arguments
    (The Logic of Science)

    Invoking the precautionary principle is a favorite tactic of anti-vaccers, anti-GMO activists, and various other groups that are prone to opposing scientific advances, but there are numerous issues with this strategy. The exact definition of the precautionary principle is a bit amorphous and variable, but the general concept is that before taking an action that has potential risks (particularly with the application of something new), the burden of proof should be on the proponent to demonstrate the safety of that action before taking it. There is certainly an element of validity to
    this. I absolutely agree, for example, that new medications should be tested and shown to be safe before being made publicly available (indeed, that is
    part of why we have organizations like the FDA that regulate the approval of new drugs). Similarly, months ago when COVID vaccines were in early stages
    of testing, I and many other ardent pro-vaccers stated that while the
    vaccines were promising, we wanted to see the results of the tests before drawing any conclusions. That is a completely rational, evidence-based way
    to approach the situation. New drugs, vaccines, and technologies certainly
    have the potential to cause harm. So, it is not unreasonable to want safety testing prior to their use.

    Where this becomes problematic, however, is in determining what constitutes reasonable evidence. Groups like anti-vaccers have a tendency to stretch the precautionary principle to unreasonable limits and use it as an excuse for science-denial, rather than a legitimate decision-making tool. Usually, what
    I see is an incorrect insistence that the precautionary principle demands absolute assurance of safety and that it should be used in a strictly binary decision tree where any possible risk means that the thing in question
    should not be used, regardless of the known benefits. This is very bad risk assessment and ignores important aspects of how science actually works. As
    I'll explain, science is about probabilities, not absolutes, and you must consider both the risk and benefit of an action.

    https://thelogicofscience.com/2021/03/02/the-problems-with-anti-vaccers-precautionary-principle-arguments/

    ------------------------------

    Date: Fri, 5 Mar 2021 12:06:21 -0500
    From: Monty Solomon <monty@roscom.com>
    Subject: You got a vaccine. Walgreens got your data.

    Retail pharmacies are now giving out Covid-19 vaccines, and some of them are using it as an opportunity to profit off your information.

    https://www.vox.com/recode/22310281/covid-vaccine-walgreens-cvs-rite-aid-walmart-data

    ------------------------------

    Date: Fri, 5 Mar 2021 11:44:09 -0500 (EST)
    From: ACM TechNews <technews-editor@acm.org>
    Subject: Research highlights impact of Digital Divide

    University of Houston News, 3 Mar 2021 via via ACM TechNews, 5 Mar 2021

    Researchers at the University of Houston, Rutgers University, and Temple University found that people with basic IT skills are more likely to be employed, even if their jobs are not explicitly associated with those
    skills. In addition, the researchers found that people with more advanced IT skills tend to earn higher salaries. The researchers said, "Workers who
    possess relevant IT skills might have an edge in an increasingly digital economy." The University of Houston's Paul A. Pavlou said the study
    highlights the need for strong public policy to enable people more likely to deal with employment discrimination, like women and older workers, to obtain basic IT skills. Pavlou said, "Workers are expected to obtain these IT
    skills themselves, in order to get a job in the first place. And the less-privileged population they are, the harder time they have obtaining
    these skills that require computer equipment and Internet access."

    https://orange.hosting.lsoft.com/trk/click?ref=znwrbbrs9_6-29c88x228ff6x068077&

    ------------------------------

    Date: Fri, 5 Mar 2021 06:52:38 -0500 (EST)
    From: Andrew Appel <appel@princeton.edu>
    Subject: ES&S hashcode testing is wrong in 3 ways

    We just published this article:
    Andrew Appel and Susan Greenhalgh
    Voting Machine Hashcode Testing: Unsurprisingly insecure, and surprisingly
    insecure https://freedom-to-tinker.com/2021/03/05/voting-machine-hashcode-testing-unsurprisingly-insecure-and-surprisingly-insecure/

    The accuracy of a voting machine is dependent on the software that runs it.
    If that software is corrupted or hacked, it can misreport the votes. There
    is a common assumption that we can check the legitimacy of the software that
    is installed by checking a hash code and comparing it to the hash code of
    the authorized software. In practice the scheme is supposed to work like
    this: Software provided by the voting-machine vendor examines all the
    installed software in the voting machine, to make sure it's the right stuff.

    There are some flaws in this concept: it's hard to find ``Call the installed software in the voting machine,'' because modern computers have many layers underneath what you examine. But mainly, if a hacker can corrupt the vote-tallying software, perhaps they can corrupt the hash-generating
    function as well, so that whenever you ask the checker ``does the voting machine have the right software installed,'' it will say, ``Yes, boss.''
    Or, if the hasher is designed not to say ``yes'' or ``no,'' but to
    report the hash of what's installed, it can simply report the hash of what's supposed to be there, not what's actually there. For that reason, election security experts never put much reliance in this hash-code idea; instead
    they insist that you can't fully trust what software is installed, so you
    must achieve election integrity by doing recounts or risk-limiting audits of the paper ballots.

    But you might have thought that the hash-code could at least help protect against accidental, nonmalicious errors in configuration. You would be
    wrong. It turns out that [ https://www.essvote.com/ | ES&S ] has bugs in
    their hash-code checker: if the ``reference hashcode'' is completely
    missing, then it'll say ``yes, boss, everything is fine'' instead of
    reporting an error. It's simultaneously shocking and unsurprising that
    ES&S's hashcode checker could contain such a blunder and that it would go unnoticed by the U.S. Election Assistance Commission's federal certification process. It's unsurprising because testing naturally tends to focus on
    ``does the system work right when used as intended?'' Using the system in unintended ways (which is what hackers would do) is not something anyone
    will notice.

    Until somebody does notice. In this case, it was the State of Texas's voting-machine examiner, Brian Mechler. In [ https://ftt-uploads.s3.amazonaws.com/wp-content/uploads/2021/03/03172500/brian-mechler-ESS-exam-report-EVS6110-aug.pdf
    | his report dated September 2020 ] he found this bug in the hash-checking script supplied with the ES&S EVS 6.1.1.0 election system (for the
    ExpressVote touch-screen BMD, the DS200 in-precinct optical scanner, the
    DS450 and DS850 high-speed optical scanners, and other related voting machines). (Read Section 7.2 of [ https://ftt-uploads.s3.amazonaws.com/wp-content/uploads/2021/03/03172500/brian-mechler-ESS-exam-report-EVS6110-aug.pdf
    | Mr. Mechler's report ] for details).

    We can't know whether that bug was intentional or not. Either way, it's certainly convenient for ES&S, because it's one less hassle when installing firmware upgrades. (Of course, it's one less hassle for potential hackers, too.)

    Another gem in Mr. Mechler's report is in Section 7.1, in which he reveals
    that acceptance testing of voting systems is done by the vendor, not by the customer. Acceptance testing is the process by which a customer checks a delivered product to make sure it satisfies requirements. To have the vendor
    do acceptance testing pretty much defeats the purpose.

    When the Texas Secretary of State learned that their vendor was doing the acceptance testing themselves, the SOS's attorney wrote to ES&S to admonish them about it, pledging to ensure all Counties amend their procedures to
    ensure local officials conduct acceptance testing. The attorney may
    encounter a problem, though: the ES&S sales contract specifies that ES&S
    must perform the acceptance testing, or they [ https://ftt-uploads.s3.amazonaws.com/wp-content/uploads/2021/03/04141319/48428_2018-241-Contract.pdf
    | will void your warranty (see clause 7b) ] .

    There's another little gem in Mr. Mechler's report, Section 7.3. The
    U.S. Election Assistance Commission requires that `` [ https://www.eac.gov/sites/default/files/document_library/files/VVSG.1.0_Volume_1.PDF
    | The vendor shall have a process to verify that the correct software is loaded, that there is no unauthorized software, and that voting system
    software on voting equipment has not been modified, using the reference information from the [National Software Reference Library] or from a State designated repository. The process used to verify software should be
    possible to perform without using software installed on the voting system. ]
    '' This requirement is usually interpreted to mean, ``check the hash code of the installed software against the reference hash code held by the EAC or
    the State.''

    But ES&S's hash-checker doesn't do that at all. Instead, ES&S instructs its techs to create some ``golden'' hashes from the first installation, then subsequently check the hash code against these. So whatever software was
    first installed gets to be ``golden'', regardless of whether it's been
    approved by the EAC or by the State of Texas. This design decision was
    probably a convenient shortcut by engineers at ES&S, but it directly
    violates the EAC's rules for how hash-checking is supposed to work. So, what have we learned?

    We already knew that hash codes can't protect against hackers who install vote-stealing software, because the hackers can also install software that
    lies about the hash code. But now we've learned that hash codes are even
    more useless than we might have thought. This voting-machine manufacturer

    * has a hash-code checker that erroneously reports a match, even when you
    forget to tell it what to match against;
    * checks the hash against what was first installed, not against the
    authorized reference that they're supposed to;
    * and the vendor insists on running this check itself -- not letting the
    customer do it -- otherwise the warranty is voided.

    As a bonus we learned that the EAC certifies voting systems without checking
    if the validation software functions properly.

    Are we surprised? You know: fool me once, shame on you; fool me twice, shame
    on me. Every time that we imagine that a voting-machine manufacturer might
    have sound cybersecurity practices, it turns out that they've taken
    shortcuts and they've made mistakes. In this, voting-machine manufacturers
    are no different from any other makers of software. There's lots of insecure software out there made by software engineers who cut corners and don't pay attention to security, and why should we think that voting machines are any different?

    So if we want to trust our elections, we should vote on hand-marked paper ballots, counted by optical scanners, and recountable by hand. Those optical scanners are pretty accurate when they haven't been hacked -- even the ES&S DS200 -- and it's impractical to count all the ballots without them. But we should always check up on the machines by doing random audits of the paper ballots. And those audits should be ``strong'' enough -- that is, use good statistical methods and check enough of the ballots -- to catch the mistakes that the machines might make, if the machines make mistakes (or are
    hacked). The technical term for those ``strong enough'' audits is [ https://freedom-to-tinker.com/2019/05/23/how-to-do-a-risk-limiting-audit/ | Risk-Limiting Audit ]

    Andrew W. Appel is Professor of Computer Science at Princeton University.
    Susan Greenhalgh is Senior Advisor on Election Security at [ http://www.freespeechforpeople.org/ | Free Speech For People ] .

    ------------------------------

    Date: Fri, 5 Mar 2021 16:05:23 -1000
    From: geoff goodfellow <geoff@iconia.com>
    Subject: At least 30,000 U.S. organizations newly hacked via holes in
    Microsoft's email software

    At least 30,000 organizations across the United States -- including a significant number of small businesses, towns, cities and local governments
    -- have over the past few days been hacked by an unusually aggressive
    Chinese cyber-espionage unit that's focused on stealing email from victim organizations, multiple sources tell KrebsOnSecurity. The espionage group is exploiting four newly-discovered flaws in *Microsoft Exchange Server* email software, and has seeded hundreds of thousands of victim organizations worldwide with tools that give the attackers total, remote control over affected systems.

    On March 2, Microsoft released emergency security updates to plug four
    security holes in Exchange Server versions 2013 through 2019 that hackers
    were actively using to siphon email communications from Internet-facing
    systems running Exchange. <https://krebsonsecurity.com/2021/03/microsoft-chinese-cyberspies-used-4-exchange-server-flaws-to-plunder-emails/>

    In the three days since then, security experts say the same Chinese cyber espionage group has dramatically stepped up attacks on any vulnerable, unpatched Exchange servers worldwide.

    In each incident, the intruders have left behind a ``web shell,'' an easy-to-use, password-protected hacking tool that can be accessed over the Internet from any browser that gives the attackers administrative access to
    the victim's computer servers.

    Speaking on condition of anonymity, two cybersecurity experts who've briefed U.S. national security advisors on the attack told KrebsOnSecurity the
    Chinese hacking group thought to be responsible has seized control over *hundreds of thousands* of Microsoft Exchange Servers worldwide -- with each victim system representing approximately one organization that uses Exchange
    to process email.

    Microsoft said the Exchange flaws are being targeted by a previously unidentified Chinese hacking crew it dubbed *Hafnium*, and said the group
    had been conducting targeted attacks on email systems used by a range of industry sectors, including infectious disease researchers, law firms,
    higher education institutions, defense contractors, policy think tanks, and NGOs. [...]

    https://blogs.microsoft.com/on-the-issues/2021/03/02/new-nation-state-cyberattacks/
    https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/

    ------------------------------

    Date: Sat, 6 Mar 2021 15:12:54 -0800
    From: Lauren Weinstein <lauren@vortex.com>
    Subject: Texas PUC to electricity users who received outrageous bills from
    grid mismanagment during winter storm: SCREW YOU!

    https://www.npr.org/2021/03/06/974417969/texas-wont-reduce-16-billion-in-electricity-charges-from-winter-storm

    and later this one:

    https://www.khou.com/article/news/local/puc-overcharge-winter-freeze-electricity-ercot/285-134ee343-7389-4f33-8284-19ea88959968

    ------------------------------

    Date: Wed, 3 Mar 2021 19:40:26 -0500
    From: Gabe Goldberg <gabe@gabegold.com>
    Subject: Rookie coding mistake prior to Gab hack came from site's CTO
    (Ars Technica)

    Site executive introduces, then removes, insecure code, then hides the evidence.

    https://arstechnica.com/gadgets/2021/03/rookie-coding-mistake-prior-to-gab-hack-came-from-sites-cto/

    Funny comments...

    ------------------------------

    Date: Sat, 6 Mar 2021 22:14:35 -0500
    From: Gabe Goldberg <gabe@gabegold.com>
    Subject: What lies beneath... on disaster respone (NYU Tandon)

    NYU Tandon-led effort sheds light beneath the surface for NYC
    disaster response (NYU Tandon School of Engineering)

    Project gets NSF City Innovation Challenge award to help communities respond
    to floods, storms and other disasters by making info on underground infrastructure viewable, usable and shareable.

    https://engineering.nyu.edu/news/nyu-tandon-led-effort-sheds-light-beneath-surface-nyc-disaster-response

    ------------------------------

    Date: Sun, 7 Mar 2021 14:46:26 +0100
    From: Peter Bernard Ladkin <ladkin@causalis.com>
    Subject: Re: Post Office scandal (RISKS-32.52)

    The issues with the Post Office Horizon POS system and prosecutions and convictions of subpostmasters for alleged fraud has led to what I believe is the largest referral of possibly-unsafe cases to the Criminal Cases Review Commission in UK history.

    I and a number of colleagues, namely Martyn Thomas, Bev Littlewood, Harold Thimbleby and barrister Stephen Mason, have written individually and collectively, and more recently with others, a number of recent papers about these cases, published in the University of London School of Advanced
    Study's journal Digital Evidence and Electronic Signature Law Review, which Stephen edits.

    Volume 17 contains four papers on this issue by Ladkin et al, Ladkin,
    Marshall and Christie https://journals.sas.ac.uk/deeslr/issue/view/578
    . Paul Marshall was invited in 2020 to submit some considerations about the probity of computer evidence to the Parliamentary Under-Secretary of State
    for Justice in the UK Ministry of Justice, Alex Chalk MP. A public version
    of this submission (Marshall et al) has been published by DEESLR at https://journals.sas.ac.uk/deeslr/article/view/5240

    There are deeper issues involved in this series of cases than that some
    people were unsafely convicted. Readers of the above articles will see that
    a certain presumption in English law (since a Law Commission recommendation
    in 1997) about the correct/incorrect operation of computers comes into
    question (addressed by Ladkin et al, and in the MoJ submission by Marshall
    et al). Some of the argumentation used in court was technically
    spectacularly poor (cf. Ladkin on "Robustness"). And it came to light in a civil case brought by a large number of suffering subpostmasters against
    Post Office Limited that the developers and operators of the system (Fujitsu and Post Office Limited) had not disclosed pertinent information about the dependability of the Horizon system to defendants that Post Office Limited
    had prosecuted. Indeed, it is as a result of the superb judgment by Justice
    Sir Peter Fraser in that civil case that the large number of convictions
    were referred to the CCRC as possibly unsafe. Fraser J's judgment is at https://www.judiciary.uk/wp-content/uploads/2019/12/bates-v-post-office-judgment.pdf

    It is over 300pp long but bears close reading for those interested in the behaviour of large IT systems; I anticipate it will become a "landmark judgment".

    Because of these deeper issues, I anticipate that these cases will continue
    to reverberate for some time in the English judicial system. Some people
    have worked on this matter for decades. Stephen Mason is one. He obtained
    and published the transcript in DEESLR of the criminal case of subpostmaster Seema Misra. It is because of Stephen's persistence that Martyn, Bev, Harold and I became involved. A blog with extensive, detailed references is
    maintained by Nick Wallace at https://www.postofficetrial.com

    ------------------------------

    Date: 7 Mar 2021 12:44:41 -0500
    From: "John Levine" <johnl@iecc.com>
    Subject: Re: Fed outage shuts down U.S. payment system (Ars Technica)

    Re: https://arstechnica.com/tech-policy/2021/02/fed-outage-shuts-down-us-payment-systems-for-more-than-an-hour/

    The ACH system suffers from having been cutting edge when it was set up, and
    is now aging badly. The U.S. is also unique in having over 4000 banks and
    5000 credit unions. Some are large and well known but there is a long tail
    that are very small and not very sophisticated. (By comparison, France and
    the UK each have about 400 banks.) I hear that some of the small banks still
    do their ACH transfers with a daily FTP session.

    The Federal Reserve is working on a faster and more modern payment system called FedNow, but the rollout will be slow as all of those tiny banks and credit unions have to figure it out and get connected. Since this is the
    US, some big banks have a competing system called TCH which they claim is
    just as good, no need for FedNow, but it is unlikely to reach all those
    small banks, at least not at a price they can afford.

    ------------------------------

    Date: 6 Mar 2021 23:16:11 -0500
    From: "John Levine" <johnl@iecc.com>
    Subject: Re: his lights stayed on during Texas's storm. Now he owes $16,752
    (RISKS-32.52)

    It must be interesting to live in a world where insurance does not exist.

    For the most part, it's true, paying the marginal price is more cost
    effective. But there is a huge difference between "the most part" and
    "always". For the most part, it is more cost effective to pay your medical bills as they occur rather than paying for insurance. But then you're hit
    but a bus, your bills are a million dollars and you do not have a million dollars. Now what? The market solution is too bad, you die.

    In the middle of the freeze, there was no market clearing price. Much of the cheaply built generation system failed so there was no more power to be had, while people with electric heat can't just turn it off or they and their
    water pipes will freeze. That's why the other 49 states spend money to make their electric system resilient even though it makes the day to day costs a little higher. Ask people in El Paso whether they think they'd be better off with cheaper ERCOT power.

    ------------------------------

    Date: Mon, 1 Aug 2020 11:11:11 -0800
    From: RISKS-request@csl.sri.com
    Subject: Abridged info on RISKS (comp.risks)

    The ACM RISKS Forum is a MODERATED digest. Its Usenet manifestation is
    comp.risks, the feed for which is donated by panix.com as of June 2011.
    SUBSCRIPTIONS: The mailman Web interface can be used directly to
    subscribe and unsubscribe:
    http://mls.csl.sri.com/mailman/listinfo/risks

    SUBMISSIONS: to risks@CSL.sri.com with meaningful SUBJECT: line that
    includes the string `notsp'. Otherwise your message may not be read.
    *** This attention-string has never changed, but might if spammers use it.
    SPAM challenge-responses will not be honored. Instead, use an alternative
    address from which you never send mail where the address becomes public!
    The complete INFO file (submissions, default disclaimers, archive sites,
    copyright policy, etc.) is online.
    <http://www.CSL.sri.com/risksinfo.html>
    *** Contributors are assumed to have read the full info file for guidelines!

    OFFICIAL ARCHIVES: http://www.risks.org takes you to Lindsay Marshall's
    searchable html archive at newcastle:
    http://catless.ncl.ac.uk/Risks/VL.IS --> VoLume, ISsue.
    Also, ftp://ftp.sri.com/risks for the current volume/previous directories
    or ftp://ftp.sri.com/VL/risks-VL.IS for previous VoLume
    If none of those work for you, the most recent issue is always at
    http://www.csl.sri.com/users/risko/risks.txt, and index at /risks-32.00
    ALTERNATIVE ARCHIVES: http://seclists.org/risks/ (only since mid-2001)
    *** NOTE: If a cited URL fails, we do not try to update them. Try

    [continued in next message]

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)