LastPass: "We got hacked (again), and pretty sure they got encrypted customer vaults, metadata, phone numbers and our source code & network maps. But it would take *millions* of years to crack. Also, they're likely brute-forcing your vaults with any previous leaked creds."

Reporters: Is that true? "Millions" of years??

Cryptographers: AHAHAHAHAHAHAHAHAHAHAHA
*inhales deeply, holds ribcage that are aching from exertion* AHAHAHAHAHAHAHA. No.

https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/

Remember that time I had to shut down the Effin' Birds text message service because it was costing $5000 a month?

Well, I finally figured out how to get it going again without losing my shirt.

Introducing 1-845-EAT-FART, where three measly bucks a month will get you daily Effin' Birds in your text messages at whatever time you choose.

Visit http://845eatf.art to get started.

htop | lolcat

try it :D

(apt-get install lolcat or brew install lolcat)

Here is my thesis on Security:

The diligent and reliable existence of locks, matters a lot more than their strength.

In trying to find how often lockpicking is a factor in burglaries, a huge number/majority of thefts were from behind no locks at all. Lockpicking is almost nonexistent.
Thieves simply try doors for being left open. Or just break a window.

This matched with my experience in Enterprise Security.
Penetrators got in through poking for trivial misconfiguration and lack of protection, not novel trespass.
They had millions of targets with a small % of success and won.

So I ask, why aren't we focusing on high assurance?

Because assurance is hard. It is not fun. It is not flashy. It fails silently. It supposes diligent attention.
Remediation is by definition beyond self-correction. The percentage of failures meets 85% SLA, even though it fails every month for three years.
Catastrophe is demure.

The modern Enterprise endpoint is almost always a massive distribution of responsibility. And in that denial of culpability, nobody is responsible for success.
The completeness of maintenance. The completeness of security configuration. The completeness of the agents that assure it.
It is the perfect failure.

Nobody owns actual success, just blame.