Color Me Concerned

Your sundowning American president continued his long and inevitable slide into oblivion over the weekend. It was so spectacular that it has taken the news cycle a couple days to catch up. Or maybe firing off 150 tweets over the course of a Sunday morning really did manage to 'flood the zone with bullshit', as Steve Bannon memorably described his strategy. Either way, hooooo boy! This guy is crazy for real. Obamagate? What the actual fuck are you talking about? When pressed, he gave the classic "you know what I'm talking about" as a response. Truly, a master of rhetoric.  

It's hard to know what to say or guess at any more when the erstwhile commander in chief is incapable of basic, coherent thought, but somehow continues in office. He cannot answer a direct question. There's only so much deny / deflect / distract that they can do. Barr will not hold him accountable because he is a bible-thumping holy warrior on a crusade to Save America from, umm, cannabis? No idea. McConnell just want to make sure that his rich friends stay rich, and that corporations can keep on making as much money as possible, and if you're not rich then that's your fault. Anything that threatens their hegemony is unacceptable, so any type of voter suppression and shady dealing is perfectly fine because the end justifies the means.  

If you were to create a cartoon villain and all of his cronies from scratch and you ended up with something that looked like Trump and his enablers you could only put it in cartoons, because all the characters are too flat and one-dimensional. The treasury secretary loves money? The puppetmaster in the senate looks like a turtle taking a shit and also pulls all the strings behind the scenes? The head law enforcement officer prostrates himself before the president and only does his bidding? The president only surrounds himself with attractive young female aides? It's all a little too on the nose. Call me back when you can add some subtlety or nuance.  

January cannot come soon enough. They can open every shop and restaurant in America if they want to. I am avoiding people for as long as it takes, and it will be a while. 

Oliver Heldens: We're on a Boat!

Sometimes you just need to get out of the house. How can you maintain social distance while still straight vibin? 

On a boat, obvs. 

One man (and his boat driver person) bringing the beats to the people. 

It's not much but I'll take it. 

I Don't Know I Just Work Here

Are you tired of quarantine? Me too, and I have the benefit of my own living space and (just about) all the entertainment that money can buy. Youtube served me this, because at this point Google probably knows me better than I do myself.

In times like these it's good(?) to turn to the classics, and this song takes me places. Several years ago my friend got married and had an 80s cover band for the music. They had party favor packages with neon wristbands, headbands, neon wayfarer-style sunglasses, neon necklaces, and stickers and flare. The band brought the HEAT. I drank too much the correct amount, wore out the dance floor, had PDA with the hot Swedish cousin (a former Guess girl, allegedly), and made those sunglasses look like it was hot in 1988. Dear Reader, I am here to tell you that it fucking ruled.

In summary: I need to get out of the house. Until then, let's kick out some jams.

Wash Your Hands, Maintain Social Distance, and Wear a Mask

Not much to report.
Wear a mask, wash your hands often, and avoid people. I was doing the first two before the plague kicked off, but the mask really completes my look.

This thing will be going on for a good long while. The social distance and mask wearing should continue until we have a vaccine, and/or the infections start to slow down. Expect second and third waves of the epidemic to hit once this first wave is done, with more of the same all over again.

I don't have any good news. I hope that you are not sick, and that you do not get sick.
See you out there.

The Rich Get Richer at No Risk, While the Working Man Gets Screwed

Here is a good summary of the why a bailout for corporations can be bad.

In short: hospitality and airline companies have been plumping up their own executive comp plans with stock buybacks for the last 10 years, leaving them in very risky positions when times get tough. Stock buybacks are great for rich people, not so good for rank and file employees (who either do not own enough stock, or own no stock at all).

This is very good business! The executives that got paid don't have to give the money back, and now they can rely on you, the taxpayer, to bail them out.

America, everybody!

Desus and Mero and Andy and Anderson

This is good. I don't much care about any of Andy Cohen's shows, or watch anything that Anderson Cooper is doing (I don't have cable), but Desus and Mero are great.

YOLO, aka 2020 KTM 1290 Super Duke R

:: SWOON ::

We love the two wheeled machines in this space. Motorcycles, bicycles, whatever you have is welcome.

Does it involve wearing silly outfits and putting your life at risk? HELL YEAH. Is it expensive? YOU CAN'T PUT A PRICE ON LOVE. Do you get to wear a helmet? IT'S CALLED A BRAIN BUCKET FOR A REASON. What is wrong with you and why are you shouting? I DON'T --ahem -- I don't know. The motorbikes just get me SUPER PUMPED and then I have to watch 30 minute videos as a welcome distraction from my fading middle age and also a global pandemic. Seems reasonable, no?

Not much else to add here besides that motorcycles are like bicycles except you do not have to work as hard.

COVID-19

Here is A Photo of a Kitten

I wanted to write about something else, literally anything else, but it seems disingenuous. There is a disturbing amount of misinformation out there, so here are some facts that you may or may not find useful:

- COVID-19 is way worse than the flu. Forget about comparisons to the flu. Those comparisons are bad and inaccurate. Best guess is that it is 7x as bad as the flu in terms of fatalities. Might be a bit less, or a bit more, but that's where we are right now.

- It is not kind to seniors, or anyone with existing lung conditions. Older people are dying at a rate of about 80%. That's a lot! If your parents, or grandparents, or anyone you know that is elderly gets infected they will almost certainly die.

- If we do not decrease the rate of infection then the morbidity rate will go up for everyone infected, including people in their 30s and 40s.

- Younger people are very low risk for hospitalization and fatal infections, but high risk for infection transference.

So that's that. Follow through on your social distancing. Stay healthy if you can. Isolate yourself if you are sick. This thing will burn itself out one way or another, and life will go on. It might look a lot different at first, but it will settle back down eventually. It's weird not to be able to give my friends hugs, and to be isolated, but it will not last forever.

See you out there.

The Political Commentary We Need

'Warren coming with that strong teacher that cares energy right now' killed me.

Bloomberg is a clown. A rich clown, but a clown nonetheless. He is no more qualified to run the country than a mayor from a nowhere town in a nothing state, and they deserve to be called out for their bullshit.

Warren with that strong teacher that cares energy is also full of shit (her health care plan is a pipe dream), but at least she ethered the most obviously unqualified dipshits on the panel.

Also Desus Air Max 95's are dope. I like that color way. I would never wear it, but it's cool if you can make it work for you.

Here We Are: 02/20/2020

Welp, here we are. 02/20/2020 - I know, I didn't think we would make it either, but life is full of surprises.

Today there will be cake. And some sweet, sweet jams. Tomorrow, who knows? You get today. So have some cake, tell your friends and family you love them, and worry about tomorrow when it gets here.

See you out there. 

This is How Democracy Dies

The Senate is the absolute worst. A president elected after losing the popular vote + a legislative branch that gives unequal representation = government by a minority.

Wyoming, with a total population of about 580,000 people, gets two Senators. 580,000 people would make the entire state of Wyoming approximately the 15th largest county in the state of California. It would only be the fifth largest city in California, which: lol.

Alaska has about 700,000 people, and also gets two Senators (bridge to nowhere!). North Dakota, same thing. South Dakota, same thing. Same principle is true of Vermont, Rhode Island, and several others.

The problem with this is that residents of states with low populations have a disproportionate say in national legislation. The other problem is that the senators from these states are easier to buy in bulk than senators from states with large populations: your lobbying money goes a lot further when the politician you buy does not have very many constituents. That's why Orrin Hatch lived comfortably in the pocket of pharmaceutical companies for 40(!!) years.

Democracy is messy and imperfect, but it is not difficult. The US government is broken, in large part because senators wield influence that far outstrips the impact of their constituents. The United States Senate is an enemy of democracy, and it should be abolished.

Abolish the Senate

Imagine a world where Barack Obama conspired with a foreign government to try to gain an advantage in his own re-election. Imagine that the evidence was clear, obvious, and incontrovertible.

Imagine then that he was impeached, and that the Senate had to hold a trial to determine if this constituted 'high crimes and misdemeanors' (hint: it does), and imagine that before the trial even started that the majority leader announced that Obama would be acquitted, and that the Senate would not allow any witnesses to be called.

That would never happen, because Barack Obama, in addition to not being a fucking moron that routinely breaks the law to enrich himself at the expense of the country, is not an enemy of democracy.

The United States is being held hostage by a minority of its population, because the Senate is broken. It should be abolished, along with the electoral college. Put them both in the trash where they belong. Rich old white men will have to find something else to keep them busy in their dotage besides fucking up the greatest nation on earth.

Insecurity Can Ruin Relationships

I found this article deeply interesting and relevant, and ordered the book as a result. I confess that I see more of myself in some of this than I would like to admit. The Atlantic had the title as 'Negativity Can Ruin Relationships', and that is true, but the part about insecurity being the root cause of many breakups made a bigger impact on me.

There's lots to unpack here, and no doubt much more in the book, but you can start with this and see where it takes you:

Some couples, of course, are better off splitting up, but far too many of them sabotage a relationship that could have worked.

Teach Your Child to Ride a Bike

I thought this was charming. And I rode everywhere when I was a kid, so of course I think it's great for kids to ride bikes. YMMV (literally)

Happy New Year

Happy new year!
I'm very busy the next couple weeks with not-very-important business. You care.

I got a new job, which is similar to the old job, but hopefully better because I will be able to actually sell some software this time. We can but hope.

Right now the idiot President and has associate idiot Secretary of State are trying to start a war with Iran. Just in time for the election! The last time an idiot started a pointless war in the Middle East it cost over two trillion dollars (and counting) and went on for 15 years (and counting). What could possibly go wrong?

Well, for starters, Iran is a big country that is remarkably unified, and it is chock full of religious fundamentalists. The value of destabilizing a relatively large country full of religious fundamentalists can only be fully understood by a 200 IQ galaxy brain genius like Mike Pompeo, but up here in the cheap seats it is not very strategic to kill a much revered foreign general unless you have (and can show) concrete proof that it is worth it, and that there was a credible threat to the United States. In other words the death of a single American contractor (who was operating in a de facto war zone) does not justify starting a war, unless you're a complete and utter fucking moron. Oh, wait, I forgot who I was talking about.

But hey, oil prices are way up, and I am sure that none of the President's failsons took positions in energy securities before this thing kicked off.

More on this as the situation develops. Or not. I actually do have stuff to do. Weird, I know.

Ollie Down a Six-Stair, but Blind

Hell yeah.

Hennessy Strong as Fuck

I like this song. Guy has a good ear for melody and a deft touch with lyrics. Not for nothing, but this kid died last week at 21. The drugs, they feel good sometimes, but they can also kill you.

I need to go home.

What Happens When Your Browser Connects to A Website?

I was asked to create a writeup of what happens when your browser connects to cnn.com. You can find writeups for this in other places (it's a common interview question), but the summaries I found were either out of date, because they did not include a summary of perfect forward secrecy during the TLS handshake, or incomplete. The out of date issue is a problem, because TLS v1.3 mandates Diffie-Hellman encryption and PFS. (See my previous post about perfect forward secrecy for more information on how that works).

There is other useful information here, such as what layer of the OSI model is being used by switches (Layer 2) and what is being used by routers (Layer 3). Switches move traffic within networks, and routers move traffic between networks.

Anyway, here is the assignment, and my response:

Send a detailed walkthrough of what happens when you go to cnn.com, and it is a multi-factored website. Which means that the information that is coming from Cnn.com is not coming just from cnn.com.

1 - Open browser, type cnn.com

2 - Browser calls the DNS resolver to check the local /hosts file and (if no IP address is found) to check the cache for a DNS record to find the corresponding IP address of cnn.com. The caches are checked in the following order:
Browser cache
OS cache
DNS cache
ISP cache

3 - If no IP address for cnn.com is found in the cache, the ISP DNS server initiates a DNS query to find the address of the server that hosts cnn.com.

If the DNS server is on the same subnet as my local machine then the network library follows the Address Resolution Protocol (ARP) for the DNS server. If the DNS server is on the is on a different subnet than my local machine then the network library follows the ARP process for the Default Gateway IP.

To send the ARP broadcast the network stack library needs the target IP address to look up, as well as the MAC address of the interface it will use to send out the ARP broadcast.

The ARP cache is checked for an ARP entry for the target IP. If the entry is cached then the library returns a value that the target IP is equal to the MAC address.

If the entry is not in the ARP cache:

The Client looks up the routing table to see if the target IP address is on any of the subnets on the local route table. If so, the library uses the interface associated with that subnet. If not, the library uses the interface that has the subnet of our default gateway.

The Client Looks up the MAC address of the selected network interface.

The Client Network library sends a Layer 2 (data link layer) ARP request. The request includes the Sender MAC address, Sender IP address, Target MAC address, and Target IP address.

ARP request:
Sender MAC: client:mac:address:here
Sender IP: client.ip.goes.here
Target MAC: FF:FF:FF:FF:FF:FF (Broadcast)
Target IP: target.ip.goes.here

Next step depends on the hardware between the computer sending the ARP request and the router.
Directly connected to router: Router responds with ARP reply

• Hub: Hub will broadcast ARP request out all the other ports. If router connected on same ‘wire’, it will respond with an ARP reply
• Switch: Switch will check local CAM/MAC table to see which port has the MAC address we went. If no entry it will rebroadcast the ARP request to all other ports. If switch has an entry in the MAC/CAM table it will send the ARP request to the port that has the MAC address we are looking for. If the router is on the same ‘wire’ as the switch it will respond with ARP reply. The reply will be routed directly to the sender using the ARP reply. 

ARP reply:
Sender MAC: server:mac:address:here
Sender IP: server.ip.goes.here
Target MAC: client:mac:address:here
Target IP: client.ip.goes.here

The network library now has the IP address of the DNS server or the default gateway and it can send a UPP request to the DNS server for the IP address. If the local ISP/DNS does not have it, it starts a recursive search across the list of DNS servers until an answer is returned.

4 - IP address found, the browser initiates a TCP connection with the Server, likely using the default port 80 (HTTP) or port 443 (HTTPS).

The request from the browser is passed to the Transport layer (Layer 4) to create a TCP Segment. The Transport Layer adds (encapsulates) a TCP header, which includes the source port and destination port, and creates a Segment.

The Transport Segment is then sent to the Network layer (Layer 3), which wraps another IP header to create a packet. The IP header includes the IP address of the current machine and the IP address of the destination server (i.e. the IP address for cnn.com, in our example).

The Packet is sent to the Data Link layer (Layer 2), where the encapsulation adds the Ethernet header to create a Frame. The Ethernet header (or Frame header) includes the MAC address of my local machine and the MAC address of the local router.

At this stage the message/segment/packet/frame is ready to be transmitted. To summarize, it includes:

• Request
• TCP Segment (added in Transport layer), Destination Port and Source Port headers
• IP header (added in Network layer) which includes the IP address of the destination server AND the IP Address of the current machine
• Frame Header (added in Data Link layer) that includes the MAC address of the destination machine NIC, and the MAC address of the gateway (local router)

After passing through the Data Link layer the packet is ready to be transmitted on the Physical layer.

Packet will pass through the wire on some combination of Ethernet / WiFi / Cellular Data Network

Eventually the packet will reach the router managing the local subnet. From there it travels across the autonomous system’s border routers, other autonomous systems, and finally to the destination server. Each router along the way extracts the destination address from the IP header and routes it to the appropriate next hop. The time to live field (TTL) is decremented by one for each router that it passes. Packet will be dropped if the TTL field reaches zero or if the router has no space in its queue.

When the message reaches the server it is de-encapsulated: the Frame header is stripped by the Data Link layer, then the IP header is stripped by the Network layer, and then the TCP header is stripped and used to identify the destination port on the server. (Likely 443, if we connect to cnn via HTTPS.)

When the message is received we can establish a connection via a TCP/IP three way handshake, where the Client and Server exchange SYN (synchronize) and ACK (acknowledge) messages to establish a connection.

Step 1/3: Client sends a SYN packet to server asking if open for new connections

2/3: If the server has open ports that can accept and initiate new connections, it will respond with ACKnowledgement of the SYN packet with a  SYN/ACK packet

3/3: Client receives SYN/ACK from server and acknowledges with ACK packet, and the connection is established.

Connection established, we can now execute the TLS handshake:

• Client sends ClientHello message to the server with its TLS version, list of cipher algorithms, and available compression methods. 
• Server replies with ServerHello to Client with TLS version, selected cipher, selected compression methods, and server’s public cert signed by a Cert Authority. 
• If using typical RSA (not PFS) encryption, then the Client uses the server’s public key to create a pre-master Secret, and sends that pre-master secret to the Server. 
• Server decrypts the pre-master secret from the Client using its private key, and both the Server and Client can now generate a Master Secret, or Session Key, for bulk encryption. Usually this asymmetric encryption is used with the RSA encryption algorithm. 
• If using Diffie-Hellman Ephemeral Encryption (enforces Perfect Forward Secrecy), the Server responds with a Diffie-Hellman key exchange as its preferred selected cipher. It uses two known, public values (prime number and a modulo number), along with a secret value, to send a Diffie-Hellman key value to the Client. 
• Client uses this Server Diffie-Hellmen key value to calculate its own Diffie-Hellman Key value (the math is complex, but it is based on the fact that the Client knows the modulo and prime number used by the Server, and also on a unique number known only to the client), and sends that back to the server. 
• Now both Client and Server know the calculated values for each other, and they can use these values to generate a pre-master secret. Both Client and Server arrive at a pre-master secret without ever having had to know the private key of the Server.
• Once a pre-master secret is generated, then a master secret on both Client and Server is generated (often using AES), and they can communicate. 
• Note that if PFS is enabled then this flow is repeated, and a new key is generated for each session of the Client and Server. Using Elliptic Curve Diffie-Hellman Ephemeral encryption will improve performance, as ECDHE offers similar security to RSA at substantially lower bit sizes. 

I used the Chrome Developer Tools to poke around in cnn.com to get more details on the page. The main cnn.com connection is encrypted and authenticated using TLS 1.2, ECDHE_RSA with X25519, and AES_128_GCM, but there are many resources also served on the website that are secured with different encryption. For example, facebook.com is serving content on the site using TLS 1.3, X25519, and AES_128_GCM. Since I browsed to cnn.com with Chrome, some of the connections were served using the QUIC protocol instead of TCP (google.com used QUIC, X25519, and AES_128_GCM).

5 - Once the TLS handshake is complete my browser can send a HTTPS GET request to transfer data from cnn.com. The request contains additional information like browser identification (User-Agent header) and requests it will accept (Accept header), and connection headers to keep the TCP connection alive for future requests. It will also pass info from cookies that my browser has stored for this domain.

6 - Server receives the request and passes it to a handler to read and generate a response. The handler reads the request, the headers, the cookies, updates any information on the server as needed and assembles a response in the format specified by my request. The server sends an HTTP response with the form:
200 OK

Headers for:
Content-Encoding
Cache-Control
Cookies to set
Privacy information
(single empty line)


If the HTTP headers sent by the Client include enough information to determine that the version of the file is unchanged since the last visit then it sends a 304 Not Modified response and no payload, and the Client Web browser retrieves the HTML from its cache.

After parsing the HTML the Client and Server repeat this process for every resource (CSS, image, etc.) referenced by the HTML page.

7 - My browser displays the HTML content. 

Someone Made a Video About My Life: Casually Explained Cycling

This is uncomfortably accurate.

How the World Works: Flynn Andrizzi is a Piece of Shit

A friend of mine works at a major hospital in the area, on the foundation / donations side. The hospital is a nonprofit, but that doesn't mean they don't make money. Quite the opposite: they make mountains of money. Also they collect a lot in donations.

A few weeks ago my friend told her boss that she wanted to pursue an opportunity in another part of the hospital, on the corporate side. Her boss gave it his blessing. As part of the effort she also spoke to her skip level manager (her boss's boss), because she wanted to give him a heads up and get his feedback. This was a courtesy, because she wanted to be professional and transparent with her manager and team. Seems reasonable, since she has been a top performer in the time she has been there, is popular with her doctors and her donors. Also they just offered her a multi-year contract to stay in the foundation that included a 150% raise (not a typo), which she rejected, because she does not want to manage anyone, and also does not want to limit her options.

The meeting with the skip level manager, a white mormon man in his early 60's, did not go well. He took the fact that she rejected the contract offer personally, so he rejected her request to change departments, told her explicitly that she would never work anywhere but her current role in her current department, that he would not recommend her to the CEO, and said, "I am going to talk to you like I would talk to one of my kids...", and explained that she needed to 'wait her turn'. It was ageist, condescending, and mean. It's fine to disagree with someone in a professional context, but this was not that; this was personal.

My friend proceeded with her original plan: met with the CEO, got strong buyin from him, and got busy making a case for a role on the corporate side. She also told me she expected some type of hazing from her VP, but that hoped that her boss would insulate her from most of it.

So how did her boss insulate her from the hazing? By trying to get her fired for cause.

Fast forward to yesterday, when she was asked to attend a meeting with her manager. My friend arrived to find her manager flanked by an HR flack, and they interrogated her about some appointments in her calendar. Their main issue was that she had an appointment somewhere on a Friday afternoon and when it got canceled she worked from the site of the appointment (another Hoag location) instead of coming back to the office. There was another issue with 'calendar hygiene' as well, related to a contact from earlier in the year. She was accountable, honest, and got the work done as asked. So the issue is not the work, it's the appearance of the work. Seriously.

For these two 'offenses' she was given a three day suspension, effective immediately, and walked out of the building.

Why would they try to fire their top producer over the past two years for some trivial calendar discrepancies?

Are calendar discrepancies like this even grounds for termination? (No, not at any place I have worked, or heard of, especially for what is a senior outside sales role. You are supposed to be in front of customers / donors; not sitting at your desk.)

My friend quit before they fired her, and while she could sue it's too much hearsay and he-said/she-said for it to really go anywhere. Only the lawyers will get rich. So in two weeks she went from being a respected, much in-demand employee that they offered a years-long contract and asked to mentor other talent to being suspended for violations in her calendar and likely fired for cause.

How does that happen? What changed? Did she not show enough deference? Did she fail to recognize how petty and vindictive people can be?

My friend will be fine - she is smart and good at her job and well connected. As traumas go, this one is minor, and recoverable.

It's hard to appreciate how quickly an encounter with a powerful egomaniac can derail your career prospects at a company until you see it firsthand. This is definitely not the first time that Flynn Andrizzi, shitbag that he is, has acted maliciously. It's never the first time, and never the only time. Hoag Hospital Foundation will be stuck with low performers and a shitty team until he dies or rides off into the sunset. That day cannot come soon enough.