Full disclosure - I did get conned once - a too good to be online deal for a useless product.
Ten questions total. Some later questions are chosen based on your earlier answers.
From the Economist podcast on the solo Chinese traveler of today:
Joel Budd: And these guides were describing at great length the sort of context of the objects that they could see. It was a very sort of highly informed kind of tourism. Very studious. It was. And that was especially clear in a sold out exhibit that we went to see with famous Chinese painting.
What I did regret is that I wasn’t properly prepared, so I didn’t have my reading glasses with me. And it’s really a very, very dark room because the painting is so fragile. The people who had come to see it were seriously well-prepared. They had good equipment.
Jiehao Chen: Yeah digital cameras. Yeah
Well, luckily I did have my glasses with me and it’s a very beautiful painting. It’s an illustration of a poem written by a Jin dynasty official called Zhang Hua, and it was aimed at correcting the behavior of an empress. So it has all these different frames showing the proper way to dress and behave at court. What’s really interesting is that 40, 50 years ago, a lot of Chinese people would say, oh, this painting showed outdated feudal values that modern women should just do without. But, as we saw, it’s now really popular with visitors. I guess now enough time has passed for people to be able to appreciate traditional art without the baggage.
 |
| One way of saying, you can't have it, but you can buy us for $2T |
WSJ resource : https://www.wsj.com/tech/personal-tech/residential-proxy-network-cybersecurity-botnets-03856c7f
https://spur.us/context/me (from the podcast show notes)
If he hadn't taken time off studying for his finals, the internet might have died - so says the WSJ :)
 |
| Bigger than Stuxnet, but KimWolf was no match for Benjamin Brundage of Seattle |
Back to the point : if you're making money off your network, but sharing bandwidth, be warned. Who does that anyway? Are ghetto people that smart? Maybe word gets around
Is it possible to deliberately preserve a small set of files, along with backups of their original versions, so that if a ransomware attack occurs, security researchers could compare the pre-encryption and post-encryption versions and potentially recover the decryption key or otherwise build a decryptor?
If so:
The goal is not to assume you will be able to break the ransomware. The goal is to preserve the kinds of artifacts that are most useful if the ransomware later turns out to have made a cryptographic mistake, or if a public decryptor becomes available.
The most useful pair is often the exact same file before and after encryption: same filename, same original location, and a clean version from backup.
Sometimes, yes — but there is no universal canonical set of files that guarantees recovery.
When ransomware researchers succeed by comparing a clean file to its encrypted version, the real reason is usually not merely the existence of a before/after pair. What they are typically exploiting is a cryptographic or implementation mistake in the ransomware.
Examples of mistakes that can make recovery possible include:
If the ransomware uses sound modern cryptography correctly — for example, a fresh per-file symmetric key or nonce, with those keys then protected using the attacker’s public key — then having both the original and encrypted versions of the same file usually does not let you recover the decryption key.
That is why this approach is best understood as an opportunistic recovery aid, not a primary defense strategy.
The best files for this kind of analysis are those with highly predictable structure or exactly known content.
These are especially valuable:
The strongest possible sample is not just a “good file type,” but a file whose original bytes are known exactly. A standard company logo, a stock image used everywhere, a blank template, an exported form, or a known installer can all be more useful than a random user-created document.
This approach works only under fairly specific conditions. The biggest enabler is usually a real flaw in the ransomware.
The conditions that can make recovery feasible include:
The decisive factor is almost always whether the ransomware made a mistake. The file set only helps researchers exploit that mistake.
Many modern ransomware families cannot be defeated this way.
If the ransomware uses correct modern cryptography with:
then known plaintext is usually not enough to recover the decryption key.
In other words:
There is no magic file set that defeats correctly implemented ransomware.
That is why preserving helpful files is worthwhile as a secondary recovery aid, but attacker-inaccessible backups remain the real defense.
The practical takeaway is straightforward:
The preserved-file approach is best viewed as:
A way to improve your odds in the rare cases where the ransomware is flawed — not a substitute for proper backups.
Yes, you can prepare a useful set of files and artifacts that may help future decryptor efforts. But what makes recovery possible is usually a weakness in the ransomware, not the mere existence of those files.
