Wednesday, June 03, 2026

How Can You Scam Proof Yourself?

Full disclosure - I did get conned once - a too good to be online deal for a useless product.



How Scam-Resistant Are You?

This short adaptive quiz looks at everyday judgment patterns around phone calls, texts, emails, online accounts, tech support, payments, relationships, and investment pitches. Each answered question stays visible, and the next question appears below it.

Ten questions total. Some later questions are chosen based on your earlier answers.

Question 0 of 10

Tuesday, May 26, 2026

What We Go from China to See at the British Museum in London


Lots and lots of priceless relics were looted and taken outside of China during that time. C.T. Liu, who we mentioned, was one of the biggest art dealers of the time. If you go to Guimei Museum in Paris today, you see him described as a great collector, someone who promoted Chinese art overseas, but to a lot of Chinese people, he was nothing more than a criminal who stole relics to order. A lot of those ended up in the British Museum.

From the Economist podcast on the solo Chinese traveler of today:

Joel Budd: And these guides were describing at great length the sort of context of the objects that they could see. It was a very sort of highly informed kind of tourism. Very studious. It was. And that was especially clear in a sold out exhibit that we went to see with famous Chinese painting.

What I did regret is that I wasn’t properly prepared, so I didn’t have my reading glasses with me. And it’s really a very, very dark room because the painting is so fragile. The people who had come to see it were seriously well-prepared. They had good equipment.

Jiehao Chen: Yeah digital cameras. Yeah

Well, luckily I did have my glasses with me and it’s a very beautiful painting. It’s an illustration of a poem written by a Jin dynasty official called Zhang Hua, and it was aimed at correcting the behavior of an empress. So it has all these different frames showing the proper way to dress and behave at court. What’s really interesting is that 40, 50 years ago, a lot of Chinese people would say, oh, this painting showed outdated feudal values that modern women should just do without. But, as we saw, it’s now really popular with visitors. I guess now enough time has passed for people to be able to appreciate traditional art without the baggage.

Sunday, May 10, 2026

Cloud Mythos - If You Dare Open the Pandora's Box


Whether you view it as genuine caution or very clever marketing (the model gets enormous attention precisely because you can’t have it), the outcome is the same: a handful of major tech and cybersecurity companies now have exclusive access to something that can locate software vulnerabilities faster than any human or team. --Davey McGlade

Guess the Zuckerberg will be shelling out more billions for defectors from Anthropic. Coz, guess what? Facebook (META) has been DENIED!

One way of saying, you can't have it, but you can buy us for $2T

The 27 year old OpenBSD bug we all happily missed - including Eric Schmidt (an integer overflow condition that allows a remote attacker to crash any OpenBSD host responding over TCP - allowing denial of service.)



Monday, May 04, 2026

Hero Ben Brundage - Are Tiny Networked Devices in Your Home Part of a BotNet?

WSJ resource : https://www.wsj.com/tech/personal-tech/residential-proxy-network-cybersecurity-botnets-03856c7f

https://spur.us/context/me (from the podcast show notes)

If he hadn't taken time off studying for his finals, the internet might have died - so says the WSJ :)


Bigger than Stuxnet, but KimWolf was no match for Benjamin Brundage of Seattle

Back to the point : if you're making money off your network, but sharing bandwidth, be warned. Who does that anyway? Are ghetto people that smart? Maybe word gets around


Sunday, April 12, 2026

How You Can Defeat Ransomware After the Hack

A practical guide to whether preserved clean and encrypted file pairs can help researchers recover decryption capability after a ransomware attack.
Problem Statement

Is it possible to deliberately preserve a small set of files, along with backups of their original versions, so that if a ransomware attack occurs, security researchers could compare the pre-encryption and post-encryption versions and potentially recover the decryption key or otherwise build a decryptor?

If so:

  1. Is there a canonical or especially useful set of file types that should be preserved for this purpose?
  2. What characteristics make certain files more valuable than others in a known-plaintext or before/after comparison attack?
  3. Under what conditions can this approach actually work, and why does it fail against many modern ransomware families?
  4. What is the most practical defender-oriented checklist of files and related artifacts to archive now, so that if a future decryptor becomes possible, the chances of successful recovery are maximized?
Defender-Oriented Checklist

The goal is not to assume you will be able to break the ransomware. The goal is to preserve the kinds of artifacts that are most useful if the ransomware later turns out to have made a cryptographic mistake, or if a public decryptor becomes available.

Highest-Value File Types
  • PNG files
  • PDF files
  • DOCX / XLSX / PPTX files
  • ZIP files
  • One append-heavy database file, such as SQLite
  • One or two small text or config files whose original contents are known exactly
  • One standard image or template file used repeatedly in the environment
For Each Preserved File, Ideally Keep
  • The clean/original copy
  • The encrypted version, if an attack occurs
  • The original path and filename
  • The encrypted filename and any added extension
  • Before/after file sizes
  • Timestamps
  • A SHA-256 hash of the clean file
  • A SHA-256 hash of the encrypted file
Incident Artifacts to Preserve
  • The ransom note
  • At least one sample encrypted file
  • The ransomware-added extension, if any
  • Any notes about when the attack happened and which systems were affected
  • If safely captured by professionals, a copy of the malware binary or launcher
A Practical Minimum Archive Kit
  • 1 PNG
  • 1 PDF
  • 1 DOCX
  • 1 XLSX
  • 1 ZIP
  • 1 append-heavy database file
  • 1 small known text/config file
  • 1 common template or reference image
  • 1 ransom note, if attacked
  • Encrypted counterparts of the above, if available

The most useful pair is often the exact same file before and after encryption: same filename, same original location, and a clean version from backup.

Can Preserved Before/After Files Help Recover a Ransomware Key?

Sometimes, yes — but there is no universal canonical set of files that guarantees recovery.

When ransomware researchers succeed by comparing a clean file to its encrypted version, the real reason is usually not merely the existence of a before/after pair. What they are typically exploiting is a cryptographic or implementation mistake in the ransomware.

Examples of mistakes that can make recovery possible include:

  • Reused keystream
  • Reused nonce or IV
  • Weak XOR-style encryption
  • Deterministic partial encryption
  • Broken key generation
  • Improper key reuse across files

If the ransomware uses sound modern cryptography correctly — for example, a fresh per-file symmetric key or nonce, with those keys then protected using the attacker’s public key — then having both the original and encrypted versions of the same file usually does not let you recover the decryption key.

That is why this approach is best understood as an opportunistic recovery aid, not a primary defense strategy.

What Kinds of Files Are Most Useful?

The best files for this kind of analysis are those with highly predictable structure or exactly known content.

These are especially valuable:

  • PNG files, because they have a well-defined signature and chunk structure
  • PDF files, because they start with recognizable headers and have regular internal structure
  • ZIP files
  • Office files such as DOCX, XLSX, and PPTX, because they are ZIP-based containers internally
  • Small template-based text or config files whose contents are known exactly
  • Append-heavy database files, where an older copy and a newer encrypted copy may differ mostly by appended data

The strongest possible sample is not just a “good file type,” but a file whose original bytes are known exactly. A standard company logo, a stock image used everywhere, a blank template, an exported form, or a known installer can all be more useful than a random user-created document.

What Makes This Approach Work?

This approach works only under fairly specific conditions. The biggest enabler is usually a real flaw in the ransomware.

The conditions that can make recovery feasible include:

  1. The same key material or keystream is reused across files.
    In that case, one known plaintext/ciphertext pair may reveal information useful for decrypting others.
  2. Encryption is partial, patterned, or deterministic.
    Some ransomware encrypts only parts of each file for speed, which can leave useful structure visible.
  3. The file format reveals a lot about the plaintext.
    Fixed headers, signatures, and internal structure increase the amount of known plaintext.
  4. Multiple files of the same type are available.
    A large set of samples can reveal patterns that a single pair cannot.
  5. The clean and encrypted copies are truly corresponding versions of the same file.
    Exact pairing matters. Random clean files of the same type are much less valuable than the real before/after pair.

The decisive factor is almost always whether the ransomware made a mistake. The file set only helps researchers exploit that mistake.

Why This Often Fails Against Modern Ransomware

Many modern ransomware families cannot be defeated this way.

If the ransomware uses correct modern cryptography with:

  • fresh per-file keys,
  • fresh nonces/IVs,
  • proper authenticated encryption, and
  • attacker-held asymmetric key wrapping,

then known plaintext is usually not enough to recover the decryption key.

In other words:

There is no magic file set that defeats correctly implemented ransomware.

That is why preserving helpful files is worthwhile as a secondary recovery aid, but attacker-inaccessible backups remain the real defense.

What Is the Real Defensive Strategy?

The practical takeaway is straightforward:

  • Preserve helpful file pairs and incident artifacts because they may help researchers later.
  • Do not assume cryptanalysis will work.
  • Maintain offline, immutable, or otherwise attacker-inaccessible backups.

The preserved-file approach is best viewed as:

A way to improve your odds in the rare cases where the ransomware is flawed — not a substitute for proper backups.

Yes, you can prepare a useful set of files and artifacts that may help future decryptor efforts. But what makes recovery possible is usually a weakness in the ransomware, not the mere existence of those files.

Why? A friend told me about "The Ransomware Hunting Team" by Renee Dudley and Daniel Golden. Said it's not something she'll be recommending to anyone because of how unnecessarily long it is, there were some useful tidbits.

If you're unlucky enough, these are the old folks in the world who can help you out:


Bottom line - if you have an old computer, install nothing that you don't download from a Fortune 50 company :)



Wednesday, March 25, 2026

You Want More Dates from Your Online Dating Profile? Ensure They See the Guitar. So Says Dr. Yakir

That's all you need. Don't take my word for it though. It comes from the highest authority on the subject : Dr. Liat Yakir (Weizmann Institute)

Ensure a guitar is visible in your profile picture on match.com!

Another one on finding love (Mandy Len Catron)

Monday, March 23, 2026

Scumbag of the Day : Guanghzhou Duoyi's Xu Bo - Who Out-Eloned Elon by Fathering 100 Surrogate Kids

How many would he have had if surrogacy was legal in Zhong-gua and it cost one third what it does in the US?

The scumbag whose dream is to share grandkids with none other than Elon Musk. Does Musk want the same? My guess - yes. Surprised you, didn't it😊

Just plain funny, as long as the joke's not on you!


From the Wall Street Journal:

When Katherine and her colleagues started digging into the surrogacy industry, they got curious about one particular corner of that business. The corner that serves wealthy Chinese parents. (FYI, 40% of US-born surrogates are for overseas parents and 40% of those are for Chinese couples)

And the judge starts asking questions and Xu Bo starts answering them. And he says that ultimately he hopes to have as many as 20 children. He says he wants to have all boys because they're superior to girls. He says that he hopes his children will grow up to inherit his business empire.

Ryan Knutson: And he's saying all this to a female judge.

Katherine Long: Yes, that's right.

Ryan Knutson: How does she take that?

Katherine Long: Well, according to people who were in the hearing, she seemed less than impressed by some of these answers. At one point, the judge asked about the children that he'd already had through surrogates, and he said that he hadn't actually visited them yet because his work had been too busy.


Judge Amy Pellman who denied Xu's petition in California


From fortune.com

Xu Bo is the founder and chairman of Guangzhou Duoyi Network: one of China’s largest mobile gaming companies. Despite the Gen X entrepreneur growing his company in Guangzhou, he’s not looking to pass down his $1.1 billion fortune to a child born in his home country. A 2025 Wall Street Journal investigation into Xu’s surrogacy history in the U.S. found the Chinese billionaire was seeking parental rights to at least four unborn children, and had previously fathered and was actively fathering at least eight more surrogacy kids. There could be dozens more.

The billionaire’s video game company had also reportedly stated Xu has more than 100 children born through surrogates based in the U.S., according to the WSJ reporting last year. He was allegedly seeking “50 high-quality sons,” according to accounts linked to Xu on Chinese microblogging website Weibo, and said that “having more children can solve all problems.” During a 2023 court hearing, Xu also said he hoped to have around 20 U.S.-born children to one day take over his business

North Korea, Here I Come Baby, Yeah!


Content coming soon :)

Mr. P! Mr. P!

Yes, Fox.news.

Mr. P. What are you planning to do about North Korea. Aren't they worse than Venezuela and Iran?

I'm going to bomb them.

Using a bunker-buster bomb that weighs 30,000 pounds?

Bigger.


Bigger.

What bomb then?

Sunday, March 22, 2026

Pray You Don't Meet This Scumbag : Dominique Side

Pic from cnn.com. The scumbag Dominique Side at Vegan Fashion Week

Scary as it gets (from cnn.com):

Arielle Mitton’s world turned upside down when she learned the $50,000 she borrowed to pay for surrogacy had disappeared from her escrow account.

“That was the hardest day for me,” she told CNN in a video chat. “I couldn’t eat. I couldn’t sleep.”

Her surrogate was 12 weeks pregnant, and in a cloud of emotional confusion, she remembers reporting the alleged fraud to at least 10 federal and state law enforcement agencies and calling her bank asking for loan forgiveness. But she says the answer was the same. No one could help her.

And the scumbags who did this:

Surrogacy Escrow Account Management LLC, or SEAM, and its owner, Dominique Side, systemically misappropriated millions of escrow dollars, allegedly using the funds to enrich herself and fund side businesses – including a clothing line and a career as a rap and R&B singer and producer.

Did you know? Surrogacy is illegal in China. That's why a lot of wealthy Chinese want surrogate mothers in the US (considered the highest quality surrogate marketplace)

In the US, surrogacy is illegal in Louisiana and Nebraska

In the US, you should be prepared to spend about $150-200k for a surrogate delivery (as the parent). In Mexico, it's about $80k.

If you're planning to be a surrogate mother or a parent planning to go that route, consider a well-written contract!


What if you want a kid through surrogacy?

  • Matter of Baby M. (N.J. 1988) — Traditional surrogate changed her mind after birth, triggering a highly public custody battle; the contract was voided.
    Lesson: Choose jurisdictions and arrangements where surrogacy contracts are clearly enforceable, and favor gestational over traditional surrogacy.
  • Johnson v. Calvert (Cal. 1993) — Gestational carrier claimed motherhood, forcing litigation over who the legal mother was despite a prior agreement.
    Lesson: Establish clear legal parentage upfront through well-drafted contracts and pre-birth parentage orders where available.
  • In re Marriage of Moschetta (Cal. Ct. App. 1994) — In a traditional surrogacy arrangement, the surrogate was treated as the natural mother.
    Lesson: Use gestational surrogacy (no genetic link to surrogate) to significantly reduce custody and parentage risks.
  • In re Marriage of Buzzanca (Cal. Ct. App. 1998) — With donor egg, donor sperm, and a surrogate, a court initially ruled the child had no legal parents.
    Lesson: Secure legal parentage early and explicitly when using donor gametes and surrogacy combinations.
  • P.M. v. T.B. (Iowa 2018) — A twin pregnancy, death of one twin, and dispute over custody led to litigation over enforceability and parental rights.
    Lesson: Include detailed contingencies in contracts for medical complications, multiple births, and unexpected outcomes.
  • Mennesson v. France (ECHR 2014) — France refused to recognize parentage from a lawful U.S. surrogacy, leaving children in legal limbo.
    Lesson: Verify that your home country will recognize the surrogacy arrangement and resulting parentage before proceeding internationally.
  • Paradiso and Campanelli v. Italy (ECHR Grand Chamber 2017) — Child born via surrogacy abroad was removed by authorities due to lack of genetic link and legal recognition.
    Lesson: Ensure at least one intended parent has a recognized legal or genetic link and that all documentation aligns with local laws.

Friday, March 06, 2026

Scumbag of the Day - ACRC Leo (Shen) Li

Scary one and good journalism. A surprise they (WSJ) delivered (and one they weren't expecting to):

Keep it up and he can give Kitano a run for his money

https://static.wixstatic.com/media/2707af_a27bbf0622e243de99c9de107bc3d89a~mv2.png/v1/fill/w_148,h_148,al_c,q_85,usm_0.66_1.00_0.01,enc_avif,quality_auto/%E6%9C%AA%E5%91%BD%E5%90%8D%E7%9A%84%E8%AE%BE%E8%AE%A1%20(10).png

Grad of Tianjin Foreign Studies U.

Nia's internal bleeding was bad. The doctors had to remove her uterus and fallopian tubes. She'll never be able to carry a child again. Nia says the doctors moved her to the orthopedic floor to recover so that the parents, St-Fleur and Scott, wouldn't be able to find her. In the end, St-Fleur and Scott went home with the baby, but Nia's nightmare was far from over.

Nia Trent-Wilson: My contract says after I delivered, the full amount is due. And the full amount due to me still with the complications, with the rest of the money owed, was almost like 75,000.

With the escrow account depleted, there wasn't enough money to pay for Nia's health insurance, meaning Nia didn't have coverage during her C-section and roughly six-hour surgery. Ultimately, Nia is now on the hook for all the medical bills, $182,000. What recourse is there for a surrogate who has an experience like this where they're not paid what the contract says they're owed?

The number of attorneys who feel confident practicing surrogacy law is quite small, and often those attorneys are practicing law in such a way that privileges relationships with parents and surrogacy agencies over surrogates.

Eventually, Nia was able to find an attorney to help pursue the surrogacy agency, ACRC. She alleged that the agency breached its contract with her by matching her with unsuitable parents. ACRC denies the allegation.

In court, ACRC CEO, Shen Li, said the agency believed the intended parents' ability to place so much money at once into the escrow account was sufficient proof of their financial suitability. Ultimately, the judge sided with Nia and ordered ACRC to pay her $41,000. In his ruling, the judge called out the power imbalance between surrogates and agencies. He said that ACRC was able to make money by treating Nia's body as a "profit venturing business" and that the company itself didn't take on much risk during the surrogacy. In an email to the journal, the CEO said, "ACRC remains committed to ethical and responsible surrogacy practices, and to supporting both surrogates and intended parents through what is often a deeply personal process." Nia is still deeply in debt from her third surrogacy. She says she's thinking about the entire industry a lot differently now.

Nia Trent-Wilson: My perception of it has changed because now if you do wrong, there's nobody to report you to. There's nobody to shut you down. They're just like, "Oh, well." And you can continue to keep ruining people's lives and just pick up shop and go across the street and start it all over again.

And the part that surprised me..

Within weeks, the agency approved Nia and matched her with a gay couple in Washington, DC. Their names were Jason St-Fleur and Ricky Lovell Scott, a lawyer and a filmmaker. What were your initial impressions of them?

Nia Trent-Wilson: That they're a nice, normal couple and that they just really long for a child.

...

And Nia had another problem. In her case, the parents weren't even worth suing. Because it turns out, according to Katherine's reporting, Jason St-Fleur and Ricky Scott were broke.

Katherine Long: What I know from legal records is that in the months preceding his contract with ACRC, Ricky Lovell Scott took out a $60,000 loan. He only paid $7,000 without loan. It's not clear to me whether that money was going towards the surrogacy journey, whether he took that $60,000 and put it into Nia's escrow account, but it does speak to a pattern of this couple taking out loans or not paying what they owe and then facing very little judgment.

The lender, SoFi, tried to sue Scott, but had to drop its claim because it couldn't locate him to serve him the complaint.

The surprise - a lawyer can be broke. Someone told me he went into law because he wanted to make a bit of money to retire early. There's a lot of money in law? OMG, are you kidding me. "Is there a lot of money in law"? Are you saying that just to be funny?

Another question - why wouldn't WSJ say more about the ethnicity of this gay couple? Would a white guy behave thus?

Nia Trent-Wilson: At the doctor's appointment, they discovered that only one baby took. And when they discovered that only one baby took as opposed to two, they start calling me a baby killer.

A baby killer. Nia says that one of the intended parents started rolling on the floor, crying. Well, how did you feel in that moment?

Nia Trent-Wilson: A mix of emotions, embarrassed, belittled, ashamed. And I'm already pregnant, so I'm already on all of these IVF medicines, so I'm mentally and emotionally vulnerable right now. 

The dragon hits back at America, by proxy!







Given one's an attorney and the other's a filmmaker, which one do you suppose started rolling on the floor and crying?