Re: Oct. 3, 2018 EAS Presidential Alert test

2018-10-08 Thread Sean Donelan

On Mon, 8 Oct 2018, Aaron C. de Bruyn wrote:

Google solved these problems with ~$120 smoke alarm and a decent cell phone app.
If they released a new version with weather alerts, I wouldn't think
twice about dropping $200 on it.


A company already made a combination smoke alarm/weather radio.
Halo Smart Labs went out of business earlier this year.
https://www.smartthings.com/products/halo-smart-labs-halo-smoke-and-carbon-monoxide-alarm-plus-weather-alerts

A $120+ niche silicon valley product is great for the nerds. Whats the 
business case for everyone else?


What's the business case for reaching 126 million households, with a 
product that is afforable or already part of something they already have.




So how is there no business case?  No disrespect intended, but you
failed to back up that statement.


More people own Amazon smart speakers than NEST thermostats.  Amazon 
product people have told me there is no demand for emergency alerts in its 
Alexa product.


Likewise, I've asked Google developers.  They said the same thing about 
adding emergency alerts to their Google assistant product.




Perhaps I'm the only one who would spend more than $50 on a weather
alert device?


Fewer than 5% of households buy weather radios.

WEA can reach over 60% of households with cell phones. Its not 100%.

Yes, 5% of households are willing to spend $50 on a weather radio.  How to 
reach more than 5%?



If you know that Google or Amazon plan to add emergency alerts to its 
smart assistant products, that would be great news.  But so far, their 
product people have been very clear, they see no business case for 
supporting government emergency alerts on their "smart" products.




Re: Oct. 3, 2018 EAS Presidential Alert test

2018-10-08 Thread Aaron C. de Bruyn via NANOG
On Mon, Oct 8, 2018 at 10:54 AM Sean Donelan  wrote:
> There is no business case for Amazon, Apple or Google to include emergency
> alerts as part of their smart speakers.

I have a $50 weather alert radio.
Does it have have batteries?  Are they charged?  Are they almost dead?
 When did I last hear an alert from it?
Does your smoke alarm have batteries?  Are they dead?  When did you
last test it?

Google solved these problems with ~$120 smoke alarm and a decent cell phone app.
If they released a new version with weather alerts, I wouldn't think
twice about dropping $200 on it.

So how is there no business case?  No disrespect intended, but you
failed to back up that statement.

Perhaps I'm the only one who would spend more than $50 on a weather
alert device?

-A


RE: Oct. 3, 2018 EAS Presidential Alert test

2018-10-08 Thread bzs


On October 8, 2018 at 16:37 s...@donelan.com (Sean Donelan) wrote:
 > A nation-wide WEA and EAS system helps warn people in both cities and 
 > rural areas. But they still depend on carriers and broadcasters. If there 
 > are no backup batteries in cell towers, or backup transmitters for 
 > broadcasters, you end up with communication blackouts like in Puerto Rico 
 > for months.

Which is why it's more relevant to this list than some were grousing
since people here are often the ones keeping the infrastructure this
has to travel on running.

The US govt should pay us all to discuss this!

-- 
-Barry Shein

Software Tool & Die| b...@theworld.com | http://www.TheWorld.com
Purveyors to the Trade | Voice: +1 617-STD-WRLD   | 800-THE-WRLD
The World: Since 1989  | A Public Information Utility | *oo*


RE: Oct. 3, 2018 EAS Presidential Alert test

2018-10-08 Thread Sean Donelan

On Mon, 8 Oct 2018, b...@theworld.com wrote:

I suppose since every life is precious one can measure the
effectiveness based on "land mass" but then one wonders if some sheep
out in a field in Idaho really care that the US was just invaded...put
better: You do what you can!


How quickly we forget.  Puerto Rico's catastrophe was only a year ago. 
Per capita fatalities in rural areas are usually higher than cities after 
a disaster.  Telecommunications are even more important in rural areas 
because you have fewer disaster response resources than in cities.
Rural areas receive warnings later, have fewer emergency responders, fewer 
advanced trauma hospitals. There are more neighbors helping neighbors in 
cities, and more potential sources of help in densely populated areas.


Telecommunication providers are less likely to spend money hardening
infrastructure in rural areas, because there is less business.  Its easy 
to find alternative telecommunications in New York City. Its hard to find 
backup telecommunications in Idaho.


A nation-wide WEA and EAS system helps warn people in both cities and 
rural areas. But they still depend on carriers and broadcasters. If there 
are no backup batteries in cell towers, or backup transmitters for 
broadcasters, you end up with communication blackouts like in Puerto Rico 
for months.




Re: Oct. 3, 2018 EAS Presidential Alert test

2018-10-08 Thread Nate Metheny
Just as a small point of contention, if you lose the bread basket and 
the agricultural industries, you might as well have never received an 
emergency alert in a city where the supplies and fresh food will run out 
and people will be fighting and killing each other for a Snickers bar.


No good saving millions of people if you can't feed more than thousands.

Just my $.02. :)

On 10/08/2018 12:42 PM, b...@theworld.com wrote:

I suppose since every life is precious one can measure the
effectiveness based on "land mass" but then one wonders if some sheep
out in a field in Idaho really care that the US was just invaded...put
better: You do what you can!


--
. === --  - --  - - --   - ---.
| Nate MethenyDirector, Technology |
| Santa Fe Institute   office 505.946.2730 |
| cell 505.672.8790   fax 505.982.0565 |
| http://www.santafe.edu  n...@santafe.edu |
`---   -   -- ----  - = == ==='



smime.p7s
Description: S/MIME Cryptographic Signature


RE: Oct. 3, 2018 EAS Presidential Alert test

2018-10-08 Thread bzs


On October 8, 2018 at 03:37 snasl...@medline.com (Naslund, Steve) wrote:

 > A few cases come to mind.  I also think there are lots of alerts
 > that will not send people screaming into the streets.  9/11 did not
 > really have that effect in most places and it took quite some time
 > for word to spread to people who did not have full time media
 > access.  You also have to account for non-urban areas (the majority
 > of our land mass).  In a lot of this country you might not see
 > anyone other than the ones you live with for many hours or days at
 > a time.

9/11 literally did send people out into the streets screaming.

Even nationwide skyscrapers were evacuated in some cities. In Chicago
Sears tower (and I believe the Amoco tower according to some
eyewitnesses) were evacuated at about 10AM. So was the IDS tower in
Minneapolis (57 stories, tallest in the city.)

The White House and Capitol building were evacuated a little earlier,
about 9:30AM. And the UN in NYC.

At about 10:45AM NYC mayor Rudi Giuliani ordered the total evacuation
of all of Lower Manhattan.

  https://en.wikipedia.org/wiki/Timeline_for_the_day_of_the_September_11_attacks

The article below lists the evacuations of the Coca-Cola and BellSouth
buildings, CNN center in Atlanta. And several more in Los Angeles
(Citibank tower etc.)

Well, read the article, Detroit, the Grand Coulee Dam, etc.

  http://articles.latimes.com/2001/sep/11/news/ss-44625

I suppose one can go back to the phrase "most places", sure, MOST
places even in western Europe weren't bombed in WWII or even affected
physically (i.e., by ordnance of any sort.)

P.S. Over 80% of the US population is urban.

I suppose since every life is precious one can measure the
effectiveness based on "land mass" but then one wonders if some sheep
out in a field in Idaho really care that the US was just invaded...put
better: You do what you can!

-- 
-Barry Shein

Software Tool & Die| b...@theworld.com | http://www.TheWorld.com
Purveyors to the Trade | Voice: +1 617-STD-WRLD   | 800-THE-WRLD
The World: Since 1989  | A Public Information Utility | *oo*


Re: Oct. 3, 2018 EAS Presidential Alert test

2018-10-08 Thread Sean Donelan

On Sat, 6 Oct 2018, valdis.kletni...@vt.edu wrote:

Since there isn't infinite money to build a system that will reach *everybody*,
the only reasonable approach is to cobble together a set of overlapping systems
on existing technology that covers the most people while staying inside the
funding restrictions.


There is also the circular logic of budget cutting.

1. We don't need to fund outdoor sirens, becuase we have E.A.S. on 
radio/TV/cable.

2. We don't need E.A.S. because we have NOAA weather radio.
3. We don't need NWR because we have Wireless Emergencey Alerts.
4. We don't need WEA, because we have outdoor sirens.
5. Goto 1

There is no business case for Amazon, Apple or Google to include emergency 
alerts as part of their smart speakers.


The majority of cities did not repair/replace their outdoor civil defense 
sirens when they reached their 40-year lifespan in the 1990s.  Tornado 
Alley likely still has the most working outdoor sirens, but even in that 
part of the country a majority of cities saved money by not maintaining 
them. An average outdoor siren costs $25,000 installation, $1,000/year 
maintenance and only covers 1/2-mile radius -- outdoors. In most places, 
an outdoor siren won't wake you up indoors.


This year's federal budget proposed cutting 20% of NOAA weather readio 
transmitters to save money. Fewer than 5% of households buy weather 
radios.


Although FCC and FEMA help standardize national disaster response systems, 
such as 9-1-1, E.A.S. and W.E.A, essentially 100% use of those systems is 
for local disasters and emergencies. It makes sense for some national 
consistency for things like stop signs and emergency alerts and 9-1-1. 
People travel and work in other cities, and aren't ready for lots of local 
variations during emergencies.


Since 2011, EAS and WEA has been used for 33,000 local weather alerts and 
local emergencies and only 4 national tests (4 for EAS and 1 for WEA). 
FEMA only has about 15 people to maintain its national warning system 
24/7/365.


Giving the lack of disaster funding, you are more likely NOT to get any
warnings during a disaster than ever seeing any black helicopters flying 
over your house.


Alexa won't say a word.


Re: bloomberg on supermicro: sky is falling

2018-10-08 Thread Daniel Taylor
The risks of VPN aren't in the VPN itself, they are in the continuous 
network connection architecture.


90%+ of VPN interconnects could be handled cleanly, safely, and reliably 
using HTTPS, without having to get internal network administration 
involved at all.
And the risks of key exposure with HTTPS are exactly the same as the 
risks of having one end or the other of your VPN compromised.


As it is, VPN means trusting the network admins at your peer company.

On 10/08/2018 12:15 PM, valdis.kletni...@vt.edu wrote:

On Mon, 08 Oct 2018 08:53:55 -0500, Daniel Taylor said:

Especially when you have companies out there that consider VPN a
reasonable way to handle secure data transfer cross-connects with
vendors or clients.

At some point, you get to balance any inherent security problems with the
concept of using a VPN against the fact that while most VPN software has a
reasonably robust point-n-drool interface to configure, most VPN alternatives
are very much "some assembly required".

Which is more likely?  That some state-level actor finds a hole in your VPN
software, or that somebody mis-configures your VPN alternative so it leaks keys
and data all over the place?





Re: bloomberg on supermicro: sky is falling

2018-10-08 Thread valdis . kletnieks
On Mon, 08 Oct 2018 08:53:55 -0500, Daniel Taylor said:
> Especially when you have companies out there that consider VPN a
> reasonable way to handle secure data transfer cross-connects with
> vendors or clients.

At some point, you get to balance any inherent security problems with the
concept of using a VPN against the fact that while most VPN software has a
reasonably robust point-n-drool interface to configure, most VPN alternatives
are very much "some assembly required".

Which is more likely?  That some state-level actor finds a hole in your VPN
software, or that somebody mis-configures your VPN alternative so it leaks keys
and data all over the place?


pgpgfWgi58nGW.pgp
Description: PGP signature


Re: bloomberg on supermicro: sky is falling

2018-10-08 Thread Daniel Taylor

That would be one way, but a lot of the problem is unplanned cross-access.

It's (relatively) easy to isolate network permissions and access at a 
single location, but once you have multi-site configurations it gets 
more complex.


Especially when you have companies out there that consider VPN a 
reasonable way to handle secure data transfer cross-connects with 
vendors or clients.



On 10/07/2018 10:53 PM, Naslund, Steve wrote:

You just need to fire any contractor that allows a server with sensitive data 
out to an unknown address on the Internet.  Security 101.

Steven Naslund


From: Eric Kuhnke 


  >many contractors *do* have sensitive data on their networks with a gateway 
out to the public Internet.


--
Daniel Taylor  VP OperationsVocal Laboratories, Inc.
dtay...@vocalabs.com   http://www.vocalabs.com/(612)235-5711