<?xml version="1.0" encoding="utf-8"?><feed xmlns="http://www.w3.org/2005/Atom" ><generator uri="https://jekyllrb.com/" version="4.3.1">Jekyll</generator><link href="https://www.zagaja.com/feed.xml" rel="self" type="application/atom+xml" /><link href="https://www.zagaja.com/" rel="alternate" type="text/html" /><updated>2025-08-18T14:08:49+00:00</updated><id>https://www.zagaja.com/feed.xml</id><title type="html">Zagaja.com</title><subtitle>Matt Zagaja&apos;s personal blog. Musings on politics, technology, and other geeky things.</subtitle><author><name>{&quot;twitter&quot;=&gt;&quot;mzagaja&quot;}</name></author><entry><title type="html">Ray-Ban Meta AI Glasses Review</title><link href="https://www.zagaja.com/2025/05/ray-ban-meta-ai-glasses-review/" rel="alternate" type="text/html" title="Ray-Ban Meta AI Glasses Review" /><published>2025-05-24T00:00:00+00:00</published><updated>2025-05-24T00:00:00+00:00</updated><id>https://www.zagaja.com/2025/05/ray-ban-meta-ai-glasses-review</id><content type="html" xml:base="https://www.zagaja.com/2025/05/ray-ban-meta-ai-glasses-review/"><![CDATA[<p>A couple weeks ago I donned my Ray-Ban Meta AI Glasses and glimpsed the future. Heavier and bulkier than my typical Warby Parker spectacles, but able to pass for typical Wayfarer sunglasses. They are imperfect, but they are the first pair of smart glasses worth owning.</p>

<p>It is important to compare wearing the Ray-Ban metas with regular glasses as an all day glasses wearer. While they do look like regular Wayfarer sunglasses they sit larger and bulkier than the “New Wayfarer” style that I have been used to wearing. When I switch back to my everyday Warby Parker glasses I find my face feeling a little bit of relief, even if I do not notice the weight while I’m wearing the Meta glasses. ￼The prescription lens quality is optically fantastic as ordered direct from the Ray-Ban website. I do not think these are perfect as your only glasses but I find myself happy wearing them a lot more than I expected.</p>

<p>A big question with the cost of the frame being so high is whether it’s worth investing in Transitions lenses, or buying one or two pairs with clear and/or tinted lenses. I tried Transitions for the first time with these and have come away impressed. The latest generation changes tint quickly and in bright sunlight is sufficiently dark that I do not miss regular sunglasses. The only downside is the tint barely activates in cars due to their UV shielded glass. Allegedly the Xtractive line resolves this issue at the cost of maintaining a slight tint indoors, a trade off I did not want to make. The regular Transitions stay perfectly clear inside. I am happy with my choice here.</p>

<p>The camera is not amazing but it is good enough. Photos are usually clear at close and medium range, and Meta will smart crop them to account for the angle your head is at to make them look normal. Videos are a bit better than the photos. Even when you shake your head the stabilization of the video (presumably software based) is decent. Being able to quickly get first person perspective photos means you do not miss shots you might otherwise not take.</p>

<p>Meta AI is ironically the thing I find myself using the least. While the conversational aspect feels significantly more natural than speaking with Siri, Meta AI suffers from being disconnected. It cannot search the web for answers. There are no connections to have it interact with my smart home devices via HomeKit. It has a reminders system that is separate from the Apple app. The future will not arrive until Meta and Apple build bridges instead of walls between their ecosystems.</p>

<p>The stand out feature is the shockingly clear speakers. While audio is not as detailed as my AirPods Pro, it is more than sufficient for phone calls, gaming, and podcasts, and passable for casual music listening. It has been an incredible convenience to not have to take my AirPods Pro in and out of my ears while wearing these. While transparency mode for AirPods is nice, I feel less isolated from the world without AirPods in my ears. Less need to fumble with the AirPods means I find myself listening to podcasts in situations that I would normally go without. There is some sound leakage to the outside world, but its not noticeable at lower volume levels.</p>

<p>The achilles heel is the half-day battery life. If you leave the house for an extended period of time you will have to bring your charging case if you plan to use the smart features later in the day. You can continue using these as regular eyeglasses once the batteries die, but it defeats the point. Most people will not be satisfied with these as their only pair of eyeglasses. IPX4 water resistance means you should leave them home when riding water rides or swimming at the pool.</p>

<p>A few weeks with these has shown me that smart glasses will be a part of our future. Google recently announced a line of their smart glasses and Apple is allegedly developing their own pair due to be released in 2026. As better battery and further miniaturization of electronics arrives, more exciting frame options should follow. If you are an early adopter you will enjoy the Ray-Ban Meta AI Glasses today, but we are a few years out from this product category truly maturing.</p>]]></content><author><name>{&quot;twitter&quot;=&gt;&quot;mzagaja&quot;}</name></author><summary type="html"><![CDATA[A couple weeks ago I donned my Ray-Ban Meta AI Glasses and glimpsed the future. Heavier and bulkier than my typical Warby Parker spectacles, but able to pass for typical Wayfarer sunglasses. They are imperfect, but they are the first pair of smart glasses worth owning.]]></summary></entry><entry><title type="html">Lessons from a Second Trump Victory</title><link href="https://www.zagaja.com/2024/11/lessons-second-trump-victory/" rel="alternate" type="text/html" title="Lessons from a Second Trump Victory" /><published>2024-11-09T00:00:00+00:00</published><updated>2024-11-09T00:00:00+00:00</updated><id>https://www.zagaja.com/2024/11/lessons-second-trump-victory</id><content type="html" xml:base="https://www.zagaja.com/2024/11/lessons-second-trump-victory/"><![CDATA[<p>“I feel like I am walking on eggshells.”</p>

<p>This is feedback I got from an employee at a place I used to work when they left. The culture at this place was incredibly progressive. Filled with wonderful well meaning folks trying to marry their careers to their purpose. This person’s heart matched the mission of where they were, but the culture kept them from feeling included. A place where failing to master new lingo could be a micro-aggression and disagreeing with others could be a crises. In the 80s progressivism was punk rock — raw, accessible, and focused on empowering ordinary people. In 2024 it has become avant-garde jazz — technically sophisticated but focused on complex terminology and impressing insiders.</p>

<p>While progressives can stand to be kinder in their culture they can also stand to be more machiavellian in their politics. Bad faith claims around Obama’s birth, Kamala Harris’ race, and the integrity of elections proliferated against Democratic candidates. Our failure to master information warfare is knee-capped by an allergy to hyperbole. Meanwhile when holding power in Congress Democrats have been too trigger shy to eliminate the filibuster. We could not get our heads out of asses to expand the Supreme Court after Merrick Garland was denied a seat. We need a gentler heart in our community and a sharper edge in our tactics.</p>

<p>If Democrats want to fight they need to learn to land punches as well as they take them. Republican rhetoric manages to knock down Democrats while raising themselves up: “liberal crybaby” implies the target is dramatic and the critic is levelheaded. When progressives lob criticisms weird is a soft jab where stupid would be a strong blow. Trump has shown us the electorate does not see this kind of language as mean, but as authentic. We would be remiss to ignore this lesson.</p>

<p>The key is to punch up, not punch down. Instead of unleashing our sharpest knives on our family or neighbors we should save them for the politicians and billionaires that tell us our enemies are down the street instead of up in the penthouse. Save your patience for your colleague trying to navigate a changing world and save your fire for the con men that profit off of the fears and struggles of working Americans.</p>

<p>Democrats and progressives also came off in the past year as caring more about the Middle East than Middle America. Voters have limited time and attention. As heartbreaking as the situation in Gaza is, most folks do not see it as pressing as the issues here at home.<sup id="fnref:1" role="doc-noteref"><a href="#fn:1" class="footnote" rel="footnote">1</a></sup> Wasting oxygen on issues that divide us inevitably hurts our efforts, especially when we can unite behind causes that matter like ending hunger and homelessness.</p>

<p>The path forward requires both humility and boldness. Progressives must rebuild a movement that speaks to ordinary Americans in plain language about the issues that affect their daily lives. This means creating spaces where people can engage without fear of missteps, while still advancing justice and equality. It also means fighting harder and smarter, using the full range of political tools available to us when we are in power.</p>

<div class="footnotes" role="doc-endnotes">
  <ol>
    <li id="fn:1" role="doc-endnote">
      <p><a href="https://publicwise.org/publication/war-in-gaza-voter-insights-2024/">According to PublicWise only 2% of voters were planning to cast a vote based on the situation in Gaza</a>. <a href="#fnref:1" class="reversefootnote" role="doc-backlink">&#8617;</a></p>
    </li>
  </ol>
</div>]]></content><author><name>{&quot;twitter&quot;=&gt;&quot;mzagaja&quot;}</name></author><summary type="html"><![CDATA[“I feel like I am walking on eggshells.”]]></summary></entry><entry><title type="html">Yubikey is the Digital Seat Belt We Need Today</title><link href="https://www.zagaja.com/2024/09/yubikey-digital-seatbelt/" rel="alternate" type="text/html" title="Yubikey is the Digital Seat Belt We Need Today" /><published>2024-09-02T00:00:00+00:00</published><updated>2024-09-02T00:00:00+00:00</updated><id>https://www.zagaja.com/2024/09/yubikey-digital-seatbelt</id><content type="html" xml:base="https://www.zagaja.com/2024/09/yubikey-digital-seatbelt/"><![CDATA[<p>Another day another breach. Yesterday I got a notice in my mailbox that Ticketmaster was compromised and my data was once again in the hands of hackers. Like you I have grown numb to these notices. The private sector is content to lull us into complacency when it comes to security. They tell us buying mediocre solutions like Crowdstrike are the answer while ignoring hardware security keys that can protect accounts from phishing. Here in Massachusetts we know better and it’s time we make corporations do better.</p>

<p>Hardware security keys are small devices that plug into a computer or smart phone and provide a strong physical form of two-factor authentication. This technology is proven, and widely supported by Apple, Google, and Microsoft. Unlike software based solutions they are virtually impervious to phishing attacks and remote hacking attempts. Yet despite their effectiveness companies resist using them due to perceived inconvenience or cost.</p>

<p>The Massachusetts Attorney General’s office should begin investigating companies in critical sectors like healthcare and finance and inventory whether they use hardware security keys. Some gentle prodding might be sufficient to spur action by some, but others may require a more direct approach. Using their authority under 93A the Attorney General’s office should make clear that failing to secure sensitive data and systems with hardware security keys are an unfair or deceptive trade practice.</p>

<p>Next session the Massachusetts legislature should take this further by codifying the requirement that critical systems be protected with hardware security keys. The Commonwealth can lead by example with rules for its own systems, along with future software procurements. Extra penalties and enhanced damage awards should be codified for breaches that could have been prevented by hardware security keys but were not. These penalties should escalate annually so they grow from a nudge to a bludgeon over three years. Let us pass an audacious bill that puts hackers and scammers on notice that their era of easy money is over.</p>

<p>When seatbelts were first introduced, many viewed them as unnecessary. When airbags came along, they argued they were too costly. Today we cannot imagine driving a car without these life saving innovations. The free market is great at a lot of things, but mandating its own conscience is not one of them. It is past time for our state government to bridge the gap between the private sector’s innovation and its adoption of security technology.</p>]]></content><author><name>{&quot;twitter&quot;=&gt;&quot;mzagaja&quot;}</name></author><summary type="html"><![CDATA[Another day another breach. Yesterday I got a notice in my mailbox that Ticketmaster was compromised and my data was once again in the hands of hackers. Like you I have grown numb to these notices. The private sector is content to lull us into complacency when it comes to security. They tell us buying mediocre solutions like Crowdstrike are the answer while ignoring hardware security keys that can protect accounts from phishing. Here in Massachusetts we know better and it’s time we make corporations do better.]]></summary></entry><entry><title type="html">Pretty Good House Exposes the Gaps Between Mainstream Building and Building Science</title><link href="https://www.zagaja.com/2024/08/pretty-good-house/" rel="alternate" type="text/html" title="Pretty Good House Exposes the Gaps Between Mainstream Building and Building Science" /><published>2024-08-09T00:00:00+00:00</published><updated>2024-08-09T00:00:00+00:00</updated><id>https://www.zagaja.com/2024/08/pretty-good-house</id><content type="html" xml:base="https://www.zagaja.com/2024/08/pretty-good-house/"><![CDATA[<p><a href="https://www.prettygoodhouse.org">Pretty Good House</a> is a <a href="https://www.amazon.com/Pretty-Good-House-Michael-Maines/dp/1641551658/ref=sr_1_1?crid=1NLKOH867G55H&amp;dib=eyJ2IjoiMSJ9.2oF8TeXsc4nLcl5hMUyVt0ruvxge3T4iRP7hkEu7fdcO96sURC9WzRSwVW1GaLMtGe_QhVf7M3Pbr8f6b97baU8f82KU6IbqLTIEh7HhUyJzoyzq7Zlhi7tGc7Q0gqNdJ050daodSSP4xjmwd3QiTi5lmCqgyoG3nejO_3ENHqdZgyF_fXePNbMo9TEy2O7gvA1S_CezgCxfN1iQkmVOZhvnxihkkZQNtv_npZ2j7T0.-6ll-GgCs0YZsiHg0MdgvBdVJ-Ogmd5rC-bXKUtSy08&amp;dib_tag=se&amp;keywords=pretty+good+house+book&amp;qid=1723207780&amp;sprefix=pretty+good+house%2Caps%2C92&amp;sr=8-1">book</a> born of a podcast about building science. The authors, experts in building science, walk you through ideas and considerations in creating a house that is environmentally friendly and functional for its occupants. I walked away from reading it with a better understanding of home design and building considerations, and an even greater sense that these have not propagated into the mainstream trades.</p>

<h3 id="why-it-matters">Why It Matters</h3>
<p>Understanding the methods and considerations that go into designing a well built home gives you insight into issues you might not have been able to previously articulate or see in your own home. As someone who bought a condo it also is nice to have a sense of what a forever home might have or look like compared to what is available on the market. Finally the fact that so few of these ideas in the book match what is happening with renovations around my neighborhood makes me question how much thought the local builders have put into these issues.</p>

<h3 id="the-authors-hate-plastic">The Authors Hate Plastic</h3>
<p>One thing that stood is out is the authors of the book hate plastic products. Although better than it was, vinyl siding will never look as good as wood or fiber board to me. However I will disagree with them on the use of things like Trex, which uses recycled plastic and is less maintenance than a straight wood deck.</p>

<h3 id="what-i-am-seeing">What I am Seeing</h3>
<ul>
  <li>ZIP system exteriors and a slightly tighter building envelope are common, but not tested.</li>
  <li>Builders love vinyl and plastic components.</li>
  <li>The ductless heat pump systems favored by the authors combined with HRV or ERVs are not present in almost any build I see.</li>
  <li>Although blown in cellulose is more environmentally friendly, I see a ton of Facebook posts with folks using spray foam.</li>
</ul>]]></content><author><name>{&quot;twitter&quot;=&gt;&quot;mzagaja&quot;}</name></author><summary type="html"><![CDATA[Pretty Good House is a book born of a podcast about building science. The authors, experts in building science, walk you through ideas and considerations in creating a house that is environmentally friendly and functional for its occupants. I walked away from reading it with a better understanding of home design and building considerations, and an even greater sense that these have not propagated into the mainstream trades.]]></summary></entry><entry><title type="html">Chrome Enterprise is the Security Industry’s Latest Fraudware</title><link href="https://www.zagaja.com/2024/08/google-chrome-enterprise-security-fraudware/" rel="alternate" type="text/html" title="Chrome Enterprise is the Security Industry’s Latest Fraudware" /><published>2024-08-07T00:00:00+00:00</published><updated>2024-08-07T00:00:00+00:00</updated><id>https://www.zagaja.com/2024/08/google-chrome-enterprise-security-fraudware</id><content type="html" xml:base="https://www.zagaja.com/2024/08/google-chrome-enterprise-security-fraudware/"><![CDATA[<p>After losing its antitrust case in federal court this week Google is throwing money at a tech sector that is immune to facts and scrutiny: cybersecurity. On today’s The Daily they advertised <a href="https://chromeenterprise.google">Chrome Enterprise</a>, a version of Chrome for business customers designed to be secure, because apparently the regular Chrome they ship for consumers is not. For $6 per user per month you can tell your boss that you have paid for security for your enterprise users and pretend to be smarter than the dolts that just downloaded the regular free version of Chrome.</p>

<h3 id="why-it-matters">Why It Matters</h3>
<p>It seems odd that the security industry and its approach to protecting users and its data is not under scrutiny after the Crowdstrike incident. The no blame postmortem has wilted into a no accountability box checking exercise. The amount of security hoops to jump through seems to grow every year, but so do the <a href="https://www.idtheftcenter.org/post/2023-annual-data-breach-report-reveals-record-number-of-compromises-72-percent-increase-over-previous-high/">number of breaches</a>. We cannot keep paying more for failure.</p>

<h3 id="you-have-to-trust-someone">You Have to Trust Someone</h3>
<p>Whole classes of security software duplicate functionality provided by other software or hook in to monitor it. If Windows and MacOS have built-in anti-malware tools, why does your browser also need that? Is Crowdstrike really going to be better at identifying threats than Microsoft? If you’re going to deploy restrictions on software users can install, what level of scrutiny is sufficient for approval? Did you read the source code? Did you read the source code for the dependent libraries? In a zero trust environment should a browser extension really be a threatening attack vector?</p>

<h3 id="secure-by-default">Secure by Default</h3>
<p>When corporations buy automobiles, they do not buy special versions that have different locks and immobilizers than what the general public buys. Yet for some reason folks think corporations need special versions of software to be secure. The fact that Google touts a secure version of Chrome implies that the regular version is not secure. Yet there is no special reason they could not simply integrate the secure settings and features into their main version.</p>]]></content><author><name>{&quot;twitter&quot;=&gt;&quot;mzagaja&quot;}</name></author><summary type="html"><![CDATA[After losing its antitrust case in federal court this week Google is throwing money at a tech sector that is immune to facts and scrutiny: cybersecurity. On today’s The Daily they advertised Chrome Enterprise, a version of Chrome for business customers designed to be secure, because apparently the regular Chrome they ship for consumers is not. For $6 per user per month you can tell your boss that you have paid for security for your enterprise users and pretend to be smarter than the dolts that just downloaded the regular free version of Chrome.]]></summary></entry><entry><title type="html">The Algebra of Wealth</title><link href="https://www.zagaja.com/2024/07/the-algebra-of-wealth/" rel="alternate" type="text/html" title="The Algebra of Wealth" /><published>2024-07-28T00:00:00+00:00</published><updated>2024-07-28T00:00:00+00:00</updated><id>https://www.zagaja.com/2024/07/the-algebra-of-wealth</id><content type="html" xml:base="https://www.zagaja.com/2024/07/the-algebra-of-wealth/"><![CDATA[<p>I just finished reading Scott Galloway’s <a href="https://www.amazon.com/Algebra-Wealth-Formula-Financial-Security/dp/0593714024">The Algebra of Wealth</a>. Galloway provides a well written tour of basic financial concepts for folks that might not be familiar with how to save, invest, and make choices about their careers. For folks like me who have their finances under control the content can feel like review, but Galloway has a gift for writing in an enjoyable and accessible manner. This is a great gift for a recent college graduate.</p>

<h3 id="why-it-matters">Why It Matters</h3>
<p>Galloway’s sobering advice comes off as a bit contrarian to the kinds of things you might hear in a college graduation speech. Where folks might advise “follow your passion” Galloway makes a case for trying to accumulate the wealth you need to live the life you want to live. If starving artist does not suit you, Galloway’s advice might resonate.</p>

<h3 id="lessons-from-dad">Lessons from Dad</h3>
<p>When I was younger my father kept telling me to put money into an IRA. Even when I was not making much and found it to be a stretch. Dad knew, just as Galloway points out, that it’s good to get into the habit of saving. Combined with the magic of compound interest, you have a foundation for a financially secure future.</p>

<h3 id="the-importance-of-time">The Importance of Time</h3>
<p>Galloway spends some detours ruminating on his decision to buy and maintain a private jet. This isn’t a normal person problem, but through it he explains that it is worth buying your time back. You can always make more money, but everyone gets the same 24 hours in the day. Do not waste it sitting in lines if you do not have to.</p>]]></content><author><name>{&quot;twitter&quot;=&gt;&quot;mzagaja&quot;}</name></author><summary type="html"><![CDATA[I just finished reading Scott Galloway’s The Algebra of Wealth. Galloway provides a well written tour of basic financial concepts for folks that might not be familiar with how to save, invest, and make choices about their careers. For folks like me who have their finances under control the content can feel like review, but Galloway has a gift for writing in an enjoyable and accessible manner. This is a great gift for a recent college graduate.]]></summary></entry><entry><title type="html">Posting to GitHub Pages with iA Writer on iPad</title><link href="https://www.zagaja.com/2024/07/ia-writer-ipad-apple-shortcuts/" rel="alternate" type="text/html" title="Posting to GitHub Pages with iA Writer on iPad" /><published>2024-07-24T00:00:00+00:00</published><updated>2024-07-24T00:00:00+00:00</updated><id>https://www.zagaja.com/2024/07/ia-writer-ipad-apple-shortcuts</id><content type="html" xml:base="https://www.zagaja.com/2024/07/ia-writer-ipad-apple-shortcuts/"><![CDATA[<p>A few weeks ago I got an iPad Air. I love using this including writing my blog posts on it, but did not have an easy way to post to my blog, which uses a programmer centric site generator called <a href="https://www.jekyllrb.com/">Jekyll</a> to create the HTML that is then hosted on GitHub Pages. It turns out using the GitHub API and Apple Shortcuts this problem was not hard to solve.</p>

<h3 id="why-it-matters">Why It Matters</h3>
<p>If you want to do some one off convenience scripting on iPadOS Apple Shortcuts bridges the gap between the more simple operating system and some of the advanced things software engineers would want to do. Shortcuts gives you a way to automate the boring stuff.</p>

<h3 id="the-downers">The Downers</h3>
<ul>
  <li>Shortcuts feels buggy, dragging and dropping actions does not easily let me order them and would often just place the action I am trying to move on the top of the stack.</li>
  <li>Debugging information is not easily available for every action.</li>
  <li>Trying to use Anthropic’s Claude to guide me in quickly developing the shortcut fell on its face when it gave me the wrong HTTP verb for GitHub’s API. It then failed to identify this issue when I gave it a screenshot of my shortcut.</li>
</ul>

<h3 id="bonus-downer">Bonus Downer</h3>
<ul>
  <li>The “copy text in Markdown” action misses the YAML front matter. I’ll need to find a fix for that.</li>
</ul>]]></content><author><name>{&quot;twitter&quot;=&gt;&quot;mzagaja&quot;}</name></author><summary type="html"><![CDATA[A few weeks ago I got an iPad Air. I love using this including writing my blog posts on it, but did not have an easy way to post to my blog, which uses a programmer centric site generator called Jekyll to create the HTML that is then hosted on GitHub Pages. It turns out using the GitHub API and Apple Shortcuts this problem was not hard to solve.]]></summary></entry><entry><title type="html">Lessons from Crowdstrike</title><link href="https://www.zagaja.com/2024/07/lessons-from-crowdstrike/" rel="alternate" type="text/html" title="Lessons from Crowdstrike" /><published>2024-07-22T00:00:00+00:00</published><updated>2024-07-22T00:00:00+00:00</updated><id>https://www.zagaja.com/2024/07/lessons-from-crowdstrike</id><content type="html" xml:base="https://www.zagaja.com/2024/07/lessons-from-crowdstrike/"><![CDATA[<p>As I sat in our hospital room with my wife and newborn son, I was a little bit trapped. The computer the nurses had been using now displayed an error message. Our morning nurse came by and asked for whatever paper records they had left in my son’s bassinet. Our hoped for early discharge was waylaid not by a foreign actor or expert saboteur but by the very software meant to protect the hospital from these threats. Straight out of the 80s the backup discharge plan involved our doctor painstakingly hand scribing our son’s medical record. So much time had been spent trying to prevent disaster yet not nearly enough time and effort had been spent planning to recover from it.</p>

<h3 id="why-it-matters">Why It Matters</h3>
<p>Sometimes your defenses fail. Or in this case you fall victim to friendly fire. The faster you can recover from failure the less painful it is.</p>

<h3 id="some-things-to-consider">Some Things to Consider</h3>
<ul>
  <li>Rather than using a single vendor for computers and software, larger organizations, especially those with mission critical functions, should diversify their pool and engage multiple software tools for the same function. If one fails then it makes it easier to shift resources to the other one(s).</li>
  <li>When engaging vendors companies should require they provide data in standard formats and have standard APIs. This way if one vendor fails you can more easily recover migrate to the next.</li>
  <li>Organizations should run recovery drills where they rebuild their infrastructure from scratch using their backups. They should be required to report their “time to live” from when they start the process. Simply put: if an incident destroys a company infrastructure we should know  how long it will take them to recover.</li>
</ul>

<h3 id="a-digital-services-reserve">A Digital Services Reserve</h3>
<p>When natural disaster strikes in the United States, FEMA comes in and helps manage the situation. When a major technical incident occurs we need to a government agency that can swoop in and help. By establishing a Digital Services Reserve we can have experts at the ready to do things like manually update lots of computers or dissect otherwise inscrutable technical problems. If government can provide a surge of help, hospitals, banks, and other critical organizations will more quickly be able to recover.</p>]]></content><author><name>{&quot;twitter&quot;=&gt;&quot;mzagaja&quot;}</name></author><summary type="html"><![CDATA[As I sat in our hospital room with my wife and newborn son, I was a little bit trapped. The computer the nurses had been using now displayed an error message. Our morning nurse came by and asked for whatever paper records they had left in my son’s bassinet. Our hoped for early discharge was waylaid not by a foreign actor or expert saboteur but by the very software meant to protect the hospital from these threats. Straight out of the 80s the backup discharge plan involved our doctor painstakingly hand scribing our son’s medical record. So much time had been spent trying to prevent disaster yet not nearly enough time and effort had been spent planning to recover from it.]]></summary></entry><entry><title type="html">Christmas Tree Projects in Government</title><link href="https://www.zagaja.com/2024/07/christmas-tree-projects/" rel="alternate" type="text/html" title="Christmas Tree Projects in Government" /><published>2024-07-10T00:00:00+00:00</published><updated>2024-07-10T00:00:00+00:00</updated><id>https://www.zagaja.com/2024/07/christmas-tree-projects</id><content type="html" xml:base="https://www.zagaja.com/2024/07/christmas-tree-projects/"><![CDATA[<p>Yesterday the <a href="https://www.mbta.com/news/2024-07-09/new-ways-pay-mbta-announces-contactless-payments-accepted-onboard-buses-green-line?utm_term=subway&amp;utm_campaign=curated-content&amp;utm_content=New+Ways+to+Pay%3A+MBTA+Announces+Contactless+Payments+Accepted+Onboard+Buses%2C+Green+Line+Trolleys%2C+Mattapan+Line+Trolleys%2C+and+at+Subway+Fare+Gates+Starting+August+1&amp;utm_medium=news&amp;utm_source=homepage">MBTA announced that come August 1st they will finally accept contactless payments from credit cards and smart phones</a>. This project took over <a href="https://www.bostonglobe.com/2024/07/09/metro/no-charlie-card-needed-on-mbta-bus-subway-august-1/?p1=BGSearch_Overlay_Results">six years and billion dollars</a>. The retrospectives and reports will no doubt show the money was used in useful or productive ways, or wasted with a vendor who is blamed for the mistakes. Nobody will be held accountable for prospectively putting together a project with a budget so large it was doomed from the start. The only reason it had to take six years is it can be a challenge to spend a billion dollars in a single year.</p>

<p>When I experienced projects like this working in government I realized they are Christmas trees. An idea arrives with an over-sized budget so mid-level managers see the opportunity to decorate them with their own ideas, dreams, and aspirations. The simple idea or directive from the top becomes lost. The project morphs into a death march as scope explodes and number of objectives becomes insurmountable. The lesson we learned from healthcare.gov is the only way to tame this kind of beast is a directive from the top with people smart enough to see the whole system that are empowered to make hard choices.</p>]]></content><author><name>{&quot;twitter&quot;=&gt;&quot;mzagaja&quot;}</name></author><summary type="html"><![CDATA[Yesterday the MBTA announced that come August 1st they will finally accept contactless payments from credit cards and smart phones. This project took over six years and billion dollars. The retrospectives and reports will no doubt show the money was used in useful or productive ways, or wasted with a vendor who is blamed for the mistakes. Nobody will be held accountable for prospectively putting together a project with a budget so large it was doomed from the start. The only reason it had to take six years is it can be a challenge to spend a billion dollars in a single year.]]></summary></entry><entry><title type="html">Security Redux</title><link href="https://www.zagaja.com/2024/07/security-redux/" rel="alternate" type="text/html" title="Security Redux" /><published>2024-07-07T00:00:00+00:00</published><updated>2024-07-07T00:00:00+00:00</updated><id>https://www.zagaja.com/2024/07/security-redux</id><content type="html" xml:base="https://www.zagaja.com/2024/07/security-redux/"><![CDATA[<p>Yesterday Vanguard, despite having two security keys enabled with their account, randomly forced me to enable a less secure factor on my account with them. Later that day Facebook would not let me login using the “Security Key” button on their iPad app and instead required me to approve my login using another logged in Facebook instance from my mobile phone. Even these large allegedly smart companies fail a basic security maxim that any method that is less secure than your most secure factor lowers the security of your account and opens a new attack vector.</p>

<h3 id="the-problem-with-security-policies-and-consultants">The Problem with Security Policies and Consultants</h3>
<p>Security is treated as a compliance function and as a result rules are made and audited by non-technical experts. While they may develop expertise in their rules and general concepts, they do not have a full understanding of the systems they are securing and how the security mechanisms work. Additionally it is tough to argue against frivolous measures and poor implementations when the other side can frame you as being against security. This is rarely a good place to be.</p>

<h3 id="this-week-in-breaches">This Week in Breaches</h3>
<ul>
  <li><a href="https://www.nytimes.com/2024/07/04/technology/openai-hack.html?unlocked_article_code=1.5U0.8KjB.4lT1WNdM5mmx&amp;smid=url-share">A Hacker Stole Secrets from OpenAI</a></li>
  <li><a href="https://www.theverge.com/2024/7/3/24191791/twilio-authy-2fa-app-phone-numbers-hack-data-breach">Twilio leaked phone numbers linked to its 2FA system Authy</a>.</li>
  <li><a href="https://www.schneier.com/blog/archives/2024/07/new-open-ssh-vulnerability.html">A new OpenSSH vulnerability was discovered</a>.</li>
</ul>]]></content><author><name>{&quot;twitter&quot;=&gt;&quot;mzagaja&quot;}</name></author><summary type="html"><![CDATA[Yesterday Vanguard, despite having two security keys enabled with their account, randomly forced me to enable a less secure factor on my account with them. Later that day Facebook would not let me login using the “Security Key” button on their iPad app and instead required me to approve my login using another logged in Facebook instance from my mobile phone. Even these large allegedly smart companies fail a basic security maxim that any method that is less secure than your most secure factor lowers the security of your account and opens a new attack vector.]]></summary></entry></feed>