Tech News and Issues

From the aboriginal Australians to the Zuni people, human civilizations have celebrated the winter solstice for as long as we’ve comprehended the seasons. It is a time for optimism, hope, miracles, and light. Even before we understood the solar system, we knew the basics: at a certain point, less sun gives way to more. These days, we’ve figured out a lot more about our place in the universe, but that doesn’t make this moment any less special. Humans look up, and forward; it’s who we are.

This morning’s launch of the James Webb Space Telescope got me thinking about where we’re at as a species. We live in an age of wonders, but it doesn’t always feel that way. For better and worse, we’ve atomized; we don’t have as many universals as we used to; sometimes it seems like solstice celebrations are one of the few things we have in common any more. We’ve broken down a lot of old structures and sources of meaning, which has been great for a lot of people, but we sort of forgot to replace them with anything. People report having fewer friends than they used to. Deaths of despair have skyrocketed in this country, and lots of people feel lonely and isolated, a situation that the last two years have not improved. Maybe it’s all a big coincidence that we’ve forgotten how to talk to each other, but I’m not so sure. People need communities and shared goals and things bigger than themselves.

Which brings me back to thinking about that telescope, about the thousands of people who worked together for decades to build a device which, if it works, might revolutionize our understanding of reality. If we want to find meaning in something, work together, and better ourselves, we could do worse than focusing on space. It’s how we will press forward with figuring out what the universe is; it’s how we will defend our planet from species-destroying asteroids; it’s how we will find extraplanetary life. These represent big tasks and big questions. Space exploration is broadly popular, too, and it’s not even that expensive, in the grand scheme of things–the James Webb telescope only cost $10 billion.

There’s something deeply humbling about cosmology and space exploration; something awesome, in the old sense of the term. They inspire feelings in me that a less atheistic person might find in religion. Carl Sagan had it right when he convinced NASA to turn Voyager 1 around and take one last picture: Astronomy is a humbling and character-building experience. There is perhaps no better demonstration of the folly of human conceits than this distant image of our tiny world. To me, it underscores our responsibility to deal more kindly with one another, and to preserve and cherish the pale blue dot, the only home we’ve ever known.

So I guess my message on the darkest week of the year is: there are worse directions to look than up!

Happy launch day to all who celebrate.

Looking Up And ForwardPost + Comments (41)

Late last week, the engineering team at Alibaba announced that they’d found a major vulnerability in a widely used software library. The library is called log4j, the vulnerability is named log4shell, and it has the potential to be very bad. With a lot of luck, you won’t see it all over the news, but in the event that you do, here’s a quick primer. Wired has a good longer piece, from which I stole this post title.

Do I have to worry about log4j?

Not in so many words. Unless you’re a systems administrator, you probably aren’t running a (particularly) vulnerable machine, so there’s nothing you can do anyway. See a movie; hug your children.

How does it work?

log4j is logging software, that is, it writes down information about a running program so that developers can see how it’s working (or not working). Sometimes, when it sees a certain string, it says, “oh okay, let’s download a file from this arbitrary location and execute it.” An attacker, with fairly basic knowledge of what kind of computer they’re attacking, can use this to take control of the whole system*, just by saying hello over the internet. And log4j is used in many, many systems, systems where the admins might not even know about it, because it’s buried under a bunch of other software libraries. The little guy on the bottom right of the cartoon? Sometimes that’s log4j**.

Sounds bad!

It is! It’s worse than 2014’s Heartbleed, which resulted in the theft of, conservatively, tens of millions of identities. At the time, Heartbleed was widely considered to be the worst vulnerability ever found in the modern Internet. This distinction now belongs to log4shell. And just like with Heartbleed, there is probably nothing you, personally, can do about it.

How bad?

Above, I said that the attacker needs to have ‘fairly basic’ knowledge of the computer they’re attacking. This is because computers can’t execute any old arbitrary code–it has to be a Java binary written for the correct version of the Java Runtime Environment. This means that viral spread will be limited, at least until somebody figures out a way around this, which may happen in a matter of days. And if that happens… lots of very important computers will find themselves under the control of hackers.

Welp.

Yep.

Open thread!

*Or whatever sandbox Java may be limited to, if you’re lucky.

**log4j is maintained by the large Apache Software Foundation, but you get the idea.

‘The Internet Is On Fire’Post + Comments (133)