jack: (Default)
Community. Rewatched first two series. Got bored in series three. I think there was still a lot of good things after that, but I wasn't as excited by each episode.

Rewatching s1 of west wing. Still very good. See twitter for running commentary. It's strange that WW made so many things famous you can't look up if they're true or not, you just find they were in the WW.

When I was being excited by Natural History of Dragons #3, I forgot to say, they investigate translating an ancient syllabary language. made me think of rochvelleth :)

Watched Doctor Who "Veritas". Some things are tedious: that's not how computers work, and that's not how random numbers work. It's almost the opposite. But overall I enjoyed it quite a lot.

Read the latest wild cards. Weird that it just happens to be set in Taraz (Talas) in Kazakhstan when ghoti et al are visiting that country. Although it unfortunately doesn't include much actually specific to Kazakhstan.

There's so many things that are really interesting about the wild card books. Partly that lots of famous authors show up writing a really different style of thing to what they usually write, often more straightforwardly engaging. Partly that main characters in one story thread show up as minor characters in other story thread, and you get a good triangulation on them, how they think of themselves vs how different people see them -- often with no Word-of-God on which is more accurate.
jack: (Default)
http://cartesiandaemon.livejournal.com/1030046.html

OK, I'm going to assume everyone who wanted to think about the original problem unspoiled has probably done so, and assume comments have rot26 spoilers from here on.

Read more... )
jack: (Default)
OK, so before the bizarre misunderstandings in my previous post, I had been going to repost question which I thought was an interesting logic puzzle in its own right.

You have five bags of holding. One contains a fabulous treasure. Two contain liches who can't escape until you open the bag. Two contain nothing.

You have a spell which tells you something about the result of a course of action you propose. (This description is slightly altered from the functionality of the original spell to make the puzzle work, feel free to ask for clarification as needed.)

"Weal" for good result (eg. treasure, no liches)
"Woe" for bad result (eg. 1+ lich, no treasure)
"Weal and Woe" for a good and bad result (eg. treasure and also lich)
"Nothing" for a result of no particular good or bad (eg. open no bags or only open empty bags)

Puzzle

What's the minimum number of castings of the spell needed? (I think 3 is easy and 1 is impossible, so basically, can you do 2?)

Clarifications

The course of action has to be 30 minutes or less.

We don't have specifics on how you define the course of action, ask if it needs to be more explicit.

Assume you can include other results in the plan if they help, eg. "if this bad contains nothing, I stab myself in the leg", without necessarily needing to follow through. (This is slightly more generous than the original spell.)

Assume you don't include the castings of further divination spells within the scope of the course of action considered by casting the first spell.

Follow-ups (may be unnecessary depending on the best solution to the original)

If you only have one casting, what's the greatest chance you can give yourself of finding the treasure whilst finding no liches.

The original restrictions of the spell say that if you cast it four times in a day (ignored for the basic puzzle), the second, third and fourth times have a 25%, 50% and 75% chance of giving a random answer. What's the highest chance you can give yourself of finding the treasure and no liches in up to four castings with those failure chances.

Previously we assumed you couldn't create a paradox. If you *can*, and causing a paradox causes the spell to fail to give an answer in a way distinct from "nothing", can you reduce the number of castings?

If you *can* ask about a course of action including further divination spells, does that help?

Does the answer generalise to a larger number of bags (assuming 1 treasure, N liches and N nothing)

ETA: Fix formatting.
jack: (Default)
In several ways I enjoyed the second (African swamp dragons) and third (Sea Serpents, Chinese dragons of many sorts, and Polynesian firewyrms) more than the first. The main character is more proactive. We start to see more of the outline of her life. I found it a bit easier to cope with the alternate-history geography too, either because I was more used to it, or because it was further away from places I'm familiar with.

I like the bits of her son Jake we get. There's so few fantasy novels with children and adults together.

And I'm more familiar with the alternate world. Several things are different: the series is set later than I'd realised (1890s?) but steam power is severely curtailed by the lack of iron, taking the place of various resource-scrambles Europe imposed on the world in our history.

And I still can't believe I missed everyone is Jewish, temple judiasm or "magisterium" judaism, but with the varied devotion victorian scholars had for Christianity.

As I'm re-reading, I see more things alluded to in the early volumes, about her eventual discoveries, and the misadventures she gets into, and her later remarriage, that make me excited to know which of the things I've read tie into those and which are still to come.

Every book seems to wend its way until the plot starts about 3/4 of the way through, but the third one I was really wrapped up in all the things that happened until that point, the difficulties of navigating a ship, negotiating chinese bureaucracy to get to see dragons, befriending islanders, surviving storms, performing experiments.

I'm still a bit put off by the alternate-history names for countries. Couldn't we just use the same names even if the shapes are different? It seems like more places are islands? And it feels weird I can't just look it all up online and see what corresponds to what, but here no-one seems to have done the work. I should compile a list of what I managed to work out for my own reference.

Minor Spoilers )
jack: (Default)
I'm not going to get all of this right, but there's quite a lot of things which have been annoying me. Please suggest corrections or additions.

Sinn Fein will not take their seats. They have not been taking their seats for a very very long time. There might be some circumstances where they might, but almost certainly only if (a) it's an issue overwhelmingly important to NI and (b) they would actually make a difference. Some constitutional hack, or swinging the UK govt one way or the other, is not likely to change that now.

Hence, report the true number for a majority, not the theoretical number if SF were going to vote against.

The PM usually resigns as PM when someone else is ready to take over. This almost never matters, but there there IS a PM in the intervening time.

This is the closest british equivalent to the concept of a "lame duck" in American politics, I think, because you don't usually have elections that take a long time to take effect.

Everything is usually organised very quickly. Whether or not it might be healthier to take longer, if there are any negotiations, they're usually a matter of hours or days, not weeks.

Two processes happen. The unofficial process is, "parties have talks and establish if they could possibly form a majority". This is much less complicated than many countries as there's usually not many different combinations who would *ever* work together. There's often only one real possibility.

The official process (well, more official -- almost everything is by convention) happens in parallel. If that the govt have a majority (either directly, by coalition, or by enough other MPs being willing to vote for them anyway), then they stay govt, there's no resign and reform. If not, the largest party have first crack at forming govt. Else, the second largest party. But usually, it's obvious in advance if this is possible or not, and only the possible options actually happen. (eg. govt resigns if opposition have a majority)

The fixed term parliament act did basically only one thing: prevent the larger party in a coalition calling an election against the wishes of the smaller party in a coalition. It may have very slightly increased the pressure on a govt not in coalition to not call snap elections, but apparently, not really. It did the thing that the people who designed obviously wanted.

It might or might not have been nice if the fixed term parliament act had actually made parliaments fixed term. It sort of looked like it might. But (a) it didn't and (b) I don't think the people who designed it just stupidly forgot it didn't, I think they just accepted they couldn't really fix that and didn't really try. Because (a) if there's a hung parliament, there's another election anyway (that makes sense, what else will you do?) and (b) if the govt want an election, even if they don't have 2/3 -- are the opposition going to come out and say "yes, we can rule better than them but we don't want to prove it"?

I'm not great at reading between the lines, but somehow even people who are presumably more socially aware than me often ignore things I find obvious and I don't know why. There are many, maybe most, cases of potential coalitions like this, but see Lib Dems in this election. Tim Farron says he won't form a coalition with the conservatives. Duh! Saying that would be electoral suicide. I don't know if he would like to, but I think he's pretty much *got* to deny it anyway[1]. Would he? Well, hopefully not. But if the conservatives offered an attractive enough deal (say, electoral reform and cancel brexit) one the public might actually like, would he say, "oh no, I'm sorry, I agree that would be best for the country, my party, and my own career, but too late"? But that doesn't happen, because they're not making that offer. If really really wanted to say never ever make it stick, he could probably say something bridge-burning.

It's not guaranteed, but you usually know which way the non-top-two parties will go. Ie. UUP and DUP are likely to prop up Con and not Lab. Lib-Dem are kind of split. Everyone else might prop up Lab but won't help Con. That doesn't mean they WILL prop up a government, but when you're considering potential governments, there's not usually a lot of different possibilities. Usually you'll get a majority. If not you can see a majority of "Lab or Con + parties generally disposed to them". If so, they'll usually work out SOMETHING. If the margin is thin it will be very flaky (eg a rainbow coalition needing many small parties to get a majority is likely to fall apart). Technically any "not majority" is a hung parliament, but that's only really the case if there's a significant chance of a deal not being struck. If no-one has a majority even with reluctant support, then probably whoever's closest (closest in numbers or closest to support from a large non-govt party) can eke out a minority government. If that doesn't happen, *then* there's a reasonable chance of a surprise, some party working a party you don't expect. And if not, then it's well and truly hung and will soon devolve into another election whether people want it or not (but that's really rare).

[1] See also, "PM says they won't resign". They always say that. If they have to, they have to, whatever they said, and if they're not in politics any more, what do they lose by having said the opposite?

ETA: And re: "English votes for English laws", even if the conservatives have *some* votes outside England, they still have a larger majority in England than in the UK as a whole. Somehow people (who usually know what they're talking about) keep seeming to think that Scottish tories and DUP don't count for England-only matters, but opposition MPs in Wales/Scotland would. But I don't understand why people think that?

Books etc

Jun. 11th, 2017 10:10 pm
jack: (Default)
Villains, Inc

Second in the series of Wearing the Cape superhero novels. Does a better job than most of building a world where superheroes make sense. I like the second one more in some ways, where the protagonist has grown a bit and is a lot more proactive. Although I don't remember much else.

I was interested to realise, "Villains Inc" was not just a catchy name but a reference to Murder Inc, the name given by the press to the organisation that span out of various crime families in the american mafia handling a majority of their contract killing[1].

[1] Also see: http://www.anarchogeekreview.com/history/so-a-nazi-walks-into-an-iron-bar-the-meyer-lansky-story

Hanging Tree (Rivers of London #5)

I liked this more than almost any of the previous ones. The humour is firing on all cylinders. We stop discovering whole new tracts of supernatural beings surely SOMEONE would have mentioned by now, and return to the strongest topics, Peter's family, the rivers, Nightingale and the other magicians. There's almost none of Peter being an arse about women. We're still waiting to find out more about what happened to you-know-who, but we find out *something* about it.

Magnificent Seven remake

This was... ok. It had a few good moments.

The first 30 minutes of the Magnificent Seven were one of the best films ever made. An underwear salesman is trying to pay for the funeral of a guy who died in the street, but the funeral director won't take his money because no-one wants a black guy buried in the cemetery, even though it's full of disreputable people, murders, criminals, etc. The protagonists volunteer because why not, everyone watching chips in to pay for the wagon if necessary, for the spectacle more than out of the goodness of their hearts. There's an extended scene while they drive to the graveyard, shooting a variety of people who take potshots at them. Everything about it is just great. It's entertaining and tense. Even the minor characters are very memorable. It cements two of the major characters for you.

And the rest was ok, but not especially memorable. Writing is HARD, because you want EVERY PART of your story to blow people away, and it's really hard to say what makes that happen. And the same for the sequel. Nothing especially is wrong, it just all happens how you'd expect, and I never felt "Wow".

Stealing Light

The galaxy is de-facto ruled by the Shoal, the only species to have FTL. Humanity lives in the region of stars allocated to them. Now a human faction may have discovered an ancient pre-Shoal FTL ship.

I didn't really get into the book itself, but I really wanted to find out about the history and which races had FTL and how they interacted. I probably won't re-read it, but I may read the sequel.
jack: (Default)
In order for life to continue you need a variety of things. You need to severely curtail the number of fusion explosions around. You need oxygen. Need to not be underwater. Not to be constantly struck by lightning.

But funnily enough, for life to come about, you basically need the opposite of all those things.
jack: (Default)
Some sites don't load in chrome on this one computer. IE, ok. Chrome on another computer on the same network, ok. This one, doesn't load or loads reeeaaalllllyyy slowly. Any suggestions?

Dead phone

Jun. 10th, 2017 06:22 pm
jack: (Default)
Sigh, my phone seems to have worn out. I thought this one had been treated fairly well, with a case, and not suffering any disastrous drops. But now when I turn it on, it reboots again either immediately before finishing the boot sequence or as soon as I open an app.

I tried removing the case and waggling the buttons, and doing a factory reset and that didn't make a difference. Is there anything else I should try?

Assuming I need a replacement, what should I get? Probably a recent android phone. I used to always get nexus but pixel seem to have got expensive.
jack: (Default)
So... no-one else have an opinion on rules interpretation in http://jack.dreamwidth.org/1032556.html ?

I thought the answer was so obvious, but apparently not?
jack: (Default)
Oh FFS. How did I ever get into such a stupid argument.

On roleplaying stackexchange, there was an interesting question about using a divination spell, augury (which tells you the result of a purported course of action as "good", "bad", "mixed", and "neutral") to solve a puzzle.

The specifics was, you have five bags of holding, two contain dangerous demiliches[1], one contains some treasure you've been seeking, and two empty. What's the best strategy with a minimum number of castings of augury to get the treasure ideally without being attacked by undead monsters?

But one of the answers had some ingenious thoughts, but also depended on several steps asking an augury along the lines of "if bag A contains a demilich, I open B, else I open C". I thought you couldn't do that because you have no way of finding out without opening the bag.

That was the crux of the disagreement -- for the record, do other people think you could do that, or not? And can you explain convincingly -- I thought my interpretation was so obvious I couldn't really explain what was wrong with the alternative.

But then we ended up in an endless pointless snarl of misunderstandings with the original poster and others, including:

* I assumed I'd misunderstood something and it took several questions to figure out that he thought this was possible, which he took as me making a long argument veering randomly all over the map.

* I accidentally made an argument something like "augury can't tell you the result of a plan assuming you can fly if you can't do that, likewise it can't tell you the result of a plan knowing what's in bag A if you have no way of finding out" and angrily denied thinking augury could tell you the result of a plan assuming you could fly.

* I said, the "spell doesn't do that". He said "where does it say that". I said, it doesn't say it does and spells only do what they say. He thinks that "if A, then B, else C" is a course of action, and not knowing A doesn't make a difference.

* I asked a separate question about the interpretation of that spell. Several people replied saying "it might be up to the GM". Yes, thank you, it always MIGHT be up to the GM, but surely there's some generalisation about "things where reasonable people might disagree" vs "this is what the spell says,

* Yes, technically this is an opinion poll. Everything is an opinion poll. If most people think "die" means "die" but someone thinks it means "turn into a pumpkin" then they will have a different interpretation of the rules. But I think it's still valid to ask "what does the rules mean" and answer "in normal english, obviously this".

* NO I CAN'T FIT THE ENTIRE QUESTION IN THE TITLE WHY NOT ANSWER THE QUESTION RATHER THAN THE TITLE?

* You can't just ask if you can do X, people have an edit war whether you have to add "according to a strict and literal interpretation of the rules".

* Yes, I suppose all castings of augury depend on information you don't have WHY DON'T YOU READ THE FUCKING QUESTION can you not recognise the difference between "find out information and act on it" and "magically know it without finding it out" I'm asking about the one in the question, not all the other sorts of depending on information you don't have THERE'S A FUCKING CHARACTER LIMIT IN THE TITLE YOU LITERALLY CAN'T PUT ALL THE INFORMATION IN THE QUESTION IN THE TITLE OK?

* Yes, I agree you could ask a different question instead, but I want to know the results of asking THIS question. I think you ought to be able to make sub-optimal decisions in DnD and carry them out, not have the GM say "actually you did this related thing". If you think the GM should just ignore questions of this sort, then SAY SO, that's ALREADY AN ANSWER to this question, don't suggest I ask some other question that ignores the difference this question is about.

* I feel like, can you augury "if A contains a lich, I open B, else I open C" is a complete question. You do NOT need a detailed specification about which bags might contain a lich in order to ask "does A contain a lich", you should be able to ask that about ANY bag whether it's likely or not. And just because there is a complicated scenario in the related question, doesn't mean that this question is unfinished. Eventually I caved and made one up.

Sigh. Sorry that was so ranty. I feel like the useful lessons are:

* Learn when you're not going to get anywhere and don't bother.

* Imagine everyone you're talking to is drunk, distracted, and has a short attention span. It doesn't matter WHY they have a hard time following, maybe they're trolling, maybe they're really young, maybe they're busy, maybe they're in chronic pain, maybe they just don't care much, try and err on the side of compassion. If you draw an analogy, expect a likelihood immediately start arguing about the last two sentences you said, and not be able to maintain in their minds a connection between that and the thing you thought you were talking about.

* When I explain things they're often nowhere as clear as they sound in my head and I almost always need to provide a detailed example which is fairly representative of the general question. Eg. if I ask "can you do X" where you don't want to do X, everyone will ignore the actual question. This is generally true when I'm trying to understand something too.

[1] Note: a lich tantamount to a demigod, not a half-lich :)

A Joke

Jun. 5th, 2017 09:15 pm
jack: (Default)
Q. What do you call a wizened humanoid playing the donkey in a monastery nativity play, accepted into the brotherhood for his gardening ability?
A. I don't know, what do you call a wizened humanoid playing the donkey in a monastery nativity play, accepted into the brotherhood for his gardening ability?
Q. A hoe-monk-yule-ass!
jack: (Default)
I have decided I do not have more time to spend revising my novel. I really enjoyed it, although it is still pre even a first draft. But thank you ever so much to everyone who was excited to see it, if you're ok reading the rough version, please do, thank you so much.

This is a novel about Hashara, an angel who helped make the world but screwed up, and is trying to do better, and her girlfriend Lizzie. Hashara looks like a tall woman with curling horns and matted goat hair. Sometimes she's up, sometimes she's very persecuted.

Expect lots of musing about the relationship between angels and God. An angel asking, "What DOES God want me to do? Do the humans know any better than I do?" Angel magic and human magic. Angels-as-demons. Angels as genius locii. The fell children of misguided angels, the nephilim, prominently including such supernatural creatures as vampires and maybe leviathan. A flamingo-breeder. Lesbian lovers. Old church ladies. Awkward conversations with bishops. Lots of me-ish dialogue.

The link is in the immediately prior post. If you do not have an LJ or DW account, you can ask me to email you a link (yes please, you're very welcome!) or to log in with openid (or maybe facebook) and comment on this post.
jack: (Default)
https://the-orbit.net/brutereason/2016/08/15/book-club-brideshead-revisited-introduction-chapter/

This essay points out Brideshead Revisited maybe makes more sense realising its a sympathetic lovesong to dysfunctional families populating glorious excessive country houses, written not necessarily because Waugh liked them, but because he was on leave from the war, and felt (a) hungry for a larger-than-life caricature of simple naive screwed up passions that people who are not dying in a war have (b) he assumed all that would just vanish from history, not that the buildings would be carefully preserved for the public by National Trust and English Heritage.
jack: (Default)
I'm rereading Borderline in preparation for reading Phantom Pains.

(Be warned that although these are not dwelt on unnecessarily during the book, and I didn't notice any notable bad handling, the main character suffered emotional abuse and a suicide attempt before the book starts.)

I love the basic concept. The main character, struggling to cope with borderline personality disorder, is recruited by an ad-hoc agency dealing with various supernatural stuff. More like negotiating stuff than SWAT raids. I'm being deliberately vague because I like the way the main character finds out about this stuff so I want to avoid spoilers.

Writing about a character whose perceptions shift so radically is really hard. Whenever you're dealing with a main character's flawed perception, you need a balance between, narrative presents their point of view at least superficially plausibly, and yet sooner or later gives enough information that the reader can tell its skewed. But when "this person is great" and "this person is horrible" can abruptly switch places without warning, it's really hard to carry the reader along. Somehow it feels like it doesn't really "count" if the main character believes it but I don't. Borderline handles this well (although not so well I didn't notice).

The supernatural worldbuilding is also really interesting (spoilers below), although it did feel sometimes like it hadn't been fleshed out enough.

I followed the author on twitter and was really pleased when she was nominated for a Nebula.

Minor spoilers )
jack: (Default)
In a manful effort to remember which is which, I looked these words up *again*.

It looks like, "synecdoche" means using a part to represent the whole, eg. "how many heads" in a herd of cattle, or "how many bums" in a theatre, or "nice wheels" referring to a whole car. But is also used for the reverse, using a whole to represent a part, eg. "what does Brussels think" referring to the European parliament.

I couldn't tell why the second meaning was included, but secondarily, if the first meaning came first, and then people started using it both ways round, or something else. Nor if only the first meaning is "correct" and the second is a mistake, or if both are equally accepted.

Apparently "metonymy" means "using a closely related concept to represent a thing". Eg. using "suits" for "lawyers" or "businesspeople", or "the pen is mightier than the sword" to mean "the written word is mightier than force of arms".

So the real difference between "synecdoche" and "metonymy" is different history and connotations, which I don't really understand. But in terms of literal meaning, the only difference is "using a part to represent the whole" vs "using one concept to represent another".

But, obviously, human pattern matching means if you mostly use synecdoche in the "part for a whole" sense, then the most common use of metonymy is "whole for a part", even if it could be used for other things.

Can anyone fill in the gaps here?
jack: (Default)
We went to visit the new north cambridge station, and had a lovely trip to Ely. I hadn't realised we'd actually got to the opening so it was a pleasant surprise.

Overall, it looked really nice, clean, modern, a little artistic, if it works out practically I'd really enjoy using it.

In many ways well provided, like having a lift fairly central and not buried off somewhere, despite a few flaws.

There were some nice touches, like mains and usb charge points in the waiting room, although I did feel, if you're going to add any, why add only four, why not put them round the room? And why not put them next to a shelf?

I wasn't sure quite what trains I was hoping for, there aren't the ones Liv and ghoti had hoped would exist, and for now the connections seem annoyingly inconsistent, but any trains at all from North Cambridge is really nice. I think as I get used to having it available I will find it's really handy; ambling there on the bike puts a train trip in the "why not" category not the "sigh, I suppose so" category even if it doesn't save that much time overall.

My biggest worry was that it would instantly become as busy as the old station, taking a lot of the traffic from north cambridge, and making chesterton into more london commuter belt, and not be able to handle that traffic, but other people seem to think that wouldn't happen. Presumably there is *some* plan for expansion if necessary by people who know (there is still something to be built next to the station judging by the empty lot).
jack: (Default)
Driving to Bar Hill for work has been fine. It took a little adjustment, I kept not wanting to switch to cycling to go out in the evening (and if I come home first I find it very hard to go out again). But it doesn't take long, the traffic is not bad.

Although I'm not looking forward to doing it in the dark again, most is fine, but some of the junctions are a bit offputting.

Since I started working in Bar Hill I've been going to the gym there. I've very slowly got better from where I seemed to be to start with, but the last few weeks haven't improved much. Hopefully if I just keep at it, I will improve in spurts.

I've been keeping up month-by-month goals. Although several months have been more like a todo-list than a goal. I think I'd benefit from some that were even more focused on "just relax". In fact, I realise lots of productivity advice suggested month-by-month tracking of tasks and goals, but "one big one" was the way in that worked for my brain; previous attempts at similar things had me shy off thinking "I have to do everything and I can't".

Work is going ok. I still have many of the problems I've had actually getting progress done, but all *better* than they used to be, and longer periods of productivity. My first few weeks effort to close out distraction entirely failed though, I'm back to alternating work (where I get plenty done if I'm into it), and other faff.
jack: (Default)
I feel confused by the news of Friday's ransomware worm. I've tried to piece together the pieces.

It spread by both email (requiring people to clink a link or open an attachment?) and across local networks to windows computers that were not up to date with patches (ie. all xp and win7/8 which haven't got security updates in the last two months )[1] using one or more particular vulnerabilities. Is that right?

This vulnerability applied to some networking thing called Windows SMB, version 1, which was outdated, but mostly still enabled on any computers which used SMB at all, which was mostly organisation networks, not home computers. Is that right?

Some time ago, the NSA discovered this particular vulnerability. As far as I can tell there's no suggestion they *created* it? Even though that's the sort of thing they WOULD do. Lots of news articles are saying "the nsa vulnerability" but that's just hype, right? But they did find it, and (apparently) not report it, just keep it for internal use.

They assembled some of these vulnerabilities into a suite of hacking tools.

Some time more than two months ago, there was a leak. Probably an insider of some sort? Someone got hold of those tools. cf. https://en.wikipedia.org/wiki/EternalBlue

About two months ago, maybe immediately, maybe after a delay, the NSA tipped off microsoft. Microsoft released a patch in the normal security updates. I think Microsoft mostly confirmed this recently, even though at the time the patch didn't say anything about it (it was somewhat suspicious it didn't say who found the vulnerability).

One month ago, a shadowy hacker group who named themselves after a shadowy hacker group in Mass Effect 3, tried to auction some of those leaked tools with mixed success. This sounds weird, but AFAICT is fairly certain, is that right?

They could be anyone, but people suspect they may be sponsored by Russia, as propaganda to say, "see what the NSA do, don't get into an open, cyber or propaganda war with us, you have a lot to lose too".

If the malware had been released *before* the patch, it could have been a lot worse, it could have infected many other networks as well, even completely up to date computers. As it happened, it only applied to older computers of which there were still many, but it made the auction less notable.

By Friday, someone had used that vulnerability to create (an updated version of?) that worm aka WannaCry and released it. It infected many many major organisations including most of NHS.

I don't know how the clean-up is going. Will large organisations pay ransom? Probably not? Will they be able to restore computers? How much data is permanently lost? I've no idea.

Someone registered a domain name referenced in the worm which accidentally or deliberately acted as a kill switch.

Microsoft released a one-off patch for windows xp and some other older operating systems (?) to fix this specific exploit.

We have no idea who "someone" was in this case, if they were affiliated with any of the previous groups or not.

Speculation

This is just a feeling, but it feels like this particular worm was a bit of a rush job by someone who didn't expect it to do this well.

Misconceptions

As far as I can tell, this worm was based on the same exploit the NSA found, but I've not heard anything concrete whether (a) they reverse engineered the microsoft patch (b) they got the vulnerability from the leaked NSA tool or (c) they re-used some of the code in the leaked NSA tool.

I assume the NSA didn't actually write this worm? Like, they would have done something more targeted?

But the news keeps saying things like "the tool used in this current attack had been developed by the US National Security Agency and was stolen by hackers". As far as I can tell, they just didn't understand the difference between "using" and "based on", right? I don't understand how they could know "using" without citing a security researcher or something, and I've not seen anything like that. Am I missing something?

What we should do

Give up the idea that unpatched OSes are "good enough". Make sure you're getting updates if you can.

Backup.

Worry about the NHS being underfunded, and having a fucked-up tender process that ensures their IT infrastructure is always supplied by the sort of company that was cutting edge when security updates came out on a scale of a decade, not a day.

Worry about the NSA stockpiling vulnerabilities.

Remember that it could be a lot worse. Sooner or later things will line up and a vulnerability gets discovered and *not* patched, and basically infects every computer running a particular operating system, and is paired with something even worse than ransomware eg. a botnet consisting of 75% of the windows computers on the planet. People are working on this and we've got a lot better, but it's a struggle to make security good enough.

Postscript

That's my attempt at a summary. Mostly based on the news and SwiftOnSecurity. Can people who actually know more fill in the details, especially the bits that don't quite seem to track?

Footnotes

1. No idea if anyone's using vista.