The new logo: thank you!


With big thanks to you all, the new logo was selected.
With thank to Cris, these became embroidered Mizzen + Main shirts on time for the BP Conference 2016. embroidered on shirts embroidered on shirts

Wearing the shirts with logo felt good: it is my style clothing (nice business casual and practical), my style logo (personal, simple yet slightly out of the box), and people had an easy time spotting and reading the logo. Win!

Oxygen bar BP Conference 2016

Oxygen bar BP Conference 2016

Business card
Business card

I’ve written up how the process with 99designs and with those of you who gave feedback was too.

Again, thank you all for making this happen for me!

With gratitude (and a new logo),

Flying as superman: Airflow by Mindride at the Bulletproof Conference 2016

I always wanted to fly a wing suit, but without the risks of actually crashing into an unforgiving ground. 😉

I got to experience that with Mindride’s “Airflow”: I got suspended in a bungee jump harness with foot straps to hang horizontally, sensors on my arms for arm inclination, an Oculus Rift on my head for virtual reality view, and fans blowing at me for the sensation of wind flight.
And off I went!

The experience is much like flying as superman. Like with a canoe, holding one arm low pivoted me around that arm, arms to the back accelerate (Naruto ninja-running style), arms open to slow down.

I found this quite an immersive experience.

The developer said they also have versions with heat lamps, CO2 puffs for cold, and water misting for even more immersion.

The main application they said they were targeting for was entertainment (hiring it out for parties and such). I imagine there is also great opportunity for working on fear of heights or flying with it.

With different software, I think it is a great opportunity for flow state hacking with this kind of setup.

My expectation is that this kind of application of virtual reality is going to be worth to keep an eye on. There are already “VirZoom” and “WideRun” virtual biking, or “Icaros” flying core workout.

Here is to flying as superman!

In business, you outsource your shadow work

In the self-improvement world, there is a strong bias towards healing any wounds/shadow/reactive behavior. You see a weakness, you work on it. You struggle with it, finally heal yourself, and make yourself an even more perfect person. You learn to love being in that painful healing state.

In the business-world, you don’t. You see your weakness, you figure out what needs to be done to have that weakness resolved, and you outsource doing that – to a contractor, a piece of software, a system, a trusted employee. But not you. There is no value in struggling with your demons in business.

In business, you focus on doing what is so obvious to you and brilliant to others, what is so much your superpower, that it is simple to do that seems super-human to everyone else, what is your 10x value add.

Now stop delving deep in your shadows, just hire that accountant to do your taxes, and bring your actual gifts to the world!

With efficient passion,

Flip Feng Shui: Perturbation attacks made it to VMs

I’ve been reading up on the Flip Feng Shui: Hammering a Needle in the Software Stack paper, and I’m enjoying that the common smart card attack considerations are coming to more mainstream software considerations.

From the paper:

We describe Flip Feng Shui (FFS), a new exploitation vector that allows an attacker to induce bit flips over arbitrary physical memory in a fully controlled way. FFS relies on two underlying primitives: (i) the ability to induce bit flips in controlled (but not predetermined) physical memory pages; (ii) the ability to control the physical memory layout to reverse-map a target physical page into a virtual memory address un- der attacker control.

This first item we call “perturbation attacks” in smartcard domain. We do those attacks all the time, by giving our poor smartcards power spikes it really shouldn’t be exposed to, prodding it with probing needles too small for the human eye, shooting it with freaking lasers, … you know: standard Monday morning stuff in the office*.

Because we’ve been doing this for ±20 years now in this domain, it takes a while for me to understand a statement like the following is not a joke:

existing cryptographic software is wholly unequipped to counter it, given that “bit flipping is not part of their threat model”.

Because in my world, bit flips are a given, considering that there is an attacker playing with the smartcard. Monday morning remember?

So how does this attack work?

The attack (mis)uses memory de-duplication, i.e. a feature in the host hypervisor that sees that the page of memory of one VM is identical to another one VM’s. When this is enabled, the host hypervisor then maps both these pages to the same page (to reduce actual used physical memory by 40-70%!). If the attacker was the one who created that page originally, he now owns the actual physical page. As long as the host software thinks this page’s content has not changed, the victim VM will read the attacker’s physical page.

So the attacker then does a Rowhammer attack to cause a bit to flip in the part of “his” page. As Rowhammer is a physical side-effect that ‘should not happen’, the host hypervisor does not see the page as changed, even though it is. So now the attacker has just caused a bit flip in his own and, more importantly, this victim’s memory.

Flipping a bit in say a RSA public key allows the attacker to factor that modified key, and generate the appropriate secret key to match. If the attacker does this with the RSA key say used to authenticate root access for SSH, or the signature key for package updates of Linux, he now has full control over that machine.

Neat! (In smartcard world we usually attack the secret key, because of how the protocols are used.)

Theory or practice?

Now, to successfully pull off this attack, several things have to be possible for the attacker:

  • predicting the memory content (this excludes attacks on confidential information such as secret keys),
  • memory de-duplication must be active (so disabling that, or setting it to “only zero pages”, seems prudent),
  • the attacker must be running his VM on the same physical machine as the victim’s VM (I don’t know if this is a realistic scenario. More on it below)
  • the memory must be sensitive to something like Rowhammer (so ECC memory is yet again a good idea, it will reduce the chances of this significantly)

Realistic to be the neighbour of your victim VM?

This attack depends on being able to run the attack VM on the same hardware as the victim VM. I have no well-founded grounds to guess if this is a realistic assumption.

I can think of the following situations where that is possible:

  • The pool of actual hardware is pretty small compared to the amount of VMs, because the hardware is very beefy or the VMs are small.
  • The amount of instances of the victim VMs is pretty big, because it is a standard VM replicated many, many times. I think about situations like massively parallel computing or streaming (Netflix?).
  • Or the targeted page is very common, and here I’m thinking of the signature files for updates for example, or company wide backup root accounts.

My conclusion: stay calm and …

Considering all the complexity of this attack, I don’t see it worm all over the Internet soon. It is however a cool warning that attack can and do cross over from these various fields.

I wonder when they’ll realise they can also apply this attack to modify the running code of say the password check routine

Financial growth to freedom

Lately, I’m getting questions on “how to invest” income beyond direct living costs.
Just like with GTD systems, I find it very important to have a financial system that one can relax into fully. Not having concerns about money frees up a lot of mental and emotional energy, and can shift one from a scarcity to abundance mindset.

My advice and practice is go implement this once the daily living costs have been covered, in the below stated order:

  1. Put an amount of at least 6 months of living costs + one big unforeseen cost (e.g. suddenly needing a new car due to an accident) aside in a savings account as buffer for hard times.
    Taking out a loan is very expensive, both in money (interest) and in energy (loss of abundance mindset).
  2. Invest at least 15% in a financial freedom fund, some form of savings that does not easily lose value but is accessible if you need it within half a year, relative to the way you live.
    In my case it is my own house and office, as I don’t likely need to move anytime soon. If you are like a lot of my friends and you want to stay more mobile for a while, consider an investment fund that has the same distribution as the Dow Jones, but mind the costs and risks!! I highly advise reading Tony Robbins’ “Money, master the game” on this topic. Management costs above 0.5% annually of your investment will kill any value accrued.
  3. Invest 10-30% in development of skills and contacts that make you more valuable, more productive and widely skilled, so that you upgrade your market value by at least one order every two years. Examples include workshops that really stretch you beyond what you think you could do or mastermind groups at a level you think is beyond your stature.

After the above, you can put the remainder into further tweaking of your financial growth and stability, with your choice of:

  • Extending your safety buffer to 12-24 months (I aim for 18+ months, allowing for a safety margin to abort ventures)
  • Reducing any costs you have (e.g. paying off outstanding credit card, loan or mortgage costs)
  • Investing in quality products and services that require reduced upkeep costs and make you much more productive
  • More investment in financial freedom capital
  • More investment in totally different skills and contacts

And whatever you have left and are entirely ok with losing completely, gamble that by:

  • Paying it forward to a personally worthwhile social goal. Ideally, this could be bootstrapping someone you personally care about towards their self independence, their growth, while expecting nothing in return (and probably getting a lot from that in feeling good).
  • Trying an investment in a start-up you believe in will work financially (with a return of at least 10x) and do your kind of good in the world. Then don’t touch or even look at that investment for at least 5, preferably 10+ years. Don’t expect it to return anything, be positively surprised when it does.
  • If you really must learn that lesson yourself: lose it by gambling on the stock market, stepping into or out of the latest crypto coin hype too late, or other such “I can beat the system” delusions.

I hope this view helps you decide wisely where to put your money.

For the growth!

Time hack: speeding up podcasts and audiobooks

One of those small hacks that I enjoy a lot, is to set the playback speed of podcasts or audiobooks to 1.5-2x the normal speed. Modern players such as the iOS podcast Overcast app and Audible app will keep the pitch normal.

So the effect is similar to giving the speaker a cup of coffee, not a hit of helium and making him one of the chipmunks. Especially with speakers … who … speak … with … … profound … … silences … like Osho, this speed up saves me a lot of will power to keep listening.


The Overcast app has a more granular setting for the speedups. Not only can you select speedups in 0.25 granularity, you can also vary the speedup per podcast (so usually slow speakers can get even higher speedups). In the speedup it also removes the pauses, which gives another 0.25-1.50x speedup without any loss of information.

The Overcast app has a few other features that make life easier: downloading of new episodes is reliable (iOS app is crap at this), skip forward button step is configurable, it automatically plays the next priority episode (iOS app stopped doing this for unknown reasons). And they are very well aware of the impact on our mental well being:

Overcast knowing the cost of attention
Overcast knowing the cost of attention

For iOS podcast app

Podcast speed is to the left of the play buttons:

Podcast speed is to the left of the play buttons

For the Audible app

I like Audible for audiobooks, and quite a few of the speakers have this profound … silence … speaking style that I’m not really interested in anymore, so this works well for me. Tapping on the lower left corner brings up the Narration Speed menu.


Even more ideal would be removing the silences automatically, similar to how my videos are edited, but I’m not aware of something that does that.

Hoping I saved a few hours of your life with this,


NSA Equation Group’s exploits for sale?

There is a persistent and fairly believable rumor going around that a significant amount of the NSA exploits are for sale. To convince potential buyers that they have the goods, the sellers have apparently dumped a ±250MB package of 3-year old exploits and implants for firewalls.
Looking at the descriptions Mustafa Al-Bassam extracted from the dump, it seems plausible that at least these firewall exploits are from a government outfit like the NSA or GCHQ based on the terminology and the typical codenames like “WOBBLYLLAMA”, and the kind of firewalls targeted.

Regardless whether this is the real deal (and whether more than just these firewall exploits are up for grabs), this, in my view highlights the main problems with seeing offensive hacking as as the best defence:

  • Backdoors and exploits are often single-use: using them as attacker is risky, as your target may be recording network traffic and recover the attack. This was also explicitly mentioned by Rob Joyce, the head of the NSA’s Tailored Access Operations (TAO) group, i.e. the NSA hackers whose toys are apparently now for sale. Or mishandling a spearfish and lose your nation state quality three 0-days on iOS to Apple, an expensive mistake as a full weaponised remote rooting of iOS is easily $100.000+ value.
    As an aside, their 2007 hardware toy catalogue leaked some time ago, a fun read for people like me.
  • Amusingly, the NSA actually does this eavesdropping to get other organizations’ offensive hacking tools. There are some convincing theories that this ‘leaked exploits sale’ is actually one of the other organisations (China and Russia have been mentioned) getting back at them.
  • Somewhere in these offensive organizations there is a weapons cache of these exploits, and it just takes is one disgruntled employee with access to it and the desire to leak it. After all, it is these hackers’ full-time job and passion to break in and out of highly secure environments, and they have all the tools for this. (This is the most likely explanation).
  • Once the attacks are out, others can also use it against you! The NSA has the story that “NObody But US” (NOBUS) can exploit these things, and use that as an argument not to inform the American companies whose products are at risk in this way. So now, Cisco (and other) firewall vendors are scrambling to make a bug fix (which takes a few days to weeks), and actually may impact other products too.
    Then the users of these firewalls have to actually deploy the bug fix (which they’ll be reluctant to do for reliability reasons, if the users even know that the bug fix exists, taking another few days to many months), and all the while savvy and assertive attackers can hack these firewalls at their leisure.

I still have this naive hope that these blowups will change policy for these organizations to lean to the defensive more. Realistically though, they’ll double down: both hide their exploit development better and come down even harder on leakers and whistleblowers.

And of course thus continues the arms race, making us all less secure in the long term for a short term gain. Sigh.

Your friendly professionally paranoid,


P.S. this may of course just be a disinformation campaign or a fundraiser. One never knows… (until ±30-50 years later when the documents get declassified)

Voynich manuscript reproduction coming

Oh, in the world of infinite resources, I definitely lust for this, for the sheer having as a token of cryptography run rampant: The Voynich manuscript is going to be reproduced at a staggering $10,000 price tag.
Much more reasonably priced reprints are available via Yale books or Amazon, and the scans are available for free.

The Voynich manuscript has been intriguing cryptoanalysists for ages, with its cryptic almost-sensible texts, pictures of not-quite-real plants and animals. There are interesting attempts claiming to have partially decoded it here and here.

I, for one, think XKCD still has the best explanation of the origins of this intriguing manuscript:


XKCD's take on the Voynich manuscript