Month: November 2023

In Praise of Pen and Paper

Back before the Internet became ubiquitous, one of the most commonly given pieces of computer security advice was to not write passwords down on Post-It notes and stick them to your computer. The threat model was obvious. Anyone sitting down at the computer would have access to the password. This threat model was the most common one back then. While writing passwords down on Post-It notes isn’t a good idea today, it’s actually quite secure against today’s most common threats because a piece of paper can’t be accessed remotely. Ubiquitous Internet connectivity has shifted the most common threat models from local access to remote access.

Data breaches, ransomware, and distributed denial of service are three of the most common forms of attack we read about today. Data breaches in business and government networks have resulted to tremendous amounts of personal information being leaked online. Ransomware attacks can grind businesses to a halt by locking away the data needed to complete day to day tasks. Likewise, distributed denial of service attacks can bring businesses to a halt because so much data has been uploaded to other people’s computers. If those computers are knocked offline, the data uploaded to them becomes inaccessible. A folder containing information written on paper forms stored in a filing cabinet can’t be stolen remotely. It can’t be maliciously encrypted remotely. Access to it can’t be taken away remotely.

The benefits of paper don’t stop there. Paper has an intuitive interface. You pick it up and you read it. Accessing information on a piece of paper doesn’t require trying to figure out a command line or graphical user interface designed by a mad programmer who seemed to take design cues from Daedalus. The user interface of paper also doesn’t change. You don’t have to worry about a software company releasing an update to a piece of paper that drastically changes the user interface for no reason other than the sake of changing it.

Paper is resilient. Data stored on a computer can be corrupted in so many ways. A file loaded into RAM can be corrupted due to a memory error and that corrupted data can be dutifully written to disk and then included in backups. It’s possible that a file that is accessed infrequently can be corrupted without anyone noticing until all of the backups of the uncorrected file are cycled out. A file can also be corrupted while it’s stored on a hard drive or SSD. Paper doesn’t suffer such weaknesses.

Writing information down on paper has a lot of security and integrity benefits. None of this is to say there aren’t downsides to using paper. But the next time you read about patient information being leaked online because a hospital suffered a data breach, consider how much safer that information would have been if it had been stored on paper forms instead of a database. When half of the Internet disappears due to another Cloudflare misconfiguration and you are unable to perform a task because the information you need is hosted on somebody else’s computer, consider that you’d still be able to complete the task if the information was on a paper form in your filing cabinet.

Just because a technology is old doesn’t mean it’s completely outdated.

No True Gray Man

Through some twist of cosmic karma, there seems to be a universal rule dictating that any group of carry permit holders must discuss the concept of the gray man. Through an addendum to the universal rule, this discussion must always devolved into No True Gray Man where each participant points out why every other participant is failing to be a gray man.

The concept of the gray man seems simple enough. If you don’t want unwanted attention, you need to blend in with the general populace. This is important to many carry permit holders because they know that if a bad guy is able to mark them as a carry permit holder, then they will be the first target should that bad guy decide to act like a bad guy. Such a grizzly fate can only be avoided by becoming indistinguishable from the background mass of people, to become a gray man. The question is, how does one achieve the coveted status of gray man?

As a frequent (and almost always unwilling) participant in this conversation, I have learned the characteristics of the gray man.

  • The gray man does not wear tactical pants. The only people who wear tactical pants are people who are carrying a gun. No exceptions.
  • The gray man does not wear a tactical shirt. What is a tactical shirt? Any button down shirt that has pockets. Unless it’s not.
  • The gray man does not wear camouflage.
  • The gray man does not wear any clothing with an emblem of any firearm manufacturer.
  • The gray man does not wear hiking boots unless they’re in gaudy colors.
  • The gray man does not use a backpack with MOLLE webbing.
  • The gray man does not use any pack other than a fanny pack because all other packs scream that the owner is carrying a gun.
  • The gray man does not walk too fast. People who walk too fast attract attention and are easily identified as a man with a gun.
  • The gray man does not walk too slow. People who walk too slow are obviously trying to avoid attention and are therefore easily identified as a man with a gun.

If you do all of these things, you will blend in perfectly with the masses and by extent achieve the coveted status of gray man! Unless, of course, you actually practice all of the other things you’re told to practice such as keeping your head on a swivel, not reducing your awareness of your surroundings by wearing earbuds and staring at your phone, crossing the street to avoid an individual or group that you believe could be trouble, or otherwise maintaining any awareness of your surroundings.

The problem I have with most gray man conversations is that they focus almost exclusively on clothing. There is another, and I will argue more important, component of blending in with the masses: behavior. Go to a public place like an airport, mall, or the downtown of a city and watch the people. Take note of how they dress and behave. I can’t tell you how many backpacks with MOLLE webbing I’ve seen at the airport. Those backpacks aren’t unique to carry permit holders. It’s fall here in the Midwest, which means it’s jacket season. Here in my rural community I see countless people wearing camouflage jackets. They don’t stick out at all because hunting is a common pass time in these parts. Many of the fashion trends declared as faux pas by the carry permit holder crowd are actually quite common amongst the general population. I can shuffle through an airport, mall, or city downtown in a 5.11 tuxedo with a Multicam backpack covered in MOLLE webbing and attract little to no attention. However, I can stomp through the same airport, mall, or city downtown in jeans and a t-shirt and attracted more attention. I just have to change my behavior.

If you spent some time people watching, you’ll notice a few trends. Most people look down at the ground as they walk. A lot of people wear earbuds in public and many more are glued to their phone. I once watched a girl whose eyes were glued to her phone walk into a moving car in a Menard’s parking lot. She was lucky that the driver noticed her and stopped the car before she hit him. Many, if not most, people are in varying states of overweight. The people who stick out are the ones who look up and forward as they walk, are obviously aware of their surroundings, and are in good physical shape. In other words, the people who practice all of the things self-defense classes teach are the people who stick out regardless of how they dress.

The gray man as typically discussed in carry permit holder circles is fudd lore. You cannot simultaneously be a gray man and practice good self-defense principles because the behavior of people who practice good self-defense principles causes them to stick out. But I’m also here to tell you that it doesn’t matter. Going back to my remark about being able to attract attention wearing jeans and a t-shirt, I specifically said more attention, not a lot of attention. This is because, short of running around screaming racist slurs (simply screaming is unlikely to attract much attention as most people work to ignore it) with my hair on fire, it’s difficult to attract much attention because most people are oblivious to their surroundings. They’re not just passively oblivious either. They actively work to remain oblivious. They wear earbuds to deafen themselves. They stare at their phones to blind themselves. They do everything they can to not have any awareness of what’s happening around them.

The good news is that you’re a gray man to the general population no matter what you do. The only people likely to notice you are other carry permit holders and bad guys. Being noticed by other carry permit holders usually isn’t a big deal. You might make a new friend (or you might sucked into a No True Gray Man discussion). Being noticed by a bad guy isn’t necessarily a problem either. The main point of practicing good self-defense principles is to signal that you’re a hard target. The reason for signaling this is because most bad guys are looking for soft targets. A bad guy noticing you and identifying you as a hard target is a typically a good thing because it will often dissuade them from choosing you as a victim. Even if a bad guy decides to target you first because you’re a potential hindrance to his ability to target others nearby, the fact that you’re practicing good self-defense principles improves your survivability. If you were blending in with the general population, if you were actively preventing yourself from being aware of your surroundings, you would have zero chance of identifying the bad guy beforehand and would therefore have no chance to defend yourself.

Don’t let yourself get suckered into believing that a change of wardrobe will allow you to achieve gray man status. If you practice good self-defense principles, you’re going to stick out no matter what you wear. Wear what you like to wear. Carry backpacks that you like to carry. Walk how you like to walk. Enjoy your life.