Y’all read the updates to PIPEDA? Starting November 1st 2018 (yup this week) you have some reporting obligations if you have a ‘security breach’ of your privacy safeguards.

You probably think it doesn’t apply to you. You are wrong. Big and small. A new acronym for you RROSH (Real Risk of Significant Harm).  Who wants to be the first to fill out the form?

So… are all your laptops encrypted (with something better than BitLocker please), with UEFI secure boot? Is your data all encrypted at rest on your servers? Are all your personal fields hashed with salt? Don’t be ‘that company’ that fesses up to keeping the SIN + Passport + home address + Credit Cart w/ CVC in a ‘foo.csv’ file in the root of an old web server that gets sold on ebay.

What’s your egress firewall policy? In your cloud? In your site?

I didn’t take a photo of this (I was laughing too hard and it seemed a bit rude so I held off), so picture it in your mind.

Waterloo Park. Its got a ‘lake’ in it (silver lake). And the lake is inhabited by ~30 mallard ducks and between 0 and 50 Canada Geese (and many squirrels, ground hogs… you get the picture). This is not the part of the park with the llama and donkeys in the petting zoo, its more typical urban wildlife.

Its fairly common for people to feed the ducks. As a consequence the ducks are extremely tame. I have seen a person sitting at a picnic table with a duck on her lap, like a cat!

So I’m booting through the park yesterday afternoon. Its not a terrible fall day. And these two parents have their young child out. The kid is maybe 2, walking, but unsteady. And they have given the child a cup full of some sort of duck ‘crack cocaine’ which he is doling out. Eventually the ducks decide this is going too slowly and decide that a full-court-press is in order, @ which time the poor child falls down and spills the seed all over himself. At which time there is a flurry of duck action and he is *covered* in ducks. And a couple of squirrels jump into the fray. All you can see is beaks and fluffy tails and hear the anguished cries of the poor kid. His parents were unsure what to do, stand and laugh, or dive in and de-duck the situation. After a moment of indecision they choose the latter, yanking a very confused toddler from a fracas of quacking.

And that is why I looked up ‘Anatidaephobia‘. I hope the therapy is not too expensive!

When I was much younger, a friends dad was the local OPP constable. The area I grew up in houses were many km apart. There’s a photo to the right, somehow through the magic of 110-camera stuck winding, a double exposure showing both out the front and back of our house at the same time! (I don’t have a lot of photos from when I was young, and none of them are particularly ansel adams-quality). As a consequence of distance, everything involved driving.

There came a time when it was high school graduation for my friends older brother, and I was surprised that his dad (the cop) (and a few other parents) were hosting an after party at their farm where they would supply alcohol. The rationale was “Those kids are going to drink anyway, it may as well happen where they won’t drive afterwards and with some outer-boundaries of safety”.

Now, I wonder if this pragmatic approach “bad things will happen, rather than try and prevent them, attract and contain” could apply to network security (oh you thought this would be about Radon again? sorry!)

You see, there are some hugely risky behaviours out there today. One of them is the use of containers and their upstream repo’s without much thought. For example, Docker, its common to use things from the Docker Hub without giving them a thought. But are they up to date? Are they free of purposeful malware? This paper says no. So ultimately you are relying on the (thin) walls of the container to prevent the badness from leaking out. And, in a world of Spectre, this could be not as great as you think.

However, thin walls of a container do nothing for networking, and that container you did a pull on, “docker pull evil”, can wander around your network, east<->west, attacking and surveilling your other virtual machines and containers. And this is because outbound firewalls are rare to configure, and inbound are 1-tuple port-only. Hmm.

So I wonder if we can take a page from a rural cop’s book and find some way to, instead of entreating people to be more careful with these powerful technologies and try to be perfect, simply accept that bad things will happen, and, create a strong sandbox for the slices or zones.

OK, I said I’d stop writing about Radon for a bit, but, well, I can’t help it. A few readers have written in with their screenshots, and I thought I would share them back out.

First, if you read no further, and you live in a house with a ground floor or basement, and you don’t have a Radon meter. Get one. Get this one. Yes its $250. Yes its cheaper than doing the charcoal test monthly (pays back in the year). yes its cheaper than  the funeral cost of you dying from lung cancer.

First, is there such a thing as a Radon season? Yes, there is a bit, since it travels with groundwater. See that guy on the right? He’s out and about in my backyard today (no longer just feral cats!), which means spring is here (despite what he said on February 2nd).

And with spring comes melt, and with melt comes underground water. And with underground water comes Radon.

Lets examine how the ‘invisible gas of death’ gets in your house. Hey, a picture!


OK, as you can see, water is the main way its moving around. Got a sump? Put your Radon detector nearby. Got a part of the basement that’s a bit damp? Put it there!

If you are over 100Bq/m^3, start thinking about what you will do. If you are over 200Bq/m^3, get on it. If you are in Ontario, and your home is new, it may be covered by warranty, so get on that.  This meter is certified. It seems expensive @ $250, but the alternative is monthly tests w/ charcoal packages and it pays back within the year.

Now, lets look at how to read it. First off, the first couple of measurements are not that accurate, so don’t stop/start worrying in your first couple of hours.

Second, yes it goes up and down. The important thing is the average. You want the long term average to be somewhere below 100 (World-Health) or 200 (Canada) recommendation. See mine on the right? Sometimes its ~60, sometimes it’s ~35. Its related to weather, how much I move around in the basement, how often the furnace runs, etc.

Third, yes, put it in the worst spot. There is no sense putting it somewhere and saying “well, that spot has Radon, but this other spot doesn’t so i’ll leave it here”. Find the worst spot, understand the level, and then decide if that is worth worrying about.

Fourth, don’t over-stress. Its not an instant quick killer, it takes time and levels of exposure.

Fifth, Radon is hyper-local. If your neighbour is good, you might not be. And vice versa. It depends on factors that vary metre by metre, and foundation by foundation. So yes, lots of the world is in a high-risk Radon zone, but that doesn’t mean you are/are not.

Here’s another graph of a local reader. See how his is more consistent than mine? But still varying?

Other local readers are seeing 130 (warning), 250 (needs resolving), 1300 (needs quick resolving), 800 (needs quick resolving), etc. And its varying day by day.


Another reader has purchased the gadget and found an issue. If you still think “this couldn’t happen to me, my dank wet  basement is in a Radon-free zone, well, you are only right in the sense the Radon is free. Free to invade your lungs, cause lung cancer.

If you are still trying to convince your SO that yet another gadget can be in the budget, well… Just click this link and click “buy now with 1-click”. The peace of mind will be good. And then slap the 2 AA batteries in, pair it to your phone (or don’t), put it near your sump-hole in the basement (or the root cellar, or other low air-flow, damp area). Find the worst spot, measure. It only starts to get accurate after a day or so, so don’t fret right away. If your worst spot is good, stop worrying. If your worst spot is a bit bad, consider your mediation options (another inlet on your HRV, sealing paint, sealed cover for sump w/ exhaust fan, slab negative pressure, etc. A professional in your area can help with this).

One of my other friends found he had a problem on Monday, and had the mitigation finished on Tuesday. And it was not that expensive. Its a fan and a pipe, its not rocket surgery!

PS, if you live outside of The Great White North (Canada eh), just google “Airthings Wave”, you’ll find it on your local gadget repository, either online or brick+mortar.

Oh, and since I brought up The Great White North, well, here you go! Some of the greatest rocket surgeon’s ever to grace a TV (and now you can lookup how Canadian TV had less commercial time, so they needed ‘original Canadian content’ to fill it during SCTV simulcast). This might lead you to watch Strange Brew. I am not responsible. But the plot is strong (about possibly poisoning the beer during Kitchener-Waterloo Oktoberfest).