Behind the Cover: A Look Back at a Year Designing The New York Times Magazine
We spent 52 weeks documenting how we create our covers. Here’s what we learned.
By The New York Times Magazine
A lot goes into designing a magazine cover, from type treatments to photography to the best possible cover line. The finished product needs to catch readers’ attention but also begin to tell a story.
We spent a year documenting our cover process in short videos. Each week, our editor in chief and design director talked through their decisions and the challenges along the way.
We’ve just wrapped the series, which gave us a chance to look back at what it meant to us.
Gail Bichler, design director: Coming up with a meaningful cover image can be messy. It sometimes includes false starts or means simultaneously going down several different paths.
Jake Silverstein, editor in chief: These weekly conversations with Gail became a kind of therapy, I think for both of us. Making covers is the ultimate design/edit collaboration, so it’s great to be able to sit and talk through the twists and turns of an idea at the end of the road — revisiting the light-bulb moments, rehashing some of the disputes. I’ll miss it.
Gail: Internally, we have so many interesting discussions about our covers, and some of the thinking behind our choices is pretty nuanced. Talking with Jake about the decisions we made helped clarify my own thoughts on why we did what we did.
Jake: We take that real estate so seriously, and I want readers to know that.
Jake Silverstein, editor in chief: “Cristiana Couceiro’s collage of the artists selected for our list of the 25 songs that matter right now is dynamic and fun — I can imagine readers turning the magazine around to study the image for who made the list. The shape created by the cluster of all those different musicians has a wonderful organic quality to it.”
Jake Silverstein, editor in chief: “Tyler Hicks’s image captures a dramatic moment as a soldier from Viper Company dashes up a hillside after a Taliban ambush, with smoke grenades billowing behind him. The pink smoke and green leaves, along with the slightly blurry quality of the photo, give the whole thing a surreal apocalyptic beauty, which perfectly complements the cover line.”
Gail Bichler, design director: “This year’s Food Issue takes a global approach to candy. For our cover, Massimo Gammacurta used a silicon mold to make a lollipop that looks like the earth and then photographed it capturing its beautiful, sticky imperfections and bubbles.”
Jake Silverstein, editor in chief: “Maya Rudolph is such a game subject that we wanted to try something a little weird and collaborative. The photographer Alex Prager’s sister, Vanessa, a painter, created a portrait of Rudolph that is inspired by a work by the 20th-century American portraitist Alice Neel. It was then cut to allow Rudolph’s real face and hand to come through, creating a surreal image that blends fact and fiction, much the way she does as an actress.”
How do you keep creating when you feel uninspired? This is one of those questions that plagues photographers at all levels, at some point in their lives. Here are a few tried and true tips that have prevented some from giving up.
Hexbyte – Glen Cove – News 1. Start a project
At some stage in your shooting life, a photography project is highly recommended. When stuck in a creative rut, setting yourself a clear and defined focus or theme helps. Projects require a commitment out of you and are a great way to push yourself.
Depending on the magnitude of your project you can either set a timeline or forego it. Some timelines are built into a project, for example: a 365 project with a common theme or a 52-week portrait challenge. Other projects can be life long, such as shooting long exposure beaches in different countries or a specific location over a number of years.
The best part is that your project can be as small or big as you want – ranging from strange and faraway places to the comforts of your back yard. There are endless possibilities.
During the course of your project, do not forget to challenge yourself often. If you find your project is getting routine or mundane, this is an indication that your progress/learning has stopped or is slowing down. If this happens you could very well end up back in your previous uninspired state. Make your project challenge you, while keeping it fun and celebrate your skill and knowledge progression.
Hexbyte – Glen Cove – News 2. Do something outside your comfort zone/genre
One of the greatest things about photography is that there are so many genres, with different skills to explore. Landscape photographers and studio portrait photographers have distinctive skill sets. Street photography versus macro photography, each comes with their unique challenges.
When you love capturing moments in time, traversing an area outside of your norm can help you see things anew. Even within the same genre, each photo experience can be diverse. In landscape photography, for example, you have sub-categories such as long exposure, astrophotography, nightscapes and seascapes to name a few.
If you have hit a creative wall in your genre, try learning something new to you. Creating new work encompasses shooting outside of your comfort zone or even editing differently.
As a creative, you can even try another artistic avenue other photography! It may sound unrelated, but doing something else like painting or drawing can give you a whole new appreciation for light (or maybe it will just remind you why you shoot and not draw or paint).
Hexbyte – Glen Cove – News 3. Consume less, do more
Inspiration is everywhere. Looking at other people’s work in person (exhibitions) or online (photography websites, social media) is a great way to probe yourself. Asking questions like, “how can I do a version of that?” or “what will it take to recreate that lighting?” Save anything that inspires you with purpose. Images that get you excited about creating or planning a future shoot. Browsing other people’s work can be a double-edge sword though.
On the plus side, you can use it to gauge either how far you have come or what is left for you to learn. It can inspire you to try something new and challenge your skill level. The recommendation is to do this in spurts and not too often for too long, as you can start comparing yourself to the point of getting discouraged. Consume enough so that you are inspired, move to the planning stage and execute. More doing/creating is what will actually move you to a better place mentally.
Once inspiration starts to overwhelm you, take a step back. Reference the images that you want to learn from and actually attempt it. In this case, failure is an option as it shows you that you need to read, research and try again until you get the final output that you desire.
Important note: while you can learn from your attempts, do not set yourself up for failure. Too often trying to recreate the entire image can be senseless. A better approach may be to determine what about the image inspires you (lighting, subject, processing). Choose one or two elements you want to experiment with and make it your own.
Hexbyte – Glen Cove – News 4. Get constructive feedback
Posting your images on social media might seem like the best place to get feedback – it is not. While it may be a great way to share your image (and boost your ego), it is not the place where you will learn what you can do to improve. If you are feeling uninspired, constructive/positive feedback will do you good. Keep in mind that in order to improve, you have to also be willing to deal with critique.
On most photography forums known for good feedback, you will find that the other members here know how to give feedback in a non-offensive, positive way since they also seek feedback for themselves. Additionally, you can also streamline what you ask for. Is it the lighting? The composition? Exposure techniques? These questions will help your viewers hone in on the area you are having the challenge with.
Hexbyte – Glen Cove – News Conclusion
If you find yourself at a plateau with your creative work, there is no right time to try to come out of it. Make the effort to break out of that uninspired space by committing to do something different. Challenge yourself outside your comfort zone or start a project.
Looking at your peer’s work can definitely be inspirational, but more than that, do something today and get feedback on it. These are great ways to push through the mental blocks.
Share with us something that has worked for you on your photography journey in the comments below.
Framing buildings in disorienting fashion, he created images of Hong Kong’s density. He also recorded the minutiae of its everyday life.
HONG KONG — Michael Wolf, a photographer who was known for his vertiginous depictions of rainbow-hued skyscrapers in Hong Kong as well as the minutiae of everyday life there, died on Thursday at his home in Cheung Chau, an outlying island near the city. He was 64.
His death was confirmed by his longtime representative, Sarah Greene, and his studio manager, Pierfrancesco Celada. They did not specify a cause but said he had died in his sleep.
In photographs he likened to “supermarket bar codes,” Mr. Wolf captured Hong Kong’s high-rises — dizzying stretches of pink, green and orange — in a 2005 series titled “Architecture of Density.”
“He took a building that is very three-dimensional and compressed it into a surface in a way that would make one feel breathless and lost in scale,” Tugo Cheng, an architect and fine-art photographer based in Hong Kong, said by telephone.
By tightly framing high-rises in a way that showed neither sky nor horizon, Mr. Wolf created architectural photographs that gave the viewer the impression of infinity and repetition.
“This building is only as big as it is, but it could be 10 times as big, because you don’t know where it ends,” he said of his photos in a 2009 talk at the Aperture Foundation.
A closer look at one of his pictures reveals minuscule details that intrude on the uniformity of a building’s facade: laundry dangling from a window, poles jutting over a ledge, a child’s flower-shaped windmill spinning below a grate.
Mr. Wolf later spent time inside homes, documenting small, square-shaped public-housing apartments for a series called “100 x 100.” But to some critics he began revealing too much.
From a rooftop in Chicago, Mr. Wolf used a telephoto lens to capture both the scale of condominium units and the particulars of private lives, glimpsed through illuminated windows, for “The Transparent City.”
Later, for “A Series of Unfortunate Events,” he placed a camera on a tripod in front of a computer screen and, from blurry Google Street View footage in Paris, captured images of cars burning, dogs defecating, couples kissing and cyclists falling onto the streets.
The project, which won honorable mention in the World Press Photo awards of 2011, was lauded for its innovative use of technology, but it was also questioned as to whether it should be considered photojournalism.
Mr. Wolf was aware of how intrusive his camera could be, as when he photographed Tokyo commuters in packed train cars pressed against the glass of the doors. “It’s a bit aggressive, what I’m doing,” he said, “because these people cannot defend themselves.”
The project won a World Press Award in the daily life category. Mr. Wolf surmised that some subjects closed their eyes at the sight of the camera. “The thinking is, If I don’t see you, you don’t see me,” he said.
He called himself an “obsessive” worker who returned to subjects repeatedly until a project was complete.
Ms. Greene, his longtime representative, said Mr. Wolf’s “intensity” gave his work its impact. For instance, he spent 13 years photographing objects found in back alleys and published them as “Informal Solutions,” a 264-page book subdivided by chapters on mops, boots, carts and gloves.
He also collected hundreds of chairs and thousands of used toys that he incorporated into gallery installations of his photography.
Michael Wolf was born on July 30, 1954, in Munich. Both his parents were artists: His mother painted and did pottery, and his father did calligraphy.
Mr. Wolf studied at the University of California, Berkeley, and, under the photojournalist Otto Steinert, at the Folkwang School in Essen, Germany. He worked as a photographer for Stern, a weekly newsmagazine in Europe, until he was 39, when he moved to Hong Kong in what he called “the throes of a midlife crisis.”
Though he would occasionally take on projects in other cities, he honed his photographic style largely in Hong Kong.
Mr. Wolf is survived by his wife, Barbara Wolf, and their son, Jasper. He is also survived by his sister, Kyra Quon.
By then he had begun wading into fine-art photography, looking for quirky details of life in crowded Hong Kong. He photographed, for example, the tools that workers stored in back alleys connected to kitchens and gloves hanging from industrial pipes and bamboo scaffolding, ballooning in the breeze as if they were disembodied hands reaching across the city.
“When foreign photographers come to Hong Kong, they often capture things they consider to be typically Hong Kong: red lanterns and the like,” Lam Yik-fei, a photographer who published the book “Hong Kong Umbrella” with Mr. Wolf in 2015, said in a phone interview. “But he would go to back alleys and photograph things that maybe even Hong Kong locals wouldn’t notice.”
After years of photographing buildings without the context of sky and horizon, Mr. Wolf spent two hours every morning shooting what he titled “Cheung Chau Sunrises,” his final tribute to Hong Kong.
Before moving there, he said, he had spent a long time pondering where to go. “The globe of the world turned in my head, and I stopped at many places and none of them somehow resonated,” Mr. Wolf said in 2009. “And at the very end I stopped in Hong Kong and everything in me said, ‘Yes.’ ”
Much of what we hear about technology these days is a grim, dystopian recitation of what tech is doing to us: We have become addicted to our screens; our every move is being watched, overheard, recorded, predicted; and malign forces are manipulating us to believe that down is up. And we should be deeply concerned about all that. But it’s also important to take stock of what tech is doing for us—how we, as human beings, have seen our agency expanded and deepened by digital tools.
Technology is a medium; sometimes it’s a humanizing, enchanting one. “Something about the interior life of a computer remains infinitely interesting to me; it’s not romantic, but it is a romance,” writes Paul Ford in his WIRED essay “Why I (Still) Love Tech.” “You flip a bunch of microscopic switches really fast and culture pours out.” To accompany Ford’s essay, we reached out to a bunch of people to ask them about the technology they love—the tools that make them better at being human. Here’s what we heard back.
Jerome Hardaway, Geek-at-Arms, Vets Who Code
As told to Gregory Barber
Shudder Streaming Service
Meredith Graves, Director of Music, Kickstarter
I have a lifelong obsession with the dark and creepy. As a little kid, I liked weird, scrompy music and unpleasant sounds. I was also obsessed with literary horror—the Goosebumps series, Scary Stories to Tell in the Dark. In third grade, I read Stephen King’s Rose Madder, which involves domestic violence and is totally not an appropriate book for that age. It was my first woman-turns-on-all-of-y’all horror novel.
Later on I got into horror movies and all the adjacent genres. I’d rummage through the dollar bins at the Salvation Army, trying to find that ultra-obscure early-’80s Italian movie that some people claimed was actually a real murder. Then, a few years ago, Shudder came about. It’s very punk how they do things. The people behind it are appealing to a community that enjoys archival stuff, that worships the low-budget and the DIY. They have an open comments section, and they use that to figure out what movies to get next. This is by us, for us, 150 percent.
Every time they put things on the site, it feels like a friend saying, “Hey, guys! I spent all last Saturday doing bong hits and finding weird horror movies on YouTube. Let me show you.” But it’s not niche, and the original content they put out offers a diversity of voices. They have a podcast that’s all about women in horror, hosted by a woman in horror. And they just released Horror Noire, the first comprehensive documentary about the history of black horror in America.
I’m an early riser. I can watch two movies on Shudder before work. When I see the notification that I’ve paid my subscription, I’m like, “Shit, yeah. That rules.”
As told to Anthony Lydgate
Colonel Enrique Oti, Director, Project Kessel Run, US Air Force
The U.S. military spends billions on IT, and I’m one of the people in charge of getting new software built and deployed. But I doubt I’ll ever build something people love as much as their free chat apps.
mIRC, our weapon of choice, is free and open source—a type of Internet Relay Chat. We started using it almost 20 years ago, and it spread organically. Now it’s at the center of how we manage just about everything, from coordinating rescue missions and strikes to monitoring the ebb and flow of combat. The technology is so ubiquitous and simple, you can almost forget its importance—until a chat server goes down. For IT, that’s a five-alarm fire.
In combat ops, it’s common to see officers with 30 chat windows open. Some will swivel their chairs between computer systems, chatting across multiple security levels with coalition partners. They’re running the wars, chat line by chat line. Lives depend on keeping information flowing, not stuck in silos. Chat is our backbone.
Outside of combat, chat apps are flattening the military’s strict hierarchy. On my software team we’ve started using more modern tools than mIRC to converse, like Slack and Mattermost. Yes, we all appreciate having #Random to blow off steam with weird news articles and programmer memes. But the main benefit is collaboration and being able to engage a generation of recruits raised on Twitter and Snapchat. Today, one of my newest airmen can ask a question in a Slack channel and see a response from a colonel in minutes. For both of us, that’s empowering. (To be clear, these are my personal views, not the official policy or position of the Air Force, DOD, or the US government.)
As told to Gregory Barber
Concordia Open Source Software
Kate Zwaard, Director of Digital Strategy, Library of Congress
Nothing tells people they belong to an institution like asking them to help out, so at the Library of Congress we built an open source software package called Concordia that allows crowdsourced transcribing. Then we set up By the People—a site that invites people to transcribe handwritten and original documents.
Transcription really called to us because it is how you get people deeply into the library’s collection. They are reading images of primary source material. They’re reading Clara Barton’s diaries, Mary Church Terrell’s papers. They’re reflecting on history.
Anybody can volunteer; one person transcribes and another person validates that transcription. The site went up in October, and 4,200 people have set up accounts. So far 43,040 images have been transcribed and more than 11,000 validated.
People sometimes ask for help, and history Twitter will jump in. There was a professor using our Letters to Lincoln collection in a class and had a hard time figuring out one of the words in a letter from a Republican club; 51 people in a social media thread worked to decipher the word pervades. Then the product of that is so exciting. We have a searchable database of text.
I do it a lot myself. Branch Rickey’s papers are just awesome. He is most famous for bringing Jackie Robinson into Major League Baseball, and through crowdsourcing we were able to transcribe 1,926 pages of his scouting reports on prospective players. I would never have guessed how fun baseball scouting reports could be! One of my favorite lines is “I doubt if he has any adventure in his soul.”
As told to Vera Titunik
Signia 7Nx Hearing Aids
Dan Kohn, Executive Director, Cloud Native Computing Foundation
I was diagnosed with mild to moderate hearing loss about 12 years ago, which is unusual for someone who was in their early thirties and had no clear cause. I had just gotten married, and I was missing some things that my wife was saying. Her voice was at the higher frequencies, where I have the most trouble. I started wearing a hearing aid a few years after that.
I run an organization that puts on the largest open source developer conference in the world. We believe in these conferences because developers are so much more productive and successful when they interact in person. But the events were always difficult for me: In addition to having trouble hearing higher frequencies, I also struggle when there’s background noise.
Just over a year ago, I switched to Signia Pure Charge&Go 7Nx hearing aids. I jokingly describe them as my bionic implants. They’re Bluetooth-enabled, and they can do what’s called beam-forming: From my phone, I can direct them to focus in on the sound coming from my right, say, or just in front of me, and reduce noise coming from elsewhere. Another magical thing about them is my phone can ring and I’m the only one who hears it.
In Copenhagen last year, I attended a conference for the first time with the Signias. I remember speaking with a senior developer from Microsoft, and it really felt different to be in that noisy environment and not have to focus on making out her words, but instead just try to connect with a human being.
The Cisco 1001-X series router doesn’t look much like the one you have in your home. It’s bigger and much more expensive, responsible for reliable connectivity at stock exchanges, corporate offices, your local mall, and so on. The devices play a pivotal role at institutions, in other words, including some that deal with hypersensitive information. Now, researchers are disclosing a remote attack that would potentially allow a hacker to take over any 1001-X router and compromise all the data and commands that flow through it.
And it only gets worse from there.
To compromise the routers, researchers from the security firm Red Balloon exploited two vulnerabilities. The first is a bug in Cisco’s IOS operating system—not to be confused with Apple’s iOS—which would allow a hacker to remotely obtain root access to the devices. This is a bad vulnerability, but not unusual, especially for routers. It can also be fixed relatively easily through a software patch.
“It’s not a trust buoy.”
Ang Cui, Red Balloon
The second vulnerability, though, is much more sinister. Once the researchers gain root access, they can bypass the router’s most fundamental security protection. Known as the Trust Anchor, this Cisco security feature has been implemented in almost all of the company’s enterprise devices since 2013. The fact that the researchers have demonstrated a way to bypass it in one device indicates that it may be possible, with device-specific modifications, to defeat the Trust Anchor on hundreds of millions of Cisco units around the world. That includes everything from enterprise routers to network switches to firewalls.
In practice, this means an attacker could use these techniques to fully compromise the networks these devices are on. Given Cisco’s ubiquity, the potential fallout would be enormous.
“We’ve shown that we can quietly and persistently disable the Trust Anchor,” says Ang Cui, the founder and CEO of Red Balloon, who has a history of revealing major Cisco vulnerabilities. “That means we can make arbitrary changes to a Cisco router, and the Trust Anchor will still report that the device is trustworthy. Which is scary and bad, because this is in every important Cisco product. Everything.”
In recent years, security-minded companies have increasingly added “secure enclaves” to motherboards. Different solutions go by different names: Intel has SGX, Arm has the TrustZone, Apple has the secure enclave. And Cisco has the Trust Anchor.
They variously comprise either a secure part of a computer’s regular memory, or a discrete chip—a safe, secluded oasis away from the bedlam of the computer’s main processor. No user or administrator can modify the secure enclave, no matter how much control they have over the system. Because of its immutable nature, the secure enclave can watch over and verify the integrity of everything else.
Secure-computing engineers generally view these schemes as sound in theory and productive to deploy. But in practice, it can be dangerous to rely on a sole element to act as the check on the whole system. Undermining that safeguard—which has proven possible in many companies’ implementations—strips a device of critical protections. Worse still, manipulating the enclave can make it appear that everything is fine, even when it’s very much not.
That’s the case with the Cisco 1001-X. The Red Balloon team showed specifically that they could compromise the device’s secure boot process, a function implemented by the Trust Anchor that protects the fundamental code coordinating hardware and software as a device turns on, and checks that it’s genuine and unmodified. It’s a crucial way to ensure that an attacker hasn’t gained total control of a device.
On Monday, Cisco is announcing a patch for the IOS remote-control vulnerability the Red Balloon researchers discovered. And the company says it will also provide fixes for all product families that are potentially vulnerable to secure-enclave attacks like the one the researchers demonstrated. Cisco declined to characterize the nature or timing of these fixes ahead of the public disclosure. It also disputed that the secure boot vulnerability directly impacts the Trust Anchor. According to its security bulletin, all fixes are still months away from release, and there are currently no workarounds. When the patches do arrive, Cisco says, they will “require an on-premise reprogramming,” meaning the fixes can’t be pushed remotely, because they are so fundamental.
“As a point of clarification, Cisco advertises several related and complementary platform security capabilities,” a spokesperson told WIRED in a written statement. “One of which that is relevant to this discussion is Cisco Secure Boot which provides a root of trust for system software integrity and authenticity. Another capability offered within certain Cisco platforms is the Trust Anchor module, which helps provide hardware authenticity, platform identity, and other security services to the system. The Trust Anchor module is not directly involved in the work demonstrated by Red Balloon.”
Cisco seems to make a distinction between its “Trust Anchor Technologies,” “Trustworthy Systems,” and “Trust Anchor module,” that may explain why it only considers secure boot to be implicated in the research.
The Red Balloon researchers disagree, though. They note that Cisco’s patent and other documentation show that the Trust Anchor implements secure boot. If secure boot is undermined, the Trust Anchor is necessarily also defeated, because all of the tools are in a chain of trust together. You can see it visualized in this Cisco diagram.
“That’s why they call it an anchor! It’s not a trust buoy,” Cui says.
The researcher group, which also includes Jatin Kataria, Red Balloon’s principal scientist, and Rick Housley, an independent security researcher, were able to bypass Cisco’s secure boot protections by manipulating a hardware component at the core of the Trust Anchor called a “field programmable gate array.” Computer engineers often refer to FPGAs as “magic,” because they can act like microcontrollers—the processors often used in embedded devices‚ but can also be reprogrammed in the field. That means unlike traditional processors, which can’t be physically altered by a manufacturer once they’re out in the world, an FPGA’s circuits can be changed after deployment.
FPGAs pull their programming from a file called the bitstream, which is usually custom-written by hardware makers like Cisco. To keep FPGAs from being reprogrammed by mischievous passersby, FPGA bitstreams are extremely difficult to interpret from the outside. They contain a series of complex configuration commands that physically dictate whether logic gates in a circuit will be open or closed, and security researchers evaluating FPGAs have found that the computational power required to map an FPGA’s bitstream logic is prohibitively high.
“This is proof that you can’t just rely on the FPGA to do magic for you.”
Josh Thomas, Atredis
But the Red Balloon researchers found that the way the FPGA was implemented for Cisco’s Trust Anchor, they didn’t need to map the whole bitstream. They discovered that when Cisco’s secure boot detected a breach of trust in a system, it would wait 100 seconds—a pause programmed by Cisco engineers, perhaps to buy enough time to deploy a repair update in case of a malfunction—and then physically kill the power on the device. The researchers realized that by modifying the part of the bitstream that controlled this kill switch, they could override it. The device would then boot normally, even though secure boot accurately detected a breach.
“That was the big insight,” Red Balloon’s Kataria says. “The Trust Anchor has to tell the world that something bad has happened through a physical pin of some sort. So we started reverse engineering where each pin appeared in the physical layout of the board. We would disable all the pins in one area and try to boot up the router; if it was still working, we knew that all of those pins were not the one. Eventually we found the reset pin and worked backward to just that part of the bitstream.”
The researchers did this trial-and-error work on the motherboards of six 1001-X series routers. They cost up to about $10,000 each, making the investigation almost prohibitively expensive to carry out. They also broke two of their routers during the process of physically manipulating and soldering on the boards to look for the reset pin.
An attacker would do all of this work in advance as Red Balloon did, developing the remote exploit sequence on test devices before deploying it. To launch the attack, hackers would first use a remote root-access vulnerability to get their foothold, then deploy the second stage to defeat secure boot and potentially bore deeper into the Trust Anchor. At that point, victims would have no reason to suspect anything was wrong, because their devices would be booting normally.
“The exposure from this research will hopefully remind the companies out there beyond just Cisco that these design principles will no longer stand as secure,” says Josh Thomas, cofounder and chief operating officer of the embedded device and industrial control security company Atredis. “This is proof that you can’t just rely on the FPGA to do magic for you. And it’s at such a low level that it’s extremely difficult to detect. At the point where you’ve overridden secure boot, all of that trust in the device is gone at that point.”
Even Bigger Problems
Thomas and the Red Balloon researchers say they are eager to see what types of fixes Cisco will release. They worry that it may not be possible to fully mitigate the vulnerability without physical changes to the architecture of Cisco’s hardware anchor. That could involve implementing an FPGA in future generations of products that has an encrypted bitstream. Those are financially and computationally more daunting to deploy, but would not be vulnerable to this attack.
Lily Hay Newman covers information security, digital privacy, and hacking for WIRED.
And the implications of this research don’t end with Cisco. Thomas, along with his Atredis cofounder Nathan Keltner, emphasize that the bigger impact will likely be the novel concepts it introduces that could spawn new methods of manipulating FPGA bitstreams in countless products worldwide, including devices in high-stakes or sensitive environments.
For now, though, Red Balloon’s Cui is just worried about all of the Cisco devices in the world that are vulnerable to this type of attack. Cisco told WIRED that it does not currently have plans to release an audit tool for customers to assess whether their devices have already been hit, and the company says it has no evidence that the technique is being used in the wild.
But as Cui points out, “Tens of thousands of dollars and three years of doing this on the side was a lot for us. But a motivated organization with lots of money that could focus on this full-time would develop it much faster. And it would be worth it to them. Very, very worth it.”
Distributed system design is hard. There are many decisions that you need to make in the architecture early that have long reaching impacts. One of these decisions is how systems will communicate.
Will components expose RESTful APIs?
Will they interact with a messaging system (e.g. RabbitMQ, NATS, Kafka)? GRPC?
How will they share responses?
I think that communication roughly falls into two schools: point to point and message bus.
In an architecture driven by a message bus it allows more ubiquitous access to data. The consumers are allowed to determine how they will consume the data. It is not something decided by the sender. The power created by decoupling the producer and consumer, far outweighs any operational overhead introduced. Point to point is easier in some ways, but it silos the data off from the rest of the system. This can be a perk, security and isolation for instance, but building these walled gardens of data will hurt innovation, development pace, and monitoring in the long run.
Often systems will use a hybrid of the two communication styles. For instance, we have a service that will take commands from a message bus, but are provided a callback URL where they can funnel the responses. It could have easily been that we just send messages back on the bus. We chose the hybrid approach because it fit the existing architecture better. We could have also stood up a proxy/load balancer that would have distributed the messages but looked like a single instance.
In point to point, you’ll communicate between services directly. For instance, you’ll POST metrics directly to an endpoint, or funnel logs, or request an action. For scalability, you’ll often need to consider having multiple instances supporting that endpoint. To do this you’ll have some kind of load balancer or proxy. Setting up an maintaining proxies can be cumbersome, but they also provide a huge amount of power. Usually, you also have to address service discovery earlier in the system design.
Using load balancers to distribute load across multiple instances, is very helpful, arguably essential when designing the system. Once in place it allows you to easily load multiple services into a box and provide a consistent port signature. However, the most powerful feature is the ability to fail an instance out of the load balancer. This allows the running production instance to stay running for troubleshooting while not compromising the integrity of the whole system. This flexibility is invaluable when you have a lot of services collaborating on a single logical request.
The biggest drawback of a point-to-point communication structure is that the data is silo’d in the ecosystem from which it originates. The creator of the information determines how the data is used, by sending that data to a single point. This means that new crosscutting capabilities have to go fundamentally highjack that communication channel. They have to man-in-the-middle the receiver to get access to that data. Simple things like ‘how many requests is that service getting’ have to be built in and can’t be added afterwards.
Using a message bus will allow for the same communications, but it’s a little more simple. Single request/reply, worker pool, and broadcast models are supported out of the box. Service discovery is a matter of just sending messages to the right topics. There is an operational cost of maintaining the message bus, and possibly having a piece of infrastructure that impacts all services. But, all the production grade buses support clustering, but still things can go wrong and it can lock the whole system up (looking at you RabbitMQ).
The primary benefit of a message bus architecture is that data is freely available. Services just provide data and don’t mandate how it is used. You still have the necessary coordination in developing a system; part a generates messages like this and part b will do that. But now you can have any new service start non-destructively consuming those messages. This free flow of data allows for rapid prototyping, simple services crosscutting, intuitive monitoring and easier development.
As an example you can look at how Netlify collect metrics from across the system. Each of our services has a message bus connection logging, command & control, and metrics. We knew that each of the services would need to be pushing out metrics (read: counting things), but we weren’t sure where we would be storing them. Because the data was just on the bus I could easily create a few different services that took the data and pushed it to different storage engines. I was able to quickly side-by-side influxDB, redshift, dynamo and a 3rd party system with no modifications to the actual services. I built some quick command line utilities to tap into streams and run little experiments (e.g. validating counts, debugging, monitoring throughput).
All of these experiments are developed independently as I needed them. This flexibility let me ask a question and quickly answer it without potentially impacting the actual service. I could quickly look at real production data to answer any questions that came up. All of those perks is because the data wasn’t walled off, anyone with access to the message bus (which is secured) could look at the data without impacting other services.
Without a load balancer it is more difficult to leave an instance running but not communicating with the system directly. It requires specific code and for the end user to build this, not just configure the load balancer. There are also security concerns, once on the bus a consumer can start listening to data very easily. Enterprise messaging systems sometimes provide out of the box ACLs, but it is not in everyone. I would contend that this ease of access is far more valuable and worth the security considerations.
Communicating between components
There are a handful of ways to design communication systems in a distributed system. An architecture with a message bus as a core feature is very powerful. The decoupling between data creation and data consumption is invaluable in a growing system. New services can easily collaborate using the bus, and service agnostic tools (e.g. a message tailer) can interoperate easily. Point-to-point systems have some clear perks, but I think they’re outweighed by the capabilities created by a message bus.
Coordinating disparate systems is complex to say the least, designing how they communicate is vital to there success. But, which school is best for your system? As is always the case with engineering, the answer is “it depends”. Hopefully this helps you qualify which is the best for you.
Hexbyte News Computers Gillette-based Cloud Peak Energy filed for Chapter 11 reorganization
By Associated Press //
GILLETTE, Wyo. – The nation’s third-largest coal company by production volume filed for bankruptcy Friday as utility companies increasingly turn to gas-fired generation and renewable energy for electricity.
Gillette-based Cloud Peak Energy filed for Chapter 11 reorganization in U.S. Bankruptcy Court in Delaware. The move was widely expected since at least March, when the company received the first of several extensions to make a $1.8 million loan payment.
The latest extension expired Friday.
Cloud Peak owns and operates three mines in the Powder River Basin: the Antelope and Cordero Rojo mines in Wyoming and the Spring Creek Mine in Montana.
The mines shipped 50 million tons of coal in 2018. Cloud Peak officials say the mines will remain in operation during the bankruptcy process.
Last Wednesday we reported that bitcoin had risen to $6,000 for the first time this year. On Monday, just five days later, bitcoin reached a new 2019 high of $8,000. As I write this one bitcoin is worth about $7,900.
Of course, bitcoin reached much higher levels in late 2017 and early 2018. Bitcoin’s current price just under $8,000 is less than half the all-time high of $19,500 set in December 2017. Bitcoin was last worth at least $8,000 in July 2018.
As often happens, bitcoin’s rise is part of a broader cryptocurrency boom. On Saturday, the price of ether—the currency of the Ethereum network—rose above $200 for the first time in 2019. Other cryptocurrencies, including Litecoin, Bitcoin Cash, Monero, and Dash are at or near 2019 highs.
Still, bitcoin has outpaced all of these alternative cryptocurrencies in recent weeks. Bitcoin’s price has doubled just since late March.
Attackers have been exploiting a vulnerability in WhatsApp that allowed them to infect phones with advanced spyware made by Israeli developer NSO Group, the Financial Times reported on Monday, citing the company and a spyware technology dealer.
A representative of WhatsApp, which is used by 1.5 billion people, told Ars that company researchers discovered the vulnerability earlier this month while they were making security improvements. CVE-2019-3568, as the vulnerability has been indexed, is a buffer overflow vulnerability in the WhatsApp VOIP stack that allows remote code execution when specially crafted series of SRTCP packets are sent to a target phone number, according to this advisory.
According to the Financial Times, exploits worked by calling either a vulnerable iPhone or Android device using the WhatsApp calling function. Targets need not have answered a call, and the calls often disappeared from logs, the publication said. The WhatsApp representative said the vulnerability was fixed in updates released on Friday.
The FT, citing the unnamed spyware technology dealer, said the actor was NSO Group, which was recently valued at $1 billion in a leveraged buyout that involved the UK private equity fund Novalpina Capital. NSO Group is the maker of Pegasus, an advanced app that jailbreaks or roots the infected mobile device so that the spyware can trawl through private messages, activate the microphone and camera, and collect all kinds of other sensitive information.
The WhatsApp representative told Ars that a “‘select number of users were targeted through this vulnerability by an advanced cyber actor. The attack