Chinese Cyberspies Appear to be Preparing Supply-Chain Attacks

First and foremost, attackers appear to favor spear-phishing individual targets, preferring to collect credentials and then entering accounts without utilizing malware for establishing an initial foothold.

We have observed spear-phishing campaigns that target human resources and hiring managers, IT staff, and internal information security staff, which are generally very effective,” 401TRG experts said about the 2017 campaigns.

Hackers focus on collecting network credentials and then spreading laterally inside a company.

Attackers then use a technique known as “living off the land,” which refers to the use of locally installed apps for malicious purposes. Tools often used in these intrusions include standard Windows utilities, but also penetration testing utilities such as Metasploit and Cobalt Strike. Malware is only deployed if necessary, attackers fearing detection, which often implies losing their foothold on a target’s network.


First, don’t forget the ‘supply chain’ isn’t just raw materials or parts or assemblies or their ilk. It’s the HVAC and fish tank maintenance companies, too.

I like the phrase LotL (“Living off the Land”). I think, tho need to check, it translates well.

Tl;dr: Orgs with strong security & defense-in-depth can still harbor blind spots & inaccurate assumptions.

Continue reading

Shinjuku, Tokyo, Japan

Also on:

The Trouble With OneNote and Evernote

My solution for replacing these proprietary and, in the end, dangerous-to-use services is the same as Voit’s: switch to Org mode. Unlike OneNote and Evernote, Org runs on your own machine, is open source so it will always be there for you, and, most importantly, stores its data as plain text [In this context, “we” means the community of Emacs users, of course., ed]. The data is readable by any application that knows about text.

Voit makes the case for Org mode in his post but by now we [In this context, “we” means the community of Emacs users, of course., ed] should all be familiar with it. For most of us, what’s required is to import any data we care about into Org so we no longer have to worry about what third parties are planning to do with their products.


Karl Voit has a great site for Emacs and Org-mode users, but also things generally open-source. I came to the same conclusion he did, just sooner.

I was an Evernote user and subscriber back in the day, but their increased fees with lesser functionality and the difficulty getting data out of their semi-walled garden was too much. Evernote also had platform inconsistencies I can’t recall specifically but I think there were some features only available on Mac.

I moved to OneNote, which clearly reached its pinnacle w/ 2016. The Metro/UWP/Win10 version paled in comparison as did the Mac version. When it became clear the Mac version would remain feature incomplete, especially the inability to have a local OneNote notebook I moved off.

Org is my primary exocortex now. The only major things I can’t do right now are:

  • Capture hand-written text or drawings

  • iOS version

I’m overcoming the latter using Drafts 5: Capture ‣‣ Act on iOS with some scripting and maybe some Pythonista 3 & Workflow stuff. Some Drafts 4 (Legacy Version) may still be needed. It relies right now on Dropbox as the sync engine but I hope to move to git/GitHub/Working Copy soon. I hope to publish my work and workflows this week (Golden Week 2018).

丸曽ビル, Shinjuku, Tokyo, Japan

Also on:

I’m debating the best mobile solution for Emacs for me. My main driver is org-mode, of course.
* File sync for configuration and org-mode
* Power management (battery life)
* Portability (weight, size, profile)
* Display quality (readability, sharpness of text)
* Keyboard (Japanese JIS, shortcuts)
* Inputs (USB, Bluetooth, on-screen keyboard), outputs (micro-Display Port|USB C|Micro USB|mini-Display Port), and network (wifi, Ethernet [via USB], cellular)
* Non-native integrations like pandoc, PDF-tools If I go with a primarily tablet solution, it will have to be Android or some other non-iOS option. If I go with a primarily laptop|ultrabook|netbook solution it has to have a good Japanese keyboard.

On iOS, Drafts seems an interesting option.

Also on:

Another Take on Engineering Notebooks:

Kleiman’s post can be useful for a wide range of users. The main takeaway, for me at least, is that your tools and specific procedures are not as important as organizing your data and scripts and keeping careful notes on what problem you’re trying to solve and the steps you’ve taken to solve it.

(Via Emacs – Irreal)

Here is the original article that kicked this off. As I’ve been trying to simplify my workflows to better manage my data my thinking has informally been tending toward what Dan Kleiman wrote. I don’t have code any more, replaced by the constant flood of documentation coming my way for various projects. Something like this could would for me with a few small changes.

Language/Editor Integration:

Articles about Org mode almost always make the point that Org documents are plain text and can be edited with any editor. That’s true and it’s part of what gives Org its power.

On the other hand, just because you can edit Org mode documents with any editor doesn’t mean you should or would. Who, other than in an emergency, would do such a thing1? One reason not to do so is, of course, that Org mode runs in the Emacs lisp interpreter so you can’t get agendas, generate reports, use the spreadsheet functionality, or a host of other things in other editors.

A more subtle reason, though, is that the Org language is integrated with the Emacs editor.

(Via Emacs – Irreal)

I agree … but …

I don’t have a universal Emacs device. I use Orgzly on Android [F-Droid & Google Play] and beorg on iOS for tasks and agenda stuff when I’m mobile which fill the gaps a bit. I use Termux on Android [F-Droid & Google Play] for a more full-featured Emacs experience. And of course I have Emacs on my MacBook Air, my MacMini, and my Surface Pro 4.

There is a capture gap that still needs addressing. Then, manipulating that which has been captured.

I don’t have a good solution, but I know that this is not (directly) an Emacs issue. And it should not be a Gnu Emacs issue, because RMS won’t let it be. Too many compromises would need to be made in order to facilitate an “official” macOS Share Sheet for Emacs, for example.

Scale All Emacs Windows for Presentations:

If you use Emacs in or for your presentations, here’s a nice tip from Robin Green on how to scale all the windows up for better presentation:


You’ll have to load Drew Adams’ zoom-frm.el but if you give a lot of presentations where Emacs and its buffers play a significant role, you may find it worthwhile and helpful.

(Via Emacs – Irreal)

I don’t use Emacs for presentations but I wish I did. Maybe it will be my next project? Who knows?

This is a great tip anyway. For example, when I lose or break my glasses, insane zoom will be the only way I can read my Emacs.

So there’s this:

On Thu, Jan 4, 2018 at 12:59 AM Shiyao MA <[email protected]> wrote:
>  Hi,

>  is there a plan to move org elpa from http to https?

It’s already https: …

From “[O] is there a plan to move org elpa from http to https?” on

The instruction page referencing installation via Org ELPA is updated: Basically you edit your entry in your init file from http:// to https://, such as …

(add-to-list 'package-archives '("org" . "") t)

Get you some TLS!

Linux Journal on Scimax:

Over at the Linux Journal, Joey Bernard has a nice article on John Kitchin’s scimax. I’ve written about scimax before but for those who came in late, it’s a collection of Emacs and Org mode tools to make using reproducible research methods for performing and writing about research easier.

If you’re doing research and especially if you’re publishing your results you really should check out scimax. A good way to see what it can do for you is to take a look at its manual or by watching Kitchin’s video

(Via Emacs – Irreal)

I love the stuff John Kitchin has come up with. Bits and bobs can work in your config even if you’re not doing research. 

Sorting Org Mode lists using a sequence of regular expressions:

I manually categorize Emacs News links into an Org unordered list, and then I reorganize the list by using M-S-up (org-shiftmetaup) and M-S-down (org-shiftmetadown). I decide to combine or split categories depending on the number of links. I have a pretty consistent order. John Wiegley suggested promoting Emacs Lisp and Emacs development links at the top of the list. I like to sort the rest of the list roughly by interest: general links first, then Org, then coding, then other links at the bottom.

(Via Emacs – Sacha Chua)

I always look forward to Sacha’s weekly Emacs News articles. She always finds one or two things I find interesting.

I’ve often wondered how she puts it together, and now I know. I might have a use for her method and code at work. Hmm …