We live in a digital world with a false sense of security. While watching Blade Runner 2049 I smiled during a scene near the end where Deckard says to K, “What Have You Done?!?!?” I expect that this false sense of security will still exist in 2049 if humans manage to still be around.

The first big piece of security news this weekend was ‘All wifi networks’ are vulnerable to hacking, security expert discovers. It only a Severe flaw in WPA2 protocol leaves Wi-Fi traffic open to eavesdropping, but, well, that’s most Wi-Fi networks. If you want the real details, the website Key Reinstallation Attacks: Breaking WPA2 by forcing nonce reuse goes into depth about KRACK Attacks. And yes, KRACK is already up on Wikipedia.

Here’s the summary, which is mildly disconcerting (that’s sarcasm if you missed it …):

The weaknesses are in the Wi-Fi standard itself, and not in individual products or implementations. Therefore, any correct implementation of WPA2 is likely affected. To prevent the attack, users must update affected products as soon as security updates become available. Note that if your device supports Wi-Fi, it is most likely affected. During our initial research, we discovered ourselves that Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys, and others, are all affected by some variant of the attacks. For more information about specific products, consult the database of CERT/CC, or contact your vendor.

I was cruising along in my naive security bliss this morning when I saw the article Millions of high-security crypto keys crippled by newly discovered flaw. It turns out that a key RSA library that is widely used has a deep flaw in it and has been being used to generate weak keys since 2012.

A crippling flaw in a widely used code library has fatally undermined the security of millions of encryption keys used in some of the highest-stakes settings, including national identity cards, software- and application-signing, and trusted platform modules protecting government and corporate computers.

The weakness allows attackers to calculate the private portion of any vulnerable key using nothing more than the corresponding public portion. Hackers can then use the private key to impersonate key owners, decrypt sensitive data, sneak malicious code into digitally signed software, and bypass protections that prevent accessing or tampering with stolen PCs. The five-year-old flaw is also troubling because it’s located in code that complies with two internationally recognized security certification standards that are binding on many governments, contractors, and companies around the world. The code library was developed by German chipmaker Infineon and has been generating weak keys since 2012 at the latest.

I’m sure there will be a lot more written about each of these flaws in the next few days. I expect every security vendor is hard at work this morning figuring out what to patch, how to do it, what to tell their customers, and how to get all the patches out in the world as fast as possible.

The constraint, of course, will be on the user side. A large number of customers of the flawed products won’t update their side of things very quickly. And many more bad guys now have a very clear roadmap for another attack vector with high vulnerability.

Be safe out there. Well, at least realize that whatever you generate digitally isn’t as safe and secure as you might think it is.

Also published on Medium.

October 15, 2017

My partners Chris Moody, Seth Levine, and Lindel Eakman are all blogging right now. My other two partners, Ryan McIntyre and Jason Mendelson have blogged in the past, ut took a break in 2017. Also, the Foundry Group blog is always active, with occasional thought pieces but mostly updates on initial financings both for companies and other funds that we invest in.

So, I thought I’d point you at Moody, Seth, and Lindel’s blogs (and some posts) in case you are interested in following more of what we are doing at Foundry Group.

Moody’s recent post Two Steps Forward, One Step Back talks about being a few months into his gig as a VC, after his announcement of his transition from operator to VC in Joining Foundry Group.

Seth has started a Friday series named Friday Fun because the world needs more fun. His longer thought pieces like The Feature -> Product -> Company Continuum, How to value your SaaS company, and Reading Your VC Pitch Meeting are must-read posts for me – and for every founder and company executive. Also, Seth’s not afraid to be very personal and open, as he shows in his post Drowning.

Lindel is getting into a grove with posts like Saying “No” too often is part of being a good investor, Mi Casa Es Su Casa – How we seek to interact with our family of GPs, and Venture Risk and Return circa 2017. Very few LPs blog, so it’s neat to add Lindel’s perspective as a fund investor into the mix.

If you are following and reading me, I encourage you to follow and read my partners to get the full view of how we think about things at Foundry Group.

Also published on Medium.

On October 19th, Engage Boulder is hosting a breakfast with me from 7:30am to 9:30am to discuss the past, present, and future of Boulder. I’ve lived and worked here since 1995 so I’ve seen, and be involved in, a lot of the evolution of our city over this period of time. I’m hoping to have a thoughtful and open conversation about a lot of the issues that are coming up around our local election. If you are interested, please join us.

Recently, the Daily Camera did an excellent series of profiles on the fourteen candidates running for the five open Boulder City Council positions. I recently endorsed five specific people: Jan Burton, Eric Budd, Jill Grano, Mark McIntyre, and Bill Rigler. Following are excellent profiles from interviews with each of them that I encourage you to read to get to know them, and their viewpoints, better.

Jan Burton: Bring smarter budgeting of time and money to Boulder

Eric Budd: Tech-savvy new urbanist wants younger voices in Boulder politics

Jill Adler Grano: Real estate pro pushes new ideas for Boulder zoning

Mark McIntyre: Boulder is changing, should continue to innovate

Bill Rigler: Lone renter on Boulder ballot says better public process within reach

Our local election, like our recent national election, has had some extreme animus creep into it. It’s not my nature to engage with what I view as irrational and ad-hominem hostility, especially when I view it as disingenuous. So, I was happy to see the Editorial by Dave Krieger, for the Daily Camera editorial board, call some of this out in a measured way. It’s worth a read, but listed are a few of the key statements.

“We came away convinced that Boulder will be in capable hands no matter which five of the 14 are elected. We think some of the fear-mongering that has already appeared in the campaign verges on the ridiculous.”

“We think today’s Boulder is a vibrant, bustling small city known nationally for the cutting-edge research of its university, federal labs and high-tech sector, but struggling to maintain its historically funky feel due to soaring property values and creeping gentrification. So we endorse forward-looking candidates seeking innovative ways to keep Boulder from becoming a gated community of wealthy white folks. We think this is what “progressive” means in the 21st century.”

“We do not share the view that Boulder is going to hell in a handbasket. There is no question it has undergone a growth spurt since the last recession, in part based on pent-up demand from that slowdown. It could have done a better job encouraging creative design of new buildings that better fit their surroundings. We have high hopes that a new planning director, in concert with a new council, may improve this process.”

“Colorado’s growth appears to be slowing, which may allow everyone to take a breath and lower the civic temperature. Boulder has too much going for it to engage in a divisive war choosing among a strong slate of City Council candidates.”

If you are game to have a calm and constructive conversation around this, please join me for breakfast on 10/19.

Also published on Medium.