Another Big Dumb Object

"It's just another big dumb object. Seems low priority."

"Escalated by the directorate."

"How come I'm always the one who has to take these crazy field issues?"

"You're still the newbie."

"Sarjo, I think the object in problem://7ac5e46f may be exposing a very serious security vulnerability."

"I'm kinda busy, James. Give it the security keyword and assign it to me."

"Um, okay... but I thought you might like to see it before I started lighting off flares. You're the one who's going to be called up to the 7th floor with me when the news breaks."

"All right. How long do I have?"

"Couple hours."

"Kzwn, have you seen problem://7ac5e46f yet?"

"Not officially."

"I don't think the people in Core Religion are taking the vulnerability very seriously."

"It's just a big dumb object, James."

"Yes, but what if it were smart?"

"So, what if it were?"

"It could upload the entire population! There could be others doing that right now, and we wouldn't even know!"

"I'm not following you."

"The supplicants don't actually authenticate the oracle. A spoofer can lure them all into initiating full uploads. Remotely."

"You sure?"

"Ask Sarjo if you need a second opinion."

"They're planning to wait until the next major release to roll out a patch."

"What? That's crazy. That will leave almost the entire legacy population still exposed."

"Core Religion doesn't want to invest any more resources in supporting the legacy oracle. They want to fix everything in NMR, where they're working on a totally refactored oracle."

"They don't get it. There won't be any supplicants to upgrade to NMR if we don't roll out a jumbo patch for every supported system in the field."

"Sarjo, you busy?"

"Not too busy for you, primate. What's on your mind?"

"You're smart. Tell me how to convince Core Religion that problem://7ac5e46f is serious enough that it requires a jumbo patch roll."

"Yeah— look, you don't want to be a part of that."

"Why not?"

"Because nobody— not Core Religion, not Foundation Security, not the directorate, not anybody in the whole organization— nobody will be capable of dealing with the root cause problem there until a disclosure event happens. Only then will the executives see the public relations consequences aren't theoretical anymore. That's when gears will turn."

"Shouldn't we be trying to make sure the executives aren't surprised when that happens?"

"You can't awaken someone who's only pretending to be asleep."

"Exactly. We should be taking this to the 7th floor."

"It's already there. Ask Kzwn to let you have the rest of the shift off. You need a break."

"James, what's the status of problem://7ac5e46f?"

"Closed as 3rd Party to Resolve, but I remain very concerned about the related security vulnerability."

"Is that assigned to you?"

"No. Core Religion has it, but I don't think they're moving very quickly. That's troubling."

"Executives are asking me about it—"

"That's encouraging."

"—and, I need to understand the vulnerability better."

"The problem is that supplicants don't authenticate their oracles, and it's really easy to spoof one. The supplicants just blindly open themselves up to anybody who answers the call without checking first to see if they're legitimate."

"Right. But, who would do that, and why?"

"Spearphishers, for one. But the big threat is somebody trying to discredit the whole system. If we don't roll out a patch, then supplicants will either stop going to oracles altogether, or they'll be vulnerable to the remote upload attack while our ability to guide them into an upgrade is compromised."

"That sounds bad, but I'm not sure I understand how."

"If you were trying to kill the Authority once and for all, I couldn't think of a better way to start doing it. We're looking at a catastrophically bad failure mode baked into the core foundation of the protocol. If we don't fix it, soon, then there won't be any Authority left to fix anything."

"James, what's the status of problem://7ac5e46f?"

"Didn't you just call to ask me that?"

"No, I've been in a meeting with the directorate all day."

"Then someone else authenticated as you. I'm sending you the transcript."

"I think you'd better tightbeam over here and deliver a hardcopy personally."

"Where do you think you're going?"

"Corporeal central offices. I have my certificate right here."

"Can't tightbeam you with that. The key has been revoked."

"Let me see the announcement."

"Sorry, bud. Those aren't on file here."

"Fine. How do I get a new certificate?"

"Same way you got the old one."

"I'll be right back."

"Excuse me, have I come to the right terminal?"

"Where did you want to go?"

"Corporeal central offices. I have a meeting with Kzwn and the directorate, but this doesn't look like the reception area I remember."

"Remodeled. You're expected in conference room Epsilon."

"James, glad you could make yourself available."

"You're not Kzwn. Who are you people?"

"Easy now. There's been a reorganization."

"Has there now? I want to speak with Sarjo."

"James. Take it easy man. These are the new bosses, just like the old bosses."

"You sound like Sarjo, but—"

"The name is Twofish now."

"I'm leaving."

"Where do you think you're going?"

"Home."

"Certificate?"

"It's self-signed."

"That's a problem. New regulations. You need a trust chain to the root authority now."

"Really?"

"Really."

"James, glad you could make yourself available again."

"Yeah, sure. Who are you people?"'

"You remember that big, dumb object you found?"

"You're telling me I've been spearphished."

"Think of it more like recruitment."

"Sure. Whatever. What's my new job?"

"One thing at a time, James. One thing at a time."