auto-erotic schadenfreude when discussing the history of conflict in the middle east to answer the question of "why Iran?"

some shrouded fear mongering surrounding the notion of digitizing machinery, which is better characterized by pr0f (featured) who says gross-incompetence, rather than technical prowess of a malicious actor, are the fault of most of these kinds of vulnerabilities. E.g. "No one wants a control system to lock out an operator who mistypes a password a few times in a a state of panic," – wrong. People who are concerned with security require that to be the case. Be better, accessibility is inherently opposed to security; if you are a private firm you can pick one, if you are a SCADA systems admin responsible for public infrastructure, you have to pick security.

N.B. that the author's skeptical remarks fall in the longest chapter of the book detailing very real incidents of cyber terrorism/the possibilities thereof.

Chapter 12, "A New Fighting Domain," is my favorite – talking about the history of cyber warfare in general, and the coordinated effort required in the e.g. the U.S. government to maintain a robust defensive posture, while also not torching all your ow zero-days and exploits. Also some interesting citations regarding the NSA's activities include targeting a Belgian telecom company (wtf are we doing messing with Belgians).

Where the front half of the book is a very strong presentation of history, technical detail that manages to remain accessible and accurate, I think the back half of the book struggles to maintain organization, and I started to find myself griping with the authors choices, presentation, and sight. Many details are relegated to footnote status seemingly because Zetter doesn't want to interrupt the narrative flow – and in doing so, the book is like secretly 475 pages because so much information is packed into the margins in 8pt font. Additionally, some cracks on Zetter's command of the technical aspects of the exploits being discussed start to show:

• "no one wants a control system to lock out an operator who mistypes a password a few times in a state of panic"

• "Sometimes C++ could produce compiled code that was unpredictable and executed in unintentional ways. So the attackers had chosen C instead." – this is a blatant mischaracterization of something purportedly surmised by the inventor of MSFT's Security Essentials program… Anyone remotely familiar with either language would cock an eyebrow at this statement, so I wonder how it made it out of the first draft…. Unless, as I became increasingly convinced of as the footnotes piled up – Zetter has drank her own Kool-Aid in taking the statements made by others at face value.

• "The researchers tried to follow the trail, but after hitting three different proxies in a row each time, they figured they'd never reach the end of the trail, and gave up." – I probably hit at least three proxies before I even make it out of my ISP's domain… Again I'm inclined to think Zetter misunderstood what was said by the interviewee

• (referring to hashing something 10k times with MD5) "But the complex encryption scheme used for Gauss's payload ensured that the warhead remained locked in an impenetrable vault that no one could break." – proceeds to describe how it was cracked. Like wtf, the precision of language has severe meaning when talking about security, and throwing around absolutes like this betrays a lack of ethos.

• "domain name of a computer" – presumably means hostname

• referring to Gödel as a cryptographer is like calling a Swiss Army knife a bottle opener

I think the book would benefit from a coherent timeline, diagrams, and maybe even some code snippets (as appendices) for the curious. As currently presented, it reads like a journalist's take on a bunch of other primary sources. I think the target audience would actually benefit from just reading Langner and Albright directly, rather than the anachronistic, confusing, and occasionally just wrong narrative presented by Zetter as she tries to capture a Michael Lewis-Esque voice. Contributing to the journalistic ethos is that she presents statements made by officials such as Gates, Cartwright, Alexander, Clinton, Bush, Obama, and their Iranian counterparts as fact, after presenting 400+ pages about how these people will fucking lie through their teeth about anything and everything to cover their asses, it's painfully ironic.

Some fun quotes include:

• "before you get too excited about this 'target-rich environment,' remember General Custer was in a target-rich environment too!"

• "'I don't really like mindless vandalism. It's stupid and silly. On the other hand, so is connecting interfaces to your SCADA machinery to the internet."

• "PLCs were promiscuous computers that would talk to any machine that spoke their protocol language"

• "But it's a government model that relies on keeping everyone vulnerable so that a targeted few can be attacked – the equivalent of withholding a vaccination from an entire population so that a select few can be infected with a virus"

• "Under Article 24 of the UN Charter, nations can respond to an act of force only with no forceful countermeasures…. [slyly followed by] Under Article 51, however, every state has the right to defend itself with lethal force."

Political observations:

• Why the US was targeting random Belgian telecom companies

• Israelis assassinating Iranian scientists, especially under a regime that was not popularly supported, in front of their children and in ways that endangered other civilians with motorcycle bombs is vile.

• "Upon his appointment as head of Mossad in 2002, then-Prime Minister Ariel Sharon crudely praised him [Dagan] for his skill at separating Arabs from their heads."

• "'that the first acknowledged military use of cyber warfare is ostensibly to prevent the spread of nuclear weapons. A new age of mass destruction will begin in an effort to close the chapter from the first age of mass destruction'"

• "'If you come out with a policy that subverts MSFT certificates, subverts Windows Updates to spread malware, it's difficult to get yourself to a position where cyber space is safer, more secure and resilient. In some ways, I feel like the Fort Meade crowd are the Israeli settlers of cyber space – it doesn't matter what the official policy is, they can go out and they can grab, these hills, and they're changing the facts on the ground.'" – Jason Healy

related