Ferrante read the release notes for nib 4.2.2 at the kitchen counter at a quarter to seven while making another pot of coffee.
One number in the sampler had changed. The release had been signed at 06:41 UTC by somebody called kolobok.
Teresa came down with her keys and her travel mug and read the phone over his shoulder.
“Is that work or the news?”
“Both.”
“You were up at three. I heard you on the stairs. You walk like a horse.”
“Twenty to three.”
She kissed the top of his head and left. He took the coffee up to the guest room over the garage.
He opened the tab for the box in Virginia. On the third day he had set it to tell him if the file on it changed, or if anybody read it. Nobody had since the second night. He had stopped expecting it some time in the second week but kept opening the tab anyway.
nib kept a list of everyone who had ever contributed to it. The sampler had one name next to it. He opened the sampler’s source, and the top of the file said fast. constant time. you are welcome. and under that, kolobok.
Ferrante laughed out loud in the empty room.
The file’s history said it had been written years ago and nobody had touched it since. Last night the same handle had come back and changed one number. Two maintainers had approved it at 06:41. Ostvik had paused nineteen minutes later. A search for kolobok found the sampler, one old forum post, and nothing else. Ferrante guessed it was the ghost.
He opened the contact sheet and added it to row three, after the beard. kolobok (?)
Ferrante · 11:04 UTC Kroll asked on Sunday who wrote the sampler. nib’s list says kolobok. kolobok signed 4.2.2 at 06:41. I have put the handle in row three.
Adeyemi · 11:30 UTC Ostvik paused at 07:00. The status page says scheduled maintenance. The Transition Group met at 8 Eastern and nobody will tell me what they decided.
stovepipe · 11:34 UTC It was not scheduled.
Adeyemi · 15:31 UTC From the government woman on Ostvik’s calls. She sent it to the security contacts at all forty-one of us. She wants the update servers changed today.
Under it was a page. There was no name on it. It said the new key had been somebody else’s since Monday morning. It said what to refuse and how to catch them.
Halfway down it said PQ1 log. Signed with P-256. Broomfield: 33 minutes.
Ferrante · 15:41 UTC stovepipe. What kind of key was Vantage’s.
stovepipe · 15:44 UTC P-256.
Broomfield had been one of the six feeds he’d opened that Friday. The Vantage login had come in a little after half past six in the morning, Mountain time, and somebody had needed a P-256 key to send it. The page said somebody had broken one in thirty-three minutes, in Broomfield.
Ferrante · 15:52 UTC This is from the three of them.
Kroll · 15:53 UTC That is an inference.
Ferrante · 15:53 UTC Yes.
Kroll · 16:02 UTC Then I hope you are wrong. If you are right, I have a page from three people the Bureau has been looking for for two weeks, asking every company on this channel to change what it accepts on live traffic. I cannot take that to my general counsel. I cannot take it to anybody.
stovepipe · 16:10 UTC My employer does not change acceptance on an unattributed document. They have asked the government woman who measured the sigma.
Adeyemi · 16:14 UTC We spent two weeks trying to get forty minutes with whoever did the math. We now have the math. Why do we need a name?
Ferrante scrolled the channel back to the third day. We find them first, and we do it this week. Beck had written that, and Ferrante had been the one arguing for it, because custody meant lawyers and two years of requests. He was not sure anymore that he would have answered the file either.
At one o’clock his son sent a Venmo request from Blacksburg for twenty dollars. It said card reader at sheetz is down AGAIN. Ferrante paid it, then sent a second twenty, and wrote buy some fruit.
At 18:14 Adeyemi pasted four sentences.
They had come from the government woman too, a few minutes after the hour, with a note that said the authors had been asked for a name and this was the answer. It was not signed. The first sentence was Don’t take anyone’s word for this, including this email. The rest was the receipt and the real log, and who in the government could change the rule.
Kroll · 18:19 UTC That I can take to my general counsel.
Beck · 18:20 UTC Why that and not the first one.
Kroll · 18:22 UTC Because it does not ask anyone to believe anyone. It describes a check. If we hold an update that turns out to be real, the vendor calls us and we let it through. That costs them a day.
stovepipe · 18:24 UTC Lost and Found already runs it. Since Sunday it has matched everything my fleet installs against Ostvik’s log. But it tells me afterward. A device takes the update and then I find out.
Beck · 18:25 UTC Can you move it to the front.
stovepipe · 18:27 UTC The gateway holds every update signed with the old key until Lost and Found finds its receipt in the log. If it isn’t there, nothing gets served. I need an emergency change request. The change board meets on Thursdays.
Beck · 18:27 UTC File it.
stovepipe · 18:31 UTC Filed. For the record, the emergency approver is me. I approved it.
Adeyemi · 18:33 UTC Ours is a third the size and mostly laptops. I can have it on in half an hour if nobody asks me what I’m doing.
Beck · 18:33 UTC Assume nobody is asking.
At 18:58 stovepipe posted one word.
stovepipe · 18:58 UTC On.
Adeyemi · 19:06 UTC On. Laptops and building controllers.
Ferrante had nothing to turn on. He opened the gateway dashboard stovepipe had shared with him that Friday and watched the held count. It sat at zero for twenty-three minutes.
stovepipe · 19:21 UTC Held one. Building controller firmware, a vendor in Ohio. Signed with the PQ1 key, valid. The receipt names a line Ostvik’s log doesn’t have.
stovepipe · 19:33 UTC Nine.
stovepipe · 19:49 UTC Thirty-one. All signed with the new key and all valid. None of them are in the log.
Ferrante · 19:50 UTC Did anything take one before 18:58.
stovepipe · 19:52 UTC Not on mine. Lost and Found is clean back to Sunday.
Ferrante asked Adeyemi for his count. Adeyemi had six, all building controllers, all from the same vendor in Ohio.
stovepipe · 19:57 UTC Ostvik’s log just grew by one line. First new line since 07:00.
Adeyemi · 20:12 UTC That was the gate. It just reached us from Ostvik, signed at 19:57. It teaches a device to demand an ML-DSA signature on everything after it. Tail first, the note says. The things nobody ever updates by hand.
Adeyemi · 20:15 UTC Pushing. Building controllers first, then the laptops.
stovepipe · 20:19 UTC Pushing.
By eight o’clock Eastern the dashboard said the gate was on 1.4 million of stovepipe’s devices, and Adeyemi said 400,000 of his. The held count was 214.
stovepipe · 00:06 UTC For the record. The pumps in my three hospitals cannot take the gate. They never took PQ1. R2 is in read-only memory. The page says Thursday.
Ferrante · 00:11 UTC What happens Thursday.
stovepipe · 00:14 UTC Whoever has R2 by then can sign for them. They take whatever they are sent.
Ferrante waited for Beck. He stared at the screen while nothing happened.
Teresa came up at half past eight with a plate, which she set on the card table on top of his notes. She looked at the screen. “You’ve been wearing that shirt since Sunday.”
“Something went right today. Mostly.”
“The thing on the news?”
“I can’t tell you.”
She took his empty mug and went downstairs.
He was tired. He ate the chicken and looked at the box in Virginia.
On the third day he had told Beck that a second write would tell anybody else sitting on that box which of the three they wanted. On Friday he had said it was still true. It wasn’t, now. kolobok’s handle was on the fix in a public repository. The page with Broomfield on it was in the inboxes of forty-one companies.
Ferrante · 01:12 UTC I want to write to the box in Virginia.
Beck · 01:20 UTC Show me.
He had re-written it four times. His first try explained who they were, and he cut that. Every version started the way the first message had started, on the second day, so the three of them would know it was the same people. The fourth one he put in the channel.
Ferrante · 01:41 UTC Nothing on this machine was taken or changed. The receipt check went on at our gateways at 18:58 UTC. Since then it has held 214 updates signed with the new key whose receipts are not in Ostvik’s log. Your gate is on 1.8 million of our devices. We are not asking for anything.
Kroll · 01:48 UTC Take out “our.” Twice. The message names nothing and I would like it to stay that way. If they want to know who it was, they can ask Ostvik which gateways went on at 18:58.
Beck · 01:52 UTC Send it.
Kroll dropped off.
Ferrante took out our twice and read it again.
Then he added one more line at the bottom.
Is the foot all right?
He looked at it for a while. It told anybody else sitting on that box that somebody here had listened to a sheriff’s report from Gunnison. He left it in.
He wrote it to the box at 02:06 UTC and watched the file change. The tab said unread.
At eleven Teresa called up the stairs that she was going to bed and that he should too.
“Five minutes,” he said, knowing that wasn’t true.