Mechanical Sympathy

What You Need To Work in Cybersecurity: the secret sauce

I see a lot of rules based ‘quick fix’ learning opportunities in cybersecurity, and by that I mean short, intensive courses that claim to make you ready for a cyber job by taking a couple of courses. These are usually boot camp style condensed programs that promise to turn an accounting or science student into a cybersecurity practitioner in a single semester by showing you how to use tools x, y and z. They treat cybersecurity as though it’s an office job: we show you the cybersecurity rules and you follow them. You can see how well this is working by the ongoing shortage Canada faces in finding cybersecurity professionals.

I got into cybersecurity with my students in 2017 when we started chasing CyberTitan, but I brought something with us that isn’t typical in the world of STEM: a relationship with technology that is based on a willingness to hack. I don’t like the word hack, it has negative connotations to it in English that have been encouraged by the self appointed masters of STEM (the S&M part), but that willingness to iterate and work outside the expected outcomes is the secret sauce in cybersecurity that many ignore, and a major reason for why I’ve taken to it like I have.

‘Necessity is the mother of invention’ has been the motivating factor in my relationship with technology since the beginning. I moved quickly from off-the-shelf to customized solutions based on experimentation and need. WIthin six months of owning my first home computer (a VIC20), I’d figured out how to copy software using a sufficiently low noise audio deck. My first x86 Windows PC was purchased but quickly modified as I came to need more memory and processing power. By the mid-90s I was building my own computers at a time when many people didn’t own one.

This process was initially powered by curiosity, which many training programs eclipse with the promise of ‘we provide the initiative and knowledge so you don’t have to’ approach – something that has never appealed to me and a major reason why I didn’t start collecting certifications until 2001 (I’d been working in IT for a decade at that point). Schools are bad at this too. Many educators feel that it is their job to impart knowledge in a regimented format (that’s why we call them disciplines!) and assess student understanding with examples of rote learning that emphasize compliance rather than their own understanding of a subject. Many in education call this approach rigorous and disciplined – it’s how they demonstrate credibility.

The Indians have a term for austere innovation: jugaad (non-conventional, frugal innovation) which doesn’t have the pejorative connotations of the English ‘hack’. Jugaad celebrates common sense with a solutions focused approach to creative problem solving without needless bureaucracy. It emphasizes an applied approach to making technology works that is especially needed in an industry like cybersecurity where practitioners are often facing out of the box problems. WIRED recently did an article on a Ukrainian technologist who demonstrated this start-up like approach in the war with Russia. There is even an event in cyber that highlights this out-of-the-box rapid response to an unknown problem: the dreaded zero day vulnerability. Jugaad will get you much further than any amount of rote learning during a zero day attack.

Kintsugi has played a part in
my motorcycling.

There is another term in Japanese that takes the derision found in English out of making old things work. I’ve long enjoyed the concept of ‘kintsugi‘ or ‘golden joinery’, which is the repairing of old things using gold to embellish the fix rather than trying to hide it. In typical Japanese fashion it raises what is seen as banal work in the West to an artform. A concept that combines jugaad’s celebration of a fix beyond rules based approaches with kintsugi’s raising of that fix to an artform is where a good candidate for work in cybersecurity should find themselves inspired. When I started in cyber I found my IT background helped in terms of understanding the mechanics of what was happening, but my kintsugi powered jugaad approach is what has allowed me to thrive.

This ‘secret sauce’ is often ignored in education and especially in cybersecurity adult retraining. There are some disciplines that tend to attract rules focused types, but that fixation on systemic order blinds them in the edge cases where cybersecurity often operates. Rather than retraining an accountant or rigorously compliant STEM student, I suspect that those exploring subjects like detective work in policing or creatives in the arts would find the skills they’ve honed more effective, but that doesn’t stop everyone from demanding a computer science degree for any job in the industry.

In 2019 after the Terabytches went to CyberTitan nationals we got invited on the local radio station to talk about the experience. The interviewer asked me a good question about our DIY approach to computer tech. I was annoyed at the lack of resources, but he suggested it might be what gave us an edge. He was right, we’d been jugaading and it made us mighty!

There are many jobs in cybersecurity. People who lean toward the jugaad end where they can problem solve without restrictions can find a comfortable fit in operational cybersecurity where they are monitoring real time threats, penetration testing where they are attempting to exploit a client’s system to highlight vulnerabilities, or threat intelligence which focuses on gathering reconnaissance data on threat actors. But even in the policy and compliance work, a willingness to consider and understand threats and solutions that are outside the box is a necessity.

This map of cybersecurity domains gives you an idea of the many specializations that the field offers, though I would argue that in all of them (even those up the compliance end) an ability to work from your own initiative and experience rather a rule book is essential.

Sam Sheepdog & Ralph Wolf know the score.

I sometimes describe cybersecurity types as sheepdogs. I think many in law enforcement also fit this description. You can’t send a goat to fend of wolves, but having a wolf of your own will do the trick. Early on in my transition from IT into cybersecurity I found myself leaning on IT administrative habits that don’t work in cyber, and came to realize that the jobs are very different, though the technology is the same. If you have an IT person running your cybersecurity you’re likely to be constantly surprised by the attacks you face because they tend to see systems in an architectural way rather than as an opportunity to be compromised.

It would be easy to say something silly like, ‘there are no rules in cybersecurity!’ but that’s pointlessly reductive. It would also be easy to describe all the people in it as hackers, but this isn’t true either, though a mentality that tackles problems from a place of curiosity and jugaad is far better than a rules compliant myopic who can’t see beyond the framework they maintain. At the end of all this I firmly believe that you need a bit of the wolf in you if you want to consider a career in cybersecurity. I wish more cybersecurity training and especially adult retraining would emphasize that when looking for candidates rather than demanding STEM grads often missing these skills. If it’s a formulaic job that you’re looking for, cyber isn’t it.

STEM students are often missing skills which “include teamwork, collaboration, leadership, problem-solving, critical thinking, work ethic, persistence, emotional intelligence, organizational skills, creativity, interpersonal communication, and conflict resolution.” Adding an ‘A” to STEM doesn’t fix this, incorporating an iterative, resilient, team-based problem solving mindset into STEM subjects would, but that doesn’t tend to be how we teach them.

Another piece of Canada’s cybersecurity puzzle came into focus from the last post on how our cybereducation system is broken. In response to that, Francois Guay from the Canadian Cybersecurity Network followed up with the observation that the cybersecurity talent pipeline in Canada is also in tatters.

I’ve been thinking about that post and believe all of the responses from both new cybersecurity practitioners and veterans are valid. It would appear that when you try to fix a talent shortage with rushed retraining no one trusts the results. Problems such as absurd requirements for entry level positions like asking for 5 years of experience on a tool that only came out last year or demands for that vaunted yet irrelevant computer science degree continue to strangle entry level workers coming into the field, even though they have hacked (cough) their way through our broken cyber education system to do it.

Not to sound hopelessly jugaad, but the simple solution would be to introduce cybersecurity apprenticeships that give everyone a chance to find those with the right combination of fearless curiosity, critical thinking and tenacity needed to do the job. Students with a background in science and technology might find that they are familiar with the medium that cybersecurity operates in, but that doesn’t mean they’ll be able to handle the demanding stochastic message that working in cyber demands.

I’ve always told my students that if they can bring a willingness to explore, experiment and possibly break things in the process of figuring them out, they don’t need to sweat the technicalities, I can teach them those by harnessing the curiosity they bring with them. I’ve had strong technical students fail in cyber because they lean on systemic approaches to do less. Another favourite adage of mine in the classroom is, ‘if you’re looking for a way to do less, you’ll usually find it.’ Those that want to work in a framework often do it so that they can delineate where they can stop; in other words it’s used as a way to limit their involvement. That’s no way to approach cybersecurity. If solving a problem is a nine to five gig for you, go find work elsewhere.

from Blogger https://ift.tt/J23ZnTt
via IFTTT

Cyber Education in Canada is Broken, Here’s How to Fix It

I’ve been sitting on this one for some time. What’s below is more like brainstorming than a clear solution, but I feel like it’s moving in the right direction…

The Problem: Canada’s Cyber-education system is broken – or doesn’t exist at all

I’ve been ruminating on this since virtually attending the “How to protect our children in an increasingly digital and online world” meeting by Economic Development Ontario and the Canadian Trade commission a couple of weeks ago. James Hayes from Cyber Legends is a man on a mission. His keynote was both insightful and frustrating – the main point being that Ontario (and by extension Canada)’s cyber-education ecosystem is broken. I’d go so far as to say that in most places it doesn’t exist at all; broken implies that there was something there to begin with.

This observation speaks to a cultural challenge that Canada faces. Other countries are able to leverage a collaborative approach to the asymmetrical global threat cyberattacks pose, but Canada’s history and the loose confederation it has produced creates many gaps between levels of government. Those gaps are where cybercriminals operate.

The Problem: cybersecurity, cybersafety and online privacy are barely mentioned in Canadian school curriculum and educators are some of the least digitally experienced professionals able to resolve this skills crisis

In Ontario we’ve mandated mandatory eLearning for all students, but cybersecurity only just got into the computer studies curriculum in this year’s rewrite, and what’s there is thin (it immediately devolves into personal online data awareness and ignores the many interesting technical specialities in cybersecurity). This optional course doesn’t run in most high schools (it was cancelled locally in mine), so this one mention isn’t seen by most students.

Many other provinces don’t mention cybersecurity at all even as they all depend on it every day with networked education technology delivering material in every classroom. Cyberskills are now essential skills if we want to keep the learning happening, but aren’t treated that way in our education systems. New Brunswick is the exception with a full cyber-learning pathway for students interested in heading into the field professionally. Why does that matter? There is a global shortage of cybersecurity professionals, so Canada’s usual approach of immigrating in solutions to its education failings won’t work in this case.

James mentioned teacher cyber-illiteracy in his keynote as well.

Our oblivious response to cybersecurity awareness is part of a larger problem in public education. When I first came into teaching in 2003 I was surprised to see the education system rocking early 90s information and communication technology. Throughout my career education has dragged its feet at every opportunity in terms of adopting digital transformation and the benefits it delivers. The result of this decades long drag is that people in education tend to be less digitally literate than the general population, even as they are expected to teach students essential digital skills like cyber awareness. Teachers are precisely who you want to be raising general cyberawareness and the skills needed to safely navigate our online world, but decades of status quo leadership means educators are missing the digital media literacy necessary to do it.

The Problem: we’re happy to make online edtech solutions mandatory (usually as a cost cutting measure) but a surprising percentage of the people doing it don’t think they should be held legally responsible for its safe delivery

I spoke on a panel about cybersecurity at the Canadian Edtech Summit the week before. The event had an online component so I started a poll aimed at the education administration and technology companies in attendance. Recently the SEC in the US sued a company for their failure to respond to cybersecurity problems that they were very much aware of that resulted in many clients’ data being spilled onto the darkweb. This raises an interesting policy question: should school boards and provincial education ministries be held legally responsible for cybersecurity in Canadian classrooms? Canadian educational ministries and their school boards have increasingly adopted cloud based solutions to reduces costs on what used to be locally managed technology integration, but with internet based ‘cloud’ solutions come cybersecurity responsibilities. This US decision will likely influence our lax cyber responsibility policies in Canada and I was curious what the people implementing these technologies (often poorly) thought of the potential for liability penalties for failing to protect student data (which often also includes staff and family personal data too).

I expected the people delivering online edtech (school boards, ministries, not-for-profits and private edtech companies) to recognize that cybersecurity is very much their responsibility if their technology is vulnerable online. Especially if they are going to demand that students use online learning tools. This should be especially obvious when our ‘clients’ are vulnerable sector children whose safety should be a primary concern.

Most did recognize the importance of taking responsibility for their technology delivery, but I’d love to have a chat with the quarter or so who thought they should be putting student learning online while bearing no legal responsibility for it. One of those people could well be managing your local school board‘s technology department.

If we’ve got a problem with the people delivering online edtech understanding that they are responsible for cybersecurity, we need to back the bus up and clarify those responsibilities with policy – legally binding policy. I recently saw a memo which said data privacy wasn’t even a paid job in the school board and is done outside of regular work responsibilities by IT staff, most of whom have no cybersecurity experience. Until we begin taking public sector cybersecurity seriously we will continue to see our public services being disrupted by breaches and system failures.

NIST’s cybersecurity framework offers a technical policy approach to cybersecurity that clarifies what organizations need to do to provide viable online security. ISED has a Canadian version called ITSG-33 which is more policy focused. This isn’t an all or nothing thing with a solution for every problem. Any time you put data online you risk being hacked, but by following these best practices you can at least know you’ve taken reasonable steps towards preventing abuse. What you want to do is get up to Tier 4 of the NIST framework where you’re proactively defending against threats, but public education in Canada can’t get out of tier two because “implementation is still piecemeal”, and no one has “the proper resources needed to protect themselves.” Our cyber failures in Canadian education are the result of both policy and a subsequent lack of funding. I’d hope that we’d follow best practices in protecting student data, but that ship sailed years ago. If that carrot isn’t available, then a legal policy stick might be the only thing left that prompts ministries and schools to make data privacy a priority.

The Problem: Public services in Canada are siloed bureaucracies that are difficult to work with

This isn’t just an education problem, it’s a
CANADA problem. Canada’s history hasn’t
produced a culture that can collaborate
against asymmetrical global threats.

During the panel talk at the EdTech summit one of the speakers said, “working with public school boards is very difficult. It can take years just to find the right person to talk to. Even if you can find that person, they’ll tell you there are no resources.” I talked to Kyle Bokyo, another of the panelists, after the event and we commiserated on this point.

There are not for profits and businesses in Canada who are attempting to provide solutions to Canada’s ongoing cyber-education failures, but attempting to engage with any public service in Canada is a a difficult prospect. If you talk to the ministries they hold up their hands and say they only manage the funding and not the implementation of cybersecurity solutions. If you talk to the regional school boards they say that they aren’t provided resources to do it.

In Canada’s uncoordinated cyber policy landscape I suspect it’s easier to play victim even as you assume greater cyber risk pushing user data into the cloud than it is to develop a coordinated response to this very asymmetrical problem. These gaps in responsibility make it easy for the people being paid to be responsible for the safety of online student data to point the finger at each other, even as breach after breach occurs.

Canada’s failure to
coordinate cyber response
is recognized as an
problem globally.

What I learned through COVID as a classroom teacher is that the people running public education will ask all manner or ridiculousness just to maintain the illusion of a functional system. It’s what got them into their offices and they aren’t about to jeopardize that. Public education, along with other public services, are insular industries with generational employees and tightly knit networks of political operatives managing them. This might sound like immigrant complaining (and it is), but the best way to get into education ‘leadership’ is to have had family who did it, or marry into one. The next best way is to be willing to maintain the status quo at all costs. Agility and responsiveness aren’t words often applied to this sector.

Cybersecurity in the public education is dangerously under-prioritized even as we continue the rush to cloud based edtech solutions in an attempt to save money. On top of that a surprising percentage of the people delivering these solutions don’t think they should be held legally responsible for its safe delivery. This deadlock suggests that we need policy that not only enforces best cybersecurity practices in education, but also makes resources for it a requirement rather than a politically motivated failure.

But the fix needs to go further in education because we also have a responsibility for providing graduates with opportunities to learn the skills they need to survive in a rapidly changing world; something we’re not doing as many jurisdictions continue to studiously ignore cyber education. The key piece to this puzzle is policy that creates a responsive, responsible Canadian cybereducation system.

The Solution: A Viable 21st Century Canadian Education Ecosystem

As both James and Kyle mentioned in their talks, technology moves so quickly that large public services are always going to struggle to keep up, but an agile edtech sector could help with that. Startups and small businesses can pivot to keep up with technology emergence in a way that larger organizations struggle with – that’s why Google and the rest buy agility rather than trying to produce it in-house. The problem has been Canada’s pigeon hole approach which doesn’t aim to produce a coherent ecosystem of interrelated programs that provide a comprehensive Canadian shield.

As mentioned, the issue of regional school boards and provincial ministries making it difficult for anyone outside of these insular systems from collaborating with them is a key problem. We can’t leverage digitally literate industry partners if they have no way to effectively communicate with education delivery systems.

The solution is to connect the federal government with the Council of Ministers of Education, Canada and The Insurance Bureau of Canada and design a centralized approval process that connects Canadian not for profits and industry edtech expertise with provincial ministries and clears the way for access to credible cybereducation materials and best practices through internal communications with education systems across the country. Instead of individual boards doing cyber badly, a national partnership with a wide range of technology specializations and strengths would work together to build solutions at scale while also ensuring that these solutions are prioritized. This relationship would also prompt meaningful updates to curriculum instead of the current ‘in a bubble’ approach that produces material well short of what is needed to prepare graduates for our technically challenging future.

I made this graphic after last year’s CPI conference
at University of Waterloo, where I first met James,
Cheryl and Cyber Legends.

In such an environment a startup like James’ Cyber Legends, or an internationally partnered and long running national competition like CyberTitan would pass NIST levels of cyber-review nationally and then be welcomed into a Canada-wide edtech ecosystem that works through each provincial and territorial education ministry directly into school boards. Any edtech company working outside of this framework would find itself where we all do now: on the outside unable to make any significant change. But those who meet this national standard would be considered trusted internal partners with access to federal funding and direct internal access to provincial education at both the ministry and district levels. No more trying for years to find a person who may (or most likely doesn’t) exist in a local school board who is in charge of cybereducation.

This ecosystem would reward collaboration. Members that don’t want to collaborate would find themselves removed. Those that want to do want to partner to build a more secure and digitally literate Canada would work with other members to produce complementary resources that allow teachers from all corners of the country to develop meaningful digital skills, including the difficult ones to deliver like cybersecurity. These members would find funding and partners who ensure that their programs are successful and always ready to keep up with the impressive rate of technological change we’re all dealing with. This would also give those providing federal funding clear guidelines for who they should be supporting.

The stick would come through policy changes that are both legal and regulatory. Any school board (and by association ministry) not making use of these secure, partner provided resources for improving student data protection would find themselves both liable for any breaches, and also uninsured. Educational cybersecurity would no longer be a political blame game. Local implementation would still very much remain the purview of school districts, and ministries would remain very much in charge of funding their province or territory, but with focused federal support many of the associated expenses would be reduced through the centralization of resources. These savings would also be a carrot. With national cyber standards and partnerships that leverage the strengths of all members of Canada’s education ecosystem (federal government, private industry, national not for profit, education ministries, and local school boards), Canadian students would enjoy access to more Canadian made digital learning opportunities that raise digital fluency in a meaningful way, and they could do this while also exploring cybersecurity in a way that creates a more secure Canada. Imagine what all these cyber-aware students could do for our national security.

We have a habit of regionalizing our approaches to government in Canada, but in the face of wildly asymmetrical threats like cybercrime and (increasingly) international cyber espionage, we need to push back against this culture and build a collaborative defence. In doing so we would also create much richer digital learning opportunities in our schools that make Canada more secure and competitive in the networked, global economy.

The Solution: collaboration doesn’t end locally, regionally or even nationally in Canada

I’m attending The Global Forum for Cyber Excellence’s inaugural Global Conference on Cyber Capacity Building in Accra, Ghana at the end of November.

“It is paramount for all nations to have the expertise, knowledge and skills to strengthen their cyber-resilience”

I’m presenting a research paper a former student and CyberTitan (Louise Turner) and I have written about the disruption quantum computing will cause to cybersecurity encryption in the coming years. Doing this research with Louise has been both eye opening and very intellectually satisfying, but after 20+ years in the classroom I’m still very much a cyber-educator first and a cyber researcher second. It’s why I invited one of the next generation of cyber professionals to write the paper with me.

Looking at the program for the conference, the lack of talent and focus on developing cyberskills both in the population and in those interested in pursuing work in the industry isn’t a Canada only problem, it’s a global one. If we can repair Canada’s internal cyber-education system, we can then work with international partners to help them do the same. The cyber battlefield inherently favours the anonymity of hackers damaging our systems with impunity for their own gain, but through collaboration the defenders could become mighty.

As the GFCE so eloquently puts it: “Nations should work together and support each other with these capabilities, so that no country is left behind in their digital evolution. After all, a chain is only as strong as the weakest link.” Look for the Accra Call: a global action framework that supports countries in strengthening their cyber resilience being announced during the conference.

from Blogger https://ift.tt/RMSG9zr
via IFTTT

A Colourful SMART Adventures Late in the Season

I’ve been going to SMART Adventures since 2018. As a way to get myself doing things on a motorcycle that I don’t get to do on the road, it’s a great opportunity to expand your riding skills. Getting experience on a variety of different bikes is never a bad thing either.

I’ve had some great days at SMART. A particular highlight was during the deepest, darkest summer of 2020 when I did a full day that started on a trials bike, moved to a brand new GS1250 and ended on a dirt bike. It was a great day of bike learning across three very distinct machines.

Last summer we managed to squeeze in a half day and it was the first time I’d done the expert riding group, which I second guessed myself on being in. Unfortunately the father who dragged his son into it wasn’t so introspective. I spent a good amount of money hoping for expert riding opportunities but the afternoon consisted of watching this kid fall off a bike too big for him that his dad kept demanding he ride, and then watching him drop the second bike we had to go back to get for him into a two foot deep puddle. We ended up spending most of the afternoon picking this kid up or riding back to the base after he broke a bike. I needed this trip to SMART to be a win after that last disappointment.

We tried to arrange a trip up in August but things got complicated (dog died, kid going to college, in-laws being difficult) and it never came into focus. I thought this would be our first year not going up to Horseshoe Valley, but Max’s reading week was at the end of October and the week before the weather looked like it might hold up, so I signed us up for an afternoon, and this time SMART nailed it, though in fairness it’s not their fault if a toxic dad wants to design a miserable afternoon.

Going this late in the season and during the school year means you’re less likely to trip over father/son drama. Max got Dave who was the instructor who taught him both ATVs and dirtbikes previously, and I got Tyler who I hadn’t had before but is an incredibly talented off road rider who also has a knack for finding where I was at in terms of skill and then keeping us at that edge throughout the afternoon – I learned tons.

Having a look around before the ride out, it’s not easy keeping the jealousy in check when it comes to SMART Adventures owner Clinton’s bike collection.

Why are y’all wearing rain jackets? ‘Cause it was raining… a lot! That’s inches deep mud.

We started with some warm ups in the bowl at the base. I’ve been on a 250 CRF Honda before but this time they had a Kawasaki KLX 300 with bar risers which fit me even better. Tyler had me doing riding with one hand while standing up (in mud), which isn’t as easy as it sounds, then rear wheel lock up braking, then both wheels coming as close to locking up the front as we could manage (in the mud). We also did logs and tires, but once Tyler had an eye in on where I was with clutch control and balance we took off into the woods, which were spectacular!

Riding in a thick ground layer of leaves is tricky. You can’t see rocks or mud underneath, but it teaches you to ride looser and float over the surprises without over correcting for them. We did a lot of kilometers through the rain and brilliant colours and the riding was never dull.

I’m always surprised at how physical proper off-roading is. With mid-teens temperatures and the rain gear on I was dripping wet with sweat. I worked hard at using my legs to grip the bike so my arms weren’t putting pressurized inputs through the handlebars. It’s a combination of balance and lower body strength that demands a lot of energy. One suggestion was to turn my feet fractionally into a corner to weight the pegs in the direction I want to go (a Clinton Smout move) and it works!

We got back for a break but before I parked the Kwak we did K turns. The idea is if you get stuck going up too steep a hill you let the bike stall in gear (or kill the motor in gear) and then roll it backwards leaning into the hill and letting out the clutch bit by bit as you turn the back end until you’re parallel with the hill (still leaning up it). The tricky bit is once you’re near parallel having backed up on the clutch, you start turning the handlebar lock to lock and the bike’s nose will fall under the twisting to face downhill. You then stand it up and roll on down. The final move was to bump start the bike. You do this by leaving it in third gear and dropping the clutch at the bottom of the hill as you sit down on the seat. It sounds like a lot of gymnastics but I got it to work on the second try. Tyler said it can really save your bacon if you get stuck on a big adventure bike on too steep a hill.

Just when I thought it couldn’t get better, Tyler went and got a couple of the new Surron electric dirt bikes out of the lockup. He gave me the bigger Storm model and then told me (jokingly) not to get it wet. We left both bikes in economy mode because of all the wet leaves over mud. Tyler described ‘S’ Mode as ‘scary’, and don’t press turbo!

383 ft/lbs of torque in mud and wet leaves? What could go wrong?!?

I hadn’t dropped the big Kawasaki all afternoon despite the crazy conditions. I should have four times but saved it each time. Being able to practice saves is one of the best parts of SMART. I genuinely got to do things on a bike I’ve never done before, which is the whole point. Sounds ominous, right?

We got out into the woods again and both Tyler and I were down in the first five minutes, but not because the Surron was a torque monster (it’s actually easy to get the hang off). It’s the lack of clutch after riding one all day that caught me out. I was sliding down the muddy side of a trail covered in leaves and went to pull in the clutch to drop a gear, except the clutch is the rear brake and the Surron doesn’t have gears. The bike was out from under me in an instant. Here’s a pic from right after – check out that mud!

I finally got myself back on the bike after I slipped in the mud again throwing a leg over it and we went down a second time. The bike took a minute to ‘re-arm’ because I’d popped one of the brake sensors out, but Tyler figured it out and we were off again.

We made tracks after we both learned not to use the rear brake like a clutch.

That’s Tyler – ace instructor!

Interesting choice of name, great bike!

No one went down again and by the end of a forty minute blast through the woods and into the trails beyond the SMART owned land, I was getting a feel for the Surron (not Sauron from LotR). Being able to focus on riding without worrying about gears and clutches was one part of it. By the end I was getting crafty with the hand operated brakes. The other piece is the silence. When you goose it the bike roosters dirt like a mad thing, and it’s properly quick. The only noise it makes is once you’re up to speed and it’s a ghostly whine, which suited the October hallowe’en woods. I could hear rain hitting leaves as we whispered through the trees.

Where am I at with an electric dirt bike? If I owned a Surron I’d play with the settings so the energy recovery/gearing pulled a bit more and provided more of what feels like engine braking. That would have prevented the spill on the hill. So much of dirt biking is clutch though. You manipulate the clutch continuously to offer smoother power delivery, especially in tricky conditions. A dirt bike without a clutch and gearing is missing a key control, not to go faster, but to manage the power better. The throttle on the Surron felt a bit wooden after riding the big Kwak all afternoon, but that may well have been because I couldn’t feather the Surron’s power delivery with a clutch..

The upside is the silence when riding, though it isn’t really silent with that ghost whine. It did make me miss the thud of the thumper, and the simplicity of the controls (no clutch, no gears) lets you concentrate on other things, but at the cost of simplifying the riding which I have mixed feelings about. Aesthetically, a bike having a heartbeat is pleasing, though I could get used to that ghostly howl.

The older much used Kawasaki went through all sorts of gymnastics during the afternoon without missing a beat, while the Surron needed TLC after one drop, which doesn’t bode well for its resilience. I’d describe my first time on an electric dirt bike as interesting, but they’re not ready for prime time yet. If I were to buy a dirt bike tomorrow it would be a fuel injected ICE model that is decades into its evolution rather than an ebike that’s at the beginning.

SMART was running a regional trials event that weekend and I asked Tyler about electric trials bikes, but he said most riders are still using ICE models – once again because the clutch offers much more nuanced control. I suspect electric bikes will end up adopting something like a clutch to allow for that finer control, though they don’t need gears so perhaps the clutch is simply another electronic intervention. It’s just a matter of time for this to all get worked out, but they’re not quite there yet.

As we pulled in to SMART a red fox fan across the parking lot, and I saw wild turkeys and what might have been a coyote in the woods. We clambered out of our muddy gear past 4pm and got changed before heading up the road to Vetta Nordic Spa where we put our aching muscles into various hot waters as we watched the moon rise through the skeletal trees. Yes, the rain stopped and clouds blew over pretty much the minute we stopped riding, but the weather is part of what made it such a good afternoon of riding! As a way to wrap up the riding season (it was snowing the following weekend), there are few better.

SMART Adventures

https://www.smartadventures.ca/

You should go!

from Blogger https://ift.tt/wALiW70
via IFTTT

A.I. Isn’t What You Think It Is

I’ve been in a series of presentations over the past couple of months where organizations are getting frantic about catching the ‘AI Wave’. This urgent need to feel like they aren’t missing out on a fad is understandable, but like so many emerging technologies, getting ‘into it’ won’t be effective if you ignore the foundations its built on, and the foundations of AI and the technology itself are… problematic.

You can’t have ‘generative’ AI without massive data sets to train it on. This data is scraped from the internet and then fed into systems that can eventually give users “a statistically likely configuration of words” that look like an answer. That’s right, the brilliant answer you just got on a generative AI platform isn’t really an answer, it’s a cloud computer cluster giving you its best guess based on crowdsourced data. None of that stops people from thinking it’s intelligent (it isn’t), and being in a panic about missing out.

Putting the fact that AI isn’t nearly as smart as the marketing portrays it aside for a moment, large data and the cloud infrastructure that stores and delivers it are a house of cards teetering on the edge of collapse. You can’t have AI without climbing to the stop of this wobbly infrastructure. How precarious is it? Data growth worldwide is in an explosive phase of growth (partially driven by the AI fad). Our overloaded storage infrastructure is under pressure because AI uses it much more aggressively that simply storing information. AI demands fast data retrieval and constant interaction making the rise in AI particularly problematic for our stressed storage systems.

We’re facing data storage shortages in the next couple of years because of our belief that the cloud is an infinite resource. It isn’t, it’s an artfully hidden technological sleight of hand. The irony is that our digital storage infrastructure limitations will also end up limiting our current crop of AIs as well.

The staggering environmental costs that underlie our myth of an infinite digital cloud haven’t been mentioned yet, but like many of our other ecological marketing myths (electric vehicles) pushing the messy business of how it works out of sight of the consumer is a great way to market a green future while doing the opposite. Data centres in the US consumer over 2% of all electricity in the country. There are benefits to scaling large data centres, but the trend into the foreseeable future is that the cloud will continue consuming more energy out here in the real world. That we’re increasingly throwing limited resources at building AI guessing machines tells you something about our priorities.

One of the first posts on Dusty World was about dancing in this datasphere twelve years ago. Back then I’d found a quote by Google CEO Eric Schmidt talking about the coming information revolution:

I’d make a distinction between information and data. One is useful, the other is raw binary numbers and storing the majority of it is a complete waste of time and resources. Sussing out information from data is an ongoing challenge. That doesn’t change the fact that the amount of data being generated back then wouldn’t even register on the graph below, which looks like a runaway growth curve – you can make good money from all that data.

So, we live in a world that is well into an aggressive phase of digital growth, though very few people understand how any of that works. Even as we compile more content than we have in the entirety of human history to feed the attention economy, we also decide to play a sleight of hand game with machine learning on massive datasets just to see if it’ll work.

From an educational perspective, AI is in the wild now and ignoring it will only get you and your students in trouble. If we’re going to make functional use of this progenitor of true artificial intelligence, we need to teach the media literacy around it so that people understand what it is, how it works and how best to use it to amplify rather than replace their humanity.

I’ve seen a lot of people panicking about AI taking their jobs away, but if your work output is a statistically likely configuration of words, then you’re not applying much of your vaunted human intellect to the task at hand and probably should be replaced by one of these meh AIs. But if you’re one of those humans who actually thinks, even this stunted AI can be a powerful ally. In a fight for intellectual supremacy who would you think would win?

just machines
just people
an empowered hybrid of the two

The move here during this awkward adolescence of artificial intelligence where we’re faking it until we make it is to leverage the tool to best effect. If effective use of AI speeds up our ability to gain actionable information in the chaos of data that surrounds us, then we can more quickly move on to the next real steps in technology evolution.

The other day I described AI as we currently define it as a hack to keep classical computing ahead of the data tsunami we’re living in. At the time I was surprised by how I described it, but classical computing is reaching the limit of what it can do. For the past few years we’ve been finding speed in parallel processing such as adding computing cores to CPUs rather than making faster CPUs. We’ve also been finding efficiencies in how we manage data such as creating more organized memory caches to better feed our processors. Ultimately, I feel like generative AI in 2023 is another one of these patches. It’s a way to make our overwhelming data cloud more functional to us.

This is from a presentation I’ve been giving that attempts to bring people into a better understanding of the hype. AI (even this meh one) will replace you if you let it, so don’t!

Digital technologies aren’t going to go anywhere, but they are a ‘low resolution’ way to compute. There is also the problem of reducing the complexity of reality to ones and zeroes. Mathematical concepts can help us understand relationships, but they will always be inherently reductive; they’re never the thing itself but a simplified abstraction of it. Digital reduces the world to ones and zeroes and at some point we’ll realize that this isn’t the way.

When we run out of nanometres like we have with electronics, the next step is a big one, but it’s one we’re working on globally as a species right now. In the next decade we’re gong to figure out how to use the building blocks of nature itself to compute at speeds that classical computers can’t imagine. What will this do for our data clogged world? One of my hopes is that it will process much of that data into usable information, information that we can then use to solve this mess we’ve gotten ourselves into.

I’ll weather the current AI hype storm, but if you ask me what I’m really excited about it’s artificial intelligence realized on a faultless quantum computer. The future beyond that moves in directions I can’t begin to guess, and that is exciting. imminent and absolutely necessary if we’re going to prevent a global collapse of human civilization. Some people might get panicky about that, but they’re the same ones who think a cloud based statistical guessing machine will replace them.

from Blogger https://ift.tt/uF8RQPH
via IFTTT

Finding Your Way Around OEM’s Giving Up on Parts Support: Triumph 955i Fuel Injection Seals

With Triumph giving up on my Tiger before I’m prepared to, I’m going to document the research and give details on what works when you’re trying to keep a Triumph 955i’s fuel system working by replacing old o-rings.

This has involved a crash course in o-rings and engine operating temperatures. As I work out a fix here I’ll post details on o-ring sizing, what type works and include data on measuring the intake manifold at temperature.

It’s been all Concours for the past few weeks while the Tiger is laid up. I’m hoping to get the fuel system sorted before the snows fly and I have to wait for next year.

Here are the measurements for the upper and lower fuel injector seals. The classy move by
Triumph would be to open source publish the technical details for all the parts they no longer support so that the rest of us can get on with keeping the history of the marquee alive. With that in mind, here are the deets for the upper and lower fuel injector o-rings:

The thick ones go on top where the fuel injector meets the rail. My best guess is 3mm thick by 1.5cm outer circumference.

The skinny ones go on the bottom where the fuel injector slides into the intake manifold.

My best guess there is 2mm wide by 1.4mm outer circumference.

Unfortunately, buying off the shelf boxes of o-rings isn’t likely to get you anything that fits. The two below from Amazon didn’t. This thing looks handy: https://www.allorings.com/O-Ring-AS568-Standard-Size-Chart.

The Tiger is a metric bike, so I’ll work in mm (if Triumph went imperial on o-ring, what the actual f***). The thicker o-ring is 1.5cm or 15mm outside diameter (OD) and (I think) about 3.5mm cross section (CS). Looking at that chart, the #203 is a 14.58mm outer diameter with a 3.53mm cross section. That makes it mighty close. What would be nicer would be if Triumph just came out and gave us the precise sizes for these parts it has discontinued. Triumph?

The thinner one is also a 1.5 (ish) mm outer diameter (15mm-ish), but the cross section is thinner – perhaps two and a bit mm, and they have a 2.62mm cross section standard o-ring size. You’d have to hope Triumph didn’t make bespoke o-rings for their fuel injectors, right? For the skinny o-ring I think I’d take a swing at the 2.62mm cross section / 14.43mm (1.443cm) size.

The All O-Rings site also has a good description of the materials you want to get your o-rings in. Nitrile and Viton are what I went with in the pointless Amazon order, but those are the materials you want in a fuel heavy application like this.

That’s the configurator (right) – pretty straightforward, but it sounds like they manufacture each order, which probably won’t make this a viable solution for someone just trying to keep their old Triumph on the road.

If only there was some kind of network of retailers who supported Triumph motorcycles who could order this parts to help their customers keep their older Triumphs rolling… some kind of ‘dealer’ network who understand how parts work and how to order this sort of thing in large enough quantities to make a profit while offering customers what they need.

RESOURCES

How hot motorcycle engines runs: https://blog.amsoil.com/extreme-heat-is-hard-on-your-motorcycle/

Buna (Nitrile or NBR) o-rings: https://sealingdevices.com/o-rings/buna-n-o-rings/

Viton vs. Nitrile o-rings: https://www.nes-ips.com/viton-vs-nitrile-o-rings/

All O-Rings https://www.allorings.com/

They have sizing tools! https://www.allorings.com/o-ring-kits-and-accessories/o-ring-sizing-tools

I’d prefer to use All O-Rings for the parts, but they might be a B2B type of thing, and I’m not a B.

Amazon’s kits:

Turns out Amazon’s shot-in-the-dark kits didn’t work either. There’s more to this o-ring sizing caper to come. I wish I could just 3d print the nitrile o-rings I was looking for (doesn’t look like it’s additive manufacturing friendly).

from Blogger https://ift.tt/Jc48aHG
via IFTTT

You Want to Teach WHAT?!? Reconfiguring Technology in Schools to Empower Pedagogy

Cybersecurity is one of the more challenging subjects to try and bring into classrooms, even though every one of them depends on it every day to function; everything from attendance to lesson content happens via networked computers in 2023.

Few people have advanced digital media fluency when it comes to using software and hardware, but that’s just the tip of the iceberg with cybersecurity. It also depends on skills from many other technical subjects that don’t get much attention in K-12 classrooms, such as software development, networking, information technology, IoT and programming, but not just high level stuff, you also need to be comfortable looking at firmware and low level coding.

Cyber skills aren’t just about leveraging these interdisciplinary technologies though, they’re also about discovering, understanding and resolving the many points of failure inherent in them. This is something most people feel very uncomfortable doing. For the vast majority of users, when technology goes wrong it’s someone else’s problem. Even for the people who build and maintain networks, the dark arts of cybersecurity cause great unease.

One of my hobbies is restoring old motorbikes. There is a strange parallel to cybersecurity in this. Many mechanics won’t touch old machines because they don’t lend themselves to modular parts swap fixes, which is how all modern shops work – technicians don’t fix things, they replace them. Diagnosing an old machine takes patience and sensitivity that many mechanics haven’t learned in our digital world of part numbers, modular engineering and timed repairs to maximize profit. I’ve talked about this before in relation to Matt Crawford’s books and I think there is a corollary with IT and cybersecurity. Many of the people who build and maintain our systems aren’t interested in how they might break, they are only interested in keeping them running as cheaply as possible. That’s good for running your enterprise system as long as there are no surprises, but not so good if you want to build something bespoke or prepare for the many nasty surprises out there.

I was thinking about this challenging situation after attempting to convince school board IT departments from coast to coast about the technical requirements of the CyberTitan/CyberPatriot competition. I’ve been told again and again by people struggling to provide IT support in schools that they won’t run VMWare or Cisco’s Packet Tracer simulator because they:

1) are viruses (they aren’t, though they are a great tool for safely examining them)

2) pose a threat to their systems. They don’t – they actually do the opposite, but training people in the arcane cyber arts scares many of the people managing IT in education.

Virtual machines are used in cybersecurity (and network building) to test software and network environments. By examining a virtual machine cyber operators can explore how a machine has been compromised and what they might try to repair it in a safe (virtual) environment. VMWare is one of the biggest players in this field, and cleaned up at last year’s cybersecurity awards, yet many board IT departments declared it a hazard. I suspect the hazard is in teaching ICT and cybersecurity best practices, and isn’t that a tragedy?

I sympathize with the IT departments I’ve communicated with. They are responsible for running complex enterprise systems that support hundreds or even thousands of users with varying levels of system access (administrators, office staff, teaching staff, building maintenance, and more). That’s more than many IT departments manage in other industries, but educational IT also has to serve tens of thousands of vulnerable sector clients (students), all of whom are coming at them with a staggering array of hardware and software without any real training on it. To make it even worse, most of them will be connecting to these systems using out of date and possibly compromised machines.

An attack surface is a concept that helps cybersecurity types better understand how a bad actor might exploit their network. The software you’re using, the hardware it runs on, the network you’re logging in from, other software installed on your device, the operating systems you’re using, and the systems that connect it all together along with all the cloud based stuff you depend on are all components of a modern attack surface, and the education one is particularly complicated.

One of the last big network installs I did before I went into teaching was at Glaxosmithkline in the early zeroes. This was a network of hundreds of desktops, hard wired via ethernet into an onsite server that provided all the ‘cloud’ they needed. The desktops all ran the same operating system and software on identical hardware. No one on this network had internet access, closing down a massive headache in terms of attack surface (internet access in a world experiencing a digital skills crisis is a nightmare!). This kind of simplicity is a distant memory in 2023. With our rush to the cloud, attack surfaces now include all the online managed systems we so gleefully replaced our secure networks with. BYOD and off-site work only pile more complexity on.

Comparing that GSK network to any modern education network is an apples to fruit salad comparison. On any day at dozens of school and administrative sites across a board you’ve got a nearly infinite number of different devices logging in, from phones with varying software packages (most of which are probably out of date and may well contain malware) to other personal technology (tablets, laptops, etc) all peppering your network with requests that may be school related or (more often) not.

To try and mitigate this complexity inflation, many boards have dumped computers that do onsite computing (like desktops and laptops) in favour of an easier to manage (because it can’t do much) chromebooks. These simple machines can’t get infected like a fully interactive operating system can, but you’re still susceptible to fake browser extensions and compromised websites. This is usually solved by preventing users from customizing their chromebooks with extensions, further reducing what they can do.

With all this in mind, I was struck the other day by the idea that educational IT departments are missing a key component: a department focused on enabling technology empowered pedagogy (the reason we have schools… remember?). Early on in the edtech revolution we had OSAPAC in Ontario, which vetted software and created a provincial bank of safe to use software for learning digital skills in classrooms. With the rush to cloud based systems, OSAPAC evaporated and most school systems fell in with multi-nationals offering ‘walled gardens’ such as GAFE (Google Apps for Education) or the Microsoft equivalent. As this migration happened, teachers and students lost access to essential digital media literacy opportunities, especially when it comes to advanced digital skills such as 3d modelling, game design or cybersecurity.

A way to combat this skills deflation would be to create local IT support units dedicated to providing teachers with digitally enhanced student learning opportunities instead of starving us of them. I’d go a step further and suggest that the messy enterprise side of things that is such a headache should become the responsibility of the Ministry. Many cost savings and security enhancements could occur from centralizing these systems. It would also mean that students and staff moving between boards would be able to migrate more easily because everyone would be on the same systems. There would also be opportunities to collect provincial data more easily that would support better education policy, not that we like to collect data before making education policies in Ontario.

This does not mean the end of regional school board IT departments. Instead of chasing the tail of impossible enterprise expectations with insufficient funding, they would be provided by a central provincial authority with the secure standards and proper support. Imagine how much we might save if every board in Ontario isn’t reinventing the wheel over and over again with varying degrees of success.

Local school board IT departments would be entirely focused on working with their teachers to find the best hardware, software and cloud based learning opportunities based on the needs of the programs they are running. Instead of saying no and reducing technology access to enhanced pedagogical learning opportunities in our classrooms, our local IT departments would become sources of local technical expertise focused on helping public education close an ongoing digital skills crisis.

I’m writing this in a hotel room in the north end of Toronto the night before attending the Ontario Public Sector Cybersecurity conference. I want to believe that the people at this event are taking the challenges of technology enhanced education, including the tremendously difficult task of engaging with cybersecurity learning, seriously in 2023, but I fear it’s going to be all cartoons and platitudes. Here’s hoping.

from Blogger https://ift.tt/pOYXgiA
via IFTTT

Discontinued Tigers and Triumph Supporting its Riders

If you follow the blog you’ll know I’m on a mission to get my 2003 Triumph Tiger 955i to roll over into six figures on the odometer. I picked up the bike with under forty-K on it and have done the majority of the now high miles on it. Over that time I’ve had an ongoing battle with the early fuel injection on the bike, but other than that it has been my preferred ride even as a series of other bikes passed through the garage.

Once again the fueling has gone off on the bike just as I was hoping to push it over the 100k mark in its 20th year on the road. If I lived somewhere that wasn’t trying to kill me for four months of each year this would be an easier goal, but trying to do it in Canada where the bike has to sit through minus forty winters and then navigate the frost heaved results in our too-short riding season? It’s technical a flex I’m up for, but it’s a shame that Triumph isn’t.

I tried the usual solution of rebalancing the fuel injectors, but the bike is still stalling out and running rough. I checked the valves less than 15k ago so that isn’t likely it. If it isn’t throttle body balancing, which the bike is prone to needing, perhaps it’s time to, at over 90k, to finally replace the o-rings and gaskets in the fuel injection system, but Triumph tells me that the majority of these parts are discontinued.

One of the reasons I enjoy the old Tiger is that it still catches eyes and prompts conversation when I’m out and about. Another reason I like it is that it can pretty much do anything (I’ve trail ridden on it and done multi-thousand mile two-up road trips too). It fits me better than anything I’ve ridden, is fun to chuck around in corners and has handled axle deep mud when I needed it to. The engine is full of character and pulls well even two up and, considering the miles it has done, the amount of TLC needed isn’t unreasonable. I’d love to keep this bike going indefinitely, it’s a shame that Triumph don’t feel that way.

I had a chat with the dealer (who isn’t particularly local, it’s a 170 mile round trip to go there physically – I usually get parts delivered), and they said that this is a problem with Triumph – they don’t support their older machines. He then went on to say I couldn’t use generic o-rings because the Triumph parts are strangely size specific. I’m going to try anyway because I really want to be able to jump on my old Tiger and ride. I wish Triumph felt the same way.

Suzuki runs a successful vintage parts program, I’m not sure why Triumph wouldn’t want to keep their bikes on the road, especially when they lean on brand heritage marketing so much.

Here’s Nick Bloor’s take on it:

Never standing still, always pushing to get the best from ourselves, for our riders. Building iconic motorcycles that celebrate our past while embracing the future through bold design, original styling, purposeful engineering and a genuine passion for the ride.
Always focused on delivering complete riding experience, creating bikes with the perfect balance of power, handling and style that totally involve the rider and bring out the best in them.
This is our passion and our obsession.
We are chasing the same thing as our riders THE PERFECT RIDE.
Nick Bloor
CEO Triumph Motorcycles

All good stuff, but maybe focus a bit more on celebrating Triumph’s past, Nick? That includes the bikes your reborn Triumph have been making since the nineties.

When you market on brand history and provenance, shouldn’t you support brand history and provenance? I’m coming at this hard because I want to believe… and keep my old Triumph rolling.

from Blogger https://ift.tt/97ErOZP
via IFTTT

Fall Moto Photos

Alas, the Tiger’s fuel system is acting up (again), so it’s all Concours14 this fall, but the big bike is doing the job. It handles two up without breaking a sweat and when I want to ride it like a sports bike, it never misses a beat. It’s heavy, but once it’s in motion it seems to loose one hundred pounds. It’s no Fireblade, but it’s surprisingly willing in the (few) twisties we have around here.

This time of year the fall colours mean you can enjoy a ride even on our tediously straight roads…

from Blogger https://ift.tt/ARib4gL
via IFTTT

Dream Motorcycle Trips: Madness in the Desert

If you’ve read this blog you know I’ve written a historical fiction of my granddad’s time in the RAF during World War 2. The two books I’ve done already are about his time behind Nazi lines in France in 1940, but after he escaped he got sent to Africa and spent the the next chapter of his time overseas crossing the Sahara (in 1940s vehicles!) and fighting in Egypt and Libya. I’m keen to eventually trace his steps but when am I ever going to be on the east coast of Africa?

The Allies didn’t have control of the Mediterranean in late 1940 (remember Guns of Navarone?), so the Royal Navy took Bill and his RAF squadron down the east coast of Africa to Takoradi in Ghana. There they unloaded their Hurricanes and ground support vehicles and then they (incredibly), saddled up in their 1940s vehicles and leapfrogged with their planes ***across the Sahara***!!! It’s a 5000+ kilometre odyssey that leaves me absolutely awe struck:

Sure, Tim, you’re saying, but when are you ever going to get to Ghana? Well… I applied to the Global Forum for Cybersecurity Expertise’s cyber-research proposals in the summer and my paper on quantum disruption in cyber got accepted… which means I’m going to Accra, Ghana to present it at the end of November at the Global Conference on Cyber Capacity Building. That puts me about 200 kilometres away from Takoradi where I’d have a chance to stand where Bill stood in late 1940.

I’m feeling pretty scrappy. The dream ride would be to get a collection of 1940s RAF bikes, cars and lorries and repeat that astonishing trek across the desert to the southern coast of the Mediterranean. That’s some pretty gnarly country, so doing it as part of a documentary with a film crew that looks at what life was like in the desert in World War 2 would be the dream part of this ride.

Some of my cousins ride and some of their kids are old enough to do it too. There are several times in Bill’s military career when he shouldn’t have made it out, but he had a knack for it. An opportunity for his descendents (who wouldn’t be here if he didn’t have that knack) to repeat this Sahara crossing while talking about the history and passing through the heart of the desert on 1940s technology would be… epic.

Yep, that’s what epic looks like.

Austin Vince did Mondo Sahara, which was ambitious. This is… more.

RAF in the desert collecting downed Hurricanes. Engines of Western Allies WW2.

from Blogger https://ift.tt/QOW0BYh
via IFTTT

Dream Motorcycle Trips: Riding with Austin

I’ve been watching the inestimable Austin Vince lead his latest VINCE trail riding adventure in the Spanish mountains on Facebook. Austin’s Mondo self funded world trips have gotten me through many a long Canadian winter. The chance to ride with the man himself through some of the most beautiful and remote parts of Spain would be epic.

We drove through Northern Spain last winter but it was in a rental Kia. This is Spain next level!