Sunday, August 30, 2026

Biased Blow-By-Blow - Vuelta a España Stage 9

Introduction

Remember that annoying character, Cousin Oliver, who showed up in a few episodes of “The Brady Bunch?” Well, the Vuelta a España is kind of the Cousin Oliver of the Grand Tours. It’s late in the season, the weather isn’t typically as dramatic as that of the Giro d’Italia, and most of all it simply isn’t the Tour de France. So it gets no respect. But honestly, it’s usually a lot better show than the Tour, especially when a rider whose Tour hopes got scuppered can have one final shot at redeeming his season. I was hoping that’d be the case for Jonas Vingegaard (Team Visma - Lease a Bike) this year, after he crashed out of the Tour, but he isn’t here. Instead, Tadej Pogacar decided to show up and make the race boring as fuck. So I almost wasn’t even going to follow this Vuelta. But here I am … can you guess why? Read on!


Vuelta a España
Stage 9 – La Vila Joiosa to Alto de Aitana

As I join the action, the riders have 79 kilometers (49 miles) left to race and a breakaway has almost five minutes on the red jersey group. The course profile you see above really threw me because it’s in miles, for crying out loud. Notwithstanding the superiority of the Imperial system of measure, this scale is annoying because looking at the footage, which gives the remaining distance in kilometers, it’s hard to figure out where the riders are. Before my coffee kicked in, and I realized the scale was miles, I was totally confused, to the point of mental collapse, and thought about going back to bed. But of course I didn’t because—and this is the most important thing to know about this year’s Vuelta—Tadej Pogacar (UAE Team Emirates XRG) is out of the race.

It’s sad, and strange, but Pogacar, who led the GC battle from day one after winning the very short opening time trial, crashed on a flat, straight road yesterday, apparently after he or someone near him ran over an object in the road. Pogacar went right over the bars and suffered a broken collarbone, a broken vertebra, and a concussion. Of course that is a terrible shame. At the same time, life goes on: insofar as we haven’t resolved to wear black for a year, not go out in public, and not watch any more of the Vuelta, it must be said the race just got way more exciting. Instead of a foregone conclusion, the race is blown wide open.

The riders are crossing the valley floor before starting the third-to-last climb, the Category 2 Puerto de Tudons. Movistar Team leads the peloton, working to bring back this breakaway because their leader, Enric Mas, also leads the Vuelta.


Is Mas Grand Tour winner material? I’m a bit skeptical, as he’s not usually a rider who takes a lot of initiative … he just follows wheels, rides consistently, and hopes for the best. That said, a couple stages ago Pogacar was soloing and Mas actually bridged up to him. It gave Pogacar a bit of a shock, because Mas seemed to come out of nowhere and blew right by him at the very summit of the final climb. Pogi seemed to have forgotten that he doesn’t always get to solo just because he tried. I was reminded of Mike Tyson’s bewildered reaction when Evander Holyfield became the first opponent to actually fight back, instead of immediately folding up. My analogy only goes so far, of course, because Pogacar didn’t bite Mas’s ear, and probably wasn’t even tempted. Pogacar wasn’t overmuch threatened by Mas’s insubordination, as the “attack so they’ll give up” tactic had worked just fine in Stage 4, the first real mountain stage of the race, when the Slovenian soloed from 50 kilometers out and took almost three minutes, easily enough to secure the overall GC barring some catastrophe (which as you now know did happen).

It’s a really big breakaway. Their lead is down to 4:32 … should I give you all the names? What a hassle. I’ll give you a few. We’ve got Gianni Vermeersch (Red Bull - Bora - Hansgrohe), Kevin Vermaerke (UAE Team Emirates XRG), Stefan Kung (Tudor Pro Cycling Team), Alexey Lutsenko (NSN Cycling Team), Santiago Buitrago (Bahrain Victorious), and Pavel Sivakov (UAE Team Emirates XRG). It’s at least twenty riders total and in the time it took to type that, the lead came down nine seconds. Who knows, maybe a subset of this group will stay away … hopefully not the guys I didn’t name. Anyhow, they’ve got 2.8 kilometers left on this climb.

I took a gamble and slept in a bit late today, figuring that without Pogacar, the race would be slower. This has worked out well … they are way behind schedule to finish at the earliest predicted time.

It’s hotter than balls out there according to Christian Vande Velde, one of the Peacock announcers. Yes, of course I’m paraphrasing. Wouldn’t it be great if these guys talked like that, though? Apparently there was a pretty funny exchange during an early stage, when a freak hailstorm ended the stage and drove all the riders to seek shelter in a roadside hotel. As a friend recounted to me, Bob Roll said something like, “I’m not sure the stage should have ended, I think I’ve raced in worse conditions,” and Vande Velde replied, “You’re an idiot.” Don’t get me wrong, I like Bob okay, but honestly, that rebuke was long overdue.

So how hot is “hotter than balls”? It’s 34 degrees Kelvin. I know that’s not very helpful, especially when it’s obviously not Kelvin, that would be almost 400 below zero. Just making sure you’re awake. It’s 34 Celsius, which is 93 degrees Fahrenheit. Why do all these benighted countries persist with this inferior metric system?

With 1.7 kilometers left in the climb, the gap is down to 4:02. It’s not just Movistar working to close the gap, as several teams now have a good shot at helping their leader win this Vuelta. The favorite now would have to be Primoz Roglic (Red Bull - Bora - Hansgrohe), who has won this race four times, including two years ago. He’s in second overall and trails Mas by just one minute. Felix Gall (Decathlon CMA CGM Team) sits third, a mere 11 seconds behind Roglic, and in fourth is Sepp Kuss (Team Visma - Lease a Bike), 1:04 off the virtual podium and 2:15 behind Mas. Rounding out the top five is the current Best Young Rider of this Vuelta, the one and only Oscar Onley (Netcompany Ineos Cycling Team), a mere second behind Kuss.

Interestingly, with 54 kilometers to go, the gap is increasing again as riders tackle the penultimate descent. It’s back to almost five minutes. But we’re going to see three or four teams shredding the last climb, it’s gonna be awesome. So why does my cat look so bored? She’s barely paying attention!


Who are the other favorites for this Vuelta now? On paper, I’d expect the big battle to come down to Roglic vs. Kuss, since they’ve both proven they can win this. (In case you’ve been hiding under a rock for the last several years, Kuss has won the Vuelta before, in 2023, despite severe opposition from his own teammates.) Granted, Mas has been second overall three times, but there’s a big difference between first and second. Gall has only managed eighth overall. And neither of them has had to deal with the extreme pressure of seizing and defending a Grand Tour lead.

Alessandro Romele (XDS - Astana) attacks, weirdly enough, and takes the descent solo. I guess if he’s got mad descending skills he might as well; if the break fractures behind him he may have fewer competitors to contend with. Wow, he’s really good and has established a non-trivial 49-second lead. And it’s not like the break isn’t trying … their lead on the peloton has ballooned up to 5:46!


I don’t know how these short climbs get labeled Category 2. It seems like this one only just started and now there’s only 3.7 kilometers left.

Marcel Camprubi (Pinarello - Q36.5 Pro Cycling Team) is chasing down Romele as they approach the summit. He quickly cuts the gap in half. He’s really thrashing the bike but hauling ass, so.

Getting back to the GC favorites, which team is the strongest? Oddly, Visma - Lease a Bike evidently decided that without their usual leader, Vingegaard, they’d just hunt stage wins, which is working out great with their crazy-fast young sprinter, Matthew Brennan, who’s won two stages. Doesn’t bode well for supporting Kuss, though. Movistar was always in this for the GC, bringing two leaders, one of whom, Cian Uijtdebroeks, flamed out in dramatic fashion, dropping out after finishing dead last on Stage 4 due to a hairline fracture on his ankle. Our hearts went out to Uijtdebroeks, as he’d raced the entire stage with this injury, until we found out he incurred it kicking a dog. Then we all despised him, until we learned that the dog was completely racist and deserved to be kicked. Only upon further reflection—can a dog be racist?—did we become truly ambivalent, especially given the karmic notion that that dog’s being kicked was likely something that unfolded through natural moral causation or cosmic law, not entirely due to Uijtdebroeks’s will. We’ve ultimately decided that the case is too murky to justify a strong opinion, and we’ve gone back and deleted all the extreme comments we’d scattered across cycling websites.

Getting back to the team analysis, Decathlon has brought a very strong team here with the specific aim of supporting Gall in the overall. So the team dynamic could blah blah blah I wish something exciting would happen in this stage.

Holy crap, the lead is out to almost six minutes. What are these teams doing? I guess they still have time, with two big climbs to go.

Sivakov has caught Camprubi. They trail Romele by 33 seconds.

In the peloton, both Decathlon and Movistar are now working.


This is interesting. Romele decided his brake lever was dirty and spent so long washing it off, the two chasers all but closed the gap.


I’ll bet their levers are filthy. The question is, will that matter in the finale? We shall see.

It’s another endless commercial break so I’ve bounced over to Claude to see if I can get an answer to a pressing question: how is Kuss’s form right now? Naw, I’m just messing with you … I know the more pressing question is, did Kuss get that tooth fixed? If you’ve been following albertnet you’ll have read about how the American seemed to have Stage 20 in the bag, but then crashed—twice!—on the final descent. He did win the Combativity award, and I was shocked at the state of his teeth as he stood grinning on the podium (a good sport, always!). Kind of hard to look at, honestly. So I really hope he got that fixed now that he’s leading his team in this Vuelta with a serious shot at victory. But Claude can’t turn anything up about the tooth. There’s been no dental report in any cycling journal.

Now, if you’re pedantic enough to care whether Kuss and Roglic are riding well lately, I guess I can speculate. Roglic was hit by a car in training in late July, after which he said it was a struggle even to put on his socks. I’d say he’s riding great, considering. As for Kuss, he raced both the Giro and the Tour so he’s got to be pretty fried. Time, and miles, will tell.

As the riders near the base of the final climb, Decathlon is still up there and Movistar masses for Mas at the front.


More ads, including one for maple-flavored waffles at Chick-Fil-A. I’ll be right back, I have to go throw up.

Okay, I’m back, and the breakaway has reached the final climb. The gap is down to 4:25 on the leading trio, who now have 1:36 on what’s left of the original breakaway. Did I say trio? Looks like Romele detonated at some point and is nowhere to be seen. Oh well ... at least his lever is clean.


As the peloton hits the climb, Decathlon keeps drilling it at the front. How long can they keep this up? It’s a long fricking climb, like 12 miles. My mouth is watering.

The gap is down to 3:48. There’s a chase group of four 1:23 behind the leading duo … or is this really just what’s left of that giant breakaway? Behind them by 11 seconds is Lutsenko. I guess the group did detonate.

Wow, the peloton is depleted too. It’s gotta be fewer than 25 guys and there’s a lot of climbing still to come. The gap has now fallen below three minutes. If a GC favorite launches an attack, that margin could tumble pretty fast. Wait, did I just say “if”? I did. We could see a boring détente here. Mas and Gall just aren’t that attack-y, and Roglic and Kuss (per my earlier analysis) may not feel up to ripping everyone’s legs off, including their own.

For the team supposedly defending their leader’s red jersey, Movistar isn’t doing much now. They haven’t been on the front in at least a dozen miles. In fact, they haven’t even been ahead of Mas. And now one of them blows!

Up ahead, Sivakov attacks and gets a good gap pretty quickly. Camprubi looks to really be suffering, sawing away at his bike, out of the saddle.

Oh yeah, thirty seconds later Camprubi is toast.

Back in the GC group, Mas sits up to fiddle with his water bottle. Look, Mas, no hands!


Mas looks okay but man, his team is getting shelled. Look at this poor bastard being dropped. I wish you could see how bad his form looks, he’s dying.


With five miles to go, the gap is down to 1:45 and Sivakov looks like he’s really hurting.

Ooh, Kuss is dangling just off the back of the GC group.


And now Gall makes his move! Mas seems to handle it pretty easily but the group completely shatters.


Oh man, the gap to the break is plummeting as the grade gets steeper. Sivakov’s shoulders are rocking. It’s only 1:06 now … I can’t see him staying off.

Gall goes again! My god, the effrontery of this man! (You didn’t think I was gonna say gall, did you…?)


Sivakov is practically underwater.


The GC group is down to only Onley, Roglic, Mas, Gall, and Richard Carapaz (EF Education - Easypost). Kuss is way off the back. These guys are passing the remains of the break like in one of those car race video games.

Carapaz attacks! He looks great!


Wow, a big gap yawns way out. Carapaz could well win this stage. And what of his GC hopes? He started today in sixth overall, 2:22 behind Mas. He has to be considered a favorite, especially now. He won the 2019 Giro, you know.

Carapaz overhauls Buitrago.


Wow, Gall has attacked again and suddenly Carapaz and Sivakov are both neutralized!

Gall just keeps drilling it. He’s relentless. Mas just waits, watches, matches, no sense of any initiative but he’s just … competent. For now.

Golly, Gall attacks again, and this time he’s kind of caught Mas napping! Still, it comes right back together. These repeated attacks have got to be costing Gall, though.

Mattias Skelmose had been dangling off the back of this lead group but suddenly catches up and rolls right on by.


And just like that, there’s a huge gap. Skelmose is with Harold Tejada (XDS Astana Team) and one other dude but never mind, I think it’s—whoa, Mas attacks!


Only Onley can respond!


They blow right by Skelmose! He no longer exists!

Wow, Mas looks really strong, he’s just drilling it. And now Onley takes a turn at the front and the group is just scattered. Only Roglic can hang on ... for now.


Behind, Gall has faded and then Roglic. The two drag along for a bit and others catch up. 

Now Roglic has dropped everyone else and has 15 seconds to … no, the screen is wrong. He’s already bridged up!


Mas punches it again and Roglic is dumped instantly. Onley looks good, though.


The peloton has been blown to bits, it’s every man for himself. With 1.2 kilometers to go, it doesn’t look like Roglic can make it back. Cripes, Mas is just drilling it on the front. But Roglic is tenacious, he just keeps clawing away.

They head for the line and Mas leads it out like a boss! He’s crushing it! Onley is clearly in agony!


And Mas has got the win! Brilliant!


Roglic comes in for third and he’s so tired, he can’t even keep his tongue in his mouth.


It seemed like a great move from Carapaz but I reckon he either went too early, or brought the wrong legs today. He comes over in ninth.


So Onley only loses four seconds (due to the time bonus) today, a great ride for him even if Mas was the star of the day. If only Onley can keep this gap down, he might overtake Mas in the GC in the second half of this Vuelta.

Here’s the stage result.


It’s funny: after all the work Gall’s team did to set him up, and all the little mincing attacks he mounted, he ends up losing 18 seconds to Mas, plus another 10 from the time bonus. So he’s not nearly as impressive as his namesake, the tree gall, which is a bizarre phenomenon whereby a gall wasp lays an egg inside the tree’s tissues, and when the larva hatches it releases all these plant hormones and other compounds that cause this kind of weird blister to form on the tree, and this blister becomes like a nursery for the larva which, safely ensconced, feeds on the gall tissue as it grows. Compared to all that, Mas’s futile attacks and fourth place finish don’t seem very impressive. Gall must find Mas’s dominance, and this coverage of it, pretty galling.

And here’s the new GC. Quite a shakeup and Kuss drops to seventh.


They’re interviewing Mas.

INTERVIEWER: [unintelligible]

MAS: You’ve seen the team today, everyone working together so well, thanks very much also to the directors in the car as well.

INTERVIEWER: Why do you winners always do this? During the race you demonstrate individual dominance, crushing out your rivals like a cigarette, and then afterward you get all faux-humble and blather on about your team. It’s totally unconvincing.

MAS: The team was great, everyone was so calm.

INTERVIEWER: Dude. They were off the back. What are you talking about, calm? They were nowhere! When you needed them they straight-up evaporated! They were probably shitting bricks back there, at least they better have been!

MAS: I feel as though going forward I will be very calm, I had great sensations in the legs today.

INTERVIEWER: Is “calm” some kind of code word for “my team sucks and I’m the man!”?

MAS: You do not seem very calm. Do you need a minute to collect yourself?


Note: if you’re new to albertnet, you should know that I don’t speak any Spanish so when I’m translating these interviews, I take inspiration from AI and just blatantly make shit up. Rest assured, though, the fiction above is far closer to the truth than anything Mas actually said. If that makes any sense.

Bob Roll says, “It feels like a thousand light-years since Roglic won a Grand Tour.” This is the second time in this Vuelta he’s mistaken “light-years,” a measure of distance, for a measure of time. Also, a thousand light-years is the very height of exaggeration; that would be 5.879 quadrillion miles, whereas Roglic won the Vuelta as recently as two years ago.

Onley only had a lead of three seconds in the Young Rider classification as recently as Stage 6, but now that’s up to 5:45, a probably insurmountable margin. Am I deliberately contriving sentences to juxtapose “only” with “Onley”? You bet your sweet ass I am. And if only Onley only had a handful of seconds over second as before, the white jersey competition would be a lot more exciting. But let’s not diminish this achievement, as Onley only owns one such distinction so far in this Vuelta.

Christian and Bob are comparing the times of riders on this climb vs. the last time the Vuelta was here. “These riders went four minutes faster, almost five, that’s light-years,” Christian says, and then—as if catching himself—goes on to say, “that’s kilometers ahead.” So he course-corrected with regard to distance vs. time, although a kilometer is only 1.057 × 10⁻¹³ (i.e., 0.0000000000001057) light-years so this is still a gross exaggeration.

Well, nothing interesting is going on with the awards ceremony because there are no podium girls anywhere and no champagne either. It’s the most stripped-down podium presentation I’ve ever seen, they aren’t even giving out merchandise prizes like wheels of cheese, wooden bowls, or salad dressing like in other stage races. I was about ready to wrap this coverage up when I realized I should whet your appetite a bit for the rest of this Vuelta. It’s far from decided, because Roglic trails the GC by only 1:18, with a significant 32-kilometer mostly flat time trial coming in Stage 18. Roglic is a far better time trialist than Mas, Onley, and Gall, and seems to be riding into form in this Vuelta. We can expect a shakeup, and then I’ll be back to report on the queen stage, that being Stage 20, on September 12. BE THERE! (Well, here.)

—~—~—~—~—~—~—~—~—
Email me here. For a complete index of albertnet posts, click here.

Tuesday, August 25, 2026

Ask an Insensitive Man

Dear Insensitive Man,

My husband won’t admit his own insecurities and masks them by finding fault with other men, in a transparent effort to bolster his own ego. For example: he totally bags on men who ride electric scooters. I mean, these guys are getting around quickly, doing something for climate change, and not hurting anyone … what’s the problem? Is there any way, short of expensive counseling, to shore up my husband’s self esteem so he’ll stop doing this?

Martha V, Portland, OR

Dear Martha,

Does your husband criticize all kinds of other men and this is one example among many? Because if it’s just the scooters, I think you’re misinterpreting the situation. Any person in his—or her—right mind would rightly lambast adults riding scooters. I mean, have some dignity! Be a grown-up! No amount of energy efficiency is worth discarding one’s self-respect. Also consider that those things are a menace, due to their small wheels and their silent, swift tendency to appear out of nowhere. Imagine the unfortunate motorist who kills a scooter rider and has to live with the memory of that, even if the person killed was a twit.


Dear Insensitive Man,

I get no empathy from my husband when I open up to him about how hard ageing is on me, especially when I contemplate how saggy and crepey my neck is getting. He just blows me off like my grievance is unimportant. Does he just not even see me anymore?

Candace R, Newark, NJ

Dear Candace,

Men don’t care about necks, only women do (and of course you’re in good company, what with Nora Ephron’s classic essay “I Feel Bad About My Neck”). Generally if a man, be it your husband or anybody else, is looking anywhere in the vicinity of your head, he’ll notice your mouth and eyes more. And it’s widely accepted that many a man may call himself “a tits man” or “an ass man,” but I have yet to meet a “neck man.” I mean, think about it: can you imagine a guy describing a first date to a pal and having the pal ask, “So … how’s her neck?” It’s absurd. (Again, if you’re worried about what other women think about your neck, that’s an  entirely different matter. Just don’t go dragging us men into it.)

Dear Insensitive Man,

I am eight months pregnant and my husband seems oblivious to all the suffering and indignity I’m going through, what with the weight gain, the nausea, my feet hurting all the time, and on and on. How can I wake him up and maybe get a little empathy, or at least some more help around the house?

Kim Reed, Oakland, CA

Dear Kim,

If your husband is normally more sympathetic, such as when you’ve got the flu or a twisted ankle, you might chalk this up to him not knowing how to react to the pregnancy, given the strangeness of your metamorphosis and the drastic life change and awesome responsibility he knows is about to descend upon your lives. (Or maybe I’m just making excuses … after all, when my wife complained about such pregnancy-related discomforts, I replied, “If it’s any consolation, I feel great!”) Hang in there, shame your husband into helping more, and hope for the best. And don’t worry, you’ll get to turn the tables one day when it’s time for his vasectomy and he gets dry-shaved with a 25-cent Bic. Sure, his suffering will be briefer than yours, but at least you’ll have a moment to throw it in his face … that and every other trivially painful situation he may encounter after witnessing childbirth.

Dear Insensitive Man,

I truly believe there is something wrong with my husband. Although he’s a loving father and enjoys reading to our young daughters, he’s managed time and again to read aloud the brilliantly touching Love You Forever children’s book, from cover to cover, without crying at the end. Not a single tear, not once! How is this possible? Is he actually a heartless, unfeeling iceberg?

Sarah M, Topeka, KS

Dear Sarah,

Don’t worry, there is nothing wrong with your husband. He doesn’t cry while reading Love You Forever simply because the book is actually not that touching. When you cry reading it, it’s probably because it’s giving you a good excuse, and you were probably going to cry sooner or later anyway. Let me tell you a story: in college, a friend once invited me to movie night at her sorority house. This seemed like a great deal: a free movie and snacks, plus I’d be surrounded by beautiful girls I could possibly hit on! The problem was, the movie was “Fried Green Tomatoes,” a total chick-flick. Before the opening credits were even over, every single girl was already crying, and then as the movie progressed they all shot daggers at me. It seems I’d stumbled into what was probably supposed to be a female bonding ritual, basically a chance to cry together, and maybe Love You Forever is in that insta-cry vein. (All this being said, if your husband can make it through reading The Gardner aloud without crying, why then yes, something is wrong with him.)

Dear Insensitive Man,

My brother-in-law accused my husband of, and I quote, “whining like a little bitch.” My husband hasn’t said anything about it, but I think his feelings were really hurt. Would it be inappropriate for me to confront my brother-in-law and let him know he owes his brother an apology?

Jan K, Cheney, WA

Dear Jan,

Most of my friends call me a whiny little bitch from time to time, and it doesn’t bother me a bit—this is just how a lot of men talk. In fact, it’s almost like a compliment, because it means they know I can take it. And if occasionally I reply, “That really hurts my feelings,” they know I’m joking. Now, if you’re worried about “bitch” being sexist, consider that many modern men call each other “bitch” all the time, and that it’s gradually evolving into a gender-neutral term, via a process linguists call “semantic bleaching.”

Dear Insensitive Man,

My husband is a big pain in the ass when it comes to hiring a tradesman, such as a plumber or handyman. It’s like his male ego can’t handle it. So he says he’ll do something, but then puts it off. Even when I suggest he hire somebody simply because he has better things to do with his time, he acts all butt-hurt. Is there no way out?

Tina O, Brooklyn, NY

Dear Tina,

I can see two main sources for your husband’s hesitation, and both may apply. One, he’s a cheap bastard; two, he doesn’t want to admit he’s incapable. Don’t be too bummed about this; I mean, imagine if your guy was lame, and shameless, and didn’t even know how to change the filter in your furnace or program your thermostat, or if he paid a bike shop to fix a flat tire on your commuter bike. (Is it wrong of me to assume you’d look to him to do these things? Of course it is, I’m an insensitive man!) As for the solution, that’s easy: wait until he’s away all day at a ball game or camping trip, and hire the handyman while he’s gone. When he gets home and acts all irritated, a) consider that he’s probably faking it and is secretly relieved, and b) turn it around and say, “Honey, I wanted it to be a surprise!” (Note: don’t say “honey” unless you routinely call him this. My wife only says “honey” when she’s pissed at me.)

Dear Insensitive Man,

A friend of mine recently transitioned to a new gender identity. My dad is sloppy—perhaps conveniently sloppy—about remembering my friend’s chosen name and affirmed pronoun. I think my dad is being passive-aggressive, and that deep down inside he is reluctant or even unwilling to adapt to this societal evolution. Is there some way to get through to this man?

Alicia C, Los Angeles, CA

Dear Alicia,

I suspect it’s the case that your dad is actually trying, but is having difficulty shedding the habit of using the deadname and previous pronoun, especially if he’s known your friend for years. That you say “sloppy” suggests that your dad sometimes gets it right, whereas a non-affirming traditionalist is likely to be boldly defiant and unapologetic. If your dad apologizes, he probably means it and you should cut him some slack. But if he slanders your friend’s transition openly, you have my permission to kick your old man in the balls.

Dear Insensitive Man,

My husband is a generous tipper when he tips, but he seems a bit stingy when deciding who deserves a tip and who doesn’t. For example, when we were traveling recently he didn’t tip a really friendly hotel concierge who gave us great advice on a local restaurant. What do you do with a husband who is insensitive to the service sector?

Lisa S, New Haven, CT

Dear Lisa,

If your husband tips baristas, hotel maids, cab drivers, parking valets, and bartenders, and at counter-service restaurants, I doubt he’s insensitive to the service sector. Frankly, I wouldn’t have tipped the concierge either—it’s that guy’s job to be generally helpful and courteous, and to be given a cash tip for dispensing friendly advice might actually insult him. Ask yourself this: did your husband tip you the first time you had sex? Did you wish he had?

Dear Insensitive Man,

Is it possible to be too sensitive? It seems like my son does all the dishes for his entire household. Every time we talk on the phone I hear him doing dishes in the background. Is my daughter-in-law taking advantage of him?

Jill A, Ashland, OH

Dear Jill,

I don’t think this is about sensitivity or progressivism, but probably just an arrangement that works. Does your son’s wife do more of the cooking than he does? If so, this could be a perfectly fair trade. It could also be that on some level your husband actually enjoys doing the dishes, or at least finds it soothing. It also could be that, if he’s punctilious and efficient about it and you are slapdash, that he’d rather do it right than have you do it wrong. I watched some stand-up comic on Netflix recently who said there are two kinds of men: those who have a particular way of loading the dishwasher, and those who step out on their wives. I think she’s on to something.

Dear Insensitive Man,

My boyfriend has this nagging habit of pooh-poohing very real world problems like climate change, overpopulation, and threats to democracy. Particularly when these are discussed among friends, he just clams up, though he’s normally a pretty gregarious guy. People we socialize with may well get the idea he just doesn’t care about anything, when I know this man’s heart is good. How can I housetrain him to be more politic?

Vivian L, San Francisco, CA

Dear Vivian,

Hang on to that guy, he could be a good influence on you! If he really doesn’t care, that could be a red flag, but it’s just as likely he simply doesn’t consider these worthy topics of conversation—in which case I agree 100%. I mean, what are you and your friends going to actually solve, unless you are in politics or members of a think tank? Maybe he needs to housetrain you to be less political.

Dear Insensitive Man,

I have just started shaving. While I was home from college for the summer, my dad watched me shave with my new Gillette ProGlide razor and started giving me a hard time for how I let the “Shaving Industrial Complex” dupe me into overspending on blades just because I’m afraid I might cut myself. He called my razor a “child’s toy.” He’s normally a pretty good guy but what the actual fuck?! Can you tell him how lame he’s being so I can show him the column and get him to lighten up?

Henry C, Las Cruces, NM

Dear Henry,

I hate to break it to you, but your dad is completely in the right on this one. It looks like the replacement blades for your razor run about four bucks apiece, vs. under 25 cents for a proper double-edged blade, made for a traditional steel razor, that actually provides a closer shave. The ProGlide is stupid, plastic, and does look like a toy, and you need to man up here. Shaving is just not that complicated. If you need inspiration check out “Ode on a Double-Edged Razor.”

An Insensitive Man is a syndicated journalist whose advice column, “Ask an Insensitive Man,” appears in over 0 blogs worldwide.

—~—~—~—~—~—~—~—~—
Email me here. For a complete index of albertnet posts, click here.

Tuesday, August 18, 2026

DUMB Goals in Action!

Introduction

If you were a cyclist in your mid- to late-50s, and I promised I could help you improve your average riding speed by 5%, and/or lower the time of your 20-mile evening loop by an average of six minutes, while maintaining or even lowering the amount of time you spent training, would you be interested? Now let’s assume you aren’t a cyclist: would you still like to know how I’ve actually achieved these strides—among others—simply by setting a DUMB goal and working casually toward it? Well, read on. That’s what this post is about.


But first … what is a DUMB goal?

Years ago in these pages (here!) I derided the ballyhooed but also hackneyed “SMART” goals that motivational speakers like to trot out. SMART generally stands for  Specific, Measurable, Attainable, Relevant, and Time-bound. I dislike this framework because it makes you decide in advance what success really looks like, when so often we have no idea. Consider workplace revenue goals: their feasibility is at the mercy of industry trends, the economy in general, and the skill of those trying to decide what a reasonable target really is. Only once in my thirty-plus-year career did a director push back; after a missed revenue goal, he told his leadership, “We don’t have a performance problem—you have a forecasting problem.” (He didn’t last long.)

Let’s consider a SMART goal of losing fifteen pounds by December 1. That’s specific, measurable, possibly attainable (depending on the person and how overweight he or she is), perhaps relevant (if a doctor recommended the weight loss and/or the person feels bad), and clearly time-bound. But is it a good goal? I think not. Suppose a person exercises a bunch, eats really well, and ends up only ten pounds lighter on December 1. He or she might feel bummed out at having failed. But what if he or she had actually lost fifteen pounds of fat and gained five pounds of muscle, but doesn’t know it? The specificity becomes a setback. The person may feel demoralized and less inclined to bother with the new lifestyle—which brings up another issue, which is that making this goal time-bound kind of suggests the project  is over, when of course a noble goal like a better lifestyle  should be a lifelong habit, regardless of silly metrics.

That’s why in a subsequent blog post (here!) I proposed an alternative: DUMB goals. This type of goal is Duplicate,  Unimpressive, Mealy-mouthed, and Best-effort. Am I kidding? Well, of course I always seek to amuse, but actually, I’m completely serious. Consider:

  • Duplicate: A goal you failed at already—never mind what anyone else tells you—is a great goal to try again at because if an attempted improvement was important to you before, that probably hasn’t changed. Failing to achieve something attests only to its difficulty and is no excuse for giving up.
  • Unimpressive: Too often, a goal puts too much emphasis on getting credit, on getting noticed. By gaining too much social payoff just for stating your flashy goal, you can actually reduce the likelihood of achieving it, because your ego gets stroked before you’ve even succeeded (as described here).
  • Mealy-mouthed: Being too specific, as with the weight loss example described above, can set you up to feel like a failure even when real progress is being made. Being more vague gives better elasticity to the tricky, messy business of self-improvement.
  • Best-effort: Defining success as pass/fail can lead to a sense that you’re done, or conversely that a goal is futile … and either way, you may be inclined to check—or strike—the goal off your list. Treating your goal as an ongoing attempt at improvement can keep it alive indefinitely.

But do DUMB goals actually work?

My original post about DUMB goals, being on the theme of New Year’s Resolutions, was more hypothetical than empirical. The idea was to shift the reader’s thinking about how to formulate a better resolution. But over the last two years—and especially the last ten months—I’ve actually made startlingly good progress on a DUMB goal of my own.

Here’s the goal: as I age, I want to build and maintain as much strength and vigor as possible, on and off the bike, while improving my balance so I don’t fall and break a hip when I’m 80.

How DUMB is this? Very. Is it Duplicate? Well, I’ve been fretting about the ravages of age for, well, ages—my first blog post on this (here!) was over 17 years ago. Is the goal Unimpressive? Yeah, I’d say—it’s not as bold as planning my first Tough Mudder or marathon; I mean, who doesn’t want to age gracefully? And is it Mealy-mouthed? Sure—it doesn’t apply any metrics. And it’s clearly Best-effort, with the vague “as much as possible” element that gives me all kinds of wiggle room.

Now, this isn’t to say a DUMB goal is no better than no goal at all. Instead of breaking a lofty aim down into very time-bound and measurable milestones, with progress tracked carefully, as one would with traditional goals, a DUMB goal like mine can be simply directional: without getting too meticulous about it, what general lifestyle changes might take me in the right direction?

And this, as I learned kind of by accident, is the secret sauce of DUMB goals: you can make huge strides by selecting just a few general behaviors which should bring the goal closer, and then focusing on the process of executing these behaviors as well as possible. Getting feedback on your progress in the  moment, as opposed to periodically measuring yourself against some (frankly kind of arbitrary) goal, turns out to be incredibly powerful. I love this quote from an article about parenting in the NY Times: “A Dutch father of three told me about his Buddhist-inspired approach: total commitment to the process, total equanimity about the outcome.”

General behavioral change #1: balance saucer

I wrote already about my balance saucer, here. And it’s been great. I ditched the directions and started with just a vague idea of the kinds of motion I wanted to do (e.g., tapping the front edge of the saucer on the floor with both feet on the saucer; tapping the back edge; tapping forward on one foot; backward on one foot). At first I couldn’t even do them all; the backward-on-one-foot seemed impossible. But it wasn’t, and when even that got too easy, I started adding in other stuff to do on the saucer: standing on one foot pulling a knee to my chest; standing on one foot and sticking a leg out straight; doing a slow, all-the-way-down squat; putting on my shoe and tying it while standing on the other foot. I avoided the drudgery of trudging toward milestones; my saucer tricks are more like what the Cat in the Hat would do (e.g., now I’ll balance on the saucer with this fishbowl on my cane!) or the ways Tom, of Captain Najork fame, enjoys just messing about. Maybe I’ll work up to a one-legged squat, or juggling while tapping on one foot, or doing all this while drunk (kidding!).

Though I had no objective other than to buy this saucer and use it, I can tell you now my balance has improved significantly. For example, I can now ride the white line of the road shoulder on my bike, not just coasting, but pedaling at full power, even out of the saddle. (It’s rare to learn a new trick after forty-five years in this sport.) Not only that, my core seems a lot stronger: my back never hurts anymore (knock wood), and basic tasks like putting on socks and shoes have become easier and more fun.

General behavioral change #2: join a gym

Lots of people join gyms, and then they don’t go, and they feel bad, and they fall behind in their SMART goals, and the whole thing is just a big drag. But I’m the world’s cheapest man, so when I join a gym I actually go, just to get my money’s worth. Meanwhile, half the reason I joined is that my wife wanted me to, so I could go with her and, as needed, kick the asses of any creepy guys there. (That’s the theory, anyway; so far everyone has behaved, which is a big disappointment.) So when my wife signs up for a class, I head over there with her, because honestly I seldom have a good excuse not to.

Now, I could ruin all this by making SMART goals around the gym workout, like gaining or losing some number of pounds, or adding some measurable amount of visible bulk, or being able to bench press some specific weight. But I’m too DUMB for that, so all I did is get a tour from the gym staffer, showing me a generic circuit training regimen that is popular, and that’s all I do, with no real programmatic rigor other than always being in motion. I get it that if you want to become huge and swole via a specific machine, you have to sit there for fifteen minutes between sets, scrolling on your phone, so your muscles “recover” or some damn thing, but that’s not a good use of my time.

I started off setting the machines to really low weight, just to keep from maiming myself, on the assumption that anything is better than nothing. I do fifteen minutes of cardio on  the elliptical machine to warm up, then do my circuit training, in order of whatever weight machine is open next so I don’t have to stand around waiting for some dude on his phone working toward a SMART goal. My routine takes almost exactly an hour. Now, as long as I’m there I might as well do a good job, which means paying attention to how my body handles each exercise so I can gradually, but safely, increase the weight over time. And since all the muscles in my body other than my legs have been neglected my entire life, progress is swift even at my advanced age. On the leg press I’ve gone from 90 pounds last October to 155 pounds today; on the rowing-esque machine I’ve gone from 35 to 80; on the shoulder press from 20 to 55; and so on. As with the balance saucer, working toward a DUMB goal helps keep things fun and stress-free. It’s hard to miss developmental milestones when the only one you have is “go to the gym a few times a week.”

And has all this paid off? It sure has. It’s a fun new routine with my wife, biking to the Y and back for our workouts; the improved core and back strength I touted earlier is probably partly due to this regimen; and, believe it or not, the arm warmers in my cycling costume stay up better than they used to. In fact, my biceps look a bit less like the almost two-dimensional blades of an oar and more like normal arms (though I dare not suggest they’re muscular, at least not yet). I’ve gained seven pounds, and it’s not in my belly so I’m going to call it an improvement. And, as you’re about to find out, the weight room circuit training might actually be helping with my cycling.

General behavioral change #3: use a power meter

About a year ago I bought a new road bike. As detailed here, it’s a totally sweet machine, and even came with a built-in power meter (that is, a strain gauge in the crankarm), which measures my output in watts and sends it to my bike computer. The power-meter-capable bike computer is sold separately, and after a brief struggle—dragged out by misplaced faith in AI—I got it working just in time for the new year, so I could switch platforms without messing up last year’s stats. Figuring that this new tool could probably help me somehow in my DUMB goal to age more gracefully, I started fiddling with it during my rides, studying the numbers and wondering vaguely, in the spirit of Alice as she tumbles down the rabbit hole toward Wonderland, how its data could help me improve. What I eventually realized is that my average power output for a ride exceeds what I’m doing at various points during it, and this represents a major area for improvement.

Let me explain. On a typical ride, my power output will average around 210 watts (or 250 “normalized” watts, meaning the average after all the very low readings from almost coasting, etc. are discarded). So I have been challenging myself during rides by asking, “Why is my output below 200 watts right now?” And for that matter, why should it ever be below 200, if I know I’m capable of maintaining that? Unless I’m doing a tricky descent, there’s really no good reason. To have a wide variance in effort during a ride just boils down to laziness (albeit a less drastic version than coasting when you could pedal). Despite my long tradition of making myself suffer during rides, I also have the human habit of conserving energy where possible, instinctively. Once I started paying more attention to my power output in the moment, throughout the ride, I started seeing the duration of my standard evening loop drop, and then drop some more.

Now, managing my effort better on a ride, nipping and tucking the lazy bits, might not seem like a game-changer; I mean, I get home a couple minutes earlier but so what? Well, as I eventually realized, going harder, consistently, all the time, actually improves your fitness. I mean, duh! It kills me how long I took to realize this actually, since it’s so obvious. But what I found is that the more I managed to keep the intensity up, ride after ride, the faster I got, and the more fun I had, and the more motivated I got. I discovered that the biggest improvement was in my power output while riding in the saddle, probably due to the increase in my core strength from the balance saucer. The muscular strength from the gym must be a factor too, because my fitness just seem to start to compound, like a freakin’ 401(k).

Improvement by the numbers

Here are some numbers to illustrate how crazy my progress has been. It’s a bit hard to compare my performance since a year ago (since during that period I had to alter my evening route due to a road closure), but my average speed over my longer (mostly weekend) rides went from 15.1 mph last August to 16.0 now, with most of the improvement coming since March, when my average was 15.2 mph. That’s a 5% improvement in speed, for the longer rides, in about four months.

But you know, my average speed during longer rides is a bit diluted, because loafing is naturally a bigger part of a 65-mile weekend ride with friends. My 20-mile after-work solo spin represents about three fourths of my rides, so this is where most of my fitness is built. It’s also where my improvement has been the most dramatic: last March my solo loop took me, on average, 1:24 (an hour 24 minutes), and this past month only 1:18. Can you imagine shaving six minutes off a 20-mile loop? And it’s not just that I’m bothering to ride faster; I’m capable of riding faster—much faster. My best time for this loop last March was 1:23, and a couple weeks ago I did it in under 1:14. Nine minutes faster. Are you kidding me?

But wait, this gets even better. I happen to track my total exercise duration pretty closely because I do an online DIY training contest with my family, and when I compare July 2025 to this past July, I see that my total duration actually declined significantly, from 58:12 (58 hours 12 minutes) in July 2025 to 45:26 last month. It’s nuts: I’m training less and my performance is soaring. All because I keep adding balance saucer tricks, gradually upping the weight on the gym exercise machines, and striving to maintain higher power throughout my rides. All in the service of this one DUMB goal.

And here’s probably the best part: all of my improvement has been, ultimately, gravy. Sure, I’m closely measuring and tracking my power, time, and speed on the bike, and my weight selection in the gym, but not in the service of holding myself accountable to anything. If this rate of improvement levels off next month, or even starts to drop, I won’t get discouraged, because remember my goal: to build and maintain as much strength and vigor as possible, while improving my balance, as I age. All I have to do is not decline. Actually, to not decline too fast. Best-effort!

Unimpressive

A final note: I want to emphasize the “U” in this DUMB goal: unimpressive. Consider how bored you’ve been getting over the last few paragraphs. That’s because, as important as my progress is to me, you couldn’t care less—and shouldn’t. This is why I think goals should be personal, and essentially private. I only present my experience to you as an illustration of what you yourself may achieve if you stop beating yourself up with SMART (or even just traditional) goals, and start thinking DUMB! Good luck with it!

—~—~—~—~—~—~—~—~—
Email me here. For a complete index of albertnet posts, click here.

Tuesday, August 11, 2026

AI Security Threats - Is It Time to Panic?

Introduction

It’s been over nine years since my last post about how to stay secure online. A lot has changed since then, particularly with Artificial Intelligence making everybody more effective at everything. (At least, this is what Corporate America is telling itself, and in the case of fraudsters, it’s actually true.) In this post I’ll briefly highlight some of the most pressing AI-driven threats, and then focus on what you can actually do to protect yourself, vs. what we’ll have to hope “they” can protect us from. Short version: be extra wary of phishing and spear-phishing attacks. (Oh, and no point in panicking … yet … as far as I know. I put “panic” in the title of this post just to grab your attention—and look, it worked!)


Major AI-driven security threats

Here are some of the top Internet security threats presented by AI:

  1. Autonomous attacks: Fraudsters are using agentic AI to unleash fully automatic phishing and other attacks, greatly speeding up their campaigns.
  2. AI systems as attack surface: As companies build AI into email, documents, and workflows, attackers are targeting the AI stack directly rather than going around it. (Some call this “AI supply chain compromise.”) Malicious instructions can be hidden inside the content that an AI reads as it goes about its job, and training data can be poisoned.
  3. Deepfake-driven identity collapse: AI can produce realistic voice, face, video, and document forgeries cheaply and at scale. This can undermine authentication systems across corporate, banking, and consumer platforms.
  4. Data leakage from ordinary use: As corporate employees use AI normally, and get very specific in providing context for their prompts, they often share more info than they mean to, giving bad actors access to sensitive data without even having to steal it.

(Why four threats, instead of a nice round number like three or five? I based my assessment on queries I made to ChatGPT, Gemini, Copilot, and Claude, and these are the four top threats that all these models agreed on.)

On top of these threats, and overlaying them, is Open Source Intelligence (OSINT), which in the context of Internet security refers to personally identifiable information (PII) that over time has become public due to voluntary posting of it, such as on social media (e.g., Facebook users sharing info about themselves, their activities, and their families, assuming it’s only seen by friends and online “friends” and not realizing how easily shareable it is across the entire Internet). All this data has been increasingly well indexed by Google and other Internet tools, and now web scrapers and other generative AI tools can easily harness this sensitive data to create targeted phishing (i.e., spear-phishing) attacks.

An example of an OSINT hack

This will all make more sense, I think, if I provide an example. It occurred to me recently that anyone with a Gmail account could create a Gemini Notebook into which they could feed large batches of albertnet posts, to turn this very blog into a chatbot. They then could query this chatbot for any and all PII that could be used to answer security questions when trying to impersonate me. To identify such vulnerabilities, I did this exact exercise myself (employing a tactic called Defensive OSINT—basically beating hackers to the punch). I fed the most likely categories of albertnet posts (e.g., Parenting, Bits & Bobs) into a Notebook and asked the chatbot to build a comprehensive “public knowledge index” of PII based on the categories most often used for website authentication security questions. Then I had it produce a report describing the vulnerabilities it found.

Did it come up with anything? Well, yes: it found one item of rather sensitive information based on a bit of handwritten text that was included on a picture that was posted. I found that pretty embarrassing, but it was easy enough to remove since this is my blog and I manage the content directly. (Also, because I own the domain used by my blog, I can go to web.archive.org and have the original version of the post removed forever.)  Fortunately, I’ve had an eye on privacy and security for the whole time I’ve been blogging, so other than some pet names and schools I attended, I’m overall in pretty good shape. Here’s a particularly amusing excerpt from the Gemini Notebook security audit report:

Category V: Workplace & Career

The author’s career trajectory is extensively documented, providing a roadmap for Business Email Compromise (BEC) and “Career Gate” attacks.

Security Risk Assessment: Attacker groups scrape metadata from Blogger sidebars (e.g., the “Specialist” title) to craft highly targeted BEC lures. By referencing past roles like “underwear canner” or “radio station receptionist,” an attacker can establishing [sic] a false commonality to bypass corporate security screenings or impersonate a former HR representative for the purpose of credential harvesting. 

As you can see, when you share personal information on the Internet, it’s highly advisable to bullshit a lot. I have a feeling that the above career information, even in the hands of the most devious hacker, isn’t going to get me in a lot of trouble. I do need to warn family members not to use any of the PII in my report (e.g., a pet’s name, a school name) as security answers, though I’ve already cautioned them—as I’ll now caution you—to not use real PII for security questions in any case; after all, you can’t change your mother’s maiden name or the city you were born in, so once somebody hacks a website and gains these answers, you’re pretty much hosed. And good luck remembering what security questions and answers you’ve set up over the years across all the sites that use them for authentication.

So can everyone run this kind of audit? Well, any blogger can, but if you’ve been active on multiple social media platforms over the last ten or fifteen years, it’s gonna be really tough. And remember, in many cases (e.g., Facebook) you do not actually own that information. Probably the best thing you can do is keep an eye out for spear-phishing attacks.

Some updated anti-phishing basics

In my previous post on phishing, I pointed out that you could often spot fraud based on bad spelling or grammar (e.g., “Security fraud alerted corporate card!” or “Account info updating needs!”). This is no longer a reliable rule of thumb, because AI has gotten so good at grammar and even at matching the style of the supposed sender. It’s more likely to produce a realistic subject line as well (as opposed to something generic like “Hello”) and isn’t so prone to excess emoticons, weird fonts, and/or tacked-on numbers (e.g., “✅  𝙋𝙡𝙚𝙖𝙨𝙚 𝙘𝙤𝙣𝙛𝙞𝙧𝙢 if you're qualified for a compensation 5078227).” My previous advice still stands: don’t click on any link in an email unless you completely trust the sender, and have hovered your cursor over the link to make sure the domain matches what you’d expect based on what your contact purports to be sending you.

For example, if a cycling buddy sends you an email that says, “You’ve got to check out this Tour de France blow-by-blow report from albertnet,” and the link says “Tour de France Stage 15,” and you hover over the link and see the URL “https://www.albertnet.us/2026/07/biased-blow-by-blow-2026-tour-de-france.html, ” that would be safe. But if you get an email from $CashApp$  (nxaqlvxcvm@ekgkx1ylmv.co.us via arbeitsstellepro.com) with the same message (or any message, actually), you shouldn’t click on any link in it. Or, let’s say you get the same aforementioned Tour de France email from a trusted pal, but hover over the included link and see “https://www.xtremecloudmontzer.xyz/encryptvictimHD” … you obviously shouldn’t click it. Now let’s say you got a legit albertnet link to the Tour de France post, but from a friend who constantly bags on my blog and/or on the Tour de France. Valid-looking URL aside, you might reasonably decide the message fails the sanity test, and you should send a separate email to that friend asking, “Did you really send me a link to an albertnet post?”

Always be especially careful with any email that conveys a sense of urgency and wants you to take immediate action. Fraudsters will employ that to try to get you to bypass your normal habit of being careful and deliberate with your email. It isn’t always the foreboding kind of urgent; it could alternatively be the upbeat kind of urgent, like a party invitation, which gets us excited because hey, fun, party! 

Anatomy of a spear-phishing attack

A friend of mine fell prey to a spear-phishing attack recently because an email she received was from a friend who’d been on a volunteer board of directors with her, who quite reasonably could be hosting a reunion. The email looked like a standard punchbowl.com invite, with the right logo, etc. My friend, due to a momentary lapse of reason, clicked the link without hovering over it. If she had bothered to hover, she’d have seen this (click to enlarge):


Since my friend doesn’t use Outlook, she wouldn’t have been falsely comforted by the “Protected by Outlook” indication and in fact would have found it suspicious—had she hovered over and seen it! Meanwhile, even if the fraudster had lucked out and my friend were on Outlook, she would have been wise to suspect the “roves.sbs” because a) it isn’t the punchbowl.com domain, b) it isn’t anything recognizable, and c) that .sbs top-level domain is automatically suspicious because that’s an extremely cheap domain, perfect for hackers. (They love a cheap domain they can set up to snare as many victims as possible before the fraudulent site is identified and flagged by security community filters like Google Safe Browsing or Norton.) On top of all this, the URL shown above isn’t even itself the real URL—it’s a bogus tooltip set up by the hackers. You need to look in the lower left of your browser screen to see the real URL, which in this case was “accounts.lifeofastartryfghjgd.icu,” which a) also isn’t the punchbowl.com domain, b) also isn’t recognizable, c) looks like somebody started to type something plausible but lost patience, and d) has another disposable, cheap, very phishy landing page domain. Alas, my friend missed all of this, delighted as she was to be invited by a friend to a party, and just clicked the link.

From here, things went even more sideways. First, she was presented with a CAPTCHA she had to solve to prove she was human. This was employed by the attacker for three reasons:

  1. It stymied her security software, hiding the phishing page and thereby preventing the software from blocking it;
  2. It established a sense of trust, because users associate CAPTCHA screens with security (i.e., it made my friend think the site was establishing that a bot wasn’t trying to accept the invitation);
  3. It confirmed to the attackers that a real human—i.e., a dupe—had actively taken the bait, and they probably added my friend to a list of suckers who should be actively phished again in the future.

Then, the page went in for the kill, saying that to accept the invitation and add it to her calendar, my friend should log in to her Google account. It helpfully provided the input fields to do so. Only at this point did my friend smell a rat, and closed the page instead of serving up her Gmail address and password to the hackers. Probably there was no harm done, but man, what a close call! (It’s possible the site could have meanwhile instigated a “drive-by” malware download, but this probably wouldn’t have worked without her browser asking her to explicitly approve a file download or browser extension installation.)

As you can see, phishing has gotten more sophisticated. And the worst part of the phishing email my friend received was that it did come from a known person, and (whether through luck or knowledge of the person’s work experience) created a plausible scenario: this was exactly the kind of invitation my friend would expect to receive from this person. This is one of the ways spear phishing attacks are engineered.

Incidentally, my friend contacted the sender, and sure enough, this person’s PC had been compromised and the attack mounted against everyone in her address book. Why she hadn’t warned anyone is a mystery to me, and I hereby implore you to let all your contacts know if your system ever gets hacked. It’s no different than the responsibility a sexually promiscuous person has to notify his or her paramours about testing positive for a venereal disease. (For a charming comedy series on this theme, you might check out “Lovesick” on Netflix.)

AI and spear-phishing

Getting back to AI, it changes the game by making phishing attacks more realistic than ever, and at a lower cost to hackers. In the past, spear phishing was time- and labor-intensive, and thus reserved for people who are (no offense) bigger targets than you. But now, with AI, producing a bespoke attack with maximum plausibility has gotten easy, fast, and cheap. Gemini describes it thus:

Traditionally, gathering intelligence on a target required significant manual effort. If an attacker wanted to map out a corporate hierarchy, scrape executive social media, identify software stacks, or build custom spear-phishing personas, it took days or weeks of painstaking human research.

AI-driven OSINT compresses that timeline from weeks to seconds:

  • Automated Harvesters: AI tools can scrape public records, forum posts, code repositories, blog archives, and dark web dumps simultaneously.
  • Instant Synthesis: LLMs [large language models] parse millions of lines of unstructured text, connect disconnected data points across 15 different platforms, and output a clean, actionable “target profile” with zero fatigue. 

This means that instead of a person employing just a few methods to get the target to let his or her guard down (e.g., crafting a realistic-looking, well-written email seemingly from a friend who might plausibly have written it), AI can generate a hyper-personalized attack, presenting specific contextual details designed to boost the sense of authenticity, with a high likelihood of dissolving the recipient’s natural defenses of skepticism and caution.

Imagine if my blog were less slippery, and the career info I posted were actually relevant and factual. I could get an email from someone purporting to have served with me in the Artillery Regiment in the late ‘80s, who has announced he’s become very successful in the underwear canning business; understands my frustration with modern corporate America; and would like to talk to me about an executive position at his startup with great pay, a signing bonus, and stock options—and all I have to do is go to this website and upload my CV! The specificity of this email might dupe me, if I actually had served in the same Artillery Regiment, and if canning underwear had been a bigger part of my career. And imagine if the fraudster spoofed the identity of a guy I actually knew (“it’s your old pal Fred, from the Hot Chillys cannery!”) … the email would seem pretty legit. Somebody harvesting LinkedIn PII instead of albertnet might actually get somewhere.

The ABC mnemonic

To protect yourself from spear-phishing attacks, I recommend borrowing a concept from police detective training: the investigative doctrine of “ABC.” Across the UK and Commonwealth, detective trainees are taught to Assume nothing; Believe nothing; Check everything.” Adapting this for Internet security:

  • Don’t assume an email is safe, just because it has proper formatting and logos, good grammar and spelling, etc.
  • Don’t believe an email is really an intentional communication from your friend, even when the source email address checks out, if there’s anything even slightly phishy about it
  • Check for any sign that the email could be fraudulent.

Here are things to watch for in that third “check everything” step:

  • The email has a mismatched “From” vs. “Reply-To” address (e.g., purports to be from Bank of America but the reply-to address has a phishy domain like banksupport@bank.sbs)
  • It includes a link it wants you to click, especially from an unusual top-level domain (basically anything other than .com, .gov, .edu, or .us and especially the johnny-come-lately TLDs like .xyz and .biz or anything you don’t recognize—always remember to hover over a link before clicking it)
  • It includes a link with a shortened URL like bit.ly (which can be used to hide a phishy domain)
  • It has a file attachment, especially something besides a PDF or JPG
  • It conveys a sense of urgency (especially from a bank or other business telling you they’re going to have to block your account, or already have, or will have to close it unless action is taken such as updating your payment details, etc.)
  • Is from a business but has emoticons in the subject line (I mean, really?!)

Is albertnet safe?

Yes, albertnet is perfectly safe. This website doesn’t run any scripts; doesn’t employ cookies or tracking pixels or Google Analytics; won’t try to install anything; and never includes links to unsafe websites. I won’t serve you ads, don’t want your money, and respect your privacy. About the only risk you’ll run is believing I served in an artillery regiment, or that Strava has a new nighttime KOM category, or that the Tour of Sweden was held in 2020 at the height of the COVID-19 pandemic. And at least when I bullshit you I always fess up.

—~—~—~—~—~—~—~—~—
Email me here. For a complete index of albertnet posts, click here.