The FBI can (almost certainly) crack the San Bernardino iPhone without Apple's help

The title kind of says it all.  How do I know?  Because of this photo:


That's a picture of the logic board of an iPhone 5C, the same model as the San Bernardino phone.  The chip with the red outline is a Toshiba THGBX2G7B2JLA01 NAND Flash chip.  That's the phone's memory chip.  All the data on the phone is stored there.  It's encrypted, but here's the thing: the encryption key is also (almost certainly) stored in the same chip.  So all the FBI needs to do is de-solder the chip, mount it in its own hardware, and read out the data.  Unless the FBI is completely incompetent, it should be able to do this in less than a day.  And again, unless they are completely incompetent, having read out the contents of the chip they should be able to decrypt its contents in a matter of minutes if not seconds.  And even if they are completely incompetent, they could use a copy of the chip to try five different PIN codes, and then replace the chip with a fresh copy of the original and try five more.  Lather, rinse, repeat.  At worst this would take about a week or so.

How do I know that this is possible?  Because one of the highly touted features of the iPhone 6 is that it has a secure enclave where things like encryption keys can be securely stored in a way that does not make them accessible using the technique I just described.

The FBI knows this.  Everyone in the security community knows this.  But not everyone in the general public knows this, and the FBI is counting on that ignorance to cover up the fact that their lawsuit against Apple is a charade.  They are not worried about the data on the San Bernardino iPhone, because if they were they would have had it by now.

What they are worried about is the secure enclave in the iPhone 6.  That is much harder to crack than the external memory chip on the 5C, which any competent hobbyist could do.  Cracking a secure enclave requires actually getting inside the processor chip itself, a process known as decapping.  That's possible too (the NSA can probably do it) but it's much, much harder and requires very expensive and specialized (and probably classified) equipment.

What the FBI is really trying to do here is to set a legal precedent that will let them use the power of the law to do an end-run around the secure enclave, and any other security technology that any company might produce in the future.  This is not about catching some potential terrorists, this is about effectively eliminating legal access to encryption technology.  Attempts have been made in the past to regulate encryption technology through the democratic process, and they have all failed.  So now the FBI is trying to get a court to do what Congress has on multiple occasions refused to do.

If democracy is to survive in the United States they must not be allowed to succeed.

[UPDATE:] Some commenters on Hacker News are saying that my analysis is wrong because the encryption key has additional entropy in it in the form of the processor's 256-bit unique ID.  While this is true, it does not make the 5C secure.  The limiting factor on attacking the PIN is the fact that the phone only gives you 10 attempts before wiping the flash.  But if you have a copy of the flash, you can just replace the wiped flash with a copy and make another 10 attempts.

PSA: Beware of low rate limits in letsencrypt

I've been noodling around with letsencrypt, the Mozilla foundation's new free SSL certificate service.  It's pretty cool.  There's no reason to ever pay for (or wait for!) an SSL certificate again.  However, there is a hidden trap in the public beta which I discovered the hard way: there's a rate limit of five certificates per domain per week, and there's no warning about this until you hit the limit.

So... if you use letsencrypt (and you really should!  It's easy!) use a dummy domain or their staging server for experiments, and plan your actual certificate issuance very carefully.  The rate limits should go up eventually, but there's no telling when that will happen.

The end of an era

Google is removing ads from the right-hand side of search results.  Ordinarily I wouldn't care about where Google puts its ads, but this is a little bittersweet for me because I was on the team that launched the original AdWords platform back in September 2000 and started the whole ads-on-the-right phenomenon.  It makes me just a little melancholy to see that come to an end.

Scalia is dead. Good riddance.

I know it's bad form to speak ill of the dead, particularly those who have dedicated their lives to public service, but I'm sorry, Antonin Scalia was not the great scholar and man of principle that some pundits are making him out to be.  He was a delusional hypocrite, and in the position of power he occupied with no one to answer to but the Reaper, he was dangerous.  I would rather have seen him impeached than dead, but if God wants to fill in where Congress fails to act, well, who am I to question His judgement?

What made Scalia delusional was that he believed he knew the One True Way to interpret the Constitution, and that the One True Way was Originalism.  What made him a hypocrite was that he was perfectly willing to chuck originalism out the window when it didn't lead to the result he wanted.

One could surely write a book about Scalia's hypocrisy, but I don't have time for that so I'll just cite a few particularly egregious examples.  Let's start with Gonzales v. Raich.  That was the case where the Court ruled, with Scalia concurring, that the Commerce Clause gives Congress the power to make it illegal for an individual to grow marijuana for personal medical use even in a state where such use is legal under state law.  That this is untenable under an originalist interpretation of the Constitution is so obvious that a first-year law student would have no trouble making the case.  You may recall that the U.S. federal government tried to impose prohibition once before, but before that first disastrous experiment could be conducted the U.S. had to pass the 18th amendment to the Constitution.  Manifestly then, prohibition was not among Congress's enumerated powers prior to the passage of the 18th amendment.  There are only two possible ways you can squeeze a prohibition power out of the Commerce Clause: you can read something into it that the founders clearly did not intend, or you can argue that the whole sordid affair of passing the 18th amendment and then repealing it again 13 years later was unnecessary, just a colossal waste of time because not a single legal mind in the entire country realized that Congress could just, you know, pass a law.

Another example that sticks in my craw because it hits close to home is Scalia's blatant disregard for the separation of church and state.  In October 2014, Scalia gave a speech where he said:

I think the main fight is to dissuade Americans from what the secularists are trying to persuade them to be true: that the separation of church and state means that the government cannot favor religion over nonreligion. That’s a possible way to run a political system. The Europeans run it that way, and if the American people want to do it, I suppose they can enact that by statute. But to say that’s what the Constitution requires is utterly absurd.

This past January he doubled down on that position:

Government support for religion is not only justified by the Constitution, it was the norm for hundreds of years... 

Slavery was the norm for hundreds of years too, but let's not get sidetracked here.  Let's look at Scalia's claim that government support for religion is justified by the Constitution.  Where exactly is that justification?  The word "God" does not appear anywhere in the Constitution.  The word "religion" appears once, in the First Amendment:

Congress shall make no law respecting an establishment of relgion...

And then the word "religious" appears once:

...no religious Test shall ever be required as a Qualification to any Office or public Trust under the United States

And that's it.   So where exactly is the Constitutional justification for Scalia's claim that government support for religion is justified by the Constitution?  It's not there.  He has to extract it from history somehow, which I suppose is not entirely unjustifiable, except that whenever someone does the exact some thing to support a position that he opposes, all of a sudden that's not allowed:

One case was Romer v. Evans, in which the people of Colorado had enacted an amendment to the state constitution by plebiscite, which said that neither the state nor any subdivision of the state would add to the protected statuses against which private individuals cannot discriminate. The usual ones are race, religion, age, sex, disability and so forth. Would not add sexual preference — somebody thought that was a terrible idea, and, since it was a terrible idea, it must be unconstitutional. Brought a lawsuit, it came to the Supreme Court. And the Supreme Court said, “Yes, it is unconstitutional.” On the basis of — I don’t know. The Sexual Preference Clause of the Bill of Rights, presumably. And the liberals loved it, and the conservatives gnashed their teeth.

Just for the record, the justification for ruling an a priori license to discriminate against gays to be unconstitutional is the equal protection clause of the fourteenth amendment.  To which Scalia's response was not to explain why he didn't think this was a valid argument, but rather simply to stick his fingers in his ears and say, "Nah nah nah I can't heeeeaaaar you!"

Like I said, one could write a book.  I'll just point out one final example of Scalia's hypocrisy, one which was particularly egregious and consequential.  When it came to issues like abortion and gay rights, his unwavering position was that these issues should be left to the states and to the democratic process.  (I suppose that if one could somehow muster the votes to repeal the 13th amendment, Scalia would have had no problem with that.)  He was constantly complaining about how activist liberal judges were legislating from the bench.  But he had no problem being the deciding vote when it came time to appoint a Republican President of the United States from the bench.

If that's not enough to convince you that the Scalia-worshipping emperor has no clothes, there's this:

This Court has never held that the Constitution forbids the execution of a convicted defendant who has had a full and fair trial but is later able to convince a habeas court that he is 'actually' innocent

It is hard to imagine a more despicable thing a human being could say.  Not only is Scalia saying that executing innocent people is OK as long as they've had a "fair trial" (whatever the hell that could possibly mean in a situation like this), but he's trying to fob the responsibility of it onto "this court" as if he had nothing to do with this sorry state of affairs!  And besides, how could there possibly be any more cruel and unusual punishment than executing an innocent person?

Bah.

Antonin Scalia was the Donald Trump of the Supreme Court: obnoxious, hypocritical, and dangerously muddled in his thinking.  He made for great entertainment, but absolutely terrible law.  May he rest in peace and trouble us no more.

Is Spirituality Irrational?

Just published my first ever essay in a third-party venue: Is Spirituality Irrational? over at Intentional Insights.  It was written by invitation as a response to this piece by Rev. Caleb Pitkin.

Not with a bang...

Jeb Bush's campaign for the presidency is literally ending with a whimper:

“I will not trash talk. I will not be a divider in chief or an agitator in chief. I won’t be out there blowharding, talking a big game without backing it up. I think the next president needs to be a lot quieter but send a signal that we’re prepared to act in the national security interests of this country — to get back in the business of creating a more peaceful world,” Bush declared to the crowd Tuesday evening. 

He was met with a long beat of silence. 

“Please clap,” he pleaded, drawing applause and awkward laughter.

Pathetic.

Well, this is stupid

Kenya is about to destroy 270 million dollars worth of ivory.  That is an incredibly stupid thing to do.  They should instead sell the ivory and use the proceeds to fund anti-poaching efforts.  By destroying the ivory, they are reducing the supply, which drives up the price, which encourages more poaching by making it more lucrative.

I fully understand the visceral revulsion at state-sponsored distribution of ivory.  It kind of feels analogous to the government selling seized stockpiles of heroin or cocaine.  But ivory isn't like heroin.  It's not addictive.  People don't need regular fixes of elephant tusk.  Ivory is a Veblen good: people want only it because it's rare.  Increase the supply and demand will go down, along with the price.  Do this long enough and you might even depress the market to the point where you bring about a generational change and make the demand for ivory disappear entirely.

In fact, there is even an argument to be made that governments should actively sponsor the harvesting of elephant tusks (and rhino horns)!  It turns out that it is possible to harvest these things without serious harm to the animal.  Poachers don't do it because it's a lot harder than just killing the animal, but if governments did it they could use the proceeds to fund the activity.

In a perfect world, no one would want ivory or rhino horn, and these animals could just live in peace. But we have to deal with the world as it is, not as we would like it to be.  In this world, the elephants that created the tusks that the Kenyan government is about to destroy are already dead.  Destroying their tusks is not going to help them, nor will it help the elephants that are still alive.  Quite the contrary.

Upgrade or die: Apple's diabolical re-invention of the version ratchet

Now that I'm done with my travel tales I can go back to ranting about geeky things.  Apple just announced an update to an update to OS X Snow Leopard.  It's not that Snow Leopard is suddenly being supported again.  It's now fully five versions behind the current state of the art.  But there are some die-hards who are still running it (I'm actually one of them) and this update is necessary to track updates in the App Store so that if you decide you want to update Snow Leopard, you still can.

This sounds like a positive development, but it's actually an indication of something quite ominous that most people don't realize: for several years now, Apple has been deploying a strategy straight out of Microsoft's Big Book of Dirty Tricks which I am hereby dubbing the version ratchet.  A version ratchet is a software deployment strategy that forces you to upgrade even if you don't want to.  Microsoft implemented it back in their glory days (irony intended) by changing the file formats in new versions of the Office suite so that documents created by newer versions of Office could not be read by older versions, thus forcing everyone to upgrade to the newer version in order to share data.

Apple doesn't have the same hegemony in applications that Microsoft had, so their version ratchet works differently.  Apple's version ratchet is implemented through the App Store.  As more and more applications are delivered through the App Store, the less control you have over the hardware that you ostensibly own.  Apple uses the App Store version ratchet not to force you to not only upgrade your software the way Microsoft did, but also as a way to force you to upgrade your hardware.

Here's how it works: most apps nowadays depend on a server to do what they do.  You, of course, have no control over what a vendor does on their server, so it is inevitable that sooner or later some service that you rely on will make some change that requires a change in the client.  If you've ever used Uber or an on-line banking app you will no doubt have encountered a situation where one day the app works fine, and the next day it says, "Sorry, this version of the app is out of date.  To continue to use this service you must upgrade to the latest version."  And then it gives you a helpful link.

So now you have no choice but to upgrade the app.  But then sooner or later you will encounter an upgrade that will force you to update not only the app, but also the operating system.  This happens both on iOS and OS X, with my poster child being iPhoto.  I've been using iPhoto for years.  I have a vast collection of photos stored in iPhoto libraries.  The collection includes carefully edited and curated collections of photos from various trips I've been on.

But iPhoto uses (or I should say, used, because it's not supported any more) the classic Microsoft version ratchet to force users to upgrade: newer versions of iPhoto changed the format of the iPhoto Library directory in non-backwards-compatible ways.  That meant that if I upgraded my iPhoto and my wife didn't, I could no longer share my iPhoto library with her.  So we stopped upgrading.  Or at least we tried.

I resisted upgrading Snow Leopard for as long as I possibly could.  I skipped Lion and Mountain Lion, but then my old Macbook Pro died and I had no choice but to get a new machine, which left me no choice but to upgrade to Mavericks because new machines wouldn't run Snow Leopard any more. That's fair enough; you can't expect OS vendors to support ancient hardware forever.  The problem is much more subtle than that.

Apple intended for the old version of iPhoto not to run under Mavericks; Mavericks was missing the iLife library that iPhoto relied on.  But it turned out that simply copying the library from Snow Leopard to Mavericks worked, and we've been happily running the old version of iPhoto (version 8) ever since.

Unfortunately, this trick doesn't work on El Capitan, so Mavericks is the end of the line for iPhoto version 8.  When I upgrade to El Cap, I have no choice but to upgrade iPhoto to version 9.

Except that I can't.

When Apple introduced El Cap, it deprecated iPhoto in favor of Photos.  Photos is missing a crucial piece of functionality: the ability to export an album as a web page.  Apple wants you to share your photos using iCloud.  Well, I don't want to use iCloud.  I run my own server, and I want to share my photos there.  But because Apple wants to phase out iPhoto, it is no longer available from the App Store as a new install, only as an upgrade.  But it won't let me upgrade my copy because it wasn't installed from the App Store, it was installed years ago from an iLife DVD.

This is Apple's insidious refinement of the version ratchet: if you don't upgrade regularly, you will eventually end up in a situation where you cannot upgrade any more.  Moreover, your software will stop working even if your hardware is still working fine.  In the old days, you could always rely on being able to roll back an upgrade by re-installing the old version from, say, a DVD.  Now you can't because install DVDs don't exist any more.  Once something is pulled from the App Store, it's gone forever, so if you let the gap between where you are and where the App Store is at get too big you're stuck forever.

And nowadays everything is in the app store, including the developer tools.  And the tools are set up so that you can only build for supported version of the OS.  It is still possible to use XCode to build an application for Snow Leopard because you can still get an old XCode install DVD and an old Snow Leopard install DVD, and if you get Snow Leopard Server you can even run it on a VM.  So no matter what Apple does, you can run Snow Leopard forever if you want to.

Not so for Lion.  You can't get an old Lion install DVD because there is no such thing.  Lion was the first OS X version distributed exclusively through the App Store.  The only way you can run Lion nowadays is if you find a working machine that has Lion installed on it.  And some day, all those machines will be gone.

If your reaction to this is, "Why would anyone want to run Lion?  Lion sucked!" then you are missing the point.  This is not about Lion.  This is about the day five years from now when Apple introduces a version of OS X and iOS that sucks again, or that has some feature that you really hate, or is missing some feature that you really love, and you don't want to upgrade.  What I'm warning about here is that when that day comes you won't have any choice.  You will either upgrade or die.  If you don't upgrade, you will see all of your installed apps stop working one by one as they are upgraded in the App Store, and the servers they rely on stop supporting the old versions.

Microsoft was limited in their ability to leverage their version ratchet by the fact that it was possible (indeed necessary!) for third party developers to write and deploy applications for Windows machines without Microsoft's approval.  Microsoft could play games like limiting access to internal Windows APIs to make their own applications more competitive, but they could not shut out the competition entirely.  This kept them somewhat in check; if they ever released a version of Office that sucked too badly, users might revolt and allow a third-party to take over that market (as indeed has now happened to a certain extent with OpenOffice and Google Docs).  Apple is slowly but surely shutting down that escape route.  It is already not possible to deploy an application on iOS without Apple's approval.  That is not yet true of OS X, but I predict that some day in the not-too-distant future, Apple will release a version of OS X that is as closed as iOS is today.  And on that day there will be a great wailing and gnashing of teeth.  But you will upgrade.  You will upgrade because all of your data will be in iCloud and all of your finances will be in Apple Pay, and you will have no choice: you will upgrade or die.

And then, after that, you will have the buy the new iPhone and the new Mac even if the ones you have are still working perfectly well, because they won't run the new OS.

Even if Apple doesn't implement this strategy, they could, and that to me is cause for concern.  Personally, I don't want the only thing standing in the way of being coerced in this way to buy things I don't want to be the continued benevolence of the largest corporation in the world.  I want an escape hatch to keep Apple in check.  And right now, I don't see one.

Almost forgot...

I was saving the best for last, but then I forgot to include it in my last travelogue post.  We saw the most awesomest sunset ever:



That is a non-photoshopped picture.  It really did look like that.  This was taken at Duma Tau.

Was it something I said?

Six people unsubscribed to the Ramblings yesterday.  That's the biggest one-day exodus I've ever had in the thirteen years I've been writing.  Maybe I should stop writing travelogues.

West Africa travelogue wrap up

Madikwe was our last Safari stop.  From there we went to Johannesburg where we spent two days before going home.  We were originally scheduled to do some tours there, but we realized that we were physically and emotionally wiped out so we cancelled them.  I also still didn't have a working computer, so I ended up buying a new one in Johannesburg.  Fortunately for me, the day before we arrived, the president of South Africa, Jacob Zuma, caused a major scandal by, without any warning, firing the finance minister and replacing him with a political crony.  As a result, the Rand plummeted overnight, and I was able to get a really good deal.  (BTW, if anyone wants to buy a brand new MacBook Pro, still under factory warranty, it's for sale :-)

Johannesburg is a really beautiful city, very reminiscent of Los Angeles: sprawling, modern.  But it's still an African city, and that means there is still a lot of abject poverty.  You can see the shanty towns from the air as you're flying in.  And even in the best parts of town, where extreme wealth is on prominent display, it has to hide behind some pretty gnarly security.  This was the entrance to our hotel:



That door is fully a foot thick.  It's meant to stop vehicles and bullets.

This is a little bit of what it looks like behind the gates:



If you have money, you can just hide in there and forget about the world outside.  But the moment you leave, you can't help but be reminded that you are in constant danger from your own countrymen.  There was not a single property that was not surrounded by high walls topped with razor wire and electric fencing.









This, as far as I can tell, is as good as it gets in Africa.  We visited an acquaintance of ours who happens to live in this same neighborhood.  Her house is spectacular: a mansion of probably 10,000 square feet with sprawling immaculately manicured gardens.  She lives there by herself.  No family, just staff (all black, of course), including security guards who are there 24 by 7, three shifts a day, day in and day out.  It was beautiful.  And it was creepy.

That is why, despite all the wonderful wildlife and natural beauty that we saw, despite the fact that I feel incredibly fortunate to have had the opportunity to make this trip at all, the memory of it will for me forever be tinged with melancholy, because there was not a day that I was not reminded that the vast majority of the people around me are not as fortunate as I am, and it is not because they are lazy or risk averse, but rather because they had the poor judgement to be born in Africa instead of Europe or the United States, or to be born to black parents instead of white, or to live under a corrupt government.

I lived for six years in a gated community in the Los Angeles area, and I hated it.  Oh, it was very nice inside, but it was almost literally like living in Africa.  Nearly everyone inside the gates was white, nearly everyone outside was black, as were most of the security guards whose job it was to keep the black folks out.  Why did we move in to such a place?  Because we bought our house while the place was still under construction.  It didn't start out as an apartheid enclave, it gradually turned into one as the HOA board was taken over by people with a very different mindset from our own.

This is why I worry about income and wealth disparities, because I've seen the end-game for it both at home and abroad, and it ain't pretty.  I do not want to have to live behind a wall because I fear my fellow man.  The fact that the leading Republican candidates for president are selling this as a feature fills me with dread.

I'd better stop there before I get too maudlin.

Travelogue day 14: Madikwe game reserve

From Little Mombo we took one last small plane to Maun.  Maun has only about 50,000 people living in it, but it has the busiest airport in Africa in terms of total flights per day because of all the little bush planes that come and go.  From Maun we took an honest-to-goodness twin turboprop to Gabarone, the capital of Botswana, and from there we were driven across the border to South Africa and the Madikwe game reserve.  We stayed at the Mateya Safari Lodge.  I won't put up and photos of it because the web site does a pretty good job of showing what the place looks like.  Mateya is interesting in that it has a maximum capacity of only ten people, and while we were there there were only six including the two of us.  It was originally built by a wealthy Atlanta socialite name Susan White Mathis as a private residence, but was opened to the public when the staff complained that they had nothing to do between her visits.  It was opulent, but also a bit eerie.  In the afternoons there was often no one around, not even staff.

(Another odd feature, which I later learned is common in South Africa, was that the floor of the shower was not flat but rather deeply concave.  It made the water drain effectively, but it felt weird, kind of like taking a shower in a giant soup bowl.)

The game drives were all accented with a melancholy note by this memorial to poached rhinos, which was on the road leading to Mateya, so we were constantly driving by it:



Nonetheless, we did see quite a few rhinos.



And a brown hyena:



This was one of only two pictures I got of him.  They are both rare and shy, so it's very hard to get good pictures of them.  To make up for it, there were a lot of other critters that posed for us, like this jackal:



This lion was walking down the runway at the airport just as the sun was rising:



Yellow weavers were everywhere:





A scarlet breasted shrike, considered by one of our fellow guests to be the most beautiful bird in the world (though I'm not sure I'd go that far):



Even the insects were beautiful.

We found a fresh lion kill:





And a not-so-fresh one:



And just because I don't want to round out the wildlife portion of this travelogue on a morbid note, here are some elephants playing in the water.

And what the heck, I'll throw in a baby impala.

Travelogue day 13: Little Mombo

Little Mombo was the last of our three stops in the Okavango, and by far the best.  I took over 600 photos here alone (out of over 6000 over the course of the entire trip).  When I was going through them to pick the best of the best to include in this blog entry I ended up with over 30, so brace yourselves.  This is going to be a long entry.

(BTW, Little Mombo and regular Mombo are marketed as two separate camps, but they are really the same facility divided into two areas that you can easily walk between.  This is unlike Vumbura Plains and Little Vumbura which are two completely different facilities.)

As you will recall, in our previous two camps we had rain.  In fact, at our first stop we had rain so hard that it soaked the inside of our tent and destroyed my computer.  The distance between our previous stop and Little Mombo was not that great, only about 20 miles.  So we were more than a little surprised to see a substantial brush fire burning not that far from the camp.



It had apparently been sparked by lightning from the previous day's thunderstorm.  And of course there is no fire department out here.  When a brush fire starts, it burns until it rains.

Which it didn't.

That fire burned the entire time we were there.  Most of the time it wasn't a problem, but on a couple of occasions the wind shifted and blew the smoke straight into camp.  As someone who has lived through a brush fire before, it made for a somewhat tense three days, particularly since we were so far from civilization.  None of the staff seemed worried, though, so that helped.  It turned out there as a branch of the river between us and the fire, but that may or may not help if the wind picks up.

But to make up for the fire, we had by far the best three days of our entire trip.  The first thing we did was get some lunch, and there was an elephant there to greet us.



And then he came closer.



And closer.



And then he got ridiculously close.



He was so close he could easily have reached out and picked me up with his trunk.  If you've ever wondered what the inside of an elephant's mouth looks like, well here you go:



All that happened in the first hour, before we even got to our tent.  Which was very, very nice.



The whole camp was absolutely spectacular.



There was even a gym, though who would want to work out in the 100+ degree heat I'm not sure.  The entire time we were there I didn't see anyone there.



And the only ones that I saw using the pool were the baboons.



On our first game drive, our guide, whose name was Moss, surveyed the landscape with a pair of binoculars and suddenly got very animated and excited.  "I think I saw a rhino," he said.  Rhinos have been hunted very nearly to extinction in Botswana, but recent restoration efforts have seen the beginnings of a comeback, so this was exciting news.  Moss gunned the engine and for the next half hour or so we tore across the landscape at a pretty scary speed, with Moss proclaiming every few minutes, "I think I saw a rhino!"  We went so far that I would have given long odds against just because there was no way he could have seen anything so far away.  And yet, sure enough, there was a rhino.





And lions.





(Gotta love that evening light!)

And wild dogs.









And hyenas eating an elephant:







The elephant almost certainly died of natural causes because its tusks were still intact.

Giant eagle owls.  It's rare to see them.  We saw three.  Together.



A southern ground hornbill, the largest hornbill in the world.



An impala with a broken horn.  That's gotta hurt.



Mating lions.





Zebras are common, but quite skittish, so it's unusual to get this close.



The silver lining of having a brush fire nearby was some spectacular sunsets.