#paloma cloud | Explore Tumblr Posts and Blogs

gothcsz · 5 months

Text

𝑻𝒉𝒐𝒓𝒐𝒖𝒈𝒉𝒇𝒂𝒓𝒆 / Chapter VII.

PAIRING: Javier Peña x Original Female Character

SUMMARY: Our main character gets further involved with her other love interest. Javier gets jealous.

WORD COUNT: ~9k

RATING: 18+ Mature topics such as sex, drugs, murder, the occult, religion, cannibalism and other triggering matters will be explored in this body of work. Minors DNI.

CHAPTER SPECIFIC TAGS: Mentions of religion, i'll say it once and i'll say it again: slow burn, officer!Javi P because i think that's like really hot, Jealous!Javi too, some lore is explained, love triangle, mutual pining, other things that I'm probably forgetting.

DISCLAIMER/WARNINGS: The Javier Peña referenced in this body of work is solely based off of the character that appears in Netflix’s Narcos and not the actual person. Very canon divergent and I will tweak things as I see fit to compliment the narrative of this story. While efforts have been made to be accurate in terms of canon timeline, a lot of details will be fictionalized.

A/N: hiiiii here's this week's chapter! i just love love LOVE this world and these characters, i rlly hope you all feel the same (: if u see any typos... uhhh... pretend u didn't :p anyways feel free to drop any type of feedback/support on this blog or ao3. i'd really appreciate it <3

♰ read on ao3. ♰

♰ playlist | pinterest | series masterlist ♰

True to her word, Paloma fulfills her promise and chauffeurs Sloane home the following afternoon. Their journey is smooth sailing, filled with belting out songs and animated chatter, so much so it seems as though they reach their destination in the blink of an eye.

Nestled far into the horizon, the house resides amidst a vast expanse of parched grassland. Its isolation strikes her immediately, as if it’s purposefully distanced from any signs of civilization. The last notable landmark has faded into the rearview mirror, easily twenty minutes behind them.

“It’s so far from everythin’, how did August know this woman again?” As they draw nearer, she casts her gaze upon the home, curiosity guiding her observations.

Initially, the house appears unassuming, boasting a generous Southern size. Yet as her eyes trace its silhouette, the subtle hints of antiquity emerge, revealing its longstanding presence in the landscape. The intricate detailing, weathered by time, whispering tales of decades past.

Amidst her admiration, a wave of relief washes over her; it’s a stark improvement from the dreary confines of the motel where her friend was staying at.

“He looked after her way back when she lived in Fayette.” Slo answers plainly, releasing her seatbelt as the car halts, its engine settling into a quiet then nonexistent hum. With a fluid motion, she swings the door open and gracefully steps out onto the gravel, stretching her limbs.

Paloma mirrors Slo’s action, sliding on her sunglasses as the sun casts its unyielding rays upon them. The sky stretches endlessly, devoid of any clouds to offer respite. Already, the heat sears against her skin causing beads of sweat to form, clinging to her like a damp embrace.

Immersed in her surroundings, she takes in the scenery when August’s familiar voice draws near. Her attention shifts and a radiant smile illuminates her face as he closes the distance and envelops her in a heartfelt embrace.

“Looks like you hit the jackpot.” She tells him once they pull away, banking on her sunglasses to conceal her admiring gaze as it traces the intricate tattoos adorning his bare arms. His thin undershirt offers a canvas for her to wander, inviting her eyes to linger on the myriad designs. A glimmer of gold catches her attention—a simple chain draping from his neck, the pendant dangling with a symbol unfamiliar to her.

“I keep thinkin’ they made a mistake. M’waitin’ for the other shoe to drop.” He remarks, his head subtly shaking as his blond hair catches the sunlight, casting a radiant glow around him.

“Just enjoy it while it lasts then,” She teases, her hands enfolding his arm as he guides her towards the house. “But seriously, this is a blessin’. Now y’all can all be together again.” He’s told her about the struggles his group has faced. Constantly displaced and unable to be together for months.

Their unconventional religious beliefs had made them outcasts in many narrow-minded towns, branded as some sort of demonic cult by most. It’s quite ridiculous.

“M’gonna go take a shower. You good?” Sloane asks Paloma once they’re inside, a hint of a smirk on her face at her friend’s growing closeness with August.

“I’m fine and in very capable hands.” She jests, playfully nudging him.

With a gracious sweep of his hand, August leads her on the grand tour, showing her all around the property. The outward appearance of this home is deceiving, as its interior dimensions far exceed expectations. It’s fully furnished, with the majority of bedrooms already claimed by members of August’s collective.

She still doesn’t know much about them, only acquainted with the sparse details he’s disclosed to her.

Seeking purpose, these wandering spirits have weathered the scrutiny of their communities for deviating from societal norms. Many among them are runaways or troubled youth, adrift with nowhere else to turn.

August possessed a unique talent for uniting fragmented souls. He wielded his philosophies and unconventional perspectives like a beacon, illuminating pathways to security and a profound sense of belonging for those who agreed to walk alongside him.

Not quite family, but a bond akin to it— a group of individuals capable of rescuing one another.

“Were you and the woman who owned this related?” She inquires with a curious tilt of her head as they descend the large staircase, her hand still encircling his bicep.

“Nah. I used to work at the grocery store back home and she would come in all the time needin’ a lotta help. After a few visits, she asked if I wanted a side gig. Basically just mowin’ her lawn, fixin’ things around her house and what not. I agreed and did that for a few years ‘til she moved away. Hadn’t heard from from her ‘til recently when I was passin’ through Fayette. Her lawyer tracked me down ‘n told me she left all this,” gestures to everything around them, “To me. With a small fortune, too. Turns out she had no other family so she wrote me into her will shortly after I started workin’ for her.”

Paloma absorbs all this information, engrossed entirely. “That’s quite the story. Crazy how an act of kindness years ago ended up in all this. There’s a lesson in there somewhere.” She remarks as they step into the spacious central area of the house, offering a panoramic view of both the front and back yards.

“What goes around comes around, yeah?” A beguiling smile plays across his face as he leads her into the backyard, and her eyes widen in astonishment.

The landscape is strikingly manicured, adorned with tastefully arranged outdoor furniture and a meticulously crafted stone fountain serving as its centerpiece. Not far off lies a sprawling garden, brimming with an array of crops and vegetables. Adjacent to it stands a quaint barn, completing the picturesque scene.

“This is beautiful. Add a few farm animals and this place could be self-sustaining.” She understands the immense effort required to maintain a place like this, but judging by its current state, it seems to have been well cared for. Now that they’re here, she’s confident that August harbors ambitious aspirations to elevate this space into something remarkable.

“We got some pigs, a cow and a few chickens in the barn.” He reveals to her, as if reading her mind, and she’s itching to get a look. She wishes she and her father had the time and resources to have farm animals of their own. Hell they have the land for it.

Just then, a young girl, her demeanor hesitant, approaches August and tells him he’s needed inside.

Paloma’s gaze holds onto her, her appearance suggesting late adolescence. A slight ache grips her heart as she recalls the weighty traumas that drew these individuals together. The realization that someone so youthful has endured immense suffering tugs at Paloma’s sentimentality.

“Be right back. Feel free to look around.” She nods as he separates from her, following the soft spoken girl inside the house.

Driven by curiosity, Paloma wanders about, stooping down to scrutinize the garden’s burgeoning offerings. The sight of the fresh produce ignites a twinge of envy within her. Vegetables have never been her forte, explaining why her home garden mainly boasts an array of flowers.

Suddenly, a flicker of motion catches her attention nearby. Behind her sunglasses, her eyes narrow in curiosity before widening with delight as she discovers a playful kitten leisurely exploring its surroundings.

A large, goofy smile tugs at her lips as she attempts to scoop the animal into her arms to no avail. It scurries away before she can even reach for it.

“C’mere little kitty…” Her voice trails after it as she chases it around, weaving through the area until it darts towards the cellar of the house. Paloma nearly grasps it, but the kitten slips away into the thicket of bushes. Just as she resigns herself to letting it go, a faint voice drifts from behind the weighty cellar doors.

“Hello? Is someone there? Please help me…”

Her brows crease in confusion, struggling to decipher the person’s muffled words. She leans in closer, on the verge of speaking, when the touch on her forearm interrupts her impending words.

A sound of surprise pushes past Paloma’s lips as she swiftly turns her head, her eyes locking onto August. His brows knit together in a puzzled frown as he regards her, then his gaze flicks toward the cellar.

“Whatcha doin’, sweetheart?” He asks, loosening his grip on her arm and she pulls it to her side, straightening her posture.

“I thought I heard, uh, someone askin’ for help.” She stammers, gesturing towards the basement, a sudden unease settling at the base of her spine.

He hums in acknowledgement, eyes not leaving hers. “S’probably someone workin’ on the busted pipe this place came with. Gabriel!” He calls for his friend, who appears seemingly out of nowhere. “Go see if they need anythin’. Paloma heard someone callin’ for help.”

The two men share a silent exchange, their eyes conveying a conversation of their own. Then, with a nod from Gabe, he departs as swiftly as he arrived.

“There’s somethin’ special I wanna show you.” August starts to speak, drawing her focus away from the imposing cellar doors and extending his hand toward her.

She nods in agreement, no longer feeling that pesky unease, intertwining their fingers as he guides her back toward the backyard, but this time leading her to a sprawling greenhouse.

A soft gasp escapes her as the structure comes into view, its presence previously unnoticed. He chuckles softly at her surprised reaction, enjoying her astonishment.

“You like?” He queries as they step inside, and her response is an eager nod, her gaze sweeping across the diverse assortment of plants and flowers with fascination.

Paloma finds herself unable to contain her excitement, delving into a torrent of facts and anecdotes about his greenery. It’s only when she’s passionately discussing azaleas and the challenges she’s facing nurturing the ones she planted earlier in the season that she abruptly pauses, a blush creeping across her cheeks as she realizes she’s been carried away, “Sorry, I didn’t mean t’get all rambly….”

“Don’t apologize little dove. You look so cute like this.” As his fingertips delicately tuck a stray strand of hair behind her ear, she instinctively leans into his tender touch. The endearment he uses makes her heart flutter, her thoughts briefly flickering to Javi as she nervously nibbles on the inside of her cheek.

Not now, Paloma.

“Let me take you out one night baby.” He suddenly says and her eyes widen in surprise.

“You want to go out with me?”

“Of course. Thought I had made it obvious with the way I’ve been throwin’ myself at you.”

Her bottom lip finds itself caught between her teeth, not oblivious to the way he has been coming on to her. Since she had someone else on her mind, she hadn’t really reciprocated any of his advances.

But after the kiss that never happened and the silence that followed, she figures this is exactly what she needs to get over the sting of Javier’s wordless rejection.

“I would love to but everyone in town talks too much and if my dad got word that I was out on a date…”

An undertone of irritation seeps into her words, noticeable even to him, and something flickers in his eyes as he catches onto it.

“Don’t worry about that, okay? I’ll handle it. You just worry about gettin’ all pretty for me, which won’t take much considerin’ how perfect you are.”

A flutter of warmth dances in her stomach at his sweet words.

“Okay… then yes, I’d love to go out with you.”

A handsome expression takes over his countenance, “Perfect. Gotta get some stuff straightened out around here but I’ll call you. Hope I can talk to you before then, though?”

“Slo has my number… if you call and daddy answers just hang up and try again later. Don’t want him goin’ on one of his little tangents.”

A smirk dances on August’s lips, his mischievous urge to test the limits and provoke the sheriff evident. Yet, despite his inclination, he restrains himself, recognizing the strides he’s making with her and unwilling to jeopardize the progress.

“Yes ma’am, anythin’ else I need t’be made aware of? I like my manhood and would like to keep it attached to my person.” He jokes about being castrated by her father and she snorts, rolling her eyes.

“S’all. Don’t take too long ‘straightening things out’. If not I might lose interest.”

His eyes darken at her words despite her playful tone, “You won’t.” August says with a conviction that has her rubbing her thighs together.

“Then it’s a date.” She nods, and they exchange an amorous stare, “I should probably head back. Got some chores I gotta get done but I appreciate you showin’ me around. This is a beautiful place, you’ve really been blessed, August. It’s only up from here.”

“Any time. M’glad you came by today... Oh, and Paloma?” He begins and she shoots him a puzzlingly look.

“Yeah?”

“I think it’s best if we keep this visit a secret between us. We’ve finally got some peace and quiet to be ourselves without being ostracized by the community and we’d like to keep it that way. Many of us ain’t ever had a place to call home so losing this… feeling uncomfortable here would negate all we’ve been working towards.”

She nods, fully understanding how big of a deal this is to all of them and she wasn’t going to be the one to ruin their solace.

“Of course. I won’t tell a soul. The only person I’d consider tellin’ already lives here.” She giggles and his lip quirks up into a small smile.

He leads her back to her car, his hand resting gently on the small of her back, sending a wave of warmth through her. They bid farewell, and as August leans in to place a tender kiss on her cheek, she can’t help but become flustered in response, gazing up at him with a hint of playful affection.

“Don’t forget to call.” She tells him, sliding into the driver’s seat.

He closes the door, leaning down to talk to her through the rolled down window, “I won’t. Just make sure you’re around to answer.” He winks at her, slapping his palm against the top of her car. “Drive safe, little dove.”

Departing from the house, she carries a blend of excitement and nervousness. It’ll be her first genuine date in years, igniting both giddiness and apprehension within her. Throughout the entire ride home, her mind swirls with fantasies about his plans for the evening and the possible outcomes of their time together. Javier pushed to the back of her mind entirely.

When she gets home, she is determined to make the most of the remainder of her day. However, her plans are momentarily halted as she notices a bright colored piece of paper taped to the front door.

POWER OUTAGE IN IMMEDIATE AREA.

RESTORATION APPROX. 9PM.

Well shit, that’s still hours away, and Paloma refuses to suffer through this heat at home with no air conditioning. So, she gathers all the laundry from the house and loads it into her car, making sure to grab her CD player, a book and her journal to stave off boredom. She’ll hang out at the laundromat until tonight, maybe even stop by to visit her father at the station in order to kill time.

The mere thought of encountering Javier sends a whirlwind of thoughts swirling through her mind, momentarily disrupting her focus. Despite the anticipation of potential awkwardness, Paloma resolves to maintain her composure. She makes a silent vow to herself to hold an air of nonchalance, determined to act as if nothing had transpired between them and she wasn’t the least bit affected by their days of silence.

She pulls into the small parking lot of the laundromat, doing her best to haul everything inside in one trip. She struggles at first, her progress hindered by a persistent strand of hair that’s fallen loose from her ponytail. Despite her efforts to brush it aside, the unruly strand stubbornly resettles in front of her face each time. Frustration mounts, prompting a colorful stream of curses to escape her lips.

Using her ass to nudge the door open, she stumbles inside, careful not to topple over entirely and make a fool out of herself.

Once she’s in the small building, a refreshing wave of cool air washes over her, causing goosebumps to form on her skin despite the perspiration from the scorching weather outside.

Turning around, she doesn’t anticipate encountering anyone and nearly loses her grip on everything she’s carrying when she locks eyes with a familiar pair of deep, brown eyes staring back at her.

Javier. Of-fucking-course.

She maintains her silence, averting her gaze swiftly and busies herself with locating a spot on the opposite side from where he stands, this time managing to move her belongings without difficulty.

The gentle hum of the washing machines and dryers in operation fills the space, accompanied by the soft murmur of a soap opera emanating from the small, boxy television perched high in the corner.

Despite the distractions, a palpable tension lingers in the air, accentuated by the weight of his gaze boring into her back as she starts loading one of the machines.

“It’s rude to stare, y’know.” She finally speaks up, unable to resist addressing his intense scrutiny. Turning to face him after finishing her task, she meets his gaze head-on.

Javier knew better than to openly gawk at her the moment she entered, but her unexpected presence caught him off guard. Their lack of interaction since that night at the fair only added to the uneasy atmosphere.

He threw himself into overhauling the department. With Romeo preoccupied by the missing persons case and other matters, he took it upon himself to revamp everything. Implementing a new filing system, acquiring better equipment, and updating certain procedures are just a few tasks amongst the many that became his primary focus. It was a deliberate effort to keep from pursuing her, however he found himself thoroughly enjoying the reorganization because he is good at it.

He had convinced himself that distancing from Paloma was the wisest choice. Initially, the flirtation had been manageable, but as their connection deepened and the lines of intimacy blurred, it became overwhelming.

While it was the rational decision, it wasn’t without its challenges. Despite having plenty to occupy his mind, there remained a palpable void in the absence of her presence. Javier found himself yearning for their casual conversations and lighthearted banter, missing everything about their relationship beyond its romantic aspect.

Amidst his conflicted emotions, Javier grapples with a sense of guilt for harboring feelings towards the daughter of a man he now considers a friend. He witnesses firsthand the toll that the unsolved cases have taken on the sheriff, observing the weariness and frustration. Javier dreads the possible fallout if his involvement with Paloma were ever to come to light; it would undoubtedly wreak havoc.

Yet as he stands there, charmed by the sight of her in her denim shorts and tied-up blouse, he finds himself unable to look away. Despite the weight of his conscience, he can’t help but admire her.

“You’re right. Sorry querida.”

She feels a flutter in her chest as he speaks to her, frustrated that she still reacts like a smitten teenager.

“I’m surprised you even remember me. Figured we were strangers again.” Her words drip with sarcasm, a tinge of bitterness creeping in. That little vow she’d made to herself to keep things nonchalant now swiftly tossed out the window.

“I’ve been tied up at the station.” He begins to explain, which isn’t a lie but also not the entire truth.

Paloma’s soft hum fills the air as her eyes traces his figure, from the crown of his head to the tips of his boots, and a sigh as delicate as a whisper falls from her. The sight of him clad in the effortless ensemble of a plain t-shirt and denim jeans stirs a faint pulse between her legs. Goddamnit.

How ridiculous it is for her to have vowed to keep her distance, agreeing to a date with another man just hours before; only to find herself standing here, unable to resist Javier’s magnetic pull and being drawn back to him by the sheer force of his irresistible attractiveness.

“So you’re not avoidin’ me ‘cause we almost kissed?” Subtly be damned, she allows her words to linger, floating like weightless clouds in the space that separates them. Across the compact room, they share a gaze, locked in a suspended moment pregnant with anticipation where unspoken sentiments hover like whispers.

She can practically hear Sloane fussing at her, their last conversation about him still fresh on her mind.

“It’s obvious what typa man he is. Flirty, handsome, charismatic. Sex on legs— a long trail of broken hearts follow that man.”

A subtle twitch dances along his jawline as she acknowledges the awkward moment, “S’that what all this is about? You think I’m ignoring you because we almost kissed?” Despite that being the case, he maintains a composed facade, a humorless chuckle vibrating through his chest as he shakes his head. “If you missed me, you can just say that.” He teases, testing the waters in attempts to lighten the mood.

Paloma emits a soft snort, a reflex to mask the warmth flooding her cheeks as she averts her gaze, ensuring he doesn’t catch sight of the gentle blush coloring the apples of her cheeks. “As if. Just kinda rude to be a part of a friend’s big moment then ice ‘em out after a heat of the moment mishap.”

His tongue glides over his teeth, a simple gesture as his gaze remains fixed on hers, unwavering. “I wasn’t icin’ you out, princesa.” Javier states smoothly, his words flowing effortlessly despite it still being a lie, “I’ve genuinely been busy as hell. Redoin’ the infrastructure of the department, helping your pops out with the cases. Shitty timing but I’m not dodging you on purpose.”

Paloma contemplates his words, her gaze fixed on his features, searching for any telltale signs of deception. A growing sense of embarrassment floods over her as she reflects on how wrongly she had interpreted his silence. It dawns on her that Javier had merely been occupied with his responsibilities— it was his job, after all. Considering her father’s recent transition to overnight shifts, she can envision how deeply absorbed Javier must be in the process of reevaluating everything.

She conceals her humility. Though inwardly, she chastises herself for allowing her emotions to cloud her judgment, berating her heart for leading the way instead of her (sometimes not so) rational mind.

“So things aren’t weird between us?”

“Not in the slightest.”

“Water under the bridge?”

“Water under the bridge.”

A smile curves her lips as she pushes herself away from the running washing machine, slipping her hands into the back pockets of her denim shorts. She saunters over to him, each step purposeful, exuding a quiet yet growing confidence.

“Okay. I guess I mighta jumped the gun a bit…” She admits and he flashes her a knowing smile.

“Just a little.”

It’s unexpectedly simple for them to lie to themselves and each other about the nature of their connection. Whatever manner it takes to get them to this fragile sense of peace; he’ll take.

Finally, Javier can free himself from dwelling on the petty dysfunction between them, self-conscious about his recognition of how much he’s missed having her around.

It was only a week of silence. Can they be any more pathetic?

As she approaches him, however, he can’t help but let those pesky explicit thoughts infiltrate his mind. How he’d love to pull her flush against him, cover her mouth with his and kiss her until they’re both breathless. Grab a handful of her plump ass and perch her on top of one of these machines, feeling her fingers run through his hair as his dug into her hips.

He’d be content with just that, feeling her inviting lips, tasting her lip gloss and nipping at the soft skin until the flesh is swollen due to the passionate exchange.

It’s thoughts like these that make it hard for him to conceal his feelings. Why he initially sought to create space between them, only to find that maintaining distance was more challenging than simply being in her presence.

“Y’know, I actually missed makin’ fun of you.”

“Is that all I am to you? Someone to poke fun at solely for your entertainment?”

“Uh, yeah. I thought that was a mutual understandin’?” She snickers and the tension dissolves entirely as they fall back into their usual limbo.

Javier reassures himself that he can handle this situation with normalcy as he engages in conversation with her while they attend to their laundry. He convinces himself that he can exercise self-restraint and maintain a romantic distance while remaining close to her in a platonic sense. Recognizing their mutual maturity, he sees no reason to let something as trivial as a crush disrupt the budding friendship they both clearly cherish.

He can totally just be friends with a bewitching and irresistible woman like her. He can shed his reputation as a womanizer. Think with something other than his dick for once.

“Do you dance, cowboy?” She inquires, her voice carrying a playful lilt as she presses play on the CD player, flooding the room with the twang of a country song.

“Yeah, why?” He responds, his gaze fixed on her as she gracefully maneuvers in the confined, open area at the rear of the shop.

“‘Cause they’re havin’ a little line dance event on Saturday before I play. Figured you’d swing by and join in on the fun.” She explains, her movements syncing with the rhythm of the song as she executes a simple two-step before spinning. Javier finds himself unknowingly grinning as his thumb brushes against the corner of his lip after gliding over his mustache.

“I dance but not line dancing. S’not my thing.” He admits, though he’ll make an exception, just to watch her have fun.

“Well it can be your thing for one night. Get that stick outta your ass, viejo.” She giggles softly, her feet effortlessly finding the beat as she kicks them out in perfect rhythm. With a fluid motion, she sways her hips, his attention drawn to the exposed skin of her midriff, tracing her scar, before looking back up at her.

“You gotta teach me then, ‘cause I don’t know a single fucking one of those dances.” This has her halting her movements entirely, extending her arms outward and motioning for him to join her.

He approaches her with deliberate steps, and she guides him to stand where she pleases, her touch on his bicep igniting volts of sparks to flash through him.

“It’s very easy. I’ll make sure to request one of the beginner songs just for you. They usually reserve those for the kiddos.” She jests, licking her lips.

Javier chuckles, releasing a breath through his nose and shaking his head in amusement.

She takes the lead, gently leading him through each step of the country dance, her giggles tinkle like music when he stumbles. Their occasional collisions only deepen their shared laughter, weaving a tender bond between them with each clumsy misstep.

Her presence has a revitalizing effect on Javier, coaxing forth a lighter, more carefree aspect of his personality that had become obscured during his years in Colombia. Once cynical and self-centered, he had morphed into a man driven by ambition, his reputation tainted by arrogance and a propensity for hedonism. He was known as a whore and a volatile agent, his temper often preceding him like a dark cloud.

Despite his notorious reputation, he made unparalleled strides, surpassing all others in his field. Though he grew increasingly daring toward the end, it was the sacrifice of his character and morals that enabled the DEA to take out Escobar and propel their efforts towards dismantling the Cali cartel.

With the turmoil behind him, he stands at a crossroad, presented with the opportunity to reconstruct himself anew. He’s determined to chart a different course for his future, to discern how he desires to navigate the remainder of his life. Aspiring to become the man he knows he is capable of being.

It’s going to take a lot of fucking work, requiring him to confront the discomfort of self-reflection head-on. Yet, he realizes that the initial stride involves acknowledging the imperative need for change. Without it, he risks being ensnared in a future filled with cynicism and dread.

Inadvertently, she aids him in this rediscovery journey of his; finding and polishing all the good aspects of his character, valiantly putting them on display.

She evokes feelings of joy and normalcy within him, a stark contrast to his usual reserved nature. It’s why he finds it challenging to suppress his feelings for her, why his heart and mind become entwined in a beautiful chaos whenever she crosses his path.

“Peña! Over here!” She exclaims the moment she spots him, beckoning him eagerly from her position by the pool table

In the midst of the crowd, Paloma effortlessly commands attention. Her hair is elegantly tousled into a stylish updo with wisps of hair gracefully framing her face, her oversized hoop earrings glisten in the soft glow of the bar lights. Adorned in a snug denim jumpsuit, it shows off every curve of her tight body, accentuating her figure. As he draws nearer, he finds his gaze irresistibly drawn to her silhouette, particularly to the curve of her ass like it always does.

His eyes quickly shift as he notices her father poised over the velvet-covered table, cue in hand, striking the white ball amidst a chaotic scattering of others.

Fortunately, he hadn’t caught Javier openly eye-fucking his daughter. That would have undoubtedly led to an uncomfortable conversation.

“Wasn’t aware you’d be here, Romeo.” Javi says as the two men greet each other in a friendly handshake.

“First weekend off in ages and this one convinced me I needed to get out and relieve some stress.”

Paloma leans over, her concentration evident as she assesses her next move, closing one eye to refine her aim. With a confident swing, she propels the cue ball forward, skillfully sinking two of her own colored balls into separate pockets. She celebrates her achievement with cheerful exuberance.

“Though ain’t no stress bein’ relieved with the way she’s whoopin’ my ass.” The older man grunts.

“You literally taught me how to play.” She retorts with a playful roll of her eyes, chalking her pool stick.

“Maybe he’ll have better luck at it then me. M’goin’ to get somethin’ drink. Y’all want anythin’?” He asks, handing the cue stick over to Javier.

Paloma orders her usual mocktail and Javier orders a plain beer, deviating from his typical whiskey neat.

He casually removes his leather jacket, revealing a red button-up shirt with the top buttons left undone, a habitual style choice. She quickly averts her gaze, preempting any chance of him catching her admiring stare and sporting that smug grin on his devilishly attractive face.

“Don’t get your hopes up, I’ll probably beat you at it too.” She rounds the table, nearing him as he takes his turn, just barely missing the corner pocket.

He blames her close proximity.

“Oh, so close.” She teases, patronizingly nudging him aside to take her position. As she leans forward, she brushes against him, and he takes a lengthy step back before his hand instinctively comes down to grab at her waist.

Paloma purposefully arches her back as she’s bent over the table, feeling his gaze on her. It’s fun riling men up because it’s so easy— as if she hadn’t just been on the verge of drooling when he shrugged his jacket off.

Another success as her balls fall into the pockets, she flashes him a victorious grin over her shoulder.

“Told you.” She repeats his words back to him, remembering how smug he’d gotten after knocking down all the bottles with the baseball at the fair.

“You’re playin’ a dangerous game here princesa.” They gravitate closer, as if entering a trance that keeps them from remembering that this is what they’re both trying to avoid.

“Am I?” She challenges, gazing up at him with a playful glint in her eyes, framed by her thick lashes.

Romeo reappears, distributing drinks as they settle into the rhythm of their evening. The first part of their night unfolds amidst friendly competition, with Paloma emerging victorious in nearly every game against the two men. However, there’s a solitary exception when she graciously allows them a victory. A mercy win of sorts

By this point, the bar begins to buzz with activity. When the familiar strains of country music fill the air, her face lights up with a wide smile as she beckons Javier to join her with an inviting gesture.

“Alright now, cowboy, hope you’ve been practicin’ those moves I showed ya.” He exchanges a look with the sheriff, an amused expression on his face.

“She’s roped you into it, huh? Feels good to no longer be her only victim,” The sheriff jokes which prompts her to roll her eyes and for Javier to genuinely laugh.

“Both of you are no fun, but I reckon this one here has no choice but to join me.”

He allows her to pull him towards the open area of the dance floor, a crowd gathering around them but he’s only focused on her.

They synchronize their movements, the steps simple enough for him to have retained in the days that followed her little lesson at the laundromat. He acknowledges internally the genuine effort he’s putting into dancing with her, despite his initial reluctance.

The radiant smile on her face makes every effort worthwhile.

Across the bar, Sloane observes the affectionate scene with interest, prompting her to excuse herself momentarily to make a phone call.

When the song ends, Paloma turns to him. “See? That wasn’t so bad. You did really good!”

“Well, I did have a great dance instructor.” He quips, and she suppresses a grin by biting her lip. She’s probably beaming like the damn Cheshire Cat right now.

Upon rejoining Romeo, he’s teasing Javier about his dancing.

“Oh daddy, don’t be such a bully.” Though her attention is diverted by the fresh tray of loaded fries resting on the edge of their pool table, and she takes a forkful; practically scarfing them down.

“Slow down, they’re not goin’ anywhere.” Her father comments as she devours the entirety of the appetizer.

“I haven’t eaten all day and loaded fries are the best thing to ever be invented.”

“Just like fried oreos?” Javier can’t resist the opportunity to tease her, shooting her a playful glance over the brim of his beer glass as he takes a sip.

She shoots him a sharp look, “Don’t.” Though she smiles softly, part of her wishing she could relive the entirety of that night. Sans the ferris wheel ride.

Shortly after finishing, Paloma heads off to prepare for her gig.

“Been meanin’ to ask…” The older man begins as they make their way to the usual table they sit at, “How was the trip to Dallas? You got back damn near the next mornin’.”

Javier tenses briefly but recovers, reaching for his trusty pack of cigarettes so he can puff on one while he does his best to recount that night without incriminating himself.

“It was great. She had a lotta fun… would have been back earlier but she insisted on staying to enjoy the fair. She can be very persistent.” He lights the stick, inhaling deeply before blowing the smoke out through his nose.

“Tell me about it. M’just glad she enjoyed herself. She deserves it, my sweet girl.” The adoration on his eyes is clear as day, that guilt Javi feels for pining after his daughter intensifies in the moment but it’s quickly dispersed as Paloma joins the stage.

The night unfolds in its usual manner, with her infectious energy and unmatched talent captivating the audience. Amidst a break between songs, she takes a sip of water, her gaze drifting across the crowd until it lands on August. A smile tugs at her lips as she realizes that he’s never seen her perform before. With her heart racing at the thought, she caps her water bottle and steps up to the microphone, clearing her throat in preparation.

“This next song has become one of my favorites after bein’ introduced to it by a very special friend.” Her eyes meet August’s and they twinkle underneath the stage lights. He raises his hand in a subtle wave as they acknowledge one another. “This is Creep by Radiohead.”

♫

As expected, she delivers the song perfectly. Javier becomes utterly entranced by her, mesmerized by the power of her voice. He’s so absorbed in her presence that he barely notices when the sheriff and some of his friends step outside, leaving him alone at the table with a fresh cigarette nestled between his lips.

Whatever makes you happy. Whatever you want. You’re so very special. I wish I was special.

In the midst of the crowd, a man emerges, clutching a vibrant bouquet of flowers that he carefully places on the stage near Paloma. Their eyes meet, and a surge of butterflies fills her stomach as she realizes he’s brought her azaleas, recalling her disappointment since her own hadn’t bloomed properly.

A trace of her excitement seeps into her singing, a gentle giggle interwoven with the lyrics as August winks at her before departing.

Javier finds himself frowning as he observes the exchange, a dangerous wave of jealousy sweeping over him. It’s only when the man begins to depart that he recognizes him.

Augustus fucking Dixon.

For the remainder of the night and well into the following morning, Javier’s mind is consumed by that interaction. He replays it over and over again— Paloma’s mention of August as a ‘special friend,’ the bouquet of flowers he had left for her.

The memory of her smile, her laughter directed at him, and the song she sang, seemingly just for him, echoes relentlessly in his thoughts.

Javier can’t shake the pinched feeling in his chest. He berates himself for his irrational jealousy. After all, he has no claim over her in any way, shape, or form. She’s a young, beautiful, and talented woman, free to be with anyone she damn pleases.

But to get involved with August? He can’t help but feel a surge of frustration. He’s pored over the guy’s file, seen the litany of petty crimes and the years he’s spent behind bars as a result. In Javier’s eyes, she deserves better, so much better. Someone who will treat her with the respect and admiration she deserves.

It’s unfair of him to react this way, he knows. Yet, try as he might to quell the rising tide of envy, he finds himself struggling against the tumultuous waves of the emotion.

She needs to be adored like the shining star she is, to be with someone who’ll kiss the ground she walks on and and treat her like fucking royalty.

What she doesn’t need is to be entangled with a petty criminal adorned in tattoos, sporting a questionable haircut, and roaring around on a motorcycle.

What— was Javier going to be the one to treat her as well as she deserves? The man with a jaded past and inability to commit? Yeah, right. He’s delusional for even letting that thought cross his mind.

He lets out a soft scoff, exhaling a stream of smoke through the cracked window of his cruiser. He sits parked in front of the church building where mass is currently being held.

He’s here after finding out that Gabriel Torres is employed as a groundskeeper for the property. It gives reason as to why he was around the day of Nina Thorton’s funeral, but doesn’t quite explain why he paused to stare at her picture in deep thought before leaving.

A nagging sense of intrigue gnaws at Javier as he considers the situation. There’s an underlying connection here, he senses it, yet he struggles to pinpoint exactly what it might be. Nina and Gabriel come from different towns, and his nomadic lifestyle suggests he’s been traversing the state for a while. From what Javi has gleaned about the deceased girl, Nina wasn’t one to associate with the ‘wrong crowd’. Still, he acknowledges the disparity between stating she wasn’t that type and the possibility that appearances can be deceiving.

Driven by his spark of jealousy, he intends to delve deeper into the group that includes Gabriel, August, and Sloane. Returning to his place last night, he went over their records and any other pertinent information he could find at that moment.

With sparse details at his disposal, he relies on the hearsay from the locals and a single notable arrest involving the trio. In this incident, they were apprehended for setting a cross ablaze in the heart of the woods. The resulting fire grew out of control, warranting all three of them to serve two years in jail.

Driven by a fierce determination, Javier resolves to unearth more information, to transform the whispers and rumors into concrete knowledge. He wants to unravel the enigma of August, to understand why someone as riveting as Paloma would choose to align herself with someone like him.

Javier remains steadfast in his pursuit, refusing to relent until he can definitively eliminate this group from his (almost nonexistent) roster of suspects. He won’t dismiss them entirely until he’s thoroughly convinced of their innocence. Moreover, he harbors no intention of divulging his personal investigation to the sheriff. After all, he had dismissed them months ago without a second thought, and Javier sees no reason to involve him now.

Unless he finds something of use, that is.

He gets out of his cruiser in his full work getup, snubbing out the finished cigarette with the bottom of his boot. Javier readjusts the gun that’s tucked against his lower back, plucking out a piece of spearmint gum to rid him of the nicotine taste that lingers in his mouth.

He rounds the building until he’s at the graveyard nestled on the grounds, approaching the younger male who is in the midst of digging a hole into the ground.

“Gabriel Torres?” Javier announces himself, lazily chewing on his gum as the guy turns to face him with a skeptical look on his face.

No words are exchanged, but Javi catches the subtle nod of acknowledgment directed his way.

“Javier Peña with Seminary’s Sheriff’s Department. Got a second to answer some questions.” He states, his gaze focused intently on the man’s face, searching for any subtle clues in his expression. After a beat of silence, he continues, “You’re not in any kind of trouble or anythin’. I’m just curious about the things I’ve been hearin’ about this group you’re part of.” Another analytical look follows, his amber-tinted shades not obscuring the intent behind his gaze.

Gabe drives the sharp end of the shovel deep into the soft earth, using it as a support as he leans against it. His gaze shifts to the officer before him, his expression thoughtful as he weighs the decision of whether speaking to him is wise or not.

“What is it?”

Javier’s hands fall to his waist, resting atop of his utility belt that has all his equipment on it.

“You’re not really sacrificin’ goats and eating newborns, right?” He chuckles dryly. As absurd as it may sound, it was verbatim to what a group of elderly woman had told him not long ago. Obviously, Javier treated it with a healthy dose of skepticism, but he realizes the importance of approaching this conversation with an open mind, not wanting to intimidate Gabriel into clamming up.

Given the number of arrests involving Gabriel and his two companions, Javier is acutely aware that they may not have the best relationship with authority. Consequently, he opts to adopt a more amicable approach, aiming to play the role of the ‘good cop’.

Gabriel dismisses the notion with a shake of his head. “Nah, man, we ain’t doing all that.” He replies. August had practically drilled everyone in their group on how to handle police interactions. Normally, he would stay silent and brush off an officer altogether, but he’s aware of Javier’s significance, especially regarding August’s interest in Paloma.

Sloane has kept them informed about her growing feelings for the older man and how that can be a hindrance to the overarching goal the group has.

“Kinda fuckin’ annoyin’ that people spew that bullshit without knowin’ how we actually operate. S’like the second they can’t wrap their narrow-minded brains around somethin’— the first thing they do is shout devil and other obscenities. Pointin’ fingers and grabbin’ their torches and pitchforks.”

Javier remains silent, allowing Gabriel to voice his thoughts without interruption. Yet, behind his outward calmness, his mind is sharp, absorbing every syllable uttered and analyzing the subtle nuances of Gabe’s demeanor. Observation is a skill honed over years of experience, and Javier excels in deciphering the unspoken language of body cues.

As Gabriel speaks, frustration emanates from him like a palpable force, evident in the tension of his posture and the earnestness in his voice. Javier takes note of every detail, recognizing the authenticity behind the words.

“It’s why we move around so damn much. Each time we think we found a place to settle in at, they’re runnin’ us off… Y’know, for claiming to be such compassionate people— they sure are hateful.”

Javier finds resonance in his sentiment. Hypocrisy often cloaks itself in the guise of piety, a facade worn by many he has encountered. The irony is not lost on him as he reflects on the dichotomy between professed faith and heinous deeds.

In his mind’s eye, he recalls the sanctimonious cartels in Colombia, adorned with religious iconography that belied their nefarious activities. Their clandestine operations, stained with bloodshed and violence, stood in stark contradiction to the sanctity they purportedly revered.

“Pretty shitty that you all have had to go through that… Has anyone ever attempted to retaliate? Some kind of revenge for constantly being pushed away?” Javi probes, earning a narrowed gaze from Gabe before their conversation is interrupted by another figure joining in.

“Chattin’ up a narc?” The insult rolls off August’s tongue with purpose as he approaches and his jaw ticks at the sound of his voice.

The two of them size each other up. August is a few inches taller than Javier though the discrepancy hardly matters given his hardened demeanor and inability to appear weak.

Now that he’s got a closer look at the guy, he really can’t fathom what it is that Paloma sees in him.

“He was just askin’ about the group. Tryin’ to discern if we’re actually killin’ babies ‘round here.” They share a laugh but Javier remains stone faced, annoyed at August’s interference.

“Ah, well, officer, I can assure you that none of that is happenin’. We’re a peaceful bunch... don’t bother no one. Keep to ourselves. Sure we’ve all done some pretty fucked up things but that’s all behind us. I created the Paragons of the Sacrificed with one goal: to unite and rehabilitate broken souls without the influence of organized religion. S’been workin’ so far— most of our members have stayed outta trouble, others following through with their sobriety.”

Javier remains skeptical of August’s supposed rehabilitation, a sentiment perhaps colored by his personal dislike for the man. With little else to say, he simply grunts in acknowledgment. The name of the group now revealed and stored away in his mind.

“Sounds like a good thing, then. Wonder why everyone is so insistent that you’re all trouble.”

“‘Cause of the childish shit we used to do. S’quite simple. They also feel threatened by the worship of something that isn’t their precious God.”

“So what is it that you devote yourself to then?” Javier maintains unwavering eye contact with August as he poses the question, his curiosity getting the better of him.

Amid the tense silence, Javier’s attention is diverted by a sudden commotion emanating from inside the church.

“Seems like you’re needed elsewhere, Officer Peña.” August remarks with a tilt of his head, a mischievous glint in his eye. Javier feels the temptation to reply with a snarky comment, but he restrains himself.

He’s determined to maintain the fragile rapport he’s building with Gabriel. He senses that he might be the one to provide the answers he seeks. Javier isn’t confident in Sloane’s ability to keep his sleuthing quiet around Paloma, and he certainly doesn’t trust August.

With a pointed glance at both of them, Javi excuses himself, now determined to investigate the unfolding disturbance.

Upon entering the stuffy church, his stomach sinks as he witnesses the chaotic scene unfolding in the tranquil atmosphere of the Sunday mass.

Mr. Thorton, his face contorted with grief and fueled by alcohol, stumbles down the aisle, his slurred words echoing through the hallowed space. The congregation shifts uncomfortably in their seats as he spews venomous words about his deceased daughter, casting blame upon the town for its perceived failure to bring her justice.

With practiced calm, Javier steps forward, his authoritative presence attempting to quell the rising tension. He approaches the man, who sways unsteadily on his feet, his sorrow morphing into rage. Despite his inebriated state, his words cut through the air like knives, each one laced with pain and bitterness.

As Javier attempts to diffuse the situation, Mr. Thorton’s desperation reaches a fever pitch. In a moment of reckless anguish, he lunges towards Paloma, his grip fierce and unyielding. The gasps of the onlookers mingle with Paloma’s startled cry as Javier moves swiftly to intervene, his strong arms encircling then pulling him back with firm force.

The sheriff looks like he might kill the man for putting his hands on his daughter.

In that fraught moment, Javier feels for the broken man before him, his own frustration mirrored in Mr. Thorton’s anguished cries. But duty compels him to maintain order. And so, with resolve in his eyes and compassion in his heart, he guides his wrists behind his back to cuff him and redirect him away from the congregation.

His steps are heavy with the burden of sorrow that hangs in the air. “Alright, let’s go.” Javier murmurs, dragging the babbling man down the aisle and out the door.

Concerned whispers fill the room as a few people gather around Paloma, their eyes reflecting worry and sympathy. She offers them a reassuring smile, her hand absently rubbing at her sore forearm where Mr. Thorton’s grip had been firm and unforgiving. Beneath the surface, she can feel the faint stirrings of pain, a precursor to the bruises that will inevitably bloom in the days to come.

Her focus remained fixed on Javier through the entirety of the situation. When their eyes met, she felt a rush of gratitude wash over her as he handled the outburst.

Because it’s his job, Paloma. Stop overthinking every little interaction you have with him!

Despite the chaos of the moment, she couldn’t help but be entranced by his presence. There’s something undeniably sexy about him in his uniform, the way he rushed to her side with a sense of protective urgency that set her heart racing.

As he strides out of the church, his silhouette framed by the dim light filtering through the stained-glass windows, her gaze lingers on the gun tucked into the back of his pants.

For a brief, exhilarating moment, she’s overwhelmed by a rush of emotions. The sight of him, strong and resolute in the face of conflict, stirs the yearning that she struggles to contain. But then reality comes crashing back in, reminding her of the solemn setting of the church and the prying eyes of the congregation.

With a rueful shake of her head, she pushes aside her fleeting infatuation, burying it beneath a veil of composure. She knows that now is not the time nor the place for such thoughts. And so, with a determined resolve, she squares her shoulders and turns her attention back to the proceedings, pushing aside her wayward emotions in favor of the solemnity of the moment.

The Thorton family’s sorrow weighs heavily on Paloma’s heart in the aftermath of their tragic loss. It’s evident that the death of their daughter has left them shattered, each member of the family bearing the scars of grief in their own way. Mr. Thorton’s descent into alcoholism and his wife’s spiral into depression paint a poignant picture of their collective anguish.

She finds herself contemplating whether she should reach out to them, offering a small gesture of solace in the face of their immense pain. The idea of stopping by their house, perhaps with a comforting dish in hand, crosses her mind as she ponders ways to alleviate their suffering, even if only for a fleeting moment. Yet, she knows deep down that no amount of well-intentioned gestures can ever fully mend the brokenness that has consumed their family.

#pedro pascal fanfic #pedro pascal #pedro pascal character fanfic #javier pena fanfic #javier pena fic #javier peña x ofc #javier pena narcos #javier peña narcos #javier peña fanfiction #javier peña fic #javier pena fanfiction #javier pena smut #javier peña smut #javier peña fanfic #southern gothic fic #ethel cain #preachers daughter

17 notes · View notes

mostlysignssomeportents · 2 years

Text

Delegating trust is really, really, really hard (infosec edition)

CORRECTION: A previous version of this thread reported that Trustcor has the same officers as Packet Forensics; they do not; they have the same officers as Measurement Systems. I regret the error.

I’ve got trust issues. We all do. Some infosec pros go so far as to say “trust no one,” a philosophy more formally known as “Zero Trust,” that holds that certain elements of your security should never be delegated to any third party.

The problem is, it’s trust all the way down. Say you maintain your own cryptographic keys on your own device. How do you know the software you use to store those keys is trustworthy? Well, maybe you audit the source-code and compile it yourself.

But how do you know your compiler is trustworthy? When Unix/C co-creator Ken Thompson received the Turing Prize, he either admitted or joked that he had hidden back doors in the compiler he’d written, which was used to compile all of the other compilers:

https://pluralistic.net/2022/10/11/rene-descartes-was-a-drunken-fart/#trusting-trust

OK, say you whittle your own compiler out of a whole log that you felled yourself in an old growth forest that no human had set foot in for a thousand years. How about your hardware? Back in 2018, Bloomberg published a blockbuster story claiming that the server infrastructure of the biggest cloud companies had been compromised with tiny hardware interception devices:

https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies

The authors claimed to have verified their story in every conceivable way. The companies whose servers were said to have been compromised rejected the entire story. Four years later, we still don’t know who was right.

How do we trust the Bloomberg reporters? How do we trust Apple? If we ask a regulator to investigate their claims, how do we trust the regulator? Hell, how do we trust our senses? And even if we trust our senses, how do we trust our reason? I had a lurid, bizarre nightmare last night where the most surreal events seemed perfectly reasonable (tldr: I was mugged by invisible monsters while trying to order a paloma at the DNA Lounge, who stole my phone and then a bicycle I had rented from the bartender).

If you can’t trust your senses, your reason, the authorities, your hardware, your software, your compiler, or third-party service-providers, well, shit, that’s pretty frightening, isn’t it (paging R. Descartes to a white courtesy phone)?

There’s a joke about physicists, that all of their reasoning begins with something they know isn’t true: “Assume a perfectly spherical cow of uniform density on a frictionless surface…” The world of information security has a lot of these assumptions, and they get us into trouble.

Take internet data privacy and integrity — that is, ensuring that when you send some data to someone else, the data arrives unchanged and no one except that person can read that data. In the earliest days of the internet, we operated on the assumption that the major threat here was technical: our routers and wires might corrupt or lose the data on the way.

The solution was the ingenious system of packet-switching error-correction, a complex system that allowed the sender to verify that the recipient had gotten all the parts of their transmission and resend the parts that disappeared en route.

This took care of integrity, but not privacy. We mostly just pretended that sysadmins, sysops, network engineers, and other people who could peek at our data “on the wire” wouldn’t, even though we knew that, at least some of the time, this was going on. The fact that the people who provided communications infrastructure had a sense of duty and mission didn’t mean they wouldn’t spy on us — sometimes, that was why they peeked, just to be sure that we weren’t planning to mess up “their” network.

The internet always carried “sensitive” information — love letters, private discussions of health issues, political plans — but it wasn’t until investors set their sights on commerce that the issue of data privacy came to the fore. The rise of online financial transactions goosed the fringe world of cryptography into the mainstream of internet development.

This gave rise to an epic, three-sided battle, between civil libertarians, spies, and business-people. For years, the civil liberties people had battled the spy agencies over “strong encryption” (more properly called “working encryption” or just “encryption”).

The spy agencies insisted that civilization would collapse if they couldn’t wiretap any and every message traversing the internet, and maintained that they would neither abuse this facility, nor would they screw up and let someone else do so (“trust us,” they said).

The business world wanted to be able to secure their customers’ data, at least to the extent that an insurer would bail them out if they leaked it; and they wanted to actually secure their own data from rivals and insider threats.

Businesses lacked the technological sophistication to evaluate the spy agencies’ claims that there was such a thing as encryption that would keep their data secure from “bad guys” but would fail completely whenever a “good guy” wanted to peek at it.

In a bid to educate them on this score, EFF co-founder John Gilmore built a $250,000 computer that could break the (already broken) cryptography the NSA and other spy agencies claimed businesses could rely on, in just a couple hours. The message of this DES Cracker was that anyone with $250,000 will be able to break into the communications of any American business:

https://cryptome.org/jya/des-cracker.htm

Fun fact: John got tired of the bar-fridge-sized DES Cracker cluttering up his garage and he sent it to my house for safekeeping; it’s in my office next to my desk in LA. If I ever move to the UK, I’ll have to leave it behind because it’s (probably) still illegal to export.

The deadlock might have never been broken but for a key lawsuit: Cindy Cohn (now EFF’s executive director) won the Bernstein case, which established that publishing cryptographic source-code was protected by the First Amendment:

https://www.eff.org/cases/bernstein-v-us-dept-justice

With cryptography legalized, browser vendors set about securing the data-layer in earnest, expanding and formalizing the “public key infrastructure” (PKI) in browsers. Here’s how that works: your browser ships with a list of cryptographic keys from trusted “certificate authorities.” These are entities that are trusted to issue “certificates” to web-hosts, which are used to wrap up their messages to you.

When you open a connection to “https://foo.com," Foo sends you a stream of data that is encrypted with a key identified as belonging to “foo.com” (this key is Foo’s “certificate” — it certifies that the user of this key is Foo, Inc). That certificate is, in turn, signed by a “Certificate Authority.”

Any Certificate Authority can sign any certificate — your browser ships with a long list of these CAs, and if any one of them certifies that the bearer is “Foo.com,” that server can send your browser “secure” traffic and it will dutifully display the data with all assurances that it arrived from one of Foo, Inc’s servers.

This means that you are trusting all of the Certificate Authorities that come with your browser, and you’re also trusting the company that made your browser to choose good Certificate Authorities. This is a lot of trust. If any of those CAs betrays your trust and issues a bad cert, it can be used to reveal, copy, and alter the data you send and receive from a server that presents that certificate.

You’d hope that certificate authorities would be very prudent, cautious and transparent — and that browser vendors would go to great lengths to verify that they were. There are PKI models for this: for example, the “DNS root keys” that control the internet’s domain-name service are updated via a formal, livestreamed ceremony:

https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/

There are 14 people entrusted to perform this ceremony, and at least three must be present at each performance. The keys are stored at two facilities, and the attendees need to show government ID to enter them (is the government that issued the ID trustworthy? Do you trust the guards to verify it? Ugh, my head hurts).

Further access to the facility is controlled by biometric locks (do you trust the lock maker? How about the person who registers the permitted handprints?). Everyone puts a wet signature in a logbook. A staffer has their retina scanned and presents a smartcard.

Then the staffer opens a safe that has a “tamper proof” (read: “tamper resistant”) hardware module whose manufacturer is trusted (why?) not to have made mistakes or inserted a back-door. A special laptop (also trusted) is needed to activate the safe’s hardware module. The laptop “has no battery, hard disk, or even a clock backup battery, and thus can’t store state once it’s unplugged.” Or, at least, the people in charge of it claim that it doesn’t and can’t.

The ceremony continues: the safe yields a USB stick and a DVD. Each of the trusted officials hands over a smart card that they trust and keep in a safe deposit box in a tamper-evident bag. The special laptop is booted from the trusted DVD and mounts the trusted USB stick. The trusted cards are used to sign three months worth of keys, and these are the basis for the next quarter’s worth of secure DNS queries.

All of this is published, videoed, livestreamed, etc. It’s a real “defense in depth” situation where you’d need a very big conspiracy to subvert all the parts of the system that need to work in order to steal underlying secrets. Yes, bottom line, you’re still trusting people, but in part you’re trusting them not to be able to all keep a secret from the rest of us.

The process for determining which CAs are trusted by your browser is a lot less transparent and, judging from experience, a lot less thorough. Many of these CAs have proven to be manifestly untrustworthy over the years. There was Diginotar, a Dutch CA whose bad security practices left it vulnerable to a hack-attack:

https://en.wikipedia.org/wiki/DigiNotar

Some people say it was Iranian government hackers, who used its signing keys to forge certificates and spy on Iranian dissidents, who are liable to arrest, torture and execution. Other people say it was the NSA pretending to be Iranian government hackers:

https://www.schneier.com/blog/archives/2013/09/new_nsa_leak_sh.html

In 2015, the China Internet Network Information Center was used to issue fake Google certificates, which gave hackers the power to intercept and take over Google accounts and devices linked to them (e.g. Android devices):

https://thenextweb.com/news/google-to-drop-chinas-cnnic-root-certificate-authority-after-trust-breach

In 2019, the UAE cyber-arms dealer Darkmatter — an aggressive recruiter of American ex-spies — applied to become a trusted Certificate Authority, but was denied:

https://www.reuters.com/investigates/special-report/usa-spying-raven/

Browser PKI is very brittle. By design, any of the trusted CAs can compromise every site on the internet. An early attempt to address this was “certificate pinning,” whereby browsers shipped with a database of which CAs were authorized to issue certificates for major internet companies. That meant that even though your browser trusted Crazy Joe’s Discount House of Certification to issue certs for any site online, it also knew that Google didn’t use Crazy Joe, and any google.com certs that Crazy Joe issued would be rejected.

But pinning has a scale problem: there are billions of websites and many of them change CAs from time to time, which means that every browser now needs a massive database of CA-site pin-pairs, and a means to trust the updates that site owners submit to browsers with new information about which CAs can issue their certificates.

Pinning was a stopgap. It was succeeded by a radically different approach: surveillance, not prevention. That surveillance tool is Certificate Transparency (CT), a system designed to quickly and publicly catch untrustworthy CAs that issue bad certificates:

https://www.nature.com/articles/491325a

Here’s how Certificate Transparency works: every time your browser receives a certificate, it makes and signs a tiny fingerprint of that certificate, recording the date, time, and issuing CA, as well as proof that the CA signed the certificate with its private key. Every few minutes, your browser packages up all these little fingerprints and fires them off to one or more of about a dozen public logs:

https://certificate.transparency.dev/logs/

These logs use a cool cryptographic technology called Merkle trees that make them tamper-evident: that means that if some alters the log (say, to remove or forge evidence of a bad cert), everyone who’s got a copy of any of the log’s previous entries can tell that the alteration took place.

Merkle Trees are super efficient. A modest server can easily host the eight billion or so CT records that exist to date. Anyone can monitor any of these public logs, checking to see whether a CA they don’t recognize has issued a certificate for their own domain, and then prove that the CA has betrayed its mission.

CT works. It’s how we learned that Symantec engaged in incredibly reckless behavior: as part of their test-suite for verifying a new certificate-issuing server, they would issue fake Google certificates. These were supposed to be destroyed after creation, but at least one leaked and showed up in the CT log:

https://arstechnica.com/information-technology/2017/03/google-takes-symantec-to-the-woodshed-for-mis-issuing-30000-https-certs/

It wasn’t just Google — Symantec had issued tens of thousands of bad certs. Worse: Symantec was responsible for more than a third of the web’s certificates. We had operated on the blithe assumption that Symantec was a trustworthy entity — a perfectly spherical cow of uniform density — but on inspection it was proved to be a sloppy, reckless mess.

After the Symantec scandal, browser vendors cleaned house — they ditched Symantec from browsers’ roots of trust. A lot of us assumed that this scandal would also trigger a re-evaluation of how CAs demonstrated that they were worth of inclusion in a browser’s default list of trusted entities.

If that happened, it wasn’t enough.

Yesterday, the Washington Post’s Joseph Menn published an in-depth investigation into Trustcor, a certificate authority that is trusted by default by Safari, Chrome and Firefox:

https://www.washingtonpost.com/technology/2022/11/08/trustcor-internet-addresses-government-connections/

Menn’s report is alarming. Working from reports from University of Calgary privacy researcher Joel Reardon and UC Berkeley security researcher Serge Egelman, Menn presented a laundry list of profoundly disturbing problems with Trustcor:

https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/etbBho-VBQAJ

First, there’s an apparent connection to Packet Forensics, a high-tech arms dealer that sells surveillance equipment to the US government. One of Trustcor’s partners is a holding company managed by Packet Forensics spokesman Raymond Saulino.

If Trustcor is working with (or part of) Packet Forensics, it could issue fake certificates for any internet site that Packet Forensics could use to capture, read and modify traffic between that site and any browser. One of Menn’s sources claimed that Packet Forensics “used TrustCor’s certificate process and its email service, MsgSafe, to intercept communications and help the U.S. government.”

Trustcor denies this, as did the general counsel for Packet Forensics.

Should we trust either of them? It’s hard to understand why we would. Take Trustcor: as mentioned, it has a “private” email service called “Msgsafe,” that claims to offer end-to-end encrypted email. But it is not encrypted end-to-end — it sends copies of its users’ private keys to Trustcor, allowing the company (or anyone who hacks the company) to intercept its email.

It’s hard to avoid the conclusion that Trustcor is making an intentionally deceptive statement about how its security products work, or it lacks the basic technical capacity to understand how those products should work. You’d hope that either of those would disqualify Trustcor from being trusted by default by billions of browsers.

It’s worse than that, though: there are so many red flags about Trustcor beyond the defects in Msgsafe. Menn found that that company’s website identified two named personnel, both supposed founders. One of those men was dead. The other one’s Linkedin profile has him departing the company in 2019.

The company lists two phone numbers. One is out of service. The other goes to unmonitored voicemail. The company’s address is a UPS Store in Toronto. Trustcor’s security audits are performed by the “Princeton Audit Group” whose address is a private residence in Princeton, NJ.

A company spokesperson named Rachel McPherson publicly responded to Menn’s article and Reardon and Egelman’s report with a bizarre, rambling message:

https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/X_6OFLGfBQAJ

In it, McPherson insinuates that Reardon and Egelman are just trying to drum up business for a small security research business they run called Appsecure. She says that Msgsafe’s defects aren’t germane to Trustcor’s Certificate Authority business, instead exhorting the researchers to make “positive suggestions for improving that product suite.”

As to the company’s registration, she makes a difficult-to-follow claim that the irregularities are due to using the same Panamanian law-firm as Packet Forensics, says that she needs to investigate some missing paperwork, and makes vague claims about “insurance impersonation” and “potential for foul play.”

Certificate Authorities have one job: to be very, very, very careful. The parts of Menn’s story and Reardon and Egelman’s report that aren’t disputed are, to my mind, enough to disqualify them from inclusion in browsers’ root of trust.

But the disputed parts — which I personally believe, based on my trust in Menn, which comes from his decades of careful and excellent reporting — are even worse.

For example, Menn makes an excellent case that Packet Forensics is not credible. In 2007, a company called Vostrom Holdings applied for permission for Packet Forensics to do business in Virginia as “Measurement Systems.” Measurement Systems, in turn, tricked app vendors into bundling spyware into their apps, which gathered location data that Measurement Systems sold to private and government customers. Measurement Systems’ data included the identities of 10,000,000 users of Muslim prayer apps.

Packet Forensics denies that it owns Measurement Systems, which doesn’t explain why Vostrom Holdings asked the state of Virginia to let it do business as Measurement Systems. Vostrom also owns the domain “Trustcor.co,” which directed to Trustcor’s main site. Trustcor’s “president, agents and holding-company partners” are identical to those of Measurement Systems.

One of the holding companies listed in both Trustcor and Measurement Systems’ ownership structures is Frigate Bay Holdings. This March, Raymond Saulino — the one-time Packet Forensics spokesman — filed papers in Wyoming identifying himself as manager of Frigate Bay Holdings.

Neither Menn nor Reardon and Egelman claim that Packet Forensics has obtained fake certificates from Trustcor to help its customers spy on their targets, something that McPherson stresses in her reply. However, Menn’s source claims that this is happening.

These companies are so opaque and obscure that it might be impossible to ever find out what’s really going on, and that’s the point. For the web to have privacy, the Certificate Authorities that hold the (literal) keys to that privacy must be totally transparent. We can’t assume that they are perfectly spherical cows of uniform density.

In a reply to Reardon and Egelman’s report, Mozilla’s Kathleen Wilson asked a series of excellent, probing followup questions for Trustcor, with the promise that if Trustcor failed to respond quickly and satisfactorily, it would be purged from Firefox’s root of trust:

https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/WJXUELicBQAJ

Which is exactly what you’d hope a browser vendor would do when one of its default Certificate Authorities was credibly called into question. But that still leaves an important question: how did Trustcor, who marketed a defective security product, whose corporate ownership is irregular and opaque with a seeming connection to a cyber-arms-dealer, end up in our browsers’ root of trust to begin with?

Formally, the process for inclusion in the root of trust is quite good. It’s a two-year vetting process that includes an external audit:

https://wiki.mozilla.org/CA/Application_Process

But Daniel Schwalbe, CISO of Domain Tools, told Menn that this process was not closely watched, claiming “With enough money, you or I could become a trusted root certificate authority.” Menn’s unnamed Packet Forensics source claimed that most of the vetting process was self-certified — that is, would-be CAs merely had to promise they were doing the right thing.

Remember, Trustcor isn’t just in Firefox’s root of trust — it’s in the roots of trust for Chrome (Google) and Safari (Apple). All the major browser vendors were supposed to investigate this company and none of them disqualified it, despite all the vivid red flags.

Worse, Reardon and Egelman say they notified all three companies about the problems with Trustcor seven months ago, but didn’t hear back until they published their findings publicly on Tuesday.

There are 169 root certificate authorities in Firefox, and comparable numbers in the other major browsers. It’s inconceivable that you could personally investigate each of these and determine whether you want to trust it. We rely on the big browser vendors to do that work for us. We start with: “Assume the browser vendors are careful and diligent when it comes to trusting companies on our behalf.” We assume that these messy, irregular companies are perfectly spherical cows of uniform density on a frictionless surface.

The problem of trust is everywhere. Vaccine deniers say they don’t trust the pharma companies not to kill them for money, and don’t trust the FDA to hold them to account. Unless you have a PhD in virology, cell biology and epidemiology, you can’t verify the claims of vaccine safety. Even if you have those qualifications, you’re trusting that the study data in journals isn’t forged.

I trust vaccines — I’ve been jabbed five times now — but I don’t think it’s unreasonable to doubt either Big Pharma or its regulators. A decade ago, my chronic pain specialist told me I should take regular doses of powerful opioids, and pooh-poohed my safety and addiction concerns. He told me that pharma companies like Purdue and regulators like the FDA had re-evaluated the safety of opioids and now deemed them far safer.

I “did my own research” and concluded that this was wrong. I concluded that the FDA had been captured by a monopolistic and rapacious pharma sector that was complicit in waves of mass-death that produced billions in profits for the Sackler family and other opioid crime-bosses.

I was an “opioid denier.” I was right. The failure of the pharma companies to act in good faith, and the failure of the regulator to hold them to account is a disaster that has consequences beyond the mountain of overdose deaths. There’s a direct line from that failure to vaccine denial, and another to the subsequent cruel denial of pain meds to people who desperately need them.

Today, learning that the CA-vetting process I’d blithely assumed was careful and sober-sided is so slapdash that a company without a working phone or a valid physical address could be trusted by billions of browsers, I feel like I did when I decided not to fill my opioid prescription.

I feel like I’m on the precipice of a great, epistemological void. I can’t “do my own research” for everything. I have to delegate my trust. But when the companies and institutions I rely on to be prudent (not infallible, mind, just prudent) fail this way, it makes me want to delete all the certificates in my browser.

Which would, of course, make the web wildly insecure.

Unless it’s already that insecure.

Ugh.

Image:

Curt Smith (modified)

https://commons.wikimedia.org/wiki/File:Sand_castle,_Cannon_Beach.jpg

CC BY 2.0:

https://creativecommons.org/licenses/by/2.0/deed.en

[Image ID: An animated gif of a sand-castle that is melting into the rising tide; through the course of the animation, the castle gradually fills up with a Matrix-style 'code waterfall' effect.]

#pluralistic

349 notes · View notes