business

A private espionage company for businessmen

business, security, technology / /

From Bo Elkjaer and Kenan Seeberg’s “Echelon’S Architect” (Cryptome: 21 May 2002):

After that, [Bruce McIndoe] started to design Echelon II, an enlargement of the original system.

Bruce McIndoe left the inner circle of the enormous espionage network in 1998, a network run by the National Security Agency, the world’s most powerful intelligence agency, in cooperation with other Western intelligence services. Ekstra Bladet tracked down Bruce McIndoe to IJet Travel Intelligence, a private espionage agency where he is currently second in command.

IJet Travel Intelligence is an exceedingly effective, specialized company that employs former staff members of the NSA, CIA, KGB and South African intelligence services.

The company’s task is to furnish reports for top executives from US business and industry that reveal everything about the destination to which they are travelling for their multinational company. All the information they need to make the trip as safe as possible. The company resembles a miniature version of his previous employer, the world’s most powerful intelligence agency, the NSA. …

“Okay. In short, we have transferred everything I did for the NSA and other services to a private company that then sells intelligence to businesspersons. We get information on everything from local diseases, outbreaks of malaria epidemics and local unrest to strikes, the weather and traffic conditions. Our customers are large multinational companies like Prudential and Texas Instruments. We also work for institutions like the World Bank and the IMF.” …

“Yes, exactly. Our staff are also former intelligent agents who have either developed or run espionage operations for US intelligence agencies or people from the UK, South Africa and Russia.”

A private espionage company for businessmen Read More »

Learn by working on hard problems

business, education, history / /

From Paul Graham’s “Undergraduation” (March 2005):

Thomas Huxley said “Try to learn something about everything and everything about something.” Most universities aim at this ideal.

But what’s everything? To me it means, all that people learn in the course of working honestly on hard problems. …

Working on hard problems is not, by itself, enough. Medieval alchemists were working on a hard problem, but their approach was so bogus that there was little to learn from studying it, except possibly about people’s ability to delude themselves.

Learn by working on hard problems Read More »

Education teaches people how to solve problems, not choose the good ones

business, education, history / /

From Paul Graham’s “Why Smart People Have Bad Ideas” (April 2005):

Why did so few applicants really think about what customers want? I think the problem with many, as with people in their early twenties generally, is that they’ve been trained their whole lives to jump through predefined hoops. They’ve spent 15-20 years solving problems other people have set for them. And how much time deciding what problems would be good to solve? Two or three course projects? They’re good at solving problems, but bad at choosing them.

But that, I’m convinced, is just the effect of training. Or more precisely, the effect of grading. To make grading efficient, everyone has to solve the same problem, and that means it has to be decided in advance. It would be great if schools taught students how to choose problems as well as how to solve them, but I don’t know how you’d run such a class in practice.

Education teaches people how to solve problems, not choose the good ones Read More »

Business, work, and good ideas

business / /

From Paul Graham’s “Why Smart People Have Bad Ideas” (April 2005):

This summer, as an experiment, some friends and I are giving seed funding to a bunch of new startups. It’s an experiment because we’re prepared to fund younger founders than most investors would. That’s why we’re doing it during the summer– so even college students can participate. …

The deadline has now passed, and we’re sifting through 227 applications. We expected to divide them into two categories, promising and unpromising. But we soon saw we needed a third: promising people with unpromising ideas. …

One of the most valuable things my father taught me is an old Yorkshire saying: where there’s muck, there’s brass. Meaning that unpleasant work pays. And more to the point here, vice versa. Work people like doesn’t pay well, for reasons of supply and demand. The most extreme case is developing programming languages, which doesn’t pay at all, because people like it so much they do it for free. …

So why were we afraid? We felt we were good at programming, but we lacked confidence in our ability to do a mysterious, undifferentiated thing we called “business.” In fact there is no such thing as “business.” There’s selling, promotion, figuring out what people want, deciding how much to charge, customer support, paying your bills, getting customers to pay you, getting incorporated, raising money, and so on. And the combination is not as hard as it seems, because some tasks (like raising money and getting incorporated) are an O(1) pain in the ass, whether you’re big or small, and others (like selling and promotion) depend more on energy and imagination than any kind of special training.

Business, work, and good ideas Read More »

Patenting is hurting scientific research & progress

business, law, science, technology / /

From American Association for the Advancement of Science’s “The Effects of Patenting in the AAAS Scientific Community” [250 kb PDF] (2006):

Forty percent of respondents who had acquired patented technologies since January 2001 reported difficulties in obtaining those technologies. Industry bioscience respondents reported the most problems, with 76 percent reporting that their research had been affected by such difficulties. In contrast, only 35 percent of academic bioscience respondents reported difficulties that affected their research.

Of the 72 respondents who reported that their work had been affected by the technology acquisition process, 58 percent of those reported that their work was delayed. Fifty percent reported that they had to change their research, and 28 percent reported abandoning their research project as acquisition of the necessary technologies involved overly complex licensing negotiations.

Patenting is hurting scientific research & progress Read More »

OnStar: the numbers

business, security, tech in changing society, technology / /

From PR Newswire’s “OnStar Achieves Another First as Winner of Good Housekeeping’s ‘Good Buy’ Award for Best Servic” (3 December 2004):

Each month on average, OnStar receives about 700 airbag notifications and 11,000 emergency assistance calls, which include 4,000 Good Samaritan calls for a variety of emergency situations. In addition, each month OnStar advisors respond to an average of 500 stolen vehicle location requests, 20,000 requests for roadside assistance, 36,000 remote door-unlock requests and 19,000 GM Goodwrench remote diagnostics requests.

OnStar: the numbers Read More »

The power of PR

business, language & literature, politics / /

From Paul Graham’s “The Submarine” (April 2005):

Why do the media keep running stories saying suits are back? Because PR firms tell them to. One of the most surprising things I discovered during my brief business career was the existence of the PR industry, lurking like a huge, quiet submarine beneath the news. Of the stories you read in traditional media that aren’t about politics, crimes, or disasters, more than half probably come from PR firms.

I know because I spent years hunting such “press hits.” Our startup spent its entire marketing budget on PR: at a time when we were assembling our own computers to save money, we were paying a PR firm $16,000 a month. And they were worth it. PR is the news equivalent of search engine optimization; instead of buying ads, which readers ignore, you get yourself inserted directly into the stories. …

If anyone is dishonest, it’s the reporters. The main reason PR firms exist is that reporters are lazy. Or, to put it more nicely, overworked. Really they ought to be out there digging up stories for themselves. But it’s so tempting to sit in their offices and let PR firms bring the stories to them. After all, they know good PR firms won’t lie to them.

A good flatterer doesn’t lie, but tells his victim selective truths (what a nice color your eyes are). Good PR firms use the same strategy: they give reporters stories that are true, but whose truth favors their clients. …

Where the work of PR firms really does get deliberately misleading is in the generation of “buzz.” They usually feed the same story to several different publications at once. And when readers see similar stories in multiple places, they think there is some important trend afoot. Which is exactly what they’re supposed to think. …

Remember the exercises in critical reading you did in school, where you had to look at a piece of writing and step back and ask whether the author was telling the whole truth? If you really want to be a critical reader, it turns out you have to step back one step further, and ask not just whether the author is telling the truth, but why he’s writing about this subject at all.

Online, the answer tends to be a lot simpler. Most people who publish online write what they write for the simple reason that they want to. You can’t see the fingerprints of PR firms all over the articles, as you can in so many print publications — which is one of the reasons, though they may not consciously realize it, that readers trust bloggers more than Business Week. …

I didn’t realize, till there was an alternative, just how artificial most of the writing in the mainstream media was. I’m not saying I used to believe what I read in Time and Newsweek. Since high school, at least, I’ve thought of magazines like that more as guides to what ordinary people were being told to think than as sources of information.

The power of PR Read More »

How to get 1 million MySpace friends

business, security, social software, tech in changing society, technology / /

From Nate Mook’s “Cross-Site Scripting Worm Hits MySpace” (Beta News: 13 October 2005):

One clever MySpace user looking to expand his buddy list recently figured out how to force others to become his friend, and ended up creating the first self-propagating cross-site scripting (XSS) worm. In less than 24 hours, “Samy” had amassed over 1 million friends on the popular online community.

How did Samy transcend his humble beginnings of only 73 friends to become a veritable global celebrity? The answer is a combination of XSS tricks and lax security in certain Web browsers.

First, by examining the restrictions put into place by MySpace, Samy discovered how to insert raw HTML into his user profile page. But MySpace stripped out the word “javascript” from any text, which would be needed to execute code.

With the help of Internet Explorer, Samy was able to break the word JavaScript into two lines and place script code within a Cascading Style Sheet tag.

The next step was to simply instruct the Web browser to load a MySpace URL that would automatically invite Samy as a friend, and later add him as a “hero” to the visitor’s own profile page. To do this without a user’s knowledge, the code utilized XMLHTTPRequest – a JavaScript object used in AJAX, or Web 2.0, applications such as Google Maps.

Taking the hack even further, Samy realized that he could simply insert the entire script into the visiting user’s profile, creating a replicating worm. “So if 5 people viewed my profile, that’s 5 new friends. If 5 people viewed each of their profiles, that’s 25 more new friends,” Samy explained.

It didn’t take long for friend requests to start rolling in – first in the hundreds, then thousands. By 9:30pm that night, requests topped one million and continued arriving at a rate of 1,000 every few seconds. Less than an hour later, MySpace was taken offline while the worm was removed from all user profiles.

How to get 1 million MySpace friends Read More »

Microsoft: only way to deal with malware is to wipe the computer

business, security, tech in changing society, technology / /

From Ryan Naraine’s “Microsoft Says Recovery from Malware Becoming Impossible” (eWeek: 4 April 2006):

In a rare discussion about the severity of the Windows malware scourge, a Microsoft security official said businesses should consider investing in an automated process to wipe hard drives and reinstall operating systems as a practical way to recover from malware infestation.

“When you are dealing with rootkits and some advanced spyware programs, the only solution is to rebuild from scratch. In some cases, there really is no way to recover without nuking the systems from orbit,” Mike Danseglio, program manager in the Security Solutions group at Microsoft, said in a presentation at the InfoSec World conference here.

Offensive rootkits, which are used hide malware programs and maintain an undetectable presence on an infected machine, have become the weapon of choice for virus and spyware writers and, because they often use kernel hooks to avoid detection, Danseglio said IT administrators may never know if all traces of a rootkit have been successfully removed.

He cited a recent instance where an unnamed branch of the U.S. government struggled with malware infestations on more than 2,000 client machines. “In that case, it was so severe that trying to recover was meaningless. They did not have an automated process to wipe and rebuild the systems, so it became a burden. They had to design a process real fast,” Danseglio added.

… “We’ve seen the self-healing malware that actually detects that you’re trying to get rid of it. You remove it, and the next time you look in that directory, it’s sitting there. It can simply reinstall itself,” he said.

“Detection is difficult, and remediation is often impossible,” Danseglio declared. “If it doesn’t crash your system or cause your system to freeze, how do you know it’s there? The answer is you just don’t know. Lots of times, you never see the infection occur in real time, and you don’t see the malware lingering or running in the background.”

… Danseglio said the success of social engineering attacks is a sign that the weakest link in malware defense is “human stupidity.”

“Social engineering is a very, very effective technique. We have statistics that show significant infection rates for the social engineering malware. Phishing is a major problem because there really is no patch for human stupidity,” he said.

Microsoft: only way to deal with malware is to wipe the computer Read More »

A big benefit of open source: better learning & teaching

business, tech in changing society, technology / /

From Jon Udell’s “Open source education” (InfoWorld: 7 June 2006):

Open source software development, to a degree unmatched by any other modern profession, offers apprentices the opportunity to watch journeymen and masters at work, to interact with them, and to learn how they think, work, succeed, and fail. Transparency and accountability govern not only the production of source code but also the companion processes of design, specification, testing, maintenance, and evaluation. …

It’s typical of many professions to cultivate an aura of infallibility and monopoly control of information. Open source doesn’t work that way. There are prima donnas, to be sure, but the culture requires practitioners to show their cards, and it erodes information monopolies. Shared code is just the tip of the iceberg. Below the waterline, there’s a vast body of shared knowledge and tradition, grounded in what Tim O’Reilly calls an architecture of participation.

We’ve come to see open source as an economic innovation. Cooperative production of commodity infrastructure paves the way for competitive production of high-value products and services. Perhaps we’ll someday see open source as an educational innovation, too. Cooperative production of shared knowledge isn’t just a by-product. When apprentices, journeymen, and masters engage in a continuous cycle of learning and teaching, an old approach to education is made new again.

A big benefit of open source: better learning & teaching Read More »

Spy on no-good boss and lose your job

business, security, tech in changing society, technology / /

From Melissa Meagher’s “State Worker Spies on Boss, Loses His Job“:

For 22 years, [Vernon] Blake was a System Administrator for the Alabama Department of Transportation. It was a job he loved, with the exception of his supervisor. …

The running joke around the office? The boss blew off meetings and projects to play games on his computer. Cartoons secretly circled The Right of Way Bureau, jabbing at George Dobbs’ Solitaire habit. Dobbs is a 24-year veteran with the DOT and rakes in $67,000 a year. …

Without proof, Blake felt his accusations would get him nowhere. That’s when he turned to Win-Spy, a free version of spy ware, to tap his boss’s computer.

“My motive was to document well known behavior that already existed.”

For seven months, at random times of the day, the software captured pictures of Dobbs’ computer screen. …

Here’s what he found. Blake says less than 10% of his boss’s computer time, documented by Win-Spy, was spent working. Twenty-percent was spent checking the stock market. And 70% of what the spy ware recorded was the game of Solitaire. …

But DOT didn’t see it that way. When Blake showed them what he found, he was fired. His supervisor got a letter of reprimand, stating “It was brought to the Department’s attention you spent a significant amount of time playing video games… but your work ethic and production are above reproach.” …

It’s worth noting after Blake lost his job, DOT had all computer games, including Solitaire, removed from its system.

Spy on no-good boss and lose your job Read More »

FBI used OnStar for surveillance

business, law, security, tech in changing society, technology / /

From Charles R. Smith’s “Big Brother on Board: OnStar Bugging Your Car“:

GM cars equipped with OnStar are supposed to be the leading edge of safety and technology. …

However, buried deep inside the OnStar system is a feature few suspected – the ability to eavesdrop on unsuspecting motorists.

The FBI found out about this passive listening feature and promptly served OnStar with a court order forcing the company to give it access. The court order the FBI gave OnStar was not something out of the Patriot Act involving international terrorism or national security but a simple criminal case.

According to court records, OnStar complied with the order but filed a protest lawsuit against the FBI.

Yet the FBI was able to enforce the original legal order and completed its surveillance because OnStar’s lawsuit took nearly two years to pass through the court system.

The 9th Circuit Court of Appeals recently ruled in OnStar’s favor. The ruling was not based on invasion-of-privacy grounds or some other legitimate constitutional basis. The FBI lost because the OnStar passive listening feature disables the emergency signal, the very life-saving call for help that the advertisements tout as the main reason to purchase the system. …

The technical problem of blocking the emergency signal is clearly one that the FBI tech teams can overcome. Thus, under the current ruling, the FBI can resume using OnStar to monitor subject vehicles once it has solved the emergency issue.

FBI used OnStar for surveillance Read More »

PATRIOT Act greatly expands what a ‘financial institution’ is

business, politics, security, tech in changing society / /

From Bruce Schneier’s “News” (Crypto-Gram Newsletter: 15 January 2004):

Last month Bush snuck into law one of the provisions of the failed PATRIOT ACT 2. The FBI can now obtain records from financial institutions without requiring permission from a judge. The institution can’t tell the target person that his records were taken by the FBI. And the term “financial institution” has been expanded to include insurance companies, travel agencies, real estate agents, stockbrokers, the U.S. Postal Service, jewelry stores, casinos, and car dealerships.

PATRIOT Act greatly expands what a ‘financial institution’ is Read More »

A new fraud: faking an entire company

business, security / /

From David Lague’s “Next step in pirating: Faking a company” (International Herald Tribune: 28 April 2006):

At first it seemed to be nothing more than a routine, if damaging, case of counterfeiting in a country where faking it has become an industry.

Reports filtering back to the Tokyo headquarters of the Japanese electronics giant NEC in mid-2004 alerted managers that pirated keyboards and recordable CD and DVD discs bearing the company’s brand were on sale in retail outlets in Beijing and Hong Kong.

Like hundreds, if not thousands, of manufacturers now locked in a war of attrition with intellectual property thieves in China, the company hired an investigator to track down the pirates.

After two years and thousands of hours of investigation in conjunction with law enforcement agencies in China, Taiwan and Japan, the company said it had uncovered something far more ambitious than clandestine workshops turning out inferior copies of NEC products. The pirates were faking the entire company.

Evidence seized in raids on 18 factories and warehouses in China and Taiwan over the past year showed that the counterfeiters had set up what amounted to a parallel NEC brand with links to a network of more than 50 electronics factories in China, Hong Kong and Taiwan.

In the name of NEC, the pirates copied NEC products, and went as far as developing their own range of consumer electronic products – everything from home entertainment centers to MP3 players. They also coordinated manufacturing and distribution, collecting all the proceeds.

The Japanese company even received complaints about products – which were of generally good quality – that they did not make or provide with warranties.

NEC said it was unable to estimate the total value of the pirated goods from these factories, but the company believed the organizers had “profited substantially” from the operation.

“These entities are part of a sophisticated ring, coordinated by two key entities based in Taiwan and Japan, which has attempted to completely assume the NEC brand,” said Fujio Okada, the NEC senior vice president and legal division general manager, in written answers to questions.

A new fraud: faking an entire company Read More »

Some surprising data isn’t encrypted in ATM transfers

business, security / /

From “Triple DES Upgrades May Introduce New ATM Vulnerabilities” (Payment News: 13 April 2006):

In a press release today, Redspin, an independent auditing firm based in Carpinteria, CA, suggests that the recent mandated upgrades of ATMs to support triple DES encryption of PINs has introduced new vulnerabilities into the ATM network environment – because of other changes that were typically made concurrently with the triple DES upgrades.

<begin press release>Redspin, Inc. has released a white paper detailing the problem. Essentially, unencrypted ATM transaction data is floating around bank networks, and bank managers are completely unaware of it. The only data from an ATM transaction that is encrypted is the PIN number.

“We were in the middle of an audit, looking at network traffic, when there it was, plain as day. We were surprised. The bank manager was surprised. Pretty much everyone we talk to is surprised. The card number, the expiration date, the account balances and withdrawal amounts, they all go across the networks in cleartext, which is exactly what it sounds like — text that anyone can read,” explained Abraham.

Ironically, the problem came about because of a mandated security improvement in ATMs. The original standard for ATM data encryption (DES) was becoming too easy to crack, so the standard was upgraded to Triple DES. Like any home improvement project, many ATM upgrades have snowballed to include a variety of other enhancements, including the use of transmission control protocol/Internet protocol (TCP/IP) — moving ATMs off their own dedicated lines, and on to the banks’ networks. …

A hacker tapping into a bank’s network would have complete access to every single ATM transaction going through the bank’s ATMs.<end press release>

Some surprising data isn’t encrypted in ATM transfers Read More »

It’s alright to fail at a startup when you’re young

business, tech in changing society, technology / /

From Paul Graham’s “Hiring is Obsolete” (May 2005):

The math is brutal. While perhaps 9 out of 10 startups fail, the one that succeeds will pay the founders more than 10 times what they would have made in an ordinary job. That’s the sense in which startups pay better “on average.”

Remember that. If you start a startup, you’ll probably fail. Most startups fail. It’s the nature of the business. But it’s not necessarily a mistake to try something that has a 90% chance of failing, if you can afford the risk. Failing at 40, when you have a family to support, could be serious. But if you fail at 22, so what? If you try to start a startup right out of college and it tanks, you’ll end up at 23 broke and a lot smarter. Which, if you think about it, is roughly what you hope to get from a graduate program.

It’s alright to fail at a startup when you’re young Read More »

Why big co’s are bad are creating new products

business, history, tech in changing society, technology / /

From Paul Graham’s “Hiring is Obsolete” (May 2005):

Buying startups also solves another problem afflicting big companies: they can’t do product development. Big companies are good at extracting the value from existing products, but bad at creating new ones.

Why? It’s worth studying this phenomenon in detail, because this is the raison d’etre of startups.

To start with, most big companies have some kind of turf to protect, and this tends to warp their development decisions. For example, Web-based applications are hot now, but within Microsoft there must be a lot of ambivalence about them, because the very idea of Web-based software threatens the desktop. So any Web-based application that Microsoft ends up with, will probably, like Hotmail, be something developed outside the company.

Another reason big companies are bad at developing new products is that the kind of people who do that tend not to have much power in big companies (unless they happen to be the CEO). Disruptive technologies are developed by disruptive people. And they either don’t work for the big company, or have been outmaneuvered by yes-men and have comparatively little influence.

Big companies also lose because they usually only build one of each thing. When you only have one Web browser, you can’t do anything really risky with it. If ten different startups design ten different Web browsers and you take the best, you’ll probably get something better.

The more general version of this problem is that there are too many new ideas for companies to explore them all. There might be 500 startups right now who think they’re making something Microsoft might buy. Even Microsoft probably couldn’t manage 500 development projects in-house.

Big companies also don’t pay people the right way. People developing a new product at a big company get paid roughly the same whether it succeeds or fails. People at a startup expect to get rich if the product succeeds, and get nothing if it fails. So naturally the people at the startup work a lot harder.

The mere bigness of big companies is an obstacle. In startups, developers are often forced to talk directly to users, whether they want to or not, because there is no one else to do sales and support. It’s painful doing sales, but you learn much more from trying to sell people something than reading what they said in focus groups.

And then of course, big companies are bad at product development because they’re bad at everything. Everything happens slower in big companies than small ones, and product development is something that has to happen fast, because you have to go through a lot of iterations to get something good.

Why big co’s are bad are creating new products Read More »

Jobs are unnecessary – just build something valuable

business, history, tech in changing society / /

From Paul Graham’s “Hiring is Obsolete” (May 2005):

I think most undergrads don’t realize yet that the economic cage is open. A lot have been told by their parents that the route to success is to get a good job. This was true when their parents were in college, but it’s less true now. The route to success is to build something valuable, and you don’t have to be working for an existing company to do that. Indeed, you can often do it better if you’re not.

Jobs are unnecessary – just build something valuable Read More »