Bruce Schneier on what we should do

security, tech in changing society / /

From Bruce Schneier’s “Searching Bags in Subways“:

Final note: I often get comments along the lines of “Stop criticizing stuff; tell us what we should do.” My answer is always the same. Counterterrorism is most effective when it doesn’t make arbitrary assumptions about the terrorists’ plans. Stop searching bags on the subways, and spend the money on 1) intelligence and investigation — stopping the terrorists regardless of what their plans are, and 2) emergency response — lessening the impact of a terrorist attack, regardless of what the plans are. Countermeasures that defend against particular targets, or assume particular tactics, or cause the terrorists to make insignificant modifications in their plans, or that surveil the entire population looking for the few terrorists, are largely not worth it.

Bruce Schneier on what we should do Read More »

Religion & evolution

religion, science / /

From Salon’s “Religious belief itself is an adaptation“, an interview with Edward O. Wilson:

Religious belief itself is an adaptation that has evolved because we’re hard-wired to form tribalistic religions. Religion is intensely tribalistic. A devout Christian or Muslim doesn’t say one religion is as good as another. It gives them faith in the particular group to which they belong and that set of beliefs and moral views. …

You cannot explain the patterns of diversity in the world, the geography of life, the endless details of distribution, similarity and dissimilarity in the world, by any means except evolution. That’s the one theory that ties it together. It is very hard to see how traditionalist religious views will come to explain the meaning of life on this planet. …

Religion & evolution Read More »

Phishing by altering the bank’s server

business, security / /

From Computerworld‘s “Florida banks hacked in new spoofing attack“:

Three Florida banks have had their Web sites compromised by hackers in an attack that security experts are calling the first of its type.

Earlier this month, attackers were able to hack servers run by the Internet service provider that hosted the three banks’ Web sites. They then redirected traffic from the legitimate Web sites to a bogus server, designed to resemble the banking sites, according to Bob Breeden, special agent supervisor with the Florida Department of Law Enforcement’s Computer Crime Center.

Users were then asked to enter credit card numbers, PINs and other types of sensitive information, he said.

According to Breeden, the affected banks are Premier Bank, Wakulla Bank and Capital City Bank, all small, regional banks based in Florida.

This attack was similar to phishing attacks that are commonly used against online commerce sites, but in this case hackers had actually made changes to legitimate Web sites, making the scam much harder for regular users to detect.

… Though Breeden said the scam was operational for only “a matter of hours” and probably affected fewer than 20 banking customers, the technique appeared to be very effective at extracting sensitive information.

Phishing by altering the bank’s server Read More »

Architecture & the quality without a name

commonplace book, on writing / /

From Brian Hayes’ “The Post-OOP Paradigm“:

Christopher Alexander [a bricks-and-steel architect] is known for the enigmatic thesis that well-designed buildings and towns must have “the quality without a name.” He explains: “The fact that this quality cannot be named does not mean that it is vague or imprecise. It is impossible to name because it is unerringly precise.”

Architecture & the quality without a name Read More »

A very brief history of programming

history, technology / /

From Brian Hayes’ “The Post-OOP Paradigm“:

The architects of the earliest computer systems gave little thought to software. (The very word was still a decade in the future.) Building the machine itself was the serious intellectual challenge; converting mathematical formulas into program statements looked like a routine clerical task. The awful truth came out soon enough. Maurice V. Wilkes, who wrote what may have been the first working computer program, had his personal epiphany in 1949, when “the realization came over me with full force that a good part of the remainder of my life was going to be spent in finding errors in my own programs.” Half a century later, we’re still debugging.

The very first programs were written in pure binary notation: Both data and instructions had to be encoded in long, featureless strings of 1s and 0s. Moreover, it was up to the programmer to keep track of where everything was stored in the machine’s memory. Before you could call a subroutine, you had to calculate its address.

The technology that lifted these burdens from the programmer was assembly language, in which raw binary codes were replaced by symbols such as load, store, add, sub. The symbols were translated into binary by a program called an assembler, which also calculated addresses. This was the first of many instances in which the computer was recruited to help with its own programming.

Assembly language was a crucial early advance, but still the programmer had to keep in mind all the minutiae in the instruction set of a specific computer. Evaluating a short mathematical expression such as x 2+y 2 might require dozens of assembly-language instructions. Higher-level languages freed the programmer to think in terms of variables and equations rather than registers and addresses. In Fortran, for example, x 2+y 2 would be written simply as X**2+Y**2. Expressions of this kind are translated into binary form by a program called a compiler.

… By the 1960s large software projects were notorious for being late, overbudget and buggy; soon came the appalling news that the cost of software was overtaking that of hardware. Frederick P. Brooks, Jr., who managed the OS/360 software program at IBM, called large-system programming a “tar pit” and remarked, “Everyone seems to have been surprised by the stickiness of the problem.”

One response to this crisis was structured programming, a reform movement whose manifesto was Edsger W. Dijkstra’s brief letter to the editor titled “Go to statement considered harmful.” Structured programs were to be built out of subunits that have a single entrance point and a single exit (eschewing the goto command, which allows jumps into or out of the middle of a routine). Three such constructs were recommended: sequencing (do A, then B, then C), alternation (either do A or do B) and iteration (repeat A until some condition is satisfied). Corrado Böhm and Giuseppe Jacopini proved that these three idioms are sufficient to express essentially all programs.

Structured programming came packaged with a number of related principles and imperatives. Top-down design and stepwise refinement urged the programmer to set forth the broad outlines of a procedure first and only later fill in the details. Modularity called for self-contained units with simple interfaces between them. Encapsulation, or data hiding, required that the internal workings of a module be kept private, so that later changes to the module would not affect other areas of the program. All of these ideas have proved their worth and remain a part of software practice today. But they did not rescue programmers from the tar pit.

…

Object-oriented programming addresses these issues by packing both data and procedures—both nouns and verbs—into a single object. An object named triangle would have inside it some data structure representing a three-sided shape, but it would also include the procedures (called methods in this context) for acting on the data. To rotate a triangle, you send a message to the triangle object, telling it to rotate itself. Sending and receiving messages is the only way objects communicate with one another; outsiders are not allowed direct access to the data. Because only the object’s own methods know about the internal data structures, it’s easier to keep them in sync.

You define the class triangle just once; individual triangles are created as instances of the class. A mechanism called inheritance takes this idea a step further. You might define a more-general class polygon, which would have triangle as a subclass, along with other subclasses such as quadrilateral, pentagon and hexagon. Some methods would be common to all polygons; one example is the calculation of perimeter, which can be done by adding the lengths of the sides, no matter how many sides there are. If you define the method calculate-perimeter in the class polygon, all the subclasses inherit this code.

A very brief history of programming Read More »

Bertrand Russell on writing well

on writing, science / /

From Bertrand Russell’s “How I Write“:

Until I was twenty-one, I wished to write more or less in the style of John Stuart Mill. … I had, however, already a different ideal, derived, I suppose, from mathematics. I wished to say everything in the smallest number of words in which it could be said clearly. … I would spend hours trying to find the shortest way of saying something without ambiguity, and to this aim I was willing to sacrifice all attempts at aesthetic excellence.

At the age of twenty-one, however, I came under a new influence that of my future brother-in-law, Logan Pearsall Smith. He was at that time exclusively interested in style as opposed to matter. His gods were Flaubert and Walter Pater, and I was quite ready to believe that the way to learn how to write was to copy their technique. He gave me various simple rules, of which 1 remember only two: “Put a comma every four words”, and “never use ‘and’ except at the beginning of a sentence”. His most emphatic advice was that one must always re-write. I conscientiously tried this, but found that my first draft was almost always better than my second. This discovery has saved me an immense amount of time. I do not, of course, apply it to the substance, but only to the form. When I discover an error of an important kind I re-write the whole. What I do not find is that I can improve a sentence when I am satisfied with what it means.

… In fact, all imitation is dangerous. Nothing could be better in style than the Prayer Book and the Authorized Version of the Bible, but they express a way of thinking and feeling which is different from that of our time. A style is not good unless it is an intimate and almost involuntary expression of the personality of the writer, and then only if the writer’s personality is worth expressing. But although direct imitation is always to be deprecated, there is much to be gained by familiarity with good prose, especially in cultivating a sense for prose rhythm.

There are some simple maxims-not perhaps quite so simple as those which my brother-in-law Logan Pearsall Smith offered me-which I think might be commanded to writers of expository prose. First: never use a long word if a short word will do. Second: if you want to make a statement with a great many qualifications, put some of the qualifications in separate sentences. Third: do not let the beginning of your sentence lead the reader to an expectation which is contradicted by the end.

Bertrand Russell on writing well Read More »

Free markets need visibility to work

business, technology / /

From Slashdot’s “Pay-per-email and the ‘Market Myth’“:

But I think there’s a bigger problem underlying all of this. It’s not about specific problems with GoodMail’s or AOL’s or Hotmail’s system. The problem is that many advocates of these systems say that any flaws will get sorted out automatically by “the market” — and in this case I think that is simply wrong. And in fact the people on Thursday’s panel can’t really believe it either, because one thing we all agreed on was that Bonded Sender sucks. But has the marketplace punished Hotmail for using it? Have people left in droves because non-Bonded-Sender e-mail gets blocked? No, because if they never see it getting blocked they don’t know what happens. Free markets only solve problems that are actually visible to the user.

Free markets need visibility to work Read More »

How much does stolen identity info cost?

business, security / /

From The New York Times‘ “Countless Dens of Uncatchable Thieves“:

In the online world, he operates under the pseudonym Zo0mer, according to American investigators, and he smugly hawks all manner of stolen consumer information alongside dozens of other peddlers at a Web site he helps manage.

“My prices are lowers then most of other vendors have and I will deliver them in real time,” reads a typically fractured Zo0mer post.

At the same forum, another user, “tabbot,” offers “any U.S. bank accounts” for sale.

“Balance from 3K and above: $40,” he writes. “Regular brokerage accounts from 3K and above: $70.”

Tabbot also offers full access to hacked accounts from credit unions. One, with a $31,000 balance, is being sold for $400. “I can try search specific info such as signature, ssn, dob, email access,” tabbot writes. “Account with an extra info will be more expensive.”

How much does stolen identity info cost? Read More »

Some thoughts on strong & weak social ties

commonplace book, social software, tech in changing society / /

From Ross Mayfield’s “The Weakening of Strong Ties“:

Mark Granovetter’s seminal paper, The Strength of Weak Ties (summary), revealed the difference between friends and acquaintances and how useful acquaintances can be for certain tasks like finding a job. The difference between a strong tie and weak tie can generally be revealed by time commitment underpinning the relationship. Strong ties are better for action, weak ties for new information.

But time has changed with new tools and social networking models at our disposal. For the first time many social networks are being made explicit, often without the knowledge of participants, at an accelerating pace and dramatically lowered search costs. This newfound transparency may very well make strong ties weaker. …

Top-down models, or weak tie systems, are particularly good at the breadth of sample and search. …

That said, weak tie systems provide real insight we didn’t have before. They have vast potential for revealing structural holes and other methods of enhancing social capital. So long as participation is voluntary, information flows monitored is public and constraints keep in check how people act upon intelligence these systems will become a critical competitive advantage for any company.

By contrast, bottom-up systems are built for people instead of companies. Within Friendster, Ryze, Tribe.net and LinkedIn connections are made through individual decisions upon of invitations, requests and confirmations. The network grows organically, decision by voluntary decision.

Some thoughts on strong & weak social ties Read More »

Why we don’t have rights from the ground to the sky

business, commonplace book, history / /

From Salon’s “Throwing Google at the book“:

Lawrence Lessig, a Stanford law professor and copyright scholar, likes to tell the story of Thomas Lee and Tinie Causby, two North Carolina farmers, who in 1945 cast themselves at the center of a case that would redefine how society thought of physical property rights. The immediate cause of the Causbys’ discomfort was the airplane; military aircraft would fly low over their land, terrifying their chickens, who flew to their death into the walls of the barn. As the Causbys saw it, the military aircraft were trespassing on their land. They claimed that American law held that property rights reached ‘an indefinite extent, upwards’; that is, they owned the land from the ground to the heavens. If the government wanted to fly planes over the Causbys’ land, it needed the Causby’s permission, they insisted.

The case, in time, came to the Supreme Court, where Justice William O. Douglas, writing for the Court, was not kind to the Causbys’ ancient interpretation of the law. Their doctrine, he said, “has no place in the modern world. The air is a public highway, as Congress has declared. Were that not true, every transcontinental flight would subject the operator to countless trespass suits. Common sense revolts at the idea. To recognize such private claims to the airspace would clog these highways, seriously interfere with their control and development in the public interest, and transfer into private ownership that to which only the public has a just claim.”

… the airplane rendered the Causbys’ rights to the skies incompatible with the modern world …

Why we don’t have rights from the ground to the sky Read More »

Identity production & sharing during adolescence

social software / /

From danah boyd’s “Friendster lost steam. Is MySpace just a fad?“:

No, it is not just a moral panic that could make MySpace a fad. The primary value right now has to do with identity production and sharing, practices that are more critical to certain populations at certain times in their lives and it is possible that “growing up” will be marked by leaving MySpace (both for the teens and the 20-somethings).

Identity production & sharing during adolescence Read More »

Social capital: subcultural vs cultural

commonplace book, social software / /

From danah boyd’s “Friendster lost steam. Is MySpace just a fad?“:

What’s at stake here is what is called “subcultural capital” by academics. It is the kind of capital that anyone can get, if you are cool enough to know that it exists and cool enough to participate. It is a counterpart to “cultural capital” which is more like hegemonic capital. That was probably a bit too obscure. Let me give an example. Opera attendance is a form of cultural capital – you are seen as having money and class and even if you think that elongated singing in foreign languages is boring, you attend because that’s what cultured people do. You need the expensive clothes, the language, the body postures, the social connects and the manners to belong. Limitations are economic and social. Rave attendance is the opposite. Anyone can get in, in theory… There are certainly hodgepodged clothes, street language and dance moves, but most folks can blend in with just a little effort. Yet, the major limitation is knowing that the rave exists. “Being in the know” is more powerful than money. You can’t buy your way into knowledge of a rave.

“Coolness” is about structural barriers, about the lack of universal accessibility or parsability. Structural hurdles mean people put in more effort to participate. It’s kinda like the adventure of tracking down the right parking lot to get the bus to go to the rave. The effort matters. Sure, it weeds some people out, but it makes those who participate feel all the more validated. Finding the easter egg, the cool little feature that no one knows about is exciting. Learning all of the nooks and crannies in a complex system is exhilarating. Figuring out how to hack things, having the “inside knowledge” is fabu.

Often, people don’t need simplicity – they want to feel proud of themselves for figuring something out; they want to feel the joy of exploration. This is the difference between tasks that people are required to do and social life. Social life isn’t about the easy way to do something – it’s about making meaning out of practice, about finding your own way.

Social capital: subcultural vs cultural Read More »

Intel: anyone can challenge anyone

business, technology / /

From FORTUNE’s “Lessons in Leadership: The Education of Andy Grove“:

[Intel CEO Andy] Grove had never been one to rely on others’ interpretations of reality. … At Intel he fostered a culture in which “knowledge power” would trump “position power.” Anyone could challenge anyone else’s idea, so long as it was about the idea and not the person–and so long as you were ready for the demand “Prove it.” That required data. Without data, an idea was only a story–a representation of reality and thus subject to distortion.

Intel: anyone can challenge anyone Read More »

Intel’s ups and downs

business, technology / /

From FORTUNE’s “Lessons in Leadership: The Education of Andy Grove“:

By 1983, when Grove distilled much of his thinking in his book High Output Management (still a worthwhile read), he was president of a fast-growing $1.1-billion-a-year corporation, a leading maker of memory chips, whose CEO was Gordon Moore. … What Moore’s Law did not and could not predict was that Japanese firms, too, might master this process and turn memory chips into a commodity. …

Intel kept denying the cliff ahead until its profits went over the edge, plummeting from $198 million in 1984 to less than $2 million in 1985. It was in the middle of this crisis, when many managers would have obsessed about specifics, that Grove stepped outside himself. He and Moore had been agonizing over their dilemma for weeks, he recounts in Only the Paranoid Survive, when something happened: “I looked out the window at the Ferris wheel of the Great America amusement park revolving in the distance when I turned back to Gordon, and I asked, ‘If we got kicked out and the board brought in a new CEO, what do you think he would do?’ Gordon answered without hesitation, ‘He would get us out of memories.’ I stared at him, numb, then said, ‘Why shouldn’t you and I walk out the door, come back, and do it ourselves?'”

… once IBM chose Intel’s microprocessor to be the chip at the heart of its PCs, demand began to explode. Even so, the shift from memory chips was brutally hard–in 1986, Intel fired some 8,000 people and lost more than $180 million on $1.3 billion in sales–the only loss the company has ever posted since its early days as a startup.

Intel’s ups and downs Read More »

Zombie ships adrift off the shore of Africa

business, weird, writing ideas / /

From “Happiness: The Chinese zombie ships of West Africa“:

We’re in the big African Queen inflatable, cruising alongside an anchored trawler. It’s more rust than metal – the ship is rotting away. The foredeck is covered in broken machinery. The fish deck is littered with frayed cables, and the mast lies horizontally, hanging over the starboard side. A large rusty Chinese character hangs on railings above the bridge, facing forward. It reads ‘happiness’. …

Moff turns the boat, taking us to another of the rusting fishing vessels, 70 nautical miles (130km) off the coast of Guinea, West Africa. We had been told this was where old pirate fishing boats were left at anchor, abandoned. We didn’t expect to find living people on board the dying ships. …

We head away, going with the current, which was purple and green with the dregs of spilled fuel. Throughout the afternoon, I keep noticing just how dirty the water is, with oil and fragments of plastic.

We arrive at Long way 08, which is in line for refuelling. This trawler is in a poor state, with the hull covered in masses of good-sized shellfish.

Four young Chinese crewman meet us with smiles and welcomes. They tell us that some of them have been on board for 2 years, non-stop. The trawler itself has been out here for eight years, and would probably be kept going for another six or so, or as long it lasted.

Here’s the thing – these ships seldom, or ever, visit a port. They’re re-supplied, refuelled, re-crewed and transhipped (unloaded) at sea. The owners and crews don’t seem to do any basic maintenance, apart from keeping the engine and winches running. There’s no glass in the portholes, and the masts are a mess of useless wiring. These floating deathtraps don’t carry any proper safety gear – on one boat, I saw the half-barrel case of an inflatable liferaft being used to store a net. …

We move to the second ship, where again, a bunch of friendly young guys have been sitting at anchor for two months, waiting technical help and a new crew. Their engine doesn’t work, and they no safety gear or radio. They can, however, run their watermaker, for desalinating seawater. Lines of drying fish hang over the deck, but they’re running out of other food, and are often forced to signal other fishing boats for help. Like everyone else, their future is uncertain. …

… we talk to the chirpy Guinean fisheries observer on their vessel. He’s very chatty, and tells us what is going on – that the other trawler was basically being dumped here. He says that the Chinese boats were in poor shape generally, and that last year, one had sunk, taking 14 crew with it. What are conditions like on this boat? He shrugs: “Not good. But I have to have a job.” …

Later, as we drop some supplies to the engine-less trawler, we see one of the crew hauling himself along on a rope, while standing on a small raft. It’s bizarre sight, but this is how they get between the two decrepit vessels. …

Earlier in the day – before the graveyard of zombie trawlers, fisheries inspectors had told us of where the fish actually goes. Caught by the Chinese and other trawlers, it’s transhipped to several different vessels. ‘High value’ stock goes to Las Palmas, in the Canaries and off to the dinner tables of Europe. The ‘dirt’ fish is transhipped to Africa. The Chinese fishermen, it seems, barely get a look in. ‘Happiness’ indeed.

Zombie ships adrift off the shore of Africa Read More »

Trusted Computing: security for whom? from whom?

security / /

From Bruce Schneier’s “Trusted Computing Best Practices“:

The language [in the Trusted Computing Group’s best practices document] has too much wiggle room for companies to break interoperability under the guise of security: “Furthermore, implementations and deployments of TCG specifications should not introduce any new interoperability obstacles that are not for the purpose of security.”

That sounds good, but what does “security” mean in that context? Security of the user against malicious code? Security of big media against people copying music and videos? Security of software vendors against competition? The big problem with TCG [Trusted Computing Group] technology is that it can be used to further all three of these “security” goals, and this document is where “security” should be better defined.

Trusted Computing: security for whom? from whom? Read More »

Thieves use Bluetooth to find laptops in cars

security / /

From “Phone pirates in seek and steal mission“:

MOBILE phone technology is being used by thieves to seek out and steal laptops locked in cars in Cambridgeshire.

Up-to-date mobiles often have Bluetooth technology, which allows other compatible devices, including laptops, to link up and exchange information, and log on to the internet.

But thieves in Cambridge have cottoned on to an alternative use for the function, using it as a scanner which will let them know if another Bluetooth device is locked in a car boot.

Det Sgt Al Funge, from Cambridge’s crime investigation unit, said: “There have been a number of instances of this new technology being used to identify cars which have valuable electronics, including laptops, inside.

Thieves use Bluetooth to find laptops in cars Read More »

Hear someone typing & know what was written

security, writing ideas / /

From Edward Felten’s “Acoustic Snooping on Typed Information“:

Li Zhuang, Feng Zhou, and Doug Tygar have an interesting new paper showing that if you have an audio recording of somebody typing on an ordinary computer keyboard for fifteen minutes or so, you can figure out everything they typed. The idea is that different keys tend to make slightly different sounds, and although you don’t know in advance which keys make which sounds, you can use machine learning to figure that out, assuming that the person is mostly typing English text. (Presumably it would work for other languages too.) …

The algorithm works in three basic stages. First, it isolates the sound of each individual keystroke. Second, it takes all of the recorded keystrokes and puts them into about fifty categories, where the keystrokes within each category sound very similar. Third, it uses fancy machine learning methods to recover the sequence of characters typed, under the assumption that the sequence has the statistical characteristics of English text. …

The only advantage you have is that English text has persistent regularities. For example, the two-letter sequence “th” is much more common that “rq”, and the word “the” is much more common than “xprld”. This turns out to be enough for modern machine learning methods to do the job, despite the difficulties I described in the previous paragraph. The recovered text gets about 95% of the characters right, and about 90% of the words. It’s quite readable.

Hear someone typing & know what was written Read More »

Tracking terrorists with Unintended Information Revelation

security, writing ideas / /

From “New search engine to help thwart terrorists“:

With news that the London bombers were British citizens, radicalised on the streets of England and with squeaky-clean police records, comes the realisation that new mechanisms for hunting terrorists before they strike must be developed.

Researchers at the University of Buffalo, US, believe they have discovered a technique that will reveal information on public web sites that was not intended to be published.

The United States Federal Aviation Administration (FAA) and the National Science Foundation (NSF) are supporting the development of a new search engine based on Unintended Information Revelation (UIR), and designed for anti-terrorism applications.

UIR supposes that snippets of information – that by themselves appear to be innocent – may be linked together to reveal highly sensitive data.

… “A concept chain graph will show you what’s common between two seemingly unconnected things,” said Srihari. “With regular searches, the input is a set of key words, the search produces a ranked list of documents, any one of which could satisfy the query.

“UIR, on the other hand, is a composite query, not a keyword query. It is designed to find the best path, the best chain of associations between two or more ideas. It returns to you an evidence trail that says, ‘This is how these pieces are connected.'”

Tracking terrorists with Unintended Information Revelation Read More »

Unpatched Linux, 3 months; unpatched Windows, 20 minutes

security / /

From Bruce Schneier’s “Linux Security“:

I’m a big fan of the Honeynet Project … Basically, they wire computers up with sensors, put them on the Internet, and watch hackers attack them.

They just released a report about the security of Linux:

Recent data from our honeynet sensor grid reveals that the average life expectancy to compromise for an unpatched Linux system has increased from 72 hours to 3 months. …

This is much greater than that of Windows systems, which have average life expectancies on the order of a few minutes.

… That’s the real story: the hackers aren’t bothering with Linux. Two years ago, a vulnerable Linux system would be hacked in less than three days; now it takes three months.

Why? My guess is a combination of two reasons. One, Linux is that much more secure than Windows. Two, the bad guys are focusing on Windows — more bang for the buck.

Unpatched Linux, 3 months; unpatched Windows, 20 minutes Read More »