I'm raising a nerd

It's unseasonably warm here in IndiUcky, so we decided to have dinner in the back yard tonight as a picnic.  Boo enjoyed being able to play outside a little later than usual, and of course, he brought along the lightsaber Irish Woman bought him when she went on the road last month.

Here is the budding padwan, complete with his trusty sidearm:

Keeping the back yard safe for picnics and sand boxes

 And of course, no time with Boo would be complete without being told to hush so that he could talk.

Hush Dad.  I can't hear you over how awesome I am anyway.

He spent the evening trying to bat the lazy bumblebees that were buzzing around the blossoms on the cherry and peach trees with the lightsaber, but thankfully, he never connected.  He's currently tucked safely in bed with his sword, Hasenpfeffer the Rabbit, and a book.

Update - Upon closer examination of these pictures, it appears that we never wash the young man's face.  Fear not, for that is just the residue from a grape popsicle he enjoyed after dinner.

Quote of the Day

Don't be too proud of this technological terror you've created.  The ability to hang doo-dads on the end of a carbine is nothing compared to the power of the Mosin. -- Darth Vladimir, Dark Lord of Izhevsk and amateur chiropractor

Privacy? What's that?

A recent appeals court ruling allows police to gather data from a cell phone without getting a warrant.  The case in question had police finding three cell phones during a drug arrest, turning them on, and recording the phone numbers so that call records for those numbers could be obtained.  The judge seems to draw a fuzzy line between getting this kind of information and searching for calling, browsing, and email information without a warrant.  There's some point where the police would go too far, but he doesn't seem to make that point very clear.

If you're carrying a cell phone, especially a smart phone, then you are carrying around a device that holds a highly concentrated dose of your private information. Who you email, text or call, what pages you surf to, and any searches on the GPS are all there for anyone to see who can get to it.  And if this decision is affirmed by higher courts, it means that the police can take basic information from your phone, use that to find other information, then possibly use that information to get a warrant in order to go further into the phone.

I'd be interested to see what putting a hard-to-guess passcode on your phone would do.  My iPhone doesn't give its phone number unless its unlocked, and of course you can't get to the higher functions of the phone while it's locked.  Recent court rulings hold that a defendant can be compelled to decrypt a hard drive, so I'm guessing that a defendant could be compelled to unlock a phone or face additional charges of contempt.

In the same vein, using any application that would wipe a phone remotely could be construed as destroying evidence, dragging whoever runs it into your trouble even deeper than they may already be.  All the authorities have to do is compel your cell provider or phone vendor to show records of access to your account.

And remember, the authorities are much less likely to get hold of your phone than Sumdood is.  Getting your contacts, personal information, passwords, and banking information would certainly make his day.  Safeguarding your data against him and his ilk is at least as important as keeping it safe from Officer RoidRage.

 So what can we do?

The only thing I can think of is to lock your phone and get a lawyer.  I'm sure there are a lot more things you can do, and a lot of shades of gray in all of these.  To be honest, I still believe that a majority of police aren't out to mess with the populace in general, but there's always that one guy.   Taking a few steps before there's a problem can mean that you control when the information on your phone becomes available to the police, and you can do it under advice of counsel.

I Blame Qui-Gon

This afternoon, Girlie Bear and I decided to do something out of the ordinary and went to the movies.  George Lucas recently re-released The Phantom Menace, the first episode in his six episode Star Wars saga and the fourth movie released in that series.  The movie has been re-done in 3D, which was OK, and as usual, a Lucas movie does really well in special effects and does OK in acting, dialogue, and story.

Of course, being a geek, I've seen it before, so the story wasn't exactly a surprise.  Lucas did a lot of the scenes, even ones that do nothing but plot exposition, in 3D, which was interesting.  Watching the scenes where tanks and droid soldiers march down the main street, complete with arch and the victory parade at the end tells me that Lucas has watched Triumph of the Will and movies from Paris in 1940 more than a few times.  So in addition to robbing Kurosawa blind, he also owes Leni Riefenstahl a beer.

But that's not what struck me as the credits rolled.

What hit me was that all of the turmoil of the remaining five movies was the fault of one character.  No, not Palpatine, the Naboo Senator, Republic Chancellor, Emperor of the Galaxy, Sith Lord, and collector of authentic Wookie and Ewok teddy bears.

No, all of it was brought about by Qui-Gon Jin.

Qui-Gon is the master Jedi Knight who is teaching Obi-Wan Kenobi to be a Jedi when the movie begins.  He and Obi-Wan are sent on a mission to 'convince' one faction in a trade dispute to stop leaning on another faction.  By convince, I mean 'show up wearing light sabers and force them to back down'.  You know, the same way that Vito Corleone and Luca Brazi got Johnny Fontaine that movie gig.  He fails when the people he was there to put the arm on tried to kill them both, launch a planetary invasion, and arrest/compost most of the opposing side in the dispute.  He convinces the leader of the losing side, Queen Amidala, to flee from the scene, lands on Tattooine to find parts, makes off with a slave he thinks might be the Jedi messiah, and deposits both of them on Coruscant, the Republic capital.  He picks a fight with the Jedi Council when they tell him that teaching the force to an emotionally unstable former slave is probably not the wisest thing to do.  He gives them the rhetorical finger and is sent back to Naboo with a ragtag band of people wearing red shirts.  On arrival, he follows the battle plan of a teenage girl, fights an evil Sith that looks like he was born out of a Larry Correia fever dream, and loses because his devoted Padwan was never good at wind sprints.  Obi-wan then goes on to finish the job by turning Darth Maul from an innie into an outie, saving the day. Obi-Wan makes a promise to Qui-Gon to teach Anakin Skywalker all of the skills he will need to bring down a democratic regime and murder just about everyone Obi-Wan and Qui-Gon know.

In all of those little plot points, all of the mistakes are made by Qui-Gon, and if he had zigged instead of zagged on any of them, Palpatine would have gone down as being the most affable evil Chancellor the Republic ever had, Anakin Skywalker would be the Jeff Gordon of the podracer circuit, and Amidala wouldn't have passed on the "worst hair styles in a quarter century" gene to her daughter.

Here are the biggest mistakes he made, in your hosts humble opinion:

1. Didn't leave JarJar to get turned into cat meat.  When Qui-Gon and Obi-Wan trick the Gungun boss to let them go and give them transport so they could get to the Naboo capitol, Qui-Gon also asks that JarJar Binks be released to them.  It was done almost as an after thought.  If Qui-Gon hadn't done that, JarJar wouldn't have been there in the next movie to hand Palpatine dictatorial powers on a silver platter with a side of fries.  We would also have been spared two more movies worth of a bad Caribbean accent.
2. Left Naboo with no air cover.  After freeing Queen Amidala and her entourage from the droid soldiers, they all decide to run like scalded dogs back to Coruscant.  In order to get to the Queen's ship, which apparently was kept ready to go with her wardrobe and hair goop, they have to defeat the droids guarding the hangar.  These droids are also guarding the pilots for the fighters that are housed there, because when you're decapitating a government, the last thing you want to do is massacre their elite pilots immediately.  After quickly dispatching the droids, the pilots are told to run, and they do.  Heaven forfend that they be inspired to jump in the cockpit and defend their queen as she runs to get help.  So the ship containing the soon-to-be government in exile takes off with no fighter escort.  This probably led directly to the ship being damaged, which necessitates the next stop in their journey:  Tattoine.  This is the home planet of everyone's favorite Sith Lord in waiting, Anakin Skywalker.
3. Going through an elaborate scheme to get parts to fix the ship.  Following the Star Wars tradition of using hyperdrive engines made out of paper mache and Coke bottles, our ragtag band of Jedi knights, queens with weird clothes and hair, and amphibious Rastafarians touch down on Tattoine to get parts and make repairs.  Qui-Gon goes into town to find parts, where he meets Anakin and discovers that only one junk dealer has the necessary gear, or at least that's what the junk man says.  Qui-Gon doesn't seem to check with the competition to see if he might be telling a little fib in order to get the rube in the brown coat to make a purchase.  The junk man won't take the money they bring with them, and Jedi mind tricks don't work.  Apparently Qui-Gon isn't comfortable using the tactics he would have used on the Trade Federation on this slave-owning cheat of a junk dealer, so he has to find a less direct way of bilking the parts out of him.  He comes up with a convoluted plan to put a 9 year old into a dangerous podrace and cheat the junk dealer out of not only the parts, but also his slave.  I mean, it's not like he could have just whipped out that light saber and started singing off wings to get the parts or anything.  He could have gone to another junk dealer who would have taken his Republic money or fallen for Jedi mind tricks to buy the parts or make a three cornered deal for them with the first guy.  Or he could have just sold the broken ship for whatever he could get and arranged transport on another ship.  Or heck, just offered to trade R2D2, a valuable repair droid he had brought along with him on this run to Starship Depot, for the parts.  That would have gotten him back to Coruscant quicker, spared the galaxy the scourge of Darth Vader, and saved us from all of those "why did the Empire make all of the power receptacles the same size and shape as the USB ports?" jokes.
4. Taking Anakin with him to Coruscant.  After winning the parts from the junk dealer, Qui-Gon cheats him out of Anakin's freedom.  He could have left him there to work as a tradesman or podracer long enough to buy his mother's freedom.  That way he could have felt better about saving one slave out of the scores that must have existed on Tattooine, and we'd have been spared Hayden Christensen in the next two films.  Instead he thinks that he can make a 9 year old former slave with separation anxiety into an elite mystical warrior that will enforce the will of a democratically elected government that didn't give enough of a damn about his plight as a slave to detail someone to free him and the rest of the human chattel on Tattooine.  The word you're looking for here is 'hubris', which is pretty much the reason the rest of the series had a plot line.

It goes on from there.  If he had failed to do any of these things, all of the unpleasantness in the remainder of the series wouldn't have happened.  No Sith takeover, no massacre of the Jedi, no clone troopers, no Rebellion, no Death Stars, nothing.  

So in the end, I have come to believe that the villain of the entire six movie series was not Palpatine.  He at least was honestly evil.  Qui-Gon was a so-called good guy enforcer who brought down a millennium old Republic because he was "just trying to do the right thing".  Kind of like someone taking money from hard working citizens to give to those who don't feel that work is really that necessary, or a politician that would try to tax his way out of fiscal armageddon.  But then again, those last two might be too out of left field for anyone to believe.  Faster than light ships, laser swords, and sentient robots that are used and abused as slaves but don't rise up and slaughter their former masters are more believable than that. 

How I got Boo ready for his nap

When Girlie Bear and Little Bear were about Boo's age, I bought them each a collapsible plastic lightsaber.  Yeah, it's sometimes cool to have a dad who's a geek.  The kids enjoyed beating on each other and me, and when they moved on to other toys, I put them up.  I stumbled across them in a closet this morning, and gave them to Boo.  He hasn't put down his lightsaber since.  My hands and arms are a bit sore from being hit and swinging a lightsaber all morning, but it's a good sore.

He's currently all tuckered out after an extended post-lunch lightsaber duel.  It went kind of like this:

Of course, it looked more like the end of the movie than the beginning, but I never claimed to be agile.  I'm looking to a quiet afternoon as he sleeps it off and recharges his batteries.

Geek Christmas Carols

Yeah, I'm finally in the mood.  Not the Christmas mood, just a mood.



Jingle bells, UNIX smells
Windows laid an egg
The mainframe it just vapor locked
But the VAX is A-OK!

---

I'm dreaming of a white laptop
Just like Jobs used to sell
With a one button mouse
It costs as much as a house
But it goes with black turtlenecks so well!

---

The users called me
The network is down
They can't surf their pr0n
The network is down
The tech is on his way
The network is down
Email jokes can't be sent!
The network is down
Network is down
Network is down

---

Silent NOC
Happy NOC
No alerts
No drama
Reading a novel
And eating take-out
Hoping my shift
is quiet no doubt
Keep my board clea--ar
Ke-ep my board so clear

---

Just see those servers crashing
And hard drives thrashing
Oh joy!
This is a great profession
for someone with a pain obsession
Oh boy!

Today in Geek History

On this date in 1987, Larry Wall released Perl to a newsgroup.  For you non-geeks, this is the equivelant of celebrating the day that someone first demonstrated super glue to the masses.

Perl is one of my favorites.  Honestly, I learned to script in Perl before I learned shell scripting in sh or ksh.  My first tech job in the Army was big on Perl, so I learned Perl as I was learning to be a SysAd.

Perl is a bit of a jack of all trades scripting language, being good at a lot of things, but not as good at most of them as languages that are specialized.  For example, a lot of Internet code used to be written in Perl, but most now is written in PHP or some other language that is specific to the web.

I get the feeling that I'll still be using Perl in one form or another for a long time.

Christmas Geekery

For those of you who speak in geek, here are a couple Christmas time goodies for you:

The Perl Advent Calendar

The SysAd Advent Calendar

Just trying to warm the souls of the greasy mechanics of the information age.  Nothing says "Merry Christmas!" like a little perl spiced with a bit of OS tinkering.

Thoughts on Wizard Combat and Other Geek Thoughts

OK, bear with me.  Geek talk ahead.  This is important only in that it gets a series of thoughts out of my head that have been swishing around and around for a while.

Like I mentioned yesterday, I just finished watching the last movie in the Harry Potter series.  It's a good yarn, and the writers and directors did an excellent job in entertaining me.  But some things have been nagging at me.

The finale of the entire series is a huge battle between the hordes of evil Voldemort followers and the small, but plucky band of good wizards centered around Harry Potter.  The good wizards are holed up in Hogwarts and are preparing for a battle to the death.  The entire scope of their protection is to put up some force fields, mine a bridge, and banish the untrustworthy students to the dungeons for the duration.  Once their protection spell on the castle is defeated, the battle pretty much falls down to a large series of single combat encounters.  Individual wizards face off, with the winner living and the loser becoming something to be squeegeed up.  The battle doesn't go well for our intrepid heroes, and they win only because Harry Potter defeats Voldemort in single combat.

Basically, the wizards are conducting combat in the same way that ancient barbarian warriors and medieval knights did:  single combat between heroes.  There is no magical version of the phalanx or the maniple.  There didn't seem to be the wizard version of the archer or crew served weapon, and there certainly wasn't any use of the castle as an urban warfare trap.

Now remember, the good guys have spent several years demonstrating that they are stronger because they depend on each other and work together.  But when it finally comes down to the big battle, they dissolve into little one and two man fighting teams.

Remember, these are beings who have the ability to turn ordinary substances into deadly explosives and poisons, are armed almost exclusively with ranged weapons in the form of spells, and with the aid of brooms can fly like birds.  Where was the "You guys on the Quidditch team take these flasks and start dropping them on all of those bad guys.  Don't get caught up in the vapors from the explosions."  or "You guys go down to the owlery and lay down a base of fire with the "Mess a Guy Up" curse while we draw them into the halls of the castle so we can ambush them."?

This also brings me to something that bothered me about an incident in "The Half Blood Prince".  Harry Potter learns a pretty effective spell, sectumsempra. Basically, it's a "Cut that guy into little pieces" kind of curse.  He uses it once, then is so shocked by its effectiveness that he gets rid of the book he found it in.  As far as I can see, he never taught it to anyone else, even knowing that a battle was coming and that his friends would need as many tricks in their bag as they could in order to survive.  This mentality seems to run through the entire story.  "Let's do the minimum necessary to defeat Voldemort, but let's never do anything we might have regrets about later."   Again, the attitude of individual combat and personal limits on how to fight peaks through.

And what do the good wizards do once the battle is won?  Voldemort is dead, and so are a lot of his top lieutenants.  But a lot of bad guys are still around, and what are the victors going to do about them?  Also, the Ministry of Magic is probably still controlled by a Voldemort toady, so what was done to reform the government?  Since we know that Harry's family is alive 19 years later, we can infer that something was done so that he could show his face in public without someone trying to burn it off, but what?  After the last wizard war, they seem to have held Truth and Reconciliation hearings, where sins were forgiven for all but the worst criminals.  After seeing how badly that worked, can we assume that the good wizards then went on a hunt for the bad guys and exacted some justice in a rather sticky and smoky manner?  If you've tried just forgiving and forgetting and got another war as soon as the bad guys could find one, isn't the next logical step to start putting a whole bunch of people against a wall?


What bothers me about all this is the message it conveys to the young readers.  The bad guys in this tale are basically a gang of bullies and thugs.  The good guys are good ladies and gentlemen.  The good guys fight as gentlemen; the bad guys pull out all the stops.  What I teach my kids is that when faced with a bully, you hold nothing back.  Kick, bite, scratch, grab whatever is handy as a weapon, but the final goal is to stop the threat.   The good guys in these stories seem to be willing to only go so far in fighting, but no further, which seems to be the reason they tend to get their heads handed to them until some hero comes along to save the day.


Anyway, I'm putting way too much thought into a children's book and movie, but things like this tend to get stuck in a loop somewhere in my cranium, and this is the best way to get them out.  Y'all got any thoughts?

SCADA, SCADA, Shedoobie

Borepatch puts up some good points about IT security in general, and SCADA systems in particular, when he discusses the damage done by vandals using the controller for a water pump to disrupt operations at a water plant in Illinois.

I sort of tongue-in-cheek talked about IT security a few months ago with my 4 Rules of IT Security, and Borepatch added a 5th:  Boot it and they will come.

He couldn't be more right.

Any system, be it a gaming console, a laptop, a smartphone, or the controllers for a nuclear power plant, can be compromised given access and time.  The ideal is to make it hard enough for someone to get in that they can't do it before you notice and shut them down.  The least you can do is to know they were there so that you know what was damaged or stolen after they're gone and you notice it.

So what do you do?

If you're in IT, you bake security into the cake when you're designing new software, systems, or products.  You balance user requirements against security best practices, with the scales always tipped towards protecting the information and business that your system services.  You patch early, and patch often, and double-check to make sure that your systems aren't vulnerable to new vectors of attack.  You retrofit security into existing business processes and systems as much as you can, and you always watch your systems for early signs that someone is doing something nefarious.  And for Cthulhu's sake, if you're taking care of SCADA systems, start jumping up and down on your vendor's desk to get them to do something about the abysmal state of their systems.  Do that about 3 minutes after making sure it's hard as heck to get to your SCADA from the Internet, of course.

At work, if you're not in IT, pay attention to the excruciatingly boring security briefings and policies that you're regularly asked to attend and read.*  You think about what you're using your computer for, and try to not do anything that will compromise it.  You keep yourself educated enough that you recognize someone trying to trick you into giving up the keys to your particular kingdom.

At home, you are probably your own IT guy, so act like it.  Educate yourself about the technology you have in your home the same as you do about the technology under the hood of your car.  Keep your systems patched the same as you would change the oil in your car.*  A quick pro-tip here:  If the company that produced your operating system announces that there won't be any more patches to your system, replace it.  They're not announcing that there isn't anything left to fix, they're announcing that they're giving up for financial reasons. Also, use firewalls, both at the point where the Internet comes into your home, and on your systems.  I'm a Unix and Mac guy, and it pains me to say it, but Microsoft has come a long way in the security realm, so if you're using Windows, use the built in and bolt-on security software to your advantage.

What else can you do?  If you use USB keys, be wary of putting information that can harm you on something so easily stolen or lost.  If you have to keep your financial or personal information on a USB key, then encrypt it.  Stay out of the seedier areas of the Internet, and always be on the look out for Nigerian princes who want to give you money.  Watch your credit cards, bank accounts, and other business dealings so that you know if someone has compromised your information.  Regularly check your credit report to make sure someone hasn't gotten hold of your identity and opened a bunch of new accounts in your name.

Basically, take care of your information security the same way you would take care of your physical security. Lock your computer the same way you would lock your doors.  Use the most high-powered technology you can handle to protect your information the same way you would carry the most powerful handgun you can handle to protect your body.

*We enjoy writing and presenting them almost as much as you do going through them, trust me.

**If you don't know much about the engine in your car or change your own oil, you should probably pay to have someone to regularly service your computer the same way you do your car.

Pretty Neat

Scientists in Washington have announced that the use of an online video game has advanced the science behind anti-AIDS drugs.  The game, Foldit, encouraged game players to find the best way to fold proteins in a virus, and scientists have been able to use the solutions to the puzzles to increase their understanding of the structure and work of viruses.

Crowd-sourcing research is nothing new.  The BOINC focuses on bio-medical and mathematical research.  Basically, a problem is broken down into small bits, and PC's around the world spend their idle time going through the data and sort the wheat from the chaff to allow for more efficient use of dedicated computing resources.

But this is the first time I've heard of actual human interaction being used to do something like this.  Imagine the uses.  It could be used to find solutions to problems that are now done primarily by experts in their field.  Need a new human-usable traffic plan for your city?  Create a driving game that gives points for getting from point A to point B quickest without driving on the sidewalk.  Need to find and bomb the living crap out of some countries nuclear weapons program?  Create a video game that gets hundreds of thousands of people to go through every possible way to do it until you find the best way.  Bonus points if you give the players realistic simulations of military and intelligence units to fight with.

Hopefully, this method is used again.  I might give up my personal moratorium on playing video games to contribute.

IT People I Have Known

I've been working in IT for about 20 years, starting out as "that guy" in my office to being a somewhat skilled SySad, depending on the phase of the moon.  Over the years, I've noticed that there are a few types of organisms that keep popping up in my little IT ecosystem.

• The Gadget Guy - This strange animal is always carrying around the new hawtness from ThinkGeek, Apple, Google, or Microsoft.  Examples of this species have paid more for gaming rigs, laptops, cell phones, smart phones, and touch pads than I have on cars over the years.  Can be known by their ability to always find a way to be touching and playing with a new toy, which it will use for about six weeks before it pays out full price for the next big thing.  It is also good at bringing any conversation around to either its latest find or the next big thing that it plans to pre-order and then stand in line for at 4 AM.  This animal is also the person who refuses to support legacy hardware and software, instead using company money to chase the new hawtness in OS, hardware, and programming language.  While usually quite talented, it can be frustrating to take over  a project after they have moved onto the next shiny object, because you have to make heads or tails of their RubyC#PERLJavaJavascriptOnRails magnum opus and keep it up and running.
• The Project Manager - Some specimens of this start out as actual technical people, gaining experience in what it takes to actually do the jobs they are now trying to schedule.  The ones that seem to pop up in my memory are former DreamWeaver jockeys who figured out how to make a gantt chart after the dotcom bust.  Can be known by their ability to use words like 'leverage', 'synergy', or 'enterprise'.  Extreme examples don't really care whether or not the project they're managing was successful, so long as it failed on time and on budget.
• The Technology Manager - This funny animal is a remnant of past times.  They fondly remember setting up compute clusters on a Vax, serial hardware dongles that were used as software licenses, and networking using two inch wide copper wire.  They can be known by their inability to 'get' virtualization, security, or really anything that was developed after 1985.
• The Tusker - This is an evolutionary cousin of the Technology Manager, but is actually quite useful. It also remembers VMS, SNA, COBOL, and all of the other things that were developed for the Apollo missions, and in some instances is still taking care of them.  However, it remembers all of the technical details and can sometimes relate the concepts to new technology.  It may not be interested in learning the guts of KVM, but at least it doesn't dismiss it as new-fangled nonsense.  Well, not much, anyway.  It is called the Tusker because it's like an old elephant, who is just hanging on long enough to die happy.  Extreme examples of this group are also known as the RBDP:  Retired But Drawing Paycheck.
• The Haxor - An example of parallel evolution, in that this creature emulates the behavior and values of the Mall Ninja.  The Black Hat fancies itself as a security expert, and takes every opportunity to try to figure out everyone's passwords, get into their email, and generally be a nuisance to all who it touches.  Unless forced to by a dress code, it wears old, baggy cargo pants or shorts, and a seemingly endless array of Black Hat, SANS, ThinkGeek, and vendor give-away tee shirts.  Hired to help lock down and protect systems and networks, he visualizes his responsibilities as telling war stories from his latest LAN war and trying to penetrate the systems instead of protecting them.  Talk of configuring iptables and Snort bores this animal, as those are defensive in nature, and it only uses its skills in the offense. 
• The Old Shaman - Normally, a Unix or Mainframe guy, but some older Microsoft people are gaining this title as well.  These creatures have been working on the same technology for many years, and have the scars to show for it.  Each of these scars is catalogued and the place, time, and event that brought it into being can be talked about at length, especially if multiple Old Shamen were involved and are there to talk about them. While their technology may be old, it is still a powerful force in the company, and these Shaman are the wise old men who will be there to bring along the Gadget Guy and the Haxor when they age out of their adolescence.  Extreme examples have scars from VMS, Windows, and Unix, and can knit beautiful solutions using technology from multiple platforms into works of geek art that will not survive their passing from the scene.
• The Bushy Tailed NeoPhyte - This newcomer to the ecosystem can evolve into any of the above fauna.  It's kind of the stem cell of our little ecosystem.  If paid well, it can morph into the Gadget Guy.  If given too much time on their hands, they can become the Haxor.  Eventually, they will evolve into some of the older species.  The Neophyte can be known by the fact that their dominant hand is usually filled with a RedBull or some other sweet concoction, they still wear their college clothes to the office, and may still talk passionately about how they want to use their talents in technology to make the world a better place.  Eventually, their soul will be crushed and they can begin their evolution to the higher forms of life in the IT ecosystem.

include <RIP.h>

Today I learned that Dennis Ritchie, another person who created the technology that has greatly influenced my life, has died:

Ritchie is credited with creating the programming language C, one of the most widely used and influential languages today. He was also one of the creators of operating system UNIX, whose variants -- most notably Linux and OS X -- are also widely used today.

I've been using and taking care of Unix systems since 1990, and was using computer programs written in C long before that.  It's the technology that I use to make my living, and I don't think that's going to change for a very long time.  Yes, there are a lot of newer languages and OS's out there, but almost all of them are either based on something that Ritchie created or borrow concepts from his work.  There's something comforting and home-like about getting into a command shell on a Unix box, be it Solaris, HPUX, AIX, or Linux.

Rest in peace, Mr. Ritchie.  An entire generation of geeks owes a lot to you.

#include <stdio.h>
 
int main (void)
{
    printf("Hello, world!\n");
    return 0;
}

Trouble in Perpetual Motion

An unnamed contributor over at Skippy's List describes how an industrious dolt is always more dangerous than a lazy genius:

No more than maybe fifteen minutes go by and I hear my team leader screaming again, “what the f*** are you doing?!” There sits a very confused soldier getting his ass handed to him again. Somehow in the last fifteen minutes he had forgotten that the user name and password were labeled on the keyboard in front of his face, and got frustrated that his network log in wasn’t working. To remedy this he decided the issue was that there was no Ethernet cable plugged in so he found one and tried to plug it in, but then he noticed an obstruction in the port so he whipped out his trusty Gerber and removed it. He then commenced to try and log into the network with an unauthorized computer…our Ethernet switch was just down and we had to move offices.

(Edited for language.)

I hope that the soldier in question was put on human waste destruction detail for a while.

Reminds me of my first job in military IT.  I was tasked with crawling under the floors of our facilities to find unauthorized modems and telephone cables.  Seems that someone had been caught connecting a modem and unsecure telephone line to his classified work computer so that he could work on his classified reports at home, so we had to do a phyisical audit of all of our buildings to make sure no-one else had done it.  Nothing like the deep-lung irritation of 30 year old dust under 18 to 24 inch high suspended floors to make that morning PT run a real picnic.  At least the only critters I found were old snake skins.  Big ones.  Like make me jump up through the floor tiles whether there's a hole there or not big.  Ahhh, memories.

Privacy, or lack thereof

In other news, the privacy war marches on.

In California, Governor Brown vetoed a bill that would have required police to get a warrant before searching someone's cell phone, including using it to access on-line information such as emails, journals, location data, mobile banking data, and cloud storage.  Let's say you get arrested for drunk driving.  Fair enough, you did it, you got caught, you get arrested.  No problem so far.  The police search your car, find nothing illegal in it, so they open up your phone, find out everyone you've talked to recently, read all of your emails, look at where you've taken your cell phone in the last few weeks, and take a look at all of the things you read online or the files you keep on the net.  Those alarm bells you hear is your mind reminding you of how easy it is to break some little portion of some obscure law these days.  Maybe all they'll do is snicker at your browsing habits on Amazon, or maybe they'll report to DHS because you have been emailing back and forth in tech speak to your co-worker from Pakistan.  Either way, they're going to use the portable magic elf box to dig through a lot of the nooks and crannies of your life.

People, even if all you have is the default security software on your phone, use it.  Set your phone to lock when not in use, and use an unlocking code that isn't easy to guess.  Yeah, it won't keep a determined guy in a lab out, but it'll keep the nice officer on the side of the road from reading your text messages.

Next, we have something that really pisses me off.  The Justice Department has forced Google and another on-line service provider to give up the contact information of everyone a person, who may or may not be associated with the WikiLeaks organization, has corresponded with for two years.  The full text of the emails sent was not requested, so the government is apparently doing a bit of network and schedule analysis on the email traffic.  What gets me is that they didn't have to get a warrant to do this. All they had to do was get a court order that states that the companies have to turn this information over. For a bonus point, they did this without informing the person that they were under surveillance.  So we've got a government agency forcing two companies to provide surveillance information on a citizen without a warrant and without informing the citizen that the order has been made.  For me, that's a non-starter breach of the 4th Amendment.  If the government wants to know who I'm communicating with, then they should have to convince a judge that I'm breaking the law and  have them issue a search warrant, which should be served to me so that I know that the government is poking around in my life.  Getting the exterior information of my communications and using it to figure out who is talking to whom and when is just as intrusive as reading the actual content of the traffic itself.  The law that authorizes this behavior needs to be declared unconstitutional and thrown in the river with a cement block tied to it.

Don't get me wrong.  If law enforcement feels that someone needs to be checked out as part of a criminal case, then they should have the tools to look for evidence of these crimes.  But the principle of the warrant should be followed at all times.  Prove that there is cause for someone's privacy to be violated, get a warrant, and follow it.  All other things seem to erode the part of the social contract that says that the government should stay out of our lives unless it is absolutely necessary for them to intrude.

Yes, I know that it is absolutely trivial in a technical sense for anyone to see anything we do on-line.  But there's a big difference between what is technically feasible, what is legal, and what is ethical.  The government should have big, clear, bold lines that say "Further than this, thou shalt not go" on them when it comes to the privacy of citizens.  Anything that makes those lines fuzzier adds grease to an already slippery slope.

Quote of the Day

"I feel a great disturbance in the Force, as if millions of voices suddenly cried out in terror, and were suddenly silenced."

―Obi-Wan (Ben) Kenobi, Star Wars

In Memorium of Steve Jobs, founder of Apple Computers, the company which introduced me to computers.

The Four Rules of IT Security

1. All systems are always vulnerable.
2. Never put important information on a system you are not willing to secure and defend.
3. Keep your users away from powers and abilities that will make your systems less secure.
4. Be aware of where your information is, how it moves, and who has access to it.

Have you seen me?

Color - Black
Shape - Arrowhead
Demeanor - Pointy, but a bit unstable

Last seen taking off from Vandenberg Air Force Base in California.  May be somewhere in the Pacific.  Can move pretty quickly, so be patient while trying to catch.  Might be a bit hot to the touch

If found, please call DARPA immediately.  Reward!!!!!

Mashup

A couple of Fridays ago was "System Administrator Appreciation Day".  This is the day where we all stop to remember those people, myself included, who act as the mechanics for the technology that we all use every day.  Be it the Linux SysAd, the Windows desktop administrator, the Oracle DBA, the Cisco network admin, or the cellular communications guy, we all work bad hours in dirty computer rooms and worse to keep the information super highway rolling.

On September 19, it will be "Talk Like A Pirate Day".  This is the day where we all get to put on our eyepatch, raise the Jolly Roger, and swagger our way through the day while shouting out our doggerel to the masses.

It occurred to us at the office today that we could mix the two and celebrate "Talk Like a Pirate SysAd Day".  Here's some thoughts on good sayings for this auspicious event.

• Arrr, Linux be a harsh mistress.
• The cluster be keelhauled.  Clear decks for action.
• Batten down the hatches!  It be Black Tuesday and Microsoft has been in the captain's rum!
• Man the long toms!  We be under a DDoS attack.
• Be careful what you say, matey.  Here there be trolls.
• No, you cannot have more space for your database, ye scurvy dogs.  Ye be already using every spare gigabyte that we have and we're about to capsize the storage frame!
• Me first server she were a DEC 3800 running OpenVMS.  She were trim and yar, and me home were SYS$BOOTY.
• Which one of ye scurvy rats put pictures of naked womenfolk on me NAS?  I ought to make all of you walk the plank.
• Weigh anchor me hearties!  Of course it be heavy!  It be made of old 486's fused together with Diet Coke, Mountain Dew, and Skittles!

What do you guys think?  Is there room on the calendar for another made up holiday?

Aw crap

A few weeks ago, I put up a little rant about the lack of security on the Roku device I use to access online entertainment content.

Now, a security researcher has published findings that indicate that implantable medical devices have little to no security protection.  Basically, if you can access an insulin pump, you can change settings to allow someone other than the doctor or its owner to control it, with possibly catastrophic consequences to the owner's health.

Think about all of the wonder gadgets that doctors implant into people now.  A lot of them have some remote communication capability, and now it's been confirmed that at least some of them can be modified to the detriment of the patient. 

Why would someone do something so horrific?  It could be someone who's pissed at the company that makes them and wants to tarnish their reputation. It could be someone who wants money, and uses a demonstrated ability to kill patients to extort the pharmaceutical company.  Or it could be some script kiddy that wants nothing more than to prove that he's the baddest mother in the valley today.

I'm not sure what can be done about this due to the relative primitiveness of the computers in the implanted devices.  By necessity, embedded systems like this need to be small, so a trade off of computing power for size happens.  The processors on these things probably just can't handle any kind of encryption or sophisticated access controls. 

So grandma's pace maker, the lady at the office with an insulin pump, and the little kid with a brain stimulator are at some risk.  Whether or not this becomes as big a problem as it could be remains to be seen.  Hopefully the manufacturers will listen to this research and work towards better locking down their future products.