A Rare Moment of Unadultered Hatred: Shut the hell up.

I get frustrated just like any other person. Anyone who knows me in person can vouch that this is indeed the case. I try to keep it in check, but right now, I have but a few words to say to a great many persons:

Shut the hell up. If you can't think of anything intelligent to say, or at least something that doesn't jepordize the future of everything you might reasonably care about, then just go into your little corner of reality and don't say anything at all. You are now, and always will be, a nuisence, a distraction and a danger. While in general, I don't advocate "censorship," I must at this point admit that I need some isolation from the overwhelming idiocy that pervades what passes for political discussion in this country, and the only way to do that is for the debate to become intelligent, or for me to leave my political awareness behind. Of the two, I prefer that the dangerous idiots leave.

Having said this, I suppose I probably should make clear who I am aiming at, since we as a society have been damn near brainwashed into thinking that we actually have meaningful discourse on political, social, moral and scientific issues. I am refering to the overwhelming and completely unfounded attack on science that seems to have manifested itself this week in the form of "articles" denying the existance of global warming. By the way, don't even dare accuse me of failing to make an argument. I shouldn't have to. Many others have done so, and I don't intend to waste any effort in convincing people so utterly disconnected from reality. At this point, I wish only to encourage anti-global-warming dittoheads to simply lay off the issue until they learn what it means to have a brain and apply this learning in practice.

Let me describe some examples of the sort of thing that prompts this Unadultered Hatred. Attempting to read the opening comments of this recent Slashdot article on a related issue simply sickens me to the point of physical nausea. Reading pseudo-arguments like the following examples make me despair for humanity.

We already have droughts, floods, powerful storms, varying jet streams, famines, and lots of other weather. Why should we expect next century's droughts to be drier than last century's? When was the time when the weather was perfect for everyone? What makes you think that you can have the weather you want?

-- Kohath, comment #15145483.

Marked as 3, Insightful. I guess noting that storms exist without making any sort of actual argument passes as Insightful these days.

Face it. Most people in the US are bored. They on average spend 4 hours a day in front of the tv, 8 hours working, 8 hours sleeping, and 4 hours unexplained.

From what I hear, New Orleans is a blessing since the hurricane. Crime is almost non-existant, and people are focused on rebuilding the city, working, and being nice to each other.

Maybe a shifting environment and real estate changes will be good for us.

-- hackstraw, comment #15145816.

Marked as 4, Interesting. I suppose that I can't deny that it's interesting. Then again, isn't Hitler interesting, too, or did I just lose the debate via Godwin's Law?

Does it bother you that hurricane researchers have said repeatedly that global warming had little or nothing to do with it, and that there was an expected upswell of activity due starting last year, give or take? Or that the US coastline had been dodging the averages for the better part of 20 years, with a far smaller fraction of hurricane strikes than the historic record would otherwise suggest? What will you be saying if the next hurricane season shows lower activity than the last?

-- Martin Blank, comment #15145268.

Marked as 5, Informative. So that means if I make a bunch of baseless and uncited claims that have nothing to do with the argument at hand, it's not only perfectly on topic, but an informative contribution to an intelligent debate?

Let's make a deal:

Global warming caused last year's record number of hurricanes. So this year, when the number of hurricanes is fewer, we'll know it's because global warming has peaked and is no longer a problem. Do we have a deal?

-- Kohath (again), comment #15145883.

Marked as 4, Insightful. I give up on Slashdot moderation for now. I suppose I have to find a new target, like maybe... Digg? At least on Slashdot, the article itself is fine. The comments are what are so scary. Even then, there are some good commenters mixed in, but they spend all their time responding to idiocy like what I just referenced. On Digg, however... well, let's look at the very headlines of some recent front page articles:

"Global-warming alarmists intimidate dissenting scientists into silence."

"Global Warming Reportedly Stopped in 1998."

"Remember Global Cooling?"

Sick. To be fair, some of these have been marked as inaccurate, but again, they never should have made it to the front page. There is no substance to such articles; no arguments, no compelling presentation of new perspectives, no attempt at intelligent thought. To repeat myself, then, please, for the love of whatever you hold dear, shut any orfice from which words may emit, cease to utilize any appendage capable of recording written words, and go take a middle-school science class.

technorati tags: hate, rant, vent, science, idiots, digg, slashdot

Semantics and Software: What the hell is a beta?

If this blog has any recurring theme, it is that language doesn't mean the same thing to everyone. Often times, this subjectivity can lead to great amounts of confusion and general miscommunication. Should we not expect, then, that there exist those willing to exploit such difficulties? Of course we should. This effect is seen everywhere, and we are not surprised to see it again in issues relating to software quality.

Chances are, if you haven't been asleep for the past fifteen years, you've heard the word "beta" used in a sense other than radioactivity or Greek literature. Particularly, you've probably heard it in reference to the development status of software. Historically, the progress of software progress has been described in terms of a progression from planning, feature-incomplete implementation, feature-complete implementation, tested implementation and maintained implementation. Though the precise terms used to describe these phases depends heavily upon whom you ask, there is little disagreement on the five-phase system. Some may split or divide, but these five seem to be common across categorization systems. One of the more common codification schemes involves referring to the second and third phases (call them Phase 1 and Phase 2 for now) as "alpha" and "beta," respectively. Thus, "beta" is quite often intended to refer explicity software which does everything it should, but is likely to be buggy, and in need of through testing.

At this point, many readers would do well to stop and think of what they've seen the term "beta" applied to. Gmail, which has gained no small amount of features, has been in "beta" since its inception. Internet Explorer 7 Beta 2 is quite obviously not feature-complete, nor is the documentation even close to adaquate. Thus, we see that in both cases, the term "beta" has been shifted from meaning "feature-complete but buggy" to "people won't use it if its called alpha" in the first case, and to "we don't care enough about quality to have a bugfixing phase" in the second. Of course, the idea of distinct phases gets a bit blurry with a feature-incomplete production application. Google can't afford to have major security flaws in a production application, whether they call it beta or not. Thus, I would propose that Google fix the problem by simply choosing another word to use other than "beta." For Microsoft's part, calling Internet Explorer 7 Beta 2 is nothing short of a boldfaced attempt at deception. The documentation and visual styles are far from complete, and most dialogs are completely different than most others, leading to the realization that Microsoft is not really even trying at making the beta phase a quality control phase.

In summary, please be aware of what the word "beta" means, and don't let it sucker you into ignoring large and important faults of a product.

technorati tags: software, language, beta

More Trust Models: To Trust Telecos and Governments.

As discussed in the article "AT&T Forwarding All Internet Traffic to NSA?," the EFF alleges that AT&T has been forwarding that traffic which passes over their lines to the NSA. In keeping with my recent obsession with trust models, I shall raise an important question: to what degree should one's telecommunications provider and one's government be trusted? The most obvious answer seems to be to not trust either at all.

Dealing with each in turn, let us consider the role of a teleco in a trust model. A teleco sells a very specific service: to connect you to the Internet. Nowhere in this is the guarantee that they have the human decency to keep the data which you trust to their networks reasonably secure or private. Though some telecos may give you this decency, there is no compelling reason to assume that they will prevent unauthorized access to your data. Rather, the very people you least desire to have access to your data will seek to integrate themselves with a teleco, just as a pedophile might find access to their victims through a position in a police organization (as seen in the recent Department of Homeland Security child sex scandal). Thus, in one of those many ironies which permeate throughout information security, a teleco should be distrusted by default. How do you deal, then, with securing your data over what is, fundamentally, an untrusted network? For that, cryptography again comes to the rescue. A trust model which assumes a base distrust of the network itself will promote the use of end-to-end encryption. Oh, would that this were the case in practice.

Moving on to trusting a government, let us reflect upon words of wisdom from the Federalist Papers, No. 51, written by Alexander Hamilton:

But what is government itself, but the greatest of all reflections on human nature? If men were angels, no government would be necessary. If angels were to govern men, neither external nor internal controls on government would be necessary. In framing a government which is to be administered by men over men, the great difficulty lies in this: you must first enable the government to control the governed; and in the next place oblige it to control itself. A dependence on the people is, no doubt, the primary control on the government; but experience has taught mankind the necessity of auxiliary precautions.

A careful examinations of these words reminds us that at its most fundamental, a government is a response to imperfections in the human condition. Unfortunately, however, that response is in itself forged from the same flawed humanity. At a practical level, we are again reminded of a very basic axiom of trust:

The positions most requiring of trustworthiness are sought out by those most apt to abuse that trust.

Put differently, the positions that we create to deal with issues of trust and crime are the most desirable to those intent on violating that trust. As I have already mentioned, a position in a police organization is highly desirable for a criminal, so is not a position in lawmaking most desirable for a lawbreaker? How, then, can we ever trust our own government to be responsible with our data? We cannot if we wish to have any expectation of security. Government can secure us from each other, but it can never secure us from itself.

It is thus seen that the recent allegations by the EFF represent yet another failure to apply sane trust models to every aspect of our lives. Instead of harboring a base distrust of our communications providers and our governments, we explicitly place large amounts of trust in them. Though this by no more excuses the alleged crimes than leaving an expensive car unlocked excuses its subsequent theft, we should likewise not be at all surprised that, when we are so naive as to trust our governments and telecos, our trust will be violated in the most profound sense.

technorati tags: security, trust, encryption, government

The Fatal Flaw With Credit Cards.

Why is it that credit and debit cards are so continually under attack? Is it that those in charge of securing the credit card system are so incompetent, or is there a fundamental flaw with the model that they are charged with making secure? If the latter case holds, then no matter how intelligent the security teams are, the system will remain insecure due to a these fundamental assumptions. In this essay, then, I attempt to make the case that the model underlying modern credit cards is fundamentally insecure, and must be replaced if we are to expect any sort of security from the system. Let us consider how this might be the case by examining a typical transaction.

John Q. Public buys a few groceries at the local supermarket. He decides to use a credit card, since it is much more convienent than cash. He then proceeds to swipe the card through the card reader. The card has now been comprimised, for he made the decision to trust equipment fundamentally outside of his control with the entirety of his card's data. His web of trust has not even had the chance to start building, as it was so throughly violated at the first step. The problem that is immediately seen is that in this kind of a transaction, the validation data is the key! Every time that card is swiped, the exact same data is exchanged, and one need only capture that data once to invalidate the implicit trust in every other instance. How else might this transaction have been completed, then? By the magic of private/public key encryption, also known as keypair encryption.

Before delving into how this would work, we must first develop an understanding of keypair encryption. If you already have such a grip, please skip this paragraph. Under a keypair encryption model, each user has a private key which they keep secret at all times, and a public key which they distribute as widely as possible. There are four basic operations that can be performed using a keypair system: encryption, decryption, signing and verification. Encryption takes a set of data and encrypts it against a public key so that only the matching private key can decrypt it. Decryption, then, is the act of taking such encrypted data and recovering the original data by applying the private key. Signing is the act of attaching an extra block of data, called a signature, to a message, and requires a private key. Verification takes a public key, a signature and a message and checks to see if the signature was generated from the matching message and private key. For instance, I can sign an e-mail message and attach the signature. If someone malicious intercepts my e-mail and changes it, then the signature will no longer verify and the message should not be trusted. These operations can be combined, too. If I have your public key, I can encrypt a message so that only you can decrypt it, and then sign the encrypted message with my private key. Upon recieving the message, you can verify that it is from me, and be assured that only you will ever see the message.

Let's revisit the credit card purchase scenario again, and use keypair encryption this time. Before arriving at the grocery store, let's say that John Q. Public created a GPG keypair (which can be done using free software available for most any OS) and sent the public key to his bank. He then goes to the bank's branch office and reads to a teller the fingerprint on the key (a string of data that is unique to each public key) and verifies that the public key they recieved was the same as the one he intended to transmit. Having done that, the bank now trusts that key. John now goes to the store, selects his purchases and goes to the counter to pay. Instead of swiping a card, he takes out his PDA.

The register now generates a message to send to John's PDA. It doesn't know who John is, and so it can't encrypt it to his PDA. There would be some serious privacy concerns if the register were to send a message with his purchase details over the air, and so it first attepts to confirm his identity by generating a block of random data (called "salt" for reasons beyond my understanding) and sending it to John's PDA. The PDA then responds by signing it with the private key stored on board. The register now knows which key to use for the transaction, and verifies the signature with the public key from the bank.

Next, the register needs to confirm the transaction details. The register now writes a message consisting of the current time, the name of the company recieving payment, and the transaction amount. The message is then encrypted against the public key it recieved from the bank, as well as the store's public key and the bank's public key. (That means that any of John, the store and the bank can decrypt the message.) John's PDA recieves and decrypts the message and shows a dialog on the screen asking if the transaction should be completed. If he clicks yes, then the PDA signs the encrypted message and sends it back to the register. The signed and encrypted message can serve as legal verification of the transaction in case of dispute.

Note that nowhere in this process is John's private key sent to anything but his PDA. Thus, in order for this transaction to work, John needs to trust the following three things:

• The bank's public key actually belongs to the bank.
• The store's public key actually belongs to the store.
• The PDA has not been comprimised, and will only sign the messages that John explicitly agrees to, and will protect his private key.

The first two can be solved rather easily; if the bank's public key is trusted by a large number of other people, then they can sign a message containing the bank's public key's fingerprint and a statement that the key referred to actually belongs to the bank. Software exists to collect such messages and assemble a web of trust. If John knows any of these people personally, then the trust link will be stronger. The same process can be used to verify that the store's public key really belongs to that store. As for the PDA, that is a trust issue that John has explicit control over. If he does not trust the code on the machine, it can be replaced with code that he does trust. Of course, such trust has its limits, as it may be that the hardware itself was comprimised, but such issues remain in any system, regardless of the model. Rather, a system of trust such as the one described here minimizes the risk by decentralizing points of attack. In order to comprimise John's transactions, one must either comprimise his personal property, or form a conspiracy of the bank, store and many customers of each to poison the first two bullet points above. To form such a large consipiracy without John's knowledge is difficult at best and counter to human nature at worst.

The system can be further protected by creating John's private key such that it only works if a special password is entered at any use of the key. This, however, still requires that the PDA's hardware be trusted, and simply protects against physical theft of the PDA. These arguments are not to indicate, however, that such a system is secure against all attack, but rather that it is improved from the direct key exchange method of modern credit systems.

technorati tags: security, cards, encryption

Related or not? A case for more metadata.

Recently, I tried to search for a PSP port of the PC game Cave Story using Google, using the search string "cave story psp," and was completely frustrated by the preponderance of articles about the game on sites with PSP sections. A human can quickly see that these articles have nothing to do with the PSP, and that the links are part of the site's chrome. Google and other search engines, however, have no means of discerning this separation. Thus, I propose that in order to give search engines the help they need, site designers should label navigation links as rel="nav".

A more complete, but robust, solution would be to include an attribute for the div element from another XML namespace (say "uri:seo-metadata") that would allow you to specify information like the rel attribute of the a element. For example, a div element could take the following form:

<div seomd:tags="chrome nav"><!-- lots of navigation links --></div>

The contents of the div element would then be marked as being part of the site's chrome and not directly related to the content, and would also be marked as being part of the navigation structure. Such an approach would also be extensible so as to include a mechanism to describe other aspects of a resource for the benefit of search engines. Of course, such metadata would be useful to applications outside of SEO and so it would be more appropriate just to refer to it as a generic metadata stucture that allows you to attach metadata to any arbitrary element. That, however, is a topic for another day.

technorati tags: seo, metadata

Language, Cause, Evolution and Effect.

Recently, I found myself greatly amused by a particular Doonesbury strip illustrating the problems with the creationist assertions. Deciding to share my amusements with those who cohabit the dormitory in which I spend my sleeping hours, I printed a copy and posted it on my door. A few days later, I found that my posting had been modified to include a strange response:

"Evolution is a complete change of species: fish to bird. [The adaptation of pathogens to drugs] is called natural selection. Get the facts straight, stud."

This statement is simply false. Evolution can include complete changes of species, but not in any sort of sudden sense. In order, then, for a complete change of species to occur by evolution, there must be intermediate steps that are incremental in nature. Thus, these too should be considered part of evolution as any theory of evolution predicts their existence.

Interestingly, this response did not actually "debate" anything, but seems to have sought to distract other readers of my door with a semantic sleight of hand. I have posted to other forums on this tactic, but I feel strongly enough as to do so again on this forum. Here, our friendly neighborhood linguistic charlatan, whether consciously or not, has acted to confuse the method with the effect. Evolution can happen by many different methods, of which natural selection is but one. We can exact a change in a species through other methods, such as artificial selection practiced in the breeding of domesticated animals, resulting in an evolution of that species. At its most basic, to say that evolution exists is to say no more than that the world's zoology is not constant with respect to time and space. This notion can be experimentally shown by an examination of any number of datasets, including fossil records showing a set of species not found on modern-day Earth.

The more controversial notion is that of natural selection, the proposed method by which species evolve. (It should be noted that this is technically not correct -- species do not evolve as a direct result of natural selection, but rather, genetic patterns evolve with species as hosts. For our purposes here, however, the two models are in close enough agreement that we need not belabor the point further than to point an interested reader to Richard Dawkins.)This can be observed directly on a microscopic scale, but the allegation by the creationist apologists is that the lack of direct observation for macroscopic natural selection precludes the proposal that macroscopic natural selection is responsible for evolution from being useful or worthy of consideration. Of course, by similar criteria we are left with no viable explanation of the observations alluded to above. Creationism is no more able to produce evidence from the depths of time long past, and in fact lacks any analogous data to that of microscopic natural selection, which serves to suggest that the principles are sound and should hold at other scales. Thus, the whole trickery of trying to recast the debate into terms of an emotionally charged term and then seeking to redefine the term in a straw man argument is seen to be a callous attempt to change the universe by changing popular opinion.

What would be the effect if our delightful correspondent had succeeded in convincing all of his readers that evolution is a sham? Would the universe suddenly stop evolving? Would TB drugs of yesteryear suddenly become effective again? No. The universe would not even slow down in its continual process of change, despite our kicking and screaming, and our denial of overwhelming evidence. Such intellectual dishonesty gets us no where, as it ultimately divorces us from the world around us and impairs our ability to make rational judgments.

technorati tags: language, debate, creationism, evolution

Not Safe For Work: A case for new metadata.

You've no doubt seen it before: those wonderful four letters that alert us that a certain link should be treated differently than all others around it. Depending on the person, one may either anticipate with glee akin to that of eating from a forbidden tree, or avoid it with the same anxiety as one might avoid a rabid animal. Yes, NSFW is one of the more useful acronyms to have been developed by the collective patrons of the Internet.

All the same, however, one does occasionally fail to notice these instructive glyphs, resulting in shock, amusement and pain. If only there was a way to flag these links at the metadata level so that the browser wouldn't allow you to follow them inadvertently. Luckily for us, the rel attribute of the a element in (X)HTML is designed for such things. If we simply mark links as being NSFW by adding the attribute rel="nsfw" to the anchor tags, then it would become possible to create a Greasemonkey User Script to prevent such links from being followed. This measure would be easily deactivated, thus making it a conscious decision to follow NSFW links. In fact, I am working on just such a script right now. Hopefully I'll finish it soon. If so, I'll post it to this space when I do. In any case, please consider marking your NSFW links with this attribute, and perhaps it will catch on.

Update: Jeremy Dunck on the Greasemonkey mailing list was kind enough to write up a script for me to do exactly what I wanted.

technorati tags: metadata, design, web

Griffin AirClick USB + Linux?

I just purchased a Griffin AirClick USB. The application that powers it is a .NET application, so it should run under Mono, right? Well, not quite. Let's look at what I found.

The application itself doesn't do much- it delegates from a USB driver (I'll come back to this) to one of a set of plugins (these are .NET DLLs renamed with the extension "acp". They can be manipulated just like DLLs). The plugins then do something based on the button pushes. The Windows version comes with Interop.PowerPoint.dll and Interop.iTunesLib.dll, which the PowerPoint and iTunes plugins use to delegate to the applications. Thus, the flow of information seems to be: USB to delegate application to plugin to target application. The problem in porting this to Linux is the USB part. The application includes, compiled into the AirClick.exe assembly, the USBSharp class found here, which in turn makes explicit reference to kernel32.dll. Specifically, the file handle and HID device APIs seem to be used. I'm not too good at .NET hacking, so I can't go too much further on this front.

Assuming I can find some way of getting AirClick.exe to recognize the Linux USB stack, what next? Well, in order to be useful, you have to control something. If, for instance, you use it for controlling music, could you control a Mono music player like Banshee? If you want presentation control, use the CLI-UNO bindings to control OpenOffice.org. I now just have to find the API for the plugins...

Too Idiotic to Ignore

There are those articles that I run across that are simply too idiotic to ignore. Before responding to the article, however, I must summarize it for those with too weak a stomach to read it. The basic contention of the article, itself an extract from Dick Morris' book in which he advocates for a 2008 presidental run by Condoleeza Rice, is that an electoral showdown between Rice and Clinton is inevitable because Rice is a sort of "anti-Clinton." The article states in no uncertian terms that the two are somehow "destined" to fight each other:

Hillary Clinton does not want any other woman to take what she regards as her just place in history. Yet, ironically, it is Hillary's candidacy that makes Condi's necessary and, therefore, likely. The first woman nominated by the Democrats can only be defeated by the first woman nominated by the Republicans. Were Condi and Hillary to face one another, it would be the next great American presidential race and one of the classic bouts in history: Hector vs Achilles; Wellington vs Bonaparte; Lee vs Grant; Mary, Queen of Scots vs Elizabeth; Ali vs Frasier. And now, Condi vs Hillary.

These potential combatants are as different as, well, black and white. In many ways, they are mirror images of each other: not only white/black but north/south; Democrat/Republican; married/single; suburban/urban; and, in policy interests, domestic/foreign.

Saying that Condoleezza Rice is black, though, is similar to saying that Colin Powell is black, that Jennifer Lopez is Hispanic, or that Ann Coulter is a woman. In each case, the statement is in fact true, but it doesn't help to explain the person in question. All of them have disregarded their racial, sexual or ethnic identies in favor of the pursuit of money and political power. Thus, portraying this as a "white/black" battle is deceptive in many ways: Clinton would be much more likely to support racial and ethnic equality and civil rights. Rice is far too busy being beholden to the oil corporations that love her so much as to name an oil tanker after her to ever care about such human issues as civil rights. Make no mistake: Rice is a neoconservative, and as such has not ideological basis for upholding the Constitution. To her, and to the rest of the Bush cronies, the "law of the land" is merly an obstacle to greater levels of power. The Bill of Rights is thus made into a pesky thorn in the side of neoconservative campaigns.

That there is even one person who has even a passing familiarity with politics and yet can still hold on to the idea that Rice has any qualifications or capacity for President is a disturbing thing indeed. Her qualifications are no greater than the only President in history to ascend to office without winning any kind of a national vote whatsoever. For her to ally herself with one who blatently steals elections, who commissions and condones the murder of nearly 30,000 Iraqi civilians, who has led the most concerted assult on the Bill of Rights in US history, and who has made a complete mockery of the nation's diplomatic relations, what does that indicate about her? What sort of person willingly and knowingly supports a war criminal, serial electioneer, and a neofascist? The portrayal of this supposed struggle between Clinton and Rice as being "preordained," just or otherwise anything other than a battle of Rice's propaganda machines against the power of the independant media to expose her for what she is would be laughable were it not for the fact that there are those among us who seem to think that she could serve this nation well in any sense of the phrase.

politics 2008 bush clinton rice

Stop praying, start doing.

God did not ordain that Katrina kill so many. This was- and is- a human drama. It falls to humanity to save its own that it so willingly left in harm's way. The drama of Lake George is an outrage. The poor are left to die, as racism and rape run rampant. Look well, America! This is the face of Bush's America; his America is one in ruins as he vacations. Praying didn't stop this from happening, and prayer will not reverse it. The final chapter of this human tragedy must be written, and the climax must be the removal of George W. Bush from the seat of U. S. President. Our very survival may even be at stake, as the direct loss of life in NOLA is likely to be the least of our worries. Rather, this may be indicitive of the consequences of ignoring global warming, wetland devestation, etc., as well as the more immediate issue of providing strong leadership during times of crisis. What would happen if another hurricane hit? With the stunning lack of effort that Bush has displayed, how can we expect any better? Bush sees fit to link 9/11 and Katrina, using the same tactic that he has used for every crisis before. What he doesn't say, though, is that there is actually some merit to this comparison, as Bush was warned of both in 2001. As Paul Krugman documents:

Before 9/11 the Federal Emergency Management Agency listed the three most likely catastrophic disasters facing America: a terrorist attack on New York, a major earthquake in San Francisco and a hurricane strike on New Orleans.

Looks like FEMA was two for three, whilst Bush was batting a straight .000. The time for prayer is long past, and now we have a simple mission ahead of us: defeat Bush.

katrina disaster politics bush

Update: This is really too much.