make clean

fishagain

2009-05-22T23:02:00.000-07:00

After about a year off, I've returned to using OpenBSD. The primary reason for previously departing was due to lack of WPA2 support, which was fairly inconvenient given how much time I spend on the road. If I'd had the time, I happily would have helped port it myself, but that hasn't really been the case, of late.

Doubtless there will be new hurdles, putting the os on a current-gen hardware...but with some luck, I'll be able to stick with it at least until another new protocol becomes ubiquitous...

comes with broken bits

2009-03-28T20:20:00.000-07:00

...assuming anyone even noticed the downtime.

Was a little surprised to have a terminal hardware failure before software. Never even quite filled that hard drive to capacity :(

So some bits of content may be missing (like three entire sites of photos), but got most of the domains back online, and will be re-igniting the rest as quickly as I can figure out how...

for the freshman cs-majors

2008-12-02T13:30:00.000-08:00

This should be required reading for anyone entering a computer science program. Certainly wish I'd seen it about a decade ago, rather than finding it on /.

responsible law-making

2008-08-12T07:12:00.000-07:00

Last night, my mother started a conversation with me about ``responsible disclosure''. This was somewhat surprising, as she's not a security researcher, and it doesn't seem to be a topic exposed to the public at large by mass media. NPR aired a piece last night about the MIT students being sued by the MBTA for attempting to publish their research on the vulnerabilities found in their smart-card system (by pure chance, I was actually at ground-zero when they found out, and got to see them sprinting down a hallway...).

In discussing this with my mom, I was seriously disturbed to hear her repeating to me an argument made in the NPR broadcast, to the effect of ``they broke an unwritten law''.

The very idea of a law being ``unwritten'' is unfathomable to me. This is not a case of national security - the flaws generally represent a loss of income/reputation for the MBTA. But the fundamental issue is that a judge somehow decided that talking in a public forum is the same thing as breaking in to a system. As a member of full-disclosure (charter), I'm obviously a bit biased here. My mom is generally among the more skeptical of people out there (I'm fairly sure I inherited my skepticism from her). If the general public's first introduction to vuln. disclosure leads them to believe that rfp's guide was somehow a law that was ratified by Congress, there are going to be serious problems...

EFF takes on the case.
EFF Coder's Rights project.

new theory

2008-06-22T14:38:00.000-07:00

Only computers touched in some way by humans are fallible.

(and a site note - currently reading ``The Black Swan''. expect more of this nature)

redoubtable

2008-01-15T22:32:00.000-08:00

``The trouble is that worst-case scenarism...plays right into the hands of the fear creators. The worst-case scenario of crossing the road, after all, is that you'll be hit by a truck and killed. Yet we all do cross roads every day, and could hardly function if we did not. To live by the worst-case scenario is to grant the terrorists their victory, without a shot having been fired.

...The point is to decide...not to let fear rule our lives. To tell those bullies who would terrorize us that we aren't scared of them. And to thank our secret protectors, but remind them, too, that in a choice between security and liberty, it is liberty that must always come out on top.''

(Salman Rushdie, Jan. 2000)

info_cycle

2007-09-30T23:49:00.000-07:00

so...in case anyone didn't already figure it out, i've moved. due to a well-timed server upgrade, blog posting was unavailable until fixed this evening. i have piles of new contact info (address and phone number, at least), so shoot me an email if you happen to be in that small subset of people that read this blog and aren't in regular contact with me already.

changed jobs for...a variety of reasons. first serious dive into private sector, will see how it goes. i'm living in the bay area, which is entertaining, but kind of miss the desert already. introduced myself to some redwoods, over the weekend. rather enjoyed it

will post more info and such as it becomes available...

changing of the guard

2007-08-27T22:35:00.000-07:00

after five or so years of service (and god only knows how much abuse), I'm finally letting go of my tamrac system3 (roughly this), and have moved to a regular-sized backpack. it already has a new home, and will be surprised if it lasts less than another ten years.

kata makes some pretty neat gear. their having first been a company built around designing ergonomic body armor, i was quite happy to find they also made camera bags. i picked up an r-103 based entirely upon analysis conducted online (specs/reviews/subjective editorials/etc) and am pretty pleased with the result. i was badly in need of a way to carry two camera bodies + lenses on a decent hike, and not having to worry to that they might be destroyed the first time i bumped in to anything. can browse to look up specs on it, but the amount of design work that went in to the bag is quite impressive. it seems like they really got all the little details right (ok, the zippers aren't quite as well-sealed as the ones you'll find on arc'teryx gear, but i've yet to find much else that gets those right).

expect to start seeing mixed-variety of b&w and digital pictures for travels/events, getting posted on po...

i am against

2007-08-07T22:33:00.000-07:00

any philosophy which believes itself to be robust enough to not have to worry about what, if anything, lies beneath it. math is the only way i know of to rigorously prove anything, and if you can't do it from the bottom up, you'll always be surprised by the subtle changes that continuously cause problems (or exceptional cases). it seems possible to me that the entire ``field'' of the study of chaos theory could simply be reduced to ``thinking you could ignore certain factors, when, in fact, they were relevant''.

confusion

2007-06-20T12:09:00.000-07:00

compliance != security

2007-06-19T22:12:00.000-07:00

nuff said.

possible mistake

2007-05-06T20:47:00.000-07:00

for a long time, I've intentionally throttled myself to reading only one book per day (at least, with respect to non-technical books. I've never finished a technical one [of any merit] in a day, and suspect if I did, I wouldn't be at all concerned with starting another). It is possible, however, that I've been committing a serious mistake...

more people need to understand this

2007-05-02T22:21:00.000-07:00

this blog is not for everyone.

this post is.

I've considered writing up a post like that on several occasions. I'm probably preaching to the choir here, so just consider sending that link to someone that needs it.

sentimental

2007-04-25T16:03:00.000-07:00

perception

2007-04-17T20:31:00.000-07:00

This made some headlines today. Once I finished laughing at it, I was pretty much ready to start crying at how sad it was.

A recent conversation, similarly, included:
rob: they need to drop the scientist thing. CS is CE IMO

I'm going to try to avoid too long of a rant, but feel free to stop reading after a few pages.

Starting with the article, it attempts to make some assertions about the state of CS and where it needs to go. It clearly misses the relevance of Rob's statement, and this is a very serious fundamental flaw.

Computer science != software engineering != IT

(and for the IT majors, ``!='' means not equal)

The article repeatedly talks about the different fields computer science can be applied to. While this is certainly true, there is a remarkable lack of the terms ``algorithm'', ``compiler'', ``architecture'', etc... This is important, because those are the sorts of terms which matter most to computer scientists.

I know it's blindingly obvious, but most schools generating computer science students are in fact producing software engineers. I don't see this production as a problem - there's obviously a huge need. Only the naming. It is, for lack of a better term, polluting perception of the field.

The comment ``Moving emphasis away from programming proficiency was a key to the success of programs...'' is somewhat indicative of this. I think, however, in this case, that CMU is headed towards some sort of new (hybrid) field, rather than software engineering.

Unfortunately, I consider Rob's quote to be slightly inaccurate, and I view Computer Engineering as sort of a cross-over field between computer science and electrical engineering, but I think (and feel free to correct me if I'm wrong here) that he meant more along the lines of software engineering.

Oddly enough, I do agree with two of the major points of the article:
1) High schools generally do a horrible job of preparing students for computer science. My personal experience aside (which we'll just call ``far worse''), I'm fairly confident that two of the three terms listed above as being important to computer scientists are not mentioned in most high school curricula.
2) I've long held that women have potential to be better computer scientists than men. A great many seem to pick up analytical skills much more quickly than men do.

(Note: this was the _very_ short version. if you have complaints on any points, feel free to ask for elaboration)

sizeof(a lifetime of experience) = my(whole life)

2007-04-05T22:16:00.000-07:00

Today, I had the fortunate experience of getting to spend 30-40 minutes talking to a man who worked at Cray for 26 of the last 27 years. A year (and two weeks) ago, he left them to start at Microsoft. Keep in mind that this is a man far more intelligent than I (we're talking pretty clearly like 99.99 percentile or so).

During the course of the conversation, I asked him about his reasons for leaving Cray. His response was primarily financial - MS fairly obviously has a larger market share than Cray, and he felt like he could do more good for more people by working at MS. Philosophically, I find this very interesting. After some thought, I came up with three major categories to describe approach to such a decision:

Needs of the many over the one -
A form of gross help; a blanket approach. Clearly lots of people could be helped in lots of different ways by someone with the kind of experience he has. Applying that kind of skill to a large number of small problems will definitely make a dent.

Needs of the one over the many -
The entire HPC industry is a niche market and Cray only has a small share of that. Obviously the amount of help supplied will reach a smaller number of people. This set of people, however, tend to have disproportionate weights to the amount of influence they have in the world. Anywhere funded enough to have supercomputers tends to have analysts, which usually feed information to decision-makers. Therefore, some sort of trickle-down effect.

Needs of details, rather than trying to make large generalizations -
Possibly every situation is utterly unique, and must be examined on a case-by-case basis. In this case, he's working with MS' CCS division, which only shipped it's first product in August, and has yet to make a substantial dent in the industry.

That, at least, is my whole collection of feelings on the subject. If you have more/others, I'd love to hear them.

I have little doubt that philosophers have studied this question at length, and probably even formed some sort of general answer to it. I could probably even find it, if I bothered to look. I am not, however, going to. I'm more interested in hearing what you (esteemed and assorted readers) think about this (even if it is just a statement of agreement, with said mythological philosophers).

**Side note: every single Cray engineer I've ever met has been single.

in excess

2007-04-03T17:12:00.000-07:00

[root@zero:~]>df

Filesystem 1K-blocks Used Available Use% Mounted on

/dev/sda2 14428960 1051952 12644044 8% /var

/dev/sda3 9621880 1481248 7651856 17% /tmp

/dev/sda4 456566472 89421556 343952680 21% /

/dev/sdb1 480719056 91441332 364858524 21% /home

/dev/sdc1 46057440 43210068 2847372 94% /space

My first computer had a 20 meg hard drive.for anyone not totally over reminiscing about old hardware, that's an increase factor of 50,000 (in 16 or so years).

flashburn

2007-04-01T21:10:00.000-07:00

hope no one was directly linking to anything on po - i've been redoing directory structures, and hopefully it'll be a bit more intuitive to navigate to things that might be interesting.

unfortunately, it's not immediately obvious to me how one is supposed to see images sorted by how recently added they were (spanning albums). if anyone has any ideas, would love to hear them (so i can complain to Will to implement them).

componentry

2007-03-31T10:59:00.000-07:00

in case any of you haven't been subjected to my raving about my headphone setup, here's a picture to give you something to look forward to:

cat /dev/sec

2007-03-27T06:19:00.000-07:00

noticing that my security-ebuilds/developer-ebuilds files were getting a little out of hand, the lists have now been merged with their openbsd counterparts to hopefully become a little more useful.

security-progs now has a brief tag on the end indicating operating system. i haven't decided if more than gentoo/openbsd will be supported, but it should be a pretty easy extension if needed. i also haven't decided what to do about tools that are os-agnostic, having just found random sources for them. suggestions are welcome.

developer-progs has been similarly modified.

amusing quotes

2007-03-23T19:39:00.000-07:00

Somehow, I had never heard of Marshall McLuhan. More research is needed, but I might have to go find one of his books in the near future.

Choice quotes from wikiquote:

"What is very little understood about the electronic age is that it angelizes man, disembodies him. Turns him into software." (1971)

"Jobs are finished; role-playing has taken over; the job is a passe entity. The job belonged to the specialist. The kids know that they no longer live in a specialist world; you cannot have a goal today. You cannot say, "I'm going to start here and I'm going to work for the next three years and I'm going to go all that distance." Every kid knows that within three years, everything will have changed including himself and the goal." (1971)

thank you packetstorm qotd for introducing me to him.

tiger!

2007-03-01T17:06:00.000-08:00

no, wait, the other f5...

enter the paper crane

2007-01-26T22:46:00.000-08:00

people seem surprised to hear that i consider myself to have poor fine motor skills. this might come as a surprise, particularly if you've of played any fps' with/against me.it turns out that computers are very forgiving, when it comes to such things. i have a sufficient set to be a decent typist, but my handwriting is generally considered atrocious.

tonight, i decided to start doing something about it. folding paper cranes is a fairly well accepted practice for improving motor skills. i was not, by any means, blown away by my first attempt, but i plan to continue until i'm able to fold them with one hand (preferably either), or until my apartment becomes full of cranes...

some say...

2007-01-23T16:33:00.000-08:00

(thank you katie)

puffy!

2007-01-10T22:48:00.000-08:00

long overdue, I've finally made the switch (at least on my laptop) to OpenBSD. the security perspective was really my biggest concern, and there is large quantities of evidence suggesting OpenBSD has a huge number of advantagesin the area. I intend to evaluate as many of them as I can.

I had run OpenBSD 4 or 5 years ago - it made a pretty effective firewall system (to my knowledge, at least). the os as a whole is relatively lightweight, and I was using it on some older hardware. it never seemed to struggle in any way (think the only reason I got rid of it was due to giving that computer away...)

from a philosophical perspective, the emphasis placed upon secure coding is the biggest motivator. the frequent code-reviews don't hurt any, either.

other security things I like:
* pf - a bunch of good design decisions seem to have gone in to this. writing rules for it is about the same (in terms of difficulty) as iptables
* securelevels - a bit like init levels, these are used for making various files (like the kernel) immutable at normal runtime. in theory.
* secure-by-default - policy of having everything pretty much locked down upon install. I immediately found myself wanting to tweak quite a few things as soon as I had a prompt (X has a listener up, I don't have a need for daytime/chargen, etc...), but I like the idea that if I have yet to learn about something with the system, someone else has put some effort in to minimizing my exposure.
* tools - quite a few interesting tools have already been written for OpenBSD, that I hadn't already come across in the Linux world. looking forward to porting my own code in that direction (should be fairly easy).
* community - abusive to newbies. this tends to be a quick indicator to me of something I'll come to enjoy being a part of (expect a follow-up on this, later).

I will be keeping a Linux install around on the laptop, as well. I'm not yet confident in my abilities to make OpenBSD run Linux software, and having some decent photo-editing capabilities (read: bibble) is a necessity. otherwise, it's going to be pretty stripped-down.

happily OpenBSD seems to love Thinkpads - my T43 seems very well-supported. Out of the box, it has working drivers for the Broadcom gigE and ipw2200 cards. there is a package for tpb, which works fine. no acpi support, but apm seems to work, and no configuration at all was required to make sleep (to ram) available. hibernate to the harddisk appears possible, but requires an ms-dos partition (which I haven't gotten around to building). if I happen to get bored, I might try to get the fingerprint scanner working (but porting bioapi might be painful). haven't looked in to hdaps stuff, yet, but there are rumors about it being possible as well.

there's definitely a learning curve, but it's far from insurmountable. hopefully some of you other 50 people who have acquired Thinkpads in the last year or two will consider it :)