Perilocity

Media Security: Consolidation or Diversity?

Despite unanimous vote of the Senate Commerce Committee to delay, and direct question from one of its members, (not to mention overwhelming opposition in meetings across the country), FCC Chairman Kevin Martin plans to go ahead with the media consolidation vote scheduled for tomorrow, 18 December, which, given the 3-2 Republican-Democrat makeup of the Commission, will almost certainly result in more media consolidation.

Not only John Kerry, but even Trent Lott and Ted Stevens spoke against Martin's plan. Martin, pretending not to know that newspapers are one of the most profitable industries (and nobody on the Commerce Committee thought to ask him directly whether he knew that; they only asked him if he had seen a specific report that said that), claims that the only way to save newspapers is to let them buy television stations. The New York Times published Martin's op-ed to this effect. (Today the Times did at least publish their own editorial criticizing his position.)

Meanwhile, three members of the House Judiciary Committee have written an op-ed calling for the impeachment of vice-president Cheney, and no major newspaper will carry it, even though one of them, Wexler of Florida, collected more than 50,000 names for it over one weekend (up to 77,000 as of this writing).

Were it left to me to decide whether we should have a government without newspapers, or newspapers without a government, I should not hesitate a moment to prefer the latter.

— Letter to Nathaniel Macon, Thomas Jefferson, January 12, 1819

What would Jefferson have thought about newspapers that wouldn't publish a call for impeachment by members of the committee that is supposed to bring such charges? And why, given such a press, is anyone even considering more media consolidation? Which is better for the security of the Republic: more media consolidation or less?

-jsq

What It Will Take to Win

IT and Internet security people and companies act mostly as an aftermarket. Meanwhile, the black hats are a well-integrated economy of coders, bot herders, and entrepeneurs. This is what it will take for the white hats to win:

It can seem overwhelming for security people who are typically housed in a separate organization, to begin to engage with software developers and architects to implement secure coding practices in an enterprise. While the security team may know that there are security vulnerabilities in the systems, they have to be able to articulate the specific issues and communicate some ideas on resolutions. This can be a daunting task especially if the security team does not have a prior workign relationship with the development staff, and understand their environment.

...

The task seems daunting also because there are so many developers compared to security people. I am here to tell you though that you don't have to win over every last developer to make some major improvements. In my experience a small percentage of developers write the majority of code that actually goes live. The lead developers (who may be buried deep in the org charts) are the ones you need to engage, in many cases they really don't want to write insecure code, they just lack the knowledge of how to build better. Once you have a relationship (i.e. that you are not just there to audit and report on them, but are there to help *build* more secure code) it is surprisingly easy to get security improvements into a system, especially if the design is well thought and clearly articulated. You don't have get the proverbial stardotstar, each and every developer on board to make positive improvements, it can be incremental. See some more specific ideas on phasing security in the SD! LC here. In meantime, with security budgets increasing 20% a year, use some of that money to take your top developers out to lunch.

— Secure Coding - Getting Buy In, Gunnar Peterson, 1Raindrop, 17 Sep 2007

The start of what it will take.

-jsq

Bill Gates Considered as Evil Primitive Bacterium

Has Freeman Dyson become an evolution denier?

Whatever Carl Woese writes, even in a speculative vein, needs to be taken seriously. In his "New Biology" article, he is postulating a golden age of pre-Darwinian life, when horizontal gene transfer was universal and separate species did not yet exist. Life was then a community of cells of various kinds, sharing their genetic information so that clever chemical tricks and catalytic processes invented by one creature could be inherited by all of them. Evolution was a communal affair, the whole community advancing in metabolic and reproductive efficiency as the genes of the most efficient cells were shared. Evolution could be rapid, as new chemical devices could be evolved simultaneously by cells of different kinds working in parallel and then reassembled in a single cell by horizontal gene transfer.

But then, one evil day, a cell resembling a primitive bacterium happened to find itself one jump ahead of its neighbors in efficiency. That cell, anticipating Bill Gates by three billion years, separated itself from the community and refused to share. Its offspring became the first species of bacteria—and the first species of any kind—reserving their intellectual property for their own private use. With their superior efficiency, the bacteria continued to prosper and to evolve separately, while the rest of the community continued its communal life. Some millions of years later, another cell separated itself from the community and became the ancestor of the archea. Some time after that, a third cell separated itself and became the ancestor of the eukaryotes. And so it went on, until nothing was left of the community and all life was divided into species. The Darwinian interlude had begun.

— Our Biotech Future, By Freeman Dyson, New York Review of Books, Volume 54, Number 12 · July 19, 2007

Has he sold out for an admittedly very fetching simile?

Precision Can Hide Accuracy

Metrics are good, but just because they're precise doesn't mean they're useful:

I’ve been thinking a little bit about “threat/vulnerability” pairing. You know the drill, go out, get a scan - match the scan data to existing exploits, and voila! You’ve got risk.

Now regular readers and FAIR practitioners know that I don’t believe this exercise gives you risk at all. In fact, in FAIR terms, I’m not sure this exercise does much for finding Vulnerability.

My Assertion To You: The industry loves T/V pairing because it is precise. It looks good on paper, and if you’re a consultant doing it, it looks like you’ve earned your hourly rate. We love The precision of T/V pairing gives us a false sense of accuracy.

— Accuracy, Precision, And Threat/Vulnerability Pairing, Alex, RiskAnalys.is, 23 July 2007

He goes on to point out you also need to consider who's likely to attack you, as in such Threat Agents, as he calls htem, may be too stupid to use a given exploit, or too smart to use it because they've got a better way. He recommends some statistical analysis to help out.

I'd also recommend more basic steps, such as not using IE and shifting away from other monoculture software until you've got a mix of software from different sources. Those things will usually get you in trouble with sales and marketing, however, because hey, they've never had any problems, well, not many, and it's not their job to fix them. The precise thing isn't necessarily the right thing.

-jsq

European Firefox

Here's some good news. Firefox market share in Europe is almost 28% according to XitiMonitor. In Germany it's 38%, and several other countries have higher usage. Opera is at 3.5% and Safara is at 1.7% in Europe.

I'd be more pleased if it was a quarter each by three different browsers, with half a dozen others taking the other quarter, but this is much better diversity than 98% IE.

-jsq

No Word?

Got my hopes up on this one:

It appears that Science, the journal of the America Association for the Advancement of Science, itself the largest scientific society in the world, has updated its authoring guidelines to include advice for Office 2007 users. The news is not good.

"Because of changes Microsoft has made in its recent Word release that are incompatible with our internal workflow, which was built around previous versions of the software, Science cannot at present accept any files in the new .docx format produced through Microsoft Word 2007, either for initial submission or for revision. Users of this release of Word should convert these files to a format compatible with Word 2003 or Word for Macintosh 2004 (or, for initial submission, to a PDF file) before submitting to Science."

— SCIENCE PUBS REJECT ARTICLES WRITTEN IN WORD 2007, by Rob Weir, Rob Weir Blog, Thursday, May 31, 2007

And here I thought maybe they were rejecting Word entirely. Ah, it could happen. Most papers in physics, mathematics, and computer science journals are already formatted in TeX, if I'm not mistaken. So there is some diversity in publishing software; it's not all a monoculture.

Meanwhile, the main reason Science rejected Word 2007 is that it is not backwards compatible with previous versions of Word, thus illustrating the Microsoft dilemma: stick with the old and retain customers, or fix problems and lose some. Not so big a dilemma with Word, perhaps. How many submittors to Science are there, as compared with business Word users? But much more of a problem for security fixes that require breaking backwards compatibility.

-jsq

Black Swans, the Internet, and Renewable Energy

A recent post about Bob Metcalfe's FOCACA proposal led to some comment discussion. What does it take to produce innovation, in renewable energy, or the Internet (or more likely in both interacting)?

Let's ask John Robb, the military stategist:

Here's how. Warfare in our current complex environment (as opposed to the last century and earlier) is very similar to the areas of science/finance where stochastic processes dominate. Since stochastic dominance implies a high level of randomness in outcomes, tinkering networks (ie. open source insurgencies) tend to generate substantially higher returns on effort than highly planned activities (ie. nation-building).

Stochastic tinkerers and warfare, John Robb, Global Guerillas, Monday, 01 January 2007

Hm, that's almost like the bazaar instead of the cathedral.

Mono-EU

Microsoft wants a clear green light from the European Commission before releasing Vista, but the EC is saying it isn't going to do that; rather, it's up to Microsoft to behave ongoing, according to EC spokesman Jonathan Todd:

The main rule for Microsoft is to ensure that the market allows competition between security providers on the merits of their products, Todd said. "If business and home users are deprived of choice, a security 'monoculture' based on Microsoft products may lead to less innovation and could harm all computer users. Security risks could increase, and not decrease," he said.

Vista's European battleground As the slippery due date draws near for the Windows release, Microsoft and the EU are now at odds over security features. By Joris Evers, Staff Writer, CNET News.com, Published: September 18, 2006, 4:00 AM PDT

I wonder how much effect Dan Geer's report of 3 years ago had on the EC's awareness of this issue?

-jsq

Local IPTV

Cringely harps on something I've been saying for a while, too:

The Internet television story, even as written here in columns going back as far as the late 1990s, pushed the idea of enabling the aggregation of widely-dispersed viewing audiences, allowing programming to thrive that might not be successful on any local station, much less on the national network. A good example is NerdTV, which wouldn't attract enough viewers on most PBS stations to even generate a rating, yet when offered as an Internet download, drawing from a global population, makes some pretty good numbers. But there is no concept called “local” in this aggregation model, so stations tend to feel threatened by it; if the network can reach local viewers directly, what need is there for a local station?

But it doesn't have to be that way, because the supposed strengths of centralization aren't really strengths at all when viewed in terms of the much more imposing issue of bandwidth costs, where all the advantages are local. Local Heroes: Could the Key to Successful Internet Television Be...PBS? By Robert X. Cringely, PBS, June 8, 2006

What about the opposite of NerdTV? Local football!