30 years of Computer Security Research Swept under the Rug

Posted on

I was in a meeting discussing minimal security for a home network application. The question on the table was whether the family users need or want separate identities when interacting with network devices.

Thinking about it, it seems like taking the computer security model (e.g. you log onto to your work station) and apply it to generic devices that are on the network seems silly. For example, do you log into the refrigerator or the toilet if it happens to be networked (a.k.a. living in Hong Kong)? This seems stupid but these devices monitor the user’s health. How can they do that without the current user being identified?

From 30 years of computer security research and even more of non-computer security work, identity is required for security. But I think this identity is really only a tag for a set of privileges and does not necessarily need to be a single individual. I do think that for security of large group of people you need to identify each person (or more accurately each login should be given to only one person) but I believe for most families this is not necessary in general and in general identity is more a feature enabler (i.e. your toilet tracking your individual hydration and telling you to drink more water) than a set of privileges. The set privileges (e.g. watching a rated R movie) can be accessed by people who prove they are in the adult group by knowing the adult password.

To that end here is patent that seems to use the remote control to identify the TV viewer: link

Maxwell’s Demon

Posted on

There is a box that contains two chambers each containing gas molecules at the same temperature.  A demon controls a door between the two chambers.  He opens it if in the right chamber he sees a particle moving fast right to left or if he sees a particle in the left chamber moving slow left to right.  Over time, the left chamber is hot and the right chamber is cold.

The problem is the entropy of the system supposedly didn’t increase — it decreased!

Maxwell presented this scenario in the 1800’s and it took physicists like a hundred years to figure it out.  Supposedly, the amount of entropy in the system increased when the demon “forgets” about each particle that he is tracking.  There is this whole theory of reversible computing where the computation takes no energy but the clearing of registers takes energy and produces entropy.  The demon acts as a irreversible state machine consuming energy and increasing the entropy of the system.  (Not that all this makes sense to me as I have forgotten almost everything I ever knew about thermodynamics).

Donut Saturday

Posted on

We take G to get donuts once a month or so.  Last week, G looked at Cindy and said, “Saturdays should be donut day because getting donuts more than once a week is too much.”

My Google Gaggle

Posted on

D and G bought a webkinz. Or more made me buy myself a webkinz. I bought a google. His name is Bert.

All the other googles follow Bert and Bert does exactly what I say and makes all the other googles in the gaggle worship me. (A gaggle is the name D came up with for a group of googles — its weird that other people use the word for the same thing).  I use my google followers to run the house sending them off to peck and nag children into cleaning up the house. Its really cool.

The googles stay in shape by exercising with Cindy. When she gets out her yoga mat, they run to the china cabinate and grab their mats (place mats). Here is a picture of Cin trying achieve some sort of zen state in our home environment.

Its hard for the googles to keep up sometimes.

Exponential Fairy Growth

Posted on
A Few Fairies

G believes, really believes, that if she draws a fairy on a piece of paper its alive. Its hard to argue with her about it because, if you leave a blank piece of paper next to the fairy, it writes a note.

One time someone left a glass of water on the “art” table and Dot, our cat, tried to drink out of it. Dot knocked over the glass spilling water on several fairies — drowning them! G started to chase dot with a bat yelling “MURDERER.” We caught her before she finished Dot off.

Grieving, she put the soggy fairies in the hospital under a death watch. They recovered (dried) and are in occupational therapy now. However, I don’t think they will ever be the same.

Fairy Writing Contest

After seeing that her entire fairy population could be wiped out by one small disaster, G focused and made more and more fairies. The fairies started to fall behind in the note writing so she held a contest. The fairy that wrote the most words won a gold star and the privilege of accompany G to her guitar lesson last week.

Fairies Watching TV

Now when we watch a movie, G has to spend 30 minutes setting all the fairies up to watch.

Bad Guys

Posted on

G looks at her sister D. D sits eating quietly. As always, D’s emotions are within 1 mg of critical mass. G looks down, she’s bored and her Mom hasn’t appreciated her in the past hour.

G turns back to D and says, “The good guys in my room are going to drink a potion that makes its so they never die.” This breaks the rules, disturbs the balance between good and evil in G’s room and adds 0.00000001 mg to D’s emotions.

It took 20 msec for D to fission. G broke a rule and changed the “good guy, bad guy” game. She can’t do this. D attacks G, screaming and crying.

Complex Numbers I

Posted on

[latexpage]

I have been trying to read Penrose’s

    Road to Reality

. He spends a lot of time talking about complex numbers.

Nature uses numbers that contain the square root of -1.

$$
i=\sqrt{-1}
$$

Any number can be expressed as:

$$ x=\Re(x)+i\Im(x) = a+ib $$

In a limited way, complex numbers are 2 dimensional. Some guy defined the “Complex Plane” where the y-axis is the imaginary part and the x-axis is the real number line. Numbers can be plotted on this plane. The numbers can be expressed in polar coordinates:

$$ x = |x| e^{i\theta} $$

where:

$$ |x| = \sqrt{a^2 + b^2} $$
$$ \theta = \tan^{-1} \left( \frac{b}{a} \right) $$

I learned about these numbers in circuit and electromagnetics courses at A&M. A signal that varies with the sine of the frequency time the time can be expressed as the real part of a point in the Complex Plane with a fixed value (distance from the origin) rotating about the origin at the signal’s frequency.

Lesson III – Praise twice, criticize once

Posted on

Praise the stuff you like. Treat it like a bank. For every 2 praises, you get one criticism. If you are a natural asshole like me, try for a 5 to 1 ratio to make up for all the times your nature causes you to forget this rule.

This works really well for kids too, but I am even worse at remembering with kids.

Lessons II – Cycles

Posted on

Cycles. In work, you have to have races, projects, sprints, releases, whatever. You can’t just have people slogging day in day out towards nothing. Success for the cycle has to be defined and success must be achievable without comprising your team’s life outside of work. (This is just like any good physical training program – you break up your training into work outs with a goal for each workout – I don’t do this with training because I am a lazy fat butt).

If your team is good, they will set the success criteria higher than is really doable in the time frame of the cycle. They will work harder than 40 hours a week because they set the goal aggressively and they want to achieve their goal.

Always saying that the team sucks and should do more faster results in a team that sucks and should do more faster. Setting the goals and time lines for the team results in a team that can’t set its goals and never meets its time lines.

Don’t do work for your team and don’t micromanage. If you do this over and over, you are in a death spiral. When they don’t deliver, talk plainly about the missed matter and the consequences of it and ask them why it will be better next time. If you win but no one is there with you at the finish line, you aren’t going to win again.

Lessons I – Agreements

Posted on

In 1997 (or 96), I was sent to a management assessment program. This consisted of 2 days of mock exercises where my management aptitude was assessed. After the class, I went over the assessment with one of the programs coordinators.

One exercise involved me convincing a manager in the operations department to sign onto a program I devised. During the mock negotiations (while being video taped), I managed to convince the manager to sign onto the program (or at least nod towards the program). At the point of the first agreement, I quickly (almost breathlessly) ended the meeting.

I lost points because I didn’t summarize the agreements at the end of the meeting and make sure that the manager was really agreeing with me. Its important to address agreement and disagreement directly and plainly. If the other party doesn’t understand what they are agreeing to or they don’t really agree, it does not count. 3 weeks down the line, they will act as if the agreement never happened.

Even if you are a lawyer and its a signed contract (unless you are out to screw the other party), it matters that the other party really understands the agreement.  I wonder how much of the current credit crunch could have been avoided if the loan givers had made sure the borrowers understood the terms, conditions and consequences of the loans they were selling.