Lessons for information security from Multics

Bruce Schneier brings attention to a 2002 paper by Paul Karger and Roger Schell (PDF) about lessons learned from Multics security that are still relevant today, and Multicians come out of the woodwork in the comments.

Karger and Schell were part of the Air Force "tiger team" that ran penetration attacks against Multics in the 1970s. They were successful, which ultimately led to a Multics security enhancement project, the result of which was that Multics was the first commercial operating system to obtain a B2 security rating from the National Computer Security Center. I played a small part in that project, fixing some bugs and helping to run tests of Multics' Trusted Computing Base (TCB).

Wilkinson critique of framing

Blogger Will Wilkinson has posted a lengthy critique of George Lakoff's "framing" arguments that the Democrats have lost elections because the Republicans have changed the meanings of words. He cites the work of social psychologist Jonathan Haidt to offer a different conclusion:

Haidt’s research leads him to posit five psychological foundations of human moral sentiment, each with a distinct evolutionary history and function, which he labels harm, reciprocity, ingroup, hierarchy, and purity. While the five foundations are universal, cultures build upon each to varying degrees. Imagine five adjustable slides on a stereo equalizer that can be turned up or down to produce different balances of sound. An equalizer preset like “Show Tunes” will turn down the bass and “Hip Hop” will turn it up, but neither turn it off. Similarly, societies modulate the dimension of moral emotions differently, creating a distinctive cultural profile of moral feeling, judgment, and justification. If you’re a sharia devotee ready to stone adulterers and slaughter infidels, you have purity and ingroup pushed up to eleven. PETA members, who vibrate to the pain of other species, have turned ingroup way down and harm way up.

Rather than recommend that liberals fake religiosity, he offers a different suggestion:

Democrats can try to appeal to religious American voters by giving some ground in the culture wars. But it seems unlikely they will find an effective balance. There is no point conceding stuff too trivial to really matter, such as school prayer, and comically pretending to be moved by the pure and the foul. And there is even less point in nominating religiously convincing candidates who really do believe embryos have the spark of divinity, that gay is gross, etc. Socialized health care isn’t worth it.

Democrats should play to their own moral-emotional strengths, not apologize for not having different ones. Haidt’s early research on moralized disgust shows that its cultural manifestations vary. The Japanese apparently find it disgusting to fail their station and its duties. And here at home, formerly “repulsive” practices, such as interracial marriage, have become mere curiosities.

...

Democrats shouldn’t cater to and reinforce sensibilities that both hurt people and hurt the Democrats’ prospects. Religious doctrine and religious feeling can and have been trimmed and shaped over time to accommodate the full plurality of liberal society. Illiberal patterns of feeling bolstered by religious sentiments, like disgust for homosexuality, can be broken through slow desensitization, or a shift in the way the culture recruits that dimension of the moral sense. In dynamic commercial societies, this happens whether we want it to or not. But we have something to say about how it happens. The culture war is worth fighting, one episode of Will & Grace at a time, if that’s what it takes.

Liberals must understand the profundity to others of feelings that are weak in them, but shouldn’t pretend to feel what they don’t. They can lead as well as follow. And it remains true that all Americans, conservative and liberal alike, are wide awake to the liberal emotional dimensions of harm and reciprocity. The American culture war is about how thoroughly the liberal sentiments will be allowed to dominate. If a thoroughly liberal society is worth having, liberals will have to spot the points of conflict between the liberal and illiberal dimensions of the moral sense, drive in the wedge, and pull out all the rhetorical stops—including playing on feelings of quasi-religious elevation and indignant moral disgust—to make Americans feel the moral primacy of harm, autonomy, and rights. When the pattern of feeling is in place, the argument is easy to accept.

I find Wilkinson's reasoning to be sounder than Matt Nisbet's and Michael Shermer's.

Mirrors without glass

Daniel Rozin's Weave Mirror uses 768 motorized C-shaped prints in what appears like a basket weave patterned screen, each of which can rotate independently to change its shade, producing a grayscale image of whatever is in front of it.

Photos and video at Engadget.

This reminds me of Julius Popp's Bitfall, which draws images with falling water drops.

How to avoid advancing the gay agenda

Ed Brayton has an excellent post at Dispatches from the Culture Wars, from which I've borrowed the title of this post, in which he points out that anti-gay bigots like the American Family Association who want to boycott corporations that have gay-friendly policies have their work cut out for them now. The Human Rights Campaign's Corporate Equality Index has been released, and the number of companies scoring a perfect 100 has gone up from 138 companies last year (and a mere 13 in 2002) to 195 this year. Where Donald Wildmon's AFA protested against Ford Motor Company, a perfect scorer on the index, for its advertising its cars in gay magazines, they now have 194 other such companies to boycott.

Ed writes that, if you want to avoid advancing the gay agenda, you have to avoid nearly every major airline and automobile manufacturer, major retailers, most consumer products, major financial institutions, major health insurance providers, most pharmaceuticals, and even most American beer brands. As commenters point out, even some of the exceptions he lists as possible candidates don't work (e.g., Volvo is currently owned by Ford, and K-Mart is owned by Sears, and both Ford and Sears scored 100 on the index). Commenters also point out that the major technology companies that make the Internet possible are high scorers, and that the most common piece of software on mail servers, sendmail, was developed by a gay man.

Read Ed's piece for his list, and don't miss the comments.

Microsoft updates Windows XP and Vista without user permission or notification

Microsoft has admitted that it has updated nine executable files in XP and Windows on users' machines even when they have turned off automatic updates. These files are part of the Windows update feature itself. Corporate users who use SMS rather than Windows update for OS patches are not affected.

Bruce Schneier raises the question of whether this ability to force updates could be exploited by a third party. I would hope that such updates are digitally signed, so that they can only come from Microsoft, but a commenter at Schneier's blog notes that even if that is the case there is a potential vulnerability created:

There may be an attack vector, even if the updates are signed by Microsoft. The signed updates would always be silently accepted. If Microsoft ever signs an update which later turns out to be vulnerable to some attack (this has happened before with signed activeX components), an attacker could re-push this vulnerable update and introduce a known vulnerability into the target system.

Another commenter notes that this feature could be used by law enforcement to install a keylogger on a machine, if Microsoft agreed to do it.

Anti-P2P company suffers major security breach

MediaDefender, a company that attempts to disrupt the sharing of copyrighted material owned by its clients on peer-to-peer filesharing networks, has suffered an embarassing security breach--the leaking of 700 MB of emails from senior employees in the company. The leak allegedly occurred because one senior employee was forwarding company email to his Gmail account, and he used the same password for his Gmail account that he used to register for a P2P service of some kind.

This breach demonstrates the importance of adhering to corporate policies about use of external mail providers and using good password security--anything really important should have a unique password, not the same one used for accessing a variety of online websites and services.

UPDATE: It's now being claimed that MediaDefender's phone systems have also been compromised for the last nine months, and a 25-minute phone call between MediaDefender and the New York Attorney General's office is circulating, as well as a transcript. The transcript indicates that the AG's office was concerned (rightly so, apparently) about a possible mail server compromise at MediaDefender; the MediaDefender representative states at one point that he is speaking over a VoIP connection.

UPDATE: It seems the record companies are using information about P2P downloads collected by MediaDefender to make marketing decisions. Here's a quote from one of the leaked emails (quoted from SlashDot):

Subject: Nicole Scherzinger
Date: Fri, 24 Aug 2007 15:14:31 -0700

Nicole from pussy cat dolls has a single called "whatever u like". It's not selling well on itunes or playing that great on radio. A song called "Baby Love" just leaked (I don't know how long ago). Interscope wants to know if Baby Love is picking up steam on p2p. They need to make a decision by early next week on whether they should switch to this song as the single. Please get me a score comparison on Monday for these two tracks. Also, please put beyonces, fergie, gwen, and nelly furtado singles as comparisons.

UPDATE (September 17, 2007): Ars Technica has a good summary of the breach and what the leaked information shows about what MediaDefender has been up to with its video upload service (apparently designed to encourage the upload of copyrighted content as a sort of sting operation), MiiVi. MediaDefender says it was an "internal project" that was supposed to be password protected but was inadvertently made public.

CNet has a story on MediaDefender which notes:

Some of the tactics employed the movie and music industries in their fight against copyright infringement have come under scrutiny of late. The Motion Picture Assoc. of America acknowledged recently that it paid a hacker $15,000 to obtain private e-mails belonging to TorrentSpy, a company accused by the MPAA of encouraging file sharing.

The MPAA said it believed the e-mails were legally obtained.

In that case, the MPAA obtained the emails from a former TorrentSpy business associate, Robert Anderson, who signed an agreement saying that he obtained the emails legally, telling the MPAA he obtained them from an "informant." The CNet article on that controversy says that "records show" that Anderson "allegedly 'hacked' into TorrentSpy's e-mail system and rigged it so that 'every incoming and outgoing e-mail message would also be copied and forwarded to his anonymous Google e-mail account." In other words, it has some similarities to the MediaDefender case--likely unauthorized forwarding of email (though Anderson may not have had any authority to see those emails at all), and obtaining the email from a GMail account (though in the MediaDefender case the mail was obtained by someone other than the owner of the account).

Kathy Griffin's Emmy jokes and Lauren Green's historical revisionism

There has been an all-too-predictable Christian uproar about Kathy Griffin's Emmy acceptance speech, in which she said that Jesus had nothing to do with her win, the award was now her god, and "Suck it, Jesus!" These remarks are apparently being edited from the broadcast to protect Christian sensitivities.

Lauren Green, former Miss America turned religion correspondent for Fox News, wrote an article claiming that Griffin's remarks and her winning of the award were only possible because of Jesus. Some bloggers are jumping to agree with her, without recognizing how off-base her historical argument is.

Ed Brayton at Dispatches from the Culture Wars points out the historical inaccuracies in Green's article, such as this one:

Ninety-four percent of America's founding era documents mention the Bible; 34 percent quote the Bible directly.

Ah yes, that old canard, which has been debunked time and time again. The phrase "founding era documents" is quite slippery; she doesn't bother to say, doubtless because she has never read Lutz' study and hasn't a clue what it actually says, is that most of the documents in his study had nothing at all to do with the founding of the country and were in fact reprinted sermons. Small wonder that sermons contained Biblical references.

In fact, Lutz' study notes that at the time of the drafting and ratification of the constitution, 1787 and 1788, there were precious few references to the Bible or to Christianity and none at all in the public writings of any of the Federalists who were explaining and defending the Constitution to the citizens. Lutz wrote of this period in his study:

The Bible's prominence disappears, which is not surprising since the debate centered upon specific institutions about which the Bible has little to say. The Anti-Federalists do drag it in with respect to basic principles of government, but the Federalists' inclination to Enlightenment rationalism is most evident here in their failure to consider the Bible relevant.

Lutz' study clearly argues against the notion that the Bible influenced the Constitution, not for it. If Green had bothered to actually read the study, she would know that. But instead, she credulously repeats religious right talking points. Then again, she does work for Fox News, so this is hardly a surprise.

The See for Yourself blog responds to Green by taking her argument a step further:

If Jesus really did have everything to do with Kathy Griffin's award, and think Lauren Green has undoubtedly shown that to be true, then that means Jesus had everything to do with Kathy Griffin saying "Suck it Jesus! This award is my God now!" And since Lauren Green makes it clear that she finds self-effacing humor to be amusing, why is it that Lauren Green is unamused by Kathy Griffin's remarks, which is essentially Jesus' own self-effacement? Jesus is Lord of Comedy, but Lauren Green is won't scarf down his tasty communion wafer.
...
Now, I very much believe that Lauren Green and Bill Donahue and Fox News would never have said anything if Kathy Griffin had only disavowed the involvement of a 2,000 year old fictional Jewish zombie. They would have gladly ignored that, and nobody would have censored remarks on the broadcast, and Lauren Green never would have written her well-reasoned column.

But why turn the other cheek if you won't accept the inevitable re-slap? Why doesn't Lauren Green have a sense of humor when Jesus uses an irreverent comedian to make a little fun of himself?

Ed Brayton concludes his piece with the point that Christians should be offended when people make claims to the media that God or Jesus was responsible for their winning a sports event or prize--as if God plays favorites in such events--and that this is what Griffin was making fun of.

UPDATE (September 27, 2007): Bob McCarty has been claiming that the Founding Fathers made the U.S. a Christian nation at his blog in the comments, and has not approved my comments responding to some of his bogus claims. Here's the text of my second attempts to post a rejoinder:

Bob: You didn't approve/publish my previous comment responding to your Sep. 15 comment. I'll try again.

Your citation of "In God We Trust" and "One Nation Under God" as evidence of the U.S. being founded on Christian principles shows your lack of research--the former did not appear on coins until 1854 and on currency until 1957. The phrase "under God" wasn't added to the Pledge of Allegiance until 1954.

I also suggested you read more of the writings of Thomas Jefferson, including his letter to his nephew Peter Carr on August 10, 1787, in which he wrote "Question with boldness even the existence of a god; because, if there be one, he must more approve of the homage of reason, than that of blindfolded fear."

and, in a separate comment, after I remembered that I had also made this point in my first attempt:

Oh, and I also recommended that you check out the 1797 Treaty of Tripoli, which was ratified by the Congress and signed by President John Adams, which contains the statement that "the Government of the United States of America is not, in any sense, founded on the Christian religion." Tripoli violated the treaty and a new treaty was negotiated in 1805 without that language, but it is significant that both the Senate and President approved that language.

Lomborg, global warming, and opportunity costs

I've not read Bjorn Lomborg's new book (nor his previous one), but I have read enough of what he has written to suspect that some of those who are ridiculing one of his arguments don't understand it. For example, Bob Park of the American Physical Society's "What's New" writes:

Bjorn Lomborg's "Cool It: The Skeptical Environmentalist's Guide to Global Warming" is out. Well, yes it is getting warmer he finds, but aside from polar bears, it just means more beach weather. We've got bigger problems, he says. Instead of spending all that money trying to prevent warming, let's focus on making everyone rich so they can all buy air conditioners.

P.Z. Myers at Pharyngula writes:

He also has a bad argument about relative spending: he suggests that spending on climate change would reduce spending on other pressing issues, like the fight against malaria. It's a bad choice. Malaria research is already underfunded — it's a third-world disease, don't you know, one that mainly affects those tropical countries, so the wealthy western nations typically don't prioritize it very highly. We don't take our big pots of money and allocate it into aliquots appropriate to the world's needs already, so for an economist to sit there and pretend that climate research is a drain on tropical disease research is comical. Especially since he seems unaware of how one feeds into the other. Hey, if the world warms up, tropical diseases will creep northward into Europe and North America, and then we'll be fighting the economic effects of both direct effects of climate change and new diseases.

But as I understand it, Lomborg is making a simple point about opportunity costs--that money spent on climate change mitigation can't be spent on other things, and that it would be better off spent on things like fighting malaria (which I'm sure he would agree with Myers is underfunded, since it's #4 on the Copenhagen Consensus 2004 list of "very good projects" to spend money on), because the amount of benefit received for each dollar spent is so much greater.

To make the same point--I have looked into putting solar cells on my house, both to reduce my carbon footprint and my long-term energy costs, but I've decided against it because even with the tax incentives and my power company's willingness to subsidize half the cost, it's still not cost-effective. (I'm hoping new solar cell technologies will improve efficiency and lower cost so that I will be able to become less dependent upon the electrical grid). Instead, I've spent much smaller amounts of money that have had far more bang for the buck, replacing my incandescent lights with CFLs (though LEDs and other new promising technologies are on the way as better sources of light), adding insulation, and improving the efficiency of my air conditioning units through regular maintenance. These things I've done not only have an impact on my energy use and climate change, they are things which provide me with direct economic benefit as well--thus these are things that rational people will be doing independently of government regulation and spending.

Lomborg--or at least the Copenhagen Consensus--is not saying that climate change deserves no attention. The premise of the Copenhagen Consensus is that if the world spent an additional $50 billion over the next five years to address ten categories of global challenges (one of which is climate change), how would that money best be spent to provide the greatest net benefit. That seems to me to be an entirely worthy effort, and this kind of cost-benefit calculation should be given greater weight in public policy decisions. Instead, however, most politicians like to make arguments based on the assumption that any law, regulation, or government spending that saves even one life (or prevents one child from seeing something offensive) is worth doing, whether or not that generates enormous opportunity costs.

My personal behavior--and I suspect that of those criticizing Lomborg on this point--demonstrates that I don't consider climate change my number one priority. In my case, I live in a large house that uses a lot of electricity, I travel frequently by plane, I drive a car instead of using public transportation, I eat meat instead of being a vegetarian like my wife. Each of these things causes, directly or indirectly, an increase in carbon dioxide emissions over the alternatives.

UPDATE (December 16, 2008): I just came across this description of Lomborg's overall behavior with respect to the climate change debate, which I think is likely accurate.

Boob Scotch

Last night, Einzige sent me an email (which I opened this morning) pointing me to a video of a song by Bob Log III called "Boob Scotch" (NSFW). Bob Log III is a guy who performs wearing a motorcycle helmet, singing through a telephone microphone, and simultaneously drums and plays guitar. The sound was very familiar, reminiscent of a band I saw perform at the University of Arizona Social Sciences Auditorium back in 1994 called Doo Rag. As it turns out, Bob Log III was half of Doo Rag, the guy I remember singing through a vacuum cleaner hose.

The other bands who performed at UA that day (April 30, I'm a bit obsessive about collecting information) were Formica Bob, A Band Called Moss, Teeth, Click, Cortex Bomb, Irving, The Lonely Trojans, and the Fells. I was there with my friend Pam, who knew people in Irving and The Lonely Trojans, the latter of which included a student, Chris Morrison, from one of my philosophy classes, who's now using the name "C.S. Morrison" for his music, probably due to the large number of other musical Chris Morrisons.

Pam's two friends in Irving were Greg Petix and Gerard Schumacher who were also in the Lonely Trojans. The two went on to form another band called the Weird Lovemakers, and Gerard still has a band called The Knockout Pills.

Wikipedia seems to have way too much information about Tucson bands... I just learned that Schumacher was also in The Fells and intends to return to Australia this year, and that Petix formed a band called The Cuntifiers (no albums released yet).

Internet People

Dan Meth's song and animated tribute to virtually every major viral video of the last several years.



UPDATE (September 30, 2007): Rumors Daily has tracked down links to the videos referenced.