All day orientation

It's going to be a long day at work today. I have an all day Orientation briefing. With the sleep debt built up from Sunday, I'm going to have a hard time staying awake. It might take some caffeine, or even standing in the back of the room. I'm not sure of the benefits of 4 hour briefings to cover material that has already been learned though being on the job. Different people learn in different ways, and long meetings just chew up productive time to attempt to teach at a slow pace. I much prefer high-speed information delivery at a pace I can control, like CBTs. The only use for in-person training is when we have a two-way street with the instructor.

Commuting Sucks

Did I mention that commuting sucks? I leave the house and get to work an hour and a half later. Part of my commute is on the metro which, while cleaner than some other cities, is sometimes a pretty smelly endeavour. Most of the time is spent on the train, but I still 'slug' a ride into the city as an HOV extra. This has saved me a good deal of gas money, and makes the commute shorter than it could be. Still, 3 hours of my life just to get to/from work. I've had to cut down on my gym workout just to fit it into my day. And commuting isn't just time, it's boring. If it was at least just one mode of transport, I could sleep..but that's a bad idea when you could miss your stop.

Of course, I've plenty to fill the time with. This blog post is a good example, written on the third leg of today's journey, and posted to my blog via email once we get to a cell coverage metro stop. I also have my CISSP credits to catch up on. At this rate, I'll be ahead of the curve for next year.

Worked on Sunday

It's been a while since I did a weekend system maintenance thing - It's interesting working technical stuff again - I had prepared a script and some patches for a VMWare patch set (VMWare ESX 3.5) to run this weekend, and put them in the /tmp directory on the host. So, I logged in to run the script and 'WTF!!!', the patches and my script were gone....who would have deleted my stuff? I questioned the two suspects that I work with ("Little Red" and "Mr. Laid Back"), but neither of them were the culprit. I had to go and download the patches again and go through and make sure I installed them in the right order (only to mess up the file names while I was doing that, which Red caught for me).

Later I went online and found this post [cached from Google]. For all the things that we know, there is so much in IT that we don't, and it's the details that will get you. Not a big deal this time - just some added time but I'll be changing where I put that script in the future.

Firing Line

Went to the range today..It was fun teaching my wife and son to shoot. We fired a rental pistol, .22 caliber - just to get familiar with the weapon and the feel of firing a pistol. I'm not bad with a rifle, and this weapon is not much different. The pistol sights were badly off. I had fairly good grouping, even out at 20 yards, but the left-right sight adjustment needed to be tuned, A LOT! Rather than adjust it, we lived with it and just aimed left, but at 20 yards, I was aiming completely off-target just to hit the center of mass.

I also shake badly. With a pistol, and firing at the range, I'm not familiar with more stable positions, so we were firing double-arms up, cross-body or straight on. The shake made it nigh impossible for me to have any kind of sight alignment. :wiggle:wiggle:wiggle:

But, we had fun. I shot off probably 150 rounds today and my wife and son about 50 and 100 each. I took them each separately to keep my sanity. It's nice that the range is so close by.

4 NAND Gate design of an XOR Gate

I bought a few books lately on Amazon - one of them is The Elements of Computing Systems: Building a Modern Computer from First Principles - at the end of Chapter 1 it asks you to design all the gates you're going to use starting with primitive NAND gates (but you can use gates you've already designed). I started reading the book because I wanted to more deeply understand assembly language, which I'm trying to pick up again.
In designing the gates, I think I'm taking the wrong approaches, because my designs are not as minimalist as they could be first out of the box. When I designed my OR gate, my first design used 3 NOT gates (basically one NAND gate with the inputs tied to one pin) and an AND gate (2 NAND gates). That design, when I drew it out - it was immediately obvious that I had two redundant NOT gates (as the AND gate ends with a NOT gate), showing me that the correct design is 3 NAND gates for OR.
The doubts are starting to creep in - my first attempt at XOR design came up with a non-symmetrical drawing of 6 NAND gates (based on the logic of using one OR and one NAND and ANDing the result). Looking on the web, though, 4 NAND gates are needed, not 6, and looking at my design, I still can't SEE the redundancy. I'm hoping that something will click and I'll keep staring the problem down until I really GROK where that redundancy is...perhaps I'll go redraw my original circuit symmetrically and that will help.

Stop Assuming Security

Let's all just stop pretending that our connected applications and networks are secure. I mean, it, just stop it already. I don't care if you're PCI Compliant, use SSL with AES encryption and SHA-2 hashing algorithms. You can have IDS in place, and a 24-hour monitoring system with armed guards and Predators with hellfires ready to rain down fire on anyone that dares ping your DMZ. You're not secure....and you never will be.

Instead of approaching system security from the system side, we need to look at why the security is in place and begin architecting one-way data funnels into our connected systems. Once I've processed your credit card transaction, why do I have to continue storing your card on a connected data system (or store it all - but that's a different discussion). If I need to store vital information about my customers, the data system I do this on shouldn't be connected to anything, and it certainly shouldn't be accessible to any system connected to the Internet. System architects need to take much of the blame for system vulnerabilities because of the system design itself. Data is stored too close to the Internet, and easy and cheap interfaces like ODBC connections to our internal databases are too often shortcuts taken for saving money on development of single-use one-way data connectors.

In fact, system developers need to be woken up to the need for development of low-capability software, and how this software can play a vital role in secure system design. Why don't we see write-only database connectors on the market? How about packaged systems that have limited functionality (no-database read-only web server systems)?

We need to automatically assume that whatever multi-use software we are using is insecure and start limiting our exposure to vulnerabilities by removing capabilities that we don't want from our designed systems. When (not IF!) those vulnerabilities are discovered in our systems, the exposure risk will be limited to the capabilities of the software (and maybe the hardware!?!) that we use in designing the system. If the system is incapable of writing to the disk system at all, then when it gets hacked, the vulnerability won't expose the risk of writing data. If our customer service page gets hacked, if the page has no capability for querying the database through the one-way 'deposit-only' data connector, then the exposure will just be that they can write junk to our database. If our database is incapable of running shelled commands, they won't be able to do so.

Perhaps it's time for security analysts and software security architects to get religion...Luddism

Something that always bugged me about Statistics/Odds

Let's say that your odds of winning the lottery are something like: 1 in 23,000,000 - There seems to be a view that if you buy two tickets that your odds are now 1 in 11,500,000. But here's what bugs me about this.....and leads me to think that reducing odds fractions (2 in 23 million) is nothing more than a lie when it comes to talking about odds.

A random sample of 11,500,000 tickets has a 50% chance of containing one of your two tickets. Independently for each one. Your odds in that random sample of 11.5million tickets may be one of the following:
0 in 11.5mil (25% chance)
1 in 11.5mil (50% chance)
2 in 11.5mil (25% chance)

If you buy 11.5million tickets, your odds reduce to 50%, or 1 in 2 - but there's still a chance that if you pick 2 tickets from the 23 million tickets that one of them isn't yours....
0 in 2 (25% chance)
1 in 2 (50% chance)
2 in 2 (25% chance)

And once you've picked the two tickets - and then pick the winner.....
100%*25% (2 in 2)
+50%*50% (1 in 2)
+0%*25% (0 in 2)
Totals to 50% overall for the drawing, but the majority of that remaining 25% is when the '2' in your 1 in 2 chances don't contain any chance of you winning whatsoever.

Reducing odds from 2 in 23million to 1 in 11.5million seems to me to be a form of self-delusion...

Unfinished Posts, Random Thoughts and Life

Time - the one thing that I cannot obtain more of - as I fill my life with pursuits, time quickly runs out. Working out every day feels great, but it soaks up a full hour and a half each day. Of course, if it adds years to my life, I can imagine that it's worth it. I'll have to go and do the math on that....Let's see - a year of working out is about 365*1.5 = 547.5 hours - would need to extend my life by 23 days to be worth it. Yeah - I can see that working out in the end. Of course, if I get hit by a bus tomorrow, I'll just leave a prettier corpse.

Random Thought: Is the equal sign ruining our science curriculum

(This is the unfinished post - some day I'll get back to it)
1...2...3...4, 4 sheep, mwa-hahaha! We all remember the Count from Sesame Street. From him, many of us learned the set of natural numbers up to about 12. From there, we entered the public education system. Around about 2nd or 3rd grade we learned that numbers go higher than 20. Soon after, we learned about more integers, including negative numbers, and so on, being introduced to rational numbers as we learned about division and complex operations such as square roots (or, if you were really lucky to have a good schooling, logarithms). Perhaps you were even introduced to different base numbering systems. In all of this, we were conditioned that the right way to count things was to use integers and rational numbers. And we learned mathematical operations using the = sign to denote equivalency.

But, does the universe really work like that? Are we spending any time on mathematics as it applies to irrational numbers, and should we? (As an aside, I also hate writing with questions that I don't intend to answer - but it's the easiest way to throw down thoughts.)

I've been giving thought lately, probably due to some of my recent reading (The Drunkard's Walk by Leonard Mlodinow) and some of my work over the past year with basic statistics and metrics, to how the world is put together and operates. I've always been peripherally interested in the sciences (specifically physics but with chemical and electro-mechanical applications), and of course the debate over universal law. The thought here is that the world doesn't really operate using rational numbers at all.

Think about it, Pi isn't rational. We use pi in engineering to calculate structural ratios, but we don't really use the whole thing because after a while, an approximation is close enough for us.

Dear Jeff Bezos - Why Didn't You Say So?

Why didn't you tell us this the first time? I bought a Kindle 1 and I love it. I take it with me on my commute and read the daily news on the way in while listening to some 'wake up' music. Why, just this morning I was trying to download my newspaper from a website that kept failing and eventually locked up my Kindle 1. I was so happy to be able to pop out my battery to reset the device (Had I had a Kindle 2, what would I have done?) . Sure, I've never had to reset a book - but a book didn't download my news over the air for free every morning.

So, yesterday I'm reading on my Kindle that the one thing my device is missing is coming to a new device, the Kindle DX. What is that feature? Why, native PDF support, of course! Had I known that my device didn't REALLY support PDF, but a lousy conversion service that does a sucky job at best, I would have waited. Why didn't you just say so in the ad for the Kindle 1? Why didn't you write 'Not Really Supported PDF, but you could wait for the next version which really will support it'. I wouldn't have had a problem with the extra $100, really. I got mine at a discount thanks to MSN, anyways. After saving $85, I could afford the extra dough.

So now I sit here with my Kindle 1 and my $85, and I'm trying to figure out just how I'm going to sell it for enough to trade it in for the Kindle DX. Hey Jeff, how about a trade in program?