Today, I purchased on open-box Mac Mini. I have never owned a Mac. I am, however, an experienced computer user. I have used, at one time or another, many operating systems from the Timex Sinclair and the TRS-80's OS to the Windows and Linux(es) of today. So, I am unafraid of different experiences. And for one use case that has been itching in my mind, I need a Mac to do it right. That use case, my friends, is iPad development.
Now, it has been a long time since I have really slung code. My last real coding (aside from some VB automation inside Office) was C code development for a MUD (one of those text games that no one plays anymore, but a few sick and devoted people still play). [FoxMUD if you care to check it out.] Any-who - the development itch is one that never really goes away, and in my current role as Enterprise Architect, I don't get to do much coding. I'm more concerned with processes, products, alignments to reference models and trying to make sure I stay ahead of the customer in the daily fire drill. So, last night I watched "The Social Network" and the itch started up again - poor Mark Zuckerberg - so misunderstood. To hell with being rich - it's not the money - it's the idea of doing something REALLY FUCKING COOL...that's what I miss about programming - doing something no one's done before with a piece of code. Introducing new capabilities in software and having the users go 'oooh, ahhh' and 'Can you make it do this....too?'
Well, as those of you who know me, know....I have a new iPad 2. And it has some apps that I like, and others I think can be improved on. And I'm impulsive...and the mac mini was on sale because it was an open box...and here I am writing this first blog post. I'm going to write about my experience changing over to the Mac OS, and my foray(s) into xCode.
So, Day 1 - Realize that the open/close window buttons are on the left, not the right. Also, pushing the red 'X' doesn't actually QUIT the application - had to restart Safari to install Flash (GOTTA HAVE MY CITYVILLE FIX) and closing it/opening it didn't work after installing the plug-in.
Am using a two-button/scrolling mouse - my favorite one - don't judge - Apple purists will tell me that it's a crutch - but I still have to use two-button mice all day long, so this will ease the transition - besides - this way I don't have to buy a second mouse - I just reuse what I've got for my laptop.
After installing Safari, was suffering from seizures due to the monitor flicker - looked up in Help how to change Display Settings - STILL have no idea how to get to Displays preferences through any normal means - because I just opened it straight from the Help - have seen this in Windows Vista help too - and I thank whoever invented the Application shortcuts built into help files....changed monitor to 1080p instead of 1080i and flicker is GRATEFULLY gone.
Next step will be to fully register for Apple Developer and get xCode....will blog later.
April 27, 2011
It's Behind a Firewall
Between my neighbor's house and mine is a firewall - an actual firewall, not a computer thing, but a wall that is designed to prevent fire from spreading from his house to mine. The wall is there to protect both of us from the cross-risk of someone having their house on fire. This is obvious by the name 'firewall'. The computer domain has taken the name of this engineering construct and uses it to describe a virtual wall used to protect one network from another. Unfortunately, it has become, to the uninitiated, a term that describes some kind of absolute security.
Just because there is a firewall between my neighbor's house and mine, I am still not free to set my house afire. I would still be liable for any damages this might cause my neighbor. Similarly, I would be remiss to install substandard electrical wiring, or (according to my HOA) have a barbecue grill that uses charcoal, rather than gas. Yet, in the parlance of computer networking, it has become vogue for some parties to address security concerns of cross-domain risk with 'It's behind a firewall, so there's no risk'. Even when the sentence is uttered without those last four words, they're usually contextually assumed.
This is just wrong. Just because you have a firewall does not mean that the system you're installing behind the firewall presents no potential risk to the Enterprise. Each and every system comes with built in risks, and not only are firewalls INTENTIONALLY porous, but they're only good at preventing very wide-ranging risk. They're of virtually no use when attacks come in through the holes you've punched in it, or when you bring the risks in with you around the side (through the back-end or through a sneaker net).
One of these days, someone is going to say 'No worries, it's behind a firewall' and I am going to physically pull out a lighter and set them on fire (ok, not really, but I'll think about it).
Just because there is a firewall between my neighbor's house and mine, I am still not free to set my house afire. I would still be liable for any damages this might cause my neighbor. Similarly, I would be remiss to install substandard electrical wiring, or (according to my HOA) have a barbecue grill that uses charcoal, rather than gas. Yet, in the parlance of computer networking, it has become vogue for some parties to address security concerns of cross-domain risk with 'It's behind a firewall, so there's no risk'. Even when the sentence is uttered without those last four words, they're usually contextually assumed.
This is just wrong. Just because you have a firewall does not mean that the system you're installing behind the firewall presents no potential risk to the Enterprise. Each and every system comes with built in risks, and not only are firewalls INTENTIONALLY porous, but they're only good at preventing very wide-ranging risk. They're of virtually no use when attacks come in through the holes you've punched in it, or when you bring the risks in with you around the side (through the back-end or through a sneaker net).
One of these days, someone is going to say 'No worries, it's behind a firewall' and I am going to physically pull out a lighter and set them on fire (ok, not really, but I'll think about it).
April 20, 2011
DropBox, Security, Encryption, FIPS 140-1 and Illusions
Lately there has been some brouhaha on the Interwebs about the lack of proper security on the DropBox application. Users are rather incensed that they were told their data was securely encrypted, only to find out later that the encryption keys themselves were store in the databases at DropBox in a recoverable manner.
One of my pet peeves is when people ask me whether a product is FIPS 140-2 compliant. The question is so specific, and means one very specific thing is implemented correctly, the algorithm that implements the AES encryption and decryption activity itself. However, the question does not touch on whether or not the implementation of that encryption is done correctly. FIPS 140-2 compliance is something I would expect any graduate programmer to be able to accomplish in an implementation of AES.
What is missing is the secure implementation and design of the product that utilizes the AES algorithm, most notably the secure implementation of the key storage. For simplicities sake, imagine that AES is a specification of lock mechanism and encasement. When you lock up your secrets in this encasement, it is protected by one thing - the key. Where do you put the key to protect it? How do you share the key with others who may need it? How do you store it in a place that you can get to it from whatever device you're accessing it from, including the web and mobile devices.
Users of Dropbox made an assumption that the security of the encryption key was secured by the password that protected their Dropbox account. I, myself, made the assumption that Dropbox uses an algorithm such as PBKDF2 to create the key to protect my files at Dropbox. Of course, there was a point that I missed - if Dropbox were to do this, my files would be unrecoverable if I ever forgot my password. And obviously, some engineer at Dropbox had figured on this as well, because Dropbox can do password resets while my data can still be recovered. And thus, the slippery slope begins....security weaknesses introduced to account for the weakness of the weakest link.....the fallibility of the user. Dropbox implemented a solution whereby they store my key for me rather than make it unrecoverable. SHOCK!! DISMAY!! There's even more to the story, because other compromises were made as well in the interest of convenience, according to other accounts I've read, including generating unique security keys for each device that allowed them to authenticate to my dropbox without even my current password. This last piece, I don't even see as 'user-convenient' because it puts the onus on the user to remember to lock out any device that they've lost control of (and they may not even know they've lost control of the device!!).
The illusion of security in products that the mainstream uses is often touted as secure and covered with all kind of marketing like 'FIPS 140-2 Compliant'!! However, the reality is that true security will always get back to the security of the key. If you want to evaluate the true security of a device or a security implementation, there's a simple checklist the consumer can ask himself when buying the device:
1. Identify the 'key' that gives you access to your stuff.
This could be a password, a 'smart card' or a SecurID token.
2. Can I store my key to allow me to access without asking me every time?
The answer needs to be NO. If your devices store your key without you having to enter it (or provide something external like a secure token), the key isn't really the key, or it's replicated in the implementation. You don't want copies of your key being stored.
3. If I lose my key, is there a mechanism for me to recover my key that does not require another, perhaps more secure, key?
The answer needs to be NO. The key needs to actually be a part of what is needed to unlock the lock. If you can lose your key but still access the data later without it, it wasn't really the key - it was a token to get your key. Key Recovery is a whole practice in and of itself. Sure, we can encrypt and store your key info - but now we need to make sure that's locked up just as tight, if not tighter than the original data.
4. Can key recovery be done without my participation (providing the more secure key)?
The answer needs to be NO!! Again, if your data can be unlocked without you providing the key or an alternate key - it's not really the key at all! It's just a laundry ticket to pick up your key.
Those four questions are a good start - and there's even more to think about for advanced users (e.g. Can the key be used on the data without the system itself?)
Don't fall for the illusion - ask yourself these questions to get a feel for how secure your 'encrypted' data is. Then ask yourself which you want, convenience or lock-it-up-and-swallow-the-key security. If history is any indication - you'll choose convenience. I may still be a DropBox user, but my truly private data is encrypted before I store it there. Let's hope I don't get Alzheimer's and lose THAT key.
One of my pet peeves is when people ask me whether a product is FIPS 140-2 compliant. The question is so specific, and means one very specific thing is implemented correctly, the algorithm that implements the AES encryption and decryption activity itself. However, the question does not touch on whether or not the implementation of that encryption is done correctly. FIPS 140-2 compliance is something I would expect any graduate programmer to be able to accomplish in an implementation of AES.
What is missing is the secure implementation and design of the product that utilizes the AES algorithm, most notably the secure implementation of the key storage. For simplicities sake, imagine that AES is a specification of lock mechanism and encasement. When you lock up your secrets in this encasement, it is protected by one thing - the key. Where do you put the key to protect it? How do you share the key with others who may need it? How do you store it in a place that you can get to it from whatever device you're accessing it from, including the web and mobile devices.
Users of Dropbox made an assumption that the security of the encryption key was secured by the password that protected their Dropbox account. I, myself, made the assumption that Dropbox uses an algorithm such as PBKDF2 to create the key to protect my files at Dropbox. Of course, there was a point that I missed - if Dropbox were to do this, my files would be unrecoverable if I ever forgot my password. And obviously, some engineer at Dropbox had figured on this as well, because Dropbox can do password resets while my data can still be recovered. And thus, the slippery slope begins....security weaknesses introduced to account for the weakness of the weakest link.....the fallibility of the user. Dropbox implemented a solution whereby they store my key for me rather than make it unrecoverable. SHOCK!! DISMAY!! There's even more to the story, because other compromises were made as well in the interest of convenience, according to other accounts I've read, including generating unique security keys for each device that allowed them to authenticate to my dropbox without even my current password. This last piece, I don't even see as 'user-convenient' because it puts the onus on the user to remember to lock out any device that they've lost control of (and they may not even know they've lost control of the device!!).
The illusion of security in products that the mainstream uses is often touted as secure and covered with all kind of marketing like 'FIPS 140-2 Compliant'!! However, the reality is that true security will always get back to the security of the key. If you want to evaluate the true security of a device or a security implementation, there's a simple checklist the consumer can ask himself when buying the device:
1. Identify the 'key' that gives you access to your stuff.
This could be a password, a 'smart card' or a SecurID token.
2. Can I store my key to allow me to access without asking me every time?
The answer needs to be NO. If your devices store your key without you having to enter it (or provide something external like a secure token), the key isn't really the key, or it's replicated in the implementation. You don't want copies of your key being stored.
3. If I lose my key, is there a mechanism for me to recover my key that does not require another, perhaps more secure, key?
The answer needs to be NO. The key needs to actually be a part of what is needed to unlock the lock. If you can lose your key but still access the data later without it, it wasn't really the key - it was a token to get your key. Key Recovery is a whole practice in and of itself. Sure, we can encrypt and store your key info - but now we need to make sure that's locked up just as tight, if not tighter than the original data.
4. Can key recovery be done without my participation (providing the more secure key)?
The answer needs to be NO!! Again, if your data can be unlocked without you providing the key or an alternate key - it's not really the key at all! It's just a laundry ticket to pick up your key.
Those four questions are a good start - and there's even more to think about for advanced users (e.g. Can the key be used on the data without the system itself?)
Don't fall for the illusion - ask yourself these questions to get a feel for how secure your 'encrypted' data is. Then ask yourself which you want, convenience or lock-it-up-and-swallow-the-key security. If history is any indication - you'll choose convenience. I may still be a DropBox user, but my truly private data is encrypted before I store it there. Let's hope I don't get Alzheimer's and lose THAT key.
April 01, 2011
There are certain foods....
There are certain foods in the American culinary lexicon that seem to defy the idea that foods are created by artistic minds, unless one considers the seedier side of the artistic world as a valid source of creation vision. As I purchase breakfast this morning, which includes a 'yogurt muffin' that I normally obtain, I stopped to think about just what yogurt is - a sort of curdled milk product (yes, I KNOW there's more to it than that). But even if that were not a strong enough case to be made that some foodies must in fact be engineers instead of artists, I am given to think of Blue Cheese dressing, foie gras and even haggis. This last one I'm sure we could argue is NOT in the American culinary lexicon at all, but is in fact only closely related by the unity of Britain and Scotland and their lingual and historical relationship to Americans. No one wants to get too close to the haggis, after all. Just a passing thought.
March 24, 2011
Embarrasing
It is so embarrassing to sound so 'right' about something, only to find out that you are indeed wrong. I really need to bring my 'humility circuit' online more often, even in subjects I am supposedly smart on.
March 09, 2011
Matrix Screen Saver
Some days you just want a good Matrix screen saver. I downloaded three different ones to try out - and of the three, only one worked properly on my Windows 7 dual-screen monitor. It's a nice screen saver, includes some good options (like turning off after x minutes if you want, turning on/off the trace program sequence, changing speed and density of the falls), and it's free. The link to it on Download.Com is http://download.cnet.com/The-Matrix-Screen-Saver/3000-2257_4-10067722.html.
Perhaps this will save someone a few minutes of searching and testing.
Perhaps this will save someone a few minutes of searching and testing.
February 28, 2011
The Weekend
So, what did you do with your weekend? This weekend the wife and I went to the library - I haven't been for a while and there's a relatively new branch in the main city near me. I picked up two things - "Ender's Game" by Orson Scott Card (a friend had recommended another book by him, but they didn't have it) and a book of sheet music for songs from the 70s. I brought the sheet music home and started learning "American Pie" by Don McClean on the piano. I'm certainly no virtuoso - I'm a self-taught piano player of a few years and I'm only able to play a melody with full-chord accompaniment, but it sounds fairly good on my electronic keyboard with some creative dual-voicing. I've learned up through the first chorus by heart, and with practice I should be able to teach myself the whole song before I have to bring the book back.
We also stopped at Panera bread for scones and a smoothie while we read our books. I'm about a third through "Ender's Game" and should finish it this week. Card is a very accessible author, and so far I am thoroughly enjoying the book, aside from the incredulous level of dialogue that is supposedly coming from a six-year-old. That's my only nitpick with the book concept thus far.
We also stopped at Panera bread for scones and a smoothie while we read our books. I'm about a third through "Ender's Game" and should finish it this week. Card is a very accessible author, and so far I am thoroughly enjoying the book, aside from the incredulous level of dialogue that is supposedly coming from a six-year-old. That's my only nitpick with the book concept thus far.
February 09, 2011
Jurors take their job seriously
I had jury duty yesterday. I spent all day at the County courthouse for a trial on a charge of 'failure to stop' (at a stop sign). It was more interesting than it probably should have been, and there were plenty of takeaways to share.
1. The jurists for this case (all 7 of them) appeared to be very dedicated to getting to the bottom of the matter and ensuring they followed their instructions as closely as possible. Because the case was such a simple one, I was surprised by the level of discussions in the jury room. I expected to be one of two or three dissenters, but found myself in the majority from the outset.
2. The Prosecution needs to ensure that they do their job. In presenting their case, they need to be extremely specific about focusing on the charge at hand and ensuring they present enough evidence to erase shadows of doubt. The jury takes very seriously the 'beyond reasonable doubt' clause. In our trial, most of the jury members were very adamant that they had not heard the officer testify that they saw the defendant approach the stop sign and roll through it without stopping. This planted seeds of doubt as to whether or not she had indeed watched him fail to stop, even though it was clear she saw him stop later on. The prosecution did not dwell on setting the scene and ensuring that the officer testified as to the fact that she actually knew that she saw him NOT STOP - a very specific event. Without this specificity, the jury was left to conjecture, which meant reasonable doubt (and ultimately an acquittal).
3. "You have the right to remain silent" - No better advice can be given anyone accused of a crime. The defendant did not make it easy on himself. Deliberations took hours for the jury merely because of the defendants behavior in the courtroom, introduction of unrelated evidence, disrespect, immaturity and even introduction of his own driving record (WITH MORE THAN 5 OFFENSES ON IT!!!) into evidence. [Oh yeah, and the prosecution didn't even provide the citation as evidence, which ended up being crucial in the deliberations room].
4. If you're going to represent yourself at a trial, ensure that you've prepared a logical argument and present ONLY THAT ARGUMENT. Had the defendant followed proceedings properly and taken the stand to state only the one crucial fact (his claim that he had stopped prior to the stop sign and then again after passing through the intersection to avoid hitting something else), it would have laid the reasonable doubt without prejudice. As it is, his rambling, his attacks on the character of the officer, and his other antics in the courtroom all detracted from his credibility.
4a. Oh yeah, and if you're going to represent yourself - CALM DOWN!!! You will be given an opportunity to refute testimony and present your own facts in due time. There is a structure for approaching the situation to come to a logical conclusion, and you will have adequate opportunity to address everything you need to. Take notes if you have an impetus and cannot address it in the current forum. Whatever you do, try not to sound like a stark-raving lunatic.
5. Interesting points on juries in Fairfax County - I was unaware that (at least in this court) you needed unanimity to reach a jury decision for non-felonies. I was unaware the jury sets the sentence in Virginia. I think that's an interesting point. We were given sentencing guidelines when we entered the jury room, and asked to provide a sentence in the case of a guilty verdict.
1. The jurists for this case (all 7 of them) appeared to be very dedicated to getting to the bottom of the matter and ensuring they followed their instructions as closely as possible. Because the case was such a simple one, I was surprised by the level of discussions in the jury room. I expected to be one of two or three dissenters, but found myself in the majority from the outset.
2. The Prosecution needs to ensure that they do their job. In presenting their case, they need to be extremely specific about focusing on the charge at hand and ensuring they present enough evidence to erase shadows of doubt. The jury takes very seriously the 'beyond reasonable doubt' clause. In our trial, most of the jury members were very adamant that they had not heard the officer testify that they saw the defendant approach the stop sign and roll through it without stopping. This planted seeds of doubt as to whether or not she had indeed watched him fail to stop, even though it was clear she saw him stop later on. The prosecution did not dwell on setting the scene and ensuring that the officer testified as to the fact that she actually knew that she saw him NOT STOP - a very specific event. Without this specificity, the jury was left to conjecture, which meant reasonable doubt (and ultimately an acquittal).
3. "You have the right to remain silent" - No better advice can be given anyone accused of a crime. The defendant did not make it easy on himself. Deliberations took hours for the jury merely because of the defendants behavior in the courtroom, introduction of unrelated evidence, disrespect, immaturity and even introduction of his own driving record (WITH MORE THAN 5 OFFENSES ON IT!!!) into evidence. [Oh yeah, and the prosecution didn't even provide the citation as evidence, which ended up being crucial in the deliberations room].
4. If you're going to represent yourself at a trial, ensure that you've prepared a logical argument and present ONLY THAT ARGUMENT. Had the defendant followed proceedings properly and taken the stand to state only the one crucial fact (his claim that he had stopped prior to the stop sign and then again after passing through the intersection to avoid hitting something else), it would have laid the reasonable doubt without prejudice. As it is, his rambling, his attacks on the character of the officer, and his other antics in the courtroom all detracted from his credibility.
4a. Oh yeah, and if you're going to represent yourself - CALM DOWN!!! You will be given an opportunity to refute testimony and present your own facts in due time. There is a structure for approaching the situation to come to a logical conclusion, and you will have adequate opportunity to address everything you need to. Take notes if you have an impetus and cannot address it in the current forum. Whatever you do, try not to sound like a stark-raving lunatic.
5. Interesting points on juries in Fairfax County - I was unaware that (at least in this court) you needed unanimity to reach a jury decision for non-felonies. I was unaware the jury sets the sentence in Virginia. I think that's an interesting point. We were given sentencing guidelines when we entered the jury room, and asked to provide a sentence in the case of a guilty verdict.
January 28, 2011
Geek Thoughts
This morning I sat down at my desk and looked over at my picture frame. When I was in Georgetown this summer, I took a picture of the plaque that adorns the building where Herman Hollerith invented and perfected the punched card machine. This is one of the pictures that, along with family pictures, macro pictures and nature pictures cycles through the day. But for some reason, this morning I thought about the Hollerith card.
Did I remember the coding scheme used by the card? A quick Google search confirmed my memories that it was a two-zone system, with 3 punch rows in zone 1 and 9 punch rows in zone 2 (although I recalled 3/10). This gives us 40 possible values per column, with 80 columns available. But then I had this thought, which I am sure others thought of before me.. The possible values per column is actually much more. By allowing multiple punches per zone, the card could be made to handle 2^12, or 4096 possible values, by ignoring the zoning of the card, and utilizing each potential hole as a bit value. And that's only with the same hardware. Because there was space between zone 1 and zone 2, the potential for more holes is there in the card, and with a bit more machining, another hole would be possible (although this thought process also gets into the potential for phase shifting along both x and y axis, giving us much more potential).
Just some geek thoughts for the morning.....completely unimportant.
Did I remember the coding scheme used by the card? A quick Google search confirmed my memories that it was a two-zone system, with 3 punch rows in zone 1 and 9 punch rows in zone 2 (although I recalled 3/10). This gives us 40 possible values per column, with 80 columns available. But then I had this thought, which I am sure others thought of before me.. The possible values per column is actually much more. By allowing multiple punches per zone, the card could be made to handle 2^12, or 4096 possible values, by ignoring the zoning of the card, and utilizing each potential hole as a bit value. And that's only with the same hardware. Because there was space between zone 1 and zone 2, the potential for more holes is there in the card, and with a bit more machining, another hole would be possible (although this thought process also gets into the potential for phase shifting along both x and y axis, giving us much more potential).
Just some geek thoughts for the morning.....completely unimportant.
December 31, 2010
Sniper Ghost Warrior
I bought Sniper: Ghost Warrior from Steam and have been playing it for the past two days. This game is, hands down, the most fun I have had with a PC game since Duke Nukem. There are a few things I don't like about it (unclear map boundaries/movement restriction and lack of freedom in the Story mode, and the red dots that give away EVERY player's position in online Deathmatch play, even if they haven't fired their weapon). Otherwise, I give the game a solid 8 out of 10. With some improvement, I would have no need for another FPS game ever. I don't think the game is still on sale at Steam, I picked it up for $7.50 - but even at $15, if you enjoy sniper/shooters and stealth games, you will definitely enjoy this. I'm going to need to massage these knots out of my neck now.
Subscribe to:
Posts (Atom)