purdue seminar

I gave a seminar talk at the CERIAS lab of Purdue University yesterday. They had arranged for me to spend most of the day meeting with miscellaneous faculty -- it was great. Sometime in the next few weeks, they'll be posting a streaming video of my talk here (I think).

The talk discussed invasive browser sniffing and countermeasures that was presented at the WWW 2006 conference in Edinburgh, Scotland. (Abstract, Slides)

pspam

Sick of physical spam (pspam -- the crap that comes in the post to your home mailbox)? The USPS suggests you write to these folks, and ask to be added to the "no advertisements" list:

MAIL PREFERENCE SERVICE
DIRECT MARKETING ASSOCIATION
POST OFFICE BOX 643
CARMEL NY 10512-0643

Link

is my research pointless?

This is kind of a ranting... it may not make much sense.  Input (comments) will be appreciated.

During lunch today, I flipped on the TV and watched a PBS special on a nun who makes cheese.  Actually, it was called "The Cheese Nun".  In it, Sister Noella Marcellino talked about how they make cheese and essentially commune with the world (the beasts, the earth, the cheese-making fungi).  It was kind of neat, everything she did was backed by enormous motivation and inspiration -- though none of it was heavily religous.  In her cheese-making escapades, she was asked to go back to school and study more to make the cheese better or at least understand why they use the very antiquated cheesing methods they do (no pasturization, specific locations for aging, etc).

She went back to school to get her PhD in microbiology (ended up on a Fullbright scholarship to France) -- studying specific fungi in the cheesemaking process, and she figured out, down to the strain of fungus, exactly why each cheese tastes different.  It turns out that in the aging caves, a whole different ecosystem of microorganisms live, and a new strain of the cheese-making fungus develops and thrives.  Destroy one of these caves, and the flavor of cheese made in it will go extinct.

She illustrated the importance of keeping around these antique cheese caves, and supporting the independent middle-of-nowhere cheesemakers. Through her research, she helped a whole lot of people realize what is *really* going on in a rather mysterious process of cheesemaking.  She is the pious Indiana Jones of the cheese world.

I think it should be the goal of every advanced student to strive for something like this -- not only to pioneer something new in their field, but also try to make a real contribution to add perceived value to society.  Help steer our world straight -- a researcher with any other purpose is just a cog in the big machine.

Computer Security, as a field, is an arms' race.  You have the defenders and the attackers.  We make them wear different hats (black hat, white hat).  You also have some "gray hats" that simply find new angles of security and anti-security, then talk about them, as opposed to taking advantage of them or fixing them.  We often call the black-hats "Hackers", and the white-hats "Researchers". 

As a side-effect, the struggle (you could call it the "war on cyberterrorists" if you really want) brings about a whole new little society.  The cryptographers, virologists, coding gurus, stack smashers, documentation trolls, social engineers and script kiddies speak a language of their own, and more or less just fight amongst themselves.  Bring in malevolents -- spammers and phishers -- and you break out of the security bubble and start harming the everyday Joe and Jane who barely know what an anti-virus program does.  Jane and Joe are at everyone's mercy, and are mostly oblivious of the war going on.

So what does this have to do with cheese?  Sometimes I have to step back and think to myself, "self, what is your goal here?"  A lot of security research seems to be to be intellectual masturbation; you find a flaw, you find a solution, then you pat yourself on the back and publish it.  If you read through journals of computer security, this is all you will see: layers and layers of vulnerabilities and their solutions.  There are whole companies whose business plan is based around cataloging all of these pairs. They don't really seem to make a difference to anybody outside of this focused war.

Cheesemaking has changed radically over the years, mostly due to health scares ("you're eating WHAT kind of mold?")  and process regulation ("you must boil the milk first, to spoil the flavor and bacteria").  Due to these changes, many of the great cheesemakers have gone out of business, and what used to be a great cheese is now extinct.  It is a noble effort to preserve other cheeses from extinction.  I want to find a noble effort in computer security. 

But it doesn't seem to me that saving peoples' identity from theft is as noble as some claim.  Educated Internet users can figure out how to prevent this theft.  The everyday Joe does not, and probably never will.  Most identity thefts occur in a way that leaves the victim completely clueless until money disappears or an agency questions them about actions they did not commit.  Wouldn't the best solution to the Bank-ID-Theft problem simply be to stop allowing online banking? Why don't we just stop using computers for commercial purposes? 

Things seemed to work fine before they were used this way -- election vote counts were not disputed or mistrusted, banks employed security guards to prevent theft, junk mail was directed to "current resident."  For each problem, an expert was employed: election officials, security guards, the trash can.  Now, it takes a computer expert to solve all three of these problems!  Say there are 10 areas of expertise in the world.  One of them is computers.  Before this "information age" 1/10th of the people could be employed to solve any given problem.  Now there are only 1/10th of the entire population available to solve ALL of the problems.  This doesn't sound good.  It makes me want to go live as a hermit in a cabin in the middle of the woods.

The Internet and this "digital society" are very very complex systems.  They are not getting simpler.  In the future either everyone will need to become a computer security guru to survive -- either that or much of the population will have to place unconditional trust into the expert few for ID theft protection.  Only some of the experts are trustworthy; the others want your ID.  It is a noble effort to solve this problem while keeping computers in their currently heavy-use roles!  The current, unfortunate, direction of things seems to be a downward spiral into infinite complexity and obscurity.

honest spam

I like to see that spammers are finally being honest... I mean, it's obvious that most of the email I get is shit, but this one is actually labeled that way.

technorati tags:spam, honesty

is today monday?

What a crappy day... but at least it started well!  Happy birthday, Mom!

Last night when I wanted to take out my contacts, I realized I left my glasses in my little black canvas bag -- the same bag with my razor, deodorant, toothbrush, etc.  Normally, this wouldn't be a problem, but I failed to take the bag with me on my trip from Lafayette to Bloomington.  Luckily, I was able to squeeze an extra day of pit stick out of an old stick, scrounge up a spare toothbrush, and locate an extra contacts case.  

This morning, I had absolutely no motivation to wake up.  The weather was cool enough last night that I slept with the window open, and this morning my apartment smelled like a forest the morning after a rainstorm.

Bus driver was a jerk today.  I bought a tiny little espresso, and when I tried to board the bus to ride across campus, he asked what was in the cup.  I told him it was filled with delicious coffee.  He said I wasn't supposed to bring a cup like that onto the bus.  Nicely, I let him know that I wouldn't spill it -- and since the cup was tiny, I thought he'd assume it was not much liquid to spill anyway.  He continued arguing!  "I guarantee that if you drop that cup it will spill.  You're gonna have to put that cup in there," he pointed to the trash bin.  I harumphed and told him I'd rather walk.

To the bus driver:  I hope you enjoy your little victory.  I've been riding the same bus route for over a year and this is the only time a driver has kicked me off for a tightly-lidded coffee.  He may have his victory, but now I understand why the buses are always late: the drivers take extra time to argue with passengers.  Anyway, my walk took 20 minutes longer than usual due to some "construction" in the middle of campus.  And by construction, I mean fenced-off heaps of rubble being pushed around aimlessly by a track-hoe.

The department of education pushed my student loans into grace-period and then repayment status while I was in Oz, and I argued yesterday with the IU Registrar's Office about my full-time student status.  Apparently they think I was not even half-time in the spring, though the CS department seems to think I was full-time.  Now I have to somehow get the CS people to convince the Informatics people to convince the registrar that I was full-time.  Then I can get the registrar to tell that to DOE, and get my capitalized interest uncapitalized and my extra interest removed.

Blargh.

On a lighter note, the new Phishing Group website is up.  Writing that has been my entire life for the last two weeks.  Phew.

technorati tags:monday, DOE, student loans, bus driver, bastards, phishing

hot day

It was hot today (about 95°F) and some kids were fooling around in the fountain near my office at Purdue. I wanted to strip off most of my clothes and join them -- the water smelled really nice. The scent reminded me of a water park I used to attend with my parents when I was young. Alas, I have too much to do, so I settled for a picture instead of a run through. Anyhow, I think the air conditioning in my office would freeze me if I were wet.

technorati tags:hot, fountain, Purdue University

sofa bricks

Wow, this is really cool. I can think of a ton of things to do with "sofa bricks" -- these cushy little building blocks. As a kid who played with legos, I think they would be a great for wasting time while trying to think of a new thing to do with them.

( Link )

back to reality

Well, after lots and lots of travel, I made it back to the USA.  Right now I'm sitting in a cafe in Madison, catching up.  It's good to be back home where things feel right, people drive on the right side of the road, soft drinks are cheap, drip coffee is common (bleah), and the money is green.

On the way back, my travels took me on a train to the Sydney airport, on a plane to Los Angeles, another plane (late by 2.5 hours) to Chicago, and then a car to Milwaukee then Madison.  When I landed in Chicago, two bad things happened; first, my plane was very late due to crew being late to show up.  Then, since we landed late, I missed my connecting flight to Madison.  

(9:30pm) As a result I tried to re-book for a later flight -- but the next possible flight was at 4pm a day later.  I decided to try and get put on the standby list for the 12am flight to Madison -- and to do that I had to walk CLEAR across the Chicago O'Hare airport to the gate... both the shuttle bus and train were broken.

(10:10pm) When I got there, the nice lady informed me that there was no way in hell I would make the flight, and that I should think about taking the bus that goes to Madison at 11pm.  So I made a call to United using a service phone (after using the nice desk-worker's cell phone to call RAM and arrange a car ride from a friend).  The nice folks on the other end of the line informed me that they could not cancel my ticket over the phone, I would have to speak to someone at the service desk.  So I walked to the nearest service desk, and got in a line that extended way down the corridor.

(10:50pm) Still in line, waiting, talking to some other nice folks.  United begins cancelling flights due to weather and a surplus of baggage they will have to send to other airports.  The line grows immensely.

(11:20pm) Finally talk to a service rep who says he can't refund the flight since it's bound to the LAX->Chicago flight.  I ask him for a travel discount or free flight voucher.  He gives me a $50 discount voucher for my next United flight.

(11:40pm) Arrive at bag claim looking for my Milwaukee friend.  I think I spot my luggage sitting by one of the claims, but I was told to get it in Madison  on the following day, so I give up the search and head for the toilet to take care of what pressure built up during the last 4 hours instead.

(11:45pm) Find my friend, get in a car, go to his house.  We arrive a bit after 1 and I hit the sack.

(1:00pm) We leave for Madison the next day, and head to downtown where, at 3:30pm, I meet up with RAM and finally see her!  Yay!  I pick up my new cell phone (email me if you want the number) and then my pal and I go to pick up my bags.

(4:20pm) I easily find my bags.  The Madison airport has been overhauled, and looks beautiful now!

(5:30pm) I finally change into clean clothes at the hotel and clean up.

The rest is history.  I have a good sleep, and then today I'm tooling around downtown Madison looking for trouble.  My throat is sore and I think I'm getting a cold, but other than that, things are back to normal.

technorati tags:travel, home, United Airlines sucks