Michael N. Dundas

My wife and my ‘non-security’ friends think I am too paranoid. According to them, I overreact to simple situations and am too cautious. I’ll admit there may be some truth to that, but this is a perfect example of why I feel I respond this way. A family sound asleep in their home. Husband hears what he thinks is a robber outside. He grabs a kitchen knife and goes out to investigate. He is met by a swat team that has surrounded his house. He and his wife are handcuffed. They are released when the police determine that there is not a kidnapper holding them at gun point in their house. Why did they think that was the case you ask? Someone hacked the 911 emergency system and placed a call that appeared to come from that house saying they had a gun, had already murdered one person and were going to shoot others.

I don’t think the police did anything wrong or overreacted, but it could have gone bad. The husband could have been shot by an officer reacting without thinking due to lack of experience or fear. The simple answer is ‘well he should have just called the police and not investigated himself.’ Although that may be true for this particular circumstance, there could be other circumstances where it is not that simple. Do you call the police as soon as you hear a noise? I don’t. I usually grab my kali sticks and go take a look. You can’t burden the police with every single issue without checking the seriousness of it first. If everyone just called the police as soon as they heard a suspicious noise or saw suspicious activity, the system would break down and the bad buys would win because the police would be busy constantly answering false alarms. In my city if I call the police for a noise that turns out to be nothing, they will actually fine me.

Six months later they finally caught the person that did this. Hopefully, I am just being my paranoid self but I fear this is just a small sign of things to come. Too many things hooked up by networks and computers and not enough time, money, and expertise spent on actually securing systems.

A colleague of mine had a reference to these Internet maps on his blog. Thought it was cool, so I am adding it as well. They use The Dimes Project data to map the Internet. I was chatting about the sample sizes as that could seriously affect the graph. If there are only a handful of people in Australia for example that are involved with the Dimes Project versus many more in Europe, that would obviously affect the look of the graph. Still neat though.

This morning, I went into Starbucks to grab a Cafe Latte before going into work. This is not my normal procedure, but I had to get an oil change done on my car which was long overdue, and they were not open yet.
I ordered a Cafe Latte and a muffin. An issue came up and another employee came over to place my order. I paid. When my drink came, the lady who took my order said “Oh, I’m sorry I only charged you for a coffee, not a Cafe Latte.” I offered to pay the difference, but she said not to worry about it and have a good day. I was shocked! It was so nice to have a customer service person actually realize that the inconvenience experienced by a customer to have to pay the difference was not worth the actual difference between the two items. What I found more pleasing was that the employee was actually ‘empowered’ to make that decision. Often times, the employees know this, but now a days so many of the front line employees are forbidden to make any decisions for fear of loosing their job or other punishment. “Don’t think. Just follow the procedure!” It made my day. And I’ll go back to that Starbucks.

A charity organization in Toronto called “The daily bread” placed fridges around the city of Toronto as a way to raise awareness of the less fortunate. The article in “TheStar.com”, talks about the fridges and indicates that “Security personnel weren’t impressed” …. ummm so what?

Who are these Security Personnel? The police, private security companies, CSIS? It doesn’t say who they are. Even if they indicate which “security personnel” why do they care? Why is it bad? Why should people not do that? Come on people, let’s think for a moment.

If bad people were going to plant a bomb, or release toxic gas or some other awful ‘terrorist’ plot, do you think they would put fridges out in the middle of public, making it obvious ‘something is different’? Or do you think they might covertly do this, making it hidden, not obvious so that no one would notice and have maximal effect? How have the terrorist attacks in the world that have happened in the last 10 years played out? Obvious or covert? Threats like Operation Alberich recently foiled in Germany are the real threats that we need to be focused on and smart investigative work by law enforcement is what uncovers them, not running around worrying about fridges. Unfortunately, these real operations take time and for obvious reasons are kept out of the public ‘eye’ until they are close to being over.

How about doing some real investigation, finding out why the fridges were put there and what the point was? How about working with these types of organizations so that when they decide to do things to raise public awareness like this, they could actually give the “Security personnel” a heads up knowing that they would be more likely to discuss logically and cooperatively then just say ‘No’.

Heck, the fridge doors were even configured so they wouldn’t latch and couldn’t be closed, so no one would get caught inside them. I suspect they were even going to come back and pick them up had it not been interpreted as a ‘security threat’.

We have to stop playing security to the lowest common denominator. We need some smart people to actually come up with and implement security that makes sense — not as part of politics, or some business venture.

definitions of ‘off’:
1. to a state of discontinuance or suspension [turn off an engine]
2. out of operation or effective existence

This has always bothered me. I turn my television off, yet the red light stays on. I turn ‘off’ my PDA, but always wonder is it really off? If the alarm is set then when you turn it off it says “turning off till xx time”. It can’t be ‘off’ or it would not be able to turn itself on.

I think that off should be off. And I’d even go so far as to make it a legal requirement. When a device is in ‘off’ mode then it is truly off — not processing, not checking for updates, off. Just as if the battery is removed. If this is not the case, then don’t call it off, call it ‘sleeping’ or ‘in standby’ or ‘power save’. Off in these cases is wrong and mis-leading. I’ve heard the arguments that systems keep time, TV needs to be on to accept commands from the remote control and other similar arguments so it can’t truly be ‘off’. I’m o.k. with that. Just don’t call it ‘off’. It’s not off.

The new apple iPhone when it is ‘off’, still performs syncing with your e-mail as this person found out when they received a $4800.00 bill from AT&T.

http://theinquirer.net/?article=42235

Recently, I have been getting requests from people that do not know me to add them to my LinkedIn profile. Although I am pleased that people are interested in connecting with me, many times I do not know these people. In most of these cases, I expect they do not know me and have never met me, but are sending out connection requests based on some criteria that my profile has matched on. I haven’t investigated this, and do not intend to.

As a personal policy, I do not add people to my LinkedIn profile that I have not personally met and worked with. This isn’t just meeting at a conference once or twice, or one or two e-mail conversations. I want to be able to be able to comment on the personality and work of the people on that list. For me it is not an address book of my contacts (I have a contact manager for that), but rather a subset of contacts, that are individuals I have worked with either on projects, research or know very well personally.

Please understand, I am not trying to be difficult or unfriendly, but I always want to be able to know the people on my LinkedIn profile with a good degree of confidence and understanding.

Better late then never ….. but this is awesome cause I hope it means that DRM will go away and the RIAA has finally given up trying to push something consumers don’t want — at least I’m hopeful about it anyway.

http://hardware.silicon.com/pdas/0,39024643,39166710,00.htm

I’ve been on the Internet forever and I’m not much of a GUI kind of guy. I like how the ‘inners’ of the Internet works, the protocols, the security, analysis of packet traces (I might be considered a bit of a geek). A long time friend of mine from when I was 5 or 6 just contacted me. Really awesome. So as much as I might knock all this ‘GUI crap’, she probably wouldn’t have made contact so easily without it. So hats off to “Web 2.0″.
(Although CLI and packet traces are still better … they don’t lie).

Remember being in kindergarten and you would have to connect the dots? Connecting the dots 1,2,3,4 …. would form some picture. “Oh look it’s a Jack Rabbit.” Some pictures you really didn’t need to connect the dots, they were very obvious. You could just look at it and instantly know “it’s a jack rabbit.” But some, you couldn’t tell. You’d have to start connecting the dots to figure out what it was. There is a shape, but it’s on this branch with leaves around it. It is a monkey? is it a koala bear? Stressful for a 4 year old. But you’d start connecting the dots 1,2,3,4. “Ahhh it’s a koala bear.” Sometimes the picture is very obvious, but they try to fool you. “I know it’s an elephant.” But the dots are not sequential. “hmmmm what’s going on?”. Oh wait I see it’s 2,4,6,8 ….

Then you hit grade 1 and the connecting the dots stop. You move on to more complex things. Colour all the shapes that have 4 sides Orange and all the ones that have 3 sides blue for example. You never do connect the dots again. As an adult, I’ve recently had re-enforced the fact that all those “connect the dot” lessons in Kindergarten are very important in life. Might even be one of the most important lessons. Maybe even more important then addition. They should really place more emphasis on it. Review it once each year till you hit University. Maybe even review it in University.

Nothing new, but the write-up on what you have to go through to be “legal” was very well done.

http://consumerist.com/consumer/drm/how-i-became-a-music-pirate-245644.php