Friday, February 13, 2009

Gross Misuses of Power

It wasn't so long ago that graphic design was done by a professional with a lightboard (or, at very least, a complex piece of software that required specialized training). Now, just about anyone can publish newsletters and make flyers, and the result is often ugly/unreadable/terrifying. The same goes with web page design.

Similarly the results of amateur dabbling with Microsoft Access create problems for years after the "developer" has left since the system may still be in use. There is a definite art and science to good database design that will allow you to easily expand the systems scope and create reports to answer just about anything relevant to the data. On the other hand, bad database design results in a system that is difficult to maintain, limited in functionality, confusing to document, and will require months of conversion effort before back data can be moved to a better system.

Today, I'm trying to document a horrible Access database, and it is maddening.

Wednesday, February 11, 2009

Goodbye, Grandpa O

My grandfather died on Friday night. My mom called Saturday morning. His death was sudden insofar that he wasn’t ill. On the other hand, he was 91 (a few months from 92) and had grown noticeably weaker when I saw him at Christmas, so death was not outside the realm of possibilities.

He died in his sleep, which is all any of us can hope for ourselves.

The funeral is today. I won’t be there. I always thought I would be there for his funeral, but I never anticipated him dying when I was 35 weeks pregnant and moving in 4 days. The logistics of travel just seem like too much right now. Still, I worry that not being there will mean I have a hard time grasping that he’s really gone.

At least I was able to spend time with him and my grandmother at Christmas. My husband was able to meet him on several occasions. I had, of course, been hoping that he would be able to meet his new great-grandson, but I knew those visits would be few and my son would be too young to remember them.

My grandfather was an extraordinary man. He served in the Air Force, including flying in combat during WWII. He was a professional photographer in a small town, and there are many people for whom he took senior photos then their wedding photos then their children’s senior photos then their children’s wedding photos. Perhaps the most amazing thing is that he was happily married to my grandmother for over 70 years.

To all the emotions of being pregnant and setting up a new home sadness has been added. I pack a box, have a crying jag, and go on.

I will miss you, Grandpa.

Tuesday, February 10, 2009

Trust 2.0

The pre-commercialized and non-web-enabled Internet was a trusted environment. The sys admins knew each other. If they saw a problem coming from a particular address space they knew who to call.

Because everyone was trusted there were few security controls built in to the architecture. Most of us don't lock the doors inside our home because we trust the people inside. Same thing. That's why the original Internet Worm (the Morris Worm) in 1988 was so devastating. And that's why we still have problems today.

Here's a fairly non-technical example of the technical security problems of the Internet. To send email you used to have to type who it was to, who it was from, and the message. Note that you TYPED who the message is from. In a trusted environment it was assumed that no one would lie about who they were. This is the exact same protocol that goes on behind the scenes in our fancy email applications and online services. This is why spammers can make their emails look they they come from a variety of fake addresses. This is why many viruses would hijack people's address book, so that their malicious message looked like they came from friends.

There are a multitude of problems like the email protocol. The Internet generally believes what it is told about what something is and where it is from. This creates problems when untrusted people enter into a trusted space. We try to layer on protections like anti-virus software and site analysis tools, but the underlying architecture remains open.

Enter Web 2.0. As pointed out by many including this recent CSO Online article social networking sites have the added danger of providing very powerful capabilities to non-techies. And they continue to be environments of trust.

The ability to post and share files (including pictures and applications) used to require programming, but now everyone can do it. Although Facebook users may invoke their privacy settings they are still in a largely trusted environment as there is little authentication for "friends." This combination of power to those who may not understand and lack of authentication allow for a multitude of threats.

First, actual friends may unknowingly open you up to threats. They may link to some malicious code (possibly found one of their "friend's" sites) that will steal your personal information or provide access to your employer's network. They may (with or without malice) post personal information about your or pictures that will haunt you later.

Lack of authentication means that someone who is not actually your friend can do the above, too. Additionally, if you friend a faker you have given them access to data that you considered private. Why did you friend that person? Perhaps they were a friend of a friend.

I admit that I use some of the Web 2.0 tools. And I blog, so I'm obviously not the most hardcore of privacy geeks. Security and privacy are always trade-offs for other things, such as convenience and functionality. Sometimes I decide it is worth it to make the trade. But I do so knowing that a trade is being made. Many people don't think about that part. And they get in trouble.

Whenever you post anything or click on anything or believe anything on the Internet consider who you are trusting. Since it is essentially impossible to delete anything from the Internet, the answer is usually that you are trusting everyone for all time. Privacy settings may temporarily limit the sphere of trust, but it should be assumed that those limits will eventually erode.

Who do you really trust?

UPDATE: For an example of how Trust in Real Life can create technical vulnerabilities. Check out this social engineering example that uses someone's MySpace/Twitter updates, a cheap shirt, a USB drive, and cookies to hack a network.

Thursday, February 5, 2009

Super Weekend

I’ve been meaning to make this post but between work projects during the day and moving prep at night it’s been a busy week. I’m still not going to be able to do this all justice, but…

Last weekend was great.

On Saturday afternoon, some friends threw me a baby shower. It was a Kimmy Z in Wonderland themed Mad Tea Party. It was a nice sized group. We ate and talked. Then I opened fabulous presents for the critter.

On Saturday night, hubby and I went to see the Heartless Bastards (and a fabulous opening band, The Subjects). It was fun to be able to go to another concert together since soon that will be a luxury. (Now, we complain about high Ticketmaster fees, but those will look like nothing compared to the cost of a babysitter!)

Sunday was, of course, the Super Bowl. I cheered, and I yelled. It was an exciting game, and the Steelers prevailed bringing me to tears. Go Steelers!

A great weekend.

This weekend is all about packing and starting to move. It won’t be anywhere near as fun, but it has to be done.