(Two FSA posts in two days -- bad sign.)
The FSA have lately been taking a very hard line on data leak risk, and they themselves deal with extremely sensitive information.
So it does seem rather hard that they can't accept or originate TLS encrypted email. It's doubly hard that they use Messagelabs which handles TLS easily -- encryption must have been explicitly disabled.
So I have to dick around with fancy encryption utilities to get something that should be free.
Just a little note about our pandemic planning.
When the system was set up, we canvassed the business very carefully. Who could work at home, and who would have to come in?
The message was clear. Investors and traders could not work at home. They needed their colleagues around them, they needed their morning meetings and their bosses and compliance reps needed to see them. Delivering the order management and dealing apps on the pandemic remote access system was unnecessary and actually dangerous. Fortunate really, as some of them do not respond well to Citrix.
Well, now here we are, and I sense a slight quavering of the upper lip. When you really think about it, the idea of wealthy, numerate, well-informed and self-confident men and women with family responsibilities actually risking a lethal infection to nurse their portfolio is a bit daft. They'll stay home whatever the boss says. The first two or three, you can sack, but if it's the whole team, it becomes our problem not theirs.
Meeting tomorrow to start the the process -- "well, if that's not what you really meant, what do you mean?" We'll see how it goes.
Meanwhile, Mrs U is discussing what food to stock-pile.
The protestors -- G20 Meltdown and the climate campers -- did a big favour to London finance firms.
For three years, the FSA has been nudging us to do "pandemic planning" -- to prepare for situations like a legal or de facto quarantine where most staff will be staying at home by choice or under legal compulsion (or a train strike, or civil disorder or ...) This isn't DR proper -- if you don't want to say pandemic (and I don't, it's silly) you can call it Colleague Availability Planning.
And since we are a good and dutiful regulatee we have done what we can. In our case, that's a Citrix farm and an SSL VPN, with security settings that make it a little less unsafe when it's accessed from untrusted PCs. To ensure it's running and up to date, we use it for most of our remote access (I've preserved a little dignity by insisting that remote admins, and staff who need off-line access to data still have to use a trusted laptop.) The gimmick is that the equipment is grossly overspecified. Over a normal day, maybe 2% of staff log on. But the farm, the gateways and the Internet access is sized for 50%, and that presented us with a problem. We have no idea whether it is could handle the planned load, as we could never arrange that many to try it at once.
We got some information from the snow day in February -- that got us up to 15%. But the G20 demos were another thing again. Staff told to work at home, and pretty much told that unless they showed up on the VPN they'd be taking the day as holiday.
The first day, we struggled. A lot of silly glitches and one big one -- the presentation servers in the farm had not been built to specification. Very easy to fix, as it happened, and the second day went smoothly with about 40% of users -- pretty much the expected number -- on line.
And that's the gift that the G20 protesters gave us. Whatever you think of Mexican Swine Flu, you can be certain that we'll have to demonstrate to the FSA that our pandemic plan is up to scratch. And, now, thanks to the crusties, we can say, confidently and truthfully (and you need both to speak to the FSA) that it is.
Thanks, guys and gals! Was that what you wanted to do for us?
Naked-eye planets, obviously.
To be honest, I never expected to see Mercury. It's much harder to spot than Jupiter, Mars, Venus and Saturn. And I haven't seen Saturn, confidently, for a while.
When I went out to shut up the chickens at 21 my eye was captured by the one of the prettiest new moons I've seen. A tiny crescent silver sliver reclining, cradling a huge oval of earthlight in the last purple of the sunset. And there it was -- just off the moon/sun line -- the only star visible between the moon and the horizon.
I'd been tipped off by the night sky column in the LMS's BBC Focus magazine. "Surprisingly bright" it said and bright enough it was. And that's my lot. If I want to see another planet, I'll need binoculars. But the LMS is off too a good start.
This is mostly a funny story. "Now, boys, you are getting F grades at school for the exact same reason that you probably shouldn't bother trying to hack into the systems to change them..... "
Perhaps it's wrong to laugh. The Sumitomo hackers were prosecuted with evidence gathered by the spyware they left behind. Keyloggers are two-edged swords.
This is an interesting story on the BBC. It appears that as part of their probation, a pilot sample of convicted sex offenders are to be interviewed under a polygraph in an attempt to catch them sliding back into abusive behaviour.
I don't think any official body in the UK, certainly not the courts, police or the probation service are prepared to say that lie detectors "work" -- in the sense that they reliably detect when an interrogation subject is lying. The problems seem to be:
"Disclosures made during polygraph examinations, as well as conclusions drawn from passed or failed examinations, allow probation officers and the police to intervene to reduce risk ... Just as important, it is also aimed at enhancing the co-operation of offenders with supervision, helping them to focus on, and avoid, the sorts of behaviours that make re-offending more likely."That is a very careful statement indeed, and I hope the Beeb haven't picked out something unrepresentative. Grubin is a proper academic at a proper university -- Newcastle -- where the university profile identifies his current approaches to sex-offenders as being polygraphy and Prozac. And on the strength of this quote, it seems that he finds the chief value of a lie detector is that it's called a "lie detector". He does mention passes and failures, but his focus is on the interview itself. It appears that the purpose of the "lie detector" is not to spot lies, but to persuade the subject that telling the truth is the best plan.
On the theory that risks need names, here's a couple more from the recent Sumitomo bank job.
Two items tonight, on the Authentication Hotline
Rubbish Disguises
City financial types are being directed by firms and industry bodies to wear casual clothes on the riot days, so they don't stand out. It's a lovely idea -- take one middle aged bank operative, replace suit with M&S chinos and polo shirt and Shazam! indistinguishable from a climate change protester.
Or maybe you could try wearing a keffiyah. That should do it.
Effective Disguises
New spam trend: We're starting to get stiffy lolly spam pointing to .cn sites. The sender appears to be bright enough to realise that firms have filters which spot this a mile off, but also that there will be approved addresses bypassing the filters. So this mail is spoofed from plausible addresses. Yesterday I removed unisys.com from our approved list which should stop the immediate problem, but the attack is going to work until there's some way of authenticating envelope sender addresses.
The problem will really kick off when spammers realise that everyone has a bypass for FT.com because their news alerts are totally indistinguishable from spam.
I guess we need a checkbox. For any bypass, domain or just a single address, you need to be able to say "only bypass if the sender is spf authenticated".
I wish, I wish, I wish you'd care.
I saw the space station!
On Monday night, I did it properly, looked up the ephemeris on Heaven's Above, prepped up the less mad son, and saw it rise and brighten splendidly out of the ruins of the sunset, fly right overhead, flare sunset orange and drop suddenly into the shadow about ten degrees past the zenith. All highly satisfactory, and making me feel like a Proper Dad.
Then today, walking west on my way home from the station, a familiar-looking star caught my eye with its rapid rise and increasing brightness. I watched and sure enough it disappeared twenty degrees past the zenith. Pure fluke, but I caught the time and there's the transit on the site.
The less mad son just had a significant birthday and Mrs U was fulminating about the difficulties the building society put in the way of his opening a teenager's account -- effectively the full-scale anti-money-laundering precautions for a pass-book account with no cheques and a cash-only card. As a minor can't be held to a contract, she couldn't even see the point of asking for a signature.
But I can. If I was laundering money, I think the prize of a full scale bank account attached to a false identity would be well worth waiting a few years for. And in the meantime, spending rich uncle Lenny's generous birthday and Christmas gifts on Premium bonds keeps the account warm, plausible, and busy with a spot of placement. So I don't blame them at all.
The problem I have is that I don't believe in computer hardware.
This story puts it nicely. How can you fabricate and reliably operate a device with 16 billion capacitors, each holding 10 electrons? http://www.theregister.co.uk/2008/12/16/mlc_cpm_pcm/
It's not the physics. I believe in electrons. I did the Milliken experiment in school and I made a transistor in college.
And I've got over credulity gaps before: As a young man, I couldn't believe in computer processors and language compilers. I thought it was magic. It took a degree
in computer engineering to see that you could build a processor out of
NOR gates and a clock, and that a compiler was a data structure task
preceded by lexical and structural analyses. I understand that the right mental tools can turn incredible things into engineering.
But this gap is just too wide. Think about the difference between a nice throwing rock, and a modern assault rifle. Or the difference between a cave with a fire at the front and the Bell Labs building in Holmdel NJ. There's a difference -- a huge difference. But is the modern as much as a thousand times more difficult or involved than the primitive? Stretching a point, is it as much as a million? It's not more, and it's taken many lifetimes to go from one to the other.
The simplest computer memory cell in modern designs is a transistor and a capacitor, more or less. That's one bit. You need eight to make a byte, and another for parity -- call it ten. So the 2G flash card in your camera, or the 2G DRAM on your PC -- and these are low values today -- is 2 x 10E10 cells. Twenty billions. The vast majority of them have to work reliably, predictably, over a service life of years. A single bad cell won't make the device unusable, but it can't tolerate many failures -- and this stretches my credulity.
Shockley was making recognisable transistors in 1947 -- less than a single lifetime ago. And now we have twenty billions -- not total in the world, but mass produced on commodity component for a dollar. It's not a bit more of a step than the modern building or weapon. It's order after order of magnitude in a vanishingly short time. I don't believe there's any mental tool (Moore's law, the square law of miniaturisation ...) that will cover that gap.
So if you ask me how the ALU works, or what microcode looks like, or why recursive descent parsers are a good thing, I can tell you. But if you ask me why you can trust the data in your camera card or your memory stick, all I can say is that it's magic.
Mr Infrastructure sent me an email. He was escalating an issue his team had with security policy.
One phrase stood out: "I have been advised..."
This is the greatest cop-out ever. It means: "Because I don't claim to understand this, you can't challenge me on it. I win."
I challenged him.
