Unnatural Selection

I've just started on my Christmas present, Kolmya Tales, by Varlam Shalamov. The introduction describes Shalamov's time in the mid-century Soviet labour camps and mentions the strokes of luck which allowed him to survive. I've read a little of the popular history and translated literature of the camps and the system that required them, and it struck me that all political survivor's stories have one feature in common: the amazing luck -- a necessary skill leading to a warm job, awakened sympathy in a guard or criminal, wasted food found or any of a host of other things -- that saved the witness' life. You could end up thinking that the penal labour was a happy-go-lucky setting where something would always turn up in time....

Of course that's wrong. There are no first person stories that don't have that lucky break, because all the potential authors -- without the lucky breaks -- died. By focussing on eyewitness accounts -- the best possible sources -- we've gone wrong. The camps were not about misery overcome by good fortune; they were about misery closed with death. Everyone is telling their truth, but the sample is bad, and so the picture is false.

Sex Differences

As I write, the three household males are all in front of general purpose computers of one sort or another. The MMS is building layouts with his Trainz program; not a Christmas present, but running much better on the new computer. He's passed a little milestone that no-one else seems to have noticed -- he's saving files with worthwhile names, so it's probably time to get a modern version for his birthday. The LMS is playing Half-Life downloaded as a Christmas present (very Christmassy...) and I am writing this.

The females are on the sofa, with a nice fire, watching High School Musical...

Which is better?

Happy Christmas

This hedging porn looks a bit Christmassy so it seems appropriate. Both taken on the solstice, truly just an hour before the thaw turned the rime to drips.

The hedge is my current work in progress -- you might just see I've reached the limt of my dewiring, and as the ground is too hard for stakes, I spent the time peeling back the stockfence and tidying up.

If you think the stakes look a bit dodgy, you're right. I salvaged them out of some chesnut paling lattice. Years old, but still hard enough to drive with a hammer, once I've opened up the ground with the iron. Almost any stake makes the job much easier.

The second picture looks very frigid indeed, but that's what happens if you go outside with the white balance set to flourescent...

Paid-for Malware

I sometimes get asked what anti-virus software I recommend for use on the home PC. I've tried a number of possible answers but my heart isn't in any of them: I know McAfee is a pain; bouquets for Norton outweigh the complaints, but not by much, so I've been recommending Kapersky -- I know it works and and the price is closer to reasonable. So a story like this one is a bit disconcerting. What are the lessons?

1. Don't trust software more than you need to. We had all the warning we needed when McAfee pulled this same stunt on a bunch of system files a few years ago. Don't delete: Quarantine.
2. It's time to start getting more assertive about my true answer....

Which is this: I don't run AV software at home. I never have. I don't do stupid things, mostly, and I don't let the children or Mrs U have administrator accounts. I know how to use autoruns (though I've never needed it) and there are the web scanners. I've never had any trouble, even on Windows, and my truly personal computer runs Linux.

Even just writing that, I can see how eccentric and impossible it seems.... really I should just say that I've no useful advice to give.

We are Them

Interesting session with Mrs U in which she dammed her mother's eccentricities. I think she was completely unconscious that the traits she found most obnoxious were those shared most identically between mother and daughter.

We believe that introspection is the most reliable source of knowledge -- it certainly feels that way. In fact, we are strangers to ourselves.

For an accurate portrait we need the opinions of those who know us, expressed in their private conversation and writing. But an accurate portrait is almost unbearable. The shocked diary snooper or eavesdropper -- the relationship changed needlessly but forever -- is one of those cliches that's trite because it's so real and so common.

I wonder whether this is the real reason why words like "nosing" and "prying" carry such an ugly load: not defence of privacy, but psychic self-protection. We can't bear to know.

Insourcing Authentication

It's appraisal time and the focus is on the performance management system. That's outsourced -- Internet delivered and hosted somewhere in Florida.

The issue that was brought to me was concern that users might be saving their performance management password in the Internet Explorer credential cache. It's never something that's worried me very much -- if you lose control of your workstation session, you've lost a lot more than the right to express an opinion on that annoying support guy with the awkward questions....

But it tied up some ideas that have been rather weakly formed in my mind.

We're outsourcing more and more, and the result is that our users do their jobs with accounts on this system and accounts on that, and I have no real confidence that there's even a consistent list. I'm certain that there are some systems a leaver will retain indefinite access to, simply because the whole service was set up by the business with no IT involvement and the helpdesk will never know to cease the account. This is pretty galling when we've recently put so much work into the Joiners/Leavers/Absentees process and the unused account purge. We're actually getting on top of this, but it's slipping away though a side door. There's certainly no hope of enforcing a consistent account name or password complexity policy.

At the same time, to deal with the many sites like Blogger, Delicious and others that I use all the time from loads of PCs, I've been looking at OpenID, a public authentication system, that allows the administrators of an Internet hosted application to securely trust a logon completed at a different site. I've gone so far as to set up an OpenID on the Verisign test site, even though I've nothing to log in to it with.

So I've been toying with the idea that authentication was a service we could outsource -- to Verisign or perhaps a two-factor supplier. In fact, I had that exactly wrong. Authentication is the one service we can always do better than anyone else because no-one can know better than we do, who works for us. This is true even if we don't know very well ourselves....

So we shouldn't outsource -- we should insource. We should provide an OpenID service as part of our infrastructure support for application outsourcing. Then we become the authority on who works for us, and what tests they have to pass to prove it:

• Log on from inside, and you just need a logged-on Windows session; log on from the Internet and it'll ask for your RSA token.
• The helpdesk can cease your OpenID when you leave, so terminating access to services they don't even know exist.
• The authenticator could decline to recognise remote applications completely or on a per user basis.
• Choices about access to the dodgier stuff like the password reset tool, or remote access can all be made here.

So it would all be fabulous. Just a couple of problems:

• There doesn't seem to be OpenID software with the flexibility and convenience I need, and
• The chances that application hosts can be persuaded to recognise their customers' OpenIDs seems close to zero.

So this frankly rather wonderful approach, which ought by rights be standard, is dead. But I think I'll put OpenID support on the qualification form just to watch them squirm.

Only a year old

First encounter with a Vista installation today -- a factory fresh Compaq.

• Loved UAC -- it's definitely the future (that is, it's as good as sudo, so Windows has caught up with 1985 flavours of Unix.)
• Loved how the compatibility with DOS3.3 is way better than W2K (don't ask.)
• Hated the difficulty of finding where to give the Ethernet adapter a static IP address (got there in the end though)
• Hated that the integrated Intel graphics with an experience index of 3.3 couldn't make Aero look like anything better than Ubuntu with a translucent theme on a mobile Pentium
• Hated -- really hated -- having to wait for a dual-core 1GB laptop to pop up a printer property box or move some files. How sad. Maybe SP1 will sort it out.

In the meantime, the Dell I bought a few weeks ago turns out to be the ideal XP machine. So that's where it's staying.

How policy suceeds, for once

I've been purging out a dying domain. Disabled accounts with a last logon more than three months ago are deleted; enabled accounts with a last logon more than one month ago are disabled with a note in the comment. Do that every week or so. Keep a safe list for genuine service accounts and the domain will be nicely compliant by the time it stops.

The reason I've had to do this myself is a bit sad: the helpdesk, who own all account administration, will go through any distortion to avoid account difficulties. An odd-looking account -- precisely what should be disabled -- won't be touched for fear of breaking something. The policy itself gets re-interpreted to be "disable after ninety days" with no-one able to trace where that decision came from.

It's understandable. The best outcome from good application of the policy is that no-one complains. The likely outcome is senior staff complaining that the helpdesk has broken their account -- and no-one wants to hear that.

So, I've been doing it myself, and that makes everything different. Everyone knows that I break stuff, but everyone also knows that challenging me on what I break can leave them on the wrong side of a clearly distributed policy that they didn't read or understand....

Yes, and in this case I did a blinding job: The account policy allows just two types -- owned, which are subject to the AUP, and service which have to be on my list. The AUP says that owners are responsible for owned accounts, have to log on more often than once a month, and log off after no more than a week. That was carefully chosen to update the last logon time, and to transfer blame.

And it works! Hundreds of users deleted, a few tactful explanations, and no trouble at all. This is the root of the security truism that you start with a policy. You can't act without it -- but it has to be a good'un.

Audits fall with autumn leaves

We've just been visited by one of the many audits to which a regulated firm is subject. We didn't come out as well as I would have hoped but the point for me was different and more worrying.

These were competent people. They were clear about their wants: Evidence that the controls we publish and claim to adhere to are actually working. And they knew what "working" meant -- that the circle is closed with human escalations and choices on exceptions. So that was good (and a lot of work for us) except for one teeny issue.

"Working" also means that the control environment will actually stop trouble. And these guys had essentially no interest in the technical effect of the controls. If I said "this is a report that shows yesterday's changes to all application admin groups", that was the truth. No test that we have the same reporting on all production DCs. No enquiry about alternative ways to get the privilege. No test that our installations actually adhere to the admin group conventions. If I listed a firewall policy, or handed over the perimeter network diagram, that was it. No enquiry about how often I checked the cable patching....

Now I know that they can't check everything. And I wouldn't want them to.... I know that they're at the wrong end of a crushing knowledge asymmetry. But all the same, it reminds me of the drunk searching for his keys under the lamp post: not because he lost them there, but because the light is so much better.

In the mean time, remember:

• A big four signature on a statement of controls -- SAS70 or whatever -- means less than you think.
• Somewhere in the big city, a security guy is neglecting controls that expose trouble in favour of those that'll audit well.

Choice. I hate it.

I bought a new computer last night. Even though I'm not exactly Mr. Desktop I thought I would be able to make a sensible choice. In fact I was so overwhelmed, I nearly bought nothing.

First: supplier. I've bought from Morgan before and had a slightly patchy experience (but nothing unfair, and nothing that couldn't be resolved with my own skills.) This time I was going to avoid trouble by sticking to brand new stock -- retired from shops after going out of date. I liked the look of the HP media PCs with TV tuners and big plug-in HDs -- they were old enough to be packaged with XP Media centre (I really don't want that "which Vista edition" issue until SP1 --maybe not then), they were fully loaded with ports and the more expensive models had Intel dual cores, 2GB memory and GEForce 7600 with 256 MB. I didn't want a screen package because the more mad son has a history of headbutting flatscreens to death: CRTs are tougher and I have them already.

So I thought that was pretty cut and dried. But I can't resist a quick visit to Dell.

First impressions are low price -- Dell include VAT, and Morgan exclude it (which I think is a tad dodgy on consumer kit sold retail). Now I know that Dell charge a shameless £50 for delivery but it turns out it's free until the end of the month. Second thing is that XP is back on offer -- it was Vostro-only in September but now the consumer pages have it too. And it's XP Pro which is a big plus.

So into the configurator to be faced with all those tough choices. Many of the base builds lack 2GB and the prices start notching up as I make those tempting choices. Not all models let me configure "no screen" and if I'm having a screen maybe I should get the posh graphics as well.

I finally settle on a bearable heuristic. I'll only get factory fitted upgrades where I haven't upgraded myself successfully in the past.

I end up with PC Duo 6550, 2GB (I've had problems with dodgy 1GB parts), the base graphics (because no-name GEF8600 will be cheap and good in a years time), the base HD (definitely getting NAS ....) And a screen, which was too good to give up for £80 and I will put on the PC upstairs to keep the less mad son happy until he gets his laptop.

All that choosing left me emotionally committed to the Dell. I matched it to an HP package from Morgan and found it close (screen to placate LMS with graphics upgrade option in the future vs. no screen, and better but obsolete graphics now; no media centre tuner remote & wireless vs. XP pro and the confidence I wouldn't use that stuff; in stock vs two week delivery ouch) but a few pounds less.

So I bought the Dell. But it wasn't easy.

Secure Timestamp

I enjoyed watching the moon race past some bright planet a little above the sunrise last week. I guess it was Jupiter -- a bit too far along the ecliptic to be Venus.

Over the weekend, there was a news feature about the Mahdi army in Iraq. At one point the camera zoomed in on the moon to show this conjunction closer than I ever saw it. For me, that dated the report better than any digital means -- no encryption, no secure timestamp -- just very hard to fake.

Export

Every morning lately, when I've been there to see, a train of twenty or so flatcars each with twelve colossal steel billets heads east, to Ashford and I guess the tunnel. This morning they were behind a class 92. In my mind this question: If the country is so prosperous that the government can offer flexible working hours to every employed parent, how can anyone make money exporting raw steel? Am I that detached from the real world?

Geek Alert

The shed computer has been on my queue for a very long time. It was running an elderly Kubuntu (6.04?) and I've never found it entirely satisfactory -- Konqueror is not supported in Google Docs, I couldn't get Firefox to install and in fact I couldn't get anything to update or install. Well, I can see which way the world is going, so I wanted to put a current Ubuntu, and I've finally done it. It wasn't easy. The PC is a Dell Latitude PIII. It was classy in its day, but I think it has problems, especially with the CD drive. The steps I've had to take to get it installed are these:

• Switch off the Hot-Switchable Floppy option in the BIOS. I don't even have an FD, but with the switch on, the boot was delayed for tens of minutes negotiating /dev/fd0 errors.
• Don't even try to boot the live CD into safe video (forcevesa). It would boot, in an hour or two, but it was continuously frobbing the CD and it would be impossible to get to the fourth screen of the installer. And the bars ar the top and bottom of Gnome were lost.
• And I gave up on the live CD. The text mode install CD (select it with the check box on the Ubuntu download page) installed first time. The live CD install failed at random points copying files to the HD. My burn of that image passes the veracity test, and I exchanged HDs, and the problem was still there. But the text installer just works.

And once it's up, it's pretty good. I was notified of 16 updates, all of which applied even though one was for Firefox which was open at the time. I've added MPEG codecs (which I suspect are excluded from the build to preserve its freehood -- Fraunhofer have some MPEG patents) directly from the player, mc (which I have to have) through apt-get, and Penguin Command (which I've missed ever since I tried Suse 7.2) through the Synaptic package manager. It all works. The only real hiccup was the networking -- it needed a few restarts to work -- I think it wasn't playing nicely with DHCP on the firewall. I've tried tuning the display, but the automatic setting seemed best. Sudo works nicely. It's not quite as responsive as W2k but it is all so much better done than I remember -- and I don't miss KDE at all. Best of all -- malware won't run. I can browse on! Oh -- and on the whole, I don't think it's as stable as Windows. The kernel is better (though the scheduler is cruder) and the management GUI and command-line stuff is fine, but in userland many of the third-party apps can silently disappear.

Die Daylight Saving Die! Die! Die!

Hurrah! The log files make sense again, and the gods of time have punished the impious humans for pretending that the solar zenith is 13:00....

Physical Insecurity

A frisson walking across the fields on my way home this evening -- that lively sound of bullets wheeling past my head. It wasn't a demented assassin emerging from my ugly past -- the faint red light gave it away as an incompetent lamper with a silenced rifle killing rabbits behind Forstal farm. He carried on firing as I walked out of danger even though I was shining my torch at his likely location. Once I'd got to the safety of the lane I walked along to find out what was going on, and encountered a man claiming to be Shay Harbour(?) He knew about the footpath, he said, and thought his line of fire would be OK.

Any more of that sort of thing, and I'm getting a 50mW green laser and a night vision scope -- after this shone down his bins he'd be hard put to tell up from down, let alone fire his weapon.