The #gotofail episode will become a text book example of not just poor attention to detail, but moreover, the importance of disciplined logic, rigor, elegance, and fundamental coding theory.
A still deeper lesson in all this is the fragility of software. Prof Arie van Deursen nicely describes the iOS7 routine as “brittle”. I want to suggest that all software is tragically fragile. It takes just one line of silly code to bring security to its knees. The sheer non-linearity of software — the ability for one line of software anywhere in a hundred million lines to have unbounded impact on the rest of the system — is what separates development from conventional engineering practice. Software doesn’t obey the laws of physics. No non-trivial software can ever be fully tested, and we have gone too far for the software we live with to be comprehensively proof read. We have yet to build the sorts of software tools and best practice and habits that would merit the title “engineering”.
I’d like to close with a philosophical musing that might have appealed to my old mentors at Telectronics. Post-modernists today can rejoice that the real world has come to pivot precariously on pure text. It is weird and wonderful that technicians are arguing about the layout of source code — as if they are poetry critics.
We have come to depend daily on great obscure texts, drafted not by people we can truthfully call “engineers” but by a largely anarchic community we would be better of calling playwrights.
Stephan Wilson, “gotofail and a defence of purists”, Lockstep, 2014-02-26.
November 13, 2016
QotD: Don’t call it software engineering
November 9, 2016
November 5, 2016
The Gunpowder Plot: Exploding the Legend
July 10, 2023: Replaced the replacement video with yet another one. Hopefully this one has a bit more staying power.
April 9, 2019: Replaced the original 2016 YouTube link with a current one. After all, the “only man to ever enter Parliament with honest intentions” should be remembered.
Reel Truth History Documentaries
Published on 20 Mar 2019Richard Hammond looks to provide a definite answer to an outstanding mystery of history… Could Guy Fawkes have succeeded with the Gunpowder Plot? 400 years after of the infamous Gunpowder Plot, when Guy Fawkes planned an explosion that would wipe out the King and the entire British Government, the question still remains what impact the blast would have had but this film sets out to discover what would have happened if he’d lit the fuse.
(more…)
November 4, 2016
Blend your own favourite wines right at your kitchen table
In the Economist, a look at a very different kind of wine appliance:
To create a new wine the customer manipulates three sliders on a touch screen attached to the machine. One moves between the extremes of “light” and “full-bodied”. A second runs from “soft”, via “mellow” to “fiery”. The third goes from “sweet” to “dry”. No confusing descriptions like “strawberry notes with a nutty aftertaste” are needed.
The desired glass is then mixed from tanks of each of the four primaries, hidden inside the machine’s plinth. The requisite quantities are pumped into a transparent cone-shaped mixing vessel on top of the plinth. Added air bubbles ensure a good, swirling mix and flashing light-emitting diodes give a suitably theatrical display.
Traditionalists may be appalled by all this, but they should not be. In Mr Wimalaratne’s mind, the function of the Vinfusion system is in principle little different from the blending of grape varieties that goes on in many vineyards, to produce wines more interesting than those based on a single variety. Moreover, if Vinfusion works as intended, it will let people experiment with oenological flavours in a way that is currently impossible and which lets them discover what appeals. A decent sommelier ought then to be able to recommend wines vinified in the conventional way that will taste similar.
In the longer run, recording and collating the requests made to a group of Vinfusion machines might even help restaurants and bars stock bottles that people will like, rather than merely tolerate. And if all this happens, the snobbery and mystique surrounding wine—whether blended in the vineyard or the restaurant—may disappear for good.
The selected “component” wines are chosen for their vintage-to-vintage consistency, so that there’s a lower variability in the wines used to blend your personal selection. This almost certainly wouldn’t work as well with wines from cool climate areas (like Ontario).
November 2, 2016
Online security theatre: “We sell biometric authentication systems to people who need a good password manager”
Joey DeVilla linked to this discussion of the Mirai botnet and the distressing failures of online security … not for the brilliance and sophistication of the attack (it was neither), but the failure to address simple common-sense security issues:
I’ve written about 1988’s Morris worm, and I wanted to dig into the source of the Mirai botnet (helpfully published by the author) to see how far we’ve come along in the past 28 years.
Can you guess how Mirai spreads?
Was there new zeroday in the devices? Hey, maybe there was an old, unpatched vulnerability hanging — who has time to apply software updates to their toaster? Maybe it was HeartBleed 👻?
Nope.
Mirai does one, and only one thing in order to break into new devices: it cycles through a bunch of default username/password combinations over telnet, like “admin/admin” and “root/realtek”. For a laugh, “mother/fucker” is in there too.
Default credentials. Over telnet. That’s how you get hundreds of thousands of devices. The Morris worm from 1988 tried a dictionary password attack too, but only after its buffer overflow and sendmail backdoor exploits failed.
Oh, and Morris’ password dictionary was larger, too.
October 26, 2016
A primer on last week’s IoT DDos attacks
Joey DeVilla provides a convenient layman’s terms description of last Friday’s denial of service attacks on Dyn:
A map of the parts of the internet affected by Friday’s attack. The redder an area is, the more heavily it was affected.
If you’ve been reading about the cyberattack that took place last Friday and are confused by the jargon and technobabble, this primer was written for you! By the end of this article, you’ll have a better understanding of what happened, what caused it, and what can be done to prevent similar problems in the future.
[…]
Hackread’s animation of what happened last Friday. Click the image to see the source.
On Friday, October 21, 2016 at around 6:00 a.m. EDT, a botnet made up of what could be up to tens of millions of machines — a large number of which were IoT devices — mounted a denial-of-service attack on Dyn, disrupting DNS over a large part of the internet in the U.S.. This in turn led to a large internet outage on the U.S. east coast, slowing down the internet for many users and rendered a number of big sites inaccessible, including Amazon, Netflix, Reddit, Spotify, Tumblr, and Twitter.
Flashpoint, a firm that detects and mitigates online threats, was the first to announce that the attack was carried out by a botnet of compromised IoT devices controlled by Mirai malware. Dyn later corroborated Flashpoint’s claim, stating that their servers were under attack from devices located at millions of IP addresses.
The animation above is a visualization of the attack based on the devices’ IP addresses and IP geolocation (a means of approximating the geographic location of an IP address; for more, see this explanation on Stack Overflow). Note that the majority of the devices were at IP addresses (and therefore, geographic locations) outside the United States.
October 18, 2016
This is really what the Internet of Things will be like
October 14, 2016
QotD: You can’t fix network security by changing the users
Every few years, a researcher replicates a security study by littering USB sticks around an organization’s grounds and waiting to see how many people pick them up and plug them in, causing the autorun function to install innocuous malware on their computers. These studies are great for making security professionals feel superior. The researchers get to demonstrate their security expertise and use the results as “teachable moments” for others. “If only everyone was more security aware and had more security training,” they say, “the Internet would be a much safer place.”
Enough of that. The problem isn’t the users: it’s that we’ve designed our computer systems’ security so badly that we demand the user do all of these counterintuitive things. Why can’t users choose easy-to-remember passwords? Why can’t they click on links in emails with wild abandon? Why can’t they plug a USB stick into a computer without facing a myriad of viruses? Why are we trying to fix the user instead of solving the underlying security problem?
Bruce Schneier, “Security Design: Stop Trying to Fix the User”, Schneier on Security, 2016-10-03.
October 4, 2016
September 17, 2016
A contrarian view of the introduction of the tank
At Samizdata, Patrick Crozier gets all contrarian about the tank in a post he titles “Haig’s greatest mistake”:
On 15 September 1916 tanks made their debut at Flers-Courcelette, one of the many engagements which took place during the Battle of the Somme.
The battle marked the beginning of a sorry chapter in British military history because the truth – a truth that to this day few seem prepared to acknowledge – is that the First World War tank was useless.
The list of its failings is lengthy. It was slow, it was unreliable, it had no suspension and it was horrible to operate. The temperature inside was typically over 100°F and as exhaust gases built up so crew effectiveness collapsed. It was also highly vulnerable. Field artillery could take it out easily. Even rifle ammunition could be effective against it. While normal bullets might not be able to penetrate the armour they could knock off small pieces of metal from the inside – known as spall – which then whizzed round the interior wounding all and sundry.
That the tank was the brainchild of Winston Churchill from his days as head of the Admiralty should have alerted senior commanders to the possibility that it was yet another of his crackpot schemes. But they persisted. For his part, Haig being a technophile put a huge amount of faith in the new invention. His diary is littered with references to the tank and he seems to have made great efforts to secure ever more of them. In consequence, huge amounts of effort went into a technological dead end when it would have been far better spent on guns, shells and fuzes.
Not that such efforts were ever likely to satisfy the snake-oil salesmen who made up the ranks of the tank enthusiasts. In the face of tank failure after tank failure they simply claimed that their beloved weapon just wasn’t being used properly.
September 16, 2016
Beasts of Steel – The First Tanks On The Battlefield I THE GREAT WAR Week 112
Published on 15 Sep 2016
For years the British had developed the idea of the “landship” or tank and now it was finally ready for the first deployment during the Battle of Flers-Courcelette. And even though technical problems plagued the new invention, the British leadership was confident that this new weapon would break the stalemate at the Western Front for good. In the meantime Germany was focusing all offensive efforts on the Romanian front to mercilessly crush the new enemy.
September 13, 2016
Tank Development in World War 1 I THE GREAT WAR Special
Published on 12 Sep 2016
The idea for an armoured vehicle that could withstand fire and travel across battlefields was already developed in 1914 after the Race to the Sea. The British “Landship Committee” developed the tank weapon in secrecy. The French were also trying out different designs at the same time. Learn all about the development and the invention of the tank in our special episode.
September 9, 2016
Apple may learn the lesson of “option value” with the latest iPhone release
Megan McArdle explains why some Apple fans are not overjoyed at the latest iPhones:
You’ve probably been thinking to yourself, “Gee, I wish I couldn’t charge my phone while also listening to music.” Or perhaps, “Gosh, if only my headphones were more expensive, easier to lose and required frequent charging.” If so, you’re in luck. Apple’s newest iPhone, unveiled on Wednesday, lacks the familiar 3.5-millimeter headphone jack. You can listen to music through the same lightning jack that you charge the phone with, or you can shell out for wireless headphones. The internets have been … unpleased with this news.
To be fair, there are design reasons for doing this. As David Pogue writes, the old-fashioned jack is an ancient piece of technology. It’s been around for more than 50 years. “As a result,” says Pogue, “it’s bulky — and in a phone, bulk = death.”
Getting rid of this ancient titan will make for a thinner phone or leave room for a bigger battery. Taking a hole out of the phone also makes it easier to waterproof. And getting rid of the jack removes a possible point of failure, since friction isn’t good for parts.
For people who place a high value on a thin phone, this is probably a good move; they’ll switch to wireless earbuds or use the lightning jack. But there are those of us who have never dropped our phones in the sink. We replace our iPhones when the battery dies, an event that tends to occur long before the headphone jack breaks. There are people in the world who take their phones on long trips, requiring them to charge them while making work calls, and they won’t want to fumble around for splitters or adapters. Some of us do not care whether our phone is merely fashionably slender or outright anorexic. For these groups, Apple’s move represents a trivial gain for a large loss: the vital commodity that economists call option value.
Option value is basically what it sounds like. The option to do something is worth having, even if you never actually do it. That’s because it increases the range of possibility, and some of those possibilities may be better than your current alternatives. My favorite example of option value is the famous economist who told me that he had tried to argue his wife into always ordering an extra entree, one they hadn’t tried before, when they got Chinese takeout. Sure, that extra entree cost them money. And sure, they might not like it. But that entree had option value embedded in it: they might discover that they like the new entree even better than the things they usually ordered, and thereby move the whole family up to a higher valued use of their Chinese food dollars.
August 22, 2016
QotD: Terry Pratchett and the hacker mentality
I learned something this weekend about the high cost of the subtle delusion that creative technical problem-solving is the preserve of a priesthood of experts, using powers and perceptions beyond the ken of ordinary human beings.
Terry Pratchett is the author of the Discworld series of satirical fantasies. He is — and I don’t say this lightly, or without having given the matter thought and study — quite probably the most consistently excellent writer of intelligent humor in the last century in English. One has to go back as far as P.G. Wodehouse or Mark Twain to find an obvious equal in consistent quality, volume, and sly wisdom.
I’ve been a fan of Terry’s since before his first Discworld novel; I’m one of the few people who remembers Strata, his 1981 first experiment with the disc-world concept. The man has been something like a long-term acquaintance of mine for ten years — one of those people you’d like to call a friend, and who you think would like to call you a friend, if the two of you ever arranged enough concentrated hang time to get that close. But we’re both damn busy people, and live five thousand miles apart.
This weekend, Terry and I were both guests of honor at a hybrid SF convention and Linux conference called Penguicon held in Warren, Michigan. We finally got our hang time. Among other things, I taught Terry how to shoot pistols. He loves shooter games, but as a British resident his opportunities to play with real firearms are strictly limited. (I can report that Terry handled my .45 semi with remarkable competence and steadiness for a first-timer. I can also report that this surprised me not at all.)
During Terry’s Guest-of-Honor speech, he revealed his past as (he thought) a failed hacker. It turns out that back in the 1970s Terry used to wire up elaborate computerized gadgets from Timex Sinclair computers. One of his projects used a primitive memory chip that had light-sensitive gates to build a sort of perceptron that could actually see the difference between a circle and a cross. His magnum opus was a weather station that would log readings of temperature and barometric pressure overnight and deliver weather reports through a voice synthesizer.
But the most astonishing part of the speech was the followup in which Terry told us that despite his keen interest and elaborate homebrewing, he didn’t become a programmer or a hardware tech because he thought techies had to know mathematics, which he thought he had no talent for. He then revealed that he thought of his projects as a sort of bad imitation of programming, because his hardware and software designs were total lash-ups and he never really knew what he was doing.
I couldn’t stand it. “And you think it was any different for us?” I called out. The audience laughed and Terry passed off the remark with a quip. But I was just boggled. Because I know that almost all really bright techies start out that way, as compulsive tinkerers who blundered around learning by experience before they acquired systematic knowledge. “Oh ye gods and little fishes”, I thought to myself, “Terry is a hacker!”
Yes, I thought ‘is’ — even if Terry hasn’t actually tinkered any computer software or hardware in a quarter-century. Being a hacker is expressed through skills and projects, but it’s really a kind of attitude or mental stance that, once acquired, is never really lost. It’s a kind of intense, omnivorous playfulness that tends to color everything a person does.
So it burst upon me that Terry Pratchett has the hacker nature. Which, actually, explains something that has mildly puzzled me for years. Terry has a huge following in the hacker community — knowing his books is something close to basic cultural literacy for Internet geeks. One is actually hard-put to think of any other writer for whom this is as true. The question this has always raised for me is: why Terry, rather than some hard-SF writer whose work explicitly celebrates the technologies we play with?
Eric S. Raymond, “The Delusion of Expertise”, Armed and Dangerous, 2003-05-05.
