Stacking Fault

iPhone Photo Leaked

Ever since the Motorola ROKR came out and was revealed to be so wonderfully craptastic, rumors have been swirling about Apple launching a mobile communicator line. The traditional rumor goes something like this... Apple makes a combo iPod / mobile phone and launches itself as a MVNO (Mobile Virtual Network Operator,) leasing GSM dialtone from Cingular or T-Mobile and reselling it to the end consumer. Even though they're "renting" someone else's telephony network, there's still profits to be had by offering higher value services... perhaps something like .Mac? What info we do have comes from sifting through patent and trademark filings. Earlier this month, curious bloggers discovered that Apple had trademarked the term "Mobile Me(tm)".

Apple's been pretty tight-lipped about the whole affair, but then again they're generally tight lipped about their product strategy. So it was a great surprise when photos of the "Mobile Me" were posted on Engadget and TUAW : The Unofficial Apple Weblog.

It's interesting timing... Not long after Pixar buys Disney... er... uh... I mean... Disney buys Pixar, we see Apple-branded sim-cards popping up in mobile phones. Given Apple's iSync infrastructure, it would likely be a relatively trivial task to integrate .Mac services like email and blogging. Heck we could even see a return of the Newton; this time as a dedicated media pad for rendering Disney content.

posted by Matthew S. Hamrick @ 11:35 AM 0 comments

To strive, to seek, to find, and not to yield

And, while with silent lifting mind I’ve trod
The high untrespassed sanctity of space,
Put out my hand, and touched the face of God.

-- John Gillespie Magee, Jr. "High Flight"

It's twenty years later and I still get sick to my stomach. No so much that we lost seven good people. That's cause enough to be sad, but we all come and go and when our time's over we should be happy for a life well lived. If you're inclined towards any kind of spiritual life, you might come around to believe that part of you survives after death. If not you can still take solace in the fact that even death can't erase the simple fact that you were once here.

Twenty years ago today we lost seven good people. But that's not what makes me a little teary-eyed today. It's the caliber of the people we lost. These are people who after decades of education willingly stepped aboard a thin metal and silica bubble strapped to 694,608 kg of ammonium perchlorate, 163,672 kg of an Aluminum / Iron Oxide, 554 cubic meters of Liquid Oxygen and 1515 cubic meters of Liquid Hydrogen. They did this without being coerced and even competed for the privilege of taking this risk. To get to launch day they put their personal (and in some cases professional) lives on hold for at least a year to undergo basic astronaut training.

These are characteristics of people you want to encourage. Sen. John Glenn, himself an astronaut, said it clearly in his remarks on the occasion of Judy Resnik's memorial:

We are a curious people, a nation that wonders about what we do not know, whether in laboratories or medical centers, from frontiers of the mind to frontiers of geography, and even beyond earth's limitations. We are curious about what is beyond the next hill, the next river or mountain. What's beyond the next bend in the road? - we not only want to know the answer to that question, we even want to determine where that road will go...

The conquest of space is not merely a technological project of interest to a handful of select scientists and specialists, valuable though that research and information may be.

It is nothing less than an expression of a basic American spirit. After all, we're the same people who tamed a continent, crossed frontiers, scaled mountains, and built the greatest strongest nation on earth. We see an opportunity, a challenge, think up a way to meet it, test it[,] adjust it and ultimately succeed with it.

It's easy to find things we do wrong. But every now and again we do wonderful things. Tennyson wrote of this noblest aspect of our nature in Ulysses. He wrote "To strive, to seek, to find, and not to yield." We don't need to go into space. We could easily do it all with remote robotic space craft. But JFK said it plainly in his 1962 speech at Rice University:

We set sail on this new sea because there is new knowledge to be gained, and new rights to be won, and they must be won and used for the progress of all people. For space science, like nuclear science and all technology, has no conscience of its own. Whether it will become a force for good or ill depends on man, and only if the United States occupies a position of pre-eminence can we help decide whether this new ocean will be a sea of peace or a new terrifying theater of war. I do not say the we should or will go unprotected against the hostile misuse of space any more than we go unprotected against the hostile use of land or sea, but I do say that space can be explored and mastered without feeding the fires of war, without repeating the mistakes that man has made in extending his writ around this globe of ours.

There is no strife, no prejudice, no national conflict in outer space as yet. Its hazards are hostile to us all. Its conquest deserves the best of all mankind, and its opportunity for peaceful cooperation many never come again. But why, some say, the moon? Why choose this as our goal? And they may well ask why climb the highest mountain? Why, 35 years ago, fly the Atlantic? Why does Rice play Texas?

We choose to go to the moon. We choose to go to the moon in this decade and do the other things, not because they are easy, but because they are hard, because that goal will serve to organize and measure the best of our energies and skills, because that challenge is one that we are willing to accept, one we are unwilling to postpone, and one which we intend to win, and the others, too.

We may measure our worth by the goals we set for ourselves. Amid the evidence of barbarism, there are moments when our full potential shines through; when all of us can share in the profound wonder of the universe; when as a people we reach out for the distant meadows of the future.

Every time a rocket goes up on a mission of exploration, that's a victory for our most noble nature. It is an opportunity to prove ourselves and dream a dream of peace and blessing and adventure.

Twenty years ago we learned that dreams sometimes come with a cost. We lost seven good people on a cold January morning. People who should be here with us to share the dream. And that's why every January 28th I get a little teary-eyed.

Apollo 1
Virgil "Gus" Grissom
Ed White
Roger Chaffee

Soyuz 1
Vladimir Mikhailovich Komarov

X15 Flight 191
Michael Adams

Soyuz 11
Georgi Dobrovolski
Viktor Patsayev
Vladislav Volkov

STS 51
Francis "Dick" Scobee
Michael Smith
Ron McNair
Ellison Onizuka
Judy Resnik
Gregory Jarvis
Christ McAuliffe

STS 107
Rick Husband
William McCool
Michael Anderson
Ilan Ramon
Kalpana Chawla
David Brown
Laurel Clark

posted by Matthew S. Hamrick @ 4:49 PM 0 comments

Hack my iPod Please!

There's a great tiny article over at the New York Daily News: Starbucks may fill coffee cups, iPods. It's essentially saying that industry titans Apple and Starbucks are teaming to deliver music downloads to iPod owners while they wait for their Strawberry Caramel Chai Mochachino. From the article:

"A lot of our customers are asking for device fill-up, and going forward we'll do that," said Ken Lombard, president of Starbucks Entertainment, at the Midem music industry conference in Cannes.

Instead of having to buy a CD version of "Vince Vaughn sings Tony Bennett's Greatest Hits" at the super-hip coffee emporium, taking it home, ripping it, then syncing to your iPod, I'm guessing the use model they're going after is more come into a Starbucks, select a song or album on a kiosk, dock yer iPod and Viola! You've got music.

But there are a couple issues here that I hope someone at either company is tracking.

First off... when you sync your iPod with a machine, you're syncing your iPod with every iPod that machine has synced with in the past. Viruses are, in general, not a problem for iPods. That's because they're somewhat difficult to get to and once you got there, what would be the point. To put a virus on an iPod, you would have to find a vulnerability in the iPod em the system it attaches to, effectively doubling the effort required. And once you've got a virus on an iPod, what are you going to do? Display nekkid pictures of Steve Jobs? Refuse to play anything except Sex Pistols and Pat Boone?

In the past couple of years we've seen an increase in the activity of serious criminal system-crackers. These guys are attacking home user's PCs and if successful, using them to carry out acts of extortion. I don't know if that's something we'll see coming to a portable music player near you. But the draw of being the "hacker that hacked your iPod through Starbuck's systems" is sure to attract some of the less socially developed hackers in our community.

I don't want to be an alarmist; the sky isn't falling.

But... it would be nice to hear that Apple or Starbucks spends a few moments thinking about risks and mitigations of this distribution channel.

Tags: ipod, security, Apple, Starbucks

posted by Matthew S. Hamrick @ 2:15 AM 0 comments

Mac Users To Go Through Hoops to use new Sony Reader PRS-500

Shortly after it's debut at the CES show this last week, Sony has released more details for the PRS-500 eInk-based eBook Reader. According to the company, the unit will be sold through Sony's online store and select Sony Style retail outlets.

Here's a brief summary of what we've learned so far. The reader contains a 6" (diagonal) 800x600 pixel eInk display with 4 levels of grey; weighs less than 9 ounces; and is less than one half inch thick. It contains an internal battery with a projected life of 7500 page turns between charges; recharging the unit takes "as little as four hours" with an optional AC adapter or 6 hours when recharged via USB. Memory capacity is 64Mb, but the unit can use memory stick or secure digital removable storage. If we are to believe the online store, the reader will retail for $349.99

In terms of content, Sony plans a wide range of titles (having learned from the ill-fated Libre reader that "content is king.") Major publishers are said to be ready to provide content for the device through the Connect! music store.

But here's where the deal turns sour for Mac users. First, the Connect! online store requires Internet Explorer on Wintel with (get this) Administrator privilege. My first reaction to this news was to wonder if they were planning on installing spyware to ensure you're not running a .lrx file cracker, but I'm guessing it has something to do with ensuring that you only connect to the store with a VAIO PC. There is apparently no work-around for this. Mac users are out in the cold. You just don't get to download content for the device.

Second, to install your own content on the device (like from a PDF file) users will need to run a PDF -> BBeB conversion utility (BBeB is the Reader's native format.) Though the Sony website does not explicitly mention this, I do not doubt that Sony will provide only Wintel versions of this utility. The good news is that the BBeB format was partially documented by Sony and an active community of BBeB tinkerers exists. In theory, Mac users could use open source software to convert PDF and XML files into a Reader-readable format.

Audio is a another story. Sony's compressed audio format of choice is ATRAC3, not MP3 (or AAC or FLAC or OGG/Vorbis or ...) Reading and writing ATRAC3 files on a Mac has been problematic at best. And remember, if the labels can convince congress to close the analog hole, then there's virtually no chance you'll legally be able to play music through your Sony Reader.

Finally... in the past I've had terrible compatibility problems between Sony and non-sony products. Early version's of the company's Clie handheld stored information in a proprietary FAT-like format when exported to memory sticks. The DCR-PC5 camera's still pictures are written to a memory stick using a format unknown to non-Sony products. It's probably too early to know for sure, but it's not beyond the realm of possibility that the Reader uses a non-standard file format for memory stick and secure digital cards.

So... on the plus side... the PRS-500 looks like a great product. The low weight, low power high contrast display makes for an user experience that could potentially be excellent. But the drawbacks could prove fatal for Mac users. While there's some hope that free software could be used to convert PDFs and some XML formats to BBeB, there's an outside chance that the device will use a proprietary format on memory stick and secure digital media. So... before you buy one of these things... take a SD card into the showroom with you and see what formats the device can read.

Tags: e-ink, Sony, librie, atrac, bbeb, Gadgets, Mac

posted by Matthew S. Hamrick @ 2:00 AM 3 comments

USB + Fingerprints = FUN

A couple years ago I had the pleasure of talking with some of the Sony researchers working on the Puppy Fingerprint Identity Token. The idea behind this product is simple: you add a fingerprint scanner to a USB flash drive and viola! secure storage!

I tend to believe that there's a lot of hype surrounding Biometrics these days, but I have no problem with their use as long as users are familiar with the risks that come with modern Biometric technologies. I don't think there's anything wrong with biometric identification as long as it's not the sole authentication mechanism in a secure protocol. Aside from privacy issues of having your fingerprints on file (or trusting that your reader can securely store your fingerprint) you also have relatively high error rates, biometric readers getting faked out by silly-putty fingers and the difficulty of revoking your finger.

But hey... they sure do look cool, don't they? Nothing makes you feel like a character from an Ian Fleming novel like your computer telling you, "Authentication Required : Place Your Finger on the Reader Please."

All kidding aside... Biometric based identity systems have their place in the security ecosystem and hey, if putting your grandma's cookie recipe on a Sony Puppy makes you sleep easier at night, then it's probably worth the extra cash you plunked down for it. But please take a few moments to consider some of the risks (listed below.)

Over the last couple years we've seen a bit of growth in the Biometric-enabled flash drive market. Lexar, one of the more recognizable brands in the space has their TouchGuard (tm) line of JumpDrives with capacities of up to 256Mb (though a recent press release indicates they'll be shipping a 1Gb TouchGuard (tm) JumpDrive soon. Pretec recently announced in a press release on their site they'll be marketing a 4Gb fingerprint-protected USB flash drive.

authentication tokens

But there's also the market for plain 'ol fingerprint scanners. From humble beginnings, there are now more of these things than one can shake a stick at. One of the ones I keep coming back to is the Priva-Tech "cleared" platform. It's more than just a fingerprint scanner, it's a whole infrastructure. If you're an enterprise customer looking for a bit of value-add in terms of manageability and the ability to authenticate against multiple versions of Wintel, this may be the product for you.

On the other hand, you might just be a hobbyist looking to play around with a fingerprint scanner. The Priva product mentioned above is definitely not for you. These devices have become commodity products these days, so maybe searching eBay will get you the best deal. You may want to also look at Atmel's FingerChip line of fingerprint readers.

cool devices

But by far the coolest thing I've seen for hackers and system prototypers to date is the BlackDog. This is a small PowerPC based linux system with an integrated flash drive and fingerprint scanner. When I saw it demonstrated, the system would quick-boot when plugged into a USB port and ask for a fingerprint. After successfully authenticating, it would auto-mount a read-only USB drive with a Wintel X11 server and pop up an X login screen.

Word on their site is you can reprogram the thing to do whatever you want. Though I don't really see Linux as being the solution to every problem out there, the tool-chain is well developed and there are plenty of competent Linux developers available, so this strikes me as one of the applications where Unix / Linux really shines. I can't really tell you what practical application will come of the BlackDog, but I do know that the cost of using a proprietary OS for this product might have proved excessive.

Someone out there is going to find something really cool to do with these things. So if you're a tinkerer... check this one out.

platform support

One of the problems I've seen throughout the biometric-enabled USB device market is the nearly exclusive focus on Wintel or WinCE. Most of the flash drives are configured to export a USB mass storage device after successful authentication, and thanks to that specification being platform independent, it's generall not a problem to use the device. So if you have a pre-configured Puppy or TouchGuard device, you should (in theory) be able to use it with a Mac or Linux system.

On the other hand, advanced features like acting as a secure password vault and training the device to recognize your fingerprint seems to use Wintel-only software.

Pity.

avoiding the risks

I'm not trying to tell you not to use these things... rather... remember that every product has risks, and the guy that's trying to sell you one of these things might be be downplaying them.

• Risk 1 : It Stops Working To be fair, this is a problem with all removable media. Sometimes they fail. One of the selling points of the TouchGuard for instance, is that it stores your passwords in one, fingerprint-protected place. This is great as long as you don't drop the device overboard on a fishing trip. Make sure there's some way to backup the contents of your device lest you risk losing your data.


• Risk 2 : Someone Fakes Your Finger This is more of a problem if you allow your fingerprint reader to be used unattended. Researchers have shown recently that fake fingerprints made of silly-putty are able to fake out many readers out there, so if you happen to see someone fumbling around in their pockets for something that looks positively bogus, maybe you should say something. But hey... we can't all be everywhere all the time. Your drive might get lifted out of your pocket for a few moments and used without your knowledge. If it's only protected by your fingerprint, it's conceivable that a bad guy could lift your fingerprint from that highball glass, craft a fake finger, lift your device and bingo! Granted... if bad guys have to go through this much work to get your grandma's cookie recipe, you've pretty much won. They had to go through a lot of hassle to get something that's not especially valuable (sorry grandma.) But if you're carrying your super-secret marketing plan around on one of these things and there's identifiable monetary loss that could occur if the info was leaked, there's probably a little wisdom in plugging this hole. Many devices come with software that encrypts the contents of drive partitions, directories or individual files. On Mac and Linux platforms, encrypted drive images are relatively easy to implement. Bottom line... multi-factor authentication is a good idea.


• Risk 3 : You Lose Your Finger Don't laugh, it could happen. And it will happen at the worst possible moment. Remember what I said about making backups? This might be another reason why it would be a good idea.

what i would put in the devices

On the off chance that a product manager from Pretec or Lexar are reading this, let me take a few moments to list a couple of features I would like to see in these flash drive products.

• multi-platform support Yes.. I know.. Wintel is the vast majority of the market. However... we have a bunch of Solaris and Linux servers at work that we're not migrating to Wintel anytime soon. We're also a bit suspicious of including Wintel boxes in "sensitive" processes. So if I one product supported enrollment on Solaris or SE/Linux, that would be a pretty strong differentiator.


• multi-user support What would be really, really cool is if the device would support multiple users. It would be great if I could assign access rights on a file or directory level.


• 1st or 3rd person key recovery We all know there are no locksmiths in the digital world. From a corporate perspective, I would love to use these types of products, but I've got to say I'm a bit freaked out by the fact that my CFO could put sensitive info on the thing, then get run over by a bus and I would have no ability to get the latest financial info off the thing. For personal use I'm a bit spooked by 3rd party key recovery, so having a 1st person key recovery mode would be a big win for me. I could enroll myself as the primary user, then enroll my wife, barber, friends in a M-of-N key splitting scheme so that if I ever did get smacked by a bus it's conceivable the info could be recovered.


• biometric api support This is a tough one... from a business perspective this can be bad; but it can be good. If you look at Cryptoki, Microsoft CAPI/CSP and PC/SC, cross-platform APIs can drive the commoditization of your product, but it's a necessary step before you get to mass adoption. At some point the benefits of mass adoption will exceed the drawbacks of commoditization. When this happens, it's time to take a serious look at platform-independent, open APIs.

Tags: usb, biometrics, blackdog

posted by Matthew S. Hamrick @ 2:15 PM 0 comments

Quantity has a quality all its own

Somewhere I heard the quote, "Quantity has a quality all its own." I can't remember who said it; a Google search implies it was a quote by Comrade Stalin. But the iron dictator was talking about large numbers, not small numbers. I've recently been thinking about small numbers... specifically how cheap can you make a decent computer?

And I'm not alone. The guys at the MIT media lab are working on the problem as well. Their $100 Laptop Project aims to high-quality devices in the hands of children world-wide. Take a look at some of the project principals: Negroponte, Jacobson and Papert. You probably know about Negroponte... grand ol' man of the Media Lab. Jacobson is a serial entrepreneur; the most interesting connection being his affiliation with eInk. Haven't heard of eInk? Don't worry, you will. If you have any contact with the educational technology community, then you probably know who Seymour Papert is. I got to hear him speak at a "Technology in Education" conference at North Texas State University (now University of North Texas) in the early 80's. His book "Mindstorms : Children, Computers and Powerful Ideas" was perhaps the early reference for the community. He later worked with Lego to produce the Lego Mindstorms Robotic Invention System.

Over the last several years I've studied a lot of business startups, and a major predictor of a startup's success is the experience of their founders. Not surprisingly, more experienced founders have a much better track-record... From this perspective, I hope to see some very good things come from the Media Lab.

Another effort to put inexpensive computers in the hands of those on the wrong end of the digital divide is Simputer effort. The Simputer is a small, Linux-based device with a simple interface, digital telephony capabilities and a smart card reader. The idea is that in poor, rural villages the computer could be shared by a number of families. The simputer was originally conceived by Dr.'s Manohar and Vinay, then at the Indian Institute of Science. The current incarnation of the Simputer, marketed by Amida Simputer is apparently available now at Amida's showroom in Bangalore or via electronic purchase (though I've heard people complain that it's difficult to actually buy a simputer.)

The simputer and the $100 laptop remind me a lot of the Dynabook concept from PARC alumnus and Smalltalk godfather Alan Kay. Designed to be an electronic textbook for kids of all ages, the Dynabook featured Smalltalk as an educational computer programming language. Lest you think the Dynabook is just a concept, click over to the the Squeak Foundation page for a quick note about what's going with the technology.

And we're starting to see this kind of technology go mainstream. Tablet PCs have been around for a while, but for the most part they're PCs with pen based input. The Dynabook is intended to simultaneously be "less" than a PC and "more" than the recently announced eInk-based Sony Reader.

Now that the Simputer and the $100 Media Lab laptop are looking less and less like vaporware every day, how long before we start seeing a real Dynabook style system? An instant-on device (like Jef Raskin's Swyft,) with a high-contrast display (like the iRex illiad) and the educational potential of Squeak or Logo?

posted by Matthew S. Hamrick @ 5:00 PM 0 comments

Microsoft Releases Fix for WMF Vulnerability Early

This just in...

The Redmond, Washington softare giant Microsoft originally announced patches for the so-called WMF vulnerability were to be expected no earlier than the 10th of January, 2006. But this move didn't sit well with many users of the company's Windows operating system. As covered in stories at ZDNet and Information Week, the Windows Meta File (WMF) vulnerability is especially dangerous and existing workarounds considered "weak at best."

Official word from Microsoft execs was for users to simply wait for the the fix to be made available on the next regularly scheduled security patch cycle release on January 10th. But the lag between the December 27th discovery of the vulnerability and the proposed January 10th release of a patch left a sour taste in the mouths of many corporate data center operators.

Security think-tank and advisory clearinghouse SysAdmin, Audit, Network, Security (SANS) Instititute took the unprecidented step Tuesday, recommending affected users download a non-official patch ( available here ) from a trusted security researcher.

Following the Inadvertant release of a beta patch yesterday, the company has decided to move up the release of the patch that fixes the WMF vulnerability.

More details can be found at the Microsoft Security Bulletin Advance Notification page.

posted by Matthew S. Hamrick @ 12:40 PM 0 comments

UCS Satellite Database, Iridium Flares and Satellite Spotting

The Union of Concerned Scientists is a little.. uh.. concerned about all those satellites in orbit. Sure some of them are communications birds, but you never know how many of them are nuclear missile launch platforms or spy sats or orbiting mind control lasers. So they did something about it; they compiled a handy list of known satellites and put it in an Excel spreadsheet. Sure, CSV would probably have been nicer, but my copy of OpenOffice opens the file just fine. They don't include details like orbital elements, which would totally rock, but they do list URLs where you can get more information about each bird. There's also a users' guide with a brief introduction to orbits which is handy if, like me, it's been a couple of years since you touched an orbital mechanics text.

The list is available from the Union of Concerned Scientists UCS Satellite Database page.

People looking for a slightly more technical and slightly more detailed introduction to orbital mechanics can find a good reference at the Rocket & Space Technology Orbital Mechanics page.

And while we're on the subject of artificial satellites... one of the coolest things in the world (I think) is going outside to look at an Iridium Flare. If you're looking up on a clear night at the right time from the right place, you can see the sun reflect off the solar panels of the Iridium communications satellites. The Visual Satellite Observers page has a nice section on Iridium Flares as well as links to programs and web pages you can use to calculate when the next flare will occur in your area.

Another site of note is Chris Peat's Heaven's Above. There's lots of good tools for the amateur satellite spotter including a web-based iridium flare prediction tool and a satellite database with orbital elements. If you've found a satellite on the UCS list you're interested in, you can use the "Norad Number" found in column U as the query on the Heaven's Above Select Satellite form (paste the "Norad Number" in the top text field on the select satellite form and hit the submit button.) You'll be rewarded with a metric boatload of information, including orbital elements.

posted by Matthew S. Hamrick @ 8:00 AM 0 comments

Sony Libre, Redux

So last year I fell head over heels in love with the Sony Libre. An eBook reader with eInk's low-power, high-contrast display technology. But the Libre's fatal flaw was it's reliance on DRM protected content. Simply put, there was no "official" way to get the thing to display anything but a handful of texts available from the Sony eBook store.

This is so wrong. I just can't tell you how hard it was to see such a beautiful display attached to a device for which I could not find a use.

So I'm happy to see that at this year's Consumer Electronics Show in Las Vegas, Sony is showing off it's next generation eInk based eBook reader. This time it supposedly comes without the pesky DRM. Gizmodo has pictures the "Q Reader" (or maybe it's the "a Reader," I can't really tell) on their site at Live From CES: The Sony Reader. Reports indicate that the new device does have the option of downloading DRM protected titles from Sony's online Connect! service. But it also looks like you'll be able to load PDFs via Secure Digital, Memory Stick or USB.

However, if my experience with the Sony Clie and the DCR-PC5 is any indication, you'll likely need to reformat the memory sticks and SD cards using a proprietary application that runs on a single version of Windows and distributed only with three specific models of VAIOs.

This is the type of device I would love to see, and I'm sure that Sony can bring some serious production and logistics muscle to bear on making this reader a success. But I'm a tiny bit turned off by the lack of a keyboard (I would love to be able to search my eBooks) and given Sony's history, I fear the only text input option will be via VAIO.

Oh Well. Eventually someone will make a device like this that Mac users could use.

posted by Matthew S. Hamrick @ 1:44 AM 1 comments

Software Security Bookshelf

Since posting the article Towards More Secure Software, a couple people have emailed me asking for references for secure software development. There's a lot written on the subject, and I'm sorry to say there's no one single reference I can point people to. Rather... I can give you a list of titles on my bookshelf...

General Software Security

The book on the top of my list these days is Security and Usability : Designing Secure Systems that People can Use. Edited by Lorrie Cranor and Simson Garfinkel, the text contains contributions from some of the industry's brightest minds on the subject. I like to think of this book as a text that points you in the right direction rather than telling you how to get over every obstacle along the way.

Computer Security : Art and Science by Matt Bishop gets my vote as best overall introduction to the subject. It's got a little bit of a philosophical slant to it, so you're not going to find things like "how to implement canaries to defend against buffer overflows" in this text. You will however, find information like how to structure your application to leverage cryptographic and access control primitives to ensure confidentiality of sensitive data and positive control over the flow of execution. Great Stuff. If you read but one book about computer security this year, let it be this one.

Practical Guidance

There's plenty of free advice on the Internet these days, not all of it worth reading. However... David Wheeler's Secure Programming for Linux and Unix HOWTO - Creating Secure Software is a wonderful place to start, if you're a Unix programmer. Even if you're not a Unix guy... you might want to peruse this online text while waiting for other books to arrive from Amazon.Com.

John Viega and Gary McGraw penned the text Building Secure Software which is a good introduction to the subject. It's getting a little dated and includes little about how to deal with fundamental security technologies such as SSL / TLS and X.509 certificates, but what is in there is pretty good.

If you're a Windows developer, you probably want to take a look at Writing Secure Code by Dave LeBlanc and Michael Howard. When Microsoft had their recent "Security Stand-Down" a couple years back, developers were given a copy of this book and told to read it. Now we still see a lot of vulnerabilities in Microsoft products; I'm guessing this has more to do with aggressive development schedules than any lack of good info from this text. If you do any windows coding, you'll be doing yourself a favor by spending a few weeks really digesting the contents of this text.

Thinking Like An Attacker

One obstacle to writing good, clean, secure code is not understanding how attackers get into systems. There are a couple of resources out there that can help you put aside your trusting nature and learn how bad guys exploit weaknesses in systems to pry their way in. Before rushing out and buying any texts on the subject, however, sit down and read Smashing the Stack for Fun and Profit. There aren't too many more technical details here you won't find in some of the texts above, but it's presented in the context of an attacker, not a defender. Besides, it's free, and the Buffer Overflow seems to pop up just about everywhere, so it's great to have a review. Besides, it's free.

Security Warrior by Anton Chuvakin and Cyrus Peikari is another book I offer with the caveat that it's more useful as a guide to understanding how attackers think rather than what tools they use. Reading this book won't make you a "hacker," but if you've got the kernel of a hacker in your soul, it can help draw it out.

Next I have a pair of books: Takedown by Tsutomu Shimomura and John Markoff and The Art of Deception by Kevin Mitnick. Mitnick was the famed hacker once thought so dangerous he could take down the international banking system should he be left alone with a pay phone for a few minutes. This is total garbage, of course. Mitnick is about as technical as my big toe (thought as big toes go, mine is fairly technical.) However... he is a master of human engineering. In the old days he would have been called a "con man," but you add a bit of jargon to your come-on and viola!, you're a hacker! Shimomura is the real-deal though; he's got a brilliant technical mind and a demonstrated ability for profound, individual thought. But you need to understand the thought process of both types: con-man and tech-savvy hacker. Get both books.

Crypto

What's a security bookshelf without a few books on cryptography? Unless you've been under a rock for the last decade, you've probably seen Bruce Schneier's Applied Crypto. If you have no experience with crypto whatsoever, this is as good an intro as any. Personally, I'm a little more partial to Doug Stinson's Cryptography : Theory and Practice, as I like Stinson's writing style a little more. It does, however, have a bit more math than Schneier's book, so if you're math-o-phobic, you might want to stick with Applied Crypto.

If you think you're going to be called upon to implement crypto functions, or you need to know a bit more detail about how things work under the hood, Handbook of Applied Crypto by Menezes, et al. is a great text. What makes it even greater is you can download it as a series of PDFs from the Handbook of Applied Crypto page.

If you're doing anything at all with secure communications, you'll eventually be asked to do something with SSL (Secure Sockets Layer) or it's successor TLS (Transport Layer Security). TLS is pretty easy to understand from a conceptual level, but when it comes time to actually make implementation decisions, there are a bunch of little details you've got to get right. A lot of people start off by trying to make heads or tales of the OpenSSL documentation. I recommend reading Eric Rescorla's SSL and TLS: Designing and Building Secure Systems or SSL & TLS Essentials: Securing the Web by Stephen A. Thomas first. Rescorla's text is good if you're comfortable with a moderate degree of technical detail. Thomas' is good if you want the tech-o-meter turned down a bit.

One thing I've noticed about all these texts though... they're pretty light in their coverage of Elliptic Curve Cryptography. Adoption of ECC has lagged behind the DL and RSA public key crypto family of algorithms for a number of reasons. But a couple of new technologies have sprung up that make ECC worth looking at again. There are plenty of high-quality ECC implementations out there from people like Certicom and RSA. But ECC has traditionally suffered because some aspects of it's use are still covered by patents and it's generally a lot easier to explain the RSA algorithm to non-specialists. I can't do anything about the IP encumbrance issue, but I can recommend A Course in Number Theory and Cryptography and Introduction to Elliptic Curves and Modular Forms . They are not for those with a fear of equations; lotsa math here. But if that doesn't scare you away, they're GREAT books.

Finally, there are no great books about X.509 and PKI. Texts on the subject tend to be so broad as to provide no real technical guidance or so focused on technical minutiae that over-arching concepts are impossible to pick out. Carslile Adams and Steve Lloyd's Understanding PKI: Concepts, Standards, and Deployment Considerations is about the best I've seen for a good, healthy overview. They sometimes seem to throw in unnecessary technical detail in places; other sections are frustratingly devoid of technical detail. Overall, however, it's a good text.

Well.. that's it. Fifteen books and a couple of web pages should keep you busy for a while.

posted by Matthew S. Hamrick @ 11:16 PM 2 comments

Towards More Secure Software

So I was just reading about a vulnerability found with the BlackBerry Internet Server, and started thinking about the general state of software security.

I often bemoan the state of the art in computer security. Rather than being a highly "scientific" field where solutions are found simply by cranking through a few formula, it's really more of an "art". Don't get me wrong, there are plenty of places where you have simple answers to simple questions. But anytime you get something more than a Commodore 64 connecting to BBS over a 1200 baud modem, thing get complicated quickly. And rather than formulas to drive us to mathematically verifiable solutions, we get rules of thumb that are applied (often incorrectly.)

When developing commercial products, security frequently gets short shrift because it's very easy for project managers to look at the schedule and say, "uh... guys... we've got to release something in less than a month... why don't you just wait until later to implement all this security stuff?" And then the marketing and business development guys chime in to say, "hey! we could make security a third-party opportunity! we could turn our product into a platform where we get a secondary revenue stream by selling developer tools!" On the off chance that engineering is given any time to implement anything more than baseline security features, you often hear from QA or the User Experience group saying something like... "uh... what's all this security stuff? why do I need to always change my password when I first pull the product out of the box? Isn't that going to confuse the user?"

When engineering groups respond to such questions, we frequently are left explaining things in vague generalities... "uh... this idea violates the concept of defense in depth," or "yeah... we could cut this corner but it would violate the principle of least privilege." Management gets involved to try to resolve the scheduling issue and you often find people in charge wondering why am I risking a schedule slip to prevent violating an abstract rule of thumb when no-one can show me how violating this principle leads to a practical attack?

Project managers, salespeople, marketing professionals and CEO's are rewarded when products ship. If the product isn't shipped, there's no reward. If you manage a group that frequently doesn't ship products, then you wind up getting penalized (usually with a bad reputation around town or by not getting a raise the next time performance reviews happen.) Engineering security people generally aren't singled out for reward when a product ships. At enlightened development shops, they're added to the engineering team and share the team's rewards for shipping, but you rarely hear people talk about the heroic efforts of the security team that led to such and such a product being released on time and under budget. What you do hear about is what happens when a vulnerability is discovered.

Often what happens is you hear some quiet rumblings on the Bugtraq mailing list or in the forums of various hacker websites. Or maybe you read about critical vulnerabilities announced at computer security conventions ( like the Sklyarov / Adobe / Def Con Controversy and the Lynn / Cisco / BlackHat Controversy.) News of a vulnerability eventually seeps out to IT managers who start getting nervous. CEOs start asking CIOs if their systems are secure; many nervous phone calls are made to product reps and sales people. On good days patches are released before the system cracker community learns about the vulnerability.

In an ideal world software would be shipped without security vulnerabilities. Software companies would have time during development to consider all potential security flaws; not only in their software, but also in other packages used with their software. The holes would be fixed prior to shipping; everyone would be happy.

But the interesting thing about the software marketplace is that customers are willing to accept a small amount of risk to get features implemented faster; they're also willing to accept a lower degree of overall quality as long as the package does "just enough" to provide value. For instance, I use blogger.com to manage my blog for me. I have friends that frequently tell me I should be using WordPress or even Joomla to manage my blog. They are both clearly technically superior, but come with an added administrative burden. Simply put managing my blog via blogger.com provides me "just enough" capability with a minimum of administration.

I'll leave it as an exercise for the reader to ponder this concept with respect to software from a very large software organization in Redmond.

So we have a world where the underlying reality is consumers want new features as fast as they can get them. Apart from new features being fun, they're seen to provide incremental value either by increasing organizational efficiency or allowing people or organizations to do things they couldn't do without them. Software engineering organizations are pressured to implement new features as quickly as possible and with the minimum resources necessary to enhance an organization's return on investment. More features in new versions made with fewer resources being sold more often is music to the ears of Silicon Valley entrepreneurs. Engineering security developers working to add new security features or to enhance the security of non-security features tend to have a limited picture of how a particular piece of software will be integrated into a system delivered to an end user ( this is one of the reasons why "Security is Hard". ) Without a specific vulnerability in the code-base, it's very difficult to sell the idea that a product's release date should be pushed back to work on security or general quality aspects.

What we get from this is a stream of products with unidentifiable levels of quality and security.

On good days security researchers who discover vulnerabilities are "white hats." Classic hackers who put their talents to use for good, not evil. In the ideal world when a "White Hat Hacker" finds a vulnerability, they warn the developer of the vulnerable product, frequently including an exploit to demonstrate the problem. They give the developer time to develop and distribute a patch, and then go public with the vulnerability report.

In the old days there was a lot of controversy between software developers and security researchers (and plain 'ol hackers who simply enjoy taking things apart.) Commercial software developers didn't like the way frequent vulnerability reports made them look. The simplest way to approach this problem, they thought, was simply to shoot the messenger. The Sklyarov Controversy from several years back was the most perverse example of this line of thought. Eventually both communities (the white-hat security researchers and the software developers) realized they could co-exist and that's why you frequently find public disclosure of a security flaw immediately after the affected company releases a security patch to eliminate the vulnerability.

It's not a perfect system, but it seems to work well... until you're the victim of a security exploit and unknown attackers have made off with sensitive information. If you want to talk about having egg on your face, just take a look at the list of people who have been forced by the California Security Breach Information Act to tell their customers they weren't able to properly care for the security of sensitive information placed in their care.

If it were only the case that credit card numbers were being stolen, we might be able to say "it's not so big of a deal." Credit cards in the US come with caps on liability for fraud. Often the credit card companies will waive even that small liability. But we're seeing more than just credit card number stolen. A recent story in the Washington Post informs us that Marriott failed to properly protect Social Security Numbers for close to 206,000 members of the Marriott Vacation Club International. Can anyone say Identity Theft?

We're at an inflection point in the adoption curve of online technologies. Some people I know have stopped purchasing things online or providing sensitive information to online services. This is the first activity in what I suspect will be the "technology disownment curve." There's no clear metric to define the risks from using online services that require you to enter sensitive information. There's no security equivalent to Google's Page Rank algorithm. A lot of online vendors will point to their use of SSL as proof of their commitment to security. But I hate to tell you... SSL is just the beginning of web application security. It's the easy part. You still have to worry about Cross Site Scripting, SQL Injection and privilege escalation. The mobile phone industry has only recently started taking baby-steps into the world of wireless data access. In Japan, the EDY project allows mobile phone subscribers to use their phones as cash-cards. How long before this gets hacked? There's no indication that mobile phones are especially vulnerable, but I can tell you from personal experience it's been a long, uphill road advocating for enhanced security solutions for mobile phone handsets. (Let me say, however, that my employer, PalmSource, takes it pretty serious... that's one of the reasons I'm working there.)

Some people have suggested we'll start seeing more attention to security when software vendors are held to a higher degree of liability. I would agree with this, but I don't see it happening anytime soon. There are non-negligible costs associated with pumping up the quality and security of commercial software, and these costs are going to be passed on to the end user. Before we have something like this, we must know what the effect of enhanced security is on people's buying behavior.

And I've got to say... the state of the art is pretty abysmal. Microsoft's much ballyhooed "security stand-down" a couple years ago did nothing to eliminate security vulnerabilities in their products. As I write this, Windows users world-wide are scrambling to figure out what to do about the WMF Vulnerability. The problem is so acute, some people aren't waiting on Microsoft to deliver patches but are instead getting them from third parties.

So here's my two cents.

We all agree that secure software is a good thing, but no one wants to pay for it. We have no objective measure for what is secure and what is not secure. There are few easily quantifiable penalties for shipping insecure software, and I'm not entirely convinced that software can be made especially secure without detailed knowledge of the environment in which it will run. Every day we build larger and more flexible software systems, layering component on component, increasing the vulnerability signature of common systems. Work on "formal methods" for testing software security continues, but few researchers are tackling the problems of validating the security of common development environments from Microsoft, Borland, Oracle or Sun. And in the end, validating the security of software outside the context of the environment in which it runs may end up being a fools errand.

What can we do to enhance the security and quality of our software?

First off... as a consumer, demand better. Every now and again refuse to buy the latest version of Microsoft Office or Oracle Financials or even Adobe Acrobat unless the vendor has a "security story" that isn't pure BS. Refuse to buy a new mobile phone unless your carrier can tell you how it won't leak your AIM account information. Read up about information security and don't let salespeople get away with repeating unfounded BS about product security.

As a software developer, read more about how vulnerabilities creep into systems. There are several good books about designing and implementing secure software. Read them.

As a manager of a software development project, establish base quality and security objectives. If you don't know how to do this, find out.

As a researcher, develop metrics to evaluate quality, robustness, and resistance to attack of software and systems.

As an industry, we're going to have to think about the whole software liability issue. We might want to start talking to actuaries and insurance professionals to find out how businesses manage risk. Is there a way for ISVs (Independent Software Vendors) to assume limited liability and still remain in business? What will this do to the cost of our products? How will the market value warrantees on software?

I don't know if any of these actions will lead us to the promised land, but you never know...

posted by Matthew S. Hamrick @ 6:45 PM 0 comments

eInk Display on JumpDrives from Lexar

Okay... I admit it... I'm turning into an eInk junky. While I can generally take a pass on the concept of the big flexible wall clocks made of the stuff, I can't wait to have an eBook Reader or even a PDA or Tablet PC with a high-contrast eInk display. I work for a company that makes operating systems for mobile phones and PDAs, so it's no shock that that's the market segment I'm focused on. I was a bit surprised recently when I started drooling over a JumpDrive. Yes... like many of my peers, I carry a neclace of these devices around with me in case I have to quickly transfer files via sneakernet.

But Lexar announced recently in press release on their site that they'll be shipping the "JumpDrive Mercury" which includes an integrated eInk capacity meter. The application is pretty straight forward... just by glancing at the thing, you can see how much space you have left on the device. I don't think it's going to revolutionize the industry or anything, but I thought it was a cool application of eInk technology. eInk displays don't require any power during static displays; you only need power when you change the display. .

On the off chance that someone from Lexar is reading this, let me chime in with my recommendation. There's a little white area on the back of the red JumpDrives that's obviously intended to be used to write a title or serial number or note about the contents of the jump drive. So far I've tried using several different types of marker to write here (including the much respected "Sharpie" line of permanent markers), but they all eventually rub off. Maybe one day when eInk displays are a little cheaper, you could integrate a text display that shows the volume name assigned to the device. I think this would help a great deal as I tend to carry several of these things around and it's sometimes hard to distinguish them from each other.

Shout out to the guys at Gizmodo for turning me on to this one.

posted by Matthew S. Hamrick @ 2:30 PM 0 comments

University of Virginia's How Things Work

One of my favorite series of books is Marshall Brain's How Stuff Works and MORE How Stuff Works. Growing up I had several books (now out of print) along this theme and I don't think it's too much of a stretch to say they were influential in me later selecting a career in science and engineering.

Yet another book in the same genre (that I haven't picked up yet) is Louis A. Bloomfield's How Things Work : The Physics of Everyday Things. Bloomfield is a professor of physics at the University of Virginia and maintains a site related to the book.

But I was very happy to find his How Things Work Home Page; like a "how things work" blog where questions about people's everyday interactions with physics are answered. Though I studied physics for over four years, I still learned a thing or two in twenty minutes of reading the page. Written in an understandable style, there's virtually no jargon and should be understandable by science enthusiasts of all educational levels.

posted by Matthew S. Hamrick @ 2:00 AM 0 comments

Arrgghh! Yer Parliment is about to be Boarded!

Okay... everyone seems to be talking about this, so it's by no way a Stacking Fault exclusive. But it's such a good story...

Apparently a group of Swedish intellectual property "reformers" have formed a political party and want people to vote them into the Swedish national legislative assembly. They have no platform other than the abolition of intellectual property laws and taking Sweden out of the WIPO (World Intellectual Property Organization). Calling themselves "The Pirate Party" (or "Piratpartiet" for those of you who talar the svergie), they've put up the Pirate Party Manifesto. Alas, my skill in the swedish language is on par with my ability to bathe a wild badger without getting scratched. Sort of makes me wish I had been paying closer attention when my friends guided me through buying a "72 hour card" when last I was in Stockholm.

In a related note... if you go to google and search for "avast ye maties", you'll find that a recent note here on Stacking Fault is the top hit. I have no idea how this happened. Cryptonomicon.Net's page rank is not especially high, and the "story" is nothing other than a link to the original talk like a pirate day web page and a comment with a link to Engadget's story on ergonomic keyboards for pirates. Both of which have a relatively high page rank, I imagine.

So... I feel this gives me the unequivocal right to speak authoritatively about modern tech-geeks who style themselves as pirates. (Oh! I also have a green bandanna I wear when doing yard work or when I have a bad hair day that looks positively pirate-ish.) Just so you know... it never seems to be the cool dating maneuver you think it's going to be. Yeah, the ladies swoon every time you mention Johnny Depp's role in Pirates of the Caribbean, but it just doesn't seem to translate.

But seriously... I've always been a little suspect of organizations like the RIAA who, on behalf of their members, go out and file suit against their member's customers. Yes, I can understand their position; the big guys have sunk a fair amount of cash into finding, developing, recording and promoting upcoming young artists. As a business they're interested in recovering their costs by selling into a market that gives them the highest value for their product. Then along come these young punks that go off and make illicit copies of the latest Black Eyed Peas CD or whatever and sell it out of the back of their van for a quarter of what consumers would have to pay at the local Virgin Megastore. Yes, I can understand that the labels are a bit ticked. But suing your customer base never seems like a grand idea.

The cases that get the most attention are the ones where the RIAA is suing individual file sharers. Tech-geeks that like music and want to share it with others. Sometimes these people are motivated by wanting to inflict their musical tastes on other people; sometimes they're motivated by a quid pro quo approach of, if you give me what you've got, I'll give you what I've got and you won't have to go out and buy it. This is not an especially above-board thing to do. Copying a CD and giving it to a friend is wrong; you know that. So is ripping the tracks and putting them on a file sharing network. You can't tell me this is "fair use."

But the label's reaction is out of proportion to the problem. First they introduce Fair-Use destroying DRM schemes to confuse and irritate music consumers. I'm not even going to start talking about root-kits. Then they start suing people they suspect of sharing files. The filesharing dragnet picks up a few disadvantaged single mom's and an occasional grandma who's crime is more likely she ran an open wifi access point. (p.s. - that's not a crime, btw. Nor is it grounds for civil action.)

All the while the industry seems to be ignoring the factories in the developing world churning out pirated CDs and DVDs. Why? The best I can guess is they're afeared they'll lose the Chinese and Indian markets if they start rumbling for local jurisdictions to enact IP protections (or at least they're worried those countries will enact stiff tariffs for entertainment products.)

I think it's interesting that the Pirate Party would simultaneously agitate for elimination of intellectual property laws and the institution of stricter privacy laws. I've always considered the privacy of my files to flow from the concept of intellectual property. (I've also thought that personal papers should be covered by constitutional prohibitions against self-incrimination, but that's a different story.)

When discussing the concept of file-sharing with industry reps, they all pretty much say the same thing... "it's against the law to share files. if you've got a problem with that, change the law." So I'm really excited that someone, somewhere decided to take them up on this challenge. In the end I suspect that on the outside chance that they can get 225,000 swedish voters to get them a seat in parliament, I don' think we'll be seeing Sweden abrogating international IP protection treaties anytime soon.

But it is a sign that the age of the big record label is coming to a close. The big guys have a reputation for being... well... not especially pleasant people to deal with. For a while in my youth I was the A & R Rep for a small label in North Texas and I can tell you it's a pretty competitive, cut-throat business. But that's not to say the label's don't have (or didn't have) a role in the value chain. The classic role of the record labels was not only to physically make records, but it was also to promote albums and artists, and build relationships with people in charge of on-air programming. Most importantly, I think, was the label's role of being the first step in quality control for the music industry (as an A & R Rep I was very familiar with this part of the process.) People don't want to listen to crap. Sure... some people's crap is another person's nirvana, but the music business is a business, and you either go for volume or high-value niche markets. In either case, there's a scale that runs from "hit" to "crap" for any given market. It's easy to identify crap; less easy to identify hits; and there's this disturbingly large category in the middle that could go either way depending on the context of the music and how the band is promoted.

I almost forgot to mention the payola scandal and the concentration of media over the past twenty years. Twenty years back, broadcast radio was the promotional vehicle for new and established artists. The radio station made money by selling advertising time. They played tracks owned by record labels (effectively) for free; that got consumers to listen to their sponsor's advertisements and promoted the albums on which the tracks were released. If consumers heard something they liked, they would sometimes go out and buy a record or a single they heard on the radio. Popular artists could negotiate contracts that gave them a larger cut from record sales, but artists typically got their cut from concert ticket sales and merchandizing rights (if any.)

As a business structure, this wasn't all bad. Everyone got a slice of the pie and hey... being in the recording industry sure beats working for a living. But then things started going bad. Record labels started monkeying around with the accounting to make it look like it took a whole lot more money to promote an album that it really did (thus screwing artists out of whatever meager royalties they were supposed to receive.) And they also started slipping a few Grants and Franklins to the DJs to play specific tracks. Seriously, what else could explain the supposed popularity of Animotion's "Obsession." Congress investigated, slapped a few wrists suggested an upper limit on the value of gifts local stations could receive from the labels.

This system seemed to work well, especially if you were someone like the Rolling Stones or Bruce Springsteen and could pack an arena every time you and your band came through town. The system even worked okay for lesser known acts and there was always a place for guys like Danny Elfman, Mark Mothersbaugh, Eddie Jobson and Declan McManus who seemed to have a pretty good thing going making music not only for themselves but for other artists and for movies. (Yes, I know, purists will be sicking pins in voodoo dolls all night because I mentioned Mark Mothersbaugh of Devo fame in the same sentence as Declan McManus (whom you probably know as Elvis Costello.))

But the same wasn't true for little guys like Joe Brenna, Little Jack Melody, Ten Hands and Josh Alan. These guys pretty much eked out a "just shy of comfortable" living playing gigs, selling a few albums on the local club circuit, teaching guitar at local community colleges, and doing contract software development on the side. It was not the glamorous lifestyle you see portrayed in the movies and on TV.

Meanwhile the dark shadow of media concentration started moving across the face of the nation. Everyone's favorite corporate music whipping boy ClearChannel Communications took advantage of the loosening of media ownership rules to scarf up local radio stations at an alarming pace. While I have no problem with businesses operating in their best interest, and I've got to say that ClearChannel's operations appear to be first rate, the concentration of ownership not surprisingly led to a small cadre of national programmers being in control of content broadcast across the majority of the nations airwaves. I'm not going to go off the deep end here and start saying that ClearChannel's behavior is criminal as some have done. They worked hard to get where they're at and they could have just as easily been ground under by a fiercer competitor. But if you ask me, since taking control of the radio dial, it's pretty much all gone to crap. For all the production values of Brittany Spier's latest album, it's not really the apex of musical expression. And is it okay if I remind you that Bruce Springsteen recorded songs other than "Born in the USA."

Apart from Ted Nugent's self-declared war on Muzak it really did look grim. Some were predicting a distopian future for music where a shadowy cabal of ClearChannel execs in San Antonio conspired with the five top record labels to decide what pop jingles would grace the airwaves from coast to coast.

And then the Internet came and CD-Burners got cheap.

People had been dialing up to small local ISPs for several years before the RBOCs and Cable companies started to figure out that maybe there's a market for something with higher speeds and lower prices than ISDN. Okay... to be fair, I think a lot of them knew that ISDN wasn't the be-all end-all last mile technology, but they sure did wait a long time for the market to prove itself. Also.. there's more than a little evidence that people had been trading .aiff and .au files ripped off commercial CDs via earlier BBSes, but it really wasn't until we had cheap broadband, high quality sound in PCs and inexpensive audio CD burners that a critical mass of customers and content providers really began to see the potential for the PC as a distribution mechanism for music.

It looked as if a new day was dawning in the music industry. MP3.Com started caching music from "unknown" artists, Digital Audio Players were flying off the shelves, E-Commerce was a reality and it really looked like the little guys really could disintermediate the big labels and the consolidated media outlets by going direct to the music consumer. But it wasn't long before people started seeing another benefit to broadband: file sharing. Brilliant Digital's Kazaa and other Peer-2-Peer clients started popping up all over the place. And what did people share? Was it La Bottine Souriante's La Ziguezon? Was it The Potatoes' Queso de Amor? No, It was the same stuff you find on the radio.

*Sigh*

What follows is Internet and Intellectual Property history. The big guys looked at the future and they didn't like what they saw. They couldn't see a world where they were in control. They were losing sales of a more than a few albums, yes. But more importantly, consumers could go behind the label's backs and directly download tracks that were out of print. The economics of scarcity they had created and enforced their primacy in the world of music sales was threatened.

It's been intimated that file sharing actually helped some parts of the music industry by offering a zero-cost promotional vehicle. I don't know if this is true or not. I do know that the first thing I did when a friend of mine burned a copy of They Might Be Giant's "No!" album for me was that I went out and bought a copy in the store (and it wasn't that easy to find, BTW.) So in at least one case, it was true. I haven't seen studies to support or refute this statement, but I'm willing to give it the benefit of the doubt. I can see that there might actually be more people like me that have come to the conclusion that the only way to ensure artists continue to make more good music is to pay them somehow. I have no problem with the concept that I'm going to have to pay artists to make music. So when an album like "No!" comes along, I'm happy to slap down a ten-spot with the hope that the guys see a dime or two.

I also know that I'm going to have to pay a middle man or two to handle the music bits as they're in transit. The old model was to put bits on a record, put the record in the store and convince the consumer to buy it by scheduling it for heavy rotation on the local music station. As Todd Rundgren so eloquently pointed out however, there's something at the heart of it that's simply awful, tryin' to make a livin' off a plastic waffle.

Broadband access, digital audio players, CD burners and surprisingly good sound quality from modern computers all point towards a future where we don't need to go to the store (or even listen to the public airwaves.) The labels' cash cow is starting to look a little sick, and in the same way that the railroads in the US missed a classic opportunity to re-invent themselves as "transportation companies" and have a stake in air-transport, it's looking like the labels are going to miss the opportunity to move past being content providers and re-invent themselves as more general "music entertainment companies."

We're starting to see interesting experiments with business models. One that I really love is Magnatune. Do yourself a favor and click on over there to check them out. They Rock. Industry fixtures Muze and Gracenote offer music meta-data they're hoping will be used to create a richer music experience; the kind you won't get from trucking over to the store to pick up the latest Rush double album. Music recommendation services are starting to see the light of day. Gracenote's micro-genre system can automagically build a playlist for you from a single song. More intricate systems allow you to tell them what music you like and recommend new music for purchase. Amazon's system uses statistical measures of who bought which albums. Genie Lab leverages a FOAF-like system to get the same results. Pandora tries to analyze the structure of music you like and recommend tunes with the same music fundamentals.

What is the future of the music experience? I don't know. I don't know who does. I do know that it's not going to be business as usual for the labels (or the movie studios.) And if it takes a rowdy crowd of Swedish geeks campaigning for parliament under the Jolly Roger to drive this point home, well then... I'm all for it.

posted by Matthew S. Hamrick @ 1:00 PM 0 comments

Thin Clients : Only a matter of time

The good folks over at Engadget have a link to Chandan's blog entry on his All in One Card Concept. The idea is pretty sweet: using eInk display technology, solar cells backed with super-efficient batteries and off the shelf semiconductor technology, you could make a credit-card sized display device with WiFi, WiMax and/or Bluetooth networking capabilities. Chandan bases his concept around Sun's SunRay Thin Client technology. And as a nod to the smart card community, the concept card has an ISO-7816 interface on the back.

Most people I know got a bit of chuckle out of the concept. The same sort of chuckle people got several years ago when people started talking about manned space flight, flying personal vehicles and electric cars. "But wait," you say, "we already have manned space flight, flying personal vehicles, and electric cars!" Yes... my point exactly.

From high atop my fortress of arrogance deep in center of Silicon Valley, I while away the time pursuing technology for technology's sake, mindless of the economic realities of our industry. Well... that was until we all took a serious shellacking back in the dot-bomb. I'm now an MBA Candidate and I've started to reflexively start thinking about needs people might have for various technologies... how technology creates value in people's lives.

But let's think this one through. What would have to happen for a device like this to be valuable to people? And who would it be valuable to? Well... it would have to be relatively inexpensive, reliable and do something they want to do that other technologies couldn't. Yeah... I know... I majored in the "bleedin' obvious" whilst at university. I think where Chandan was going with his concept demonstrator was, "hey look! here's a cool new place we could squeeze Sun Ray raster-casting technology into!" Which is fine, except that I don't think this is the application that's going to cause these things to fly off the shelves. While eInk is cool, and it has some marvelous contrast and power consumption properties, it's still a bit pricey. The eInk developers' kit we talked about in a previous post cost something on the order of $3000. The iRex eInk based eBook reader discussed in yet another previous posting is, according to the company, targeted at 'high-end consumers of content." . Right now I can go out and get a used TapWave Zodiac on eBay for a couple hundred bucks. It can do many of the same things (plus I can play Doom on it, w00t!) For the time being, I'm thinking that the price increment between a TapWave or Treo or iPaq and the All-In-One Concept Card will be about $2500. It's cool, but it looks like it will be a tad expensive for my tastes for a while.

But if we've learned nothing from years of technology marketing, it's that there's always a few suckers... er... early adopters looking to reap the efficiency rewards of adopting cutting edge technologies. So the question is... Is there a market willing to pay a premium for a high contrast, extremely portable, wirelessly connected touch-sensitive display? Who are they? What are their applications? Will they buy enough of them to drive the production costs down to where mere mortals can afford such a device?

The US military has a fine tradition of spending a lot of money on high-tech gadgets. What would they use the all-in-one card for? When I first saw the thing, I must admit I thought they would make a great replacement for the Common Access Cards now in use as IDs in the military. Back in the day, when I was working with these devices one of the questions that kept coming up was something to the effect of... "we know how we're going to use these things electronically, but how should we use color and design on the front of the card to clearly identify people's clearances? It would be great if there was a bright red logo on the thing that said 'TOP SECRET' for people with top secret clearances..." But after we got to thinking about it for a few minutes, we came up with a bunch of scenarios where we didn't what big bright red "targets" on people's chests identifying their clearance level. Which is to say... if you want to have a badge that people wear as an ID badge, you might not want to advertise to everyone who are the 'top secret' guys and who are just the plain 'ol non-cleared folk.

So who knows... maybe there's a market for "Active Common Access Badges" inside the intelligence community or US military. Such a badge could use near field RF (i.e. - RFID technology) to scan for "friendly signals." When it hears a properly encoded friendly signal, the "active badge" turns into highly decorated ID. It uses color to tell you who's a contractor, who's a special agent, and who's a military officer as well as who has what type of clearance. The "friendly signals" could be broadcast only within government facilities, and if we properly deployed a PKI, we could ensure that the friendly signals were protected by strong cryptographic primitives. In other words... the active badges wouldn't reveal anyone's clearance status unless they were beamed with honest to goodness, trusted crypto-goodness. The moment the badge holder walks out of a building where friendly signals were being used, the badge reverts to name, rank and serial number.

If you wanted to get fancy, you could have the badges scan for other nearby badges, looking for people with lower clearances or people without special "compartmentalized" clearances. The badges could display the lowest clearance level of people within ear-shot; cleared individuals could use these badge-directed queues to decide what they should or shouldn't talk about.

But the Common Access Card program is a little new, at least it is in government terms. We still have to pay for the current round of cards, and given the strain the budget is under these days, it's probably an uphill battle to get the pentagon to pay three grand for something they're getting for under $75 (including card, smart card reader and software.)

There is another application I can think of off the top of my head that might be worth thinking about. It has military and civilian application, and to keep the discussion fresh, I'll just talk about the civilian application. We're already starting to see "High-End" active RFIDs attached to highly valuable shipments. I've heard stories of auto manufacturers adding 802.11b based RFIDs to cars and high-value parts as they move through factories. The benefits to the company include the ability to locate every high-value component in the factory and track it as it moves through the production process. Most of these devices are "headless," meaning they're just little quarter-sized thing-a-ma-bobs attached to crates and cars. If you want to interact with the RFID, you need a reader, or you need to find a terminal that can upload data onto the RFID.

So what about the situation where we might have a box of something very expensive we want to track, and we want to interact directly with the RFID sans reader. Let's say we have a box of expensive wine. It might be nice to have a device that integrates a temperature and shock sensor along with a simple user interface. When the box is delivered to it's destination, the recipient can view the shipping history to ensure the box hasn't been abused too badly or left out in the hot noon-day sun. They could then use the same RFID to sign a digital receipt showing they took possession of the box.

It's unlikely we'll see these devices fall in price to the degree they can be used as "Smart RFIDs" anytime soon. But that's the great thing about technology, someone might be dreaming up that killer app right now... who knows?

posted by Matthew S. Hamrick @ 6:30 PM 0 comments

Aubrey de Grey on American TV

How long do you want to live? Typical life expectancies in the developed world are something on the order of 75 to 80 years. Biologists studying the aging process tell us there's a good chance we can live to around 100 before the mechanism just wears out. But then there's Aubrey de Grey, radical gerontologist. Dr. de Grey has been making waves lately by saying there's no need to age as you grow older, and possibly, there's no need to die. Practical immortality, says de Grey, is within reach of humanity.

Morley Safer of CBS' 60 Minutes program sat down recently with Dr. de Grey to discuss the idea of immortality. The interview takes a similar tack to an earlier print article in MIT Technology Review: Aubrey's a brilliant guy, typical of the sort one might find at Cambridge University, and the reasoning behind his Strategies for Engineered Negligible Senescence seems sound, but some colleagues simply think he's nuts.

After a brief view of the gentle country life at Cambridge University, Mr. Safer's interview begins by drawing out Dr. de Grey's estimates for average life-spans sometime in the near future. Not 100 years, not 500 years, but quite possibly a thousand years. de Grey has, we're told, identified the biological processes responsible for aging and by thwarting these processes we may grow old without aging. The simplest explanation of Dr. de Grey's theories is that as we age, a wide variety of "bad things" happen to our cells. Every day a thousand tiny insults are delivered to our mitochondria, our nuclear DNA, inter- and extra-cellular environments. SENS (Strategies for Engineered Negligible Senescence) is simply a series of techniques to reverse the damage. As junk builds up in our cells, simply remove it. As our DNA is damaged, simply repair it. In de Grey's words, we can think of our bodies as buildings...

Think about the situation with houses... with moderate maintenance they stay up.. they stay intact, inhabitable more or less forever. It's just that we have to do a little bit of maintenance to keep them going. And it's going to be the same with us.

But not everyone is enamored with de Grey's work. Dr. Jay Olshansky, an aging researcher at the University of Illinois at Chicago believes that talk of immortality is irresponsible. Penning an article for the BBC News web site last year, Don't fall for the cult of immortality, Dr. Olshansky points out the long history of immortality. From ancient China to 11th century Arabia and 13th century England through to modern times, there have always been proponents of the concept of immortality. Even historic figures such as Roger Bacon believed endless aging was within their grasp. "What do they all have in common?" asks Dr. Olshansky. "They're all dead."

In the interview, Dr. Olshansky plays down Dr. de Grey's more fantastical predictions.

"From an evolutionary perspective, we're designed to make it, to grow and develop and to reproduce, pass our genes on to the next generation, and ensure the reproductive success of our offspring ... So it's no surprise that we see things go wrong with these bodies when we use them beyond their warranty period. And that's exactly what we're doing."

Key to de Grey's predictions of practical immortality is the ability to keep "one step ahead" of the grim reaper. Living forever will require several breakthroughs in cellular biology. The first generation to benefit from a radical life extension treatment might get an extra 30 years of life-span. The hope is they will still be around when the next round of life extension treatments come on the market. But this has Olshansky crying "foul!"

"I have no doubt science will make breakthroughs. But how do you develop a model or a forecast of a life expectancy based on a technology that doesn't exist?"

While Olshansky is highly critical of hucksters who would sell snake-oil to unwitting dupes, he does offer qualified words of respect for Dr. de Grey:

"What I like about Aubrey is, he's not selling anything except ideas... I just wouldn't hold out immortality or 5,000-year life expectancies as the end result or the promise of what you're going to get from this."

So is Aubrey de Grey a miracle-worker or a raving lunatic? Truth is, he's neither. I had the pleasure of speaking with him at length on several occasions back in 2000. The first when he was a guest in our house in Menlo Park and later when I was visiting Cambridge. Dr. de Grey is an engineer turned biologist; approaching the problem of human senescence from a different, but just as rigorous perspective. His training as a technologist is what I believe gives him a hopeful view of man's capabilities. Do you believe we'll be able to continually develop anti-aging treatments "just in time" to avoid the end? Or do such pronouncements seem irresponsible to you?

Manned space flight and heaver than air aircraft were for most of history considered folly. Both are now considered routine. Will immortality succumb to our ability to engineer solutions to sticky problems?

The 60 minutes interview continues with a visit to the laboratory of Dr. Christian Sell. Dr. Sell has made early gains in producing longevity in laboratory mice by altering the expression of the gene responsible for IGF-1 production. Dr. Sell is a competitor for the M-Prize. Like the Ansari X-Prize Foundation, the Methuselah Foundation offers a cash prize for the first researcher to develop a practical treatment to extend the life-span of a typical lab mouse. The foundation administrators, including Dr. de Grey, hope that a financial reward will spur research first in mice and then in humans.

The transcript of the program is available online at the web site of CBS' D/FW affiliate CBS Channel 11. Friend and former house-mate John Furber from Legendary Pharma provides the following links...

• CBS 60 Minutes Video Promo


• Commentary by Kevin Perrott (from mprise.org)


• Morley Safer speaks about his interview with biomedical gerontologist Aubrey de Grey, who believes with medical breakthroughs, humans can live much longer lives


• Commentary by Simon on Betterhumans.com


• 60 Minutes website


• Another link to the 60 minutes website

posted by Matthew S. Hamrick @ 12:50 PM 2 comments