Monday, November 3, 2014

Before Email

When a first class letter cost 3 cents, a penny post card was a less expensive way to send a greeting.  Banks used them to clear draft accounts.  Cheers, good news, announcements of arrivals, details of meetings, the events of daily life were innocently open.  

 Of course, most governments, even the bad ones,  were smaller than today.  "Gentlemen do not read each other's mail," said Henry L. Stimson, when he served as Secretary of State for President Herbert Hoover, and closed the American "Black Chamber" of cryptography.




Compared to the collecting of classic U.S. Federal coinage of the 19th and 20th centuries, stamps, covers, post cards, and other philatelic materials are inexpensive.  Rarities of high value do sell at important auctions, but generally, for the price of a common slabbed Morgan Dollar, you can buy more than you can carry at a stamp show.




Letters and post cards, commemorative covers, and other artifacts deliver world history from the daily perspective of individuals. In The Maltese Falcon when Sam Spade wants to keep the locker key safe, he mails it to himself, as here, in "City".  Most people do not know that today, local post offices do not sort their own mail.  Just about everything is regionalized into sorting centers where automatic machinery reads and recognizes the address codes. 



  

 That Ayn Rand wrote an essay for Minkus and so was famous for her stamps, not her coins, reflects the fact that women are more often active in philatelics than they are in numismatics.




About 20 years ago, on a DoD job, one of the Navy veterans said to me that the 1940s were the last time that most people had class.  Some years earlier, in fact, a designer I dated sighed that it was hard living in a "classless society."  I do not wear a suit, but I do dress up to travel.  It's the least you can do to  help make the world a better place.  (Just a couple of years ago, monitoring a security camera, I saw one of my fellow Texans remove his hat as he entered an elevator.)



August 1, 1965. 18:45 hours. Over Viet Nam.

Back about 1989 or so, I was teaching technical writing at Lansing Community College and one of my students worked for a contractor at a sorting center for the United States Postal Service. He said that the best way to address a letter is to put two spaces and no punctuation between the city, the state, and the ZIP code:  Hometown  ST  12345-6789  The machines read serif and sans serif equally well; and they can do pretty good with neat handwriting.

Also on Necessary Facts
Thank-You Notes
What is Literacy?
Open Secrets
Philatelics: the Objective Virtues of Stamp Collecting

Saturday, November 1, 2014

Vectures: Monetizing Urban Transportation

Vectures are the formal name for transportation tokens including coin-like payment for trolleys, buses, trams, and trains, as well as coin-like forms for parking, bridges, and ferries, as well as cards, tickets, and chits, including electronic formats.  In short, vectures are the numismatics of traffic and transportation. 
Courtesy card from the hotel for the tram
You can monetize anything.  Transportation tokens in all their expressions serve both sides of the transaction: they let riders pay for carriage, often at a discount if purchased in advance and in bulk, i.e., a weekly or monthly pass.  At the same time, they allow the transport authority or business to borrow money from patrons interest-free.  More subtly, they allow the monetization of a service.  
Cleveland, Ohio, 1950
Furthermore intra-urban transport represents a significant service to the commuter.  I do a lot of reading waiting for the bus and riding. Now, the express buses here in Austin have wi-fi, allowing me to work while I ride.  After January 1, 2015, it will be illegal to text and drive.  (The enforcement is more problematic than the authorities expect, but that is their problem, not mine.  I mean, I could be using my GPS, not texting...)  Be that as it may, the bus or the train allows you to do something else while you are being transported more or less safely and more or less conveniently.
Chicago 1976.
I jumped the turnstile to keep the ticket;
but I was on camera.
They let me go with a warning.
If you were sent back in time, how would you explain parking tokens to Leonardo da Vinci? Herbert Spencer might have understood.  He knew that social organisms evolve mechanisms and appendages.  The city of the modern era is not the city of the Middle Ages.
  
Roma, Italia. Face and Back of Metropole pass.

Consider the  Carrier's Case of 1473 (Wikipedia here).   We might imagine a science fiction story set in intra-galactic interstellar space in which the common carrier's point is carried forcefully.  However, here and now, it is hard to imagine that the bus driver could sell the contents of your cellphone while you ride.  

Coin-like tokens, attributed against the Atwood-Coffee catalog.
Prices have not changed in decades.
In the fantasy Lost in Austen, the 21st century viewpoint heroine caught in the Regency period comes from "Hammersmith" which to them is "outside" London.  "Well, yes," she says, "in your time..."  In the David McCullough biography of John Adams, villages outside of Boston are today neighborhoods within Boston.  "BosWash" has been the East Coast metroplex of science fiction for over seventy years.  Someday, some biometric will let you travel anywhere on Earth for a flat rate.

PREVIOUS ON NECESSARY FACTS

Thursday, October 30, 2014

The Status of ORIGINAL Property


Original property is newly invented or newly discovered.  It had no previous owner.  In fact, it did not exist – or its existence was not perceived – until the original inventor created it or the original discoverer found it.  How do we recognize such property?  What rights does the inventor or discoverer hold?  Are some or all of those those objective, absolute, or conditional? 

A sailor finds an uninhabited island.  Can she claim the whole thing for herself?  An astronaut lands on an asteroid, a moon, or a planet.  Can she claim the whole thing for herself?  A physicist discovers a new form of energy. Can she claim it all for herself?  A radio hacker finds that 1100 KHz AM is owned by a broadcast company. Can she use a chopper to parcel out nanoscopic slices of the wavelength for herself, given that her presence will never be detected and her presence will never interfere with their existing use of the wavelength?
The Ether did not exist for George Washington.
You could have had it all to yourself for all he knew.
Library of Congress.

It could be argued that the 1100 KHz frequency already belongs to someone.  However, the property is actually the amplitude modulated (AM) use of that frequency.  In theory, frequency modulated (FM) and phase modulated broadcasts are both possible on 1100 KHz without interference.  They are just not technologically useful today.  This is not new.  

(Actually, the property status is limited in space, as well.  That, too, is a different problem, caused by a misperception of the potentials in technology. One of the nice features of 550 to 176 meter wavelengths is the way the waves bounce off the ionosphere.  That was discovered as a by-product, entertaining teenagers who listened to far-away stations.  It could have been commercially exploited.)  

Thomas Edison was a telegraph hacker.  He discovered how to multiplex and quadriplex messages on the same wire.  Granted that the wire was someone’s property, it could, nonetheless have been leased out to different people using different blocks of time-passage on the same wire.  Also, in theory, it could have evolved that the telegraph wires would have been the broadcast source for what we call radio.

When a direct current circuit is closed and opened, a magnetic field is created and collapsed.  That is an alternating field.  That field could have been used to transmit information, as in fact, the “ether” was used by actual radio (initially called “wireless”).  So, you could have paid the telegraph company its tariff for sending messages, but have no concern for the literal transmission but been sending “open” and “close” signals to create a carrier wave for transmissions of your own.  Who would have owned that ether?
 
The Personal Computer Revolution
 saw the use of voice grade telephone lines
for data transmission.
(Wikipedia)


Lasers can carry messages.  It could have come that a network of  lasers made of ruby crystals doped with chromium and pumped by xenon flash would have been a continental system, point to point, with relays and amplifiers every 20 miles or so. Then, someone with a YAG (yttrium aluminum garnet) laser could have a network whose beams crossed those in space but without interference because the beams are of different frequencies.  Thus, no violation of property rights would have occurred. 

Original property brings a special challenge to the law because no previous legislation anticipated it.  Ayn Rand attempted to delineate the proper role of government in her essay "Property Status of the Airwaves."  Twenty years later, the Electronic Frontier Foundation was created to bring law and order to cyberspace.  Rand did not stray far from the mainstream.  Her essay never questioned the Federal Communications Commission - though she excoriated it in other writings - or the law that created it with power to rule by decree.  The EFF has been fighting a war of attrition while bunkered within the First Amendment.  The next new invention will leave them to defend an old technology without new ideas.

I believe that rather than looking to legislation or administration, these problems are best settled in courts.  The English system of justice works because of what American conservative complain about as "judicial activism."  The other way is the Continental theory of "civil law" in which the legislature spells out the law in detail and the courts only enforce it.  In other words, in the English system, the court fits the law to the case, making case law, whereas in the Continental system, the court fits the case to the law.  (In American today, the courts do both.  The court of original jurisdiction applies the law.  Appellate courts test the law.) The English system is better at protecting individual rights because those are the implicit foundation for judging the law and for making new rulings that create precedents.

ALSO ON NECESSARY FACTS

Tuesday, October 28, 2014

THE GIRL WHO OWNED A CITY


This is Atlas Shrugged for children. Instead of a given world collapsing for lack of reality, reason, and rights, we have an established chaos coming to order as one girl uses her reason to deal with reality and even come to understand rights.

A plague kills all the adults, leaving children to fend for themselves. This is the story of how Lisa figures it all out, usually by trial and error. She has good insights, but does not anticipate the reactions of others.  So, she works again for each new solution. She attacks each problem in turn and ultimately ensures the survival of the group that clusters around her.

Lisa finds inspiration reading Atlas Shrugged, a book alluded to, but never mentioned. (Later republications of the book have the reference to Atlas Shrugged removed.) On the Rebirth of Reason website, Barbara Branden wrote (March 23, 2005): “I've read it, and it's a beautiful book which I would recommend for any child. It has to be inspiring for a child, because it focuses on how much he or she can accomplish. The writer is an Objectivist.”

This book contrasts well against Lord of the Flies and other presentations.  What happens to children without adults is an artificial problem, not much different than a book about robots or aliens.  With science fiction and related genres, the author can create a new test environment to explore questions of human nature.  The author engages the reader to ask and answer wider questions about good and evil.  In this book, human nature is essentially a potential. (These are, after all, children whose natures are not set by habit.)   These  people are good or bad according to the choices they make.


After 35 years, The Girl Who Owned a City remains popular with kids for obvious reasons. 
1977 Dell Paperback (Laurel leaf science fiction)
1995 Runestone Press Books
2003 Rebound by Sagebrush
An audio book was produced in 2009. (Johanna Parker reading for Recorded Books, LLC. ) Graphic Universe published a new version in 2012, drawn by Dan Jolley, Joëlle Jones and Jenn Manley Lee. 

If you search YouTube you can find many trailers based on it, some of them recent.  
These are passable fan videos
http://www.youtube.com/watch?v=v-pFXwKwiS0
http://www.youtube.com/watch?v=7hsKy2b8Y3M
This is a  fan skit
http://www.youtube.com/watch?v=C8d0BJkD4ck
For being a Lego cast, this one is read well
http://www.youtube.com/watch?v=CbM-FGtbc7s

ALSO ON NECESSARY FACTS
Be an Engineer Day

Monday, October 27, 2014

Where the Only Law is Right

Back In The Saddle Again
Recorded by Gene Autry
Written by Ray Whitley and Gene Autry

C               G7      C    
I'm back in the saddle again
F                       C     
Out where a friend is a friend
          F           
Where the longhorn cattle feed
       C            A7            
On the lowly Jimson Weed
D7                     G7                  
I'm back in the saddle again

C          G7         C      
Riding the range once more
F               C     
Toting my old forty-four.
          F  
Where you sleep out every night
          C           A7  
And  the only law is right
D7          G7      C     
Back in the saddle again

       F
Whoopi-ty-aye-oh 
   C
Rocking to and fro
                   G7  
Back in the saddle again 
C      F               C 
Whoopi-ty-aye-yay I go own my way 
D7          G7      C  
Back in the saddle again

Chords for guitar from County Classic Song Lyrics
[Lyrics edited - MEM]
ALSO ON NECESSARY FACTS

Friday, October 24, 2014

LASCON 2014

OWASP (the Open Web Application Security Project) sponsors LASCON, the Lonestar Application Security Conference.  This year's two-day assembly brought together cutting edge vendors, theoreticians, and developers.  It was my privilege to be the introductory speaker serving KUNAL ANAND of Prevoty and KSENIA DMITRIEVA of Cigital.  The general session guest speakers included Martin Hellman, co-inventor of Public Key Cryptography, and Kelley Misata, formerly of Tor, now with Suricata.
Martin Hellman (right)
"The Open Web Application Security Project (OWASP) is a 501(c)(3) worldwide not-for-profit charitable organization focused on improving the security of software. Our mission is to make software security visible, so that individuals and organizations worldwide can make informed decisions about true software security risks." - www.OWASP.org



Ksenia Dmitrieva of Cigital answers questions
after her presentation
"Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. You'll find everything about OWASP here on or linked from our wiki and current information on our OWASP Blog. OWASP does not endorse or recommend commercial products or services, allowing our community to remain vendor neutral with the collective wisdom of the best minds in software security worldwide. We ask that the community look out for inappropriate uses of the OWASP brand including use of our name, logos, project names and other trademark issues." -- OWASP.


Keynote Speaker Kelley Misata spoke on behalf of Tor.
Misata is now working with the CERIAS project of Purdue
and Suricata, an Open Source Foundation partner
.
Martin Hellman worked directly with Whitfield Diffie to realize public key cryptography. They then discovered that Ralph Merkle had independently submitted papers some months earlier.  Merkle's work was rejected for openly running contrary to the mainstream of cryptographic theory. ("Secure Communications over Insecure Channels" on his website here.) They published congruent ideas but under a less contrarian article title, "New Directions in Cryptography." (On his own pages here and archived widely, including here.).  Also,  Hellman was a professor. (Diffie was his doctoral student). On the other hand, Merkle was working on his doctorate; and he had no support for his theories from his own mentors.  So Hellman brought more social status to the supposedly impartial peer-review process.  He also brought Merkle to Stanford from Berkeley.

Kelley Misata had been cyber-stalked for eight years. She watched while her computer was taken over and worked remotely. Trashy emails were posted in her name from cuts and pastes from her own Facebook pages. She could not apply for a job without her stalker knowing it and intruding.  She figured out who he was.  However, the FBI said that they were powerless, and a judge refused to issue a restraining order, both because the stalker hid behind Tor and could not be identified.  So, she took her MBA and her experience in marketing to Tor where she advocated for privacy and security. She now helps the Center for Education and Research in Information Assurance and Security (CERIAS) while working on her doctorate at Purdue.

Appropriately, the front of the vendor's hall was held by White Hat Security of Santa Clara.  All of the sellers were satisfied to have made good contacts. While setting up his talk, Kunal Anand underscored for me the importance of qualified leads to a start-up looking to scale its services. 


OWASP co-founder and Contrast Security CTO Jeff Williams 
Among the fifteen sponsors set up in the vendor hall were HP (both local and national sales offices), Contrast Security of Palo Alto, Trustwave, F5 Networks (headquartered in Seattle), Checkmarx from Chicago, Qualys (Redwood City), and K2Share from College Station. Texas.
Wade Williamson from Shape Security of Mountainview. 
OWASP conventions always include several security challenges, such as "capture the flag" and locksporting.  The convention name tags were puzzles with imbedded clues.  (Decipher the Roman numerals into an IP address and go from there.)  Winners received a challenge coin. "Capture the flag" lets would-be hackers attack knowledgeable defenders of a target computer.  Of course, all the firewalls do you no good if someone can pop the lock on your server cage. 


Jgor taught me how to pick a four-wheel combination lock.
After I felt successfully for the solution, he showed a slide
with a cutaway view of the internals . 
Over 40 different breakout sessions provided expert presentations on application security, rugged development, agile development, cryptography, IoT and mobile platforms, and an array of special case studies.  The two-day conference ended with giveaways and drawings. The top prize was a Pwn Phone from Pwnie Express.


We enjoyed great guitar work from Chris Devore
at both lunches and the Thursday evening social.
ALSO ON NECESSARY FACTS
B-Sides 2013
Open Secrets
Fortune Cookie in Hex Code
The Eurion Project
Securing Your Viper Against Cylons

Saturday, October 18, 2014

Securing Your Viper Against Cylons

If you have a late model car, someone could take control of it while you are driving.  They could disable the brakes, command the steering wheel, set the speed, open the doors, disable the airbags, or explode them.

Computers in cars go back to the 1978 Cadillac Seville.  The chip was a Motorola 6800, used also in early personal computers.  It ran the car’s onboard display that provided eleven outputs such as fuel economy, estimated time of arrival, and engine speed.  By the turn of the Millennium, upscale BMWs and Mercedes boasted 100 processors. Even the low-tech Volvo had 50. (Automotive Mileposts website and Embedded website.)
Commander Adama would not allow
the computers on the battlestar Galactica to be networked.
His ship successfully resisted cyber attacks.

 From http://en.battlestarwiki.org/
The General Motors OnStar system was launched in 1995 and went from analog to completely digital in 2006.  (Wikipedia here.) 

Now, such radio systems are a standard feature on common makes and models. With that link someone can take control of your car.

The older your car, the safer you are.  A vehicle from the 1980s or 1990s will have electronic controls, but they will be less open to attack from the outside.

The Mark VII vipers were the newest and the best.
The Cylons destroyed them
by hacking their computers from the outside.

From http://en.battlestarwiki.org/ 
 
When the Cylons attacked, these museum relics were
pressed into action because they lacked computers
that could be jammed and compromised.
From http://en.battlestarwiki.org/
Two different security projects have been reported.  In both, “white hat hackers” investigated ways to take control of different models of automobile.

In 2011, Car and Driver told about the work of the Center for Automotive Embedded Systems Security, a collaboration between academics from the University of Washington and California State University at San Diego.  First, they plugged their own device under the dashboard to compromise the on-board diagnostic computer.  (Anyone who can get to your car could do that the next time you take it in for an oil change or other routine service.)  In the second phase, they figured out how to do that remotely.
Such breaches are possible because the dozens of independently operating computers on modern vehicles are all connected through an in-car communications network known as a controller-area-network bus, or CAN bus.
Even though vital systems such as the throttle, brakes, and steering are on a separate part of the network that’s not directly connected to less secure infotainment and diagnostic systems, the two networks are so entwined that an entire car can be hacked if any single component is breached.”“Hack to the Future”, Car and Driver, July 2011 by Keith Barry here.

In the words of the researchers:
 “We demonstrate that an attacker who is able to infiltrate virtually any Electronic Control Unit (ECU) can leverage this ability to completely circumvent a broad array of safety-critical systems. Over a range of experiments, both in the lab and in road tests, we demonstrate the ability to adversarially control a wide range of automotive functions and completely ignore driver input—including disabling the brakes, selectively braking individual wheels on demand, stopping the engine, and so on.”
 “Experimental Security Analysis of a Modern Automobile” by

 Karl Koscher, Alexei Czeskis, Franziska Roesner, Shwetak Patel, Tadayoshi Kohno, Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham, Stefan Savage.
 IEEE Symposium on Security and Privacy, Oakland, CA, May 16–19, 2010. Available as a PDF from the authors here.
“Modern automobiles are pervasively computerized, and hence potentially vulnerable to attack. However, while previous research has shown that the internal networks within some modern cars are insecure, the associated threat model—requiring prior physical access—has justifiably been viewed as unrealistic. Thus, it remains an open question if automobiles can also be susceptible to remote compromise. Our work seeks to put this question to rest by systematically analyzing the external attack surface of a modern automobile. We discover that remote exploitation is feasible via a broad range of attack vectors (including mechanics tools, CD players, Bluetooth and cellular radio), and further, that wireless communications channels allow long distance vehicle control, location tracking, in-cabin audio exfiltration and theft. Finally, we discuss the structural characteristics of the automotive ecosystem that give rise to such problems and highlight the practical challenges in mitigating them.”
 “Comprehensive Experimental Analyses of Automotive Attack Surfaces” by Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham, and Stefan Savage (University of California, San Diego) and Karl Koscher, Alexei Czeskis, Franziska Roesner, and Tadayoshi Kohno (University of Washington). Available as a PDF from the authors here.

Onboard diagnostics are integral to any sophisticated vehicle.
The computers on Galactica were not networked.
(From http://en.battlestarwiki.org/)
 Two years later, Andy Greenberg, who reports on technology for Forbes, filed a story about Charlie Miller and Chris Valasek who carried out their car hacking research with a government grant. 
“Miller, a 40-year-old security engineer at Twitter, and Valasek, the 31-year-old director of security intelligence at the Seattle consultancy IOActive, received an $80,000-plus grant last fall from the mad-scientist research arm of the Pentagon known as the Defense Advanced Research Projects Agency to root out security vulnerabilities in automobiles.”  Forbes, August 12, 2013 with embedded video here.

They took Greenberg for a ride that ended in a crash despite everything he could do to fight for control of the car. (The 5 mph roll out stopped in some high grass.)

ALSO ON NECESSARY FACTS