Ged Carroll

Category: security | 保衛 | 정보 보안 | 情報セキュリティー

According to Wikipedia security can be defined:

Security is protection from, or resilience against, potential harm (or other unwanted coercive change) caused by others, by restraining the freedom of others to act. Beneficiaries (technically referents) of security may be of persons and social groups, objects and institutions, ecosystems or any other entity or phenomenon vulnerable to unwanted change. Security mostly refers to protection from hostile forces, but it has a wide range of other senses: for example, as the absence of harm (e.g. freedom from want); as the presence of an essential good (e.g. food security); as resilience against potential damage or harm (e.g. secure foundations); as secrecy (e.g. a secure telephone line); as containment (e.g. a secure room or cell); and as a state of mind (e.g. emotional security).

Back when I started writing this blog, hacking was something that was done against ‘the man’, usually as a political statement. Now breaches are part of organised crime’s day to day operations. The Chinese government so thoroughly hacked Nortel that all its intellectual property was stolen along with commercial secrets like bids and client lists. The result was the firm went bankrupt. Russian ransomware shuts down hospitals across Ireland. North Korean government sanctioned hackers robbed 50 million dollars from the central bank of Bangladesh and laundered it in association with Chinese organised crime.

Now it has spilled into the real world with Chinese covert actions, Russian contractors in the developing world and hybrid warfare being waged across central Europe and the middle east.

  • Lean web development + more

    This is more of a wish list of what changes I’d like to see in technology and related areas in the next 12 months. This is based around a number of concepts, a few of which are lean web development, security, SSD pricing, better product design and service breakouts.

    Lean Web Development

    Lean web development. This have gotten ridiculous when the average size of a web page is now 1MB. It adversely affects page load times and assumes that bandwidth for the end audience is limitless, which is a fallacy when you have mobile broadband caps and telecoms providers looking to meter broadband use moving forwards. Lean web development recognises that wireless and wired networks don’t provide the kind of limitless low latency broadband technologists assume exists. It might be about turning the approach to web development on its head and developing for mobile devices first and then adding on content or features depending on the device rather than trying to hyper-mile existing web technologies.

    Security

    A more secure web. At the base level an increased awareness of security: why do companies store credit card details or personal information in unencrypted files? At an architectural level:

    • Re-secured DNS and SSL certificates
    • Secure VPNs over IP v.6 networks
    • Effective IP address and system configuration masking to protect from privacy intrusions and badly executed behavioural advertising

    SSD price decrease

    The price of solid state drives (SSDs) to fall so that they can be used on my MacBook Pro as the primary storage drive for my life. At the moment whilst devices like the MacBook Air are attractive. they don’t have enough storage capacity and act as an adjunct or special purpose personal computing device. At the present time that just isn’t possible. Cloud is interesting as an idea, but the reality of networks doesn’t make it as practical as people seem to think.

    Design

    An increased appreciation of ergonomics in device design. In the mid-90s I had an Apple PowerBook which came with legs that flipped around to angle the keyboard at an optimal angle for typing. My current MacBook Pro doesn’t have any kind of similar feature. My iPhone feels too wide in my hand as a phone and my iPad is awkward to hold. And I haven’t even started into a rant over the pictures under class interface and soft keyboard of the device with no haptic feedback.  Part of this is down to a size-zero aesthetic design obsession and interface designers per-occupation with the Tom Cruise film Minority Report – but its making designs that are not particularly human-friendly and leading to poorer product performance.

    A move away from general purpose technology hardware and smartphones to focused designs. Convergence has been a watchword in hardware and software design. A less positive spin on this is bloatware. In hardware that has meant personal computers and smartphones. The personal computer is currently being challenged for dominance by tablet devices which only use a fraction of the computing power available. Why is it that Microsoft Word only allows me to write as fast in the latest version for the Mac as Word 5.1 which was released two decades ago? It is ironic that smartphones like the Apple iPhone can do a range of great and trivial tasks, but are quite poor at being a phone. Dropped calls, poor call-quality and a form factor that still feels a bit too wide in my hand as I hold it to my ear – it is a great example of being a jack-of-all-trades but master of none. Whilst a Swiss army knife or Leatherman tool is useful at a pinch, you are still better off doing the job with the right tools if available. With software or digital services space and weight aren’t an issue, yet we have products that have overloaded awkward functionality that leads to a poor user experience. By all means get different things to talk to each other: iftt provides a great template for how that should look; but don’t try and do all of those things on the one user space. 37Signals ethos to become the norm, rather than the exception.

    Service break out

    One of the Chinese services like Sina.com’s Weibo crossing over and giving Twitter a run for its money. Sina.com have kept innovating with their product getting ahead of Twitter and innovating in terms of the user experience. A side benefit of compliance with Chinese government legislation has meant that they seem to do a good job on spam as well.

    Wireless choice

    A clear idea of what on earth is happening with Research in Motion | Intel | Sony in the mobile space and excellent differentiated products to bring some choice back into the wireless world rather than more of the same. The wireless device industry is starting to exhibit some of the dynamics of the PC industry: with ARM and Android being the Intel X86 and Microsoft Windows of the handset world, with Apple doing their own things. Costs are coming down but innovation only seems to look like what Apple does at the present time. There is a reduction on the types of form factor designs and interaction methods.

    Media

    The return of Geek Monthly. This was a US publication that I came across in Hong Kong. It’s publisher filed for Chapter 7 bankruptcy, but it got picked up by a new firm looking to get it back on the road. Hopefully they’ll succeed. This Current TV programme should give you an idea of what to expect:

  • STRATFOR breach

    I got an email about 40 minutes ago announcing that STRATFOR were looking into a breach of their servers and email. I’ve always found their analysis on international issues informative and insightful which has helped in my work thinking about international projects with NGOs and in my writing here on this blog. It is one of a a number of media outlets that I pay a subscription to.

    Given that Stratfor position themselves as not only domain experts in territories around the world and geopolitics, but also opsec (operational security); the data breach is a shockingly bad own goal. It will be interesting to see how their brand manages to recover. The hackers have made off with a trove of government, academic, media contacts as well as general people like me who are curious about what’s going on in the world.

    Dear Stratfor Member,

    We have learned that Stratfor’s web site was hacked by an unauthorized party. As a result of this incident the operation of Stratfor’s servers and email have been suspended.

    We have reason to believe that the names of our corporate subscribers have been posted on other web sites. We are diligently investigating the extent to which subscriber information may have been obtained.

    Stratfor and I take this incident very seriously. Stratfor’s relationship with its members and, in particular, the confidentiality of their subscriber information, are very important to Stratfor and me. We are working closely with law enforcement in their investigation and will assist them with the identification of the individual(s) who are responsible.

    Although we are still learning more and the law enforcement investigation is active and ongoing, we wanted to provide you with notice of this incident as quickly as possible. We will keep you updated regarding these matters.

    Sincerely,

    George Friedman

    Cryptonome have more details here: complete with the obligatory Pastebin links. Twitter currently has a lively discussion on the hack.

    Update (February 2023): Stratfor bought all its subscribers an Equifax monitoring package for their credentials and offered discounted subscriptions. It revamped its infrastructure and carried on. Stratfor never completely recovered from the breach. It eventually sold itself to a larger group Rane. As part of Rane the Stratfor work continues and they still sell expert consultancy.

    Rane have since embraced social media to promote its content to prospective customers. The quality is the same high standards as what it used to be under Stratfor before the data breach.

  • Funds of funds + more news

    Funds of Funds

    Funds of Funds May Actually Increase Risk, Study Finds – NYTimes.com – this feels counter-intuitive at first, until you realise that funds of funds are a synthetic financial instrument from the prospective of the end investor. Synthetic financial instruments led to problems like the 2008 financial crisis and the Savings and Loans crisis of the 1990s. The reason for the problem of funds of funds for the end investor is that there lots of known unknowns under the hood. It is conceivable that several funds make a similar wrong headed bet and get stung by it. Without directing the funds, how do you maintain continued diversity of investment and strategies to ensure the bet hedging. Lastly funds are less liquid assets in the grand scheme of things with limitations on when and how much you can withdraw. I wonder if a similar study has been done around thematic ETFs as well?

    Beauty

    At Makeup Alley, Advice From Online Peers – NYTimes.com – how user reviews are demolishing beauty treatment company claims and promoting other products that previously didn’t claim benefits

    Economics

    Wealthy Investors Grow Pessimistic About Economy – WSJ – US economy, due to government debt and economic growth

    Japan records surprise trade surplus – FT.com – rescheduling manufacturing work around power fluctuations

    Ethics

    danah boyd | apophenia » “Real Names” Policies Are an Abuse of Power

    A Billion Dollars Isn’t Cool. You Know What’s Cool? Basic Human Decency | TechCrunch – social norming around the social web

    Ideas

    Could Quantum Computing Kill Copyright? | TorrentFreak

    Korea

    Five Lessons From Samsung’s Second Quarter Results – WSJ – interesting that Samsung is husbanding its cash by reducing shareholder returns

    Luxury

    Second-Tier Spotlight: “Rich Second Generation” Fueling Ningbo Luxury Market « Jing Daily : The Business of Luxury and Culture in China – interesting divergence in consumer preferences

    Media

    To Spread Your Brand On Facebook, Don’t Target Your Fans–Target Their Friends | Fast Company – propagation planning

    More British papers dragged into hacking row ‹ Japan Today – not surprising, the practice may have started at the News of The World but could have been taken around the papers as journalists and editors move on to new roles

    Murdoch Selects Advisers Carefully – WSJ.com – it makes sense he needs a ‘clean’ team that can stay together through this

    Online

    danah boyd | apophenia » Designing for Social Norms (or How Not to Create Angry Mobs)

    With the Bing Search Engine, Microsoft Plays the Underdog – NYTimes.com – I am not seeing a cohesive vision to change search from Microsoft; this looks like the ‘we are innovative’ foot-stamping PR wrapped in a storytelling methodology that comes out of Microsoft corporate PR. I think that the social search stuff at Google and Facebook is of more interest. Bing needs to come out of the box with something 10 times better to get people to move in significant numbers. Qi Lu didn’t manage it at Yahoo!, what makes them think he can manage it at Microsoft?

    A Bomb in Oslo? What Google Lost by Ending Real-Time Search – The Atlantic – Google News just wasn’t as fast, it needs Realtime

    Official Google Blog: More wood behind fewer arrows – interesting change, more focus on fully formed products?

    Security

    Majority of South Koreans’ data exposed | FT.com – the interesting bit is the data wipe of PCs used in the attack to hide fingerprints

    Technology

    Data Centers Using Less Power Than Forecast, Report Says – NYTimes.com – green technology and virtualisation kicks in

    The Key Subtle Notes From Apple’s Earnings Call | TechCrunch – exclusives are doled out on the conference call without hype

    Wireless

    Apple Passes Nokia and Holds Off Samsung to Become World’s Top Smartphone Vendor [Updated] – Mac Rumors – Android is Toyota and Apple is Mercedes & Porsche

  • Facial recognition – ethics

    Former CEO Eric Schmidt made a big deal of facial recognition databases being the one technology that Google wouldn’t deploying as it is an ethical and privacy set too far. Face recognition is currently used in law enforcement situations from policing football matches to anti-terrorism detection and surveillance amongst crowds. Google does use a certain amount of face recognition technology in its Picasa photo-sharing application and has some patents on using facial recognition in a social network.

    Developments in face recognition technology are apparently taking place at a rapidly increasing pace according Schmidt, which means that even if Google doesn’t roll something out, others will, Facebook being the likely favourite.

    With geotagged images and video taken by smartphones, turning the world into a constantly surveiled system. There would be no privacy and few hiding places left. The idea of moving to a new town or city and reinventing yourself which young people do when they go to college or go and get their first job would fall at the first hurdle as your old life would be seamlessly sewn together to your new one online.

    The risk goes up considerably when you have battered spouses who have ran away or are looking escape a stalker.

    Google’s disinterest in face recognition could be seen as being more about dodging anti-trust regulations, particularly if this technology was merged with search. However once someone does it, Google will to be a reluctant but fast follower if it is to continue to compete in the online space, which probably explains why they bought PittPatt the other day and recently patented the use of facial recognition technology to pick famous people out of pictures (presumably to improve image search relevance). More related content can be found here.

    More information online

    One Counter To Schmidt’s Facial Recognition Claim | Stowe Boyd

    Google Acquires Facial Recognition Software Company PittPatt | Techcrunch

    Google warns against facial recognition database | The Telegraph

    Google Thinks Facial Recognition Is Very, Very Bad. Except Maybe For Famous People | Gizmodo

    Google debates face recognition technology | FT.com

  • Pepsi cola + more news

    Pepsi cola

    PepsiCo Gives Pepsi-Cola a Renewed Marketing Push – WSJ.com – You just can’t go dark on brands and expect them to hold their value (paywall). At a corporate level PepsiCo had tried to focus more on functional / healthy foods and so had under invested in Pepsi cola as a brand. Market share depends on market penetration and relative share of voice so keeping a steady investment in Pepsi cola would have made more sense, even if the ‘social good’ points aren’t earned. By comparison, Pepsi cola main competitor

    Ideas

    Phys Ed: The Science of Toning Shoes – NYTimes.com – is it about whether they work, or encourage people to exercise?

    Innovation

    Did Microsoft steal the Kinect? – Hack a Day – or is it like the light bulb which had about 8 inventors at the same time

    Nice try, Amazon: ‘One-click’ payment too obvious to patent • The Register

    TECHNOLOGY REPORT » Artificial Intelligence Pioneer Marvin Minsky on the current state of AI Research – a high tech research version of the ‘if you have a hammer, every problem looks like a nail’

    Japan

    Japan’s attention to detail is all in the delivery | The Japan Times Online – since security is no longer guaranteed, fun is a key decider in roles

    London

    Afternoon Tea – Japanese tourists love it apparently

    Luxury

    Prada Woos Young Chinese With Sister-Brand Miu Miu – WSJ

    Only In China: Paper Gucci Insert Causes Vogue China Buying Frenzy « Jing Daily – shows the power of the brand, however does this dilute the brand for purchasers?

    Watches Are Rediscovered by the Cellphone Generation – NYTimes.com – an interesting article. Watches aren’t only about what information they convey to the wearer, but also what they say to other people. I remember reading an article about stainless steel Seiko analogue watches being popular with Japanese job hunters who wanted to convey that they were punctual

    Security

    Microsoft admits Patriot Act can access EU-based cloud data | ZDNet – Can Microsoft guarantee that EU-stored data, held in EU based datacenters, will not leave the European Economic Area under any circumstances — even under a request by the Patriot Act? – This screws US technology sales in a number of areas

    Software

    Why Microsoft’s ‘single ecosystem’ for PCs and tablets carries huge risks | guardian.co.uk – unified user experience just isn’t going to cut it across the different user contexts

    Judge finds HTC guilty of infringing two Apple patents; could mean trouble for Android

    Amazon’s Appstore problems run deep: a developer speaks out | ExtremeTech – interesting that Amazon has had problems

    Telecoms

    I, Cringely » The enemy of my enemy – Bob Cringely on Google’s next likely move after losing the Nortel patent portfolio to an alliance of its enemies – RIM and Ericsson together put up $1.1 billion with Ericsson getting a fully paid-up license to the portfolio while RIM, as a Canadian company like Nortel, gets a paid-up license plus possibly some carry forward operating losses from Nortel, which has plenty of such losses to spare. For RIM the deal might actually have a net zero cost after tax savings, which the Canadian business press hasn’t yet figured out. Microsoft and Sony put up another $1 billion. There is a reportedly a side deal for about $400 million with EMC that has the storage company walking with sole ownership of an unspecified subset of the Nortel patents. Finally Apple put up $2 billion for outright ownership of Nortel’s Long Term Evolution (4G) patents as well as another package of patents supposedly intended to hobble Android.