A wonderful read!

Just finished reading The White Tiger by Aravind Adiga, winner of the 2008 Man Booker prize.

The writing is amazing.

One would like to call it funny except for the fact that it is so incredibly dark and tragic.

It is written as a first-person, sort of epistolary novel, a collection of "letters" from self-styled entrepreneur Balram (Munna) Halwai to Chinese Premier Wen Jiabao. In these letters, Balram offers advice to the Premier, based on his experience in his own rise from son of a rickshaw puller in a small town in India ("The Darkness") to successful businessman in Bangalore. Let's just say this is no Horatio Alger rags to riches story...there are bodies on the road.

Adiga describes in vivid detail some of the forces at work in modern India, that shape the lives of millions of marginalized people: family, class, corruption, modernization, caste. He has few kind words for any of them.

This is probably the best book I've read in a long time. But don't read it if you are not prepared to squirm a little.

Some thoughts on writing

Just saw two wonderful quotes from Erica Jong today:

No one ever found wisdom without also being a fool. Writers, alas, have to be fools in public, while the rest of the human race can cover its tracks.

and

Everyone has talent. What is rare is the courage to follow the talent to the dark place where it leads.

I suspect these two are not unrelated.

Bad Mouth Your Boss or Co-worker? How about your employees?

This seems like such a Bad Idea that I'm surprised that Time even bothered to report on it, and that, too, in as neutral a tone as it did.

Essentially, there is a new website, Unvarnished (which I am NOT going to link to) that encourages you to post "anonymous" reviews of your boss or co-workers. Which boils down to anyone reviewing...well...anyone, since there's no possible way for Unvarnished to verify that the person you claim is your boss actually is. (Or, for that matter, that you are who you claim to be, though you are required to identify yourself with a Facebook account.)

The site claims to be an epinions-like way of submitting information about people you work with:

Unvarnished reviews are community-contributed, business-focused assessments of professional performance.

To help reviewers be honest and candid in their reviews, Unvarnished obscures the identity of review authors. This lets reviewers share their true, nuanced opinions without fear of repercussions.

At the same time, to ensure that reviews are of the highest quality, and maintain a helpful, business-focused approach, Unvarnished provides a suite of tools to allow the community to rate and moderate reviews.

How do I hate this? Let me count the ways.

1. Risks to the reviewer:
   How anonymous is this really? To make a review useful, one would have to add enough detail that it would be pretty easy to identify the reviewer. Not to mention clues offered by writing style. Most people "give themselves away every time they open their mouths" (to quote Henry Higgins), even if they think they are posting anonymously. And what's all this business about linking to Facebook? (Actually, to tell you the truth, my guess is the Facebook bit is mostly so that the Unvarnished people don't need to deal with all the adminstrative hassle of managing accounts, but I digress.)
2. Risks to the reviewee:
   What prevents anyone with a grudge about your work from writing any nonsense about your work? Having an argument with your boss/employee/annoying person in another group about whether it is legal to perform some action? Wouldn't go out with someone at work? Wouldn't work an 80 hour week? Do you wear perfume they don't like (and they never had the guts to tell you in person)?
   While we're at it, what prevents anyone in the world from writing any nonsense about your work? Disgruntled neighbors? Annoying ex-boyfriends? Here's one that I bet you wouldn't think of: extortionists. Apparently there's a bit of a cottage industry in Second Life of virtual mobsters gaming the ratings system of unsuspecting users. And that's just Linden Dollars. Think of the USD value you could extract for professional reputation or psychological despair.
3. Risks to the review reader:
   Given the above: can I believe anything I read on this site?
4. Risks to the organization employing the reviewee:
   a) What confidential information may be divulged in a review?
   b) Do you really want your organization's dirty linen aired in front of customers or other parts of the organization?
   c) What does this do to morale within the organization?

Many comments on the article have noted that this is a law suit waiting to happen.

I am half tempted to sign up for access, just to see how much damage you could really do, if you had it in for someone. But I am also paranoid about these sorts of things, especially the bit about hooking it up to a Facebook account. So maybe not.

Interesting summary of security issues

Yes, I know...I'm behind.

I have a long post about my CISSP in production (actually...see below...since I started it earlier, but finished it later, it's the next one down), but in the meantime, I wanted to post an interesting article I saw today. It's about some of the more serious IT threats we are likely to face in the near future. It's chock full of really interesting statistics and anecdotes. It may sound a little technical, but don't worry about the details. I find the bits on insider fraud and social networking particularly interesting.

Enjoy! And sleep tight!

And, as Annapurna might say...MUUUUHAAAHAAAA!!!!!

Wheeee!!!

I'm a CISSP!!!!

For you laypeople...that expands to Certified Information Systems Security Professional.

As I've already mentioned in other fora, several days ago I received the actual piece of paper, complete with gold embossing. Has my name on it, and everything! And I got the lapel pin, too!

What the certification means is that I can now claim to any potential employers or project owners (1) I passed a rather annoying 6 hour exam on ten "domains" (areas) of Information Security and (2) over the course of my career I've had at least 4 years of experience in at least two of those domains (in my case those would be Access Control, Operations Security, Application Security and Information Security and Risk Management) and (3) an existing CISSP vouches for (2) and that I'm of good character and that I'm competent. (Vampire kind of thing going on there. One has to wonder who "made" the first CISSP, but I digress). Surprisingly, having a certificate to these three claims appears to be a requirement for many jobs and participation on many projects.

The exam was truly annoying, and in my opinion, sometimes more an exercise in parsing English carefully than a technical exam. But studying for it was definitely a useful, if somewhat frustrating experience. The exam is "managerial" level (as most training materials will emphasize), also commonly called a mile wide and an inch deep. The content is sometimes poorly defined, contradictory, arbitrary, and focuses on some trivia that is easy to test but almost irrelevant to realistic modern threats (e.g. the infamous Smurf attack -- bet you never thought you'd hear me talking about Smurfs). However, there is some very important content, as well, and the process of thinking about it and organizing it in my mind was, for me, the most valuable part of the experience.

Overall, I'm glad I've got it, but I don't think it changes much what I'm capable of.

One of my favorite things

Sharney recently posted Benjamin Franklin's 13 virtues which I agree are, for the most part, things I'd like to aspire to. Order...that's a tough one! So are a lot of the others.

But that's not what I'm here to talk about today. In a similar spirit, I will post Max Erhmann's Desiderata, one of my very favorite inspirational pieces. In fact, I like it so much that I am going to type it out, rather than cut and paste it in here. Beware of typos!

Go placidly amid the noise and haste,

and remember what peace there may be in silence.

As far as possible, without surrender

be on good terms with all persons.

Speak your truth quietly and clearly;

and listen to others,

even the dull and the ignorant;

they, too, have their story.

Avoid loud and aggressive persons;

they are vexatious to the spirit.

If you compare yourself with others,

you may become vain and bitter;

for always there will be greater or lesser persons than yourself.

Enjoy your achievements as well as your plans.

Keep interested in your own career, however humble;

it is a real possession in the changing fortunes of time.

Exercise caution in your business affairs,

for the world is full of trickery.

But let this not blind you to what virtue there is;

many persons strive for high ideals;

and everywhere life is full of heroism.

Be yourself.

Especially do not feign affection.

Neither be cynical about love;

for in the face of all aridity and disenchantment

it is as perennial as the grass.

Take kindly the counsel of the years,

gracefully surrendering the things of youth.

Nurture strength of spirit to shield you in sudden misfortune.

But do not distress yourself with dark imaginings.

Many fears are born of fatigue and loneliness.

Beyond a wholesome discipline,

be gentle with yourself.

You are a child of the universe,

no less than the trees and the stars;

you have a right to be here.

And whether or not it is clear to you,

no doubt the universe is unfolding as it should.

Therefore, be at peace with God,

whatever you conceive Him to be.

And whatever your labors and aspirations,

in the noisy confusion of life, keep peace in your soul.

With all its sham, drudgery, and broken dreams,

it is still a beautiful world.

Be cheerful.

Strive to be happy.

School issues laptop, then uses it to spy on student

This is so mega creepy.

Many school districts are trying to ensure that children have the internet access they need for their schoolwork by issuing every child an identical laptop. In my opinion, done correctly, this is a laudable approach. Every child is guaranteed access, and (again, when done correctly) is provided with a controlled, protected, maintained internet environment, including someone taking care of things like antivirus for them, etc. Now, in order to make all that good maintenance stuff possible, one thing that a district can do is install the equivalent of a remote-access trojan that allows an administrator to reach into all of the district students' laptops and do the necessary maintenance on them from the comfort of the district's data center.

However, some bright person in a Pennsylvania school district took things a little farther. Ostensibly to protect against theft, they had webcams put into the laptops, so that if one were reported stolen, all they'd have to do (ha!) would be to turn on the remote administration, activate the webcam, have a little peek around, and with Holmes-like detective skills, immediately infer where they were, and voila! Track down the thief and retrieve the stolen goods.

I guess it got a little boring when no thefts were reported, so instead they chose to gather some...uh...information...about what kids were doing when their laptops were on. And surprise, surprise, "on November 11, an assistant principal at Harriton High School told the plaintiffs' son that he was caught engaging in "improper behavior" in his home and it was captured in an image via the webcam."

The sad thing is that I think we'll see a lot more of this sort of thing in the future.

Edited to add:

CNN says the school claims it didn't spy on the kid. FBI is checking things out. The fact remains, however, that the District Superintendent does admit that the capability was there to spy. "This feature was limited to taking a still image of the computer user and an image of the desktop in order to help locate the reported missing, lost, or stolen computer (this includes tracking down a loaner computer that, against regulations, might be taken off campus)."

In my opinion, having this capability is just a spying incident waiting to happen.

Citizens united (against Citizens United)

Larry Lessig has an interesting posting on the awful Citizens United Supreme Court decision.

He calls for two main actions:

1. In the short term: passage of the Fair Elections Now Act. See http://www.publicampaign.org/node/38166 for a description of this law that basically calls for citizen-funded elections (donations $100 or less)
2. In the longer term: a constitutional convention to pass an amendment to the constitution to protect the independence of congress from funders (see http://www.callaconvention.org/pages/call-for-a-convention/ for his reasoning and proposed amendment)

Lessig is a very interesting guy. Years ago I followed a great online class he and a couple of other lawyers ran on Cyberspace Law. I am not a lawyer (mandatory IANAL here :-), but the class was fascinating and accessible...check it out. It is a little old, but he covers the underlying principles, which I imagine can't have changed all that much. Many of the topics covered (copyright law, privacy law, free speech, etc. as they relate to cyberspace are still very hot topics.)

Eye of the storm

Doesn't this look like something out of Magritte?

We had rather a lot of snow yesterday.

On the slow track to justice

A week or so ago I was on a train from New York to Princeton. Somewhere before Linden I heard a bit of a hubbub around me and something about "all for $1.75".

It seems that a young man was trying to get a free ride by sneaking on at one station and sneaking off again at the next station, before the conductor came by to collect tickets. Unfortunately for him, the conductor came by a little too soon. And still more unfortunately for him, it seems that this wasn't the first time he was caught in this behavior. It was his third strike.

The conductor, only slightly older than the culprit, gleefully radioed for reinforcements. So along came the older head conductor, as well as a third conductor to join in the sport. They needled him for a while, and finally, not knowing how else to extract any satisfaction from him, radioed for the police to pick him up at Linden.

The train pulled in to Linden. And waited for the police to arrive. For about 20 minutes. And then waited for the police to debrief the conductors for about 10 minutes. During which time no one was allowed on or off the train, including passengers who just wanted to get off at Linden. Luckily I was in no particular rush, but there were a number of fairly antsy people around.

During all this waiting, I had some leisure to reflect on the incident.

The predominating question in my mind was: who stood to benefit from this exercise in justice? Why was so much collective time allowed to be spent on addressing such a petty "crime"?

Consider how much time was involved: at least one trainful of people, containing possibly hundreds of passengers, was delayed for half an hour, and who knows how many other trains with how many other passengers were held up behind ours? In addition, no fewer than three police officers appeared on the scene to interrogate the dangerous fare-jumper, diverted from protecting the citizens of Linden from other dangers. Who knows what the delays may have cost the passengers, in terms of lost opportunities, irritation to their customers or colleagues or families? Had I been on my way to, say, a job interview, I would undoubtedly have been frantic at the delay. To be fair, I think that the conductors, had they known that the process would be so slow, would have contented themselves with throwing the guy off the train at Linden with a couple of savory curses.

What was the value in spending all this time to punish a $1.75 crime? At the time, it felt like the purpose of the exercise, in the minds of the conductors, was to demonstrate to the world that they were there to uphold the social contract. It wouldn't be fair, after all, to the law-abiding, paying passengers to let some thief off scot-free. And besides, they weren't going to let some dumb-ass criminal make a monkey of them. Probably there were a few people on the train who felt the same way. But I think the majority of the law-abiding, paying passengers on that train would have cheerfully allowed the social contract to be broken in this instance, if only to get to where they were going on time. Clearly there's more at stake than $1.75, but it's not clear to me how much. Is fare-jumping a major revenue-loss for the the trains? I don't know. But it would have to be a pretty significant one, to make a delay like that worthwhile. No one from NJ Transit bothered to share that information with us.

It's a common theme in security: you don't spend more on protecting something than that thing is worth.