So evidently a creation of Apple’s called Vingle is generating a ton of buzz. Here’s the language they used to describe it:

Telecommunication services, namely, electronic transmission of streamed and downloadable audio and video files via computer and other communications networks; providing on-line chat rooms, bulletin boards and community forums for the transmission of messages among computer users concerning entertainment, music, concerts, videos, radio, television, film, news, sports, games and cultural events; web casting services; delivery of messages by electronic transmission; provision of connectivity services and access to electronic communications networks, for transmission or reception of audio, video or multimedia content.

I am quite unsure of what the hell that is, but given their track record lately I can’t wait to see it.

A fellow blogger by the name of Kasia pointed out an interesting paper called Unskilled and Unaware of It: How Difficulties in Recognizing One’s Own Incompetence Lead to Inflated Self-Assessments. I thought this was particularly good:

“It is one of the essential features of such incompetence that the person so afflicted is incapable of knowing that he is incompetent. To have such knowledge would already be to remedy a good portion of the offense.”

Do you work with someone like this? Most of us do, and it’s nice to know there’s a paper about it.

Now this is a cool geek conversation piece. :)

As many of you know, there is currently a story about a security consultant by the name of Daniel Cuthbert who’s been convicted of illegally accessing a Tsunami relief web page after making a donation.

There are widely varying views on this, but let’s first lay down the facts as we know them. First of all, he tried accessing the system directories on the web server. Secondly, and most importantly, he tried to get the database to cough by doing some SQL injection.

Here’s the thing: at the very least the guy should be convicted of abject stupidity. He may not have had any intentions of doing anything malicious, but as a security consultant he should have known better than to throw single quotes into URLs without permission. This is day 1 security consultant stuff.

His story evidently is that he didn’t get a confirmation email back after making a donation, and that after becoming suspicious he decided to check into it. The problem with that is that he wasn’t paid to audit their security. (Insert analogy about open doors on in a residential neighborhood) He should have known better — plain and simple.

What this guy does not deserve, however, is to have his name ruined. He made a bad choice, but it’s not the sort of thing that should end a career. Give him a fine, a healthy dose of embarrassment, and put an end to it. What he did wasn’t immoral, it was just stupid. Give the guy a break.

My buddy and I dabble in some Python and he stumbled across this little puzzle for novice coders. You can do it in any language, but we opted for Python. Anyway, here’s how I solved it:

reverse.py

Ken’s code was a lot more Perl’esque, i.e. it had more power per line. I’ll post a link to his when he makes it available.

There’s a new browser coming out soon. It’s called Flock, and it’s supposed to be based around the social concept, e.g. delicious, flickr, etc.

I’m somewhat worried about the security of such an offering. Not because of the team or anything, but because they are including so much functionality. Complexity is the enemy of security, and I can’t see something that integrates all of this coolness not being complex.

(yoda) Complexity leads to mistakes. Mistakes lead to vulnerabilities.(/yoda)

Anyway, I can’t wait to see it. I’ll just use double passthrough reverse ROT13 encryption on my firewall while I run it. You can’t be too careful with this stuff.

So I’m like completely enthused about the new Blackberry that’s supposedly about to be released. The coolest thing about it (other than the fact that it’s new) is the built-in GPS that it’s supposed to have.

I can only hope that this legal trouble they’re in will go away soon.

I listen to like 5 channels on XM, and two of them are Fox and CNN. Lately I’ve become absolutely militant when the news gets interrupted with the same exact guy doing commercial after commercial about home refinancing, GoToMyPc, or whatever else. It’s insane.

Not only do the commercials suck, but I’m paying like $13 a month to listen to them. To top it off, they took my favorite station off the air, making it available online only.

I’m seeing less and less benefit to this service as time goes on. If things don’t change quickly I’m either going to be looking at Sirius or dumping satellite radio altogether.

• The next version of Nessus is going to be binary-only, i.e. closed source.
• Check Point just bought Sourcefire, the company whos founder started Snort.

Dude.

All I have to say is that I can’t wait to see the products that step up to fill the gaps. Prelude anyone?

Many grapple with the concept of authentication in information security. What tends to happen is that they confuse authentication with identification or authorization. They are in fact all distinct concepts, and should be thought of as such. Let’s go over each and give an example or two:

Identification

Identification is nothing more than claiming you are somebody. You identify yourself when you speak to someone on the phone that you don’t know, and they ask you who they’re speaking to. When you say, “I’m Jason.”, you’ve just identified yourself.

In the information security world, this is analogous to entering a username. It’s not analogous to entering a password. Entering a password is a method for verifying that you are who you identified yourself as, and that’s the next one on our list.

Authentication

Authentication is how one proves that they are who they say they are. When you claim to be Jane Smith by logging into a computer system as “jsmith”, it’s most likely going to ask you for a password. You’ve claimed to be that person by entering the name into the username field (that’s the identification part), but now you have to prove that you are really that person. Most systems use a password for this, which is based on “something you know”, i.e. a secret between you and the system.

Another form of authentication is presenting something you have, such as a driver’s license, an RSA token, or a smart card. You can also authenticate via something you are. This is the foundation for biometrics. When you do this, you first identify yourself and then submit a thumb print, a retina scan, or another form of bio-based authentication.

Once you’ve successfully authenticated, you have now done two things: you’ve claimed to be someone, and you’ve proven that you are that person. The only thing that’s left is for the system to determine what you’re allowed to do.

Authorization

Authorization is what takes place after a person has been both identified and authenticated; it’s the step determines what a person can then do on the system.

An example in people terms would be someone knocking on your door at night. You say, “Who is it?”, and wait for a response. They say, “It’s John.” in order to identify themselves. You ask them to back up into the light so you can see them through the peephole. They do so, and you authenticate them based on what they look like (biometric). At that point you decide they can come inside the house.

If they had said they were someone you didn’t want in your house (identification), and you then verified that it was that person (authentication), the authorization phase would not include access to the inside of the house.

Everyday Use

It’s interesting to note that these three steps take place every day in a very transparent fashion. When your boss calls you at work and asks to meet you across town for lunch, two things happen instantly — usually at the exact same time: just by hearing the boss’s voice you have both identified and authenticated them. Identification doesn’t have to be done by the person being identified; it can be done by the person doing the identifying as well.

Another interesting hybrid is trying to get into a night club. When you get to the door and present your I.D., you’re not just claiming you are that person, but you’re presenting the I.D. as proof — that’s both steps in one. The result of whether or not your authentication was accepted as authentic is what determines whether or not you will be given authorization to get into the club.