Heading to Chicago in a few hours; I’ll be there through Monday morning. Looks like we’ll probably be at GD on Friday, Saturday, or both. Yay!
Chicago bound!
12
Some thoughts on computer security and credulity
So recently Business Week magazine ran an article about keylogger software being used in espionage. Essentially, defense contractors are being tricked into infecting their computers with keylogger malware, sent in targeted emails that appear to come from the Pentagon and other governmental sources.
The thing I find interesting about this, and also about things like the Storm and Kraken worms, is that they don’t take advantage of security flaws or vulnerabilities. They don’t attack holes in a computer’s operating system or applications, and they don’t rely on technical exploits of programming errors. These attacks all rely on tricking the victim into deliberately, intentionally infecting himself.
For that reason, I don’t think there’s a technological solution. The solution to a human gullibility problem isn’t in better programming or more elaborate firewalls; it’s in user education. No matter how sophisticated and bulletproof a security system is, there’s no defense against a person who deliberately chooses to permit someone through it.
But when it comes to the Intertubes, folks don’t get that.
If we had a situation where a criminal walked into a bank and, without weapons or violence, tricked a security guard into opening the vault for him and handing him all the money inside, we would not say “Oh, we need to build bigger vaults with thicker doors and more complicated locks!” It’s obvious to anyone who thinks about something like that that a bigger door or thicker walls won’t prevent someone from tricking a gullible guard into unlocking the door.
Yet with computer malware, we tend to jump on technological solutions. Someone in China tricks an American defense contractor into deliberately installing a key logger on his computer, and everyone says “We need tighter computer security and more computer defenses.” Which is as pointless and ineffectual as saying “we need thicker bank vault walls” if someone persuades the guard to intentionally, deliberately unlock the vault door and hand him the money.
What we need isn’t better computer security; better computer security will not and can not address this kind of problem. What we need is less gullible people.
A few weeks back, someone posted an ad on Craigslist saying that they were moving suddenly and they needed to get rid of everything in their house, including their horse. They said that the house would be unlocked and anyone who wanted to could come and take anything they liked. Hundreds of people showed up and ransacked the house, even taking light fixtures and plumbing fixtures.
Needless to say, the Craigslist ad was bogus. Some people had robbed the house earlier, then posted the ad to conceal the evidence of their robbery.
Of course, the police showed up, but what was most interesting was how indignant the folks who ransacked the house were. They were angry and upset that the police tried to stop them. Many of them waved printouts of the Craigslist ad around, as if it justified what they were doing. They genuinely, sincerely believed that the ad on Craigslist meant they were doing nothing wrong.
That’s the mentality a lot of folks–including folks who ought to know better, including defense contractors–have. They truly believe that if an email says it is from someone they know and they should download and run the attached program, it must be OK to do. They sincerely think that if they see it in an email, it can not possibly be false. And that gulllibility makes them easy to dupe.
These are not idiots. If a person walked up to them on a street and said “I live at 423 Main Street but I have to move in a hurry, so go into that house and take anything you like,” they’d be like “Yeah, right.” If someone walked into their office and said “I’m from the pentagon, take this CD and run the program that’s on it,” they’d never in a million years do it.
But because it’s on the Intertubes, somehow it gets past their bullshit filters, and they suspend their ordinary skepticism. And I think that’s really, really interesting.
One of my all-time favorite books is Why People Believe Weird Things: Pseudoscience, Superstition, and Other Confusions of Our Time, by Michael Shermer, who’s one of my personal heroes. I met him briefly at a science fiction convention last October, and he’s just as amazing in person as he is in print.
One of the things he talks about, and one of the things I’ve written about as well, is the idea of the brain as a “belief engine,” a tool for forming beliefs about the physical world. As a tool for survival, the brain works amazingly well, but survival pressures have tended to shape and mold it in such a way that its default state is to accept ideas uncritically rather than reject them. For our early hunter-gatherer ancestors, the consequences of accepting a false belief (“keeping this magic stone in my pocket will help me ward off evil spirits”) were generally less dire than the consequences of rejecting true beliefs (“a leopard is dangerous to me,” “keeping upwind of my prey will cause my prey to escape more often”), and so we have developed these amazing brains that find it much easier to accept than to reject ideas.
On top of that, our brains are so highly optimized for efficient and rapid pattern recognition that they can tend to see patterns even where none exist (“when I updated to OS X 10.4.11, my hard drive failed; the update was responsible for the failure”).
I wrote an essay about the belief engine a while back. I think that it applies to things like Internet hoaxes and Trojan-horse malware in part because we are wired by selective adaptation to accept ideas uncritically, but we are also taught from a young age when that kind of uncritical acceptance is dangerous.
Everyone (well, almost everyone) learns from an early age not to trust strangers. So if a stranger stopped us on the street and said “I live in the house at the end of the block but I have to leave, so walk on in and take whatever you like,” there’s no way we’d believe him. But we aren’t taught to distrust the Internet.
To make matters worse, I think the Internet confuses people by messing with the signs we have been taught to accept to mark trustworthy people and institutions. We are taught to separate folks within our sphere of trust from folks outside of it, but we are not taught that this trust doesn’t extend to the Internet.
So, for example, most of us trust our mothers. If we receive an email and it’s got Mom’s “from” address on it and claims to be a greeting card, we’ll likely download it and run it without a second thought, because we trust Mom. What we haven’t been taught is not to trust the From: address on any email. People don’t realize how easily that is faked; the email is trusted because it bears the mark of being from a person inside our sphere of trust, but that mark itself is untrustworthy.
Same deal for a defense contractor who receives an email that claims to be from his Pentagon contact. Because the email carries a mark of a person inside the sphere of trust, the email is accepted.
Phishing scams rely on that, too. We mostly trust our banks, and we are familiar with what our bank Web site looks like. So we associate things like the bank’s logo and the bank’s Web site layout, which are familiar and comforting, with that feeling of trust. We so strongly associate things like the bank’s logo witht he bank itself that just the appearance of the bank’s logo can make whatever it’s attached to seem trustworthy.
In contemporary society, this is intentional; businesses do a lot of work and spend a lot of money to associate things like logos with the business, and to attach the logo to our emotional response. But what that means is the logo and the familiarity of the Web site layout make us trust the fraudulent phishing site. These things are more important than, say, the padlock that shows a secure connection, or the URL of the site, because we have not been taught about those things but we have been taught to associate the logo with our feelings of trust in the bank, so that makes us fall for the scam Web sites, and we voluntarily turn over information that otherwise we would be unlikely to give to anyone.
So again what happens is that we see the Internet as a technological construction, and we seek technological solutions to security problems, when perhaps it might be more effective to see the Internet as a social construct, and teach people “never trust an email from anyone” or “never trust a Web site that does not show a padlock on it” the same way we teach people “don’t talk to strangers” and “don’t give your bank account number to people you don’t know.”
I’m not saying there’s no need for technological security, mind you. There are still folks who exploit technical flaws in computers, or who attack computers using technical attacks like DNS cache poisoning or DNS rebinding attacks. Securing computer networks is still a necessary thing to do, and on that score the Internet as it now exists gets pretty dismal marks.
But what gives the Internet its power is the way people use it, not the hardware that makes it up. It is a social construct; it’s essentially nothing more than a communication medium. And any time you have communication, you have the potential for cons and fraud. I really do think that we have not yet, as a society, learned to extend the same degree of distrust to the Internet as we have to things in “real life,” and as a result the natural tendency for us to believe rather than disbelieve is easily exploited on the Internet.
Frolicon, and some thoughts on BDSM
About three weekends ago, figment_j and dayo came down to visit for Frolicon, a BDSM/alternative sexuality convention here in Atlanta. Now, you might think that sounds like a lot of fun…and you’d be right. We met up with datan0de and femetal, and more than a few good times were had by all.
Now, in some ways I think that my own approach to BDSM–or at least the things bout BDSM that draw me to it–are a little unusual, at least in comparison to what I see in others. I’ll get to that in a minute. First, some notes about the con itself.
Which was a blast.
lolitasir gave a demo workshop on fisting, which is one hell of an awesome way to start a weekend. Some how datan0de–at least I think it was him, it may have been one of his clones–ended up being drafted into the demo, playing the part of “lube boy.” And, all in all, there are worse positions to be in. Especially considering it is, y’know, a great way to get up close and personal with a woman writhing in ecstasy, which is always fun.
I also learned to put in a pair of contact lenses. I have a set of contacts that looks like cyborg eyes, and I swear, I have no idea how you folks who wear these damn things all the time do it so easily. Half an hour of working and swearing, it took, just to get them in, and another half an hour to get them back out again.
Lots of panels (and dayo taught me a really cool no-knot two-column tie I’ll be putting up on Symtoys at some point), lots of sushi. Going out for sushi straight from the con, in fetishwear and the whole bit, was fun.
And, of course, lots of play parties.
I had the opportunity to play with dayo and figment_j at the same time, and that by itself was a tremendous amount of fun. Play with each of them is effortless and tends to flow very well, and the three of us together have that same dynamic. figment_j and I had the pleasure of co-topping dayo, with floggers and crops and knives, oh my… After the fisting, it was time for us to turn our attention to figment_j, which is where I really noticed that my style of play, even at play parties, isn’t the same as many of the other people I see play.
I first played with figment_j in a public play party last year. One of the things that I found with her, and one of the things that delights me a great deal about her, is her fearlessness when it comes to exposing herself emotionally. The two of us seem to have a very natural kind of unspoken language when we play, that extends far beyond the physical things we do.
It’s been my observation that many of the people I’ve watched play in public are willing to expose their bodies for whatever scenarios they and their partners create, but are less willing to expose their emotional selves. And certainly in a situation where a person is playing casually, especially with a new partner, that makes sense.
But one of the things that most delights me about figment_j is how easily and readily she makes herself emotionally vulnerable, and how effortlessly we carve out a very private space even when we’re surrounded by people. It was fun to see how that private space expanded to include dayo, too.
I’ve experienced the same thing with dayo, and it does seem to me that this kind of intimacy is not the norm in public play spaces. It takes, I think, a very particular kind of courage to play that way.
Later, when figment_j and I were talking about it, she was expressing frustration that she can’t do the kind of edgy physical play that she’s seen other people do. There was, for example, a person being whipped with singletails at the same time as we were playing–something that’s definitely a nontrivial kind of scene.
I think, though, that the best measure of an activity is in how the people involved respond to it, and in the psychological environment it creates, rather than in the nature of the physical activities, or the amount of bruises it leaves. (Don’t get me wrong; I love leaving marks on my partners, oh yes. Bu that’s not the measure of the quality of the encounter, not by a long shot.)
I get quite a lot of email from my BDSM pages every month, and one common theme I’ve seen in a lot of the email is people saying “I’ve heard of [insert some kind of activity here], and I just don’t see myself getting into that–I’m worried that I’m not a ‘good’ submissive.”
I think that kind of idea can be especially easy to fall into at a play party, where you might be exposed to a wide range of different activities–singletail play, knife play, piercing play, needle play–I’ve even watched people doing fire play at a play party (sans fire extinguisher, which kind of ticked me off, but that’s a whole different issue altogether). Since it’s easier to see the physical side of the things going on than it is to see the emotional side, I think the tendency exists to say ‘So that’s what BDDSM is all about; I don’t want to do those things; that must mean I’m not really doing it right.’
But for me, the stuff that happens behind my partner’s eyes is the interesting stuff. The various techniques that get us there are more or less irrelevant; they’re just the path to the destination. It’s the destination itself, not the road you take to get there, that matters.
And I do realize that approach is somewhat unusual. For many people I’ve talked to, it’s the activities themselves that matter. And, yes, I do get that, too. Being flogged, for example, just plain feels good–in fact, I’ve seen people reach orgasm just from a flogging alone. For many people, in the right context and with the right partner, things that are painful become intensely pleasurable. And that’s totally cool. I like getting my partner off; I like doing things that my partner likes.
But I also like creating that shared emotional vulnerability while we’re at it. That, for me, extends the activity beyond physical pleasure, into a much more emotionally charged space. It creates a physical and emotional dance that, properly done, really lets you see right into your partner’s soul.
And I dig that.
Bizarre email of the day
In today’s mailbox:
From: <deleted>@actionmaintenancesys.com
Subject: How dare you!
Date: April 10, 2008 1:48:10 PM EDT
To: tacitr@aol.com
Yea how dare you attack Scientology like that!
You obviously know absolutely nothing about the religion or the practices contained within.
It is not a bizarre anything it is a practical way of dealing with life and your own personal situations.
You are fucking idiot!
*blink* *blink* No attached pictures of flying saucers, though. I’m not quite sure what triggered this email; I don’t recall saying anything about Scientology any time recently…
Back from Florida Poly Retreat!
I still plan to post more about both FPR and Frolicon (which was last weekend), when I have time to get around to it. Apparently, during the weekend, some spammer forged the domain name of the place where I work for a spam run,a nd the powers that be are freaking out about it, even though it had nothing to do with any sort of attack against or compromise of our servers. *sigh* No matter how many times you tell someone never to trust what it says in the From: field of an email, folks don’t get that the From: address is trivial to fake.
In any event, Florida Poly Retreat was a roaring success, and there was much strip “Are You a Werewolf?”. I had a great deal of fun giving a presentation on ways to screw up a polyamorous relationship, and I’ve even put a PDF of the workshop’s handout on my Web site (though it isn’t linked directly from my poly pages yet…it will be). This handout probably shouldn’t be read by anyone who is satire-impaired.
Dropping back into the real world always makes for a bit of culture shock, and I think I’m going to bed early tonight to catch up on missing sleep.
Anatomy of computer crime
Note: Followup to this entry at http://tacit.livejournal.com/240750.html
So apparently, Macintosh users are now the targets of Eastern European organized crime.
First, a bit of backstory. Last December, I wrote an article about how I had done a Google search for my name and uncovered a massive hacking attack against a Web hosting company called iPowerWeb. iPower, a company in Phoenix, Arizona, has trouble securing their Web servers, and Russian organized crime can hack any Web site hosted by iPower completely at will.
That was last December. Today, as I write this, iPower still has not fixed their server security; each day, a whole crop of new Web sites hosted by iPower is hacked, and the hackers plant redirectors on the site that are designed to snare unwary visitors and send them to servers in Eastern Europe that attempt to infect users with computer viruses.
For the past couple of months, I have been emailing iPower every day with new lists of hacked Web sites they’re hosting. Each day, I bug them to fix their computer security. Each day, they remove the virus redirectors that I tell them about, but they do not fix their server security; so the next day, more of their Web sites are hacked. Some poor sots who host Web sites with iPower have had their sites hacked over and over again.
In the past 48 hours, the nature of the hacks has changed. Between December and now, the hacks were all the same; the hackers would penetrate an iPower Web site, create a directory on the site named /her, create a directory on the site named /bad, and then create a directory with a one or two digit number as a name. The redirector pages would go in the numered directory. This made spotting hacked iPower Web sites trivially easy.
About two days ago, the hackers began changing the naming scheme of the directory. This led me on a path to discovering an entire network of compomised Web sites, feeding into an elaborate underground network of computers used to distribute computer viruses.
And they’re distributing Mac viruses now, too.
If this stuff interests you, read on! (We're about to get technical here.)
George Carlin on God, the Bible, and human rights
The man’s still got it.
Some thoughts on communication
This man has a problem. Actually, he has several problems — he’s just resigned from the office of the governor of New York, he’s facing an FBI probe, and his wife is well and truly pissed off at him. But really, those aren’t his problems; they’re merely the consequence of his real problem.
As you’re no doubt aware unless you live under a rock or in Kansas City, this man is in a lot of trouble. He’s in a lot of trouble for a very simple reason: he had sex with this woman.
Now, I already know what you’re thinking. “How can the person that someone has sex with possibly have any bearing on his ability to govern the state? What, did she break into his office and steal government funds? Was she engaged in industrial espionage for a shadowy group of French business executives? What difference can it possibly make?”
And I agree with you. I won’t pretend to understand our cultural obsession with the penises of elected government officials; it’s a little weird, and a little unhealthy, and a little stupid.
That’s not the problem, though.
The woman into which Governor Spitzer inserted his member is, or rather was, a very high-priced call girl, which is the euphemism we use for prostitutes who make more than a certain amount of money. The term “prostitute” carries to our sexually repressed, Puritanical ears certain…unsavory connotations, but fortunately, as with all things American, a sufficient application of money is often effective at removing the stain. Hence, a person who charges $100 for sex is a prostitute, whereas a person who charges $4,500 an hour for sex, as Ms. Dupre is alleged to have done, is a “call girl.”
Now, I don’t know about you, Gentle Reader, but when I hear of folks making $4,500 an hour for having sex, all I can think is that I’m in the wrong goddamn business. And hey, if Ms. Dupre can make that kind of money without even getting out of bed, more power to her, says I. I frankly have no interest in the adventures of a politician’s penis, nor in the amount of money those adventures cost. Some people spend their mad money on skiing, some folks buy $1,200 titanium golf clubs…hell, if I were to trade money for recreation, and those were my choices, you could bet I wouldn’t be buying the golf clubs. Stupid goddamn sport anyway…but I digress.
Now, it appears that Mr. Spitzer may have spent official State of New York funds on doing the horizontal mambo with Ms. Dupre, and engaged in some complicated financial handwaving to conceal that. Which is a problem; in fact, I believe there are even words for that sort of behavior. “Fraud,” for one. And “corruption,” that’s a good word. “Embezzlement,” too.
That’s still not the problem, though.
As news of this whole penis-related affair broke, the predicable wailing in the media began. How can this happen?” some people asked. (Well, it’s really quite simple. You take some money, you give it to a person-I’m told it’s customary to leave it on the dresser–and in return, that person engages in sexual intercourse with you.) “Who would think that a powerful political figure would do such a thing?” other people–presumably, people who are not students of history–asked.
Magazines ran articles about how Men Are Like That, and Our Biology Makes Men Cheat And Women Fidelitous…because there’s nothing we like more than pop junk science that affirms cultural norms. Religious leaders wailed about The Death of Public Morality (from the smell of the corpse, I think it’s probably been dead for about as long as we’ve walked upright on three legs…but again, I digress).
Some folks wondered Why A Powerful And Successful Man Would Need a Prostitute, which betrays a profound lack of insight into the nature of power. A man in Mr. Spitzer’s position doesn’t pay for sex because he can’t get his dick wet any other way; he pays for sex because his money is an extension of his power. By exchanging money for sex, the way he wants it, on his terms, when he wants it, with the implied understanding that the person to whom he is giving this money is going to go away when it’s over, he is exerting power over the world around him; he can call up sex, and dictate its terms, at any time he pleases.
Now, far be it from me to cast any negative words on the notion of mixing power and sex; far from it. I’m a big fan of the idea of sex as an expression of power, and indeed spent about two hours last night expressing sexual power with dayo, a process that involved two vibrators, sixteen feet of rubber tubing, and a great deal of screaming. (Okay, so I lied about the rubber tubing, and once again, I digress.)
I personally don’t project power by means of money, largely because…err, I haven’t got enough money to make a very compelling statement. “Drop your pants and I’ll give you a dollar” doesn’t really do it, you know? Also, though, because I really dont like that particular expression of power; the business of sex tends to commodify the folks involved, and my partners are not interchangeable. I’m not keen on the implicit “go away without a fuss after we’re done” part of the equation.
That’s not the problem either.
The problem is basic. In the transcripts that came out on the news after the state of Mr. Spitzer’s penis was uncovered, it was claimed that he had a fondness for asking those people with whom he exchanged sex for money to do unusual things, or even “dangerous” things. Now, I have no idea what that means, and the folks who do know aren’t telling. I’ve probably got a wildly miscalibrated scale for evaluating unusual and dangerous things in bed; when I think “unusual and dangerous,” things like fire, knives, and trying to tell one of my sweeties how to live her life spring to mind. For other folk, maybe it’s more a question of letting her be on top without a condom, I dunno.
But anyway, that’s getting close to the problem. Forget issues of projecting power through money; forget issues of the thrill of getting some on the sly. If it’s “unusual and dangerous” our boy Eliot wanted, one might reasonably surmise he wasn’t getting it at home.
Which probably means he wasn’t asking for it at home. In fact, it would surprise me not one whit to learn that if his wife ever discovered the whatever-it-is that Mr. Spitzer is into, she’d be startled, shocked, stunned, surprised, and other words beginning with the letter “s”. My hunch? Eliot’s been kinked for quite some time, and his wife of twenty years now (anyone want to take any bets on the two of them hitting twenty-one?) doesn’t know a goddamn thing about him.
So when faced with an urge for the unusual and dangerous, he hired a stand-in.
It’s hard to know where to start with this. Actually, no, I take that back. It’s easy to know where to start with this. Let’s start with how goddamn fucking ridiculous it is to spend two decades, or more than one-quarter of one’s normal life expectancy, with a person that you don’t even talk to about yourself. Seriously. What do these two talk about, the weather? Jesus fucking Christ on a pogo stick, this isn’t rocket science. You want to get down and get jiggy with the trapeze and the Day-Glow Silly String, say so! Partnerships are built on communication and trust, you know?
I have conversations–my God, do I have conversations–with folks all over the place about this. I get emails from my Web site, I see folks posting in net forums and on mailing lists: “I know communication is important, but…”
There’s no “but.” The correct way to punctuate the phrase “I know communication is important” is with a period at the end. That’s it. No fucking “but.” The “but” that inevidably follows always ends up boiling down to “but it feels awkward to expose myself to my partner and I’m scared of feeling awkward” or “but what if my partner says no” or “but what if rabid shapeshifting werewolf-aliens from the planet Zolog-9 come and carry us away for unspeakable experiments aboard the mothership” or some other real-seeming but ultimately kind of silly thing that’s a damn stupid reason to undermine and corrode the very foundation of a romantic relationship.
There’s also the little niggling subtext: “Of course I wouldn’t want to tell my partner about it, becausewhat if she thinks poorly of me? But it’s cool to tell a prostit–err, call girl, ’cause, y’know, it doesn’t matter what they think.” And that’s a little creepy, but kinda beside the point.
Now, there’s a universal rule of life that I always tell folks: You can’t reasonably expect to get what you want if you don’t ask for what you want. Clearly, I’m wrong; you can’t reasonably expect to get what you want if you don’t ask for what you want or you don’t have a pile of money you can use to buy what you want from someone whose opinion on the subject doesn’t matter to you, more like. But that’s beside the point, too. The truth is, that’s the real issue at work here. Mr. Spitzer went elsewhere–with the taxpayers’ money, Eliot, you naughty boy–quite likely because he couldn’t find the guts to ask for what he wanted from the one person who had pledged her love and commitment to him.
And that’s pretty damn stupid, if you ask me. Which, I realize, nobody has, but still.
At least we can trust American pop culture to get it right. In all the media circus surrounding this whole sad tale of a powerful political figure’s penis, only VH-1’s coverage has got it right:
Update
It is now four o’clock in the morning. The carpet guy, who has an Australian accent and swears like the devil with a hot poker in his foot, just left. He ripped up all the carpet, vacuumed up the rather astonishing quantity of water beneath it, and departed. The place is well and truly trashed, though surprisingly the only things that were destroyed (other than the carpet) were a 25-pound box of kitty litter and a twelve-pack of toilet paper. I have gone from a plethora of toilet paper to a paucity of toilet paper in a snap of the fingers.
Twenty-five pounds of kitty litter is more kitty litter than you think. Especially when it’s burst out of a soggy cardboard box onto the kitchen floor, where it’s then absorbed approximately sixteen metric tons (or two-thirds of a metric fuckton) of water.
I passed “utterly exhausted” about two hours ago and I am now in the Land of Delirium beyond, where pixies cavort in unsavory ways with the shade of Henry Kissinger.
The cat is no longer amused.
So I just got home from Tallahassee
It’s one o’clock in the morning. I spent the weekend in Tallahassee visiting Shelly, and arrived home to find…
…the burner in my gas-powered water heater running full blast, the water heater emergency venting like crazy, and my entire apartment flooded ankle-deep in hot water.
Fuck. Fuck. Fuck. Goddamn shit fuck goddamn fucking fuck.
The cat thinks this is all terribly amusing.