Tuesday, July 15, 2008
Sunday, June 08, 2008
Little Brother
I just finished reading Little Brother
by Cory Doctorow while on a plane to Seattle for a Windows Secrets meetup.
There are a few audiences one might rate this book against. Probably the only fair one is the one Cory wrote for, young adult readers who need an introduction to electronic civil rights (and civil rights in general, for that matter.) For that audience, I think he has succeeded admirably. I will make my copy available to my kids, and see if any of them have an opinion.
To be sure, the book tries to indoctrinate readers to the cyber libertarian way of thinking. Since I happen to agree with that doctrine, I have no problem with that. (And yes, I gave up fighting the use of "cyber". I lose.)
Another audience I might rate this book against is the one I put myself in. Middle-aged infosec people. Perhaps with a little amateur writer thrown in. I still recommend the book, but now I have to start breaking out caveats and picking nits.
Spoilers ahoy.
First off, how's the tech? This is a sliding graph. Compared to the vast majority of the books in the world, Cory's technical accuracy is quite high. There are extreme ends of this scale. For example, Dan Brown (The Da Vinci Code author) writes with basically zero tech accuracy. Amazingly good, page-turning drama. Horrible tech. So Dan's down at the great writing, lousy tech corner.
If I may give my ego a backhanded stroke for a moment, I place myself up at the opposite corner. In the Stealing the Network series, I went way out of my way to make my tech 100% accurate. I also acknowledge that my writing probably sucks, so I like to think of myself as the anti-Dan Brown. Mercifully, my books are shelved in the Computer section of book stores.
Cory's writing in Little Brother is good and his tech is very good. (For a not-specifically tech, non-hacking book). So he's in the upper-right quadrant of the graph.
But of course I'm compelled to point out specific problems. Cory sacrifices some accuracy for plot in a few key places. And appropriately so, I think. The plot flows better this way. Biggest example is the RFID rewriting. The majority of the tags are not rewritable. Cory has kids running around doing non-contact rewrites of FastTrak and other cheap RFID tags. Doesn't work in real life. Nor, I believe, in the near future.
Speaking of time, I can't recall spotting anything in the book that would indicate a specific year. I'm sure that's intentional. I've had my books described as being 10 minutes into the future. I think Cory's at 60 minutes. It reads like now plus 5 to 10 years.
Cory's writing also snags in a few places. (Keep in mind, just because I can spot someone else doing it doesn't mean I can avoid doing it myself.) One of his purposes is to instruct. He doesn't assume the reader knows what an RFID tag is in the first place. This is where there's a big difference between random YA reader and someone like me who has been doing security for years.
For me, he's way over-explaining, and the story grids to a halt. It's mostly first-person, and so are the explanations. But the first person goes from being aimed at someone in the story to being aimed at the reader. It's as if the main character turns to look straight out of the page at you. For someone who knows these things, it's like saying "money can be used for goods and services." So this lessened the enjoyment of the story aspect for me somewhat. But again, probably a tradeoff he made.
I also am already caught up on all the technical and political aspects the book covers, so I didn't learn anything new there. But then I read Boing Boing, was around when the EFF was founded, have been going to various hacking conferences for over a decade, and know half of the people Cory used for source material.
In my case, that leaves the story. On to the parts I did like. I find the overall plot, sadly, believable. It's almost entirely set in San Francisco and the Bay Area, where I live. So he gets local color points. He came up with a number of characters I care about. He made me angry about what was happening in the story. After the first couple of chapters, I had to spend all my spare time reading it.
Let me see if I can help you categorize yourself as a person who would agree with the politics of this book, and would be ok sharing with a YA reader. Do you get mad every time Thomas Hawk links to a story about a photographer getting hassled by the police or a security guard? Do you want to call up and scream at a school board or principal when Fark links to a story about some kid getting expelled for a t-shirt or haircut? Do you have nothing but contempt for the TSA every time you find yourself removing your shoes at the airport?
If the answer is yes, then you will probably "enjoy" the plot and be right on board with the political implication. Be prepared to spend the first half of the book angry.
You know what else I liked? Cory didn't shy away from the other points of view in the discussion. He goes ahaead and points out how his main character is just like a terrorist. He gets screwed over by his parents for most of the book. Some of his own friends give up on him. Some of his trusted circle betray him. He doubts constantly. He suffers for it. It's not like Cory's position still isn't clear, but I appreciate him exposing all the costs.
The big moral of the story is that intrusive government sucks. But the smaller moral is that you have to stand up for your own rights, and it's going to hurt.
Little Brother download page
Little Brother posts on Boing Boing
Cory's review of one of my books (seems only fair)
by Cory Doctorow while on a plane to Seattle for a Windows Secrets meetup.There are a few audiences one might rate this book against. Probably the only fair one is the one Cory wrote for, young adult readers who need an introduction to electronic civil rights (and civil rights in general, for that matter.) For that audience, I think he has succeeded admirably. I will make my copy available to my kids, and see if any of them have an opinion.
To be sure, the book tries to indoctrinate readers to the cyber libertarian way of thinking. Since I happen to agree with that doctrine, I have no problem with that. (And yes, I gave up fighting the use of "cyber". I lose.)
Another audience I might rate this book against is the one I put myself in. Middle-aged infosec people. Perhaps with a little amateur writer thrown in. I still recommend the book, but now I have to start breaking out caveats and picking nits.
Spoilers ahoy.
First off, how's the tech? This is a sliding graph. Compared to the vast majority of the books in the world, Cory's technical accuracy is quite high. There are extreme ends of this scale. For example, Dan Brown (The Da Vinci Code author) writes with basically zero tech accuracy. Amazingly good, page-turning drama. Horrible tech. So Dan's down at the great writing, lousy tech corner.
If I may give my ego a backhanded stroke for a moment, I place myself up at the opposite corner. In the Stealing the Network
series, I went way out of my way to make my tech 100% accurate. I also acknowledge that my writing probably sucks, so I like to think of myself as the anti-Dan Brown. Mercifully, my books are shelved in the Computer section of book stores.Cory's writing in Little Brother is good and his tech is very good. (For a not-specifically tech, non-hacking book). So he's in the upper-right quadrant of the graph.
But of course I'm compelled to point out specific problems. Cory sacrifices some accuracy for plot in a few key places. And appropriately so, I think. The plot flows better this way. Biggest example is the RFID rewriting. The majority of the tags are not rewritable. Cory has kids running around doing non-contact rewrites of FastTrak and other cheap RFID tags. Doesn't work in real life. Nor, I believe, in the near future.
Speaking of time, I can't recall spotting anything in the book that would indicate a specific year. I'm sure that's intentional. I've had my books described as being 10 minutes into the future. I think Cory's at 60 minutes. It reads like now plus 5 to 10 years.
Cory's writing also snags in a few places. (Keep in mind, just because I can spot someone else doing it doesn't mean I can avoid doing it myself.) One of his purposes is to instruct. He doesn't assume the reader knows what an RFID tag is in the first place. This is where there's a big difference between random YA reader and someone like me who has been doing security for years.
For me, he's way over-explaining, and the story grids to a halt. It's mostly first-person, and so are the explanations. But the first person goes from being aimed at someone in the story to being aimed at the reader. It's as if the main character turns to look straight out of the page at you. For someone who knows these things, it's like saying "money can be used for goods and services." So this lessened the enjoyment of the story aspect for me somewhat. But again, probably a tradeoff he made.
I also am already caught up on all the technical and political aspects the book covers, so I didn't learn anything new there. But then I read Boing Boing, was around when the EFF was founded, have been going to various hacking conferences for over a decade, and know half of the people Cory used for source material.
In my case, that leaves the story. On to the parts I did like. I find the overall plot, sadly, believable. It's almost entirely set in San Francisco and the Bay Area, where I live. So he gets local color points. He came up with a number of characters I care about. He made me angry about what was happening in the story. After the first couple of chapters, I had to spend all my spare time reading it.
Let me see if I can help you categorize yourself as a person who would agree with the politics of this book, and would be ok sharing with a YA reader. Do you get mad every time Thomas Hawk links to a story about a photographer getting hassled by the police or a security guard? Do you want to call up and scream at a school board or principal when Fark links to a story about some kid getting expelled for a t-shirt or haircut? Do you have nothing but contempt for the TSA every time you find yourself removing your shoes at the airport?
If the answer is yes, then you will probably "enjoy" the plot and be right on board with the political implication. Be prepared to spend the first half of the book angry.
You know what else I liked? Cory didn't shy away from the other points of view in the discussion. He goes ahaead and points out how his main character is just like a terrorist. He gets screwed over by his parents for most of the book. Some of his own friends give up on him. Some of his trusted circle betray him. He doubts constantly. He suffers for it. It's not like Cory's position still isn't clear, but I appreciate him exposing all the costs.
The big moral of the story is that intrusive government sucks. But the smaller moral is that you have to stand up for your own rights, and it's going to hurt.
Little Brother download page
Little Brother posts on Boing Boing
Cory's review of one of my books (seems only fair)
Saturday, May 31, 2008
Friday, May 30, 2008
Is Microsoft dropping Apple 0-day?
Just saw this link show up in my RSS reader:
Microsoft Security Advisory (953818) Blended Threat from Combined Attack Using Apple’s Safari on the Windows Platform
From the advisory:
And
Is this being exploited in the wild or something? Otherwise I kinda would have expected Microsoft to keep quiet until it was patched by Apple.
I guess Apple pushing Safari on Windows iTunes/Quicktime users isn't looking so hot about now?
Update:
Aha, pointer from Slashdot and The Register. The carpet bombing seems to be the genesis, but that's not the whole story, since he doesn't talk about executing code.
Update2:
There it is, it was found by Aviv Raff.
Microsoft Security Advisory (953818) Blended Threat from Combined Attack Using Apple’s Safari on the Windows Platform
From the advisory:
FAQ
What causes this threat?
A combination of the default download location in Safari and how the Windows desktop handles executables creates a blended threat in which files may be downloaded to a user’s machine without prompting, allowing them to be executed. Safari is available as a stand-alone install or through the Apple Software Update application.
And
WorkaroundsSo... that sounds a lot like if I were to download a desktop.ini file or something like that, I'd get my Windows all 0wned. As in, if I cared to, I probably wouldn't have to work too hard to figure out how to exploit this from Microsoft's description and workaround.Microsoft has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified in the following section.
• Change the download location of content in Safari to a location other than ‘Desktop’
Launch Safari. Under the Edit menu select Preferences.
At the option where it states Save Downloaded Files to:, select a different location on the local drive.
Is this being exploited in the wild or something? Otherwise I kinda would have expected Microsoft to keep quiet until it was patched by Apple.
I guess Apple pushing Safari on Windows iTunes/Quicktime users isn't looking so hot about now?
Update:
Aha, pointer from Slashdot and The Register. The carpet bombing seems to be the genesis, but that's not the whole story, since he doesn't talk about executing code.
Update2:
There it is, it was found by Aviv Raff.
Saturday, May 03, 2008
Tweaking content (administrivia)
I have a tendency to write full essays, and only when I'm aroused enough to spend the time, and then only when I can afford the time at that moment. I've also avoided more personal and trivial stuff, because the blog is part of the Security Blogger's Network and because most of you read this because of security-related things.
Well, those are problems that have an easy technical solution. I've created a security-only feed. If you only want the security-related stuff (things I tag "security"), then change your subscription to this feed.
If you want all the other crap I decide to come up with, continue to use the full feed.
I titled the blog "ryanlrussell", I planned to have it be an egofest from the beginning, I just got sidetracked. So what have I been holding back on? Attempts at short fiction, things about my kids, other technology stuff, more things I want to keep a pointer to, and so on. You know that thing that thing that bloggers do that people complain about where they just point to some article and have a short comment without a lot of insight and value add? I'm going to do more of that.
There will be a tsunami of content. Relatively speaking. Prepare for boarding.
I'm going to go tweak old posts, which I'm sure will cause old articles to hit your readers again. Apologies in advance. Should be mostly a one-time thing.
Well, those are problems that have an easy technical solution. I've created a security-only feed. If you only want the security-related stuff (things I tag "security"), then change your subscription to this feed.
If you want all the other crap I decide to come up with, continue to use the full feed.
I titled the blog "ryanlrussell", I planned to have it be an egofest from the beginning, I just got sidetracked. So what have I been holding back on? Attempts at short fiction, things about my kids, other technology stuff, more things I want to keep a pointer to, and so on. You know that thing that thing that bloggers do that people complain about where they just point to some article and have a short comment without a lot of insight and value add? I'm going to do more of that.
There will be a tsunami of content. Relatively speaking. Prepare for boarding.
I'm going to go tweak old posts, which I'm sure will cause old articles to hit your readers again. Apologies in advance. Should be mostly a one-time thing.
Full RSS Feed