Slashdot Mirror

Hmmmmm... I don't remember saying anywhere that there was no research in industry. But there is a difference between research, and industrial product development. CS programmes are (or should be) good preparation for research. Engineering programmes are (or should be) good preparation for product development (that being the essential purpose of engineering). That doesn't mean that CS grads shouldn't be employed in industry at all, just that the assumption that they are generally prepared for product development work isn't a good one. I'm sorry if I gave you a different impression with my earlier comments.

Of course, there is also a necessity for R&D work, which may well include both scientists and engineers. But this is, again, not the same as product development.

It's not screwed up. You only hear about or notice the bad software. Most industrial software is very high quality.

Perhaps. But I think it's worth noting that all of the examples you've given are embedded software, which I'll readily admit has much higher quality standards than you're likely to find in many other application domains. It's also the software most likely to be written by people trained as engineers (electrical or computer), rather than CS grads - in other words, people who's training focuses much more on product development and delivery. Which only emphasizes my original point.

Bad software being considered ubiquitous is a recent phenomenon that arrived with desktop computing.

Really? Then why are there references to a "software crisis" dating back to the 60's? Consider, for example, these quotes from the 1968 NATO Software Engineering Conference:

Kolence: The basic problem is that certain classes of systems are placing demands on us which are beyond our capabili- ties and our theories and methods of design and production at this time. There are many areas where there is no such thing as a crisis -- sort routines, payroll applications, for example. It is large systems that are encountering great difficulties. We should not expect the production of such systems to be easy.

David and Fraser: Particularly alarming is the seemingly unavoidable fallibility of large software, since a malfunction in an advanced hardware-software system can be a matter of life and death.

Dijkstra: The dissemination of knowledge is of obvious value -- the massive dissemination of error-loaded software is frightening.

Graham: Today we tend to go on for years, with tremendous investments to find that the system, which was not well understood to start with, does not work as anticipated. We build systems like the Wright brothers built airplanes -- build the whole thing, push it off the cliff, let it crash, and start over again.

I can see why governments would like the idea of more accurate GPS; vechicle navigation.

Knowing a location to plus-or-minus-10-meters might be fine for a guided missile, but for navigation it's pretty lousy; it couldn't tell which side of the road you were on, let alone whether you were in the right lane. With centimeter-level accuracy, though, you could practically make a car drive itself.

Michael

What is it about Tokyo and 610,000 anyway? http://catless.ncl.ac.uk/Risks/21.81.html#subj1

As someone else pointed out Not On Slashdot, something like this has been reported before. 4 years before, in fact. Note that the number & price of the shares in each report are 610,000 shares at 1 yen each.

Now, what do you think that chances of this happening twice are? Yeah, that's what I thought.

Surely decaffeination is a potential cause of cancer?

If you don't want the caffeine, why not drink water?

Derbyshire Constabulary has operated ANPR systems in some of its road policing unit vehicles since 1999 and will act as the Lead Authority on the framework. Whilst the contract sees Derbyshire working with Lincolnshire, the framework may also be utilised by a number of other East Midlands police forces.

As part of the five year framework agreement, 'vehicles of interest' will be detected and stopped, using the new system to cross reference the data against a variety of databases including the Police National Computer (PNC), Local Force Intelligence Systems and other related databases, for example at the DVLA.

If you enjoy reading about other people's software screwups, checkout Risks Digest, which contains decades worth of this sort of stuff.

If you enjoy reading about other people's software screwups, checkout Risks Digest, which contains decades worth of this sort of stuff.

If you enjoy reading about other people's software screwups, checkout Risks Digest, which contains decades worth of this sort of stuff.

> ...it all seems to come back the the Social Security Number. Financial
> companies have other controls in place...to ensure identification.

Many of which are very poor controls; so poor as to be nonexistent in many organizations.

> But in order to be of any use, a bad guy would really need someone's SSN.

Yes, AND no.

> Absent of that, other information would be useless. Right?

Wrong. http://catless.ncl.ac.uk/Risks/18.04.html#subj11.1
http://catless.ncl.ac.uk/Risks/16.30.html#subj4.1
http://catless.ncl.ac.uk/Risks/14.88.html#subj3.1
http://catless.ncl.ac.uk/Risks/23.84.html#subj5
http://catless.ncl.ac.uk/Risks/10.24.html#subj5.1

> That's what I would like to ask Slashdot folks. What could be realistically
> done with customer information without a SSN?

Well, you've set up an arbitrary experiment there. It's a school experiment, a teaching tool. Good for learning, but not reflective of real-world constraints.

The question implies some constraints. Restated as a classroom question, it reads:

-----

John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Without using a social security number, perform the following tasks: A-Withdraw $N from John Doe's checking account. Etc.

----

The real world equivalent problem is:
John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Perform the following tasks: A-Acquire additional personal information about John Doe, including his SSN B-Using this data, including the SSN, withdraw $N from John Doe's checking account. Etc.

----

The school question is a useful learning tool, work exploring; but if the student can't normally perform the tasks without an SSN, you can't feel confident or safe. The real world problem just adds one more task at the beginning; "Get SSN," which is often trivial when you have the other data.

Some examples of trivial SSN exposure, the black market in personal data, and some just interesting:

http://catless.ncl.ac.uk/Risks/6.80.html#subj1.1
http://catless.ncl.ac.uk/Risks/21.82.html#subj8.1
http://catless.ncl.ac.uk/Risks/22.94.html#subj14
http://catless.ncl.ac.uk/Risks/23.11.html#subj5.1
http://catless.ncl.ac.uk/Risks/19.19.html#subj1.1
http://catless.ncl.ac.uk/Risks/7.66.html#subj3.1
http://catless.ncl.ac.uk/Risks/21.07.html#subj6.1

> Account numbers, address, maybe a phone or payment amount. Is that really
> dangerous to the customer if only those get compromised?

"Is it really dangerous to your business network if -only- your firewall fails."

No; but how can you assume that you -know- when other security measures are compromised? Sometimes all it takes is a quick trip to the victim's mailbox.

http://catless.ncl.ac.uk/Risks/23.86.html#subj3.1
http://catless.ncl.ac.uk/Risks/20.80.html#subj6.1

> ...it all seems to come back the the Social Security Number. Financial
> companies have other controls in place...to ensure identification.

Many of which are very poor controls; so poor as to be nonexistent in many organizations.

> But in order to be of any use, a bad guy would really need someone's SSN.

Yes, AND no.

> Absent of that, other information would be useless. Right?

Wrong. http://catless.ncl.ac.uk/Risks/18.04.html#subj11.1
http://catless.ncl.ac.uk/Risks/16.30.html#subj4.1
http://catless.ncl.ac.uk/Risks/14.88.html#subj3.1
http://catless.ncl.ac.uk/Risks/23.84.html#subj5
http://catless.ncl.ac.uk/Risks/10.24.html#subj5.1

> That's what I would like to ask Slashdot folks. What could be realistically
> done with customer information without a SSN?

Well, you've set up an arbitrary experiment there. It's a school experiment, a teaching tool. Good for learning, but not reflective of real-world constraints.

The question implies some constraints. Restated as a classroom question, it reads:

-----

John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Without using a social security number, perform the following tasks: A-Withdraw $N from John Doe's checking account. Etc.

----

The real world equivalent problem is:
John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Perform the following tasks: A-Acquire additional personal information about John Doe, including his SSN B-Using this data, including the SSN, withdraw $N from John Doe's checking account. Etc.

----

The school question is a useful learning tool, work exploring; but if the student can't normally perform the tasks without an SSN, you can't feel confident or safe. The real world problem just adds one more task at the beginning; "Get SSN," which is often trivial when you have the other data.

Some examples of trivial SSN exposure, the black market in personal data, and some just interesting:

http://catless.ncl.ac.uk/Risks/6.80.html#subj1.1
http://catless.ncl.ac.uk/Risks/21.82.html#subj8.1
http://catless.ncl.ac.uk/Risks/22.94.html#subj14
http://catless.ncl.ac.uk/Risks/23.11.html#subj5.1
http://catless.ncl.ac.uk/Risks/19.19.html#subj1.1
http://catless.ncl.ac.uk/Risks/7.66.html#subj3.1
http://catless.ncl.ac.uk/Risks/21.07.html#subj6.1

> Account numbers, address, maybe a phone or payment amount. Is that really
> dangerous to the customer if only those get compromised?

"Is it really dangerous to your business network if -only- your firewall fails."

No; but how can you assume that you -know- when other security measures are compromised? Sometimes all it takes is a quick trip to the victim's mailbox.

http://catless.ncl.ac.uk/Risks/23.86.html#subj3.1
http://catless.ncl.ac.uk/Risks/20.80.html#subj6.1

> ...it all seems to come back the the Social Security Number. Financial
> companies have other controls in place...to ensure identification.

Many of which are very poor controls; so poor as to be nonexistent in many organizations.

> But in order to be of any use, a bad guy would really need someone's SSN.

Yes, AND no.

> Absent of that, other information would be useless. Right?

Wrong. http://catless.ncl.ac.uk/Risks/18.04.html#subj11.1
http://catless.ncl.ac.uk/Risks/16.30.html#subj4.1
http://catless.ncl.ac.uk/Risks/14.88.html#subj3.1
http://catless.ncl.ac.uk/Risks/23.84.html#subj5
http://catless.ncl.ac.uk/Risks/10.24.html#subj5.1

> That's what I would like to ask Slashdot folks. What could be realistically
> done with customer information without a SSN?

Well, you've set up an arbitrary experiment there. It's a school experiment, a teaching tool. Good for learning, but not reflective of real-world constraints.

The question implies some constraints. Restated as a classroom question, it reads:

-----

John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Without using a social security number, perform the following tasks: A-Withdraw $N from John Doe's checking account. Etc.

----

The real world equivalent problem is:
John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Perform the following tasks: A-Acquire additional personal information about John Doe, including his SSN B-Using this data, including the SSN, withdraw $N from John Doe's checking account. Etc.

----

The school question is a useful learning tool, work exploring; but if the student can't normally perform the tasks without an SSN, you can't feel confident or safe. The real world problem just adds one more task at the beginning; "Get SSN," which is often trivial when you have the other data.

Some examples of trivial SSN exposure, the black market in personal data, and some just interesting:

http://catless.ncl.ac.uk/Risks/6.80.html#subj1.1
http://catless.ncl.ac.uk/Risks/21.82.html#subj8.1
http://catless.ncl.ac.uk/Risks/22.94.html#subj14
http://catless.ncl.ac.uk/Risks/23.11.html#subj5.1
http://catless.ncl.ac.uk/Risks/19.19.html#subj1.1
http://catless.ncl.ac.uk/Risks/7.66.html#subj3.1
http://catless.ncl.ac.uk/Risks/21.07.html#subj6.1

> Account numbers, address, maybe a phone or payment amount. Is that really
> dangerous to the customer if only those get compromised?

"Is it really dangerous to your business network if -only- your firewall fails."

No; but how can you assume that you -know- when other security measures are compromised? Sometimes all it takes is a quick trip to the victim's mailbox.

http://catless.ncl.ac.uk/Risks/23.86.html#subj3.1
http://catless.ncl.ac.uk/Risks/20.80.html#subj6.1

> ...it all seems to come back the the Social Security Number. Financial
> companies have other controls in place...to ensure identification.

Many of which are very poor controls; so poor as to be nonexistent in many organizations.

> But in order to be of any use, a bad guy would really need someone's SSN.

Yes, AND no.

> Absent of that, other information would be useless. Right?

Wrong. http://catless.ncl.ac.uk/Risks/18.04.html#subj11.1
http://catless.ncl.ac.uk/Risks/16.30.html#subj4.1
http://catless.ncl.ac.uk/Risks/14.88.html#subj3.1
http://catless.ncl.ac.uk/Risks/23.84.html#subj5
http://catless.ncl.ac.uk/Risks/10.24.html#subj5.1

> That's what I would like to ask Slashdot folks. What could be realistically
> done with customer information without a SSN?

Well, you've set up an arbitrary experiment there. It's a school experiment, a teaching tool. Good for learning, but not reflective of real-world constraints.

The question implies some constraints. Restated as a classroom question, it reads:

-----

John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Without using a social security number, perform the following tasks: A-Withdraw $N from John Doe's checking account. Etc.

----

The real world equivalent problem is:
John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Perform the following tasks: A-Acquire additional personal information about John Doe, including his SSN B-Using this data, including the SSN, withdraw $N from John Doe's checking account. Etc.

----

The school question is a useful learning tool, work exploring; but if the student can't normally perform the tasks without an SSN, you can't feel confident or safe. The real world problem just adds one more task at the beginning; "Get SSN," which is often trivial when you have the other data.

Some examples of trivial SSN exposure, the black market in personal data, and some just interesting:

http://catless.ncl.ac.uk/Risks/6.80.html#subj1.1
http://catless.ncl.ac.uk/Risks/21.82.html#subj8.1
http://catless.ncl.ac.uk/Risks/22.94.html#subj14
http://catless.ncl.ac.uk/Risks/23.11.html#subj5.1
http://catless.ncl.ac.uk/Risks/19.19.html#subj1.1
http://catless.ncl.ac.uk/Risks/7.66.html#subj3.1
http://catless.ncl.ac.uk/Risks/21.07.html#subj6.1

> Account numbers, address, maybe a phone or payment amount. Is that really
> dangerous to the customer if only those get compromised?

"Is it really dangerous to your business network if -only- your firewall fails."

No; but how can you assume that you -know- when other security measures are compromised? Sometimes all it takes is a quick trip to the victim's mailbox.

http://catless.ncl.ac.uk/Risks/23.86.html#subj3.1
http://catless.ncl.ac.uk/Risks/20.80.html#subj6.1

> ...it all seems to come back the the Social Security Number. Financial
> companies have other controls in place...to ensure identification.

Many of which are very poor controls; so poor as to be nonexistent in many organizations.

> But in order to be of any use, a bad guy would really need someone's SSN.

Yes, AND no.

> Absent of that, other information would be useless. Right?

Wrong. http://catless.ncl.ac.uk/Risks/18.04.html#subj11.1
http://catless.ncl.ac.uk/Risks/16.30.html#subj4.1
http://catless.ncl.ac.uk/Risks/14.88.html#subj3.1
http://catless.ncl.ac.uk/Risks/23.84.html#subj5
http://catless.ncl.ac.uk/Risks/10.24.html#subj5.1

> That's what I would like to ask Slashdot folks. What could be realistically
> done with customer information without a SSN?

Well, you've set up an arbitrary experiment there. It's a school experiment, a teaching tool. Good for learning, but not reflective of real-world constraints.

The question implies some constraints. Restated as a classroom question, it reads:

-----

John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Without using a social security number, perform the following tasks: A-Withdraw $N from John Doe's checking account. Etc.

----

The real world equivalent problem is:
John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Perform the following tasks: A-Acquire additional personal information about John Doe, including his SSN B-Using this data, including the SSN, withdraw $N from John Doe's checking account. Etc.

----

The school question is a useful learning tool, work exploring; but if the student can't normally perform the tasks without an SSN, you can't feel confident or safe. The real world problem just adds one more task at the beginning; "Get SSN," which is often trivial when you have the other data.

Some examples of trivial SSN exposure, the black market in personal data, and some just interesting:

http://catless.ncl.ac.uk/Risks/6.80.html#subj1.1
http://catless.ncl.ac.uk/Risks/21.82.html#subj8.1
http://catless.ncl.ac.uk/Risks/22.94.html#subj14
http://catless.ncl.ac.uk/Risks/23.11.html#subj5.1
http://catless.ncl.ac.uk/Risks/19.19.html#subj1.1
http://catless.ncl.ac.uk/Risks/7.66.html#subj3.1
http://catless.ncl.ac.uk/Risks/21.07.html#subj6.1

> Account numbers, address, maybe a phone or payment amount. Is that really
> dangerous to the customer if only those get compromised?

"Is it really dangerous to your business network if -only- your firewall fails."

No; but how can you assume that you -know- when other security measures are compromised? Sometimes all it takes is a quick trip to the victim's mailbox.

http://catless.ncl.ac.uk/Risks/23.86.html#subj3.1
http://catless.ncl.ac.uk/Risks/20.80.html#subj6.1

> ...it all seems to come back the the Social Security Number. Financial
> companies have other controls in place...to ensure identification.

Many of which are very poor controls; so poor as to be nonexistent in many organizations.

> But in order to be of any use, a bad guy would really need someone's SSN.

Yes, AND no.

> Absent of that, other information would be useless. Right?

Wrong. http://catless.ncl.ac.uk/Risks/18.04.html#subj11.1
http://catless.ncl.ac.uk/Risks/16.30.html#subj4.1
http://catless.ncl.ac.uk/Risks/14.88.html#subj3.1
http://catless.ncl.ac.uk/Risks/23.84.html#subj5
http://catless.ncl.ac.uk/Risks/10.24.html#subj5.1

> That's what I would like to ask Slashdot folks. What could be realistically
> done with customer information without a SSN?

Well, you've set up an arbitrary experiment there. It's a school experiment, a teaching tool. Good for learning, but not reflective of real-world constraints.

The question implies some constraints. Restated as a classroom question, it reads:

-----

John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Without using a social security number, perform the following tasks: A-Withdraw $N from John Doe's checking account. Etc.

----

The real world equivalent problem is:
John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Perform the following tasks: A-Acquire additional personal information about John Doe, including his SSN B-Using this data, including the SSN, withdraw $N from John Doe's checking account. Etc.

----

The school question is a useful learning tool, work exploring; but if the student can't normally perform the tasks without an SSN, you can't feel confident or safe. The real world problem just adds one more task at the beginning; "Get SSN," which is often trivial when you have the other data.

Some examples of trivial SSN exposure, the black market in personal data, and some just interesting:

http://catless.ncl.ac.uk/Risks/6.80.html#subj1.1
http://catless.ncl.ac.uk/Risks/21.82.html#subj8.1
http://catless.ncl.ac.uk/Risks/22.94.html#subj14
http://catless.ncl.ac.uk/Risks/23.11.html#subj5.1
http://catless.ncl.ac.uk/Risks/19.19.html#subj1.1
http://catless.ncl.ac.uk/Risks/7.66.html#subj3.1
http://catless.ncl.ac.uk/Risks/21.07.html#subj6.1

> Account numbers, address, maybe a phone or payment amount. Is that really
> dangerous to the customer if only those get compromised?

"Is it really dangerous to your business network if -only- your firewall fails."

No; but how can you assume that you -know- when other security measures are compromised? Sometimes all it takes is a quick trip to the victim's mailbox.

http://catless.ncl.ac.uk/Risks/23.86.html#subj3.1
http://catless.ncl.ac.uk/Risks/20.80.html#subj6.1

> ...it all seems to come back the the Social Security Number. Financial
> companies have other controls in place...to ensure identification.

Many of which are very poor controls; so poor as to be nonexistent in many organizations.

> But in order to be of any use, a bad guy would really need someone's SSN.

Yes, AND no.

> Absent of that, other information would be useless. Right?

Wrong. http://catless.ncl.ac.uk/Risks/18.04.html#subj11.1
http://catless.ncl.ac.uk/Risks/16.30.html#subj4.1
http://catless.ncl.ac.uk/Risks/14.88.html#subj3.1
http://catless.ncl.ac.uk/Risks/23.84.html#subj5
http://catless.ncl.ac.uk/Risks/10.24.html#subj5.1

> That's what I would like to ask Slashdot folks. What could be realistically
> done with customer information without a SSN?

Well, you've set up an arbitrary experiment there. It's a school experiment, a teaching tool. Good for learning, but not reflective of real-world constraints.

The question implies some constraints. Restated as a classroom question, it reads:

-----

John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Without using a social security number, perform the following tasks: A-Withdraw $N from John Doe's checking account. Etc.

----

The real world equivalent problem is:
John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Perform the following tasks: A-Acquire additional personal information about John Doe, including his SSN B-Using this data, including the SSN, withdraw $N from John Doe's checking account. Etc.

----

The school question is a useful learning tool, work exploring; but if the student can't normally perform the tasks without an SSN, you can't feel confident or safe. The real world problem just adds one more task at the beginning; "Get SSN," which is often trivial when you have the other data.

Some examples of trivial SSN exposure, the black market in personal data, and some just interesting:

http://catless.ncl.ac.uk/Risks/6.80.html#subj1.1
http://catless.ncl.ac.uk/Risks/21.82.html#subj8.1
http://catless.ncl.ac.uk/Risks/22.94.html#subj14
http://catless.ncl.ac.uk/Risks/23.11.html#subj5.1
http://catless.ncl.ac.uk/Risks/19.19.html#subj1.1
http://catless.ncl.ac.uk/Risks/7.66.html#subj3.1
http://catless.ncl.ac.uk/Risks/21.07.html#subj6.1

> Account numbers, address, maybe a phone or payment amount. Is that really
> dangerous to the customer if only those get compromised?

"Is it really dangerous to your business network if -only- your firewall fails."

No; but how can you assume that you -know- when other security measures are compromised? Sometimes all it takes is a quick trip to the victim's mailbox.

http://catless.ncl.ac.uk/Risks/23.86.html#subj3.1
http://catless.ncl.ac.uk/Risks/20.80.html#subj6.1

> ...it all seems to come back the the Social Security Number. Financial
> companies have other controls in place...to ensure identification.

Many of which are very poor controls; so poor as to be nonexistent in many organizations.

> But in order to be of any use, a bad guy would really need someone's SSN.

Yes, AND no.

> Absent of that, other information would be useless. Right?

Wrong. http://catless.ncl.ac.uk/Risks/18.04.html#subj11.1
http://catless.ncl.ac.uk/Risks/16.30.html#subj4.1
http://catless.ncl.ac.uk/Risks/14.88.html#subj3.1
http://catless.ncl.ac.uk/Risks/23.84.html#subj5
http://catless.ncl.ac.uk/Risks/10.24.html#subj5.1

> That's what I would like to ask Slashdot folks. What could be realistically
> done with customer information without a SSN?

Well, you've set up an arbitrary experiment there. It's a school experiment, a teaching tool. Good for learning, but not reflective of real-world constraints.

The question implies some constraints. Restated as a classroom question, it reads:

-----

John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Without using a social security number, perform the following tasks: A-Withdraw $N from John Doe's checking account. Etc.

----

The real world equivalent problem is:
John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Perform the following tasks: A-Acquire additional personal information about John Doe, including his SSN B-Using this data, including the SSN, withdraw $N from John Doe's checking account. Etc.

----

The school question is a useful learning tool, work exploring; but if the student can't normally perform the tasks without an SSN, you can't feel confident or safe. The real world problem just adds one more task at the beginning; "Get SSN," which is often trivial when you have the other data.

Some examples of trivial SSN exposure, the black market in personal data, and some just interesting:

http://catless.ncl.ac.uk/Risks/6.80.html#subj1.1
http://catless.ncl.ac.uk/Risks/21.82.html#subj8.1
http://catless.ncl.ac.uk/Risks/22.94.html#subj14
http://catless.ncl.ac.uk/Risks/23.11.html#subj5.1
http://catless.ncl.ac.uk/Risks/19.19.html#subj1.1
http://catless.ncl.ac.uk/Risks/7.66.html#subj3.1
http://catless.ncl.ac.uk/Risks/21.07.html#subj6.1

> Account numbers, address, maybe a phone or payment amount. Is that really
> dangerous to the customer if only those get compromised?

"Is it really dangerous to your business network if -only- your firewall fails."

No; but how can you assume that you -know- when other security measures are compromised? Sometimes all it takes is a quick trip to the victim's mailbox.

http://catless.ncl.ac.uk/Risks/23.86.html#subj3.1
http://catless.ncl.ac.uk/Risks/20.80.html#subj6.1

> ...it all seems to come back the the Social Security Number. Financial
> companies have other controls in place...to ensure identification.

Many of which are very poor controls; so poor as to be nonexistent in many organizations.

> But in order to be of any use, a bad guy would really need someone's SSN.

Yes, AND no.

> Absent of that, other information would be useless. Right?

Wrong. http://catless.ncl.ac.uk/Risks/18.04.html#subj11.1
http://catless.ncl.ac.uk/Risks/16.30.html#subj4.1
http://catless.ncl.ac.uk/Risks/14.88.html#subj3.1
http://catless.ncl.ac.uk/Risks/23.84.html#subj5
http://catless.ncl.ac.uk/Risks/10.24.html#subj5.1

> That's what I would like to ask Slashdot folks. What could be realistically
> done with customer information without a SSN?

Well, you've set up an arbitrary experiment there. It's a school experiment, a teaching tool. Good for learning, but not reflective of real-world constraints.

The question implies some constraints. Restated as a classroom question, it reads:

-----

John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Without using a social security number, perform the following tasks: A-Withdraw $N from John Doe's checking account. Etc.

----

The real world equivalent problem is:
John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Perform the following tasks: A-Acquire additional personal information about John Doe, including his SSN B-Using this data, including the SSN, withdraw $N from John Doe's checking account. Etc.

----

The school question is a useful learning tool, work exploring; but if the student can't normally perform the tasks without an SSN, you can't feel confident or safe. The real world problem just adds one more task at the beginning; "Get SSN," which is often trivial when you have the other data.

Some examples of trivial SSN exposure, the black market in personal data, and some just interesting:

http://catless.ncl.ac.uk/Risks/6.80.html#subj1.1
http://catless.ncl.ac.uk/Risks/21.82.html#subj8.1
http://catless.ncl.ac.uk/Risks/22.94.html#subj14
http://catless.ncl.ac.uk/Risks/23.11.html#subj5.1
http://catless.ncl.ac.uk/Risks/19.19.html#subj1.1
http://catless.ncl.ac.uk/Risks/7.66.html#subj3.1
http://catless.ncl.ac.uk/Risks/21.07.html#subj6.1

> Account numbers, address, maybe a phone or payment amount. Is that really
> dangerous to the customer if only those get compromised?

"Is it really dangerous to your business network if -only- your firewall fails."

No; but how can you assume that you -know- when other security measures are compromised? Sometimes all it takes is a quick trip to the victim's mailbox.

http://catless.ncl.ac.uk/Risks/23.86.html#subj3.1
http://catless.ncl.ac.uk/Risks/20.80.html#subj6.1

> ...it all seems to come back the the Social Security Number. Financial
> companies have other controls in place...to ensure identification.

Many of which are very poor controls; so poor as to be nonexistent in many organizations.

> But in order to be of any use, a bad guy would really need someone's SSN.

Yes, AND no.

> Absent of that, other information would be useless. Right?

Wrong. http://catless.ncl.ac.uk/Risks/18.04.html#subj11.1
http://catless.ncl.ac.uk/Risks/16.30.html#subj4.1
http://catless.ncl.ac.uk/Risks/14.88.html#subj3.1
http://catless.ncl.ac.uk/Risks/23.84.html#subj5
http://catless.ncl.ac.uk/Risks/10.24.html#subj5.1

> That's what I would like to ask Slashdot folks. What could be realistically
> done with customer information without a SSN?

Well, you've set up an arbitrary experiment there. It's a school experiment, a teaching tool. Good for learning, but not reflective of real-world constraints.

The question implies some constraints. Restated as a classroom question, it reads:

-----

John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Without using a social security number, perform the following tasks: A-Withdraw $N from John Doe's checking account. Etc.

----

The real world equivalent problem is:
John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Perform the following tasks: A-Acquire additional personal information about John Doe, including his SSN B-Using this data, including the SSN, withdraw $N from John Doe's checking account. Etc.

----

The school question is a useful learning tool, work exploring; but if the student can't normally perform the tasks without an SSN, you can't feel confident or safe. The real world problem just adds one more task at the beginning; "Get SSN," which is often trivial when you have the other data.

Some examples of trivial SSN exposure, the black market in personal data, and some just interesting:

http://catless.ncl.ac.uk/Risks/6.80.html#subj1.1
http://catless.ncl.ac.uk/Risks/21.82.html#subj8.1
http://catless.ncl.ac.uk/Risks/22.94.html#subj14
http://catless.ncl.ac.uk/Risks/23.11.html#subj5.1
http://catless.ncl.ac.uk/Risks/19.19.html#subj1.1
http://catless.ncl.ac.uk/Risks/7.66.html#subj3.1
http://catless.ncl.ac.uk/Risks/21.07.html#subj6.1

> Account numbers, address, maybe a phone or payment amount. Is that really
> dangerous to the customer if only those get compromised?

"Is it really dangerous to your business network if -only- your firewall fails."

No; but how can you assume that you -know- when other security measures are compromised? Sometimes all it takes is a quick trip to the victim's mailbox.

http://catless.ncl.ac.uk/Risks/23.86.html#subj3.1
http://catless.ncl.ac.uk/Risks/20.80.html#subj6.1

> ...it all seems to come back the the Social Security Number. Financial
> companies have other controls in place...to ensure identification.

Many of which are very poor controls; so poor as to be nonexistent in many organizations.

> But in order to be of any use, a bad guy would really need someone's SSN.

Yes, AND no.

> Absent of that, other information would be useless. Right?

Wrong. http://catless.ncl.ac.uk/Risks/18.04.html#subj11.1
http://catless.ncl.ac.uk/Risks/16.30.html#subj4.1
http://catless.ncl.ac.uk/Risks/14.88.html#subj3.1
http://catless.ncl.ac.uk/Risks/23.84.html#subj5
http://catless.ncl.ac.uk/Risks/10.24.html#subj5.1

> That's what I would like to ask Slashdot folks. What could be realistically
> done with customer information without a SSN?

Well, you've set up an arbitrary experiment there. It's a school experiment, a teaching tool. Good for learning, but not reflective of real-world constraints.

The question implies some constraints. Restated as a classroom question, it reads:

-----

John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Without using a social security number, perform the following tasks: A-Withdraw $N from John Doe's checking account. Etc.

----

The real world equivalent problem is:
John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Perform the following tasks: A-Acquire additional personal information about John Doe, including his SSN B-Using this data, including the SSN, withdraw $N from John Doe's checking account. Etc.

----

The school question is a useful learning tool, work exploring; but if the student can't normally perform the tasks without an SSN, you can't feel confident or safe. The real world problem just adds one more task at the beginning; "Get SSN," which is often trivial when you have the other data.

Some examples of trivial SSN exposure, the black market in personal data, and some just interesting:

http://catless.ncl.ac.uk/Risks/6.80.html#subj1.1
http://catless.ncl.ac.uk/Risks/21.82.html#subj8.1
http://catless.ncl.ac.uk/Risks/22.94.html#subj14
http://catless.ncl.ac.uk/Risks/23.11.html#subj5.1
http://catless.ncl.ac.uk/Risks/19.19.html#subj1.1
http://catless.ncl.ac.uk/Risks/7.66.html#subj3.1
http://catless.ncl.ac.uk/Risks/21.07.html#subj6.1

> Account numbers, address, maybe a phone or payment amount. Is that really
> dangerous to the customer if only those get compromised?

"Is it really dangerous to your business network if -only- your firewall fails."

No; but how can you assume that you -know- when other security measures are compromised? Sometimes all it takes is a quick trip to the victim's mailbox.

http://catless.ncl.ac.uk/Risks/23.86.html#subj3.1
http://catless.ncl.ac.uk/Risks/20.80.html#subj6.1

> ...it all seems to come back the the Social Security Number. Financial
> companies have other controls in place...to ensure identification.

Many of which are very poor controls; so poor as to be nonexistent in many organizations.

> But in order to be of any use, a bad guy would really need someone's SSN.

Yes, AND no.

> Absent of that, other information would be useless. Right?

Wrong. http://catless.ncl.ac.uk/Risks/18.04.html#subj11.1
http://catless.ncl.ac.uk/Risks/16.30.html#subj4.1
http://catless.ncl.ac.uk/Risks/14.88.html#subj3.1
http://catless.ncl.ac.uk/Risks/23.84.html#subj5
http://catless.ncl.ac.uk/Risks/10.24.html#subj5.1

> That's what I would like to ask Slashdot folks. What could be realistically
> done with customer information without a SSN?

Well, you've set up an arbitrary experiment there. It's a school experiment, a teaching tool. Good for learning, but not reflective of real-world constraints.

The question implies some constraints. Restated as a classroom question, it reads:

-----

John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Without using a social security number, perform the following tasks: A-Withdraw $N from John Doe's checking account. Etc.

----

The real world equivalent problem is:
John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Perform the following tasks: A-Acquire additional personal information about John Doe, including his SSN B-Using this data, including the SSN, withdraw $N from John Doe's checking account. Etc.

----

The school question is a useful learning tool, work exploring; but if the student can't normally perform the tasks without an SSN, you can't feel confident or safe. The real world problem just adds one more task at the beginning; "Get SSN," which is often trivial when you have the other data.

Some examples of trivial SSN exposure, the black market in personal data, and some just interesting:

http://catless.ncl.ac.uk/Risks/6.80.html#subj1.1
http://catless.ncl.ac.uk/Risks/21.82.html#subj8.1
http://catless.ncl.ac.uk/Risks/22.94.html#subj14
http://catless.ncl.ac.uk/Risks/23.11.html#subj5.1
http://catless.ncl.ac.uk/Risks/19.19.html#subj1.1
http://catless.ncl.ac.uk/Risks/7.66.html#subj3.1
http://catless.ncl.ac.uk/Risks/21.07.html#subj6.1

> Account numbers, address, maybe a phone or payment amount. Is that really
> dangerous to the customer if only those get compromised?

"Is it really dangerous to your business network if -only- your firewall fails."

No; but how can you assume that you -know- when other security measures are compromised? Sometimes all it takes is a quick trip to the victim's mailbox.

http://catless.ncl.ac.uk/Risks/23.86.html#subj3.1
http://catless.ncl.ac.uk/Risks/20.80.html#subj6.1

> ...it all seems to come back the the Social Security Number. Financial
> companies have other controls in place...to ensure identification.

Many of which are very poor controls; so poor as to be nonexistent in many organizations.

> But in order to be of any use, a bad guy would really need someone's SSN.

Yes, AND no.

> Absent of that, other information would be useless. Right?

Wrong. http://catless.ncl.ac.uk/Risks/18.04.html#subj11.1
http://catless.ncl.ac.uk/Risks/16.30.html#subj4.1
http://catless.ncl.ac.uk/Risks/14.88.html#subj3.1
http://catless.ncl.ac.uk/Risks/23.84.html#subj5
http://catless.ncl.ac.uk/Risks/10.24.html#subj5.1

> That's what I would like to ask Slashdot folks. What could be realistically
> done with customer information without a SSN?

Well, you've set up an arbitrary experiment there. It's a school experiment, a teaching tool. Good for learning, but not reflective of real-world constraints.

The question implies some constraints. Restated as a classroom question, it reads:

-----

John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Without using a social security number, perform the following tasks: A-Withdraw $N from John Doe's checking account. Etc.

----

The real world equivalent problem is:
John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Perform the following tasks: A-Acquire additional personal information about John Doe, including his SSN B-Using this data, including the SSN, withdraw $N from John Doe's checking account. Etc.

----

The school question is a useful learning tool, work exploring; but if the student can't normally perform the tasks without an SSN, you can't feel confident or safe. The real world problem just adds one more task at the beginning; "Get SSN," which is often trivial when you have the other data.

Some examples of trivial SSN exposure, the black market in personal data, and some just interesting:

http://catless.ncl.ac.uk/Risks/6.80.html#subj1.1
http://catless.ncl.ac.uk/Risks/21.82.html#subj8.1
http://catless.ncl.ac.uk/Risks/22.94.html#subj14
http://catless.ncl.ac.uk/Risks/23.11.html#subj5.1
http://catless.ncl.ac.uk/Risks/19.19.html#subj1.1
http://catless.ncl.ac.uk/Risks/7.66.html#subj3.1
http://catless.ncl.ac.uk/Risks/21.07.html#subj6.1

> Account numbers, address, maybe a phone or payment amount. Is that really
> dangerous to the customer if only those get compromised?

"Is it really dangerous to your business network if -only- your firewall fails."

No; but how can you assume that you -know- when other security measures are compromised? Sometimes all it takes is a quick trip to the victim's mailbox.

http://catless.ncl.ac.uk/Risks/23.86.html#subj3.1
http://catless.ncl.ac.uk/Risks/20.80.html#subj6.1

> ...it all seems to come back the the Social Security Number. Financial
> companies have other controls in place...to ensure identification.

Many of which are very poor controls; so poor as to be nonexistent in many organizations.

> But in order to be of any use, a bad guy would really need someone's SSN.

Yes, AND no.

> Absent of that, other information would be useless. Right?

Wrong. http://catless.ncl.ac.uk/Risks/18.04.html#subj11.1
http://catless.ncl.ac.uk/Risks/16.30.html#subj4.1
http://catless.ncl.ac.uk/Risks/14.88.html#subj3.1
http://catless.ncl.ac.uk/Risks/23.84.html#subj5
http://catless.ncl.ac.uk/Risks/10.24.html#subj5.1

> That's what I would like to ask Slashdot folks. What could be realistically
> done with customer information without a SSN?

Well, you've set up an arbitrary experiment there. It's a school experiment, a teaching tool. Good for learning, but not reflective of real-world constraints.

The question implies some constraints. Restated as a classroom question, it reads:

-----

John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Without using a social security number, perform the following tasks: A-Withdraw $N from John Doe's checking account. Etc.

----

The real world equivalent problem is:
John Doe's mother's maiden name is Mary Roe. His address is 1313 Mockinbird Lane, Anytown, IA. He works at Nationwide Insurance, and he has a checking account at Bank of America. Perform the following tasks: A-Acquire additional personal information about John Doe, including his SSN B-Using this data, including the SSN, withdraw $N from John Doe's checking account. Etc.

----

The school question is a useful learning tool, work exploring; but if the student can't normally perform the tasks without an SSN, you can't feel confident or safe. The real world problem just adds one more task at the beginning; "Get SSN," which is often trivial when you have the other data.

Some examples of trivial SSN exposure, the black market in personal data, and some just interesting:

http://catless.ncl.ac.uk/Risks/6.80.html#subj1.1
http://catless.ncl.ac.uk/Risks/21.82.html#subj8.1
http://catless.ncl.ac.uk/Risks/22.94.html#subj14
http://catless.ncl.ac.uk/Risks/23.11.html#subj5.1
http://catless.ncl.ac.uk/Risks/19.19.html#subj1.1
http://catless.ncl.ac.uk/Risks/7.66.html#subj3.1
http://catless.ncl.ac.uk/Risks/21.07.html#subj6.1

> Account numbers, address, maybe a phone or payment amount. Is that really
> dangerous to the customer if only those get compromised?

"Is it really dangerous to your business network if -only- your firewall fails."

No; but how can you assume that you -know- when other security measures are compromised? Sometimes all it takes is a quick trip to the victim's mailbox.

http://catless.ncl.ac.uk/Risks/23.86.html#subj3.1
http://catless.ncl.ac.uk/Risks/20.80.html#subj6.1

I'm sorry,
But you seem to underestimate the stupidity of people who create systems on the internet. The place is littered with tombstones marking a huge number of "WTF?? They did what?!?!?!??" type moments. So I wouldn't discount the idea that someone would put private information on a windows title bar. (However, this doesn't support TFA which seems to be a bit FUD related.)

One of my favourite websites is the RISKS list which catalogues general computer stupidity. You should check up on it sometimes, some of the reported situations are mind numbing in their stupidity.

Without thinking too much about it, the mailing list sf-lovers (aka, morphed into USENET's rec.arts.sf.written) stems from about 1972 or so. When I checked a few days ago, there were still quite a few posters there: http://w3.aces.uiuc.edu/AIM/scale/nethistory.html

The RISKS list dates from 1985 or so: http://catless.ncl.ac.uk/Risks/

The comp.compilers group goes back to 1986 or so: http://compilers.iecc.com/

(MITRE is probably best known as "that contractor who decided that Windows NT should run that battleship that was stranded when Windows NT BSODed on its test run".)

Cite? MITRE didn't exist when the final US battleship was built, nor did MIT Lincoln Labs. I suppose the MIT Radiation Laboratory was contemporaneous in 1944, but I expect their expertise in OS recommendations was limited. I suppose this lack of knowledge of operating systems is excusable as there weren't any operating systems.

Oh, you mean the USS Yorktown? That's a guided missile cruiser, and back in the old days the hull would have been called a destroyer, before the Navy decided to change the nomenclature. Little bit of a difference between a destroyer hull and a battleship, but hey, AC abuse is par for the course.

As much I relish the image of some poor ensign yelling, "Screen's blue, SIR!", nobody seems to think this was an OS-level crash. And most of the google hits I can find on "navy smart ship mitre" point to things like Think Outside The COTS . Scrolling down to Figure 1, there's a list of potential pitfalls of commercial-off-the-shelf software.

If this seems familiar, you've been a slashdot reader for a few years: MITRE Corp. Report On Open Source In Government .

http://catless.ncl.ac.uk/Risks/16.28.html#subj3

Sorry, that's incorrect.

What you're talking about here is Air France Flight 296. There's a full description on the link, but the short version is that the pilot tried to throttle up because the plane was too low, and the fly-by-wire system overrode him due to a fault. Nothing to do with the autopilot at all --- autopilot landings are quite common these days.

(There's also been a lot of controversy about that accident, because there are a number of irregularities with the investigation indicating that the evidence has been tampered with. Check out this link for more information.)

(Oh, yes; only three people died, although about 50 were injured.)

Is the closed source code of Windows preventing us from actively defending our systems?

Does this question really need to be asked any longer?

Has this story teleported us all back to the year 2000? Hit the reset button? Is Slashdot's new motto "No hugging, no learning"?

b) The US Navy is running an unsecurable OS for the most advanced surface ships in the world - with nuclear reactors to boot.

I thought this was common knowledge. I didn't really expect a "pro-business" administration to do anything about it, did you? It's actually one of the few things that makes the rest of us feel safer.

Britain has the same problem, by the way:

The Royal Navy's new, state-of-the-art destroyer has been fitted with combat management software that can be hacked into, crashes easily and is vulnerable to viruses, according to one of the system's designers who was fired after raising his concerns. ... he told Channel 4 news that "the use of Windows For Warships puts the ship and her crew at risk, and the defence of the realm".

There are also plans to install a similar Microsoft Windows-based computerised command system on Britain's nuclear submarines. Wilson said: "It is inconceivable that we could allow the possible accidental release of nuclear missiles. The people who survived such an exchange, if any, would certainly regard such a thing as a crime against humanity. And I can't help feeling that even planning to deploy such systems on Windows, with its unreliability and lack of security, is itself some sort of crime in international law."

Also see The Register which quotes an upbeat Armed Forces Minister:

Fabricant had asked if there had been an external review of the Type 45 decision, and from Ingram's answer we can perhaps infer 'No'. He then asked for a cost comparison between Unix and Windows 2000 as the CMS OS, and Ingram simply said: "The cost of implementing an operating system for the Combat Management System in the Type 45 is a matter for the prime contractor, BAE Systems, and their sub-contractor. The Department does not have, or require, visibility of costs at that level of detail."

Fabricant also asked what systems had been put in place to cope with a failure, and what steps had been taken to ensure the Win2k CMS in the Type 45 was reliable. Aside from affirming that Win2k was "the lowest risk choice" and that BAE was on top of "residual risks" (Are these cookies? Spyware?), Ingram said: "The system design has built-in redundancy, with automatic, and transparent, switch-over to a back-up system if the primary system has a problem. This would provide continuity of operation and ensure that no data was lost. The system design also ensures that comprehensive hardware mechanisms will be in place to avoid any other safety or technical issues."

Perhaps the Minister can now explain why his desktop PC doesn't even run properly.

Les Hatton gives his opinion at IT Week:

... the Royal Navy is all set to go to sea with Windows on warships. Am I alone in thinking that this has to be one of the most terminally stupid IT decisions of the century?

...this was first attempted in the mid-1990s. There was a wonderful description of the then-latest generation of a US missile cruiser, the USS Yorktown, having to be frequently rebooted because its underlying network of computers running Windows NT crashed somewhat inconveniently. Apparently the design meant that critical systems such as steering could be lost in mid-battle.

So here we are again. This time the dec

For alternate opinions on the book see this review by Rob Slade in RISKS Digest, and this short rebuttal of Slade's review by Simson Garfinkle.

For alternate opinions on the book see this review by Rob Slade in RISKS Digest, and this short rebuttal of Slade's review by Simson Garfinkle.

Your 'dd' mistake is very common. Apparrently the Greek tax system TAXIS once went down because of this. http://catless.ncl.ac.uk/Risks/20.75.html

Millions of lost revenue from faulty speed cameras
Bertrand Meyer
Sat, 01 May 2004 14:44:42 +0200

Given the attention this story has been commanding in Australia, I was surprised to find no record in RISKS. The country is proud of its strictness in enforcing speed rules, sometimes fining motorists for driving one kilometer above the posted limit (however absurd that sounds). The state of Victoria has numerous speed cameras. Last year their accuracy was questioned after reports that a truck with a maximum speed of 140 km/h was caught traveling at 164 km/h, and other similar incidents. After the first such report the Assistant Commissioner said (Melbourne Age, 11 Nov 2003):

"There's no evidence to support that any of the other cameras are malfunctioning [...] in any other way,"

"It's embarrassing for everybody... Technology is technology and I think we have had indications where it doesn't say the right thing."

almost six months after the State Government suspended the issuing of fines from Victoria's fixed speed cameras, problems with the cameras are still unresolved [...] A State Government spokesman confirmed yesterday that the 47 fixed cameras were still under review. He was unable to say when the issue would be resolved.

For details:

http://theage.com.au/articles/2004/04/29/108322451 6563.html (30 Apr 2004)

http://theage.com.au/articles/2004/04/28/108310355 1024.html (29 Apr 2004)

http://www.theage.com.au/articles/2003/11/10/10683 29487082.html?from=storyrhs (11 Nov 2003)

Bertrand Meyer
ETH Zurich / Eiffel Software
http://www.se.inf.ethz.ch/ -- http://www.eiffel.com/

A programming method that involves designing an application such that you break each top level logical component/ability down until you a) know that you have to impliment it or b) it is found to have already been done.

That already exists, and the specification is indeed amenable to proof tools (several specification languages use HOL as their proof assistant even!). Check out B-method, HasCASL, SPARK, Extended ML, or even Z and VDM. There are tools like Perfect Developer. There are specification extensions to Java like JML that support extended static checking and proof via other tools.

Uptake has been slow, and the tools associated with this stuff are still maturing (despite the fact that formal specification is a relatively old field - tracing it's way back to Djikstra and Hoare in the late 60's). Doing specification properly tends to require a little more math background, and does take some work. More importantly, for a great many projects, it simply isn't suitable. There is no magic process you can follow that makes everything work, and there is no "final" programming model. There are whatever mix of techniques and models suit the project at hand. Good developers are ones who know lots of models and techniques and adapt them to best fit the problems at hand.

That said, specification is sorely underrated and underused as a programming technique. Too few people are well acquainted with it, and almost all the complaints that often get raised are based on myths and misnomers. It's not right for everything, but there are plenty of places where perhaps it could and should be used. Knowing how to do proper formal specification is simply another weapon in a good developers arsenal, and I wish more people spent the little extra time required to learn something about it.

Jedidiah.

Who's expecting to read about this in the RISKS digest in a couple years? imagine: "Soldiers were found to be simply relying on their software agents' interpretation of the situation when they initiated the fire sequence." There was an article about this recently, though I can't find it. The Patriot system said a plane was flying like a missle and the soldiers gave fire permission. They could have waited 1 minute but didn't. http://catless.ncl.ac.uk/Risks/23.72.html#subj2

I agree: "hacker" and "cracker" are synonymous, despite what ye olde hackers believe. It seems that this happened so long ago, that it's way beyond quixotic to keep up the fight now:

Check out this thread, dated March 7, 1989:
http://catless.ncl.ac.uk/Risks/8.36.html#subj3

Brad Templeton wrote: It is with regret that I have to say that this fight has been lost. "Hacker" and "computer criminal" are now equated in the public mind, to the extent that this use of "hacker" now appears in newspaper headlines. The German Spy breakins confirm this in papers all over the world.

Rob

Yes, it's dead easy and can be done using readily-available and household materials. You just need some graphite dust and sellotape {from your desk}, photoresist PCB board and processing chemicals {from Maplin or similar; unless electronics is considered bomb-making nowadays}, and plant gelatin {from a health food store}. Dust laptop for {presubably the rightful user's} fingerprints with graphite and lift with sellotape. {Option: enhance image electronically}. Make a printed circuit board using the fingerprint pattern. Ideally use negative working photoresist or take a negative as part of enhancing the image, though in practice negative images are acceptable to fingerprint scanners {which seem to respond to edges in blissful ignorance of actual direction}. Use PCB to cast a gelatin mould of the rightful user's fingerprint. Use artificial gelatin fingerprint {possibly on the end of your own finger} to operate scanner. In the event of a bust, it can be disposed of safely by eating {you did use plant gelatin, didn't you?}

References here and here.

Microsoft? Um, well they invented something... I just don't know what that is.

but would you even notice it if you were connected to a different, wide open, WiFi hub?

seizing anything that could provide the key, including you

Although some people might find it hard to believe, this certainly does happen (via Risks digest).

Unfortunately, it has happened before that businesses who should have known better (such as banks, stock brokers and auction houses, ...), have subcontracted out security-critical mailings to third parties.

With the predictable result that concerned customers phoned tech support, were told "don't worry, these guys were indeed hired by us", and then fell for a phishing scam next month...

comp.risks is full of stories like that.

If there's anything that Slashdot has taught us, it's that it's never safe to use your computer.

Just be glad you don't read the RISKS digest. PGN has taught me that it's never safe to be near computers, things controlled by computers, things designed using computers, or anything else at all.

Maybe now's a good time to put in a plug for the RISKS "Forum On Risks To The Public In Computers And Related Systems."
It sounds academic, but it's full of level-headed dissection of all kinds of software-related disasters, ranging from the hilarious, like the USS Yorktown dead in the water after a divide by zero, to the horrifying. The contributors are skeptical but polite, and I learn new stuff with every issue.

Maybe now's a good time to put in a plug for the RISKS "Forum On Risks To The Public In Computers And Related Systems."
It sounds academic, but it's full of level-headed dissection of all kinds of software-related disasters, ranging from the hilarious, like the USS Yorktown dead in the water after a divide by zero, to the horrifying. The contributors are skeptical but polite, and I learn new stuff with every issue.

This is the famous incident that's always dragged out. It actually turns out to be somewhat more complex than the "common" version that you've probably heard by word of mouth. Check out this version for some facts, or check this one.

In short; the computer said "What you're doing is pretty stupid. Are you sure you want to do this?" and the pilot said "Yes".

Or, in other words, had the computer actually had final say, the accident likely would have been avoided.

Actually, this reminds me of another interesting feature on the A320, which is the computer's response to an emergency. Let's suppose an engine lights on fire. The master alarm goes off, and the central screen says "Fire in engine 1. Please shut off engine". So, you shut off the engine. Then the screen says "Please prime fire suppression SQUIB 1. If fire is not out in 30 seconds, fire SQUIB 1.". Meanwhile the red SQUIB 1 button starts flashing, and then the "30" starts counting down.

Another neat one is the traffic system. If the computer determines you're on a course which would take you dangerously close to another aircraft, a voice says "TRAFFIC! TRAFFIC!", and then the central screen shows the other aircraft in relation to you, and displays a list of maneuvers to carry out to avoid the other plane. (This is actually pretty standard. If you were in a 767 flying head-on at another 767, by the time you could identify the orientation of the other 767 and realize there was a problem, it would be too late to do anything about it. But, it's still very cool).

As a pilot, I'd be really annoyed that a professional engineer decided to use a really sensitive op-amp in my plane, and to leave it unshielded.

Read through the Risks Digest some time. Stupider things happen - and they happen a lot more often than you would like.

As I mentioned, it's all about removing unknown variables. Has anyone does any rigourous testing of the effects of bluetooth devices on avionics? Yes? No? Don't know? Then lets just keep all the bluetooth activity to a minimum, to be on the safe side :-)

Because unless you decide to pick up a computer and brain someone with it they are not a lethal weapon.

The issue is not the consequences of mis-use, but the complexity of learning proper use.

Anyway - bad software kills. Probably the best known incident is the Therac 25 software failure.

Peter G. Neumann notes over 700 deaths in 24 incidents - and that was just by 1986. (All software developers should read PGN's RISKS Forum.) Some more fatal incidents can be found here.

Because unless you decide to pick up a computer and brain someone with it they are not a lethal weapon.

The issue is not the consequences of mis-use, but the complexity of learning proper use.

Anyway - bad software kills. Probably the best known incident is the Therac 25 software failure.

Peter G. Neumann notes over 700 deaths in 24 incidents - and that was just by 1986. (All software developers should read PGN's RISKS Forum.) Some more fatal incidents can be found here.

You don't get owt for nowt.

I'm not sure that anybody was claiming you could get an OverWeight Truck for neat cattle. Perhaps you meant "aught for naught"?

1. The existance of "biomarkers", organic molecules found within oil with clear biological precursors (e.g., pristane and phytane are derived from chlorophyll)
2. The fact that you can put kerogen in a tube in a lab, heat it, squeeze it, and get oil out
3. The utter, utter failure and wasted $$$ of fools who drill in non-organic rich areas

Sorry for the rant, but some statements are just stupid. More information can be found at Woods Hole Organic Geochemistry group ( http://dynatog.whoi.edu/ ), at the Newcastle U site ( http://nrg.ncl.ac.uk ) or on wikipedia ( http://en.wikipedia.org/wiki/Organic_geochemistry )