Slashdot Mirror

Enjoy!

• Secrecy, flagging, and paranoia: adoption criteria in encrypted email
• How to make secure email easier to use
• Why Johnny Can't Encrypt and Why Johnny Still Can't Encrypt
• Views, reactions, and impact of digitally-signed mail in e-commerce
• Usability of security: a case study

And still has some nifty features to support pen computing.

Other apps in the space:

Xournal --- more like Microsoft Journal as the name implies (OneNote has more organizational features such as tabs &c.) (see also Jarnal)
Flash --- in its rôle as the tool which succeeds the the pen drawing tool FutureWave SmartSketch ---
Mage Software's InkBook --- (Mac OS X)
EverNote
Treenote, if I'm remembering correctly was quite interesting, but there's a placeholder page for now.
sBook --- (Mac OS X) --- nifty A.I. driven freeform address book which can be used as a general-purpose notetaking tool --- I'm still bummed the Windows version crashed when one tried to write into it on a Tablet PC and wish it had better support for graphics --- opensource: http://simson.net/ref/sbook5/

The odd thing is, I loved Millenium Software's Notebook.app on NeXTstep, but haven't found occasion to buy Circus Ponies' Notebook

Mostly though, I just use Macromedia FreeHand for drawings and am trying InkSeine for notes on a ThinkPad X61 Tablet: http://research.microsoft.com/...

Solution: get rid of CDMA.

CDMA also has much better sound quality and security from eavesdropping than does GSM.

In fact, no. CDMA can be eavesdropped.

"CDMA (Code Division Multiple Access) is the digital telephone standard that was developed by Qualcomm and deployed by Sprint PCS and by Verizon. CDMA used RC4 encryption but the protocol doesn’t keep the keys secret, so in practice CDMA communications can be eavesdropped by a motivated attacker. In practice, though, it’s must easier to wiretap a CDMA telephone on the provider’s network. Today CDMA is used by the Sprint part of Sprint/Nextel and by Verizon."

http://simson.net/ref/security_cellphones.htm

My point is, this isn't a simple task.

Concatenation, or building a list of links would be trivial.

Taking untagged and unformatted information and providing it with:

  - semantic tagging
  - structure
  - hierarchy

Is not something which happens w/ free-form data w/ publicly available tools resulting in a usable result.

Closest thing to it I've found is Simson Garfinkel's address book sBook:

http://simson.net/ref/sbook5/

and it can barely handle addresses, e-mails and URLs.

If I've missed a tool, I'd be delighted to be shown where it is.

William

Whenever I see "X11 Window System" I think of the UNIX Haters handbook. A bit dated but well worth a read - even if you like UNIX/linux - http://m.simson.net/ugh.pdf

I would also add "The UNIX Hater's Handbook" to that list. This book isn't just about programming in UNIX. It is more about the philosophy behind UNIX, which in turn, through negation, describes properties of any sustainable software system.

It can be found online here: http://m.simson.net/ugh.pdf

One of my favorite parts is on transparency and discoverability: Chapter 8; csh, pipes, and find; Power Tools for Power Fools

If you haven't read The Unix Haters Handbook, it's a great read for all those *nix lovers. I say this as one who prefers Linux for most everyday stuff.

The UNIX-HATERS Handbook [pdf]

Foreword
By Donald A. Norman

The UNIX-HATERS Handbook? Why? Of what earthly good could it be? Who is the audience? What a perverted idea.

But then again, I have been sitting here in my living room—still wearing my coat—for over an hour now, reading the manuscript. One and one-half hours. What a strange book. But appealing. Two hours. OK, I give up: I like it. It’s a perverse book, but it has an equally perverse appeal. Who would have thought it: Unix, the hacker’s pornography.

When this particular rock-throwing rabble invited me to join them, I thought back to my own classic paper on the subject, so classic it even got reprinted in a book of readings. But it isn’t even referenced in this one. Well, I’ll fix that:

Norman, D. A. The Trouble with Unix: The User Interface is Horrid. Datamation, 27 (12) 1981, November. pp. 139-150. Reprinted in Pylyshyn, Z. W., & Bannon, L. J., eds. Perspectives on the Computer Revolution, 2nd revised edition, Hillsdale, NJ, Ablex, 1989.

What is this horrible fascination with Unix? The operating system of the 1960s, still gaining in popularity in the 1990s. A horrible system, except that all the other commercial offerings are even worse. The only operating system that is so bad that people spend literally millions of dollars trying to improve it. Make it graphical (now that’s an oxymoron, a graphical user interface for Unix).

You know the real trouble with Unix? The real trouble is that it became so popular. It wasn’t meant to be popular. It was meant for a few folks working away in their labs, using Digital Equipment Corporation’s old PDP-11 computer. I used to have one of those. A comfortable, room-sized machine. Fast—ran an instruction in roughly a microsecond. An elegant instruction set (real programmers, you see, program in assembly code). Toggle switches on the front panel. Lights to show you what was in the registers. You didn’t have to toggle in the boot program anymore, as you did with the PDP-1 and PDP-4, but aside from that it was still a real computer. Not like those toys we have today that have no flashing lights, no register switches. You can’t even single-step today’s machines. They always run at full speed.

The PDP-11 had 16,000 words of memory. That was a fantastic advance over my PDP-4 that had 8,000. The Macintosh on which I type this has 64MB: Unix was not designed for the Mac. What kind of challenge is there when you have that much RAM? Unix was designed before the days of CRT displays on the console. For many of us, the main input/output device was a 10-character/second, all uppercase teletype (advanced users had 30- character/second teletypes, with upper- and lowercase, both). Equipped with a paper tape reader, I hasten to add. No, those were the real days of computing. And those were the days of Unix. Look at Unix today: the remnants are still there. Try logging in with all capitals. Many Unix systems will still switch to an all-caps mode. Weird.

Unix was a programmer’s delight. Simple, elegant underpinnings. The user interface was indeed horrible, but in those days, nobody cared about such things. As far as I know, I was the very first person to complain about it in writing (that infamous Unix article): my article got swiped from my computer, broadcast over UUCP-Net, and I got over 30 single-spaced pages of taunts and jibes in reply. I even got dragged to Bell Labs to stand up in front of an overfilled auditorium to defend myself. I survived. Worse, Unix survived.

Unix was designed for the computing environment of then, not the machines of today. Unix survives only because everyone else has done so badly. There were many valuable things to be learned from Unix: how come nobody learned them and then did better? Started from scratch and produced a really superior, modern, graphical operating system? Oh yeah,

"[Automatic decryption] can save your ass if you accidentally use the "x" command (encrypt the file) that is in some versions of ed, thinking that you were expecting to use the "x" command (invoke the mini-screen editor) that is in other versions of ed. Of course, you don't notice until it is too late. You hit a bunch of keys at random to see why the system seems to have hung (you don't realize that the system has turned off echo so that you can type your secret encryption key), but after you hit carriage-return, the editor saves your work normally again, so you shrug and return to work.... Then much later you write out the file and exit, not realizing until you try to use the file again that it was written out encrypted--and that you have no chance of ever reproducing the random password you unknowningly entered by banging on the keyboard. I've seen people try for hours to bang the keyboard in the exact same way as the first time because that's the only hope they have of getting their file back. It doesn't occur to these people that crypt is so easy to break."

Footnote, page 252, Unix Hater's Handbook. And people wonder why "ed" is unpopular...

I had a run-in recently from a drive-by malware install (curse you Chrome!). It immediately disabled task manager and locked me out of regedit and msconfig, and icons began to fill my desktop as I gazed on in horror... I couldn't install MalwareBytes because the malware killed the installer process immediately. I couldn't even download anything with an ad-aware-like filename since the request was hijacked and I got a scareware page instead.

A reboot into safe mode failed. Luckily, I had Process Explorer on a thumbdrive and was able to wrangle it dead with judicious use of Kill Process Tree and very fast clicking, since the processes restart each other when you kill them. Then I could use autoruns to nuke anything remotely non-Microsoft from my startup, and then I could install malware removal tools and antivirus scanners.

While it's easy to bash Windows after this privilege-escalation browser-hijacking nightmare, the tools available for defeating malicious software even when it has root are impressive. The problem of regaining control from a hostile takeover is fascinating and despite the panic it's always fun to engage in combat using your own little tricks.. it's like sitting in the computer lab on locked-down machines and trying to break free :) In middle school, there were very few icons on the desktop, nothing in the start menu, task manager was locked out, Run didn't work, none of the usual key combinations were effective... but I discovered that you could embed a hyperlink to file://c:/windows/cmd.exe in a word document and control+click it to bring up the DOS prompt!

And frankly the only reason that I was able to recover control from the malware is because XP's internal security is a wreck and there are a million different things to lock down individually. Let's face it, if somehow malicious code found a way to be executed as root on my linux system, there are no tools on earth short of going over the entire filesystem in a different OS with a text editor that can save you. Even rudimentary tools like Autoruns have no analogue in Linux.. there are rc.d scripts and .bashrc scripts and .xsession scripts and rc.conf and etc etc etc scattered all over the place, it's a mess. Well, I don't want to turn this into a unix haters rant...

With the growing interest in Linux, I wonder if we'll see more parity of viruses between Windows and Linux.

This should sound familiar to most readers here. We've heard it before:

http://www.simson.net/clips/2000/2000.SecurityFocus.Linux_Viruses.html

http://web.archive.org/web/20000304004534/http://www.zdnet.co.uk/news/2000/3/ns-12862.html

http://www.vnunet.com/vnunet/news/2120227/honeymoon-linux-users

And the same general theme has even been fitted for the MacOS crowd:

http://www.linuxinsider.com/story/mac%C2%AD-security/57811.html

It's not that the concept is all that unlikely. Oddly enough, WinNT set a historical precedence for adoption and exploitation. Yet Linux / Unix has yet to pan out the same way.

What we've got to keep in mind is that Linux (and Unix variants) have been in this arena for some time. They have had exposure and faced scrutiny. In fact, the hay-day so far for Unix and Linux malware was probably around 2002 - 2004.

Whether that is the last chapter for Linux malware is yet to be seen. I would expect it isn't. Linux users must remember that it is no silver bullet. But history has shown that it appears to be fairly resilient.

[tired of posting AC, here I am, the linuxhaterhater...]

It is not written in the style of Unix Hater's Handbook. Unix Hater's never degenerated into homophobic right-wing rants. And it was clever. And well written. And technically accurate.

I re-read the handbook for the first time in a decade when the Allison op-ed hit slashdot (and you saw the little hissy the author threw about the summary link being to zdnet, right? That wasn't a joke.) Unix Hater's is every bit as good as I remember (see my earlier comment).

Allison's point of view seems absurd to me. He thinks that the "community" has to embrace this cretin so that they don't seem humorless. That's just PR. It reminds me of Bill O'Reilly going on the Colbert Report to show he wasn't "humorless". It's not genuine, it's not necessary.

About the fonts article, I am totally unimpressed that you managed to find an article that wasn't totally uninformed, when there are a dozen articles on the front page without any merit at all.

Allison's good-humor act isn't fooling anybody on the other side of the fence. And this blog is a terrible bug report system. Linuxhaters only value to foss, as far as I can tell, is showing the problems that linux beginners encounter. And even that involves cutting away 80% of the boring pseudo-fratire lameness.

Linuxhaters is no Unix Hater's. Not even close.

and who isn't?

Me.

I don't even have a linux desktop right now. I just think it (linuxhaters) isn't any good.

It reads like it was written by a 18-year-old sub-literate kid who missed the "satire" part of "fratire". Even if the writer (writers?) understood linux, I couldn't read it due to the latent homosexuality making me so uncomfortable on the the author's behalf (why is everything about balls, cock, and ass to you?).

Back in the day, we had UGH. Now that was some good hate.

Or, by the name I use to remember it, ugh.pdf

I think university should be about education, not about job training. Aside from the entertainment value, the UNIX-HATERS Handbook provides interesting information about the design of Unix systems, as compared with other operating systems that have been tried. You can use sections from it to start off discussions, either about why Unix is like that, or how it has changed since then.

Surely, that title belongs to COBOL. Maybe Java wins in the the "Biggest, most successful, unreadable language" subcatagory. I'm not a COBOL programmer BTW. I'm not even sure that the term "Cobol Programmer" isn't an oxymoron as most of the "Cobol Programmers" I met back in the decades when it dominated the business world struck me as being somewhat on the not real swift side of confused.

I lack the patience to program in COBOL, but the couple of times I've needed to dig into a COBOL program to figure out what it was doing, I found it to be orders of magnitude more comprehensible than C, C++ or Java.

Seriously, I think the write-only nature of modern languages is a huge contributor to the dubious quality of software. Trying to scale programming languages that lead to baffling code at the toy/small program level to huge systems works about as well as one might expect -- Poorly. Frankly, I see virtually no progress on the big system side since the first non-assembler big systems I saw 40+ years ago written in Fortran and Jovial. In fact, some parts of OSS programs I've looked at written in C++ look to be a decided step backwards.

So I'm an old foggy who is stuck in the past? Perhaps. Probably even. But I do see significant progress in some areas. List programming is a step forward although I'm not that good at it. Same with Object Orientation. Perl is a vastly better tool for quick and dirty little programs than anything we had in the 1960s. Python is even better. I expect there are even better languages for many jobs.

But if you ask me, C sucks at least at many of the jobs it is being used for. Bad with object orientation pasted on is lipstick on a pig. It's still a pig and it's still bad. (I'd have thought that C might be OK for some simple embedded programming -- especially if the alternative is Intel's abominable assembly language. But embedded programmers have told me otherwise. Easier to code, but performance is deficient.)

I'll finish this rant with a quote from the Appendix B to the Unix Hater's Handbook (I use Slackware 12.0 BTW. It has it's moments, but for the most part I'm a Linux fan).

... we quickly added additional cryptic features and evolved into B, BCPL, and finally C. We stopped when we got a clean compile on the following syntax:

for(;P("\n"),R=;P("|"))for(e=C;e=P("_"+(*u++/ 8)%2))P("|"+(*u/4)%2);

To think that modern programmers would try to use a language that allowed such a statement was beyond our comprehension! We actually thought of selling this to the Soviets to set their computer science progress back 20 or more years. ... http://www.simson.net/ref/ugh.pdf

That's parody of course. But good parody is usually built on a kernel of truth.

Couple of things:

1. The automation of a catapult launch is a bit different from an autopilot. The pilot (AFAIK) still controls the plane once it leaves the deck. The computers just control the various factors of the plane's configuration necessary for a successful catapult. Once it's off the deck, it's still up to the pilot to keep it in the air and make the necessary clearing turns. Think of it more as a safety feature built into the fly-by-wire.

You can read one of the patents for such a system here:

http://www.freepatentsonline.com/6793176.html

2. On the subject of magnesium, I think you might find the NeXT Cube burning story interesting. Linky:

http://www.simson.net/hacks/cubefire.html

In particular, you'll note how amazingly difficult it was to get the blasted thing ignited. :-)

Sorry everyone. That was a joke. A little too much Wikipedia on that one... and not enough smileys.

I mean, people thought the electronics would survive in a 2861 C (5182 F) metal vat??? Even the magnesium casing will melt lower than that.

Sorry about that. Carry on.

(And BTW, the magnesium casing can burn, but it's hard to do)

http://www.simson.net/ref/ugh.pdf

The unix hater's handbook. Yep, semi-humorous, but a lot of truth to it. I like parts of unix, I'm a big proponent to Linux, but many parts I could do without. It is always good to keep in mind there are more than 1,2 or even 3 ways to do something.

It followed the UNIX philosophy of do one thing (play music) and do it well.

Magnesium in a proper alloy for a computer case is rather difficult to ignite.

"And finally the old unix guys will flame about how none of these vulnerabilites would have happened if we would have stayed away from GUIs."

No. Old UNIX hackers will instead berate UNIX for being a total piece of shit and then endlessly whine about the downfall of Symbolics and its old dedicated LISP machines. And they'd be right.

How about just useful desktop applications?

The closest thing I can think of is Simson Garfinkel's sBook (recently opensourced, not sure of the license, see http://www.simson.net/ref/sbook5/ ), but all it does is parse addresses --- I'd love to see a more general purpose one where I can dump all sorts of data in, have it organize it, then run more than just queries, but calculations / forecasts / charting off the data in it (one example, dump a listing of all of my book collection in and have it create a table of average page counts by types of book over time).

William

It is much much much harder than you think to light a magnesium-cased computer: see http://www.simson.net/hacks/cubefire.html

What's even worse, this concept has been tried, and it failed miserably.

Uh-huh. Because if something is tried and fails once, that means it can never work, ever.

Clearly, between this, and the AI prediction, this guy is completely unaware of computing history. Only a fool would try to predict the future with no knowledge of the past.

Clearly?

Dijkstra dismissed the idea long ago. But of course, I'm sure this no-name doofus knows better! http://www.cs.utexas.edu/users/EWD/transcriptions/ EWD06xx/EWD667.html

Dijkstra was one smart cookie, but there were things even he was wrong about. When you're talking about "what works in practice", I wouldn't hold up Dijkstra as the end-all-be-all.

http://en.wikipedia.org/wiki/Natural_language_and_ computation

I'm familiar with those problems, and I still think it's possible (though maybe not in the proposed timescale). If those are the worst problems we can think of, we're in great shape.

For example, most of the problems listed there are some case of "well, NLs are ambiguous in case X". Yes, they are! At which point, if you were telling this to a computer, the computer would say "wait a minute, Dave, do you mean X or Y?". This is exactly what I do (I'm a programmer) when I'm given ambiguous specifications.

The idea of computers detecting this sort of thing is not new. Lotus Improv let you type in formulas, but it is (of course) possible to type in two formulas that conflict. Steve Jobs (yes, him!) got the developers to see that this is a great feature, not a drawback: the computer can ask you what you want.

The guys who wrote the book han an innovative agreement that once out of print, they could publish it online for free. You will find the xomplete 3.5MB pdf here. You will also, surprise, surprise, find a link from the site of a well known computer company.

A1:A7 was a necessary (computer) memory-saving expediency --- http://www.bricklin.com/history/intro.htm

Not necessary now though --- http://www.simson.net/clips/91.NW.Improv.html

At the very least, I know of one accounting firm which requires only named ranges be used in calculations --- (cited in ) http://www.amazon.com/exec/obidos/tg/detail/-/0534 371353?v=glance

William

If you design user interfaces to secure applications, I highly recommend the O'Reilly book Security and Usability. It's a collection of classic and new papers on the topic. Simson Garfinkel's thesis is also a good reference on usability and security.

"The wonderful thing about standards is that there are so many of them to choose from"
-- Grace Murray Hopper

it's funny AND true.

/ seriously thinks UNIX like systems need to go the way of VAXen.
// well, actually not so much the systems themselves, but the assinine UNIX mentality of "harder is better" and "more documentation eliminates the need for good design.", which set back Computer Science departments and academia 15 years behind industry.
/// fortunately, one of the unintended side-effects of Linux is that the mentality, at least amongst Linux users, is slowly, ever so slowly, fading away.

I'm not going to discuss the main article anymore, because it's just too painfully retarded to think about, much less read. But as long as we're out in the Land of Wild Speculation anyway, I kind of like the whole Solaris kernel + Aqua idea.

Actually, that has been done. Sun got uppity and dumped it for Oak, which became Java. That was dumb, but that was Sun. :-)

Not only did Adobe port Photoshop to the SGI, they also ported to the Sun. As someone who has used (suffered through) Photoshop for UNIX, I can assure you that you're not missing anything by sticking with the GIMP.

The UNIX ports are just the Mac version bundled with a Mac emulator. This is not unlike those companies which offer a "Linux version" of their software by repackaging their program with a Windows XP install and VMWare.

I think you're thinking of magnesium, like the NeXT cube, not titanium. Titanium doesn't appear to ignite under standard pressures, even in excess of 4000C.

This link: http://www.simson.net/clips/1991/91.NW.Improv.html

is a good retelling of the Improv story

Simon Says for the NeXT, 1992.

I mean, cmon! Don't you people have calenders? Ten years ago wasn't that long ago. If you expand that to 15, such events as the fall of the Soviet Union, the Wall coming down, the Burning of the NeXTCube*, The Browser Wars... the list goes on. Wake up, Slashdot!

*http://www.simson.net/photos/hacks/cubefire.htm l

You didn't happen to have a NeXT Cube inside that case, did you? :-p

p

The really funny part about {NeXTstep,NextStep,NEXTSTEP,Nextstep,OpenStep) being around for 16 years (1989 was the release of 0.8, I recall), is the apps that Steve (that's JOBS) is recycling from the old days.

Keynote is VERY close to a wonderful 1995 NEXTSTEP presentation app from Lighthouse Design called "Concurrence". How close is it? Well, why not ask Roger Rosner, who now works at Apple, on Keynote, and was one of the founders of Lighthouse.

Another Lighthouse founder, Kevin Steele, wrote Diagram! for NEXTSTEP in 1992, WELL before Visio was even a company (and well before Visio bought ten copies of Diagram!, worked for a year, and came out with a similar program for Windows, making millions of dollars). He rewrote it a couple years ago and gave his new version to me (and Omni) -- we renamed it OmniGraffle.

And (finally for now) there was a company that started working on an amazing word processor / page layout hybrid program for NEXTSTEP in 1996-7ish, that just barely got published before the company folded.

The product was called... Pages. cf. Pages. Note that both Apple's new iWork apps are actually NEXTSTEP apps from the mid-1990s.

The last great product from the 1990s NEXTSTEP days was Lotus Improv -- later rewritten by Lighthouse as "Quantrix". It was a truly amazing infinite-dimension spreadsheet. Do a google on Quantrix -- there's a new Java spreadsheet of the same name. And, in fact, by one of the old Lighthouse alumni. And it runs on Mac OS X, but, frankly, I'd really rather have a native Cocoa port. (Sorry, guys, but it doesn't feel the same yet.)

[BTW, it really pays to have worked at Lighthouse. Their president, for example, is now the president of Sun.]

I don't think it was an update, but Keynote WAS being pushed to life by Steve Jobs because at NeXT, he used Concurrence and I can imagine he still had a reluctance to use PowerPoint when he went back to Apple.

I wonder if Pages was descended from Pages for NeXT:
Article on it.

I wonder what happened to that software?

iWork isn't by any means an entirely new software package. Keynote is of course an existing product, though updated here to a new version.

More interestingly, Pages (the word processor) appears to be an update of a software package of the same name that was released for NeXT in 1994 by a company called Pages Software. So here we have yet MORE benefits of the NeXT purchase, albeit delayed by 8 years...

From the linked 1994 NeXTWorld article: The software, three years in the making, takes a new approach to word processing that doesn't include such conventional tools as rulers, font panels, and style sheets. Pages is being positioned as an easy-to-use word processor in light of NeXT's de-emphasis on publishing and a lack of available word-processing software for NEXTSTEP.

"The early view of the product was that it was more of a publishing product," said Larry Spelhaug, CEO of Pages Software. "Internally, we always assumed that it would have full word-processing capability but that wasn't perceived outside the company."

Pages' extensive feature set, roughly equivalent to the latest versions of WordPerfect and Microsoft Word, was entirely implemented in object-based code. The software uses design templates to ease document creation."

I don't know if Apple's Mac OS X version of Pages derives from the NeXTSTEP word processor by the same name. It would be a stretch, but Apple may have purchased the codebase or rights.

http://www.simson.net/nextworld/NextWorld_Extra/94 .04.Apr.NWE/94.04.Apr.NWExtra06.html

It is surprisingly difficult to ignite a NeXT cube.

Stay away from this guy's drivel.

Forgot to post the link - clicky here

Actually, they didn't burn so well.

Most metals, if divided finely enough, will burn. Titanium burns *nicely*. Yet you can make the body of a Mach-3 aircraft out of it and there's no problems.

It wasn't NeXTWorld by any chance?

and the cases burned really well due to the fact that they were cast magnesium =) Back in the mid 90's I lusted after a beutiful black cube of my own, even when Jobs was making high end workstations he had good asthetics.

Well, since he's a graduate student at MIT, I'll wager he has.

"Garfinkel holds three degrees from the Massachusetts Institute of Technology and a masters of science degree from Columbia University. He is a member of the Association for Computing Machinery (ACM), Computer Professionals for Social Responsibility (CPSR), and has a certification in computer security (CISSP) from International Information Systems Security Certifications Consortium."

Hosting these free hotspots costs money...

Surprisingly few seeing that, contrary to popular slashdot belief, web servers don't actually burn.