Slashdot Mirror
Interview with Eugene Spafford
scubacuda writes "Dr. Eugene 'Spaf' Spafford, security expert and professor of Computer Science at Purdue University, talks with Greplaw about what drove him to the computer security field, what it's like to testify before the White House and Congressional committees on information security and public policy, and how legislating technology is 'bad law.' For you budding legal geeks interested in forensics, technology, law, and ethics, Spaf has provided a reading list."
I saw him recently in a conference. He talked about how we all need as americans to make sure we know how to stand in the menace of the actual "orwellian" (his words) government policies.
He sure knows his stuff and is a great source of inspiration for all of us.
A message from the system administrator: 'I've upped my priority. Now up yours.'
Ah, Spafford. The guy who said RTM should be jailed for an accident with a worm - what a nice guy. NOT.
Before giving this guy big hugs and kisses think about what he stands for. Sure, he has a book or two published, by O'Reilly no less. But he's the kind of guy who believes in DRM, DMCA, inflated estimates of "damages" in hacker cases and jail for anyone who so much as sniffs the wrong port. In short a net.nazi.
Define "like."
True story.
are you kidding? Spaf and attallah love feeding students their own opinions, and I have to hear them regurgitate to appear smart. They are considered good profs cause the students don't have to think for themselves.
It's great how the interviewer opens up the topic of virii and Spafford replies quite clearly that virii are not things he studies and that he can give references to other experts if the interviewer so wishes. Then the interviewer just plows ahead trying to make out like virii are the key problem in computer security.
At least Spafford was a good sport and continued doing his best to try to bring all of the subsequent virus questions back into the umbrella of computer security.
I have been pwned because my
Technology typically finds its own solutions to problems, which makes many laws incredible nuisances, stifling innovation.
I work in the building next to CERIAS and they are in one of the worst buildings on campus... They are definitely some smart people though. Spaf is an awesome guy and great teacher.
It's also worth noting that of the 3 UNIX worms he mentions, one, the RTM worm, hit long before it was fashionable to spread things in Windows. The architecture not only permitted it, the holes had been around for ages.
Interesting that Spaf said RTM should be jailed for unleashing that worm. If he had been, would he be an MIT professor now?
Mencken had it right. So glad that's old news.
If he's so smart, why couldn't he think up a better nickname? I rest my case.
&
\sd
s
dg
sg
#65274
Most exploits are caused by M$ due to their overwhelming greed. Would we need security in IT if M$ could get their act together?
What they need to do is get RMS on board to give them some clue about how to go about distributing software in a way that will reduce the number of errors. After all, FOSS has a far faster turnaround time for fixing reported bugs.
Also, if they stopped outsourcing, then the quality of the final product should improve. Take Linux on the desktop. A fine SECURE product, produced with no outsourcing at all!
So logically, if all software was FOSS, then we would not need IT Security consultants.
I really dont know anything about Spaf, but i think that i read somewhere once, that back in the day ( late 80's early 90's ) his personal machine at MIT or Purdue or where ever he was at the time got hacked fairly badly ..
.. ???
anyone have any memories of this ??
or am i just have a bad Acid Flash back
For those of you interested, CERIAS is actually a pretty impressive research group. One of the PhD students is teaching our cs426 class right now, and it's one of the few CS classes I've taken where I'm actually learning practical knowledge about computer security.
Go Boilers!
ce n'est pas un Sig.
Overall, an article worth reading. Two things I found worth noting. First, the "false convenience" metaphor in
I thought was an excellent way to characterise the arguments often raised when such things as user education, simple point-and-click interfaces, administration costs, etc. are the topics of discussion. Also, when asked, the response is notably diplomatic: but then goes on to mention:rot13
"If you think you have things under control, you're not going fast enough." --Mario Andretti
Great! Now I can find all the tech law websites I want with one simple command:
cat internet | egrep -i gr[:vowel:][:explosive\ consonant:]law
Which reminds me, I really wish multi-character atoms would work with reg-ex. The spec calls for them, but they haven't worked in any implementation I've used.
If Academia was deemed immune from the provisions of the DMCA I convinced that his ilk would come roaring out in complete favor of it again. Big difference when these things apply to yourself, huh...
Moderators, at least have a cursory R of TFA before modding this crap up. This guy is either trolling or he's smoking crack (or both). His post bears no resemblance to reality.
The problems that I see arising are when people like Spaf have a significant influence on the maturation of the computer crime field. This, from a practitioner's point of view, is frustrating as people such as Spaf have rarely left their offices and campuses, have little to no experience (in comparison), and often pontificate loudly.
I know how little they are actually doing up at CERIAS in regards to forensic analysis. They have 1 guy working on research, and another guy who releases tools that have an interface that sucks like a cheap whore. Again, they have not left their offices. (Smart dudes of course, but no exp.)
We don't want computer security types. We need AFS to set up certification.
Computer Security != Computer Forensics, for fooks sake.
He's quite the story teller and can relate one to almost every security issue there is. His class was the kind where you almost didn't realize you were learning until it was too late - the final comes and you ask yourself how you learned all the answers.
It was even interesting to see who he lined up as a guest lecturer each time he had to fly to Washington to brief the Government on something. They all had some weird story about security lapses somewhere important.
No, really, that was funny. I'm just a fan of crazy subject lines.
True story.
Christ, did you do any research before posting your blather? Also, why the fuck are you modded up to 4, Interesting?
Lay off the crack, friend.
It's boring but what the hell....
I graduated from Purdue undergrad ECE in '02 and with the job market the way it was back then I knew I'd go to grad school. I had picked up a big interest in infosec my last year there so I emailed Spaf about opportunities in grad school. As soon as he found out I was a lowly Computer Engineer he basically said I shouldn't bother.
So I ended up at Carnegie Mellon instead, and I just finished my MS in Information Networking with a focus on security, I even got to write a Mandatory Access Control system for Linux for my thesis.... Hey Gene? Am I up good enough to be a grad student now?
AntiFA: An abbreviation for Anti First Amendment.
The Great Worm, in its day, took down a far larger percentage of the Internet than ILOVEYOU or any of its ilk. We clamour for something to be done to those authors, who clearly have caused billions of dollars of loss, but look on older crackers with these weird rose-colored eyeglasses.
Read spaf's published analysis of the Great Worm sometime. (It was written a few days after the event.) The maliciousness was all there; fortunately, RTM was half-incompetent. Chunks of the code didn't even work and it still wiped out most of the net.
You cannot apply a technological solution to a sociological problem. (Edwards' Law)
scubaduba, interesting interview. I see some of the same themes that he's talked about in the past. He is quite concerned about the effects of technology on the average person which he discusses in some detail in the interview linked below.
Here's an interview with Eugene Spafford in two parts that outlines a lot of the issues that he's concerned with. It provides some background and insights into his thinking. I found his views on the purpose of security technology especially interesting and somewhat unexpected. The same goes for his indirect criticism of Microsoft, which speaks to his comment in the Greplaw interview about 'using the right tools for the right jobs.'
Description courtesy of Bruce Schneier's Crypto-gram:
It's a case where our elected representatives and their staff are really trying to understand complex issues and do the right thing.
Incredibly naive for someone of his age.
...what next, GropeLaw?
Funny! It's a wonder nobody else has come up with the idea of fake funny links like that. Kudos.
Don't bother with the mods. They're born stupid so they wouldn't understand what's hilarious about "poking around" on Spaf's personal computer.
A nice interview, but I would be interested to see what Spaf's views are on TCPA.
"Provided by the management for your protection."
Speaking of Spaf pontificating loudly, don't forget to read the "Farewell To Usenet" message he posted back in 1993, defining that it was the end of an era for Usenet because he was bored with it.
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
Damn kids coming in wanting to borrow my damn stapler. They're worse than stray dogs.
Okay, I got Linux installed. So where's the free beer everyone keeps talking about??
It seems that people are calling "bullshit" on this and claiming the AC is a troll, which is understandable.
I've got to say, though, I agree with AC. Spaf's a dick. "In short a net.nazi" is a PERFECT description of Spaf. Now I haven't had to deal with him for a long time, and maybe he's changed for the better. I certainly hope so; but, if this AC's impressions of Spaf were formed around the same time as mine were, then I can understand where the poster is coming from.
So, no, I don't find this post to be a troll. He may be wrong in thinking that Spaf is pro-DMCA, but the Spaf I've spoken with was most certainly not an open-minded guy who "actively encourages responsible exploration" as others here have claimed.
Sig (appended to the end of comments you post, 120 chars)
What is more important to you as a researcher?
Recognition (and possible prosecution)?...Or the public at large which will benefit more from your findings than the companies would if such findings were suppressed by the DMCA.
'Beale Screamer' and 'the RC4 divulger' did this sort of stuff the right way. To this day, nobody knows who they are. Surely, their efforts will be remembered long after people like Dmitry Sklyarov, who was punished publicly for his efforts, are relegated to the dustbin of history....
"It's unpleasantly like being drunk."
"What's so unpleasant about being drunk?"
"Ask a glass of water that sometime..."