Slashdot Mirror
Interview with Eugene Spafford
scubacuda writes "Dr. Eugene 'Spaf' Spafford, security expert and professor of Computer Science at Purdue University, talks with Greplaw about what drove him to the computer security field, what it's like to testify before the White House and Congressional committees on information security and public policy, and how legislating technology is 'bad law.' For you budding legal geeks interested in forensics, technology, law, and ethics, Spaf has provided a reading list."
I saw him recently in a conference. He talked about how we all need as americans to make sure we know how to stand in the menace of the actual "orwellian" (his words) government policies.
He sure knows his stuff and is a great source of inspiration for all of us.
A message from the system administrator: 'I've upped my priority. Now up yours.'
Define "like."
True story.
It's great how the interviewer opens up the topic of virii and Spafford replies quite clearly that virii are not things he studies and that he can give references to other experts if the interviewer so wishes. Then the interviewer just plows ahead trying to make out like virii are the key problem in computer security.
At least Spafford was a good sport and continued doing his best to try to bring all of the subsequent virus questions back into the umbrella of computer security.
I have been pwned because my
Technology typically finds its own solutions to problems, which makes many laws incredible nuisances, stifling innovation.
I think he is good for the same reason. Hackers, in the cracker sense do deserve large amounts of jail time. If you steal a CD, your fined more than the $30 retail value. You contribute to the worms and viruses which ruin many new computer users internet experiences, take down websites, etc. you deserve big time and fines.
Help Fight SPAM today!
It's also worth noting that of the 3 UNIX worms he mentions, one, the RTM worm, hit long before it was fashionable to spread things in Windows. The architecture not only permitted it, the holes had been around for ages.
Interesting that Spaf said RTM should be jailed for unleashing that worm. If he had been, would he be an MIT professor now?
Mencken had it right. So glad that's old news.
If he's so smart, why couldn't he think up a better nickname? I rest my case.
Take it from me, he isn't like that, and yes I had him guest lecture in my Ethics in Computing (PHIL 590?) class so don't say I don't know what the hell I'm talking about; unfortunately he hasn't taught CS426 in a long time :(
I really dont know anything about Spaf, but i think that i read somewhere once, that back in the day ( late 80's early 90's ) his personal machine at MIT or Purdue or where ever he was at the time got hacked fairly badly ..
.. ???
anyone have any memories of this ??
or am i just have a bad Acid Flash back
For those of you interested, CERIAS is actually a pretty impressive research group. One of the PhD students is teaching our cs426 class right now, and it's one of the few CS classes I've taken where I'm actually learning practical knowledge about computer security.
Go Boilers!
ce n'est pas un Sig.
Overall, an article worth reading. Two things I found worth noting. First, the "false convenience" metaphor in
I thought was an excellent way to characterise the arguments often raised when such things as user education, simple point-and-click interfaces, administration costs, etc. are the topics of discussion. Also, when asked, the response is notably diplomatic: but then goes on to mention:In reading your post, it becomes obvious that you dont have any clue what your talking about, I will give you a brief portion of his testimoney before congress on July 24th 2003.
More recently, provisions of the Digital Millennium Copyright Act (DMCA) have led to faculty being threatened with lawsuits for publishing their security research, and some faculty (Fred Cohen and myself included) have decided to curtail or stop our research in some areas of security because of the potential for us to be arrested or sued. This is particularly true in the area of software threats -- the very same tools and techniques necessary to reverse-engineer and protect against malicious software are seen as a threat by many in the entertainment and content provision industries. Legislation against technology instead of against infringing behavior can only hurt our progress in securing the infrastructure.
Fire in the hands of the village idiot is no tool, but a weapon of mass destruction
rot13
"If you think you have things under control, you're not going fast enough." --Mario Andretti
Great! Now I can find all the tech law websites I want with one simple command:
cat internet | egrep -i gr[:vowel:][:explosive\ consonant:]law
Which reminds me, I really wish multi-character atoms would work with reg-ex. The spec calls for them, but they haven't worked in any implementation I've used.
He's quite the story teller and can relate one to almost every security issue there is. His class was the kind where you almost didn't realize you were learning until it was too late - the final comes and you ask yourself how you learned all the answers.
It was even interesting to see who he lined up as a guest lecturer each time he had to fly to Washington to brief the Government on something. They all had some weird story about security lapses somewhere important.
It's boring but what the hell....
I graduated from Purdue undergrad ECE in '02 and with the job market the way it was back then I knew I'd go to grad school. I had picked up a big interest in infosec my last year there so I emailed Spaf about opportunities in grad school. As soon as he found out I was a lowly Computer Engineer he basically said I shouldn't bother.
So I ended up at Carnegie Mellon instead, and I just finished my MS in Information Networking with a focus on security, I even got to write a Mandatory Access Control system for Linux for my thesis.... Hey Gene? Am I up good enough to be a grad student now?
AntiFA: An abbreviation for Anti First Amendment.
scubaduba, interesting interview. I see some of the same themes that he's talked about in the past. He is quite concerned about the effects of technology on the average person which he discusses in some detail in the interview linked below.
Here's an interview with Eugene Spafford in two parts that outlines a lot of the issues that he's concerned with. It provides some background and insights into his thinking. I found his views on the purpose of security technology especially interesting and somewhat unexpected. The same goes for his indirect criticism of Microsoft, which speaks to his comment in the Greplaw interview about 'using the right tools for the right jobs.'
Description courtesy of Bruce Schneier's Crypto-gram:
Speaking of Spaf pontificating loudly, don't forget to read the "Farewell To Usenet" message he posted back in 1993, defining that it was the end of an era for Usenet because he was bored with it.
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak