Slashdot Mirror
Interview with Eugene Spafford
scubacuda writes "Dr. Eugene 'Spaf' Spafford, security expert and professor of Computer Science at Purdue University, talks with Greplaw about what drove him to the computer security field, what it's like to testify before the White House and Congressional committees on information security and public policy, and how legislating technology is 'bad law.' For you budding legal geeks interested in forensics, technology, law, and ethics, Spaf has provided a reading list."
I saw him recently in a conference. He talked about how we all need as americans to make sure we know how to stand in the menace of the actual "orwellian" (his words) government policies.
He sure knows his stuff and is a great source of inspiration for all of us.
A message from the system administrator: 'I've upped my priority. Now up yours.'
Define "like."
True story.
It's great how the interviewer opens up the topic of virii and Spafford replies quite clearly that virii are not things he studies and that he can give references to other experts if the interviewer so wishes. Then the interviewer just plows ahead trying to make out like virii are the key problem in computer security.
At least Spafford was a good sport and continued doing his best to try to bring all of the subsequent virus questions back into the umbrella of computer security.
I have been pwned because my
Technology typically finds its own solutions to problems, which makes many laws incredible nuisances, stifling innovation.
It's also worth noting that of the 3 UNIX worms he mentions, one, the RTM worm, hit long before it was fashionable to spread things in Windows. The architecture not only permitted it, the holes had been around for ages.
Interesting that Spaf said RTM should be jailed for unleashing that worm. If he had been, would he be an MIT professor now?
Mencken had it right. So glad that's old news.
Overall, an article worth reading. Two things I found worth noting. First, the "false convenience" metaphor in
I thought was an excellent way to characterise the arguments often raised when such things as user education, simple point-and-click interfaces, administration costs, etc. are the topics of discussion. Also, when asked, the response is notably diplomatic: but then goes on to mention:In reading your post, it becomes obvious that you dont have any clue what your talking about, I will give you a brief portion of his testimoney before congress on July 24th 2003.
More recently, provisions of the Digital Millennium Copyright Act (DMCA) have led to faculty being threatened with lawsuits for publishing their security research, and some faculty (Fred Cohen and myself included) have decided to curtail or stop our research in some areas of security because of the potential for us to be arrested or sued. This is particularly true in the area of software threats -- the very same tools and techniques necessary to reverse-engineer and protect against malicious software are seen as a threat by many in the entertainment and content provision industries. Legislation against technology instead of against infringing behavior can only hurt our progress in securing the infrastructure.
Fire in the hands of the village idiot is no tool, but a weapon of mass destruction
Great! Now I can find all the tech law websites I want with one simple command:
cat internet | egrep -i gr[:vowel:][:explosive\ consonant:]law
Which reminds me, I really wish multi-character atoms would work with reg-ex. The spec calls for them, but they haven't worked in any implementation I've used.