Objects can be serialized and the result looks like a file.
More generally, everything is a namespace/filesystem.
Yep. There's a very close connection between objects, dictionaries, relational tables, files/filesystems, and functions - all centred around binary relations, a fairly well-understood mathematical object - which seems well worth exploring. However, there haven't been (to my knowledge) many languages which attempt to explore this connection at a fundamental level.
Here's a suggestion: we could fairly simply extend S-expressions so they allow for multiple lists or atoms after the dot in a dotted pair. This would allow us to represent binary relations in a simple syntax that reduces to an ordinary list in the case of a relation containing only one row. You end up then with a very low-level but powerful data model which both simplifies and extends the 'array' and 'object' structures in today's scripting languages (eg JSON), and SQL tables, and which has nice mathematical properties: for example, you can union and intersect these relations as you would sets, which is an operation which is undefined on objects or dictionaries. We can also do Cartesian product which is an extension of list appending, _and_ a corresponding Cartesian divide which corresponds to a key-value lookup.
From here, we just need to extend this with a semantics for function evaluation to interpret relations as functions and allow for infinite-sized, recursive computed relations. Which gets a bit tricker, but if we got this, we could represent, say, the entire Internet as a filesystem. Would that be useful?
But a stream of bytes is inherently too low an abstraction to build everything on.
How about taking it just one step forward to a stream of streams? Then we could at least create object-like structures but with minimal overhead. Plus, it would be a fully recursive definition that would lend itself to virtualisation.
Eventually you have to talk to highly interactive hardware with massively parallel threads
What does parallelism have to do with anything? The only argument against everything's-a-file is overhead, not complexity.
Exactly. I'd like to see more exploration of something like Kahn process networks as a fundamental programming abstraction; it seems to me that we need to be thinking of programs, filesystems and networks as examples of the same thing. Our networks are becoming software-defined (especially in virtualisation), our chipsets are compiled from languages like VHDL, our programs are becoming parallelised, and our filesystems are starting to grow virtual nodes and do processing. Seems dumb to be maintaining multiple completely separate families of languages and tools each with their own subtle incompatibilities and bugs when we could settle on just one and work all the bugs out once, then use it forever.
Then "the hack stage" is the state of the world when you're operating at any significant scale.
And that's why every week we have reports of major data centers being hacked. This is not a sustainable course for the global Internet. Eventually, people are going to die from infosec disasters. (In drone warfare, they already have, but that's also a political problem.)
Yes, we'll always have bugs. But we have to get to the point where we have zero tolerance for _preventable_ bugs, such as machine code level crashes. Raw x86 code is simply too unsafe to run at any speed on the Internet; it gives no fundamental guarantees about separation of memory space. At the very least, we need managed languages with an extremely tiny, simple, provably correct kernel that make it mathematically impossible for one process to smash its stack or corrupt another's heap. We've had solutions for decades; microkernels like L4, languages like Erlang, Haskell and D. We can replace failed, non-securable syntaxes like raw ASCII SQL queries with nested list structures that don't suffer from quote-escaping vulnerabilities. We simply refuse to develop and deploy these solutions, because of no better reason than laziness, institutional inertia and a sense of "it's not my problem if my program is not provably secure". Wrong. It's everybody's Net, and that means it's everybody's problem.
As an industry, we're at the stage where medicine was before the discovery of antiseptic surgery. We have no fundamental data hygiene in our execution environments. We kill as much as we cure. This has to change.
This is an incredibly basic problem in multiprocess systems. It's like saying IF your computer crashes and needs to be restarted... in a datacenter, it's a matter of WHEN.
Except that in today's hostile Internet, WHEN that broken Internet-facing process crashes it WILL be because it was pwned by shellcode, and if that process had write access to core files, your entire server is now rooted. If that process also had any read or write credentials to your local network, your entire data center possibly just got rooted also.
Are you _really_ saying that the appropriate thing to do in that situation is to simply restart the process and continue? You'd be better to flash-wipe and reinstall at least the entire server node, and probably also change all your internal administration passwords. Otherwise, you're an infosec disaster waiting to happen.
You're fighting a full-scale hot cyberwar out there, don't forget. It's no longer 1970. You don't have the luxury of trusting that incoming packets come from universities and defense contractors with administrators you can chew out with a phone call when they misconfigure stuff by accident. NSA owns the wires and your packets come direct from the Russian Mafia and Syrian Electronic Army.
It's not a hack, because machines are NEVER perfect.
It's totally a hack, and _because_ machines are never perfect you'd better be 150% certain that every single step in your error-recovery process is double and triple checked and accounts for every possible side-effect of executing evil x86 machine code with root permissions.
Look, we both agree that Murphy rules. And you're right to say 'because random stuff happens, I need an overseeing process to automatically fix it'. But auto-restarting pwned services is not that fix, anymore, and it really hasn't been since 1999.
This is the type of government organization that hires groups like RATFOR as security consultants.
They outsourced security to a Fortran 66 preprocessor? Well that explains why my Linksys router is currently trying to crack Minuteman silo launch codes.
We're living through the biggest security and privacy disaster in the Internet's short history. We don't yet understand the full dimensions of the damage, but we understand this: it was almost entirely preventable. Inexcusably shoddy software workmanship, defended with exactly the argument you're making, is what caused this.
We won't progress as an industry until we learn the meaning of "first do no harm". First, deploy no root exploits to your customers. Then we can talk about efficiency, productivity, market forces, and what colour the fifth pixel from the left on the splash screen should be.
Software development is just about the only industry where perfection is expected.
And required.
There's also nuclear reactor design, unexploded ordnance disposal, and fugu restaurants which are almost as unforgiving as the development of mass-deployed Internet-connected software.
Hell, back in the 80's it was common for kids under 10 to teach themselves how to program.
Yes, exactly. I was there, I was that age. I remember how it was.
Of course, the ROM-based 8-bit micros we bashed out 10 PRINT "INSERT NAME HERE RULES": GOTO 10 on weren't nearly as scary as a toxic HTML5/Javascript/PHP/MySQL soup of SQL injections and root vulnerabilities running on a three-tier Web platform. It was our parents who were scared of "breaking the computer" while we reassured them that no, a misplaced comma wasn't going to drain their bank account and launch the NATO missile arsenal, and a 'crash' just meant we had to hit the power switch. And we mostly just coded BASIC so we could get games running. But it was fun, and we learned a *lot* more than you do with Facebook and a Playstation.
Things are a lot different now. I wish we did have coding environments half as safe and clean as a Commodore 64 or Atari 800. In fact, growing up in the 80s taught me a lot I had to unlearn when the Internet came along; for years it never occurred to me that commercial software could be so fault-riddled and plain dangerous to operate as Windows was. After all, I'd used machines with 8,192 *bytes* of RAM that were solid, stable, and just didn't crash unless you physically tripped over the power button. Your machine was totally air-gapped, totally safe, and could be reset to factory defaults instantly. And that was an environment where you could try anything and learn. It was intoxicating, ike having wings under your brain.
But now... no, now we've built the Matrix we had nightmares about in the 1980s. Not the space-opera Wachowski Matrix; the Gibson Matrix, all neon and chrome and happy smiling avatars on the outside, and a horror show of broken crypto and corporate greed inside. And hacking has become as stupidly easy as downloading a rootkit and clicking 'go'. And there's no guarantee that your hard drive controller or your building HVAC server aren't under the control of the NSA or the Mafia.
the systematic "burning" of Cold War nuclear weapons as commercial fuel to light the very cities they once threatened.
Admittedly WWIII would also have lit the cities extremely well... for a couple of microseconds.
I think the generation who grew up after the 1980s don't really grasp just how intensely we 80s kids felt the shadow of nuclear war. You can't really understand 80s culture without that; it seeps into almost every part of art and culture from 1980-1989, especially New Wave music. Climate change and the War on Terror combined? They don't even begin to approach a fraction of the existential certainty of absolute destruction we felt. (Though we had both back then too; watch 1973's "Soylent Green" and you'll see global warming as part of the backdrop). And the relief at WWIII being postponed when the Wall fell... quickly turning to disgust as capitalism ate everything...
That right there is everything you need to know about Generation X and why we feel so burned out on life. But, hey, alive after twenty, and not expecting to be, and every day we don't have a nuclear apocalypse is a good day. And every nuclear warhead destroyed and turned into toxic but not explosive nuclear fuel is a win.
But the nukes are still there, and the missiles are being repurposed as 'conventional' warheads, and that's sure going to end well for all concerned. Before, identifying nuclear attack was easy: an unscheduled ICBM launch means you push the button. Under Prompt Global Strike, how do you tell if an incoming ICBM signature is a nuke warhead or a conventional warhead? You don't. You guess. That's.... nice.
So, the Doomsday clock is still relevant and I for one am glad it's there. To remind us all of what once was, the shadow we lived under, and the shadow that still hasn't completely gone away.
I think the most compelling part of Google Glass is the first-person recording.
Isn't that also the part which everyone else considers an unacceptable privacy intrusion? Someone coming up to you wearing Glass might as well be holding a sign saying "hi, I'm going to record this conversation without your permission and post hilarious videos of you on social media! Do you want to 1) run away, 2) put on your Oculus Rift as a privacy shield, or 3) skip the preliminaries and punch me right now?"
No, I find the libraries break the filesystem model entirely. They are folder-like entities which aren't folders if you browse via cmd or Powershell, don't have paths associated, can't be enumerated via the standard API, but 'exist' in some half-defined sense only for Explorer.
How do you script writing a file into a library? How do you script renaming a library? How do you configure a corporate application so it installs into a library? How do you write a script to backup your files out of a library when it doesn't even have nameable path? When you write a file to a library, how do you find where it really wrote to? How do you identify where a file you read out of a library is really coming from?
Now, if they'd added the underlying Library concepts (a folder which is a union of multiple read-only and read-write source folders) into the filesystem, at the appropriate level, then I would have been cautiously supportive. It would probably still be a breaking change, but would break far less and integrate into the system automation level well. But as it is...
When a lot of these systems were placed in the open, the entire thought of exploiting them was pretty much non existent.
Only "non-existent" to people who weren't thinking and weren't paying attention to the literature. There had been a LOT of academic warnings back to the 1970s about the potential security problems of interconnected networks. Heck, the entire genre of cyberpunk science fiction in the 1980s - Neuromancer was 1984 - didn't come out of thin are but was based around the then-current academic discussions of the security problems of the early Internet. The first IBM PC virus was 1986, the Morris Worm was 1988, pretty late in the game.
Yes, it wasn't headline gossip-reality-show news like it is today - but industrial control designers? In the 1990s? Nope, there's no excuse. They were definitely in a position to know, should they have bothered to care.
Ideally, miners should be responsible and move to another pool to avoid the 51% attack possibility.
Ah, so exactly like how large corporations don't ever try to destroy their competitors, industries never injure the environment, financial bubbles don't form, and organised crime simply doesn't exist, Bitcoin miners can always be counted on to altruistically pass up an opportunity for massive temporary personal gain in order to enrich the wider community?
I like this principled Libertarian machine you've built here.
Ah, so we are ok with Karl Rove outing of Valerie Plame now?
Yeah, pretty much. At the time her CIA identity was "revealed", didn't she drive every day to the CIA Langley headquarters to work and park in a CIA parking place? And had been doing so since 1997? I'm not entirely sure, but if I were a foreign intelligence agency, that little slip might just have tipped me off that she might have been a CIA officer even before Rove announced it.
I was raising my eyebrows at the time and thought "this seems like an incredibly tiny thing to be all more-patriotic-than-thou about and will rebound badly on the Democrats when the next military-industrial complex whistleblower comes along".
Slashdot Mirror
I do hope to God that they don't remake "Forbidden Planet" though...
Of course it will happen. But in these liberal times it will be retitled "Permitted Planet".
Objects can be serialized and the result looks like a file.
More generally, everything is a namespace/filesystem.
Yep. There's a very close connection between objects, dictionaries, relational tables, files/filesystems, and functions - all centred around binary relations, a fairly well-understood mathematical object - which seems well worth exploring. However, there haven't been (to my knowledge) many languages which attempt to explore this connection at a fundamental level.
Here's a suggestion: we could fairly simply extend S-expressions so they allow for multiple lists or atoms after the dot in a dotted pair. This would allow us to represent binary relations in a simple syntax that reduces to an ordinary list in the case of a relation containing only one row. You end up then with a very low-level but powerful data model which both simplifies and extends the 'array' and 'object' structures in today's scripting languages (eg JSON), and SQL tables, and which has nice mathematical properties: for example, you can union and intersect these relations as you would sets, which is an operation which is undefined on objects or dictionaries. We can also do Cartesian product which is an extension of list appending, _and_ a corresponding Cartesian divide which corresponds to a key-value lookup.
From here, we just need to extend this with a semantics for function evaluation to interpret relations as functions and allow for infinite-sized, recursive computed relations. Which gets a bit tricker, but if we got this, we could represent, say, the entire Internet as a filesystem. Would that be useful?
But a stream of bytes is inherently too low an abstraction to build everything on.
How about taking it just one step forward to a stream of streams? Then we could at least create object-like structures but with minimal overhead. Plus, it would be a fully recursive definition that would lend itself to virtualisation.
Of course, S-expressions are only 56 years old so such a radical proposal isn't likely to be adopted any time soon.
Eventually you have to talk to highly interactive hardware with massively parallel threads
What does parallelism have to do with anything? The only argument against everything's-a-file is overhead, not complexity.
Exactly. I'd like to see more exploration of something like Kahn process networks as a fundamental programming abstraction; it seems to me that we need to be thinking of programs, filesystems and networks as examples of the same thing. Our networks are becoming software-defined (especially in virtualisation), our chipsets are compiled from languages like VHDL, our programs are becoming parallelised, and our filesystems are starting to grow virtual nodes and do processing. Seems dumb to be maintaining multiple completely separate families of languages and tools each with their own subtle incompatibilities and bugs when we could settle on just one and work all the bugs out once, then use it forever.
I suspect that between various BSDs and Linux versions that the concept of everything being a file has pretty much reached its logical endpoint.
Not even close, unless you're thinking about Plan 9.
A truly 'everything is a file' Unix would implement BSD sockets and X11 windows as files, just for a start. Can you do that on Linux yet?
Then "the hack stage" is the state of the world when you're operating at any significant scale.
And that's why every week we have reports of major data centers being hacked. This is not a sustainable course for the global Internet. Eventually, people are going to die from infosec disasters. (In drone warfare, they already have, but that's also a political problem.)
Yes, we'll always have bugs. But we have to get to the point where we have zero tolerance for _preventable_ bugs, such as machine code level crashes. Raw x86 code is simply too unsafe to run at any speed on the Internet; it gives no fundamental guarantees about separation of memory space. At the very least, we need managed languages with an extremely tiny, simple, provably correct kernel that make it mathematically impossible for one process to smash its stack or corrupt another's heap. We've had solutions for decades; microkernels like L4, languages like Erlang, Haskell and D. We can replace failed, non-securable syntaxes like raw ASCII SQL queries with nested list structures that don't suffer from quote-escaping vulnerabilities. We simply refuse to develop and deploy these solutions, because of no better reason than laziness, institutional inertia and a sense of "it's not my problem if my program is not provably secure". Wrong. It's everybody's Net, and that means it's everybody's problem.
As an industry, we're at the stage where medicine was before the discovery of antiseptic surgery. We have no fundamental data hygiene in our execution environments. We kill as much as we cure. This has to change.
This is an incredibly basic problem in multiprocess systems. It's like saying IF your computer crashes and needs to be restarted... in a datacenter, it's a matter of WHEN.
Except that in today's hostile Internet, WHEN that broken Internet-facing process crashes it WILL be because it was pwned by shellcode, and if that process had write access to core files, your entire server is now rooted. If that process also had any read or write credentials to your local network, your entire data center possibly just got rooted also.
Are you _really_ saying that the appropriate thing to do in that situation is to simply restart the process and continue? You'd be better to flash-wipe and reinstall at least the entire server node, and probably also change all your internal administration passwords. Otherwise, you're an infosec disaster waiting to happen.
You're fighting a full-scale hot cyberwar out there, don't forget. It's no longer 1970. You don't have the luxury of trusting that incoming packets come from universities and defense contractors with administrators you can chew out with a phone call when they misconfigure stuff by accident. NSA owns the wires and your packets come direct from the Russian Mafia and Syrian Electronic Army.
It's not a hack, because machines are NEVER perfect.
It's totally a hack, and _because_ machines are never perfect you'd better be 150% certain that every single step in your error-recovery process is double and triple checked and accounts for every possible side-effect of executing evil x86 machine code with root permissions.
Look, we both agree that Murphy rules. And you're right to say 'because random stuff happens, I need an overseeing process to automatically fix it'. But auto-restarting pwned services is not that fix, anymore, and it really hasn't been since 1999.
This is the type of government organization that hires groups like RATFOR as security consultants.
They outsourced security to a Fortran 66 preprocessor? Well that explains why my Linksys router is currently trying to crack Minuteman silo launch codes.
What is a spectacular crash in software? ... Software just doesn't fail that catastrophically
Wut.
Oh yes it does. If you don't realise that Internet security is already a catastrophe then I just don't... you really really need to get out more.
We're living through the biggest security and privacy disaster in the Internet's short history. We don't yet understand the full dimensions of the damage, but we understand this: it was almost entirely preventable. Inexcusably shoddy software workmanship, defended with exactly the argument you're making, is what caused this.
We won't progress as an industry until we learn the meaning of "first do no harm". First, deploy no root exploits to your customers. Then we can talk about efficiency, productivity, market forces, and what colour the fifth pixel from the left on the splash screen should be.
Software development is just about the only industry where perfection is expected.
And required.
There's also nuclear reactor design, unexploded ordnance disposal, and fugu restaurants which are almost as unforgiving as the development of mass-deployed Internet-connected software.
Almost.
Hell, back in the 80's it was common for kids under 10 to teach themselves how to program.
Yes, exactly. I was there, I was that age. I remember how it was.
Of course, the ROM-based 8-bit micros we bashed out 10 PRINT "INSERT NAME HERE RULES": GOTO 10 on weren't nearly as scary as a toxic HTML5/Javascript/PHP/MySQL soup of SQL injections and root vulnerabilities running on a three-tier Web platform. It was our parents who were scared of "breaking the computer" while we reassured them that no, a misplaced comma wasn't going to drain their bank account and launch the NATO missile arsenal, and a 'crash' just meant we had to hit the power switch. And we mostly just coded BASIC so we could get games running. But it was fun, and we learned a *lot* more than you do with Facebook and a Playstation.
Things are a lot different now. I wish we did have coding environments half as safe and clean as a Commodore 64 or Atari 800. In fact, growing up in the 80s taught me a lot I had to unlearn when the Internet came along; for years it never occurred to me that commercial software could be so fault-riddled and plain dangerous to operate as Windows was. After all, I'd used machines with 8,192 *bytes* of RAM that were solid, stable, and just didn't crash unless you physically tripped over the power button. Your machine was totally air-gapped, totally safe, and could be reset to factory defaults instantly. And that was an environment where you could try anything and learn. It was intoxicating, ike having wings under your brain.
But now... no, now we've built the Matrix we had nightmares about in the 1980s. Not the space-opera Wachowski Matrix; the Gibson Matrix, all neon and chrome and happy smiling avatars on the outside, and a horror show of broken crypto and corporate greed inside. And hacking has become as stupidly easy as downloading a rootkit and clicking 'go'. And there's no guarantee that your hard drive controller or your building HVAC server aren't under the control of the NSA or the Mafia.
Good luck, guys.
If you actually didn't know what you were doing and they tasked you to accomplish something?
Then presumably you could get a good job as a security reviewer for Adobe or Oracle.
"Exploit, exploit, exploit, exploit, Flash, Java, exploit and exploit. That's not got much exploits in it."
Anyone seen any mentions of safe nuclear power technologies?
You mean like those 'inherently safe' pebble bed reactors?
I'm sure they're around somewhere. Hey, a flying unipig! Don't see many of those these days.
unless AI research has gotten a lot darker since I last looked at it?
Well, Amazon now have drones, and Google just bought a home automation company... and a few months ago Google had their name linked to a Lockheed fusion project...
the systematic "burning" of Cold War nuclear weapons as commercial fuel to light the very cities they once threatened.
Admittedly WWIII would also have lit the cities extremely well... for a couple of microseconds.
I think the generation who grew up after the 1980s don't really grasp just how intensely we 80s kids felt the shadow of nuclear war. You can't really understand 80s culture without that; it seeps into almost every part of art and culture from 1980-1989, especially New Wave music. Climate change and the War on Terror combined? They don't even begin to approach a fraction of the existential certainty of absolute destruction we felt. (Though we had both back then too; watch 1973's "Soylent Green" and you'll see global warming as part of the backdrop). And the relief at WWIII being postponed when the Wall fell... quickly turning to disgust as capitalism ate everything...
"I wanted to run through the street yelling, to grab them all and say: 'Every day from this day on is a gift. Use it well!' Instead, I got drunk."
That right there is everything you need to know about Generation X and why we feel so burned out on life. But, hey, alive after twenty, and not expecting to be, and every day we don't have a nuclear apocalypse is a good day. And every nuclear warhead destroyed and turned into toxic but not explosive nuclear fuel is a win.
But the nukes are still there, and the missiles are being repurposed as 'conventional' warheads, and that's sure going to end well for all concerned. Before, identifying nuclear attack was easy: an unscheduled ICBM launch means you push the button. Under Prompt Global Strike, how do you tell if an incoming ICBM signature is a nuke warhead or a conventional warhead? You don't. You guess. That's.... nice.
So, the Doomsday clock is still relevant and I for one am glad it's there. To remind us all of what once was, the shadow we lived under, and the shadow that still hasn't completely gone away.
The whole "doomsday" metric is stupid.
I prefer the Kerr metric myself, but I suppose you could say anything with an event horizon is pretty much doomsday...
I think the most compelling part of Google Glass is the first-person recording.
Isn't that also the part which everyone else considers an unacceptable privacy intrusion? Someone coming up to you wearing Glass might as well be holding a sign saying "hi, I'm going to record this conversation without your permission and post hilarious videos of you on social media! Do you want to 1) run away, 2) put on your Oculus Rift as a privacy shield, or 3) skip the preliminaries and punch me right now?"
Do you find the libraries weird?
No, I find the libraries break the filesystem model entirely. They are folder-like entities which aren't folders if you browse via cmd or Powershell, don't have paths associated, can't be enumerated via the standard API, but 'exist' in some half-defined sense only for Explorer.
How do you script writing a file into a library? How do you script renaming a library? How do you configure a corporate application so it installs into a library? How do you write a script to backup your files out of a library when it doesn't even have nameable path? When you write a file to a library, how do you find where it really wrote to? How do you identify where a file you read out of a library is really coming from?
Now, if they'd added the underlying Library concepts (a folder which is a union of multiple read-only and read-write source folders) into the filesystem, at the appropriate level, then I would have been cautiously supportive. It would probably still be a breaking change, but would break far less and integrate into the system automation level well. But as it is...
When a lot of these systems were placed in the open, the entire thought of exploiting them was pretty much non existent.
Only "non-existent" to people who weren't thinking and weren't paying attention to the literature. There had been a LOT of academic warnings back to the 1970s about the potential security problems of interconnected networks. Heck, the entire genre of cyberpunk science fiction in the 1980s - Neuromancer was 1984 - didn't come out of thin are but was based around the then-current academic discussions of the security problems of the early Internet. The first IBM PC virus was 1986, the Morris Worm was 1988, pretty late in the game.
Yes, it wasn't headline gossip-reality-show news like it is today - but industrial control designers? In the 1990s? Nope, there's no excuse. They were definitely in a position to know, should they have bothered to care.
Ideally, miners should be responsible and move to another pool to avoid the 51% attack possibility.
Ah, so exactly like how large corporations don't ever try to destroy their competitors, industries never injure the environment, financial bubbles don't form, and organised crime simply doesn't exist, Bitcoin miners can always be counted on to altruistically pass up an opportunity for massive temporary personal gain in order to enrich the wider community?
I like this principled Libertarian machine you've built here.
A robot, conversely, would always do what its master tells it, regardless of whether the master says, "go pick some daisies," or "go commit genocide."
ORDER RECEIVED: Pick daisies.
TARGET LOCATED: Daisy lawn, municipal park.
WEAPON SELECTED: BLU-82B ammonium nitrate/aluminium tactical thermobaric device "Daisy cutter"
EVALUATION: Commander will be so pleased.
Although at the moment it looks like we (USA! USA!) will be the ones using them.
Well, you'll at least be the ones turning them on...
fowl foreign policy
I blame the chickenhawks for this.
Snowden has an agenda.
It's worse than that - I hear he has a quorum and takes minutes, too.
Why do people of a certain political stripe use that word as if it's an insult? Is Roberts Rules of Order the new Protocols of Zion, or something?
Ah, so we are ok with Karl Rove outing of Valerie Plame now?
Yeah, pretty much. At the time her CIA identity was "revealed", didn't she drive every day to the CIA Langley headquarters to work and park in a CIA parking place? And had been doing so since 1997? I'm not entirely sure, but if I were a foreign intelligence agency, that little slip might just have tipped me off that she might have been a CIA officer even before Rove announced it.
I was raising my eyebrows at the time and thought "this seems like an incredibly tiny thing to be all more-patriotic-than-thou about and will rebound badly on the Democrats when the next military-industrial complex whistleblower comes along".
And here we are.