Category Archives: Poetry

I’m a Climate Scientist

Scientists at the University of New South Wales have been tuning their models to interpret temperature, rainfall and soil condition variables. They want you to know that global warming leads to extreme weather conditions in the South Pacific region:

Denialists deny
This in your dreams
’cause climate change means
Greater extremes,
Shit won’t be the norm
Heatwaves
Bigger badder storms
“The Green house effect
is just a theory, sucker”
Yeah so is gravity
Float away motha’ f**cker

“Quit Coal” Painted on Fisk Smokestack

I often talk about the need for quick response to threats to critical infrastructure but here’s a video of Greenpeace climbers who took a long time to scale a 455 ft smokestack at a power plant in Chicago and paint it with giant letters: “QUIT COAL”

FOX News reports that the sign is related to a protest movement to regulate urban emissions.

Studies indicate that Chicago has the highest concentration of people in the country living near coal-fired power plants.

The Chicago City Council for the past year has been discussing an ordinance for clean energy generation sponsored by Alderman Daniel Solis.

The ordinance would obligate Fisk and Crawford to substitute natural gas for coal.

In addition, it would subject other polluting plants around Pilsen and Little Village to strict emission controls.

The proposed ordinance establishes that if a facility has a quarterly emissions average exceeding federal and state limits, it must suspend its operations until pollution controls are installed to bring it into compliance with those standards.

Will the Fisk plant just paint over the QUIT at the top?

Easy to turn the protest sign right back into a COAL message — no QUIT — although the publicity of climbers getting arrested is still a factor.

Had they painted SUSPEND OPERATIONS UNTIL POLLUTION CONTROLS ARE INSTALLED it would have left behind a sign much harder to convert or paint over (and even better publicity from a more sophisticated and impressive attack). Painting over SUSPEND OPERATIONS UNTIL would leave the smokestack with POLLUTION CONTROLS ARE INSTALLED…

L4.verified: A Formally Correct Operating System Kernel

The L4.verified project has a beautifully written introduction. They eloquently argue (a good sign for their code) that it is possible to eliminate risk from specific areas of development.

Imagine your company is commissioning a new vending software. Imagine you write down in a contract precisely what the software is supposed to do. And then — it does. Always. And the developers can prove it to you — with an actual mathematical machine-checked proof.

Sounds to me like they’re making the case for compliance. It’s not just a check-list, it’s proof of something.

I have presented this in terms of cloud at conferences for the past few years and tried to make it clear but I have to give kudos to the L4.verified author: Their explanation is tight.

Here’s my spin on things:

  • When someone says to themselves they are secure, they are done.
  • When someone says they are secure to someone else, they then have to prove their statement and show the intervals of confidence (e.g. tests and error rate or deviation).

This is the difference between security and compliance. The latter requires proof with peer review. L4.verified says they can prove security through an automation system — compliance by design.

…the issue of software security and reliability is bigger than just the software itself and involves more than developers making implementation mistakes. In the contract, you might have said something you didn’t mean (if you are in a relationship, you might have come across that problem). Or you might have meant something you didn’t say and the proof is therefore based on assumptions that don’t apply to your situation. Or you haven’t thought of everything you need (ever went shopping?). In these cases, there will still be problems, but at least you know where the problem is not: with the developers. Eliminating the whole issue of implementation mistakes would be a huge step towards more reliable and more secure systems.

Sounds like science fiction?

The L4.verified project demonstrates that such contracts and proofs can be done for real-world software.

It looks something like this:

The goal of L4.verified apparently is to build a system of proof that a machine can handle on its own.

If this reminds you of “The number 42” or “I’m sorry Dave, I’m afraid I can’t do that“, then you obviously have been reading too much science fiction.

The machines will have to be able to handle these three tasks to be successful:

  1. Pose a correct audit question
  2. Answer within a reasonable time
  3. Prove that the answer is reliable

This translates directly into the future of audits, especially in cloud. Simplification and atomisation coupled with verification is a great model for security, but even better for compliance.

I will discuss this in more detail tonight at Cloud Camp, Silicon Valley at the IBM Innovation Center.