Category Archives: Security

Hi-tech Attack Sub Exposed

All the latest technology and training in the world was apparently no match for the shallow waters near Skye. The BBC says the Royal Navy’s newest, biggest and most powerful attack submarine — the HMS Astute — has run aground and exposed itself.

Aside from attack capabilities, it is able to sit in waters off the coast undetected, delivering the UK’s special forces where needed or even listening to mobile phone conversations.

Unless, of course, it runs aground. Well, at least out of those three capabilities they can still listen to phone conversations.

There is some chance the mistake is related to a new “platform management system”.

Speaking to the BBC last month, HMS Astute’s commanding officer, Commander Andy Coles, said: “We have a brand new method of controlling the submarine, which is by platform management system, rather than the old conventional way of doing everything of using your hands.

“This is all fly-by-wire technology including only an auto pilot rather than a steering column.”

Auto pilot? Every auto pilot I ever have used at sea has failed. The phrase also brings to mind the Exxon Valdez disaster, which was related to late night maneuvers outside the shipping lane while on autopilot.

Some interesting trivia about the HMS Astute can be found on Marine Buzz:

  1. Longer than 10 London buses
  2. Wider than 4 London buses
  3. Consumes 18,000 sausages every 10 weeks*, yet only has five toilets for 98 crew
  4. Produces oxygen from sea water and can purify the on-board atmosphere (see #3)

*approximately 2.623 sausages per crew member every day

Just when you thought stone and feet were confusing, now they have a London bus metric — 1/10 the size of the new class of attack submarine, and 1/4 the width. The next time a bus is late it will be hard not to say “maybe it ran aground”.

The Royal Navy boasts about their sub technology in the following video:

“We are something different. Something for the 21st Century.”

Making Security Usable

Maybe my sense of humor needs an upgrade, but I find this amusing. The School of Computer Science, Carnegie Mellon University, has a page called Technical Report Abstracts. The top of this page has the following details:

CMU-CS-04-135

Making Security Usable

Alma Whitten

May 2004

Ph.D. Thesis

Unavailable Electronically

The last line could be anything from a real warning to a really dry piece of comedy.

Whatever it is meant to convey, Alma Whitten (Google’s privacy chief) has conveniently made usable her thesis on errors (made it available electronically). Let us hope it was not by error.

US Court Bans Use of Encryption

A US court has ruled a teen is not allowed to use encryption. TechDirt reports:

“[The accused] shall not use a computer that contains any encryption, hacking, cracking, scanning, keystroke monitoring, security testing, steganography, Trojan or virus software.” […] As for the oddities in banning him from using computers with viruses, trojans or keystroke monitors, which he could potentially violate without even knowing it, the court changed the terms to say that he can’t knowingly use a computer with any of those things on it. Unfortunately, they still include “encryption” on the list. I find it troubling that the court is okay with demonizing encryption (and, to a lesser extent, “hacking” tools) when there are plenty of legitimate reasons to do so. Does that mean he can’t even encrypt his email?

On the question of encryption for email, it goes back to the phrase: “shall not use a computer that contains”. It seems to me he can have his email encrypted unknowingly (e.g. as part of a service). More to the point the court should have been more clear with their term “use”. They could have qualified it with terms like “inappropriate”, “malicious”, “harmful”, etc. but instead their terms seem overly broad in leaving it open to ANY and ALL forms of use.

The obvious example of how this fails is the password. There is unlikely to be any way for the accused to prevent his password from being encrypted on any computer he uses. It also makes little sense for the court to rule that he must store all his passwords in clear text, thus placing him at much greater risk of harm.

Another example is HTTPS. He will use encryption on his computer every time he is redirected to a secure page. A secure connection is out of his control. Like the harm point made above with passwords it also makes no sense for the court to order him to transmit everything in the clear, especially as this violates other laws that require services to encrypt his sensitive data.

Apple Lags in Innovation

Scott Bradner writes in Network World that Apple is “still pushing industry forward”. This is a misleading title. His actual review is far from glowing and gives no evidence of a push. First example:

I did not find any of the sample features [in OS X 10.7 Lion] all that compelling, although the OS X App Store is likely to make finding, buying and installing good Mac applications a lot easier.

Not all that compelling. I agree. Linux distributions do a fine job finding and installing good applications with ease. Apple is playing catch up to Debian’s apt, SuSE’s YaST or RedHat’s RPM for example.

Moving on to the second example:

I have not bought an iPod because I, as a Unix geek, want to have an accessible operating system on my computers. (But, for full disclosure, my wife wants an iPod for Christmas — and she is likely to get one.)

I read this as Apple has announced it may bring unix to the iPod. Pushing the industry? Unix access to the iPhone/iPod was enabled by Ubuntu almost two years ago. It’s about time Apple opened up and gave their own version of full-featured unix integration to the i/Pad/Pod/Phone.

Bradner’s third and final example:

The final segment of the Apple/Jobs show was the introduction of the next generation of the MacBook Air. I wrote about the original MacBook Air when it was announced almost two years ago (Apple’s MacBook Air: evolution, not revolution). I bought one at the time and upgraded to the second generation when that was announced. The Air has been an almost perfect travel and presentation machine for me and I have had no second thoughts about not getting a “real,” in the opinion of some pundits at the time, computer.

Hmmm, well I guess it is news to most people that the Air was an near identical copy of the Panasonic Toughbook CF-W5.

The W5 was released September 12, 2006 while the Apple MacBook Air was announced on January 15, 2008. The W5, although nearly two years earlier, came with numerous advantages over the Air.

The W5 is 2.9 lbs, while the Air is 3.0 lbs. Keep that in mind when you find the W5 includes a built-in optical drive under the keyboard as well as all the usual SD, PCcard, USB and VGA ports. The Air has only one USB port — not even an Ethernet port is included. A W5 gave 6.5 hours of run-time standard but could run for 8 hours easily. OS X on the Air only manages 4 hours.

The W5 even has drain-holes in the keyboard in case you spill liquid on it. Innovative.

Few have heard of the great engineering at Panasonic and instead think Apple did something innovative with the Air. The real story is that Apple incorporated the W5’s design; maybe chip-for-chip it is what really lives inside an Air.

Panasonic has since updated the W5 several times.

February of 2009 they announced a W8 would ship with the Intel X-25M 80GB SSD. This brought the weight down another 15 grams. The W8 runs a Core 2 Duo SU9400 1.40 GHz processor and supports 4GB DDR2 SDRAM.

What year is it now?

Apple’s new Air announcement for early 2011 is that their new Air (MC505LL/A) will come with an SSD, run the Core 2 Duo SU9400 1.40 GHz processor, and support up to 4GB of memory.

Just to be clear, Jobs announced his company will in 2011 sell the same form-factor, hard drive, processor, and memory as the 2009 version of Panasonic’s W8.

This is why I say Apple lags in innovation. Nothing really wrong with their follow-the-leader strategy. Fashion works much the same. It is not who came up with the idea but who sells the most copies that gets the lion’s share (pun not intended) of the stage. I just can not help but point out where the ideas are really coming from. That is why I do not see Apple as an industry leader, especially in innovation. To be fair they have led GUI innovation some of the time, but even there they struggle to stay ahead of Linux.

Go buy a new Panasonic Toughbook W-series with Linux, in other words, and you can show fans of Apple what they will hear announced two years from now.