Category Archives: Security

Will Engineers Save the Network?

Lindsay Hill has posted a lament about change called “Will Engineers Hold Networking Back?

I’m sure anyone that’s used CiscoWorks over the last decade has been incredibly frustrated with it at times. I have heard it’s better now, although I can’t personally verify that. So engineers tried doing things with CiscoWorks in 2003 and it was buggy, so they gave up and went back to their PuTTY terminal. And they never looked back to see what might have changed in the meantime. Well, maybe it’s time we looked again. No, we won’t find all the tools ready now – but maybe we’ll be able to see a future, and we’ll be able to demand solutions from our vendors.

In short, he throws onto the table the proverbial question of how established societies should manage transition to new technology, procedures and skills. Can engineers see a future and get on board with it?

Who does he think created the last future? Que the change management consultants.

But seriously this reminds me of moments in my life when I have tried to explain change in technology. For example in 1992 I stayed up all night alone in the computer lab at college. Why? I was hard at work, downloading less than a minute of video from George of the Jungle.

Today it seems inconceivable I was alone with rooms full of unused computers; but in the early 1990s not many people seemed to care about sixteen idling processors with dedicated connections. To me it was like winning the lottery. I just needed to find a good use.

It was fairly easy to find video on the Internet through Gopher but it was a challenge and novelty to download a media segment to a tiny storage device over thin lines and then get it to play aloud.

The moment of true change came when Professor Green walked into the lab and asked me for my homework. He always came in early, cup of hot coffee in hand, to turn the lights on and get the lab ready for the day. He gave me a look of disappointment and I wondered if it was obvious I hadn’t slept in days.

I tried to distract him by sitting up and saying with excitement “look at the future, soon we ALL will be downloading video and watching the news from around the world over the Internet! CNN, MTV, everything! Watch this video…” He glared and shook his head and said “just do your f#^ng homework.”

Maybe it would have been different if I had downloaded something other than George of the Jungle. A 10 second segment of a 1960s cartoon wasn’t the best example to support my argument.

Alas, I did my homework. And I wrote for him a mock grant proposal to study the effects of teaching rural communities using the Internet and video. It was based on my own experience leaving a rural part of America to access better education. I wanted to test whether the Internet might help make that problem go away; if it worked in America, maybe America could make it work overseas and then it was just a short step before we’d be watching news video over the Internet!

Professor Green gave me an A- on the paper, which I barely remember the details of now. SPSS was involved somehow. The paper was probably filed away just as another shard of evidence that I could pass a milestone set by management. What I really remember were his words to me when we both stared into the face of change.

Why didn’t we both see the same thing? It is tempting to say it was an age disparity, or a training gap. Those are the usual suspects in discussions about why people resist change. He was a well-respected expert and into his later years. Why would he alter course and take a chance on spending time with some new-fangled experiments? The risk was high for him versus projects he had underway.

And therein lies the answer. Change has risk. There are those who take risks (knowingly or naively) and those who don’t. It’s a phenomenon that has been studied extensively and there are entire bookshelves of libraries filled with social and cultural theories. But in network engineering it’s fairly simple (ask me sometime about spice trades in the 1600s).

Bringing it back to Lindsay Hill’s lament, the answer is not binary. We should not settle with a yes or a no. Some engineers embrace risk and therefore are open to change. They even find other people who take risk to support them on the principle of making a large return on investment. However others do not embrace change so easily because they want to minimize risk. The world needs both and it is unreasonable to expect everyone to be the same.

And with all that in mind, here’s a video from Plexxi that gives a hilarious view of some of the challenges today in network management. They’re a new company you should definitely keep an eye on if you are interested in change.

We aim to resolve two major issues in the network—network automation and network scale—by leveraging the concept of affinities (the complete set of data center resources required to execute a given workload).

Eat More Possum

I just noticed the popular southern phrase “Eat More Possum” is referenced in a legal analysis of the Chick-fil-A “Eat Mor Chikin” claims against “Eat More Kale“.

Here you can watch Jerry Jeff Walker sing it in 1984, at 1:50

The punk band Antiseen of Charlotte, North Carolina published an entire album called Eat More Possum in March 1993 with a cover image of a dead and bloody possum on asphalt.

Ironic, no? Who saw Antiseen?

That means it was not long after this Antiseen Eat More Possum album was publicly released, and many years after the phrase “eat more…” had been in common use, that Chik-fil-A hired a $1 billion dollar ad agency who suggested they say “Eat Mor Chikin”.

To put it another way, that same ad agency first tried to copy a phrase from the Simpsons.

Source: The Untold Story…

And thus an ad agency might have then thought using an already common phrase in America, seen on an album and in recordings pre-dating the billboards, was unlikely to be uncovered by a client in 1995. Or more likely they preferred lots of prior use, given how they copied the Simpsons too (and Don’t Have a Cow also is an old phrase).

Today the prior art is more easily found, but it really was never hard to find in the first place.

Bicycle Power

Bicycle advocates keep coming up with creative ways to show the virtues of two wheeled transportation. Here’s a nice video from Africa:

As I’ve mentioned before here, here and here the concept is inexpensive, resilient, convenient, efficient…what’s not to like? My only complaint with the video is how little it emphasizes the opportunity for innovation in safety for the riders. I had a similar issue with the South Sudan study of two-wheeled ambulances.

I guess highlighting safety features on two-wheels in Africa is about as likely as mentioning seat belts in a video about the uber-functional and fun Fiat Panda. I’ve driven a Panda under water in rivers and up the steepest slippery slopes with no problem. No wonder the police in the Alps are known to use a Panda to chase suspects. Hmm, somehow that sounds wrong… It is a brilliant design that has been proven in Africa but you just know a video of it wouldn’t highlight the safety features.

Incidentally, speaking of Fiat did you know the new Jeep will be based on the Panda? I never thought I’d see the day when 4×4 products in the U.S. would be designed by Europeans based on a market study of Africa. Then again, I didn’t expect Americans in 4×4 to adopt piercings, tattoos and scarification as beautification. Are bicycles the next rural adaptation in America to follow African trends? Stranger things have already happened.

CVE-2012-3586: Basho Riak API, Security Alert

On June 14th a comment on Github asked Basho about validation in their API

The riak http api for map reduce doesn’t check if the content-type is application/json. The javascript http api also lets the user execute arbitrary code on the server. These two coupled together allow a malicious web page to execute arbitrary code on a users machine if they are running the riak http api. I’m not sure if this is a bug or not but there should be a warning that if you are running riak http api then you should be very careful about the sites you visit.

About a week later on June 20th Basho announced a security alert

We are releasing both a security patch (for Riak versions 1.0.3 and 1.1.2) and a full 1.1.4 security release. We advise all users of Riak to either apply the appropriate patch or upgrade to 1.1.4. If you are running a version of Riak other than 1.0.3 or 1.1.2, it will be necessary to upgrade to 1.1.4.

[…]

Additional information about the exploit will be released in the next few weeks.