<?xml version="1.0" encoding="UTF-8"?>
<opml version="1.0">
  <head>
    <title>cmdln.net_2007-11-18</title>
    <expansionState>0,1,9,10,21,37,38,56,63,67,74,78,87,92,98,106,120,121,129,137,138,146</expansionState>
  </head>
  <body>
    <outline text="Intro" Offset="00:17">
      <outline text="Creatively tapped out">
        <outline text="Small tech companies thrive on creative"/>
        <outline text="If you aren't growing, changing, then you are beaten by competitor who are"/>
        <outline text="Pushing out a new product next year, in the midst of that development"/>
        <outline text="Powers that be are already moving on to what features, developments are next"/>
        <outline text="I have been pulling back from work, trying to preserve a better balance"/>
        <outline text="Still don't feel like I have much energy, creativity left for myself"/>
        <outline text="Not sure what the answer is, yet, just trying to understand the problem"/>
      </outline>
    </outline>
    <outline text="Security Alerts" Offset="07:14">
      <outline text="More fine grained, flexible security permissions in Linux" Offset="07:34">
        <outline text="http://www.oreillynet.com/onlamp/blog/2007/11/policykit_looser_limitations_t.html?CMP=OTC-6YE827253101&amp;ATT=PolicyKit+looser+limitations+tighter+security+for+Linux+applications"/>
        <outline text="New tool for authorization, included in Fedora 8, PolicyKit"/>
        <outline text="Similar to Authorization Services under OS X"/>
        <outline text="Enforced by the operating system but not limited to the kernel"/>
        <outline text="A flexible framework all applications, services can use"/>
        <outline text="Allows privilege escalation, can prompt for user authentication, like Authorization Services"/>
        <outline text="Re-uses much of what is already there, e.g. PAM and HAL"/>
        <outline text="Adds notion of subject, action and target which existing components don't share"/>
        <outline text="Should make security management, use easier under Linux"/>
        <outline text="That should result in more, better security"/>
      </outline>
      <outline text="Potential backdoor in part of new NIST PRNG standard" Offset="09:31">
        <outline text="http://www.schneier.com/blog/archives/2007/11/the_strange_sto.html"/>
        <outline text="Like AES and forthcoming AHS, NISt released PRNG standard"/>
        <outline text="Random numbers critical to security algorithms, making keys and parameters hard to guess"/>
        <outline text="Four recommended algorithms"/>
        <outline text="One, based on elliptic curves, apparently came from NSA"/>
        <outline text="Had been shown to have a small bias at time standard was published, appendix provided workaround"/>
        <outline text="Niels Ferguson, Dan Shumow at CRYPTO 2007 showed flaw that could be seen as back door"/>
        <outline text="Basically, a set of arbitrary numbers included in EC algorithm"/>
        <outline text="Another set of numbers can be matched, act like skeleton key"/>
        <outline text="Allow attacker to predict all of the PRNG's output"/>
        <outline text="Don't know this second set of numbers"/>
        <outline text="If an attacker can discover them, though, consequences are huge"/>
        <outline text="Standard does recommend a procedure that stymies this flaw, but is optional"/>
        <outline text="No one knows why the NSA insisted on this algorithms inclusion"/>
        <outline text="Subversion seems unlikely since the standard and its works are public"/>
      </outline>
    </outline>
    <outline text="News" Offset="14:53">
      <outline text="Federal intelligence official begs re-defintion of privacy in pursuit of wiretaps" Offset="15:08">
        <outline text="http://www.cnn.com/2007/POLITICS/11/11/terrorist.surveillance.ap/index.html"/>
        <outline text="Kerr argues privacy should not mean anonymity"/>
        <outline text="Says privacy should mean corporations, government protecting private data"/>
        <outline text="Compares government surveillance to access an ISP worker has"/>
        <outline text="Thinks changing norms around social networking sites justifies less protection of anonymity"/>
        <outline text="EFF correctly calls out the gap in his logic, that voluntary disclosure is not the same thing as surveillance"/>
        <outline text="Opsahl also points out anonymity is a critical aspect of free, political speech"/>
        <outline text="Constitution says protection from search, seizure is one of our rights"/>
        <outline text="This in the context of NSA wiretaps, bill to legalize"/>
        <outline text="Argument is that if one end of communications is outside US, then a weaker standard should apply"/>
        <outline text="Foreign surveillance had such a standard, FISA court"/>
        <outline text="The bill seems to be arguing for an even weaker standard"/>
        <outline text="Most controversial aspect is immunizing telcos from suits for violating effective standards"/>
        <outline text="Doesn't seem like there's a great deal of support"/>
        <outline text="Norms cannot be changed directly"/>
        <outline text="Congress should consider regulating market or applying other pressures, constraints"/>
        <outline text="If they cannot reason out how to do so, then they have to work with existing norms"/>
        <outline text="Schneier on Kerr">
          <outline text="http://www.schneier.com/blog/archives/2007/11/redefining_priv.html"/>
          <outline text="Links to transcript of the speech"/>
          <outline text="Points out that you cannot easily separate privacy, anonymity and security"/>
          <outline text="Concedes Kerr's remarks are more nuanced than credited"/>
          <outline text="Admittedly, Kerr admits t wanting to preserve privacy"/>
          <outline text="Light on what that means when he definitely wants to eliminate anonymity"/>
        </outline>
      </outline>
      <outline text="Details of OLPC mesh network" Offset="21:22">
        <outline text="http://www.oreillynet.com/onlamp/blog/2007/11/mesh_networks_on_olpc_its_all_1.html"/>
        <outline text="Focus is on application"/>
        <outline text="Not surprisingly, OLPC is about what recipients will be able to do with meshes, not just on the technology for its own sake"/>
        <outline text="Applications can be writing to take better advantage of network">
          <outline text="Using asynchronous messaging instead of synchronous procedure calls"/>
          <outline text="Any such message could be re-written to transparently use the network"/>
          <outline text="Cache consistency, sharing apps have to synchronize so they have consistent local views of each other's data"/>
          <outline text="Discovery and presence, finding each other on the network to do work"/>
          <outline text="Implemented their own, rather than using Zeroconf"/>
          <outline text="OLPC's discovery includes application awareness"/>
        </outline>
        <outline text="Asks whether this model makes sense more generally">
          <outline text="Sounds similar, actually, to the way a lot of Apple applications work"/>
          <outline text="Leverage Zeroconf for discovery"/>
          <outline text="More dependent on each application for discovery, but focus is on ease of collaboration"/>
        </outline>
        <outline text="Mentions past issues of scaling meshes">
          <outline text="Problems seem to be well solved, though"/>
          <outline text="Mentions adoption of a similar scaling trick, super nodes, that P2P has used"/>
          <outline text="Super nodes act as aggregators, making broadcast more efficient"/>
        </outline>
        <outline text="Another perception of mesh is that centralized networks are better, mentions transition between mesh and DSL on Czech Republic"/>
        <outline text="Received wisdom is mesh and P2P relieve strain on server but spread more load onto network itself"/>
        <outline text="OLPC mesh work may have applicability even in developed nations, though, where ad hoc is key or gaps in traditional access"/>
        <outline text="Has some updates, at the end, which are consistent with Paul's remarks"/>
        <outline text="Mesh is still under very active development, many promising new ideas, implementations"/>
      </outline>
      <outline text="Cipher challenge with Colossus for new computing museum" Offset="27:28">
        <outline text="http://rss.slashdot.org/~r/slashdot/eqWf/~3/184268346/article.pl"/>
        <outline text="UK's National Museum of Computing has rebuilt a Colossus"/>
        <outline text="World's first programmable digital computer"/>
        <outline text="Used at Bletchley Park during WWII to decipher German messages"/>
        <outline text="To commemorate, holding a special code breaking challenge">
          <outline text="Two groups of amateur code breakers"/>
          <outline text="Encrypted messages using period German cipher machine, transmitted from Germany and intercepted at Bletchley"/>
          <outline text="One team will use modern PCs, the other the Colossus replica"/>
        </outline>
        <outline text="TNMoC also building a facility at and to preserve Bletchley"/>
        <outline text="Original machines were completely dismantled, the restoration was painstaking"/>
        <outline text="Colossus challenge won">
          <outline text="http://go.theregister.com/feed/www.theregister.co.uk/2007/11/16/german_code_breaker_defeats_colossus/"/>
          <outline text="Teams at Bletchley, Paderborn using period radio equipment, too"/>
          <outline text="Had difficulties with interference, extended period of just trying to get messages"/>
          <outline text="Amateur code breaker, Joachim Shcuth, in Germany intercepted, as well"/>
          <outline text="Cracked the most heavily encrypted of the three messages, two hours before teams at Bletchley"/>
          <outline text="Officially acknowledged by challenge coordinators at TNMoC"/>
          <outline text="Wrote his specialist software in Ada"/>
        </outline>
      </outline>
      <outline text="Blowable interface" Offset="30:14">
        <outline text="http://www.makezine.com/blog/archive/2007/11/blowable_computer_interfa.html?CMP=OTC-0D6B48984890"/>
        <outline text="Research at GA Tech"/>
        <outline text="Link is to a short research paper"/>
        <outline text="Motivation was supplemental input as well as for accessibility"/>
        <outline text="Designed around existing commodity systems, in particular laptops which typically include a single mic"/>
        <outline text="Alternative to voice recognition, gaze tracking"/>
        <outline text="Call their software BLUI, Blowable and Localizable User Interaction"/>
        <outline text="Key is their processing with a single mic that can tell at which part of the screen the user is blowing"/>
        <outline text="Previous work was simpler, detected just if user was blowing"/>
        <outline text="Generates a generic event stream, like typical mouse drivers"/>
        <outline text="Applications would not necessarily need to be aware of BLUI"/>
        <outline text="Good detail in the paper but still very readable"/>
        <outline text="Examples of interaction, not just the algorithm for localizing the blowing"/>
      </outline>
    </outline>
    <outline text="tail -f" Offset="33:21">
      <outline text="Label chief owns up to DRM mistake">
        <outline text="http://feeds.engadget.com/~r/weblogsinc/engadget/~3/185215512/"/>
        <outline text="Bronfman to wireless carriers"/>
        <outline text="Advised not to go to war with customers"/>
        <outline text="Admits that label's behavior in the past was unwise"/>
        <outline text="Characterizes refusal to change business model, directly address customer needs as &quot;war&quot;"/>
        <outline text="Points out packaging at iTunes as positive example, urges carriers to learn from iTunes"/>
        <outline text="Same person who made stink over pricing within iTunes, wanting variable per track"/>
      </outline>
      <outline text="Latest on Google 700MHz bid">
        <outline text="http://feeds.wired.com/~r/wired/topheadlines/~3/185976096/google-to-go-it.html"/>
        <outline text="Google's original interested assumed to be done with partners, other tech companies interested in spectrum"/>
        <outline text="Now sources are saying Google will bid on its own"/>
        <outline text="May also bid on other spectrum blocks, once not required to be open though may be limited in other ways"/>
        <outline text="Google has apparently hired game theorists to help formulate its strategy"/>
        <outline text="Seems pretty serious about its commitment to open wireless if some sort"/>
        <outline text="Many are speculating this may involve Android, be a voice and data play competitive with wireless carriers"/>
      </outline>
    </outline>
    <outline text="Outro">
      <outline text="Contact me">
        <outline text="Email to feedback@thecommandline.net"/>
        <outline text="Web site at http://thecommandline.net/"/>
        <outline text="IM to command.line@skype"/>
        <outline text="Listener comment line is 360-252-7284"/>
        <outline text="del.icio.us tag is &quot;for:cmdln&quot;"/>
        <outline text="http://twitter.com/cmdln"/>
      </outline>
      <outline text="I'd like to thank libsyn.com for AAC hosting and Wouter de Bie for MP3 hosting"/>
      <outline text="These notes and the show audio and music are covered by a Creative Commons license">
        <outline text="http://creativecommons.org/licenses/by-nc-sa/3.0/us/"/>
        <outline text="Attribution, non-commercial, share alike"/>
      </outline>
    </outline>
  </body>
</opml>
