Showing posts with label hacktivism. Show all posts
Showing posts with label hacktivism. Show all posts

Wednesday, August 22, 2012

Gary McKinnon is no enemy of the state

Gary McKinnon
Gary McKinnon outside the Royal Courts of Justice in London. Photograph: John D Mchugh/AFP/Getty Images

A final decision on whether computer hacker Gary McKinnon is to be extradited to the United States is now imminent. Behind the scenes, a battle is apparently under way between politicians and officials over what the outcome should be. There may be much else to occupy the government at the moment, but it is vital that this matter of principle is not sidelined.

More than a decade has passed since a self-styled computer nerd, working out of a bedroom in north London, started trawling through the computer systems of Nasa and the US defence department in search of information about UFOs. He left behind some rude messages about the systems' sloppy security and was arrested by British police. In all that time, no evidence has been advanced by the US prosecuting authorities that any harm – beyond the cost of installing better computer security – has resulted from McKinnon's activities.

Had he been prosecuted in the UK, as he should have been at the time, the whole matter would have been forgotten. McKinnon, who has since been diagnosed with Asperger's syndrome, would have served a mild, possibly suspended, sentence. As it is, his case now presents the government with a test of ethics.

"Gary McKinnon has been hung out to dry by a British government desperate to appease its American counterparts" – the words of Nick Clegg, while still in opposition. "Gary McKinnon is a vulnerable young man and I see no compassion in sending him thousands of miles away from his home and loved ones to stand trial. If he has questions to answer, there is a clear argument to be made that he should answer them in a British court," is what David Cameron said before he became prime minister. Fine words. They should both now make clear to home secretary Theresa May that she would have their full and public backing, despite what her officials may tell her, if she announces that McKinnon is not to be hauled off to the US.

The failure to deal with the case has already taken its toll on him, and the latest psychiatric assessment, made in April this year, places him at "extreme" risk of suicide if extradited. "Gary has lost 10 years of his youth," his mother, Janis, said on Monday. "A young man who cycled, swam, composed music and sang, now sits in the dark with his cats and never wants to see or speak to anyone."

Cameron, to his credit, has raised the case with President Obama on at least two occasions. The latter indicated that he would be content with whatever decision the British government were to make. It has long been clear that there is little real clamour in the US for McKinnon to be sent there for trial. Whether that relaxed attitude would change if Mitt Romney was to win the presidential election in November is another matter. For this reason, it is important that the British government acts now.

McKinnon's MP, David Burrowes, has hit on a novel way to resolve the issue by attaching it to the diamond jubilee celebrations. He wants the Queen to consider using her prerogative of mercy to ensure justice is served. The government should consider that doing the right thing will have only favourable consequences for them. A decision to allow the extradition would haunt them all the way, through trials and imprisonment, to the next election. The case of Gary McKinnon is a clear instance of a vulnerable individual being targeted by an overwhelmingly powerful force. With this in mind, it is time for Theresa May to reassert the rights of the citizen and to stand up to the bullying threats from the other side of the Atlantic.

http://www.guardian.co.uk/commentisfree/2012/jun/04/gary-mckinnon-extradition...

Freegaryavi

Posted from DailyDDoSe

Tuesday, August 21, 2012

No Extradition for Gary McKinnon

The Hanged Man: Gary McKinnon from a Tarot Perspective

I have often thought of Gary McKinnon as a real-life representation of the twelfth card in the Tarot, ‘The Hanged Man’. Below are a couple of examples from two very well-known Tarot decks, the Rider Waite and the Morgan-Greer.

Take a look at these two cards. A man is hanging upside down; his face is relaxed; his posture, with his arms held behind his back could be that of someone just waiting, without a care in the world, if the man was standing up. 

It is clear that this is not a man who is being hung, as a form of execution, but rather a man who is suspended, waiting.

Gary McKinnon has been waiting for a decision on his fate for almost 10 years now. He was a young man when he was caught hacking into the Pentagon’s unsecured computers, and he is now 45 years old. During the past 10 years, he has been suspended in limbo, while the most prolonged, drawn-out, Bleak House-style legal proceedings have been under way. Because of his deteriorating mental health, Gary has made very few public appearances in recent times; he has given up control over his destiny and handed it over to his mother, Janis Sharp, who is the face of the campaign to grant him a U.K. trial

The Hanged Man is tied to a wooden frame which is made of Rods (also referred to as Wands, which are the suit of ‘action’); therefore, he is tied to the action that he cannot control. The clouds in the background of the Morgan Greer card represent the air, the high concepts of justice of liberty that are being discussed while the subject hangs, still.

The twelfth card in the Tarot is even more relevant to Gary McKinnon’s life when one looks at the cards that precede it and that follow. Card No. 11 is “Justice”; card no. 13 is “Death” (which, in the traditional Tarot de Marseille, is actually referred to as “The Arcane with No Name”). Justice initiated the process; in the name of ‘Justice’ Gary was arrested and in the name of ‘Justice’ the USA demanded his extradition; but even the ‘crime’ itself was triggered in a - probably misguided - pursuit of justice, as Gary was scanning the US defence computers in search of UFO technology that allegedly would solve the global shortage of fossil fuels.

“Death” is the end of this process, the end of hanging, a final conclusion. The end, in other words, is near. But what will “The End” mean for Gary McKinnon? What will be of this man when the final verdict is read out in court, when the final credits roll?

Even assuming a positive outcome - a U.K. trial, or a complete acquittal - there will be no walking into the sunset for Gary. His supporters will be celebrating, but he will have to re-adjust to standing up rather than hanging; his ankles will have been cut through to the flesh by the rope he has been hanging from for the last 10 years. Blood will rush from his head down to his feet. He will be unsteady on his legs. After ten years of being The Hanged Man, Gary McKinnon will have to learn how to walk all over again. 

Posted from DailyDDoSe

Sunday, July 1, 2012

Reality Bytes: CyberBusted 12/21/2010 Posted on Firetown.com

CyberBusted 12/21/2010 Posted on Firetown.com

FIRETOWN-- THIS IS YOU! I HOPE YOU ALL APPRECIATE THAT I WENT OUT ON A FUCKING LIMB TO PROTECT THE INTEGRITY OF THIS FORUM, BUT I WOULD LIKE AN APOLOGY FROM THE ADMINISTRATOR(S) OF THIS "CLOSED GROUP" AS TO WHY NOBODY RESPONDED [EXCEPT FROMMES- AND HE CAUSED EVEN MORE OF A MESS BY SUPPORTING YOU!]

@firetown URGENT log out of all accounts and change your pass... on Twitpic

MIKE-- I'M CALLING IT AS I SEE IT. IF YOU RUN THIS FORUM THAN YOU HAVE AN OBLIGATION TO PROTECT IT AND EACH OF US FOR SUPPORTING YOU BY GIVING US A SAFE PLACE TO SHARE IDEAS.


NOTICE THIS IS YOUR ACCOUNT THAT WAS HACKED ALONG WITH MINE.
ARE YOU A BLACK SHEEP OR A ASLEEP AT THE WHEEL? YOU HAD THE ABILITY TO CLEAR MY NAME AND PUT AN END TO THIS SITUATION BEFORE IT ESCALATED TO THIS POINT.SO, WHEN I AM BEING ACCUSED OF SOMETHING UNETHICAL AND ILLEGAL AND YOU HAVE THE ABILITY NOT ONLY CLEAR MY NAME BUT TO CONFIRM THAT YOU ALSO HAVE EVIDENCE TO PUT AN END TO DISINFO AGENTS AND PROVOCATEURS THEN YOU OWE IT TO EACH AND EVERY ONE OF US TO COME FORWARD.

I EXPECT YOU TO DO SOMETHING AND DO IT QUICKLY. REMOVE ANYONE WHO THREATENS THE SAFETY AND INTEGRITY OF THIS FORUM.

WHO IS GUARDING YOUR HOUSE TONIGHT? I HAVE BEEN ON WATCH NOW FOR WAY TOO FUCKING LONG WITH NO END IN SIGHT.

"FIRST THEY CAME FOR THE JEWS?"

WRONG!

FIRST THEY CAME FOR THE COMMUNISTS! [REF: NIEMOLLER]

WAKE THE FUCK UP.
HOW WOULD YOU FEEL IF YOU WERE ACCUSED OF NOT ONLY A CRIME, BUT BEING UNETHICAL AND DISLOYAL TO YOUR FOLLOWERS - WHICH BTW, YOU WERE!

WELL GUESS WHAT? I STEPPED UP FOR YOU AND YOU BETTER STEP UP TO THE FUCKING PLATE FOR THE REST OF US. WHEN DID YOU TURN INTO A GREY SHEEP? WAKE THE FUCK UP AND GET YOUR SHIT TOGETHER.

GET YOUR SHIT AND MY SHIT OUT OF THIS MESS BEFORE WE ALL GO DOWN WITH THIS SINKING SHIP.

I HAVE PAID DEARLY FOR BEING SO OUTSPOKEN AND DEDICATED IN MY SEARCH TO FIND A PLACE WHERE WE CAN CELEBRATE INDIVIDUAL FREEDOMS FREE FROM REPRESSIVE GOVERNMENT AND TOXIC PEOPLE.

I WOULD REALLY APPRECIATE A FUCKING ANSWER AS TO WHY WE ALLOW THIS KIND OF BULLSHIT TO CONTINUE? DON'T YOU GET IT... DIVIDE AND CONQUER.  [REF: COINTELPRO]

DIVIDED WE FAIL. 

FACE IT WE ARE NOT ON ANIMAL FARM-- WE ARE ON PLANET FUCKING PLUTO WHERE WE ARE TOO BUSY WATCHING THE MICKEY MOUSE CLUB INSTEAD OF OUR CHILDREN. [REF: THE CORPORATION]

WE ARE NOT ALL CREATED EQUAL. SOME ARE MORE EQUAL THAN OTHERS.  [REF: ORWELL, ANIMAL FARM]

SO WHEN I AM SENDING AN SOS FROM WHATEVER PLATFORM... THAN I DESERVE THE COURTESY OF SOMEONE TRYING TO DELIVER THE MESSAGE IN A LANGUAGE OR FORMAT THEY CAN UNDERSTAND. AND, TRYING TO SHOW SOME SUPPORT IN A LANGUAGE OR FORMAT THAT I CAN UNDERSTAND. [REF: #ONE]

#911 IS THE SAME IN EVERY LANGUAGE. #thatisall

NOTICE THIS IS YOUR ACCOUNT THAT WAS HACKED ALONG WITH MINE. SO, WHEN I AM BEING ACCUSED OF SOMETHING UNETHICAL AND ILLEGAL AND YOU HAVE THE ABILITY TO BOTH CLEAR MY NAME AND PUT AN END TO THE SITUATION I EXPECT YOU DO IT AND QUICKLY REMOVE ANYONE WHO THE MEMBERS OF THIS FORUM.

WHO IS GUARDING YOUR HOUSE TONIGHT? PUT AN END TO DISINFO AGENTS AND PROVOCATEURS.

IF YOU WON'T DO IT FOR ME, DO IT FOR YOURSELF. IF NOT FOR YOURSELF THEN DO IT FOR THE WORLD. [REF: STEVIE NICKS TIMESPACE]

#911 IS THE SAME IN EVERY LANGUAGE. #thatisall

see for yourself!

no response. none.

Posted from DailyDDoSe

Saturday, June 30, 2012

Fake Security Firms Will Be Exposed || CyberWarzone #404

Thursday, June 09, 2011


Boris Sverdlik

Ca292bdd9ad8d8228833ce1f1a44a052

UPDATE: BlackbergSecurity is NOT A DEFENSE CONTRACTOR according to E-VERIFY.

I’d like to preface this again by saying I don’t condone the activities of Lulzsec. I do fall into the crowd of security professionals who Patrick Gray described as secretly loving him. Patrick has written a great piece on the awareness the group has brought to the weaknesses in information security.

I suggest you go out and read it immediately and you’ll see why.

Attrition.org broke a story back in February on how Joe Black has used social media to create his “Security God” image. Needless to say, they debunked the entire image.

Unfortunately, real security guys are the only ones who actually read Attrition, and Joe Black was able to continue in his path to self proclaimed security god.

image

In his efforts to legitimize his site, he has built a reputation around certifications and misinformation. He has a very interesting career, that we can trace back to his days at Wright Printing in 2005 according to his LinkedIn Profile which is also about the time he was supposedly enrolled at ITT in his Bachelors degree program in Omaha.

Calls to ITT have not been returned as of this writing, but Joe did post his associates degree on his flickr page. While we are on the topic of education, his profile also states that he is expecting to complete his Masters in Security Management  at Bellevue University in 2013.

According to the registrar he has withdrawn from every single course he had enrolled in since January of 2009. Guess the worlds greatest hacker, didn’t realize information is public. Oh well.

With his reputation on the line he had called out our neighborhood Lulz maker with the following message on his website:

“Cybersecurity For The 21st Century, Hacking Challenge: Change this website’s homepage picture and win $10K and a position working with Senior Cybersecurity Advisor, Joe Black.”

Guess what happens next?

image

Again, not that I condone any of this, but you know me any chance to prove that security certifications are useless can’t be ignored. Wow, look at all of those interesting certifications on his website.

This guy must be a Security Megastar. Lets see what he has:

image

All can be seen thanks to our brainiac on his Flickr:

  • Project+ COM70010068307772 A+ 1/08
  • Remote Support COMP001006830772 1/09
  • Security+ COMP001006830772 1/08
  • Network+ COMP00100683C772 1/08
  • Linux+ COMP001006830772 2/08
  • CEH ECC926927 09/08CISSP 318010 12/08

What I don’t see is the ISACA CISM & CISA certifications.

Please Joe, if you have them send the numbers my way...

So are we still confident how certifications do not equate to competency? This is just another example of false advertising, and I’m glad it has been brought to light. Black has even used Facebook to advertise his services.

I love his About statement “At Black & Berg Cybersecurity Consulting we leverage our close relationship with the Federal Government to give our small business clients a Cybersecurity posture that equals or exceeds that of the NSA and Department of Defense.”

Wait speaking of his federal contacts he does have a CAGE# on his LinkedIn Profile. Wow, legit eh... EXPIRED.

In closing I’m sure you paper security guys would be more than happy to hire him, real security guys well we don’t find our vendors at bus stops.

image

Cross-posted from Jaded Security


Post Rating:

(Rate this Post)

Comments:


728dce02fbc900cb75609c4660de7bf6
Elyssa Durant The CyberSecurity business is a rapidly growing field.

Recruitment has been fast and furious since the United States became aware that we have a serious problem on our hands.

In that process, many firms are taking on interns to test the aptitude for those who are well suited for intelligence and counterintelligence work.

As Joe Black knows. This is a field where you need to prove your skills, and the only way to truly test them is in the field. From there, you either sink or swim.

In addition, that recruitment process has been untraditional; calling on experts from all walks of life.

As we all know, extraordinary times call for extraordinary measures. We live in extraordinary times and operate under extraordinary measures.

Black & Berg CyberSecurity Consulting, LLC is a new firm and failure is not an option.

I think Joe Black is handling the situation with real class responding to directed questions and placing his credentials out there for the world to see.

Joe Black has surrounded himself with a good team, and that is half the battle. This team will stand by him, until we hear otherwise. Our methods, background and training are diverse and atypical. Our dedication and commitment beyond reproach.

Nobody makes it in this business overnight, but Joe Black has, experienced excellent advisers to support him.

What exactly do we know about Lulzsec other than their desire to wreak havoc on the world wide web and their ability to to launch CyberWarfare on those who "dare" to challenge them?

I always get a chuckle when people make [want] to make the assumption that I attended Columbia Community College as opposed to my "real" alma matter, Columbia University in the City of New York.

If people are desperate to see Ivy League Credentials and a few advanced Masters degrees... just send them my way.

5 days ago
728dce02fbc900cb75609c4660de7bf6
Elyssa Durant megacommunities@blackbergsecurity.us
to elyssa.durant@gmail.com
date Wed, Jun 15, 2011 at 7:22 PM
subject Fwd: About your website defacement/compromise.
Important mainly because of the people in the conversation.

hide details 7:22 PM (1 hour ago)

via e-mail from Joseph Black:

Thought you should see this email that I received.

~Joe


---------- Original Message ----------
From: Victor Vennt
To: Megacommunities@blackbergsecurity.us
Date: June 8, 2011 at 8:44 PM
Subject: About your website defacement/compromise.

To whom it may concern:

I believe that "LulzSec" - The notorious hacking group responsible for recent Sony & FBI hacks may have given themselves away & identified themselves with their recent defacement and compromise of your site.

Last year cryptome.com was similarly compromised by a splinter group of "Anonymous" whom went by the name of "DIDITFORTHELULZ", one of that groups 'tag lines" was "We do it for the lulz", the members of that group were eventually exposed, see:

http://cryptome.org/0002/cryptome-hack4.htm

It is believed in certain circles of "Anonymous", that the ringleader of LulzSec is one Corey "Xyrix" Barnhill, further research may yet provide confirmation of this.

One friend of his, and "notable" member of this group has previously been charged with computer tampering, computer trespass, and criminal possession of computer material for an attack on AOL, see: http://www.infoworld.com/d/security-central/ny-teen-hacks-aol-infects-systems-818.

I hope this information is of some interest to you,

A concerned citizen.

48 minutes ago

Black and Berg Cybersecurity Consulting
Black and Berg Cybersecurity Consulting is an early 21st century response to the United States Senate's request for private sector intervention in order to raise our National security posture.

The US government, business, and civil sectors are working directly with Black & Berg to ensure the success of our aggressive campaign to combat Cyberterrorism. We cannot fail in our mission to secure American Cyberspace with the application of a Megacommunity. For if we do fail, then, we really have no choice but to recommend the hand over of complete control of privately owned systems to the Executive Branch of the United States Government.
0 Topics
0 Posts
No posts

The page you were looking for doesn't exist!

It may have been removed or you may have arrived here by using a bad URL

Try searching for the article you are looking for.
Visit the Homepage to see the most recent stories.
Browse categories and tags to find a related story.
Or try the forum at forum.cyberwarzone.com

blackbergsecurity 0 0 (-) 0 0 0 (-) 6000.

Top users
Rank User News Published Comments Total votes
1 CWZ 398 398 (100%) 4 406 399 (98%) 34403.00
2 Lovely 45 45 (100%) 0 45 45 (100%) 9701.00
3 cybercopsindia 10 10 (100%) 0 10 10 (100%) 7203.00
4 nigroeneveld 0 0 (-) 0 0 0 (-) 6000.00
4 blackbergsecurity 0 0 (-) 0 0 0 (-) 6000.00
6 mgd 3 3 (100%) 0 3 3 (100%) 1198.00
7 vagabondhuman35 1 1 (100%) 0 1 1 (100%) 66.00
7 ArnanRecruiter 1 1 (100%) 0 1 1 (100%) 66.00
9 dvlaho 0 0 (-) 0 0 0 (-) 1.00

http://www.forum.cyberwarzone.com/

http://www.network.cyberwarzone.com/404error.php

http://www.cyberwarzone.com/cyberwarfare/advertising

Posted from DailyDDoSe

Sunday, March 18, 2012

How to Deploy HTTPS Correctly | Electronic Frontier Foundation

How to Deploy HTTPS Correctly

Chris Palmer, 15 Nov 2010

Internet technologists have long known that HTTP is insecure, causing many risks to users. The release of Firesheep made one of these risks concrete and obvious to even non-technical folks.

While HTTPS has long existed as a reasonable way to improve web security, web operators have been slow to host their applications with it. In part, this is because correctly and completely hosting an application with HTTPS takes some care.

This article is designed to help web operators get a conceptual handle on how to protect their users with HTTPS. Taking a little bit of care to protect your users is a reasonable thing for web application providers to do, and a good thing for users to demand.

Background

HTTPS provides three security guarantees:

  1. Server authentication allows the browser and the user to have some confidence that they are talking to the true application server. Without this guarantee, there can be no guarantee of confidentiality or integrity.
  2. Data confidentiality means that eavesdroppers cannot understand the communications between the user’s browser and the web server, because the data is encrypted.
  3. Data integrity means that a network attacker cannot damage or alter the content of the communications between the user’s browser and the web server, because they are validated with a cryptographic message authentication code.

HTTP provides no security guarantees, and applications that use it cannot possibly provide users any security. When using a web application hosted via HTTP, people have no way of knowing whether or not they are talking to the true application server, nor can they be sure attackers have not read or modified communications between the user’s computer and the server.

Modes of Attack and Defense

However users connect to the Internet, there are a variety of people who can attack them—whether spying on them, impersonating them, tampering with their communications, or all three of these. The wifi network operator can do this; any ISP in the path between client and server can do it; anyone who can reconfigure the wifi router or another router can do it; and often, anyone else using the same network can do it, too.

Firesheep is a passive network attack: it eavesdrops on the contents of network communications between browser and server, but does not re-route or modify them.

By contrast, other freely-available tools perform active network attacks, in which the attacker does modify the contents of and/or re-route communications. These tools range from serious, such as sslstrip, to silly, like the Upside-Down-Ternet. Although Upside-Down-Ternet is a funny prank, it is technically identical to potentially more damaging attacks such as an attack that injects malicious code or incorrect information into web pages; at the same time, it shows that such attacks are easy enough to be jokes. Free wifi hotspots have been known to inject advertisements dynamically into web pages that users read—indicating that active network attacks are a viable business model. Tools like Cain and Abel enable a range of attacks, including re-routing local network traffic through the attacker's system. (Also see Arpspoof and dsniff.)

Only a mechanism that provides (at least) authentication, confidentiality, and integrity can defend against the full range of both passive and active attacks. HTTPS is currently our best option for web applications.

However, there are some potential pitfalls that site operators must avoid.

Mixed Content

When hosting an application over HTTPS, there can be no mixed content; that is, all content in the page must be fetched via HTTPS. It is common to see partial HTTPS support on sites, in which the main pages are fetched via HTTPS but some or all of the media elements, stylesheets, and JavaScript in the page are fetched via HTTP.

This is unsafe because although the main page load is protected against active and passive network attack, none of the other resources are. If a page loads some JavaScript or CSS code via HTTP, an attacker can provide a false, malicious code file and take over the page’s DOM once it loads. Then, the user would be back to a situation of having no security. This is why all mainstream browsers warn users about pages that load mixed content. Nor is it safe to reference images via HTTP: What if the attacker swapped the Save Message and Delete Message icons in a webmail app?

You must serve the entire application domain over HTTPS. Redirect HTTP requests with HTTP 301 or 302 responses to the equivalent HTTPS resource.

Some site operators provide only the login page over HTTPS, on the theory that only the user’s password is sensitive. These sites’ users are vulnerable to passive and active attack.

Security and Cookies

As I described in a paper on secure session management for web applications, site operators must scope sensitive cookies (such as cookies used for user authentication) to the secure origin. If a cookie is broadly scoped (with the Domain attribute in the Set-Cookie: header), it may “leak” to other hosts or applications in the same domain—potentially less-secure hosts or applications.

Similarly, the application must set the Secure attribute on the cookie when setting it. This attribute instructs the browser to send the cookie only over secure (HTTPS) transport, never insecure (HTTP).

Use HTTP Strict Transport Security

HTTP Strict Transport Security (HSTS) is an HTTP protocol extension that enables site operators to instruct browsers to expect the site to use HTTPS.

Although not all browsers yet support HSTS, EFF urges those that don’t—we’re looking especially at you, Apple and Microsoft—to follow the lead Google and Mozilla have set by adopting this useful security mechanism. Indeed, ultimately we expect HTTPS (and possibly SPDY) to replace HTTP entirely, the way SSH replaced Telnet and rsh.

We recently enabled HSTS for eff.org. It took less than an hour to set up, and we found a way to do it without forcibly redirecting users to HTTPS, so we can state an unequivocal preference for HTTPS access while still making the site available in HTTP. It worked like a charm and a significant fraction of our users are now automatically accessing our site in HTTPS, perhaps without even knowing it.

Performance Concerns

Many site operators report that they can’t move to HTTPS for performance reasons. However, most people who say this have not actually measured any performance loss, may not have measured performance at all, and have not profiled and optimized their site’s behavior. Usually, sites have latency far higher and/or throughput far lower than necessary even when hosting over HTTP—indicating HTTPS is not the problem.

The crux of the performance problem is usually at the content layer, and also often at the database layer. Web applications are fundamentally I/O-bound, after all. Consider this wisdom from the Gmail developers:

First, we listed every transaction between the web browser and Google’s servers, starting with the moment the “Sign in” button is pressed. To do this, we used a lot of different web development tools, like Httpwatch, WireShark, and Fiddler, plus our own performance measuring systems. [...]

We spent hours poring over these traces to see exactly what was happening between the browser and Gmail during the sign-in sequence, and we found that there were between fourteen and twenty-four HTTP requests required to load an inbox and display it. To put these numbers in perspective, a popular network news site’s home page required about a 180 requests to fully load when I checked it yesterday. But when we examined our requests, we realized that we could do better. We decided to attack the problem from several directions at once: reduce the number of overall requests, make more of the requests cacheable by the browser, and reduce the overhead of each request.

We made good progress on every front. We reduced the weight of each request itself by eliminating or narrowing the scope of some of our cookies. We made sure that all our images were cacheable by the browser, and we consolidated small icon images into single meta-images, a technique known as spriting. We combined several requests into a single combined request and response. The result is that it now takes as few as four requests from the click of the “Sign in” button to the display of your inbox.

Google’s Adam Langley provides additional detail:

In order to do this we had to deploy no additional machines and no special hardware. On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help to dispel that. [emphasis in original]

Is it any wonder Gmail performs well, even when using HTTPS exclusively? Site operators can realize incremental improvement by gradually tuning their web applications. I gave a presentation to this effect at Web 2.0 Expo 2009.

Conclusion

HTTPS provides the baseline of safety for web application users, and there is no performance- or cost-based reason to stick with HTTP. Web application providers undermine their business models when, by continuing to use HTTP, they enable a wide range of attackers anywhere on the internet to compromise users’ information.

More to Come

Keep an eye out for Part Two of this whitepaper, which will go into more detail about how site operators can easily and incrementally improve site efficiency, thus enabling the move to HTTPS.

Posted via email from DailyDDoSe

HTTPS Everywhere Rulesets | Electronic Frontier Foundation

HTTPS Everywhere Rulesets

This page describes how to write rulesets for HTTPS Everywhere, the Firefox plugin that switches sites over from http to https automatically. HTTPS Everywhere comes with thousands of rulesets, but you might want to edit them, or write new ones.

[We believe this information is correct as of version 2.0 of HTTPS Everywhere.]

Rulesets are simple xml files. Here is a simplified version of Twitter.xml, from the plugin distribution:

The "target" tag specifies which domains the ruleset might apply to. The target host tag does not use regular expressions. The content of a target tag should be the actual name of a web server to which the ruleset applies or partially applies, like www.eff.org, www.google.com, secure.wikimedia.org, and so on. If your rule applies to the domain itself (like "eff.org", not just "www.eff.org"), you need an additional target tag to say so. For example, the sample ruleset above is meant to apply to either www.twitter.com or twitter.com, so it has a separate target tag for each.

A target may, however, contain a wildcard in one portion of the domain (like *.google.com or google.*, but *.google.* would not work). A wildcard on the left will match arbitrarily deep subdomains (for instance, *.facebook.com will match s-static.ak.facebook.com).1

The "rule" does the actual rewriting work. The "from" and "to" clauses in each rule are JavaScript regular expressions. You can use them to rewrite URLs in more complicated ways. Here's a simplified example for Wikipedia:

That rewrites a URL like http://fr.wikipedia.org/wiki/Chose to https://secure.wikimedia.org/wikipedia/fr/wiki/Chose. Notice, again, that the target is allowed to contain (just one) * as a wildcard meaning "any".

It is possible to add exclusions. An exclusion specifies a pattern, using a regular expression, for URLs where the rule should not be applied. The EFF rule contains one exclusion, for a domain that is hosted externally and does not support HTTPS:

Note that if your rules include ampersands (&), they need to be appropriately XML-encoded: replace each occurence of & with &.

Lastly, because many HTTPS websites fail to correctly set the secure flag on authentication cookies, there is a facility for turning this flag on. For instance:

The "host" parameter is a regexp specifying which domains should have their cookies secured; the "name" parameter is a regexp specifying which cookies should be secured. Note that HTTPS Everywhere will only secure a cookie when it is set over HTTPS.

Once you've written a ruleset, you can use and test it by placing it in the HTTPSEverywhereUserRules/ subdirectory in your Firefox profile directory, and then restarting Firefox. While using the rule, check for messages in the Firefox Error Console to see if there are any issues with the way the site supports HTTPS. Note that it is inadvisable to edit the builtin rules in-place, since they will be overwritten by upgrades to the extension. Either keep your edits in a safe place, or use a git repository.

If you've tested your rule and are sure it would be of use to the world at large, send it to the rulesets mailing list at https-everywhere-rules AT eff.org. Please be aware that this is a public and publicly-archived mailing list. NOTE: many rules that are not yet distributed in the official version of HTTPS Everywhere are already in our git repository! Before sending us a new rule, please check there to see if your rule has already been submitted by someone else.

Note that there are currently hundreds of pending rules which are not present in the latest stable version but which are included in development builds. If a version of the rule you're interested in is found in the relevant part of our git repository, you don't need to write a new one -- just switch to the the development branch or build your own .xpi from git.

make-trivial-rule and trivial-validate.py

As an alternative to writing rules by hand, there are scripts you can run from a Unix command line to automate the process of creating a simple rule for a specified domain. These scripts are not included with HTTPS Everywhere releases but are available in our development repository and are described in our development documentation.

Disabling a ruleset by default

Sometimes rulesets are useful or interesting, but contain some bugs or issues that make them unsuitable for being enabled by default in everyone's browsers. For instance, the HTTPS website may use a Certificate Authority that is not trusted by everyone's browsers (most commonly, CAcert or a self-signed certificate). Or the ruleset may successfully secure parts of a site but interfere with others.

In such cases, rulesets should be disabled by default. This is done by adding a default_off attribute to the ruleset element, with a value explaining why the rule is off.

By convention, you should add a parenthetical to the name of the ruleset — like (buggy) while it is off. If you reenable a ruleset, you should remove the parenthetical. This convention is important: it exists so that the change to the default override existing users' settings for whether the ruleset is on or off.

Disabling a ruleset on some platforms

Sometimes bugs on a platform may mean that a ruleset should be off by default on that platform only. For instance, this bug caused us to temporarily disable the Google Translate rules on Chromium and Chrome. This can be achieved with the "platform" attribute:

Platform is a space-delimited list of platforms on which the ruleset works. Currently anticipated values are "firefox", "chromium", and "cacert". If the platform attribute is present, but does not match the current platform, the ruleset will be treated as off-by-default.

  • 1. Exception: currently this is not true for a target host that is less than three levels deep. would match thing.com but not very.thing.com. We would consider changing that if anybody needs to use it. means a ruleset should be tested for every single URL.

Posted via email from DailyDDoSe

Friday, December 16, 2011

Whois Lulz? Adrian Lamo, #Aspergers Section aka SABU - blackbergsecurity.us ??

SABU took over Lulz Whois domain July 1, 2011.

Registrant Name: Adrian Lamo
Admin Name: Adrian Lamo
Admin ID: CR25623848
Admin Street1: 1 Police Plaza
Admin Street2: #Aspergers section
Admin City: New York
Admin Country: US

"The goberment of Portugal will not extradite me!"

Expires: January 17, 2012

Fuck. That. Shit.

Category:
News & Politics

Tags:
Anonymous Fraud Lulz Aspergers Hackgate NY USA @ELyssaD Whois
License:
Standard YouTube License

Posted via email from DailyDDoSe

Sunday, December 11, 2011

Great Hackers

Great Hackers

Want to start a startup? Get funded by Y Combinator.

July 2004

(This essay is derived from a talk at Oscon 2004.)


Edisons --> A few months ago I finished a new book, and in reviews I keep noticing words like "provocative'' and "controversial.'' To say nothing of "idiotic.''

I didn't mean to make the book controversial. I was trying to make it efficient. I didn't want to waste people's time telling them things they already knew. It's more efficient just to give them the diffs. But I suppose that's bound to yield an alarming book.

Edisons

There's no controversy about which idea is most controversial: the suggestion that variation in wealth might not be as big a problem as we think.

I didn't say in the book that variation in wealth was in itself a good thing. I said in some situations it might be a sign of good things. A throbbing headache is not a good thing, but it can be a sign of a good thing-- for example, that you're recovering consciousness after being hit on the head.

Variation in wealth can be a sign of variation in productivity. (In a society of one, they're identical.) And that is almost certainly a good thing: if your society has no variation in productivity, it's probably not because everyone is Thomas Edison. It's probably because you have no Thomas Edisons.

In a low-tech society you don't see much variation in productivity. If you have a tribe of nomads collecting sticks for a fire, how much more productive is the best stick gatherer going to be than the worst? A factor of two? Whereas when you hand people a complex tool like a computer, the variation in what they can do with it is enormous.

That's not a new idea. Fred Brooks wrote about it in 1974, and the study he quoted was published in 1968. But I think he underestimated the variation between programmers. He wrote about productivity in lines of code: the best programmers can solve a given problem in a tenth the time. But what if the problem isn't given? In programming, as in many fields, the hard part isn't solving problems, but deciding what problems to solve. Imagination is hard to measure, but in practice it dominates the kind of productivity that's measured in lines of code.

Productivity varies in any field, but there are few in which it varies so much. The variation between programmers is so great that it becomes a difference in kind. I don't think this is something intrinsic to programming, though. In every field, technology magnifies differences in productivity. I think what's happening in programming is just that we have a lot of technological leverage. But in every field the lever is getting longer, so the variation we see is something that more and more fields will see as time goes on. And the success of companies, and countries, will depend increasingly on how they deal with it.

If variation in productivity increases with technology, then the contribution of the most productive individuals will not only be disproportionately large, but will actually grow with time. When you reach the point where 90% of a group's output is created by 1% of its members, you lose big if something (whether Viking raids, or central planning) drags their productivity down to the average.

If we want to get the most out of them, we need to understand these especially productive people. What motivates them? What do they need to do their jobs? How do you recognize them? How do you get them to come and work for you? And then of course there's the question, how do you become one?

More than Money

I know a handful of super-hackers, so I sat down and thought about what they have in common. Their defining quality is probably that they really love to program. Ordinary programmers write code to pay the bills. Great hackers think of it as something they do for fun, and which they're delighted to find people will pay them for.

Great programmers are sometimes said to be indifferent to money. This isn't quite true. It is true that all they really care about is doing interesting work. But if you make enough money, you get to work on whatever you want, and for that reason hackers are attracted by the idea of making really large amounts of money. But as long as they still have to show up for work every day, they care more about what they do there than how much they get paid for it.

Economically, this is a fact of the greatest importance, because it means you don't have to pay great hackers anything like what they're worth. A great programmer might be ten or a hundred times as productive as an ordinary one, but he'll consider himself lucky to get paid three times as much. As I'll explain later, this is partly because great hackers don't know how good they are. But it's also because money is not the main thing they want.

What do hackers want? Like all craftsmen, hackers like good tools. In fact, that's an understatement. Good hackers find it unbearable to use bad tools. They'll simply refuse to work on projects with the wrong infrastructure.

At a startup I once worked for, one of the things pinned up on our bulletin board was an ad from IBM. It was a picture of an AS400, and the headline read, I think, "hackers despise it.'' [1]

When you decide what infrastructure to use for a project, you're not just making a technical decision. You're also making a social decision, and this may be the more important of the two. For example, if your company wants to write some software, it might seem a prudent choice to write it in Java. But when you choose a language, you're also choosing a community. The programmers you'll be able to hire to work on a Java project won't be as smart as the ones you could get to work on a project written in Python. And the quality of your hackers probably matters more than the language you choose. Though, frankly, the fact that good hackers prefer Python to Java should tell you something about the relative merits of those languages.

Business types prefer the most popular languages because they view languages as standards. They don't want to bet the company on Betamax. The thing about languages, though, is that they're not just standards. If you have to move bits over a network, by all means use TCP/IP. But a programming language isn't just a format. A programming language is a medium of expression.

I've read that Java has just overtaken Cobol as the most popular language. As a standard, you couldn't wish for more. But as a medium of expression, you could do a lot better. Of all the great programmers I can think of, I know of only one who would voluntarily program in Java. And of all the great programmers I can think of who don't work for Sun, on Java, I know of zero.

Great hackers also generally insist on using open source software. Not just because it's better, but because it gives them more control. Good hackers insist on control. This is part of what makes them good hackers: when something's broken, they need to fix it. You want them to feel this way about the software they're writing for you. You shouldn't be surprised when they feel the same way about the operating system.

A couple years ago a venture capitalist friend told me about a new startup he was involved with. It sounded promising. But the next time I talked to him, he said they'd decided to build their software on Windows NT, and had just hired a very experienced NT developer to be their chief technical officer. When I heard this, I thought, these guys are doomed. One, the CTO couldn't be a first rate hacker, because to become an eminent NT developer he would have had to use NT voluntarily, multiple times, and I couldn't imagine a great hacker doing that; and two, even if he was good, he'd have a hard time hiring anyone good to work for him if the project had to be built on NT. [2]

The Final Frontier

After software, the most important tool to a hacker is probably his office. Big companies think the function of office space is to express rank. But hackers use their offices for more than that: they use their office as a place to think in. And if you're a technology company, their thoughts are your product. So making hackers work in a noisy, distracting environment is like having a paint factory where the air is full of soot.

The cartoon strip Dilbert has a lot to say about cubicles, and with good reason. All the hackers I know despise them. The mere prospect of being interrupted is enough to prevent hackers from working on hard problems. If you want to get real work done in an office with cubicles, you have two options: work at home, or come in early or late or on a weekend, when no one else is there. Don't companies realize this is a sign that something is broken? An office environment is supposed to be something that helps you work, not something you work despite.

Companies like Cisco are proud that everyone there has a cubicle, even the CEO. But they're not so advanced as they think; obviously they still view office space as a badge of rank. Note too that Cisco is famous for doing very little product development in house. They get new technology by buying the startups that created it-- where presumably the hackers did have somewhere quiet to work.

One big company that understands what hackers need is Microsoft. I once saw a recruiting ad for Microsoft with a big picture of a door. Work for us, the premise was, and we'll give you a place to work where you can actually get work done. And you know, Microsoft is remarkable among big companies in that they are able to develop software in house. Not well, perhaps, but well enough.

If companies want hackers to be productive, they should look at what they do at home. At home, hackers can arrange things themselves so they can get the most done. And when they work at home, hackers don't work in noisy, open spaces; they work in rooms with doors. They work in cosy, neighborhoody places with people around and somewhere to walk when they need to mull something over, instead of in glass boxes set in acres of parking lots. They have a sofa they can take a nap on when they feel tired, instead of sitting in a coma at their desk, pretending to work. There's no crew of people with vacuum cleaners that roars through every evening during the prime hacking hours. There are no meetings or, God forbid, corporate retreats or team-building exercises. And when you look at what they're doing on that computer, you'll find it reinforces what I said earlier about tools. They may have to use Java and Windows at work, but at home, where they can choose for themselves, you're more likely to find them using Perl and Linux.

Indeed, these statistics about Cobol or Java being the most popular language can be misleading. What we ought to look at, if we want to know what tools are best, is what hackers choose when they can choose freely-- that is, in projects of their own. When you ask that question, you find that open source operating systems already have a dominant market share, and the number one language is probably Perl.

Interesting

Along with good tools, hackers want interesting projects. What makes a project interesting? Well, obviously overtly sexy applications like stealth planes or special effects software would be interesting to work on. But any application can be interesting if it poses novel technical challenges. So it's hard to predict which problems hackers will like, because some become interesting only when the people working on them discover a new kind of solution. Before ITA (who wrote the software inside Orbitz), the people working on airline fare searches probably thought it was one of the most boring applications imaginable. But ITA made it interesting by redefining the problem in a more ambitious way.

I think the same thing happened at Google. When Google was founded, the conventional wisdom among the so-called portals was that search was boring and unimportant. But the guys at Google didn't think search was boring, and that's why they do it so well.

This is an area where managers can make a difference. Like a parent saying to a child, I bet you can't clean up your whole room in ten minutes, a good manager can sometimes redefine a problem as a more interesting one. Steve Jobs seems to be particularly good at this, in part simply by having high standards. There were a lot of small, inexpensive computers before the Mac. He redefined the problem as: make one that's beautiful. And that probably drove the developers harder than any carrot or stick could.

They certainly delivered. When the Mac first appeared, you didn't even have to turn it on to know it would be good; you could tell from the case. A few weeks ago I was walking along the street in Cambridge, and in someone's trash I saw what appeared to be a Mac carrying case. I looked inside, and there was a Mac SE. I carried it home and plugged it in, and it booted. The happy Macintosh face, and then the finder. My God, it was so simple. It was just like ... Google.

Hackers like to work for people with high standards. But it's not enough just to be exacting. You have to insist on the right things. Which usually means that you have to be a hacker yourself. I've seen occasional articles about how to manage programmers. Really there should be two articles: one about what to do if you are yourself a programmer, and one about what to do if you're not. And the second could probably be condensed into two words: give up.

The problem is not so much the day to day management. Really good hackers are practically self-managing. The problem is, if you're not a hacker, you can't tell who the good hackers are. A similar problem explains why American cars are so ugly. I call it the design paradox. You might think that you could make your products beautiful just by hiring a great designer to design them. But if you yourself don't have good taste, how are you going to recognize a good designer? By definition you can't tell from his portfolio. And you can't go by the awards he's won or the jobs he's had, because in design, as in most fields, those tend to be driven by fashion and schmoozing, with actual ability a distant third. There's no way around it: you can't manage a process intended to produce beautiful things without knowing what beautiful is. American cars are ugly because American car companies are run by people with bad taste.

Many people in this country think of taste as something elusive, or even frivolous. It is neither. To drive design, a manager must be the most demanding user of a company's products. And if you have really good taste, you can, as Steve Jobs does, make satisfying you the kind of problem that good people like to work on.

Nasty Little Problems

It's pretty easy to say what kinds of problems are not interesting: those where instead of solving a few big, clear, problems, you have to solve a lot of nasty little ones. One of the worst kinds of projects is writing an interface to a piece of software that's full of bugs. Another is when you have to customize something for an individual client's complex and ill-defined needs. To hackers these kinds of projects are the death of a thousand cuts.

The distinguishing feature of nasty little problems is that you don't learn anything from them. Writing a compiler is interesting because it teaches you what a compiler is. But writing an interface to a buggy piece of software doesn't teach you anything, because the bugs are random. [3] So it's not just fastidiousness that makes good hackers avoid nasty little problems. It's more a question of self-preservation. Working on nasty little problems makes you stupid. Good hackers avoid it for the same reason models avoid cheeseburgers.

Of course some problems inherently have this character. And because of supply and demand, they pay especially well. So a company that found a way to get great hackers to work on tedious problems would be very successful. How would you do it?

One place this happens is in startups. At our startup we had Robert Morris working as a system administrator. That's like having the Rolling Stones play at a bar mitzvah. You can't hire that kind of talent. But people will do any amount of drudgery for companies of which they're the founders. [4]

Bigger companies solve the problem by partitioning the company. They get smart people to work for them by establishing a separate R&D department where employees don't have to work directly on customers' nasty little problems. [5] In this model, the research department functions like a mine. They produce new ideas; maybe the rest of the company will be able to use them.

You may not have to go to this extreme. Bottom-up programming suggests another way to partition the company: have the smart people work as toolmakers. If your company makes software to do x, have one group that builds tools for writing software of that type, and another that uses these tools to write the applications. This way you might be able to get smart people to write 99% of your code, but still keep them almost as insulated from users as they would be in a traditional research department. The toolmakers would have users, but they'd only be the company's own developers. [6]

If Microsoft used this approach, their software wouldn't be so full of security holes, because the less smart people writing the actual applications wouldn't be doing low-level stuff like allocating memory. Instead of writing Word directly in C, they'd be plugging together big Lego blocks of Word-language. (Duplo, I believe, is the technical term.)

Clumping

Along with interesting problems, what good hackers like is other good hackers. Great hackers tend to clump together-- sometimes spectacularly so, as at Xerox Parc. So you won't attract good hackers in linear proportion to how good an environment you create for them. The tendency to clump means it's more like the square of the environment. So it's winner take all. At any given time, there are only about ten or twenty places where hackers most want to work, and if you aren't one of them, you won't just have fewer great hackers, you'll have zero.

Having great hackers is not, by itself, enough to make a company successful. It works well for Google and ITA, which are two of the hot spots right now, but it didn't help Thinking Machines or Xerox. Sun had a good run for a while, but their business model is a down elevator. In that situation, even the best hackers can't save you.

I think, though, that all other things being equal, a company that can attract great hackers will have a huge advantage. There are people who would disagree with this. When we were making the rounds of venture capital firms in the 1990s, several told us that software companies didn't win by writing great software, but through brand, and dominating channels, and doing the right deals.

They really seemed to believe this, and I think I know why. I think what a lot of VCs are looking for, at least unconsciously, is the next Microsoft. And of course if Microsoft is your model, you shouldn't be looking for companies that hope to win by writing great software. But VCs are mistaken to look for the next Microsoft, because no startup can be the next Microsoft unless some other company is prepared to bend over at just the right moment and be the next IBM.

It's a mistake to use Microsoft as a model, because their whole culture derives from that one lucky break. Microsoft is a bad data point. If you throw them out, you find that good products do tend to win in the market. What VCs should be looking for is the next Apple, or the next Google.

I think Bill Gates knows this. What worries him about Google is not the power of their brand, but the fact that they have better hackers. [7]

Recognition

So who are the great hackers? How do you know when you meet one? That turns out to be very hard. Even hackers can't tell. I'm pretty sure now that my friend Trevor Blackwell is a great hacker. You may have read on Slashdot how he made his own Segway. The remarkable thing about this project was that he wrote all the software in one day (in Python, incidentally).

For Trevor, that's par for the course. But when I first met him, I thought he was a complete idiot. He was standing in Robert Morris's office babbling at him about something or other, and I remember standing behind him making frantic gestures at Robert to shoo this nut out of his office so we could go to lunch. Robert says he misjudged Trevor at first too. Apparently when Robert first met him, Trevor had just begun a new scheme that involved writing down everything about every aspect of his life on a stack of index cards, which he carried with him everywhere. He'd also just arrived from Canada, and had a strong Canadian accent and a mullet.

The problem is compounded by the fact that hackers, despite their reputation for social obliviousness, sometimes put a good deal of effort into seeming smart. When I was in grad school I used to hang around the MIT AI Lab occasionally. It was kind of intimidating at first. Everyone there spoke so fast. But after a while I learned the trick of speaking fast. You don't have to think any faster; just use twice as many words to say everything.

With this amount of noise in the signal, it's hard to tell good hackers when you meet them. I can't tell, even now. You also can't tell from their resumes. It seems like the only way to judge a hacker is to work with him on something.

And this is the reason that high-tech areas only happen around universities. The active ingredient here is not so much the professors as the students. Startups grow up around universities because universities bring together promising young people and make them work on the same projects. The smart ones learn who the other smart ones are, and together they cook up new projects of their own.

Because you can't tell a great hacker except by working with him, hackers themselves can't tell how good they are. This is true to a degree in most fields. I've found that people who are great at something are not so much convinced of their own greatness as mystified at why everyone else seems so incompetent.

But it's particularly hard for hackers to know how good they are, because it's hard to compare their work. This is easier in most other fields. In the hundred meters, you know in 10 seconds who's fastest. Even in math there seems to be a general consensus about which problems are hard to solve, and what constitutes a good solution. But hacking is like writing. Who can say which of two novels is better? Certainly not the authors.

With hackers, at least, other hackers can tell. That's because, unlike novelists, hackers collaborate on projects. When you get to hit a few difficult problems over the net at someone, you learn pretty quickly how hard they hit them back. But hackers can't watch themselves at work. So if you ask a great hacker how good he is, he's almost certain to reply, I don't know. He's not just being modest. He really doesn't know.

And none of us know, except about people we've actually worked with. Which puts us in a weird situation: we don't know who our heroes should be. The hackers who become famous tend to become famous by random accidents of PR. Occasionally I need to give an example of a great hacker, and I never know who to use. The first names that come to mind always tend to be people I know personally, but it seems lame to use them. So, I think, maybe I should say Richard Stallman, or Linus Torvalds, or Alan Kay, or someone famous like that. But I have no idea if these guys are great hackers. I've never worked with them on anything.

If there is a Michael Jordan of hacking, no one knows, including him.

Cultivation

Finally, the question the hackers have all been wondering about: how do you become a great hacker? I don't know if it's possible to make yourself into one. But it's certainly possible to do things that make you stupid, and if you can make yourself stupid, you can probably make yourself smart too.

The key to being a good hacker may be to work on what you like. When I think about the great hackers I know, one thing they have in common is the extreme difficulty of making them work on anything they don't want to. I don't know if this is cause or effect; it may be both.

To do something well you have to love it. So to the extent you can preserve hacking as something you love, you're likely to do it well. Try to keep the sense of wonder you had about programming at age 14. If you're worried that your current job is rotting your brain, it probably is.

The best hackers tend to be smart, of course, but that's true in a lot of fields. Is there some quality that's unique to hackers? I asked some friends, and the number one thing they mentioned was curiosity. I'd always supposed that all smart people were curious-- that curiosity was simply the first derivative of knowledge. But apparently hackers are particularly curious, especially about how things work. That makes sense, because programs are in effect giant descriptions of how things work.

Several friends mentioned hackers' ability to concentrate-- their ability, as one put it, to "tune out everything outside their own heads.'' I've certainly noticed this. And I've heard several hackers say that after drinking even half a beer they can't program at all. So maybe hacking does require some special ability to focus. Perhaps great hackers can load a large amount of context into their head, so that when they look at a line of code, they see not just that line but the whole program around it. John McPhee wrote that Bill Bradley's success as a basketball player was due partly to his extraordinary peripheral vision. "Perfect'' eyesight means about 47 degrees of vertical peripheral vision. Bill Bradley had 70; he could see the basket when he was looking at the floor. Maybe great hackers have some similar inborn ability. (I cheat by using a very dense language, which shrinks the court.)

This could explain the disconnect over cubicles. Maybe the people in charge of facilities, not having any concentration to shatter, have no idea that working in a cubicle feels to a hacker like having one's brain in a blender. (Whereas Bill, if the rumors of autism are true, knows all too well.)

One difference I've noticed between great hackers and smart people in general is that hackers are more politically incorrect. To the extent there is a secret handshake among good hackers, it's when they know one another well enough to express opinions that would get them stoned to death by the general public. And I can see why political incorrectness would be a useful quality in programming. Programs are very complex and, at least in the hands of good programmers, very fluid. In such situations it's helpful to have a habit of questioning assumptions.

Can you cultivate these qualities? I don't know. But you can at least not repress them. So here is my best shot at a recipe. If it is possible to make yourself into a great hacker, the way to do it may be to make the following deal with yourself: you never have to work on boring projects (unless your family will starve otherwise), and in return, you'll never allow yourself to do a half-assed job. All the great hackers I know seem to have made that deal, though perhaps none of them had any choice in the matter.

Notes


In early modern Europe, the most important quality may have been organization. The kind of brilliance that distinguished Isaac Newton had little practical effect. It would have more now.--> [1] In fairness, I have to say that IBM makes decent hardware. I wrote this on an IBM laptop.

[2] They did turn out to be doomed. They shut down a few months later.

[3] I think this is what people mean when they talk about the "meaning of life." On the face of it, this seems an odd idea. Life isn't an expression; how could it have meaning? But it can have a quality that feels a lot like meaning. In a project like a compiler, you have to solve a lot of problems, but the problems all fall into a pattern, as in a signal. Whereas when the problems you have to solve are random, they seem like noise.

[4] Einstein at one point worked designing refrigerators. (He had equity.)

[5] It's hard to say exactly what constitutes research in the computer world, but as a first approximation, it's software that doesn't have users.

I don't think it's publication that makes the best hackers want to work in research departments. I think it's mainly not having to have a three hour meeting with a product manager about problems integrating the Korean version of Word 13.27 with the talking paperclip.

[6] Something similar has been happening for a long time in the construction industry. When you had a house built a couple hundred years ago, the local builders built everything in it. But increasingly what builders do is assemble components designed and manufactured by someone else. This has, like the arrival of desktop publishing, given people the freedom to experiment in disastrous ways, but it is certainly more efficient.

[7] Google is much more dangerous to Microsoft than Netscape was. Probably more dangerous than any other company has ever been. Not least because they're determined to fight. On their job listing page, they say that one of their "core values'' is "Don't be evil.'' From a company selling soybean oil or mining equipment, such a statement would merely be eccentric. But I think all of us in the computer world recognize who that is a declaration of war on.

Thanks to Jessica Livingston, Robert Morris, and Sarah Harlin for reading earlier versions of this talk.


Audio of talk

The Python Paradox

Japanese Translation

Russian Translation

Italian Translation

Spanish Translation



not loaded
-->
If you liked this, you may also like Hackers & Painters.
0){R=R.substring(X,R.length)}else{return W}R=R.replace(new RegExp("([^a-zA-Z0-9$_])this([^a-zA-Z0-9$_])","g"),"$1xzq_this$2");var Z=T+";var rv = f( "+Y+",this);";var S="{var a0 = '"+Y+"';var ofb = '"+escape(R)+"' ;var f = new Function( a0, 'xzq_this', unescape(ofb));"+Z+"return rv;}";return new Function(Y,S)}else{return W}}return V}window.xzq_eh=function(){if(E||I){this.onload=L("xzq_onload(e)",K,this.onload,0);if(E&&typeof (this.onbeforeunload)!=O){this.onbeforeunload=L("xzq_dobeforeunload(e)",B,this.onbeforeunload,0)}}};window.xzq_s=function(){setTimeout("xzq_sr()",1)};var J=null;var M=null;var Q=navigator.appName;var H=navigator.appVersion;var G=navigator.userAgent;var A=parseInt(H);var D=Q.indexOf("Microsoft");var E=D!=-1&&A>=4;var I=(Q.indexOf("Netscape")!=-1||Q.indexOf("Opera")!=-1)&&A>=4;var O="undefined";var P=2000})();

http://www.paulgraham.com/gh.html

Posted via email from DailyDDoSe