You Can't "Fix the Grid" - All Networks Share Risk

There's a very insightful op-ed piece in the NY Times about how
the interconnectedness of the power grid exposes entire regions and
the nation to risk. He argues you CAN'T just "fix the grid" --
the network implies risk. (Think about last week's Microsoft
exposures on computers worldwide...)

...

We're All on the Grid Together

By ALBERT-L SZL BARAB SI
SOUTH BEND, Ind.

Once power is fully restored, it will take little time to find
the culprit: most likely, it will be a malfunctioning switch or fuse, a
snapped power line or some other local failure. Somebody will be fired,
promotions and raises denied, and lawmakers will draw up legislation
guaranteeing that this problem will not occur again. Something will be
inevitably missed, however, during all this finger-pointing: this
week's blackout has little to do with faulty equipment, negligence or
bad design. President Bush's call to upgrade the power grid will do
little to eliminate power failures. The magnitude of the blackout is
rooted in an often ignored aspect of our globalized world:
vulnerability due to interconnectivity.

We're All on the Grid Together

State Capital in Darkness; Detroit Free Press Is Clueless

The power outage that affected the Northeastern U.S. and much of Ontario also left Cleveland and Detroit without electricity. The Detroit Free Press

reported that most of the rest of Michigan was blissfully sanguine:



There's only one problem: they forgot Lansing, the state capital. Lansing's city-owned utility, the Board of Water and Light, did lose power. The BWL also serves some areas outside the city, including East Lansing. (Michigan State University makes its own power which remained on.)

The outage caught Governor Granholm in the middle of a staff meeting and affected state office buildings. GM had to shut down automotive production. (Lansing hosts major GM factories.) Lansing City Hall was evacuated. The Lansing State Journal had to borrow the news room of the MSU newspaper, the State News, in order to produce a single skinny section of the Friday paper.

In short, the capital was as dark last night as Detroit was.

You can imagine how the Freep made this error: the reporter, Sheryl James, called a PR flack at Consumers Energy, and asked what other parts of the state were affected. (Consumers and DTE are the main electric utilities in Michigan.) Consumers said "actually things are pretty good." James obviously didn't bother to ask anyone in state government -- who certainly would've known the lights were out -- or the Freep's own Lansing bureau.

The New York Times managed to produce a complete, thick Friday edition and get it delivered to the Lansing area. It includes a map showing all major cities with reported outages. Lansing and Kalamazoo are listed, along with Ann Arbor and SE Michigan. Gee, if the Times (whose newsroom ran on generators overnight) can report accurately on Michigan cities, shouldn't the Freep be able to as well?

Google Pays Homage to Alfred Hitchcock

Google periodically updates its logo with a cute graphical reference to a holiday or event. Today's Google logo pays homage to Alfred Hitchcock (and one of his movies, "The Birds").



Not knowing the significance of August 13 and Hitchcock, I went to the Internet Movie Database for the answer. Yup, Hitch was born this day. IMDB offers
other events in movie history that occurred on August 13.

My wife Judy, far more intuitive than I, figured Google would give a clue. The logo is a link to a Google search for "Alfred Hitchcock" which would eventually yield the August 13 answer.

It's fun to look at

other Google holiday logos.

Ever wonder who the artist is that makes these cute, minimalist logos for Google? Here's the scoop:

about Google's logo artist.

ABC News Ad Is Cruelly Relevant

Google, Yahoo and everyone else are racing to see who can do the best job of delivering "relevant" advertisements, sometimes with funny results.

Recently a pair of college students disappeared. The young Michigan couple was supposed to meet one set of parents in Maine after a stay on Cape Cod. Instead, they vanished. Their credit cards and cell phones abruptly stopped showing activity. Police in two states started a massive missing persons search. Both sets of parents were distraught, wondering if their kids were even still alive.

The couple turned up in Florida when a cop ran a routine license plate check. It's still not clear why the young folks did this. The relatives were relieved -- but puzzled and upset.

Here's how ABC News' online site began the story. Note the embedded advertisement:

A Spelling Note for the Christian Science Monitor

This morning I sent the Christian Science Monitor a letter to the editor correcting a sadly common mistake. Will their copy editors take notice?

Your news item on burning old weapons in Alabama refers to residents
as "Alabamans". Just as you call someone from Florida a Floridian, or someone from Carolina a Carolinian, or someone from Canada a Canadian, you call someone from Alabama an Alabamian.

If those examples don't resonate with your reporters and copy editors, then this mnemonic might help: a follower of Christ is called a Christian, not a Christan.

/rich


Army rids itself of leftover weapons of mass destruction, distributing plastic sheeting to Alabamans nearby.



http://csmonitor.com/2003/0808/p03s01-uspo.html

Lansing State Journal: Who Pays for Home Tech Installation?

The Lansing State Journal ran a piece for Monday's edition about how consumers are willing to pay to have computers, high speed Internet, and high end audio/video set up in their homes.

Points of interest:

-- 35% of folks who buy high-end A/V pay to have it installed; only 5% of PC buyers do likewise.

-- Comcast is test marketing a service to set up a home network; Ann Arbor is part of trial; Leslie Brogan says Lansing market may follow soon.

-- Best Buy and Gateway are into the home equipment setup biz.


Lansing State Journal Article: Who Pays for Home Tech Setup?
.

/rich

Great New Wi-Fi Hotspot Locator from Kensington - Doesn't work!

Kensington is marketing a credit-card size Wi-Fi detector. I bought one on a lark. The theory is you whip this tiny toy out and press a button to see if there is a nearby hotspot.

So far, it's useless. I haven't been able to get it to detect a working 802.11b network in a local coffee shop, or an access point at work, or my 802.11g network at home.

So like a good customer I went to their support site. Their FAQ answer on this topic is a hilarious jumble of technobabble and personal advice. (If it doesn't detect WEP networks and if it doesn't work with 802.11g, it's pretty much useless.)

From Kensington's knowledge base:

There are 2 possibilities: 1) Your work has an encrypted network,
by design the wifi finder will not detect networks that do not want
to be detected. The wifi finder will detect a peer to peer network
at your work site but you had better check with your
helpdesk/IT manager before setting up peer to peer wireless networks -
this can compromise your companys security and maybe even your job!

2) Your work is using a recently upgraded form of 802.11g. Network
speed helps productivity so it is likely your IT manager is always
looking for ways to go faster. The wifi finder design uses a
version of 802.11g prior to that standards finalization. It is
possible that your network has been upgraded and wifi
finder does not yet know how to look for that network protocol.
Look for updated Kensington wifi finders coming soon.

U Michigan Grad Student Steals Passwords via Keystrokes

A U Michigan grad student used keyboard logging to steal faculty and student accounts. I'm told he used software keyboard logging as well as a hardware logging device that plugs into the computer's PS/2 port and accepts the keyboard cable.

He screwed around with his victims in a variety of ways, canceling one student's job interviews etc. He even tried to extort a student into trading sexual favors for tutoring.

In a similar case, someone installed keyboard logging software on public PCs at Kinko's in NYC. That person sniffed passwords for months.

Encryption of Web or e-mail obviously doesn't work against keyboard logging.

Are any public terminals safe to use?

Fox 47 TV in Lansing

interviewed me about the case and the risks.



Detroit Free Press article.

Google and Blogger

The conventional wisdom is that Google's acquisition of Pyra Labs, the progenitor of Blogger, means big things... Does it? Maybe!

New York Times Quote on Princeton vs. Yale

Last week a reporter for the NY Times called to discuss a posting of mine to Dave Farber's Interesting People list. The subject was the rather incredible story of a Princeton director of admissions testing to see if some of the students who'd applied at his school had been admitted by Yale.

Here's the beginning of the piece:

SURVEILLANCE 101
Privacy vs. Security on Campus
By JOHN SCHWARTZ

WHEN the news broke a week ago that a Princeton admissions officer had used the Social Security numbers of applicants to his school to view Yale University's Web site for admissions, privacy advocates were aghast not only at his act, but also at the Yale site's lack of security.

In one online forum, Richard Wiggins, an author and information technology specialist at Michigan State University, noted that most businesses with online customer accounts have learned that Social Security numbers alone offer poor security, and issue personal identification numbers as well.

Here's the entire piece:

http://nytimes.com/2002/08/04/weekinreview/04SCHW.html

Here's my original posting to IP:

Subject: Princeton Admissions office hacks into Yale Admissions list
To: Dave Farber

Dave,

Last week a story broke about the Admissions office at Princeton breaking into the database that shows prospective Yale students
whether they were admitted or not. This was trivial because the Yale signon only required the applicant's Social Security Number and date of birth for authentication. Since Princeton required the same information, they could check on any applicant they surmised had applied both places.

The Princeton director claimed that he did this only to check out security on the Yale site. But a Washington Post article says that the same applicant was checked on multiple times, and that it appears that President Bush's niece as well as the grandson of Notre Dame coach Ara Parseghian were checked.

http://www.washingtonpost.com/wp-dyn/articles/A7815-2002Jul26.html

Of course this story makes Princeton look bad, though they are coming down hard, having placed the director on leave and issued a strong statement. But it also makes everyone look bad:

-- Yale's database used weak authentication. They should've assigned an ID/PW or a random PIN to each new applicant. Web merchants have had the protocol right for years now. They opened themselves up to this sort of attack -- and not only from other universities, but any
unscrupulous staff member at a credit card provider, bank, hospital, etc.

-- Yale's database notified students of admission in a rather childish way, it seems. The first time you logged in, if you were admitted, you saw fireworks. If you logged in again later, you didn't see the fireworks. Thus if Princeton looked you up you didn't get the happy treatment.

Yale has turned this over to the FBI. Whether or not there's a prosecution, the important point here is not what Princeton did to Yale, but rather what Princeton did to the privacy of prospective students. The Admissions staff could've used the same information to change an applicant's address and apply for a credit card -- "to test security".

/rich

Wigblog 1.0

The Wigblog begins...