In the wake of the Shellshock bug, I guess I need to repeat in public some things I said at the time of the Heartbleed bug.
The first thing to notice here is that these bugs were found – and were findable – because of open-source scrutiny.
There’s a “things seen versus things unseen” fallacy here that gives bugs like Heartbleed and Shellshock false prominence. We don’t know – and can’t know – how many far worse exploits lurk in proprietary code known only to crackers or the NSA.
What we can project based on other measures of differential defect rates suggests that, however imperfect “many eyeballs” scrutiny is, “few eyeballs” or “no eyeballs” is far worse.
I’m not handwaving when I say this; we have statistics from places like Coverity that do defect-rate measurements on both open-source and proprietary closed source products, we have academic research like the UMich fuzz papers, we have CVE lists for Internet-exposed programs, we have multiple lines of evidence.
Everything we know tells us that while open source’s security failures may be conspicuous its successes, though invisible, are far larger.
In a blog post on Computational Knowledge and the Future of Pure Mathematics Stephen Wolfram lays out a vision that is in many ways exciting and challenging. What if all of mathematics could be expressed in a common formal notation, stored in computers so it is searchable and amenable to computer-assisted discovery and proof of new theorems?
Infinite Science Fiction One (edited by Dany G. Zuwen and Joanna Jacksonl Infinite Acacia) starts out rather oddly, with Zuwen’s introducton in which, though he says he’s not religious, he connects his love of SF with having read the Bible as a child. The leap from faith narratives to a literature that celebrates rational knowability seems jarring and a bit implausible.
That said, the selection of stories here is not bad. Higher-profile editors have done worse, sometimes in anthologies I’ve reviewed.
Our new cat Zola, it appears, has a mysterious past. The computer that knows about the ID chip embedded under his skin thinks he’s a dog.
There’s more to the story. And it makes us think we may have misread Zola’s initial behavior. I’m torn between wishing he could tell us what he’d been through, and maybe being thankful that he can’t. Because if he could, I suspect I might experience an urge to go punch someone’s lights out that would be bad for my karma.
One of the minor frustrations of my life, up to now, is that though I can sell as much nonfiction as I care to write, fiction sales had eluded me. What made this particularly irksome is that I don’t have only the usual ego reasons for wanting to succeed. I love the science fiction genre and owe it much; I want to pay that forward by contributing back to it.
It therefore gives me great satisfaction to announce that I have made my first SF sale, a short (3.5kword) piece of military SF titled Sucker Punch set on a U.S. aircraft carrier during the Taiwan Straits Action of 2037. Some details follow.
Before you read the rest of this post, go look at these pictures of a Hobbit Pub and a Hobbit House. And recall the lovely Bag End sets from Peter Jackson’s LOTR movies.
I have a very powerful reaction to these buildings that, I believe, has nothing to do with having been a Tolkien fan for most of my life. In fact, some of the most Tolkien-specific details – the round doors, the dragon motifs in the pub – could be removed without attenuating that reaction a bit.
To me, they feel right. They feel like home. And I’m not entirely sure why, because I’ve never lived in such antique architecture. But I think it may have something to do with Christopher Alexander’s “Timeless Way of Building”.
Blogging will be light and possibly nonexistent for the next week, as I’m off to Summer Weapons Retreat 2014 for fun and swordplay.
Keep out of trouble until I get back…oh, who am I kidding. Go make interesting trouble.
I had to buy a new UPS for my desktop machine yesterday after the old one succumbed to battery death, so Cathy and I made a run to the local MicroCenter.
UPS designers have been pissing me off since forever with designs that require you to throw away the entire device when the battery craps out, unless you’re willing to go to great length to avoid this – finding the exact right replacement battery from a specialty supplier, then taking the unit apart and reassembling it yourself.
This is never practical under time pressure, and I’ve never had the luxury of no time pressure when trying to cope with a dead UPS. Sure didn’t this time; my area was under a severe-thunderstorm watch.
Imagine my pleased surprise when I found a big stack of varied models branded APC that are not just significantly less expensive and with longer dwell times than when I was last UPS-shopping, but designed with removeable and replaceable batteries, too.
Progress does get made. Dunno whether this is a standard feature on all UPS brands yet, but doubtless it will be within a few years.
Some of you may find my UPS HOWTO of interest. I’ve shipped a 3.0 update with the glad news of replaceable batteries and a few other minor updates; it may be up by the time you read this.
The new cat, Zola has been with us for about a month now. My wife and I observe an interesting convergence; as he feels increasingly secure around us, his behavior is coming to resemble Sugar’s more and more, to the point that it sometimes feels like having her back with us.
What makes this a surprising observation is that Sugar was not your behaviorally average cat. She was up against the right-hand end of the feline bell curve for sociability, gentleness, and good manners. Having Zola match that so exactly is a little startling even if we did improve our odds by keeping an eye out for a Maine Coon that liked us on sight. It still feels rather like having 00 come up twice in succession on a roulette wheel.
This is ethologically interesting; it suggests some things about how the personalities of cats – and even specific behavioral propensities – are generated. In the remainder of this post I will use detailed observations to explore this point.
“Don’t it always seem to go, you don’t know what you’ve got till it’s gone…” Three days ago freecode.com abruptly shut down, claiming “low traffic”, but there has been enough public mourning since to make me pretty sure it fills a need that’s still there. There was nowhere else you could go that was quite so good for getting a cross-sectional view of what the open-source world is doing, independently of any given forge site or distro.
Web frameworks have gotten much more powerful since the original Freshmeat was built 17 years ago; today, I think building a replacement wouldn’t be a huge project. It is not, however, something I am willing to try to do alone. Whether or not this goes forward will depend on how many people are willing to step up and join me. I figure we need a team of about three core co-developers, at least one of whom needs to have some prior expertise at whatever framework we end up using.
In the remainder of this post I’m going to sketch a set of project goals, including both some trimming away of freshmeat/freecode features I thought were unnecessary and some new ideas to address problems in its design.
Jeff Covey has responded to the demise of freshmeat/freecode by reminiscing about his past at Freshmeat. He reports a rumor that VA bought Andover just because the CEO thought it would be cool to own Slashdot.
I set the record straight in a comment on the post. No, that’s not why it happened; Larry Augustin never would have made a business decision for a reason that flimsy. In fact, buying Slashdot was my idea, and I had a solid reason for proposing it. The rest of my comment explaining this follows.
Well, that’s annoying. The freecode.com release-announcement site stopped accepting updates yesterday. The site says it shut down due to low traffic.
Accordingly, I’ve issued a final archival version of freecode-submit and shipped a version of shipper that no longer tries to do freecode notifications, issuing a complaint instead.
Had to revise the How to Become a Hacker, too. I used to advise newbs to watch that site for projects they might want to join. Can’t do that any more.
With this site gone, where can people go for a cross-sectional view of what open source is doing? Bummer….
Zola, successor to our late and sorely missed cat Sugar, arrived here today. Here’s how it went…
Cathy and I signed papers to adopt a cat from a rescue network last night. It would be here already, but it’s being treated for a mild ear infection picked up at the pet store.
“It” is actually a he, a golden-eyed ginger-and-cream Maine Coon about two years old. The name is “Gorgonzola”, which we’ll probably shorten to “Zola”.
Why this cat? Because we’re of the school of thought that believes you should let a cat choose you rather than trying to choose a cat. Of all the ones we met, it seemed to take to Cathy the most strongly, and we viewed this as the more important compatibility check because we both know I have stronger cat-fu than she does. If a cat doesn’t take an active dislike to me (which is so unusual I can’t remember when it last happened) I will charm it eventually; this one likes me well enough to begin with that I’m sure we’ll do just fine.
It’s hard to avoid making comparisons with Sugar. First impression is that Zola is almost as human-friendly as Sugar was (which sounds like faint praise but is really like saying “almost as deep as the Pacific Ocean”) with a more placid, less active temperament. I’m not expecting him to be quite as outgoing with our houseguests, but I don’t think he’ll hide behind the furniture either. Likely he’ll just hang out nearby being mellow and making nice at anyone who approaches him. That’s typical behavior for Coon toms and he seems quite typical that way. He seems to be very gentle and un-clawful even by Coon standards, which is going some. I’d bet he’s great with small children.
We’re a little nervous, for all the obvious reasons. What if Zola has un-obvious behavior problems? Ill health? But it’s time. Our home feels a bit empty without a cat in it. Not for much longer!
I, and a largish crew of the usual suspects, are at Penguicon.
Friends of Armed & Dangerous party will be 9PM tomorrow in 403 at the Westin Southfield Detroit.
Bloodmouth Carnist T-shirts will be on sale.
A few days ago I was thinking about one of the most provocative Damned Facts from population genetics, and came up with a prediction that as far as I know nobody has uttered or tested before. I throw it out here because someone with access to the right kind of primary data might be able to test it.
Sugar’s NYT appearance last week was her last hurrah. We had to have her euthanized today. She died peacefully about an hour ago.
Her decline had been extremely rapid. Three weeks ago, even, Sugar barely looked aged and it was still possible to believe she might live another year. But the chronic nephritis, and possibly other organ failures, caught up with her. She started losing weight rapidly and her legs (already affected by arthritis) weakened. Her appetite waned, and her frequency of self-grooming diminished.
The signs were clear, but we hoped that she would bounce back – she was a very tough cat and had surprised us and our veterinarians that way before. Over the weekend she showed serious problems walking. When I saw her fall partway down the basement stairs Saturday evening because she couldn’t keep her footing, I suspected it was time. Sunday she almost couldn’t walk, and began sounding distress calls a few times an hour – stopped eating and drinking. Then I knew it was time. So did Cathy.
This is an update for friends of Sugar only; you know who you are.
Sugar may not have much time left. She’s been losing weight rapidly the last couple weeks, her appetite is intermittent, and she’s been having nausea episodes. She seems remarkably cheerful under the circumstances and still likes human company as much as ever, but … she really does seem old and frail now, which wasn’t so as recently as her 21st birthday in early February.
We’re bracing ourselves. If the rate she’s fading doesn’t change I think we’re going to have to euthanize her within six weeks or so. Possibly sooner. Possibly a lot sooner.
Sugar’s had a good long run. We’ll miss her a lot, but Cathy and I are both clear that it is our duty not to see her suffering prolonged unnecessarily.
If you’re a friend of Sugar and have any option to visit here to say your farewells, best do it immediately.
If you’ve somehow read this far without having met Sugar: I don’t normally blog about strictly personal things, but Sugar is a bit of an institution. She’s been a friend to the many hackers who have guested in our storied basement; I’ve seen her innocent joyfulness light up a lot of faces. We’re not the only people who will be affected by losing her.
The Heartbleed bug made the Washington Post. And that means it’s time for the reminder about things seen versus things unseen that I have to re-issue every couple of years.
Actually, this time around I answered it in advance, in an Ask Me Anything on Slashdot just about exactly a month ago. The following is a lightly edited and somewhat expanded version of that answer.
When I heard that Brendan Eich had been forced to resign his new job as CEO at Mozilla, my first thought was “Congratulations, gay activists. You have become the bullies you hate.”
On reflection, I think the appalling display of political thuggery we’ve just witnessed demands a more muscular response. Eich was forced out for donating $1000 to an anti-gay-marriage initiative? Then I think it is now the duty of every friend of free speech and every enemy of political bullying to pledge not only to donate $1000 to the next anti-gay-marriage initiative to come along, but to say publicly that they have done so as a protest against bullying.
This is my statement that I am doing so. I hope others will join me.
It is irrelevant whether we approve of gay marriage or not. The point here is that bullying must have consequences that deter the bullies, or we will get more of it. We must let these thugs know that they have sown dragon’s teeth, defeating themselves. Only in this way can we head off future abuses of similar kind.
And while I’m at it – shame on you, Mozilla, for knuckling under. I’ll switch to Chrome over this, if it’s not totally unusable.