LookIt

(Experimental != Standard) && (Anti-spoofing != Anti-spam)

The IETF has finally emitted the email anti-spoofing documents for the SPF and Sender-ID protocols. The most important thing is that the two protocols are issues as experimental RFCs, not standards. There is a huge difference, and the IESG tried to make that as clear as possible:

"The following documents  (draft-schlitt-spf-classic, draft-katz-submitter, 
draft-lyon-senderid-core, draft-lyon-senderid-pra) are published simultaneously
as Experimental RFCs, although there is no general technical consensus and
efforts to reconcile the two approaches have failed.  As such these documents
have not received full IETF review and are published "AS-IS" to document the
different approaches as they were considered in the MARID working group.

The IESG takes no position about which approach is to be preferred and
cautions the reader that there are serious open issues for each approach
and concerns about using them in tandem. The IESG believes that documenting the
different approaches does less harm than not documenting them.

The community is invited to observe the success or failure of the
two approaches during the two years following publication, in
order that a community consensus can be reached in the future."

And, to be clear, neither protocol is directly anti-spam: they simply help the receiver believe that the mail is sent by the organization that claims it sent the message.

When cryptography borders on schizophrenia

NBC reports that the elevated terror alert in December 2003 was due to the CIA deciding that there were coded messages in the "text crawl" on the Al-Jazeera TV news network. They used steganography, the science of finding secret messages that have been hidden in regular messages.

Of course, steganography has the major side-effect of having many, many false positives. You can easily convince yourself that you're seeing what you are looking for, as the CIA aptly proved. If you read or saw "A Beautiful Mind", or have talked to someone with someone who has one of the types of schizophrenia that involves hearing voices or seeing patterns that aren't there, you are already familiar with the phenomena.

The CIA appears to have so little internal balance that this kind of shoddy research could result in the government purposely trying to frighten the US populace, including grounding flights. This bodes poorly for finding actual security.

On Grokster and BitTorrent

The media coverage of the Grokster decision is so slanted towards the current big music industry that one wonders if the RIAA has spent more money lobbying the press than they have Congress. Nearly every article I have read can be summarized as "this is good for consumers because now they will be able to buy more music". Which is, of course, hogwash. I don't remember hearing many people clamoring for more ways to spend money on music. The music industry doesn't want creativity in pricing or delivery; now that they have iTunes, all other services are going to have to look a lot like it, or die.

More humorously, none of the coverage I saw discussed BitTorrent. The news services don't understand it (although its users do). It's not really a money-making service: it's a protocol. Bram Cohen, the originator of the protocol and the first software to embody that protocol, has never encouraged its use for sharing pirated music and video, although it is amazingly popular for doing that. It is also the tool of choice for the music that the RIAA wishes didn't exist: the stuff that the artists are perfectly happy to have available for free, such as that at etree.

BitTorrent also has very obvious uses for legit distribution of large files such as Linux and BSD distributions. These days, I always use BitTorrent instead of FTP for new releases, and I always leave my sharing window open until I have given at least as much as I have received (and usually try to go to 2x if there folks still downloading).

Of course, much of BitTorrent use is clearly illegal. Bram has made that clear by making the BitTorrent page a search engine for torrents, supported by AskJeeves-sourced advertising. Searching even for artists that support free downloading of their concert material brings up pirated versions of their commercial material.

This doesn't mean that BitTorrent is encouraging piracy: it means that the press completely missed the mark when it said that the Grokster decision is going to help consumers get what they want. BitTorrent will become the protocol of choice for trading pirated music exactly because it has never been trumpeted as being good for pirating, because it is already well-established for trading ok-to-be-free music, and because it is really good for distributing large OS installations and applications.

Ed Felten raises similar points, as well as scarier ones.

Cry, Cry, Cry

This wonderful trio only lasted for one album together, but they certainly continue to do fine on their own: Richard Shindell, Dar Williams, and Lucy Kaplansky. I re-discovered an old concert of theirs from 1/8/99 in Cedar Rapids, IA. Fall On Me is the REM song with a different set of plaintive harmonies, and The Ballad of Mary Magdalen is an incredibly sweet song of love and pain.

Human Sexual Response

If you were listening to music in Boston around 1980, you might remember a band by this name. Or, if you were listening to college radio almost anywhere at the time, you might remember their song "(I Want To Be) Jackie Onassis", and possibly "What Does Sex Mean To Me?". Their music was drenched in pheromones and sweat, and they were quite intense live. Although most local bands from the time are forgotten, HSR was cool enough to get a few brief descriptions.

Recently, I found a live show of theirs at DIME from a radio broadcast on 4/12/80. The opening song from the show, 1 2 3 4 5 6 7 8 9 10 (I think that was the name of the song, but it could be "I Don't Wanna Number One"), shows the rough nervous sexual energy that was a theme for many of their songs. If you are an HSR fan and want a copy of the show (CD or MP3s), let me know. And, if you have digital copies of their albums you want to toss my way, by all means drop me a line.

Orr Hot Springs

Last weekend was our anniversary, so Judy and I wanted to get out of town a bit. We went to Orr Hot Springs in Ukiah. I didn't put a link in that last sentence because Orr Hot Springs apparently doesn't have their own web site; however, this is a review that is commonly linked to. The best way to reach them is by phone at +1 707-462-6277.

In short, it is a great place if you like hot springs and you want something closeish to the SF Bay Area. You drive to Ukiah, go west about 8 miles on a really beautiful and twisty road, and you're there. There are a couple of very nice gardens, and the community kitchen for cooking your own food is large and has all the cooking items you could want (other than food). The rooms are reasonably priced, certainly not inexpensive.

Oh, the pools. They were fine for me, but many/most people would find them not quite hot enough. I could only stay in the hot tub about 15 minutes before baking; most regular hot tub fans could stay there much longer. The mineral content was acceptable, and the sulphur smell wasn't significant. The steam room and sauna were certainly hot enough for anyone.

The pool side of the creek is clothing-optional, which this weekend meant people were mostly without clothes except the two teenagers who were there with their family. Some folks find this kind of casual nudity wonderful, and I suspect that many people find it horrid and would never consider going somewhere like this. I'm in the middle: it was fine, and nice for sunbathing, but I would rather have been at a place where more people felt comfortable.

How will Apple prevent OS X from running on other boxes?

One of my first reactions to the "we're really going to use Intel" announcement was that the cat-and-mouse game between Apple and the people who want to run OS X on non-Apple computers would be fun to watch. Well, it will be fun for me and the technical community; it will be yucky for Apple.

Serious security geek Eric Rescorla starts to imagine how Apple will stop cheaters. His proposed solution: "simply arrange that all of their hardware components (BIOS, chipsets, graphics cards, etc.) have semi-proprietary interfaces that aren't available in commodity PCs and wire their interfaces to that hardware fairly deeply into their programs". That's reasonable, and not expensive for Apple to do. Eric then says "Obviously, people can replace these drivers, but we're now talking about very substantial amounts of work, more than the average person looking to save a couple of hundred bucks is going to be willing to do."

However, a different tact would be to clone the new Apple BIOS and write it into the box you wanted to run OS X on. This would make the box unusable as a Windows/Linux/BSD machine, but it would work as an OS X machine, unless Apple went non-standard in the chipsets, graphic cards, and other items that also have interfaces. Doing the latter, however, is very expensive for Apple, greatly increases the pre-ship QA time, and pisses off their vendors, all of whom are much more familiar with customers who take whatever chips they are offer.

There are certainly things Apple can do to make BIOS cloning difficult for typical PC owners, but I suspect that the hackers are going to have a great deal of fun circumventing Apple's attempts.

So have I become a phone luddite, or just complacent?

David Strom, the editor-in-cheif at Tom's Hardware, speaks for those of us who want to use cell phones as cell phones, and would rather have stability and usability instead of a myriad of silly features.

The other Apple Intel thing

Dual-core. Dual-core. Two CPU cores running in parallel, as long as they have an operating system that knows how to handle two cores. Some operating systems will take a lot of re-tooling to do this usefully, especially for normal desktop applications; others won't. Hint hint.

Let me repeat myself differently

Maybe I'm lost out here in the woods. Looking through a large stack of Mac blogs, I see almost nothing about running Windows in emulation under the Mac. Either I'm more deluded than normal, or this is absolutely huge for Apple. If you think all the possible Windows users who wanted to switch already did so based on the cute ads a few years ago, think again. Most of the curious/jealous strangers who want to ask you questions when you open your iBook/PowerBook in a public place are Windows users yearning for something better.

A year from now, when you do that and they ask "what about Windows programs?" and you switch to a running virtual machine with Windows and (casually) say "oh, I run them too" and you (casually) show them that they run at reasonable speed, what do you think their reaction will be? "That's nice, I guess I'll wait a few years"? "Gee, it's sad that the main interface you are using doesn't have a green Start button in the lower left"? "Well, it probably gets as many viruses as my system, and probably crashes as often, so I'm not interested"?

Or, possibly, "Now I can convince my company to get me one now that I can run the corporate Windows apps and work better for everything else"? Or, simply, "I want one".