Tuesday, January 22, 2013

USCOP

As part of my studies at the University of Regina, I have enrolled in a special capstone project where I will be working with Undergraduate and Graduate students from around the world on an open-source project called "Freeseer" [pronouced Free-See-R] which is used to record conferences using very simple equipment.

For the next semester, this blog will be used for that course.

Project Proposal

Monday, November 19, 2012

Can You Still Call it "Walking a Mile in their Moccasins?"

Can You Still Call it "Walking a Mile in their Moccasins?"

Up until now, my all time favorite piece was written back in 1997 for my History of Science class when I wrote about the history of the barber-surgeons and how they fixed a delicate problem for the King Of France. This piece is now my favorite and is dedicated to the wonderful people at the South Saskatchewan Independent Living Centre.

Back in May of 2012 my daughter, Elizabeth, ended up injuring both ankles badly enough that she could not walk a step; she would require the use of a wheelchair. Since we didn’t know how long she would need it, we decided to purchase a second hand manual wheelchair for about eighty dollars. She is now recovered, and the wheelchair had been sitting unused in the storage room in our house for a few months. Her experiences in the chair gave her a personal appreciation for the accomplishments of the disabled along with the struggles, both physical and social, they face on a daily basis. In November of 2012, I decided as a personal challenge to spend two days as a paraplegic and get a sense of the realities of life in a wheelchair.

While I could talk in depth about how difficult it is as a big fat guy to propel myself using the handrims, and how my arms were quickly exhausted from the effort, I will not, because that is an issue that is quickly solved with exercise and practice. By the end of the day, I was getting better. Given time, the apparent effort needed for self-propulsion in a wheelchair would be no different than the normal effort needed for walking. I’m out of shape, the wheelchair simply pointed that fact out to me in a roundabout way. Despite my inexperience in a wheelchair, I was still able to notice a few challenges that people in wheelchairs face on a daily basis.

The first thing I really noticed about moving around in a wheelchair is that Saskatchewan is not as flat as it appears. Since I am not allowed to use my daughter’s handicapped parking permit, and I wouldn’t use it myself even if I could, I parked in my normal spot in Lot 17 at the University of Regina, a gravel parking lot that normally leaves me with an easy ten minute mosey over to class, over what appears to be flat terrain. Even when sleepy after a long night working on my Computer Science projects, I can still walk in a straight line to class and avoid walking on the grass or running into light poles.

There is no such thing as flat when you are in a wheelchair. Downhill is easy, right? Point the chair in the direction you want to go and coast to the bottom, keeping your hands close to the handrims so you can apply the brakes when needed. Um, no. While speeding downhill in a wheelchair, you will discover the sideways slant that pulls the chair to one side, forcing the front off the sidewalk and tipping the chair over, throwing you into the grass. Properly aiming the chair is much like putting in golf. On the golf green, if you aim the ball directly at the hole, you will miss. Instead, you have to read the break of the green and aim the ball uphill from the hole so that gravity does the rest, dropping the ball in the center of the hole. In a chair, if you only aim at where you walk to go, you will either end up in the ditch or you will have to keep readjusting your aim, wasting a lot of energy in the process. If I drove like I move about in a wheelchair, I would end up with a DUI.

When walking, do you slow down when walking through an open door? If you are like me, one moment you are in the Archer Library Building, the next moment you are in the AdHum building without realizing you walked through a doorway. A closed door isn’t even much of an obstacle to a fully bipedal human, open the door with one hand, hold it open for the person behind you and keep on walking. I can even do that, drink from my water bottle, and respond to a text message without slowing down at all.

This does not happen in the wheelchair. Even an open door is an obstacle, as the width of most door frames is just a bit bigger than the width of the wheelchair. The process of going through an open door isn’t too bad, but you have to make sure the chair is lined up directly through the center of the doorframe, and that your hands won’t get pinched between the frame and the handrims as you slowly push your way through the door. Another way is to just grab the door with one hand, the frame with your other, and pull your way through.

Closed doors can have a huge effect on the accessibility of the building, especially in some corners of the University. If you are lucky, there will be an automatic door opening button, and it will be on the same side of the hall as the door it opens. Others, like the one connecting the Archer Library to the Residences, have the door button on the right, but the door on the left is the one that opens. This means you have to travel right to push the button, reverse in traffic, line up the chair properly, and pass through the door as it shuts behind you trying to catch your rear wheel. If the button is instead beside the door, it’s a simple matter to line up the chair to the door, push the button, and go through. Why can’t they all be like that?

Worst of all is a closed door that does not have a button to open it. If it is your classroom door, your best bet is to simply thank your classmate for opening and holding the door for you. However, if you are alone in the CS lab, trying to find and fix the annoying bug in your code after everyone has left, you will have to open the door yourself. This is a process that involves setting your brake, turning the doorknob, push (or pull) the door, and use the chair to keep it open while you pull yourself through the door frame. Good luck sipping a drink and texting while doing this.

Carrying a drink and your lunch is not easy in the chair. For someone able to walk ordering a drink and a meal is simple. Order, pay, grab your drink, find a table, sit down, wait for your number to be called, walk to the bar, grab your food, return to your table, and eat. Easy. However, in the wheelchair, how do you carry a glass filled with your beverage of choice with one hand, and propel the chair with the other? It’s not easy. A real paraplegic likely wouldn’t be able to hold the drink between their legs. Even if I cheated and used my thighs to hold the glass, it would likely spill as I made my way to the table. My only real option was to hold the drink with one hand and propel myself with the other hand, and switch hands every push of the chair. This is not very efficient, but it does work. It is easier to simply place the food platter in your lap to move to your table, but anything bigger, like a bag of groceries, and you will begin to have a much more difficult time.

After eating and drinking, the next step is to visit the washroom. Normally this function is completely automatic. You walk in, do your business, wash up, and walk out. Able bodied people do not rate washrooms on their degree of difficulty to get in and use. Unfortunately for those in wheelchairs, not all washrooms are accessible. It takes more than just a wider stall; just like a door, you must also be able to line up the chair to the entrance. Inside the stall, you have to spin the chair 180 degrees, and reverse to the toilet in order to transfer over. I still have not figured out how true paraplegics lower their pants in order to use the toilet. To be honest, once I got the chair over to the toilet, I cheated. After finishing up, there was another problem: I could not reach the soap dispenser, and it was quite the stretch to reach the sink to let the motion sensors activate the water taps. Again I had to cheat, either because the sink area was inaccessible or I was just too inexperienced to figure out how to do it.

The most surprising aspect of working with a wheelchair is that surfaces matter. Hard, smooth surfaces are best. A soft carpeted surface makes it seem like you are wheeling uphill due to the excessive friction between the carpet and the wheels. You have to continue to push the handrims to move; if you stop, so will the chair. Decorative surfaces, like in the Education and Kinesiology Centre, that may look hard still rub against the wheels, slowing them down, making every meter a hard push. The plain linoleum in the Classroom building is the best surface I found for using the wheelchair; I was actually able to glide a bit through the hallways and rest my aching hands a bit. The worst surface is a frosty sidewalk. The light dusting of snow and frost takes away all traction from the wheels preventing almost all movement. You can spin the wheel as much as you want, but the chair only moves a few centimeters at a time. It was so bad, that I actually had to abandon my simulation and walk the chair back to my van. Very few people would notice a difference in the effort needed to walk across these surfaces, but in a chair you notice every change; not all of them are good.

I finished my two days as a paraplegic exhausted, sore, but incredibly thankful for the experience. Two days after finishing the experiment, my hands are rubbed raw with small blisters on the fingers, and the muscles in my wrists, forearms, and pectoral region are still stiff and sore from the unexpected workout. My experiences with the wheelchair have alerted me to the more subtle issues that make it more difficult for people in wheelchairs to move about and take care of daily living. Prior to my daughter or myself being in the chair, I believed that the only consideration for wheelchair accessibility would be extra maneuvering space and alternatives to stairs. Wider bathroom stalls, wider aisles in classrooms, and ramps or elevators to deal with elevation changes. Spending two days in the chair has opened my eyes to the subtle challenges that face the users of wheelchairs and other mobility aids. When others complain of the cost of making modifications to make building more accessible, my response is simple:

“What if it was you who couldn’t use the washroom in this building?”

Thursday, October 11, 2012

Schools and Personal Responsibility

This is fun

The second of my ENGL 251 essays, this one draws its inspiration from my aborted career as a classroom teacher. Written as an example of "Exemplification" the assignment was to provide examples to prove your thesis.

One of the biggest problems with the Canadian education system today is the self-esteem movement. Starting in the 1980s, teachers were told that in order for students to achieve, they had to have good self-esteem. The consensus was that failing or disciplining a student damages their self esteem, leading to lower levels of achievement in school. The problem with this concept is faulty causality; students with good self esteem do not achieve. It is the other way around. Students who do well develop their own sense of self esteem, and more importantly, develop a sense of personal responsibility in their lives that allows them to achieve on their own. Canadian schools have failed in their duty to teach this basic concept and are doing long term damage to our students, in order to avoid short term pain.

I developed my own sense of responsibility in Grade 5, shortly after moving to a new school. I told my new teacher, Mrs. Clements, that I didn’t have to study for the science test the next day. She said nothing. She knew there was nothing she could say to make me take my science text home to study; instead she handed me all the rope I would need to hang myself. I had always taken pride in my marks so scoring a 35% on that test was an important bruise to my ego. Over time I took homework and test preparation much more seriously than I did before. Later, I would graduate, with distinction, from the University of Alberta’s Faculty of Education.

Schools no longer want to “damage” students by failing them. My wife required parental permission to fail any student. That permission was never given. Unfortunately for these struggling students, each school year builds upon the concepts taught the previous year. In some cases, like Mathematics, this makes it even more difficult to keep up. By the time these students get to high school, where social promotion is no longer an option, many of them find themselves so far behind, they cannot catch up.

The results of this misguided policy were found in the Mathematics 30 classes I taught in the Northwest Territories and northern Alberta. A typical Math 30 question would be “Solve for x in 7 log10 (5x) = 28”. The problem solution is relatively simple; only one step requires any skills that are new to a student taking Math 30. The step by step solution is below:

7 log10 (5x) = 28  // Divide both sides by 7 (basic algebra)
log10 (5x)  = 4  // New in Math 30: Rearrange to remove the log
104 = 5x   // Grade 5 calculation: 104 = 10 x 10 x 10 x 10 = 10000
10000 = 5x   // Again basic algebra, divide both sides by 5 to isolate x
x = 2000   // Final answer

Very few of my students were able to do this relatively simple question correctly. Not because I was unable to teach logarithms, but because they could not handle Grade 7 algebra, or in a few cases even Grade 3 division was too challenging. Why are Canadian students unable to master basic concepts in earlier grades? It is because they do not study for exams or do their homework as there have never been any consequence for failing. From the time they are in Grade 1 until the end of Grade 9, students today know they won’t be left behind. Teachers need to ability to ensure that students do not move on to the next grade unless they have proven mastery of the material they were given this year.

Unfortunately, classroom teachers no longer have the power to teach life skills such as personal responsibility in meeting deadlines. Lynden Dorval, a high school physics teacher in Edmonton, was initially suspended for giving students who had not completed an assignment a grade of 0 in violation of school and district policies. Without the threat of a zero on an assignment or an exam, Mr Dorval reasoned that students have no incentive to complete the work as assigned. They are not held accountable for their actions. Despite support from parents, colleagues, and even his own students, Mr Dorval was eventually fired by the Edmonton Public School Board.

Canadian students do not benefit long term when schools cater to their short term self-esteem at the expense of helping students develop the skills they need to take responsibility for their own learning and behaviour. Students who are struggling with the material do require extra help from their teachers and parents, and should receive it. Extra help should not include “doing their homework for them” or passing them off to another grade to become “someone else’s problem.” Such methods do not allow students to develop any sense of accomplishment.

Their self confidence can be developed in programs, such as at Cochrane High School, where students like “Steve” often begin their apprenticeship training in one of the trades. After struggling for years in the regular classroom environment, Steve blossomed in carpentry as he learned how to frame and build houses. Experiencing success for the first time in carpentry, he applied his new found confidence in his academic classes, finishing High School with honours and a clear path to success in the trades.

Twelve years after I failed that Science test, I ran into Mrs Clements at a teachers’ rally at the Alberta Legislature. I thanked her for letting me fail when she was still in a position to help me pick myself up. No amount of grade inflation would have assisted me over my lifetime than that single moment when I had to face the consequences of my poor choice not to study. At the time, I called her the meanest teacher I ever had. But now, twenty-five years later, because she showed me the value of failure, she is the best and most influential teacher I have ever had.

Sunday, September 30, 2012

This is Fun

This is fun

This article is my Descriptive/Narrative essay assignment for my ENGL 251 class at the University of Regina. It is mostly true, with some necessary "embellishment" needed to make it a good story. When people ask me why I don't drink any alcohol, this is the reason:

“He’s vomiting again!”
“Eighteen year old male -”
“Bed 16! Stat! Crash Cart ready.”
“Uuuuuuhhrhhrrrraaaah”
“Cyanotic, breaths shallow, slow and irregular -”
“How much did he drink?"
“Body temp 32, with seizures -
“Can I have a squirrel?”
“Lethargic and confused.”
"Only one glass. He didn't even finish it."
“BAC point three four!”
"Seriously! Look! I’m trying to save his life. How much did he drink?"
"I told you. Not even -"
"God dammit! Don't lie to me you idiot! How much did he drink?"
“I’ll name him Harvey. Harvey’s a good name.”
"One glass."
"You can't tell me he only had one glass, more like twelve. How many?"
"Code blue!”

It’s a miracle I survived. Emergency Room doctors and nurses get to see this more often than they want to. New adults stumble into the ER, their clothes and bodies covered from head to shoe top in the aftermath of the explosion at the vomitus factory. If they are lucky, they are still awake, not yet having fallen into a coma after their body temperature has plunged into hypothermia, while their skin has turned a deathly blue as respiration slows to a stop, and the hypoglycemic seizures twist their body into pretzels . It’s just a matter of time before the brain finally succumbs to the toxic chemicals they have freely forced into the bloodstream.

The strangest part about my near death experience is that it should never have happened. It simply wasn’t possible that three quarters of a glass of severely over ripe grape juice did all the damage that it did. After all, I had just turned the magic age of 18; according to the ritual, I should have been downing shot after shot of whatever the bikini-clad waitresses were pushing, as if my chances of scoring with them increased after every glass. Then, after striking out at the bar, my next step should have been to stumble back home, pass out on the couch, and wake up with a pounding headache and spend the morning with my face no further than three millimeters from the water in the toilet. This is called “having a good time.”

“Finally!” exclaimed Fatima as the study group completed eight weeks of research, observation, and writing about mathematics education in elementary schools.
Vanessa grabbed the pages from the printer and exclaimed, “Beer time!”
“I’ll drive.”
“No, Lloyd. You drove last time. Enjoy yourself this time,”
I replied, “It’s not a problem, really. I can’t drink anyway. I’ll drive."
A small smile came to Fatima’s face. “My uncle’s a Friend of Bill W. Twenty years next month.”
“That’s quite an accomplishment. Congratulations to him.”
“How long have you been a Friend?”
“I’m not, but I appreciate his work.”

I did eventually learn what had happened to me on my eighteenth birthday. When alcohol enters the liver, the enzyme Alcohol Dehydrogenase goes medieval on alcohol’s reactive hydroxyl group, replacing a deadly poison with a slightly less poisonous aldehyde. That’s the theory, but my body doesn’t work that way, never has. It cannot grab the slippery alcohol molecule long enough to remove a single hydrogen atom. You would have more success asking a paraplegic to stand up and beat Usain Bolt in the 100 meters.

In most humans, the liver is able to process about 90 - 95% of the alcohol you ingest before it reaches the brain and starts killing off useful brain cells. The rest of the alcohol is slowly excreted through your breath and urine. Since my liver cannot process any of the alcohol before it reaches my brain, the effect of drinking a single glass of wine is the same as four entire bottles for most other people. I zoom past tipsy without even looking, hit and run over drunk, and crash directly into “I’ve forgotten how to breathe properly”. Because I cannot drink any alcohol, I am often mistaken by others as a member of Alcoholics Anonymous.

One August long weekend, we were driving to my in-laws to spend the weekend. I was having those coughing fits that make you curl up into a the fetal position. The force of the spasmodic coughs squeezed my stomach in a space the size of a shot glass, which has the natural side effect of making one heave, retch, and cough some more. Arriving at the Shoppers before it closed, I sprinted into the store, blindly grabbed some cough syrup, paid, and hurried back to the van. While my wife Deborah continued to drive, I downed a shot of the cough syrup and proceeded to fall asleep almost immediately.

During that entire weekend I was either asleep, snarling at my kids over the tiniest of infractions, avoiding everyone altogether, or cursing the burning pokers embedded in my eyeballs. Deborah was pissed. It was not a great weekend, and the hacking continued, no matter how many slugs of cough syrup I downed. Going home was going to be one of those trips featuring the “Silent Treatment” that husbands know so well. While sitting down to supper, I picked up the cough syrup to take another belt, and saw the ingredient list for the first time.

"Oh Shit!”

The phrase that rang out in my in-laws kitchen was definitely out of place for me, my family, and my in-laws. The entire kitchen went silent. Everyone turned their heads and stared at me. I handed the cough syrup over to my wife and quickly grabbed a glass of water. Her voice was quiet and shaking as she read out the label, "Non-Medicinal Ingredients: Alcohol". I was not quite such a donkey after all. For the first time in my life I was actually drunk, enjoying all its wonderful gifts including the nausea, headaches, and the malaise that come with the hangover as you dry out. People actually look forward to this?

After spending my life as a mandatory teetotaler and permanent designated driver, I cannot say I have missed on the social experience of drinking alcohol. When meeting people on cruise ships or in other scenarios where alcohol is heavily pushed, it does give me the interesting talking point, “Did you know there is enough poison in that wine to kill me?” In some ways, the drinkers are jealous of my life. Nights out are cheap when you don’t have to buy an overpriced bottle of wine.

Louise set her glass down, “Nice choice of wine to go with the Barramundi, dear.”
“You’re welcome,” replied Dan. “Lloyd, no wine? Here, have a glass,” he offered. He held the half-empty bottle in his hand: ready to pour.
“No thank you,” I politely responded, giving him the brief version of the story of my condition.
“Wow, never heard of that before. Too bad. I’m guessing you just don’t understand what we have been saying about how important it is to get the wine pairing correct. I personally just can’t imagine having supper without a good glass of wine to go with it.”
“No, I suppose I don’t,” I laughed, “but I have found that fresh lemonade or a Coke goes well with just about anything.”
“To a great cruise!”
As the others at the table lifted their wine glasses, Deborah and I joined in with our virgin Cuba Libres.
“Salud!”

Creative Commons License
This is Fun by Lloyd Johnston is licensed under a Creative Commons Attribution-NoDerivs 3.0 Unported License.

Monday, April 2, 2012

My pet peeve about IT people

One question I ask myself many times is "Why are so many highly skilled IT workers so inept when it comes to dealing with people who are not 'computer people'?"

I have interviewed a few people for positions as break/fix technicians for my company. They would be dealing with primarily small business owners, non-profit organizations, and home users, particularly "Grandma". One of my standard interview questions was to have them explain to "Grandma" what happened to their computer - in this case, a virus infection. None of them could do it without lapsing into Geek Speak - they talked about exploits, patches, black hats, and TCP/IP. 

Many of my clients have also told me stories of calling up some of my competitors, and being made to feel like idiots because they simply don't know what a Power Supply is, or the difference between the tower case, the monitor and the hard drive. Many techs have hung up on people who say things like "the hard drive went blank".

My standard thought process is, if I know what you mean, I'll go with it. In the above example of the hard drive going blank, I knew my client was referring to the monitor. Good chance there is a power supply problem, or maybe the computer became unplugged, or the CPU overheated. I'm not going to overwhelm my client with all the technical terms though. I will use the proper terminology myself, POINT to the object in question and use analogies that my customers will likely understand.

One of my first customers (and he still is a customer today) is a retired highway construction foreman. He knows how to build roads. He knows the materials, he knows all the equipment, how to operate it, and in many cases how to fix it. Our economy needs people like him, much more than other professions that others are studying at University. What would happen if you put 30 typical IT people on a road crew to have them build a road? We would all be lost, and wouldn't have a clue on what to do. We probably wouldn't even be able to get the "thing-a-ma-jig with the giant shovel" even started, nor would we know what to do with it. The steamroller? Knowing some of us, we'd end up pulling a "Eddie in Roger Rabbit runs over Judge Doom" stunt.





I know computers. He knows road construction. Neither one of us is smarter than the other, but long term society needs one of us much more than the other. Which one is that is, is an exercise for the reader.

(Hint: V'ir tbggra hfrq gb qevivat ba cnirq ebnqf.)

Monday, March 26, 2012

The Secret to Life

From Computer World's Shark Tank Blog
http://blogs.computerworld.com/19786/infinite_loop


Flashback to the 1990s, when this new-to-IT pilot fish is trying to perform a calculation in Visual Basic as part of a database query -- and he's not having much luck getting it to work.
But he has an idea. "I had served on a committee with an older colleague who had betrayed a knowledge of such things and a willingness to help out a neophyte, so I wrote to him with a code sample and explanation of what I was trying to accomplish," fish says.
"After about 30 minutes, a reply came back -- I suspect he hadn't read my email for 25 minutes after I sent it -- and he provided an altered code snippet which, of course, worked perfectly.
"I wrote back to thank him and I asked, 'How do you know all this programming stuff?'
"His reply: 'It's very simple. You make mistakes. You learn from your mistakes. You repeat for 30 years.'
"As I was only 28 years or so behind him, I was much heartened by this statement."

 I was really struck by this simple story. One of the reasons I don't play online games with others is the hatred others have for a new player, who hasn't learned all the conventions of play. The same is true in industry, the veterans often maintain their place by pointing out all the mistakes made by the new guys, and how useless their training is, they should know all this stuff.

The problem is that as we gain experience, we forget what it was like to be a newbie. We are all newbies in one way or another, and veterans in others. As a technician, I deal almost exclusively with people who just don't know computers very well. My clients often apologize for their lack of knowledge, to which my question is almost always "What do/did you do for a living?"

One client replied "I used to build roads and bridges". I have never done that kind of work, and if I found myself on a road crew I wouldn't know the first thing to do. I would be a safety hazard and be getting in the way of everyone else. BUT as I learned I would become a better teammate, and if a member of crew took some time to show me how things worked, that learning would be sped up dramatically.

Below is my (slightly edited) comment from that Shark Tank Entry. I think it sums up the key to happiness in any profession:

while (!dead) {
  trySomething(new);
  make(Mistake);
  askForHelp(fromSomeone);
  learnFrom(Mistake);
  teach(someoneElse);
  beHappy(); 

  succeed();
}

Saturday, March 17, 2012

The why's of passwords

 WHY is a very important concept. Skilled social engineers know this, and will always give their target a plausible reason they need to do what they are doing, but companies rarely talk about the why of security. They will have policies like this:
  1. All passwords must be a minimum of 8 characters, with at least 1 number, and 1 special character
  2. All passwords must be changed every 90 days.
  3. Passwords cannot be reused
  4. Do not use the names of friends, family, pets, children, grandchildren, or "grand-pets"
These are sensible rules, but in my experience, employees do not like these rules, so they end up with a series of passwords like this:

Muff!n1 Muff!n2 Muff!n3 . . . . 

I have had much more success with compliance with the security rules when I add this bit to the "rules sheet".

These password rules prevents others from gaining access to they system, and can also protect your own personal accounts.  If an attacker guesses your password from information you have posted on Facebook, they can gain access to ALL of your accounts, including on-line banking, email, and anything you have access to on the company network.
The more complex a password, the harder it is for someone to guess using brute force methods. Steve Gibson has created a calculator on how long it would take to crack a password at https://www.grc.com/haystack.htm. Try out a few passwords and see the difference adding numbers and punctuation has on the length of time it would take to break - especially when you add characters. Try to get the Massive Cracking Array Scenario over 30 minutes.
Once an attacker has a password, they will sometimes wait for a period of time just in case you get suspicious and start checking everything. Changing the password regularly combats this problem - a compromised password will not work very long.
Once I explain the WHY behind my password policies on the networks I manage, there is much less "flak" from employees about having to change their passwords on a regular basis. In fact, I often get asked if the same rules should apply to their other accounts. The rules become more personal.

WHY is such an important concept when it comes to convincing people to do something you want them to do  - even in marriage. Don't just say things like "stop getting your nails done every week for $100". Instead, say things like "If you can do your nails once a month instead, we would have $3600 to pay down our debts. Once the debts are paid off, we can go anywhere in the world we want on vacation every year." In most cases, when people aren't seeing your point of view it's because they don't see the WHY.

Technology is cool, but wetware is critical.



Every so often, you read a story about drivers following their GPS system off a cliff, onto rail tracks, down a dead end, etc. The rest of the Internet know-it-alls then start saying that GPS stinks, you should never use it, compasses only - and that's if they ignore the colour of the driver's hair.

As this CTV report notes - the problem is not with the hardware, it's accurate to within 5 meters when you have clear skies. The two major issues are the maps that are supplied to the GPS makers, by definition they are always a bit out of date. Roads change and businesses move or close. It's also the people who ignore everything else around them - dead end signs, low bridge alertsbad roads, as well as little things like, say, the Pacific Ocean.

I have three systems that allow GPS navigation, and I like them all. My car's Nüvi gets me to all my client appointments in Regina even when I've never been to that particular house. The directions are easy to follow (especially with an Australian accent), accurate, and usually quite quick. Whenever I fly out to other cities for work, I bring it with me so that I can navigate along strange cities like a native, always knowing which lane to be in well before the turn off. It allows me to drive in Toronto - that's saying something. When my wife and I went to Los Angeles, we drove the rental car around LAX, San Diego, Anaheim, and back to LAX without having any problems (well she drove, I hate driving, and she hates navigating so it worked out well).

My iPhone also has GPS, and although I can't use it when driving, it works well for the newer areas that the  Nüvi  doesn't have in its system since I haven't bothered buying new maps for it. I can put in an address, have it show up, and I then generally know where to go. It eats battery time though, so I don't use it often.

Finally my Garmin Oregon 400, while not used for navigating my car has allowed me to find all sorts of geocaches in 5 different countries - it is accurate to within 3 meters. At that point, my eyes and mind take over to find those hidden treasures.

Why don't I have problems with my GPS navigation? Because I don't turn off my brain - it's a lesson I learned the first time I drove in Toronto with it. I told the GPS to take me to the Toronto Airport, and it was doing a good job. Then as I approached an exit - labelled with the Airport symbol, my GPS told me to keep going straight - ignore the exit. I trusted the GPS. I ended up at the cargo entrance and had to ask for directions at a nearby gas station. I got to the proper spot eventually, but I learned my lesson - highway signs take priority over the Australian girl on the GPS. The next time I was in Toronto, I followed the sign, and after a quick "RECALCULATING" the GPS did take me to the airport.

It's like that with any technology. In an inter-group discussion in class we talked about how people are unable to do simple calculations without a calculator. While I don't expect someone to do 3.54 g / 40.08 g/mol to get 0.0883 mol in a Chemistry lab, you should still be able to do $50 * 1.10 = $55.00 including the tax when at the store. Planning on going hiking in the woods with a GPS? That's fine, but bring extra batteries, and take a course on how to read topo maps and use a compass. Those don't require batteries - in an emergency, you need to be prepared to rescue yourself and do it without batteries.

In other words, don't be this guy....


Tuesday, March 13, 2012

Innoculation

23 Questions with Kevin Mitnick from Hak5

(Skip to 11:15 for the section I'm talking about. The full interview can be found here.)



In our project for CS 280, we had initially intended to do what Kevin Mitnick is doing now, simulating an attack on the employees in a business, so that they could recognize what a social engineering attack looks like. Medical vaccinations work the same way, you give the body a weakened form of a disease so that when the body is infected by the real deal, it can recognize the antigens and mount a strong defense.

The reason behind this is the basic human need to be helpful. Humans evolved as social creatures, where each individual did their best to help the pack. Much of our internal wiring is based on trusting others and helping out, so we do not initially (at least deep down in our guts) seek out to distrust others - it is experience that brings out distrust. Think about it - ever been on vacation, handed over your camera, and ask a total stranger to take a picture of you and your significant other? And 9 times out of 10, what is that person's response? Either "Sure. Say Cheese!" or at most, you will be asked to reciprocate the favour for them. I've done it myself (both ways) at Grey Cup 2008 in Montreal and when my wife and I went on our cruise in July. People do want to be helpful, and that is not a bad thing.

The problem is when the "bad guys" take advantage of loop holes and short circuits in basic human psychology. As I've said before, the best security products and "least privileged accounts" will always fail when the staff is fulling willing to hand over the keys to the network. Donuts, coffee, and some flattery (bonus marks if the bad guy even means it) will get you much farther than learning about 0-day hacks, cracks, and weaknesses in the system. Do employees mean to compromise system security? Other than disgruntled employees (what's a gruntled employee anyway?), in most cases they are simply trying to be helpful.

This is where Kevin Mitnick, and other White-hat hackers like him, come in (although due to his past, at best Mitnick could only be called a Grey-Hat). The simulation of social engineering attacks shows three main things to employees:
  1. What a social engineering attack looks like and how to recognize it.
  2. The damage that can be done.
  3. And most importantly, WHY security protocols are they way they are, and how YOU personally can help us protect the network.
This inoculation is vital for companies, and an employee who "fails" the test should actually be considered more valuable to the company. In my opinion, someone who passes the test has a risk of becoming complacent, and may not treat a real attack seriously. Whereas, someone who has failed is much more likely to want to prove themselves to their employer. They will ask more questions, they will know why to ask those questions, and they won't be afraid to ask those questions even to someone claiming to be a police officer or a high ranking executive in the company. 

In one secured building I'm in on a regular basis, even the CEO must show his ID to the security guard, and they actually check the ID. It only takes a few extra seconds, but those few extra seconds are what matters when it comes to security. Asking visitor to wait a few extra seconds while you verify their presence will scare off the social engineer (there are much easier targets out there), but legitimate visitors will often say "No problem", especially if you become a social engineer yourself and offer them a cup of coffee while they wait.



Saturday, March 3, 2012

Patent Trolls

There are three main ways to protect your creative and inventive works. In most cases, the method you use depends on the type of work you have created. Your choices are:
  1. Patents are used for inventions, processes, or improvements on an existing invention. You can get a patent for a "better mousetrap" or for a method for turning mouse bodies into a new energy source. Patents cannot be issued if the method is "obvious to one ordinarily skilled in the art". Also, according to the exisitng law, patents can be overturned if you can find "prior art". In the IT world, devices can be patented, and so can software.
  2. Copyright is used for creative works like music, fiction, non-fiction, paintings, photographs, sculpture, dramatic performances and other creative works. This is why you cannot legally record a video of a live performance or share copyrighted music with your friends. 
  3. Trade Secrets are only effective as long as you keep the method or recipe secret. Once it is revealed, even inadvertently, you lose all protection. Examples include the receipes for Coca-Cola and KFC's "secret herbs and spices". Nothing prevents someone from using reverse engineering to learn the methods. I remember once creating some fried chicken in my kitchen that tasted almost exactly like KFC. Too bad I didn't really pay much attention to what I used....
Unfortunately, the patent system is busted. Patents are being issued for things that are clearly obvious. For example, the shape of the iPad is patented, it's a rectangle, Amazon has a patent on "One-Click" shopping, 

The other problem, which I will deal with here, is companies (Patent Trolls or Non-Practicing Entities) who buy up as many general and vague patents as they can, with no intention of actually creating a product with them

For example:

The patent, titled "Automatic message interpretation and routing system," is unsurprisingly general. It was filed in 1998 and awarded to a company called Brightware, Inc. in 2002, and it basically describes an autoresponder. "The method for automatically interpreting an electronic message may also include the step of retrieving one or more predetermined responses corresponding to the interpretation of the electronic message from a repository for automatic delivery to the source," reads the patent.
Polaris accuses Google of "actively inducing infringement" on the patent and contributing to the infringement of others by implementing its own automatic e-mail responder within the company. Amazon, Borders, AOL, and all of the other named defendants are accused of doing the same. "As a result of these Defendants' infringement of the '947 Patent, Polaris has suffered monetary damages in an amount not yet determined, and will continue to suffer damages in the future unless Defendants' infringing activities are enjoined by this Court," reads the complaint seen by Ars Technica.
Patent Trolls increase the cost, and slow down the pace of development in the IT world due to the expense of having to deal with inadvertent patent infringements. In most cases, the business model of the Patent Troll is simply to sue for damages whenever someone infringes on their patent, they do not otherwise produce any product or service. With copyright protection, when software is found to be accidentally too similar, the developer can fix their code easily using different algorithms to solve the same problem. When the problem is patented however, no amount of re-writing the code will make it non-infringing.

One defense against a bad patent is to prove "Prior Art". Farhad Manjoo wrote in Slate about how a company is using crowd sourcing to find prior art to allow their clients to overturn bad patents.


http://www.slate.com/articles/technology/technology/2012/02/article_one_partners_how_a_bunch_of_amateur_sleuths_are_stamping_out_patent_trolls_.html

The problem is that searching for old inventions is really difficult. Patents in the United States are keyword coded and searchable, but they use dense, technical language that makes them difficult to browse through. What’s more, “prior art”—a description of an invention published prior to a particular patent’s filing date—can exist anywhere, not just in a patent database. If I sue you for infringing my patent on an ancient Chinese healing technique, you’d have to look all over China for a description of the technique that was published in days of yore. But how would you know where to begin?
Unfortunately, this makes it still difficult to combat Patent Trolls. So here is my suggestion for reforming Patent Law. I release it into the Public Domain, no patents here:
  1. Software cannot be patentable, only hardware. Firmware is defined as software since it can be updated without replacing any parts.
  2. All issued patents are conditional for 12 months. A company has 12 months of protection to begin producing a product and releasing it to the market.
  3. If a company is producing a product within 12 months, their patent protection continues for the standard duration of the patent.
  4. If, after 12 months, if there is no process in place to produce a product, the conditional patent expires. Transferring the patent to another company does not restart the clock.
  5. A company can request a one time, 12 month extension if there are unanticipated glitches that need to be worked out prior to manufacture or sale.
  6. The definition of "Producing a Product" can take many forms:
    • Self -manufacturer and sale
    • Subcontracting the manufacturing and/or sale to another firm
    • Licensing the patent to any interested firm, who then manufacture and sell the product
    • Any or all of the above, plus any other arrangement that could be considered production.
However, merely suing infringing companies is not considered "Production". You may sue during the first 12 months, but any damages will be put into escrow until the patent is no longer "Conditional", and the infringing company will be subject to cease-and-desist until the end of the 12 month period. If the patent expires due to non-production the escrow money is returned and the injunction expires. If however, the patent holder begins production, they get the damage reward (plus interest) and the injunction becomes permanent.

The main idea behind this is that patents can still be issued when valid, BUT a company is not allowed to sit on them and use the court system to make all their money. If you cannot monetize your patent yourself, you can still license the patent and make money off the royalties, but you cannot use the legal system to bully others.

This system still allows inventors to profit from their inventions, but explicitly disallows them to simply sue others into oblivion - they must take action to bring their patents to market to justify being awarded damages by the court. If you have no intention of marketing your product, another company is not damaging you by releasing a similar product. Innovative individuals are still rewarded, but innovation itself is not needlessly frozen by legal threat from Non Producing Entities or Patent Trolls.

Is my idea perfect? Nope. It isn't. So please improve on it.

Tuesday, February 21, 2012

They just aren't that bright

Now, while Cracked.com is not considered an academically rigorous source, they are up there with Jon Stewart and Stephen Colbert when it comes to satire and not having to make up facts to be funny or truthful. Many of the students in my CS 280 class are concerned about privacy and government intervention in their lives. At the same time, many of them are looking for government regulation when it comes to privacy policies on the Internet.

Personally, I look at the government as the last place I would look for assistance in my life. I operate my personal and business lives as if the government is NEVER going to help me, and that's been a pretty accurate way of living my life. When it comes down to it, the government just isn't all that bright for the most part. I do hold the Canadian government in a bit higher regard when it comes to IQ, compared to the American government but not enough for me to change my mind for the most part.

Consider how good law enforcement / national security is at basic surveillance......

http://www.cracked.com/article_19677_6-people-who-turned-tables-government-surveillance.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+CrackedRSS+%28Cracked%3A+All+Posts%29&utm_content=Google+Reader

Or the priorities of government....Seriously, did these things need to be banned?

http://www.cracked.com/article_19192_6-things-you-wonE28099t-believe-got-banned-by-modern-governments.html


Protecting your privacy on the Internet is actually quite simple, don't post anything you don't want plastered on the front page of the Leader-Post or emailed to your boss. Don't use companies whose privacy policies aren't up to your personal standards. While Google and Facebook dominate their markets, they are not the only companies that do search or social networking. Market economics will reward a company who can provide search as good as Google while at the same time providing a higher level of privacy to its users. The drawback may be that you pay a monthly fee to use the service since they will not be able to charge as much for advertising because they don't have as much information about their users.

How much would you pay for Google quality searches without the privacy implications? Personally, I will continue to use Google as I police my own privacy. As a challenge, I will give the first person who can find an embarrassing article, picture, or status update about me $25 (it must have come from me or one of my customers - no fair making one up yourself using photoshop).

Ready, set, go!

Sunday, February 19, 2012

Final thoughts on our Ethics Review

One of the most valuable parts of this project has been the feedback form the U of R Research Ethics Board (REB). In our initial plan, we had failed to do everything we could to protect the interests, reputation, and employment status of the research subjects. We had not taken into account various legal and ethical issues, assuming only that nothing bad would happen because the director had signed off on the project. We had not fully taken into account that there were three parties to this project, the researchers, the target organization, AND the University of Regina.

One of the main problems with our plan was the simple fact there were three parties to the proposed penetration test (pen-test).  According to Chan Tuck Wai in his report Conducting a Penetration Test on an Organization you have to be very careful about how you conduct penetration tests on a network. Since such tests often involve what would otherwise be illegal activities, prior, proper legal preparation is essential. Normally, only the pen-testing company and the client company are parties to these agreements. Together they can hammer together all the legal protections needed. If employees are upset about the pen-testing, their legal actions are restricted to their employer and the pen-testing company - both are risks that can be mitigated through careful planning. However, in our case the U of R was also involved which would give an aggrieved employee another party to sue. Unfortunately, the U of R’s reputation may not be able to survive the publicity of “teaching a class on how to break into networks”. For this simple reason, our proposed project was rightly killed by Enterprise Risk Management.

The REB reported a large number of problems regarding our initial research plan. The major issues came to protecting employees from any repercussions of their actions during these tests. Despite assurances from management that no actions would be taken against employees who “failed” a test, the REB pointed out that while it is possible that no entries may be made in an employee file, management is human, and could remember who made mistakes during the pen-test. Since our initial plan was to present a very open and honest in-service with the cooperating organization, naming names would have been a problem, even if the names would never be mentioned in presentations outside of the organization.

The Interagency Advisory Panel on Research Ethics has issued the Ethical Conduct for Research Involving Humans. This document acknowledges the need for deception in research, particularly in the field of psychology. According to the Advisory Panel, “it is the responsibility of researchers to justify the need for such a departure” (p. 37) from fully informed consent. Further, given that we are undergraduates and not formally trained in research techniques, we should only be engaged in Minimum Risk research. Regardless of how much we anonymize the data by cutting out names, the use of edited transcripts, or disguising audio, the simple fact is that we cannot stop employees from talking to others about what we had done. This factor, regardless of anything we do, prevents this research from being Minimum Risk. There is simply no way we can enforce a “no-repercussions” policy from being applied, which again opens the U of R to a legal risk it cannot reasonably expect to take.

As a result of the feedback form the REB, we will not be conducting a real Social Engineering based penetration test. Instead, we will demonstrate Social Engineering attacks using actors, and will provide strategies for combating the threat of Social Engineering in your organization. As for what we really think about the REB, there is only two words we can say. Merci beaucoup! Your input was valuable and it is something we will take with us in our future endeavors in the world of IT.

Tuesday, February 14, 2012

Sicko and SOPA

I know it’s not IT related, but I still had to write this.

Last night I watched Michael Moore’s film, Sicko. While it’s an older film (2007) I still found it quite good. While many people, particularly Americans do not like Michael Moore, and others find this film very one sided, he still raises some very interesting and valuable points about health care systems around the world. His critics accuse him of cherry picking facts, looking for the health care horror stories, and putting universal health care on a pedestal it doesn’t deserve.


“Too many OB/GYNs aren’t able to practice their love with women all across this country.” - George W. Bush.
Sicko has three major themes running through it:
  1. The plight of un/under insured Americans and what the insurance companies will do once you have a major claim
  2. A comparison of different Universal health care systems in Canada, England, and France
  3. The plight of 9/11 rescue workers – he actually takes some of them to Cuba for treatment – and treatment they got
My Health Care Story

Last February a lump was found in my lung that was the size of a mandarin orange. I was immediately referred to two different specialists. I was facing the loss of the lower left lobe of my lung if the lump was found to be cancerous. By April, I was recovering from surgery, and the lump was found to be non-cancerous. Only a small piece of my lung was removed, and I was completely cured.

At no time did I have to do any of the following (unlike many Americans):
  • Get approval from my insurance company for the procedures
  • Pay any deductible to even see a doctor
  • Fight with Sask Health when they dropped my coverage retroactively after discovering I had a sore elbow in 2002
  • Fund raise with my neighbours so I wouldn’t lose my house to pay for everything
  • Wait a life-threatening length of time
  • Declare bankruptcy when the insurance company then simply decides not to pay the doctors.
Yet, for any major procedure waiting for people in the United States, they face all those challenges and more, and it will not change because people continue to vote the way they do. The power brokers in the US have the best care money can buy, they see no problem with waiting times or denial of coverage. They live under different rules then the rest of the country, and it simply won’t change until the American people decide to start voting for third parties – as long as the Republicans and Democrats have control control over the political system it won’t change.

Political Change

In Canada, the NDP will never form the government. I personally won’t vote for them because I’m not a fan of unions. However, I must acknowledge the valuable contribution they have made to Canadian politics. Simply by getting Canadians used to the idea that there are legitimate choices at the ballot box and asking the tough questions in Parliament is valuable\
.
Change is hard, but it can be done. Tommy Douglas changed the debate in Canada about health care. SOPA and PIPA were defeated as a result of public uprising. The RIAA and MPAA called it undemocratic because the protestors didn’t meet in backrooms with Congressmen like good lobbyist do, but the backlash worked. It can work again for ACTA. It can work for health care. Popular dissent, freedom of speech, and freedom of assembly all work. Politicians need to be afraid for their jobs.

So if Freedom of Speech, and popular uprising work, why didn’t Occupy X work? Simple – they didn’t have a clear message.No one could clearly articulate what was Occupy. Some were against the TARP bailouts, others said it was about affordable housing, others said it was about health care, and still others said it was about gay marriage. It made it too easy for the powers that be to simply ignore Occupy. They could not ignore the very targeted  message the anti-SOPA group put out.

Lessons


When looking for change, make sure you have a very targeted message. Successful leaders craft their message for a specific audience and do not attempt to be all things to all people. Make no mistake, the lobbyists always have a specific, targeted message when they speak to MPs, Senators, or Congressmen. For us to defeat ACTA a similar targeted message is needed. Just like with the SOPA issue.

Monday, February 6, 2012

The Research Ethics Board wants a word with you . . .

In my CS 280 class (Risk and Reward in the Information Society) we have to do a group topic. I had an immediate idea that had even been in my head before the class even began. Fortunately, I was able to get three great partners within 24 hours of posting the idea and our group was formed. Now, at this time I cannot divulge the nature of this idea, but I can tell you that while the professor liked the idea he noted there may be a problem. Enter the Research Ethics Board and the requirement to do a full review of the ethics of our idea.

My initial thought was "Oh no, there goes our idea" but it has turned out to be a serious blessing in disguise. The concerns they have been raised has forced our group to clearly communicate about what is important, and what we really need to do to get good results.  When you are in the middle of an idea that you think is incredibly awesome you are blind to the problems hiding in the corner. Even though the ethics review did not focus on the central thesis of our project, the Research Ethics Board has asked good questions and brought up excellent objections in their ethical review. Have you ever read the ethical guidelines for research? It is a great guide for coming up with your next research project:

http://pre.ethics.gc.ca/pdf/eng/tcps2/TCPS_2_FINAL_Web.pdf

Our group has now rewritten our research plan to deal with the objections raised by the REB, and guess what? We will still accomplish the same goals. We should still be able to do our research. Yet, it will be easier for us to do, we will be able to complete it quicker, and our presentation will be even more meaningful for both our class and for others who will have a chance to read it. Why? Because the review has forced us to consider what was truly important, eliminate side investigations that would get us into trouble, and most of all to share our ideas.

The other big advantage the the Ethics Review? When you are taking a course in programming, you really learn the materials when you sit down in front of a text editor and start writing programs. You learn about digital circuits when you open up a logic simulator and start putting together gates, flip flops, registers, and other cool stuff to make complex circuits. Where best to learn about ethics then to actually write a real Ethics Review Proposal for your project. Even if I never learn anything more from this course, the REB has taught me more than enough to justify taking the course. As a mature student I really appreciate the extra work - it is really making me think harder, and learn more, and that is something I can put on my CV. I haven't just taken a course on IT Ethics, I've actually written and participated in the ethical review procedure - something that is valuable in itself.

Hopefully we will get our formal approve from the REB soon, but if not, we have already discussed Plan B - always something good to have anyway.

More on the Office of Research Services at the University of Regina is found here: http://www.uregina.ca/research/index.shtml