From: mc/G=Brad/S=Hicks/OU=0205925@mhs.attmail.com
Subject: Re- Megatrends or Megaflops
Originator: daemon@eff.org
Organization: EFF mail-news gateway
Date: Fri, 18 Dec 1992 16:44:57 GMT

Subject:                                           Time:          Date:
Re: Megatrends or Megaflops?                       11:10 AM       12/18/92
 
I loved part 1 of Tom Forester's article in {EFFector Online} vol 4 #1,
"Megatrends or Megamistakes?"; even though I've seen most of that
information before, it was good and useful information and a fun read.
 
Part 2 (in vol 4 #2), on the other hand, had a few remarks that struck me
as ill-thought-out.  I apologize for the length of this article, but I
have strong feelings on some of these subjects.
 
 > The recent activities of hackers and data
 > thieves in the US, Germany and Britain have shown how all-too-easy it
 > still is to break into even the most sophisticated financial and
 > military systems.
 
Anyone who talkes about "sophisticated ... systems" hasn't got a clue as
to where the real problem lies.  The fault is not in our systems.  The
fault is in our administrators and users.  And that fault lies not in any
obscure technical area, but in the area of just plain common sense.
 
Twenty-some years ago, Harry Harrison's SF novel {The Stainless Steel Rat}
pointed out an all-too-common absurdity: impregnable bank-vault style
doors on rooms that had walls made out of plasterboard over pine studs.
And ubiquitous drop ceilings that make most doors OR walls obsolete.  One
of the reasons I loved the movie {Sneakers} was that it made so much of
these common vulnerabilities.
 
The metaphor extends well to computers.  A military computer system
designed and built to Orange Book standards or above, with zero backdoors
and no bugs in the operating system, can be subverted in less than an
hour, so long as there is even one third-shift operator who can be bullied
into giving the General's password to someone who he thinks is the
General's secretary.
 
I remember that years ago, the author of {Out of the Inner Circle} called
attention to the fact that given a few logon IDs, you can hack an account
on almost any machine by trying each logon ID with a short list of
passwords, like "password", "help", or the user's first name or initials.
Systems exist to prevent this problem or to at least make it less common,
but we don't use them -- because users hate having to choose complying
passwords.
 
Some vulnerabilities are even sillier.  When I was working at McDonnell
Douglas Corporation's military aircraft division, my last project (and the
one that so irritated me that I jumped ship) involved working on a capital
asset management system.  The using department was adamant: despite ACF2
security that restricted the system to only their authorized users, and
further security that would prevent the program from running on any
terminal other than the ones in their department, they wanted a second
password prompt at the point where you entered the capital asset
management system.  We argued about it, and I gave in and gave them what
they wanted.  When I went back to look for someone in that department
later, the list of authorized account numbers =and their passwords= was
neatly typed and taped to the terminal.  No level of "sophisticated
systems" will secure those users' data.
 
At least one credit-reporting bureau is notoriously easy to steal reports
from, reportedly because the minimum-wage clerks that use the system and
the companies that hire those minimum-wage clerks insist that the
passwords be no longer than three characters, not specific to particular
terminals, and that they never change.  No level of "sophisticated
systems" will secure that data bank, either.
 
 > Malicious virus creators have wreaked havoc on
 > important academic and government communication networks.
 
Is Tom using a definition of "malicious" that isn't immediately obvious to
me? In the almost seven years since the first sighting of a virus on a
Macintosh, only one (Scores) was intentionally malicious, and it turned
out to be mostly harmless (due to a programming error) and easily detected
and cured.
 
I understand that there are occurences of harmful viruses under MS-DOS,
such as Jerusalem and Michaelangelo.  But such viruses, and infection
thereby, are rare -- unless you belive the unsubstantiated hype of the
software vendors and consultants in the anti-virus industry.
 
 > Computer systems are often incredibly complex - so complex, in fact,
 > that they are not always understood even by their creators (although
 > few are willing to admit it!). This often makes them completely
 > unmanageable. Unmanageable complexity can result in massive foul-ups
 > or spectacular budget "runaways."
 
Every computer-related project that I've been involved in that had a
spectacular budget "runaway" (and I've seen some doozies) was related not
to the complexity, but to one of two things:
 
 1) Unrealistic, management-imposed deadlines for development, or
 2) Too large and poorly organized development teams, or
 3) Last-minute changes in the specification.
 
Usually #2 is related to #1; upper management imposes an impossible
deadline for a project, and middle management agrees.  When the reality
intrudes, the middle managers ask for additional manpower.  And as Fred
Brooks documented way back in the mid 70s in his must-read book {The
Mythical Man-Month}, adding manpower to a late software project makes it
later, because more time will be spent bringing the new people up to speed
and coordinating work between groups than actually cutting code.  When
middle management refuses to acknowledge this reality and keeps adding
manpower, you get a runaway.  You also usually get a disaster, because
intra-team coordination will have gone to hell, and there will have been
little or no time left for acceptance testing.
 
Does the history of the industry include any documented super-flops and
budget runaways that were =not= managed this way?
 
All three of these problems, and their solutions, have been well known and
widely publicized for =at least fifteen years.=  Unfortunately,
acquaintance with and acceptance of reality are not pre-requisites for
owning or running a business, even one that provides cost-driven,
safety-critical or privacy-sensitive services.
 
As with the security issue, this is also not a computer problem.  For
example, customer service is an almost entirely non-computer issue, and
the principles of providing top-notch service have been well-known and
well-documented since =at least= the early 80s, as in the complete works
of Tom Peters.  Companies fail to follow these principles not because they
are complex or difficult or obscure, but because they often violate the
"common wisdom" of the testosterone driven alpha males who gravitate to
leadership over large organizations or who have accumulated the wealth to
play games with the stock market.
 
 
The section on "new" psychological maladies is much better than the
preceding section, although again, I question an implied causality in one
section.  The author implicitly blames television, VCR
, and radio for
educational decline in American teenagers and young adults.  As Strauss
and Howe point out in their excellent work {Generations}, the myth that we
are seeing a decline in educational standards with no historical parallel
is just that, a myth.  They documented several such one-generation
declines, each of which occurred after an idealistic generation neglected
their children's upbringing while pursuing the spiritual life and social
change.  It is just as plausible to blame the Baby Boomer's
self-indulgence for Generation X's educational intransigence as it is to
blame TV; after all, what percentage of Generation X was ever read to as a
child?  Raised in a home with books in it?  Saw their parents read
anything for pleasure?  Saw any favorable portrayal of an intellectual
role model?
 
 
The complaints about "technobabble" are at least partially justified.  On
the other hand, humans are a language-generating species.  Every new word
and new concept orginates somewhere, and for a while after it does, not
everybody knows it.  Ultimately if it describes an object or concept that
everybody sees, then everybody learns the word and it enters common
language.
 
Besides, it isn't just high-tech areas that are flooding us with new
jargon to be learned.  Complain if you will about MIPS and megaFLOPS, RISC
vs. CISC, and so forth, but what does high-tech or its problems have to do
with the fact that over the years we've all had to learn such terms as
401K, LBO, "junk bond," or FSLIC?  Yes, learning new language is
stressful, and yes, the expansion of the language (as the maligned Alvin
Toffler pointed out in 1970) is accelerating. But I think that this is a
general social trend, not a trend in automation alone.
 
 -------------
 J. Brad Hicks     Internet: mc!Brad_Hicks@mhs.attmail.com
 X.400: c=US admd=ATTMAIL prmd=MasterCard sn=Hicks gn=Brad
 
 I am not an official MasterCard spokesperson, and the message above does
 not contain official MasterCard statements or policies.