What is CISPA and Why is it Dangerous?

The EFF has put together an excellent [FAQ on CISPA][0], the ``cybersecurity''
bill that was reintroduced to congress earlier this month.

[0] https://www.eff.org/deeplinks/2013/02/cispas-back-faq-what-it-and-why-its-still-dangerous
Libreated Pixel Cup Winners Announced

[Congratulations][0] to the [winners of the Liberated Pixel Cup][1].

[0] http://www.fsf.org/news/winners-announced-for-free-software-gamings-highest-honor-the-liberated-pixel-cup
[1] http://lpc.opengameart.org/content/code-judging-is-in
DMR: ``Very early C compilers and language''

An interesting article by Dennis Ritchie discussing [early C compilers][0]
recovered from old DECtapes. The source code and history are fascinating reads.
The quality of the code (the ``kludgery''[1], as he puts it) to me just brings
smiles---I appreciate seeing the code in its original glory.

It is also saddening reading the words of such a great man who is no longer with
us; perhaps it helps to better appreciate his legacy.

[0] http://cm.bell-labs.com/cm/cs/who/dmr/primevalC.html
[1] http://www.catb.org/~esr/jargon/html/K/kludge.html
Google Says the FBI Is Secretly Spying on Some of Its Customers

A Wired article mentions [figures released from Google][0] regarding National
Security Letters issued by the NSA under the Patriot Act. It is too early to
comment in much detail on this matter (I would like to wait for commentary from
the EFF), but, as the article mentions:

  Google said the number of accounts connected to National Security letters
  ranged between “1000-1999″ for each of the reported years other than 2010. In
  that year, the range was “2000-2999.”

The [EFF provides additional information, including recommendations on what to
do about such requests][1] via their Surveillance Self-Defense website. As
quoted from that website:

    And it's even worse for FISA subpoenas, which can be used to force anyone to
    hand over anything in complete secrecy, and which were greatly strengthened
    by Section 215 of the USA PATRIOT Act. The government doesn't have to show
    probable cause that the target is a foreign power or agent — only that they
    are seeking the requested records "for" an intelligence or terrorism
    investigation. Once the government makes this assertion, the court must
    issue the subpoena.[1]

To add insult to injury:

  FISA orders and National Security Letters will also come with a gag order that
  forbids you from discussing them. Do NOT violate the gag order. Only speak to
  members of your organization whose participation is necessary to comply with
  the order, and your lawyer.[1]

[0] http://www.wired.com/threatlevel/2013/03/google-nsl-range/?cid=co6199824
[1] https://ssd.eff.org/foreign/fisa
Adding 1 and 1 in PHP

An amusing demonstration; it is my hope that [readers will not take this PHP
library seriously][0]. This is likely a parody of the over-engineering that
often takes foot in Object-Oriented development (a game of ``how many GoF[4]
design patterns can we use in this project'' anyone?).

That is not to say that ``OOP is bad'' (just as object-oriented developers often
consider procedural code bad, when they may just be terrible at writing
procedural code). Indeed, I wrote [an ECMAScript framework for Classical OOP
(ease.js)][1].  The problem is that, with the excitement and misunderstandings
that surround ``good'' object-oriented design, designers are eager to
over-abstract their implementations (I have been guilty of the same thing).
Object oriented programming is often taught to novice CS students (often with
the reign of Java in schools)---teaching practices that can be good principles
when properly applied and in moderation---which I have also seen contribute to
such madness.[2]

Abstractions are highly important, but only when necessary and when they lead to
more concise representations of the problem than would otherwise occur (note
that some problems are inherently complicated and, as such, a concise
representation may not seen concise). I'm a strong advocate of DSLs when
abstractions begin to get in the way and increase the verbosity of the code
(languages with strong macro systems like lisp help eliminate the need for
DSLs written from scratch)---design patterns exist because of deficiencies in
the language: They are ``patterns'' of code commonly used to achieve a certain
effect.

[Criticisms against OOP are abundant][3], just as every other paradigm.

[0] https://github.com/Herzult/SimplePHPEasyPlus
[1] http://easejs.org
[2] http://c2.com/cgi/wiki?TextbookOo
[3] http://c2.com/cgi/wiki?ArgumentsAgainstOop
[4] Design Patterns: Elements of Reusable Object-Oriented Software. ISBN
0-201-63361-2. Gamma, Helm, Johnson and Vlissides (the "Gang of Four").
Oxford University Blocks Google Docs

Oxford University decided to [block Google Docs][0] last month due to phishing
attacks against its users. To quote the blog post:

  Almost all the recent attacks have used Google Docs URLs, and in some cases
  the phishing emails have been sent from an already-compromised University
  account to large numbers of other Oxford users. Seeing multiple such incidents
  the other afternoon tipped things over the edge. We considered these to be
  exceptional circumstances and felt that the impact on legitimate University
  business by temporarily suspending access to Google Docs was outweighed by the
  risks to University business by not taking such action.[0]

This incident was brought to my attention by a blog post by Schneier,[1] in
which he referenced his [essay on ``feudal security''][2] (I commented in more
detail on this essay in [my response to a previous blog post of his][3]). In
this case, Oxford is trusting that it knows better than its users and has the
right to exercise this power over them in light of their inexperience with
handling these situations (or even recognizing them).[0]

This may very well be the case---the Oxford IT department probably does have a
better understanding of security than many of their users. However, by blocking
access to Google Docs, they are also blocking access to millions of legitimate
articles hosted there, which is far from acceptable. Oxford is more than just a
workplace---for which many would argue these actions are acceptable; it is a
university that should encourage freedom of expression. They simply must find a
better way of dealing with these problems. If a user falls victim to a phishing
attack within Oxford, they will likely fall victim outside of it.

Would Oxford consider blocking e-mail access too (where phishing attacks are
very cheap and common)?

  We appreciate and apologise for the disruption this caused for our users.
  Nevertheless, we must always think in terms of the overall risk to the
  University as a whole, and we certainly cannot rule out taking such action
  again in future [...][0]

N.B.: Google Docs is proprietary and I cannot recommend its use any more than I
can recommend use of Microsoft Office.

[0] http://blogs.oucs.ox.ac.uk/oxcert/2013/02/18/google-blocks/
[1] https://www.schneier.com/blog/archives/2013/03/oxford_universi.html
[2] https://www.schneier.com/essay-406.html
[3] [cref:3fa69da6531cb2131a7f52d17eb77a75e01794ba] (I posted a link to my
response on his blog, but he did not approve the comment.)