Elphaba's Hideaway

Eureka! It's supply and demand, stupid!

2010-07-20T21:21:00.000-07:00

I've been twisting for a very long time over the whole 'vendors should pay for vulns' mantra that has recently been enthusiastically revived by a bunch of independent security researchers who, to the best of my knowledge, have never actually worked for a software vendor to understand the engineering realities of developing enterprise software.

Tonight I realized why vendors don't need to pay a dime, and it has nothing to do with vendors buying silence or two researchers finding the same bug independently and the second researcher going Full Disclosure on the vendor because the first researcher already collected the bounty.

We can all stop debating what a critical remote code execution bug is going to be worth when there is an open market for vulnerabilities. An open market requires competition. And there will not be competition. Who is going to buy Apple bugs? Apple. Microsoft sure as hell isn't going to buy them, not without a whole lot of up close and personal attention from the nice folks at the DOJ. So let's say Apple offers $10 per RCE. Whaddya gonna do about it? Whine? Go sell it to iDefense? YOU CAN DO THAT TODAY.

So simple it makes me giggle that I didn't see it before. Econ101.

~E

We're All Gonna Die Someday

2010-07-04T17:59:00.000-07:00

That title wouldn't typically be associated with optimism. Bear with me here. Lately I have had a number of reminders of my mortality, all in the span of about two months. It has been a bit overwhelming and has forced me to consider how I am living, and what is important to me. The time I have left is shorter than the time I have traveled. The 'how would you live your life if you knew you only had a short amount of time left' theory is popular in movies and books, and even something easy to say you are going to do. It is hard to live though. It is really easy to allow fear to lead you to settle for the known, for something comfortable, something good enough. Fear can make you run, but fear can also make you stand still. I spent 2009 standing still. I was so afraid I would never find what I want, so afraid I had made mistakes, so afraid I would settle, I was too afraid to even try.

I am not afraid of dying. I am afraid of dying with regrets for the things I didn't do, I am afraid of settling for 'good enough'. I don't want to look back in regret on the time I had, and wonder if i wasted it. A tolerable life is not enough. I've thrown my world into total upheaval to find more than that. I want bliss, I want joy, I want growth and new experiences and exploration. I want to see the world, I want to experience all life has to offer. That is going to take time and is almost certainly be a hard road and I can't do it if I am too afraid to go outside and expose myself to it. If I don't get on the road, I'll NEVER get to where I want to go. And where I want to go will be worth it. And that is why I am optimistic. Don't get me wrong, I destabilize a bit every time I get a visceral reminder of the fact that time is moving quickly and there is still a lot left that I want to do with my life. I'm scared I won't get there. But I look with a new respect at what I have, the happiness I have, and find opportunities to experience new things every day. And I owe it to myself to continue actively living my life as best I can to achieve my dreams.

I'm going to get there. And if there is some unforseen tragic accident in which I die tomorrow, it will be knowing that I lived as fully as I could to achieve my dreams.

~Elphie

fanfuckingtastic

2010-07-02T14:25:00.000-07:00

I notice I am swearing a lot lately. A lot more than I used to. It actually makes me a little uncomfortable, and I'm working on cutting back on the F-bombs. But dammit Jim, I'm an analyst, not a linguist, so I broke down my last blogpost and discovered the following things:

ONE:
1,222 words
16 swear words*

that means just 1.3% cussing. That doesn't seem so bad.

TWO:
I copied my last blogpost and pasted it into a Word doc to get the wordcount and GODDAMMIT IE8 SUCKS ASS for not having a spellcheck function. Hello, it's a 2009 product, who keeps cutting this goddamned feature? Why do I have to write my blog in Word so I can have a spellcheck feature and then copy it into the browser? I can't possibly be the only person generating content on the web.

Workaround: Use FireFox. *sigh* I just wish FF didn't crash so damn often.

~Elphie

*douchebag not counted as swearing

(this blogpost contains 3% cussing)

Fuck You, 2009.

2010-06-30T23:09:00.000-07:00

2009 was a bad year.

No, let me rephrase that.

2009 was a totally shitty year.

That might not be an adequate description either.

2009 was without a doubt the hardest and worst year of my entire life, where I saw some of the darkest days I have ever experienced.

I am glad it is over.

I have been thinking a lot lately about writing about 2009. I couldn't write about it at the time, I was all emo and shit, it would have just annoyed you. Hell, it annoyed me so much I quit writing in my journal. I'm not going to go back and dig all that up to spew here. The short rundown is that everything was going sideways on the fasttrack to fucked up, and a lot of it was totally out of my control. My career was totally fucked, I'd gone from working for one awful manager in a totally dysfunctional team to reporting to what could possibly be the most arrogant elitist misogynistic douchebag in the company who wouldn't have hired me and totally changed the job I had been hired to do by my the prior team manager (who I think I only worked for for about a month before he left the team). My personal life was a train wreck, compounded by the fact that I felt completely incompetent by the decaying orbit of my career and the still smouldering crater of my divorce on the personal landscape. I ended up going through a lot of therapy and on anti-anxiety and anti-depressant medications to try and re-set my brain, but the fact that I was depressed and out of control of my neurotransmitters made me feel like a failure - why couldn't I just get happy?

Things started getting better when I quit my job, funny but being unemployed let me get off the anti-anxiety meds. I took five months off and lived off savings while trying to get my shit back together. Today I've got a solid job and I'm proving to myself again that I'm not just a one-trick pony who got lucky and was one of management's darlings for awhile, but truly competent and useful. I've worked through a lot of my personal issues and while I won't lie and pretend everything is exactly how I dreamed it would be, I'm healthy and happy again and have been off the anti-depressants for 2 months now.

So why the hell am I blogging about this at all? Am I looking for pity? To create drama? Send secret passive aggressive messages to people? No on all counts (let's face it, that bit about the misogynist douchebag was hardly passive, and I'd tell him that to his face if I ran into him). I'm writing about this because writing is part of who I am. If you go back and read the blog's history, I write about a lot of things, but there is a thread going through much of it that relates to my personal journey of self-awareness, and my search for happy. And I've been journeying a lot lately, so I expect I'll be spending a fair amount of time here. I don't know if anyone reads this or cares, but writing and publishing it makes me feel better. There are some things I am intensely private about by choice. But a lot of things I have a need to express, because keeping them inside feels shameful when they shouldn't be. And if you want to judge me for my experiences or feelings or the fact that I'm sharing them with the world, fuck you. This is who I am, and I don't need negative energy in my life. You should stop reading my blog.

So 2009 sucked ass. There were times that I wanted to run away and start over - new town, new life, new job, maybe even a new name, new hair, new everything - anything that would make me be anyone but me. Everything was so fucked up, I just wanted to try again, get a second chance to do things right. But that wouldn't have actually fixed anything. I would have just moved all my emotional shit to a new geography. I had to work through it. And working through it SUCKED. There were friends who helped me when I would let them, friends who brought me smoothies when I couldn't eat anything, friends who would talk to me for hours while I cried, hell I even re-established a relationship with my mom, who I hadn't seen in 9 years but ended up talking to near daily. And while I NEVER EVER want another year like 2009, I learned a lot for it and am a healthier person today for having experienced it.

Possibly the most important lesson I learned was to let go of things I can't control. Stress is inefficient and a waste of energy in many cases. Missed your flight? Well, not a whole hell of a lot you can do except rebook and wait. No point getting upset about it, it doesn't change the situation one bit. May as well get a snack and something to read, and settle down in the airport for some people watching. So many things that used to annoy / aggravate / upset / stress me out, they all seem pretty small potatos now. I've returned to my prior state of being a hopeful optimist, but gained the traits of being much more laid back and relaxed in general about things.

Part of learning to let go of things I can't control was understanding that even if I can understand WHY something is the way it is doesn't mean there is a damn thing I can do about it. Life is not an engingeering problem to be solved. I was trying to figure out WHY things were the way they were, thinking if I could measure and quantify that, I could do something to fix it. And the inability to fix things and make myself get better was making me feel like a failure.

But some things can never be understood. And even if they could be, they still aren't things in your power to change. Sometimes you can do everything right, and you still don't get the outcome you wanted due to variables outside of your control. Shit happens. Doesn't mean you failed. In fact, I probably stay in shitty situations too long because I think if I work harder at fixing it I can make things better, but maybe the reality is that THAT is the failure. Failure to recognize the writing on the wall and walk away from an unfixable situation before hitting rock bottom. Dunno. I don't know that I'll ever be able to balance walking away with the feeling that giving up is a sort of personal failure. We'll see.

For now, I'm just thankful I came out of 2009 stronger and healthier, and while I was broken in almost every way concievable during it, it didn't break me forever. I am glad I was able to learn something from all the darkness. I am thankful that 2010 is a better year. And I am thankful for the people I love, and the people who love me. That is enough.

~Elphie

CanSecWest

2010-03-26T23:38:00.000-07:00

Single track, super smart technical content (well, except maybe the idiot from McAfee), high quality attendees... This is a good conference.

Charlie Miller's talk on fuzzing was interesting from an analytic point of view, showing the curve that illustrates the point of diminishing returns for fuzzing and the volume of failures you will have in order to achieve a few successes (exploits). Key take away for vendors: keep fuzzing. A lot. Because if you don't, someone else will.

Pwn2Own was open its usual 3 days but all the exploits were on day 1 again. iPhone was the only phone that was hacked, and three of the four browsers were hacked (IE8, FireFox, Safari). I carry an iPhone, dammit. Thinking about switching from FF to Chrome though. I doubt it is bulletproof, but if no one is targeting it because it's market share is too small, I'm ok taking advantage of that security-through-obscurity for now.

Stupid Boys

2010-03-26T23:13:00.000-07:00

I have a female coworker who is a badass tools developer. And at CanSec not only was it assumed she must not be here for the conference (female), but that she was the shiatsu massage therapist stationed at the con (Asian).

Eventually this retarded attitude at conferences has got to change. There were so many women at CanSec that Dragos ran out of ladies jackets and had to rush order more. Speaking of which, the jackets are pretty awesome. Probably the best con swag I've gotten in my 7 years of attending security conferences.

I get it now

2010-02-21T22:17:00.000-08:00

You seem very well
things look peaceful
I'm not quite as well
I thought you should know

Hurt is easier to swallow than anger. Alanis probably figured she was going to give herself cancer or some shit if she didn't get the rage out somehow.

the things people can't talk about

2010-02-12T19:36:00.000-08:00

It is hard to keep things hidden inside. It is painful and sad and it hurts, because the act of keeping something secret somehow invalidates it, makes it feel dirty and shameful even when it shouldn't be. Whether your hiding it to protect yourself or to protect someone else, the outcome is the same.

When a person hurts inside and they don't want to show it, they form a defensive shell and don't let people in. It is safer that way. They act like everything is fine, like they are bulletproof, like nothing ever bothers them. They project confidence and happiness, and they save their tears for in private where no one can see and suspect they are vulnerable.

And while they protect themselves, they struggle with feeling like they are being artificial, unauthentic, disingenuous. Identity becomes fractured between public and private. They hate who they are becoming but they feel they have no other choice. Who they are and who they present to the world are different things. And eventually this becomes routine, the new normal. Life goes on.

Someday, if they are lucky, the pressure gets released and they find themselves in a time and place with people where they have the opportunity to be themselves with and they don't have to hide (if they have the courage). They don't have to be ashamed. Hermey gets to be the dentist.

Dream Rehab

2010-02-10T21:47:00.000-08:00

I strongly believe in self determination and that you have the ability to make your future what you want it to be. But there isn't a damn thing you can do to change the actions or decisions of other people involved no matter how hard you try. That doesn't make you a failure, just a dreamer who can't see reality. Sometimes things change and you can't see it, you only see what they were and not what they are. It is hard to let go of hope. I have more experience in this area than I'd like. It is hard to accept the death of your dreams. It hurts a lot, and the bigger the hurt the longer it takes to recover. But you move on because there isn't really any other option. As they say in The Shawshank Redemption, "time to get busy livin, or get busy dyin".

Bioethics, meets Sports

2009-09-10T18:42:00.000-07:00

Wow. I'm fascinated to see what comes of the case of Caster Semeyna. She is an 18 year old female who apparently is sterile, as she has internal male testes instead of ovaries. But she apparently also has a uterus. She is dominating her track events because she has massive amounts of testosterone, but is not guilty of steroid use and hasn't broken any competition rules.

So now what? Let her continue to compete against women? Make her compete against men? Don't let her compete at all? She is at an advantage compared to the other women, but is it truly "unfair" if nature made her that way? Is it any more unfair than a swimmer with ridiculously large flipper like feet, or a bicyclist with unusually large heart/lungs?

I'm curious about the chromosomal tests that were run. Regardless, a very interesting situation.

A little birdy told me

2009-08-26T15:42:00.000-07:00

I may, or may not, tweet from time to time.

Secret hopes

2009-08-20T14:54:00.000-07:00

Is it wrong that I secretly hope Michael Jackson staged his death so he can launch the most groundbreaking comeback tour ever? That is the only thing that makes his passing remotely interesting to me. Sorry for his kids and all, but he hasn't been culturally relevant in years. To me, at this point he is just a person like everyone else who died that day.

and your little dog too...

2009-08-16T18:36:00.000-07:00

If the owner of the yapsack outside doesn't do something soon, today might be the day I finally put down Toto.

Microsoft Live has no respect for users privacy choices

2008-12-17T00:21:00.000-08:00

I am a member of a small private blog that discusses matters of a highly personal nature. There are a couple dozen members. The blog was hosted on spaces.live.com, which recently upgraded its services/UI. As part of this upgrade, the ability to comment anonymously on blogposts was removed. Anonymous comments can be abused by spammers, I get that, its why I moderate comments here on the Hideaway. But on a blog with restricted membership I think the threat of spam is about nil. Is having a system intelligent enough to respect user privacy in that situation too much to ask for though? Lemme see… IF blog has restricted membership ALLOW blog owner to SELECT whether or not to allow members to comment anonymously. Yeah, that's some wicked complicated logic. But whatever, new policy moving forward, I can live with that. Sucks as people are less likely to comment and engage in supportive discussion - I know I'll think a little more carefully about what I comment since I am personally identified - but at least I know that going in.

But no, it isn't that easy. Because Live went and applied the policy retroactively so all the anonymous comments posted in the past NOW EXPOSE THE COMMENTER'S NAME. Thankfully the blog owner noticed this and shut the blog down completely. Apparently un-selecting the 'use my profile' box and entering a pseudonym for your comment is entirely unsupported now AND they were tracking commenters identity on the back end anyway, so now with no warning what-so-ever to users, the privacy choice users made to un-select that box has been reversed.

Did I mention I'm pissed off?

I will NEVER, NEVER use a Live blog/mashup/cloud offering again. I'd ditch the email too if I didn't need it for my gamertag. Asstards.

~Elphie

Sex and Technology

2008-08-18T20:59:00.000-07:00

If you've read much of the Hideaway you know I find human behavior and identity to be fascinating. And you know i'm a total nerd. So the geektastic question I am going to address in today's blog entry is why is Cherry 2000 culturally relevant?

Cherry 2000 was a bad 1987 movie that has attained cult status - no doubt helped by semi-regular lustful references to the Cherry 2000 by Crow and Tom Servo on MST3K. Cherry 2000 wasn't the first movie to feature a humanoid sex robot (ok, technically an android), Blade Runner in 1982 had Pris the replicant. But Pris *looked* like a whore.

Cherry 2000 looked like the girl next door, and wasn't just an animated sex doll but the main character's wife-substitute.

When the main character breaks his wife/doll, he puts her personality/memory on a chip and sets out in search of a new body to house 'her'. But being a sentimental human, he wants the same model - not any old female shell to house his beloved memory chip, he wants the exact same doll, because the human has fallen in love with his android and is emotionally attached to both the physical representation of her as a person as well as her 'personality'. (of course the entire movie is set up so he instead abandons his wife/doll in the desert and falls in love with a REAL woman, a pre-Antonio Banderas Melanie Griffith.) But go back a sentence or two, where I talk about how he has fallen in love with the artificial human - THIS is one of the things that makes Cherry 2000 different from Pris or Gigalo Joe (AI). Cherry is loved. She is in a relationship, as much as she can be given that she is property and not programmed to consider independence (or really anything other than subservience) an option. Cherry, Pris and Joe are all designed and programmed to be sex partners for humans, but Cherry 2000 is the only one who is truly owned (the second difference). Pris and Joe are prostitutes, but have freedom to move about in society and choose their partners/activities/home/relationships. Cherry is property. And IMO this makes her far less human than Pris or Joe, despite the fact that she appears to have the more conventional and respectable/stable life. She has no free will, and that makes her less human than the other human substitutes.

So why is the creation of human sex substitutes so common in the future vision? Is it technology for technology's sake? Misogeny run amok? I think it is just that sex is fun, but people are complicated and STD's are a bitch. But if we've evolved enough to create complex human substitutes, shouldn't we have evolved enough to change our attitudes about sex between consenting adults and by and large not need the sex robots? Sure, the hideously ugly or those into really whacked out kinks that they can't find willing partners for would still need/want these dolls, but what would drive a human into the bed of a machine versus a true flesh and blood human offering the same services? Pure skill? (Not to say that skill isn't desirable; after all, Data rocked Lt. Yar's world). If that is the primary criteria for sex android evolution, there damn well better be Joe models and not just Cherry and Pris.

What I hated about Black Hat this year

2008-08-12T10:46:00.000-07:00

I’m on my way home from Black Hat and I have to say, some things have improved since CMP bought the conference a couple years ago. But that is a different blogpost. This is about the things that SUCK now. Like the vendors. Now vendors in and of themselves aren’t so bad when they have technical representation at their booth to talk to con attendees about their products or services. It’s the Booth Bunnies, or in some cases, the Booth Whores, that I find offensive. I’ve gone on record in the past about hating RSA because of the obnoxious marketing overload. I really hope Black Hat isn’t going that direction. I understand that the majority of Black Hat attendees are male, but it is still horribly annoying to watch companies use Cherry 2000 style bimbos try to lure potential customers to their booth based on sex appeal. And the mere fact that booth bunnies exist on the con floor makes it harder to be a woman in this industry and not have the gen pop assume you must be there purely as eye candy.

McAfee had the Security Barbie style booth bunny. I guess to distract you from the fact that their product sucks. I wonder if she comes with the Malibu Beach House.

Cenzic had a Booth Bunny ACROSS the hall from their booth (very sneaky!) stopping people walking by with “are you interested in Web Application Security?” and handing them puzzle pieces you could take to their booth and possibly win a prize. This was really funny, since I was walking with someone who works for one of their competitors (and has better products). As expected, I didn’t win anything. At least she wasn’t dressed up like a tart.

Some company had a Booth Bunny dressed as a Vegas showgirl, which I can at least respect for its theme appropriateness, even if I still hate the Booth Bunny philosophy. She was running different games where people answered questions to win prizes.

The most egregious offender was EdgeOS. When I stopped to snap a picture (and lets be clear, this was the best looking of the three Booth Whores I saw there), one of the guys working the booth asked if I’d gotten an invitation to their Saturday night party. Here is how the conversation went:

EOS Guy: hey, have you gotten an invitation to our party yet?
Me: No.
EOS Guy: you haven’t? how’d that happen? (this was kind of creepy the way he said it)
Me: probably because I didn’t stop by your booth to chat up your booth bunnies for one.
EOS Guy: they aren’t booth bunnies.
Me: no? when they wear pleather they aren’t called booth bunnies anymore?
EOS Guy: no, they’re booth babes (hands me invitation to party)
Me: whatever you call them, they make it harder to be a woman in this industry. (walks away)

You might think calling them Booth Whores is a bit harsh and judgmental. Maybe Goth Booth Bunnies is more sensitive. But this was the most direct sexual marketing I’ve seen at a non-sex industry conference, and if you get paid to dress like that, stick party invitations in your bra, and leverage sexual energy to get geek boys to stop at the booth of your temporary employer, I’d say you are selling your body for profit. AKA whoring.

Anyway, I assume the pleather girls were on display at the EdgeOS party, I don’t know for sure because I didn’t go. If I had, I’d have been the bitchy attendee who just spent the evening giving the hosts and their pleather clad prickteases shit all night, and I didn’t want to waste my time on that even if they were buying the drinks.

Just in case there is some confusion let me be clear: I have no problem with pleather, fetish wear, or pretty girls. That isn’t what I’m complaining about. When vendors bring in booth bunnies it perpetuates the stereotype that the women at cons are not there for the con itself. I have a problem with the fact that every conference I attend, at least one person assumes I must be marketing, PR, or sales. All of those fields are useful and I respect the marketing, PR, and sales people where I work. The problem is that people assume I am something I am not based on my gender. They assume I can’t possibly do anything technical or relevant to their work because I’m female. And that fucking pisses me off. Let me repeat: It isn’t that I don’t respect marketing professionals, its that I get pissed at the discrimination and bias. I understand that guys are surprised I’m a geek, that I game, that I quote sci-fi movies and know what Do Androids Dream of Electric Sheep led to. I understand that compared to the average woman you might meet in the mall or coffee shop, I’m an anomoly. But at a security conference, why WOULDN’T I be just like everyone else there?

Other things I hated:
Dan Kaminsky getting a pwnie. Black Hat overhyped his talk in a frenzy of media whoredom, then he got kicked in the balls by being awarded the most overhyped talk pwnie. He worked his ass off on this issue, did all the right things to try and protect people, and instead of earning the respect he deserved, he got made fun of.

Smells Like Teen Spirit transitioning to Saturday Night Fever. FAIL

French press sniffing creds

Snacktime crowds clogging the halls, making movement impossible

Talks that span 2 hours. I don’t want to commit 2 hours to one talk. C’mon people, tighten it up. There are too many interesting things to see to put all my eggs in one basket for 2 talks. By having a 2 hour talk you are not competing with 4 other tracks, you are competing with 8.

Not enough time or space to talk with everyone I wanted to. The size of Black Hat is a blessing and a curse. You see everyone in one place, where you might only see half as many people you want to at a smaller con. But everyone is circulating so there isn’t time for talking with any one person very much. There are a great many people I wish I’d had time to sit down and talk with more.

What I liked about Black Hat this year

2008-08-12T10:27:00.000-07:00

THE TALKS!!
Dan Kaminsky’s It's The End of the Cache As We Know It. (come on, you know you can't help thinking 'And I Feel Fine' after reading that) Standing room only, Dan’s grandma’s session cookies, talk content, speaker energy, enthusiasm. I <3 Dan. If I could adopt a big brother, it would be Dan.

Bruce Potter’s talk on Net Flow analysis. Super interesting, well presented.

Mark Dowd and Alexander Sotirov’s talk on Bypassing Windows Vista Memory Protections. They’re wicked smaht.

LT. Col. Greg Conti’s talk on visual forensics analysis - I am a sucker for visual representation of any data...

Christopher Hoff's Four Horsemen of the Virtualizaton Security Apocolypse.

I know, my review of the talks is pretty light here, but I don't have to write a trip report for the general public so quitcherbitchen. If you're so interested, you should have gone to the talks yourself.

THE OTHER STUFF
Registration check in lines are sooooo much better than in years past, more lines, move faster, yay. But having a separate line to get your delegate bag is a bit inefficient for attendees.

Box lunch option. Now if only they’d offer a ‘no lunch’ ticket. I don’t even care if it costs the same as a ‘with lunch’ registration. I never eat at the con, whether it’s a box lunch or plated meal. I feel bad wasting the food.

Overall, compared to when I first started attending Black Hat many years ago, the con feels more professional. Talks start and end pretty much on time, I didn’t see any real AV difficulties, logistically things seemed pretty smooth. Awwww, Black Hat is growing up!

Lobster and crab dumpling things, sushi, and sliders at a vendor party. Best party food all week.

The conference continues to grow and mature. I’m excited to see that, big conferences are a great initiation ground for new security professionals who may not know about or understand yet the value of smaller cons like ShmooCon or Toorcon, and a great ‘reunion’ spot for people who may talk via IM/Twitter/Facebook/MySpace/IRC/email/whatever all the time but only see each other IRL a few times a year at cons. But the size of Black Hat is a blessing and a curse. You see everyone in one place, where you might only see half as many people you want to at a smaller con. But everyone is circulating so there isn’t time for talking with any one person very much.

Wall of Sheep. A DefCon staple, nice to see it at Black Hat too. Baaaaaaaaa.

Not really about Black Hat, but a Vegas thing: there is now one cab company that takes credit cards in Vegas. w00t. I hate carrying cash.

$32K raised for EFF between Black Hat and Defcon. nice.

Several people arranged hotel suite Rock Band parties in the evenings. That is awesome. !..!,

See y’all again in 2009. Wouldn’t miss it.

The bitch is back

2008-08-12T10:21:00.000-07:00

The majority of the last year of my life has been kind of fucked up, during which time I stopped blogging. I'm not saying it's unfucked yet, just that I'm getting used to the chaos and am making an effort to return to the blog. It will take me a few days to get the Hideaway in order and clean up properly for visitors, so I hope you'll check back in soon.

updates. finally.

2007-11-01T14:32:00.000-07:00

conference calendar updated, and the blogroll. I know, I've been ignoring you for a few months. But David Litchfield is blogging now. I figured that alone was worth a post.

Device warns you if you're boring or irritating

2007-06-06T21:32:00.000-07:00

Wouldn't a gadget that warned you when you were being boring help you in your social interactions with others? Then you wouldn't have to rely on your own faulty human perception. Kind of like a Garmin for the navigationally challenged.

heh, so any thoughts on who should get one? Could make conferences a lot more tolerable...

~Elphie

w00t

2007-05-23T14:26:00.000-07:00

Another new conference in the fold. WOOT, the Workshop On Offensive Technology is launching this summer in conjunction with USENIX. While WOOT sounds extremely cool and the advisory panel is made up of uber smart people, having six conferences on three continents in August makes for some serious competition for top speakers as well as attendee dollars. WOOT is invite only though, so they might win on leet factor.

Don't count Jeff Moss out though - looks like he is planning 8 (that's right, EIGHT) tracks at Black Hat Vegas this summer. So their cfp must be doing pretty well if they can project that much content with a straight face...

~Elphie

Do no evil. Unless its really profitable.

2007-05-23T09:34:00.000-07:00

OEM's have long been known to install craplets that frustrate and annoy end users in order to beef up their razor thin hardware margins. These craplets are difficult to remove and generally not well tested or certified by (insert OS developer here), which leads to the potential for them to introduce security vulnerabilities. But now Google has teamed up with Dell to create Yet Another Miserable User Experience.

GOOG - for shame. You have forsaken users for your own avarice.

~Elphie

words of wisdom from the Frag Dolls

2007-05-08T08:55:00.000-07:00

A couple weekends ago I was playing an online game with some friends (hi Vyxxen and Strix!) and we got to chatting about being a girl gamer. One of my friends had just that evening been chatted up by another player, and things started innocently enough. But before she knew it, he was describing himself and asking her for a description of herself, asking if she was hot, etc. This sucks for a girl. There you are, having fun in a game, chatting with someone who you might be able to trade items with or help out on a quest, and next thing you know he is telling you he has great pecs and likes rockclimbing. If you aren't interested in enabling the world of one-hand-typers, yet want to be friendly and not piss someone off who might trash talk you as a bitch in forums and the game, how do you politely get out of this discussion? Really, if you know, please tell me! I don't feel like I should have to pretend to be a guy online to avoid this sort of thing.

Valkerie over at the Frag Dolls has some words of wisdom, but they are more for the guys than helping the girls out of this situation. Check out The Top 10 Most UNORIGINAL Things You Can Say to a Girl Gamer.

~Elphie

"virtual" online gambling safe... for now.

2007-04-19T16:22:00.000-07:00

First, let me make it clear that I never intended to be a Second Life blogger. I've never even played Second Life. But when I look at my tags and see just how many Second Life posts I've made, well, I've got to face facts. I've become a SL blogger. SL is just so perfectly hedonistic, such a funny little experiment of human interaction and behavior in a technical environment, how could I resist? Here you have a place where people can be the person they want to be, not the person they are. They can do the socially unacceptable - they could run down the virtual street virtually naked and still go to work the next day. So how DO people behave when you minimize or eliminate consequences? Hm, maybe I should go visit SL just to peoplewatch... I'm such a voyeur.

Anyhow, I recently read that the Feds visited Second Life to check out the gambling. Of course online gambling is illegal in most states of the USA, but people are gambling on SL and winning REAL money. For some reason though, that's ok. For now.

Honestly, I think everyone (including the Feds) knows that 'virtual' gambling with real money is still gambling, and is therefore illegal. But if the Feds decide to take that position, how can they police it, aside from taking SL off the net?

"...Linden Lab could potentially face criminal charges under the 1970 Illegal Gambling Business Act or the Unlawful Internet Gambling Enforcement Act. The latter law, passed last year, takes aim at credit card companies and other electronic funds transfers that enable Internet gambling."

..."Linden Lab's rules prohibit illegal activity.

"It's not always clear to us whether a 3-D simulation of a casino is the same thing as a casino, legally speaking, and it's not clear to the law enforcement authorities we have asked," Yoon* said.

Even if the law were clear, he said the company would have no way to monitor or prevent gambling in Second Life."

*Ginsu Yoon, until recently Linden Lab's general counsel and currently vice president for business affairs

And if online gambling is illegal in SL, what about the prostitution? Sure, I know, the prostitution in SL is also virtual, no bodily fluids exchanged, just some one handed typing. It's about as dangerous as renting porn or watching pay-per-view sex webcams. But that is changing too. Technology continues to evolve, thanks to human ingenuity (and the fact that hardware doesn't complain about your leaving the toilet seat up/down). There is a growing field I can't type without laughing, you'll just have to read about it here. But as products like this are developed (Note: that link is NOT safe for work), and a virtual prostitute and virtual John can push keyboard buttons to stimulate each other's bodies in reality, where does that fall in the definition of netsex and prostitution?

As always, many questions, few answers. Except 42. I've got that answer.

~Elphie

Why anonymity is necessary

2007-04-19T15:39:00.000-07:00

Because in some parts of the world, dissenting opinions can get you put in prison.

From the New York Times:

...Yahoo has come under particularly sharp criticism. Human rights groups say that Yahoo has helped identify at least four people, including the journalist Shi Tao in 2004, who have since been imprisoned for voicing dissent in cyberspace.

In other parts of the world, you can lose your job. oh wait, that's right here... If you are hard core about protecting your anonymity, here are a few tips from the EFF.

~Elphie