Mar 28What came first, the kernel or the shell?If your work is even remotely related to operating systems, the terms shell and kernel are likely in your everyday vocabulary. But where, and when, did they appear first? The Metaphors The kernel is the core component of the operating system that executes in a more privileged mode and provides security isolation…Computer History7 min readComputer History7 min read
Jul 21, 2022In MemoriamWe are who we are known as. When the keepers of our memories pass away, a portion of our own selves fades away with them. With age, I am beginning to better understand the sadness brought on by the passing of people from our social circles. I am not even…2 min read2 min read
Jul 11, 2022Blinded By InsightOccasionally, we are fortunate enough to generate a spark of insight that suddenly illuminates a problem from a new angle. For an instant we are able to make out new patterns, to see farther than others have been able to before. Distorted and imperfect as it may be, the revelation…1 min read1 min read
Sep 30, 2021SBOM: Good Intentions, Bad Analogies, and Ugly OutcomesThe problem is real and everyone means well. But poor metaphors are leading to proposals that do not fit reality. In the end, scarce security resources will be diverted to produce compliance make-work with no tangible benefit. A Modest Proposal Imagine the following scenario. The automotive industry has a problem. The manufacturers are…Product Security13 min readProduct Security13 min read
Jan 19, 2021A Corporate Anthropologist’s Guide to Product SecurityBuilding lasting cultural change — If you are looking for TL;DR, just read the bold headings. I was recently asked to share some lessons learned deploying a Security Development Life-Cycle (SDLC) in a large engineering organization. That gave me an excuse to write down the various thoughts that had accumulated over the years. I hope…22 min read22 min read
Jan 11, 2021Parkinson’s Law of Security Privileges (or The Curse of Least Privilege)Functionality expands so as to use all available privileges. — Parkinson’s Law postulates that “work expands so as to fill the time available for its completion”. It is commonly generalized to state “the demand upon a resource tends to expand to match the supply of the resource.” It is easy to see Parkinson’s law at work all around us. We…4 min read4 min read
Jan 4, 2021The 5 Ands?A technique for getting to the point. — TL;DR When communicating information, tell people explicitly what conclusion you want them to draw. Your message should lead with the answer to an iterative series of “And [what is the implication of this]?” questions. In my job I frequently receive and produce status updates. Over the years, I have noticed…8 min read8 min read
Nov 4, 2018A More Useful Stock StatOn January 9, 2018, Kodak ($KODK) announced that it was launching a “major blockchain initiative and cryptocurrency.” Their stock jumped from $3.10 per share on January 8th, to a high of $13.28 (closing at $10.70) January 10th, inflating the market cap from $132M to $455M. On that day (1/10/18), over…Stock Market2 min readStock Market2 min read
Nov 3, 2018Time WarpI was re-reading Bill Gates’ Trustworthy Computing Memo, when I came across an apparent anachronism: a reference to the attacks of September 11th, 2001. I was certain that the memo predated 9/11. A doubletake at the timestamp confirmed that Gates sent it out January 15th 2002. But the two events…1 min read1 min read
Aug 7, 2018Of Monsters and ShadowsTrigger Warning: tortured metaphors TL;DR: Oppression drives surveillance, not vice versa. Mass surveillance is a lagging symptom of a government that is abusing its charge, not a leading indicator of trouble down the road. It is not a warning sign of what the monster may become. It is a reminder…Surveillance9 min readSurveillance9 min read
