The Right Way to Respond to Getting Hacked / Cracked

Wired: Boston Subway Officials Sue to Stop DefCon Talk on Fare Card Hacks

Three MIT students have figured out how to hack the fare card system used on the Boston-area public transit ("the T"), to ride for free, add money to a stored-value card, and other such things. They cracked both the RFID card and the magnetic-stripe card. Here is a PDF of their presentation.

They were planning to give a talk on their discoveries at DefCon, the big annual hacker/cracker convention. The Massachusetts Bay Transit Authority (MBTA), which runs the T, sued them to prevent them from giving the talk. The talk will not be given. The students' faculty advisor, Dr. Ron Rivest, is being given a hard time.

The MBTA are going about this exactly the wrong way! (Although their response is understandable.)

Security systems are only trustable if they are thoroughly tested in actual use -- including normal users, hackers, and crackers. No matter how hard the MBTA try to hush up their security flaw, it will not make their security flaw magically go away. They should fix the flaw. Yes, it will cost money, but my sympathy is limited.

It is basically a given that many people will hear about this security flaw, whether or not there is a DefCon talk about it. Hello, Internet. But if people hear about this flaw only through underground/unofficial channels, what impression does that give them of the MBTA? It gives the impression that they either don't know about the flaw, or know about it and aren't doing anything about it. It gives the impression that the people who run all of Boston's public transit are a bunch of incompetents.

Moreover, by stage-whispering "Shh! Don't tell anyone about this!", they're also saying "Hey, this is significant! And leaves us very vulnerable!"

(By the way, if their goal is to decrease the number of people who hear about their security flaw, they have failed dramatically, because it's getting all over the news now. For example, I don't know anything about the presentations at DefCon, but now I know there's a security flaw in the subway system I use all the time, precisely because they're suing my classmates over it.)

What should the MBTA be doing? Shouting this as loudly as possible: "Yes, we have a security flaw! Thank you guys so much for pointing it out! We're working around the clock to fix it!" This would give the impression that the MBTA is run by intelligent people who can face reality instead of frantically trying to make it magically disappear. People would realize that the MBTA is serious about fare security.

The "Fare Security: SERIOUS BUSINESS" attitude would help decrease all kinds of subway sleaziness, including people who break fare security by the super-advanced hack of jumping over the fare gates. Not to mention things like littering, graffiti, and panhandling (none of which are huge problems on the T, I'm glad to say!). If I see someone fare-jumping, it makes me think the subway system is for shit anyway, so what does it matter if I stick gum to my seat?

And besides, the MBTA's anti-hacker attitude will just annoy crackers and make them more inclined to crack the T fares. Being realistic, and trumpeting increased security, will make crackers less inclined to attack the T.

Come on, MBTA. Have the grace to admit you've been hacked, instead of going into denial. Fix the vulnerability. Show us all you're serious about fare security. In fact, why don't you talk civilly to the people who hacked you? I'm sure they could help you build a better system.


...And, because I need some levity, here's a related episode in the adventures of Domo-kun. Hooray, cute pictures.

Some programming resource reviews

Since I've been teaching myself, and especially since I've been flirting with several different sources rather than settling into a steady relationship with any particular one, I thought I'd share my impressions.

So you know where I'm coming from: I took AP Computer Science AB (Java) in junior year of high school. Then in senior year we had a semi-experimental Scheme class based on the classic SICP (see below), but nowhere near as hardcore. Because Java and Scheme are so different, and because I forgot a lot of Java over the intervening summer, this amounted to me learning to program two separate times with very little cross-contamination.

After that, I didn't write so much as a line of code for my whole first year at MIT. (Yeah, I know -- how could I?!?, etc.) But somehow a lot of vague programming ideas seem to have stuck in my brain, making it much easier to (1) learn a new language, and (2) re-learn programming in general. So I'm somewhere between 'rank beginner' and 'person who wants to pick up a second language after their first CS class'. This will affect my assessment of resources.

>> Learning Python, Mark Lutz & David Ascher

...Comprehensive, I suppose. It's the O'Reilly book, which gives it lots of reputation points. It goes into a lot of detail about basically everything (I'm reading it online, but the dead-tree edition is quite hefty). Tables of built-in integer and string functions, that sort of thing. Even -- get this -- more than one chapter on getting Python to run on your system, choice of IDE, and how to run programs you write from a variety of situations. This makes it surprisingly useful as a reference, for a book with the word "Learning" in its title.

The thing that bothers me about this book is that it can't seem to decide where it's aiming. It's definitely a programming book, not a computer science book; but it's in between "dense comprehensive tutorial/reference for people who already know what they're doing" and "learn programming from scratch using Python". For example, it explains the ideas of iteration and recursion, gives very basic examples, and discusses the general sort of situation in which you might want to use them -- and then a minute later it hits you with a lot of jargon and dense stuff. Curious approach.

Perhaps some of the confusion is because the authors are trying to take a "quick survey first, then dig into the details" approach on each section, and their definition of "section" is too short, leading to a confusing rapid alternation between the high view and the details.

I'm only up to the section on classes and OOP so far, because I've started to run into stuff I never learned or have forgotten; so I can't comment on the GUI section or anything like that, but I'm sure everything else is quite comprehensive.

>> Structure and Interpretation of Computer Programs, Abelson & Sussman

Ahh, the classics. Especially the classics that are available online, for free, in full, under Creative Commons, and not in a really irritating interface!

This is a hardcore nerdy book. It doesn't teach you computer science, it ties you down and throws computer science at you thick and fast, but in a totally awesome, non-evil way. It's really not a programming book, either -- the authors go out of their way to teach you the absolute bare minimum of Scheme syntax to handle the concepts they're presenting. This is kind of irritating if your goal is to be able to do practical things quickly (ha). But if your goal is to achieve nirvana, you could do a lot worse than this book.

Read the footnotes. They are snarky, and competently so, unlike the lame attempts at humor you see in most textbooks.

>> Teach Yourself Scheme in Fixnum Days, Dorai Sitaram

This is a straight-up no-frills tutorial for people who already know how to program, more or less. Reading this after having taken a SICP class was pretty interesting: I kept going "Hey! That piece of syntax makes it really easy to do X thing we were always beating our heads over in class, because SICP HATES SYNTAX OR SOMETHING." Hooray for actually doing things with Scheme. I'd gotten the (not entirely wrong) impression that Scheme was good for nothing but theoretical interest and formalism with a dash of AI.

I'm not sure whether to recommend reading this along with SICP. On the one hand, I tried it and got really confused. Part of the charm of SICP's syntax starvation is that it actually helps you figure out how to do things; they simply refrain from teaching you the four other ways to do it. On the other hand, Scheme can actually do stuff that's not all abstract and theoretical and weird, and this teaches you how to do that.

>> [pdf] How To Think Like A Computer Scientist: Learning with Python, Downey, Elkner, and Myers.

This, I think, would be a good book for a (dedicated) beginner. It starts right at the beginning with the very fundamentals, and keeps a great balance between new concepts and new syntax. I haven't gotten very far at all in this book, mostly because I've spent so much time on the O'Reilly Learning Python book, but I like it very much so far.

Plus, how can you say no to a book that's written in LaTeX? Seriously, now.

>> Project Euler

Oddly enough, none of the above books have enough exercises in them. Teach Yourself Scheme has none at all. Learning Python only has a few, once every five chapters or so, and they're all about catching tiny nitpicks that trip you up. SICP has plenty but they're geared toward teaching CS principles, not coding practice. How To Think Like A Computer Scientist has good ones but not many of them. I googled around but the only thing I found that wasn't too advanced was FizzBuzz, which wasn't enough.

Enter Project Euler. It's a site full of math puzzles, varying in difficulty from "ludicrously easy" to "frackin' impossible", and set up such that you basically have to solve them by programming. Things like "find the ten-thousandth prime number", too big to be solved by hand. Excellent!

The site is obviously run by people who know what they're doing -- all the problems are very unambiguously stated, with examples, and the site keeps your score for you. Once you've solved a problem, you can look at the discussion thread where other people post their code and discuss alternative methods. The other people, by the way, are brilliant, and come up with all these elegant methods and neat optimizations for you to imitate.

Look Mom, Tags! And a Coding Trance!

[Before I start, let me admit that I am still very much a programming n00b. Everything that excites me is probably old hat to the majority of the coding population.]

I like tags very much. They are a million times better than folders. 'nuff said.

I've been writing a tagging system. It's nothing special -- just something that pairs up items and tags, and can do some of the same kinds of lookup that the tagging systems on blogs can do. Have been wanting to do this for quite some time, so now I feel all accomplished :D

I haven't finished testing the thing yet, so there are probably a lot more mistakes hiding in there, but most of the ones I've caught so far have been pretty similar. I tend to confuse the actual tag object with the tag's name, and refer to one when I should refer to the other -- kinda like confusing the phrase "scientists are people too" with the tool that lets you do this. Same thing with confusing tagged items and the objects they contain. These are pretty easy to fix.

There are a couple more functions I want to write -- eg, I haven't got a thing that lets you organize the tags in order of frequency of usage (as they are in the sidebar). But I've got the majority of what I wanted. (And no, that doesn't include a GUI. This is strictly text-based, Python-command-line stuff.)

I guess I'm kind of excited because, back when I was thinking about teaching myself to program again, a tagging system seemed like kind of a big challenge -- one I could do relatively quickly, but a challenge nonetheless. And now I'm about 90% of the way there. It's astonishing how fast you can learn to program when you've already learned to program twice before! ^^

This is also the longest block of sitting-and-writing-code time that I've spent in quite a while. I seemed to fall into a sort of trance -- very focused, very losing-track-of-time. This is an interesting mindstate (not to mention a very productive one!), and I'd like to get into it more often. (It helped that some people over on the XKCD forum turned me on to the streaming lyricless music from Blue Mars, which bills itself as "music for space travelers". Despite the word "mars" in their title, I think they really mean "music for headspace travelers". I find it quite relaxing and focusing.)

EVOLVE: Eyes

I just watched the History Channel's program on the evolution of eyes. Overall it was pretty meh, but there were a couple of interesting parts.
ETA: I didn't liveblog it or take notes, so there are things I forgot. Memory is fallible. I'm human.

My favorite was in the first segment -- the experiments on the jellyfish in the tank. The researchers got a jellyfish with primitive eyespots and shone different colors of light into its tank to see how it reacted. Green light made it "relax", stop swimming, and sink to the bottom of the tank. Purple light made it start swimming really fast, and for some reason it shortened up its tentacles by a factor of 2 or 3. How do they do that? And why do they do that? Is it for speed (shorter tentacles = more drag)?

I was interrupted by a phone call and missed most of the segment on trilobite eyes. My brother, who was watching, informs me that trilobite eyes are made of calcite. Huh.

The segment on the tapetum lucidum (shiny layer in the back of some nocturnal predators' eyes that makes them look all glowy and creepy) was quite good, relative to the other sections. Not so much with the ferocious dinosaur predation or the "T3H STRUGGLE FOR SURVIVAL ZOMGZ", lots of nice creepy glowy-eyed panther shots.

Dragonflies apparently have tens of thousands of lenses in their compound eyes, and have a visual "processing speed" (define please??) ~5x that of humans. Badass.

There was a weirdly long segment of dinosaur obsession. Whenever I see this kind of sensationalism it makes me sad, but I suppose it's only to be expected anymore. The epic, ceaseless struggle for survival! Eat or be eaten! And I imagine, sometime when this episode was being planned, some editor was all "we gotta have dinosaurs in all our nature programs!". Far too much time spent on dinosaurs in a program about eyes. They should have cut this by 90% and spliced in some material on cephalopod eyes, or the design flaws in the human eye, or more than perfunctory detail on intermediate stages between "patch of light-sensitive cells" and "fully evolved eyeball". All of which were either mentioned briefly or omitted altogether.

The other thing that really bothered me about this program was some of the things they felt necessary to explain: Humans are mammals. Vertebrates include reptiles, mammals, and birds. How can kids past kindergarten not know this stuff?

Also -- ok, I would really have liked to see a mention of how wildly different species use a lot of the same genes to control development, and how this interacts with (convergent) (eye) evolution, but this is a ridiculous thing to hope for, given the level of the program. Why are they showing kids-level programming at 10 pm?

Password-fu

Here's how I make good passwords:

Pick a short keyword that's easy to type -- say, 'left'. Replace some letters with numbers (l3ft) and, for good measure, capitalize some stuff (l3Ft). Now, every time you need to make a password for something, take the name of the thing and stick your keyword on to it somewhere: l3Ftgmail.

This part is fairly well-known (although, still, not enough people use it!!!). What's fun is to make like a linguist and treat your keyword as a real affix. You can affix it anywhere to the name of whatever you need a password for, not just at the beginning or end (prefix or suffix). You can also infix it (gl3Ftmail or gmail3Ftl), or circumfix it (l3gmailFt).

This method doesn't completely specify your password. Sometimes you need to use an acronym for the service instead of the full name (su, or supon, for StumbleUpon), to keep the password from being too long. And sometimes I can't remember whether my YouTube password uses yt, ytube, or youtube. But it doesn't matter, because there are only a few possibilities I need to guess. What's more, this makes it easy to change passwords and still remember them fairly easily -- just move your keyword from prefix to suffix to circumfix to infix...

Forest-path connectivity

There's a decent-sized blob of public forested space right behind my house. It's crisscrossed with unpaved bike trails -- and a good thing too, because it's difficult to walk through the forest off the trail without getting caught in dense coyote-scrub bushes or masses of poison oak. There's a little pond. From several points you can get a lovely panoramic view of the San Francisco Bay and/or the rest of the forest. All in all, it's quite the concentration of nature for someplace in the middle of a suburb.

One of my mini-projects for the summer is to learn my way around the forest trails. There are maps posted at the trailheads, but I'm challenging myself to use them as little as possible and to figure out the connectivity by myself, for two reasons. One, I'm too lazy to bother making myself a copy. Two, there are a number of "unofficial" trails that are perfectly walkable but aren't on the map. (I suppose the unofficial trails get made when people start riding their bikes down deer tracks or dry creek beds.) So I get to combine physical exercise, nature, and mental exercise. Three for the price of one!

Another point of interest: the forest is in a valley, so it's hard to find a piece of land that isn't steeply sloped (especially once you get away from the surrounding houses). Also, for some reason, the soil is such that trees fall over a lot, but often survive. So the whole place is full of trees with interesting geometries. There are horizontal trees. There are trees that form arches over creek beds -- they don't just sort of bend toward the creek, they actually start growing downward once they get to the other side, so you could almost climb up onto them from either end. Today, I saw a tree that, I kid you not, made four ninety-degree turns, each a foot or two apart.

Timprov, a friend of mine who's a pretty good photographer, is coming over tomorrow and we're going to poke around the woods and take photos of stuff. Should be fun.

It was the Summer of the Library Books. San Mateo County glowed red...

[The title is an allusion to the pseudo-medieval text on the cover of one of the Redwall books: "It was the Summer of the Late Rose. Mossflower Country shimmered...]

"A red sun rises. Ash has been spilled this night." -- all right, that was worse. I couldn't resist making another allusion, though. All the wildfires in Northern California have been sending so much smoke into the air that, many days, the sky has been silvered over and the sun has turned red long before setting. (I don't remember exactly how long before setting, but the sun's been red while still five or more diameters above the horizon.) It's actually a beautiful sight, for all it's a symptom of fire and destruction elsewhere, and for all the smoke is causing trouble for people with asthma (especially in cities closer to the actual fires).

Other than that, though, mostly the weather has been fantastic. There have only been two days so far that I'd call "uncomfortably hot". Take that, friends back in Boston. It doesn't even matter that my house doesn't have air conditioning! I don't need it!

For the first time in four years, I'm not doing any kind of science research internship thing over the summer. This is mostly because I was too lazy to get myself a lab job, although it's lovely to have all this spare time. And since I have almost nothing but spare time, I've been lavishing attention on my book heap. I've taken an inordinate amount of books out of the library, bought a few from Barnes & Noble, and pulled several out of my family's rather large collection. I even have time to reread books! What a luxury.

(Because I've started to get a little tired of just reading, I'm also teaching myself Scheme in fixnum days.)

Here are some lists of books, with comments. I may write up more details on some of the sciency ones.
(Lists are not in any kind of order, and are not exhaustive (I'll probably remember more and add them later).)

Finished

• The Hobbit, JRR Tolkien. This is a lot more fun than I remember it being when I read it as a kid. Tolkien's prose style is maybe a little difficult for kids -- but this time around I kept wanting to grab a bunch of random kids and read aloud the fun parts, really perform them. On a totally unrelated note, it's also fun to reread The Hobbit after knowing Lord of the Rings; Tolkien is constantly hinting at things. For example, it makes so much more sense that the Necromancer could cause Mirkwood to be nasty and gross if you know that the Necromancer is actually Sauron. And, there are the Dwarves charging into battle yelling "Moria!".


• This is Your Brain on Music, Daniel J. Levitin. This one had me itching to make funny waveforms to screw around with my auditory perception, and to listen to the pieces of music he mentions with a totally different ear. Unfortunately, I was stuck on an airplane. Quite a ride. I took note of several small things Levitin said about his approach to his area of research, and am planning to write them up.


• When You Catch an Adjective, Kill It: The Parts of Speech For Better And/Or Worse. Ben Yagoda. This one's good for dipping into because each of the chapters (Adjective, Adverb, Article, Conjunction, Interjection, Noun, Preposition, Pronoun, Verb) is relatively short and stands alone. Yagoda writes as a serious linguist, but not a dry one: he clearly enjoys language for its own sake, as any geek ought to. This is not a writing-advice or prescriptivist book (although it does contain some tidbits of writing advice).


• How To Dunk a Donut: The Science of Everyday Life, Len Fisher. This is an interesting popular-science book. Rather than describing one small area for the public, Fisher describes applying a "scientific" approach to random topics like "Why do cookies crumble when you dunk them in milk?". I'm somewhat wary, because some of his projects seem to have been solicited by companies who want publicity for their cookies or whatever. Similarly, some of the "scientificness" of his approach seems to consist of wrapping things in numbers and graphs. A very laudable goal, but in some places the description is pretty dense for a book with that goal.


• Proust Was A Neuroscientist, Jonah Lehrer. This was really well-written and engaging. Lehrer's idea is to show how various artists/musicians/writers (mostly of a certain Paris avant-garde club, it seems) anticipated recent developments in neuro / cognitive science. For example, Walt Whitman's "the body includes and is the soul" lines, and embodied cognition. I thoroughly enjoyed the arts-description parts and the science-description parts. And sometimes the connection between the two was strong and clear, as in the chapter on Proust; not so much in the chapter on, say, Stravinsky (that one felt forced). Still, eminently worth a read.


• The Time Machine, H.G. Wells. Oh boy, did I ever get the wrong impression from the movie version of this. The book is a lot more realistic and a lot more... quietly horrifying? I don't think it's at all plausible that class separation will lead to humans splitting into two species, but it's thrillingly creepy to imagine humans evolving into either the Eloi or the Morlocks. I guess this one is halfway between dystopia and SF. (And I'm still a fan of the virtual-encyclopedia guy from the movie.)


• Across the Wall, Garth Nix. I'm a big fan of the Abhorsen trilogy, and the first half of Across the Wall is a shorter story that's part of the canon. The rest of the book is a bunch of short stories outside the canon that I didn't find all that interesting. Nix writes young-adult stuff; Abhorsen aged well, IMO.


• Autobiography of Benjamin Franklin. Wow! Franklin gets short-shrifted among the Founding Fathers because he didn't do "hero" stuff like command armies or ride at midnight through Massachusetts, because he doesn't look all that dignified and because the things he did do were quietly behind-the-scenes and/or sounded silly (kite, anyone?). But his autobiography is full of all kinds of interesting things, like the brilliant way he basically tricked the people and the legislature into funding a new hospital. And it's packed to the gills with advice that's a little antiquated, but still good. This is a real self-help book, not some lame thing full of whining and words like "self-actualization". I would have liked to hear more about his experiments with electricity.

In Progress

• Le Ton beau de Marot: In Praise of the Music of Language, Douglas Hofstadter. What can I say? This is a book about translation -- but it's also a book by Hofstadter, which means it's a book about the idea of translation stretched and twisted and abstracted and applied to all different kinds of things, and at the same time it's also a book about poetry and music and elegance and math and computer science and AI and love. The book describes itself as something of a memory of Hofstadter's wife, Carol, and it's touching to read it as the world's longest, most elaborate love letter.


• Gödel, Escher, Bach: An Eternal Golden Braid, Douglas Hofstadter. This one is also about music and elegance and poetry, but with a much larger dose of logic and math and AI and symmetry and abstraction. It's more work to get through, but it's so worth it.


• On Food and Cooking: The Science and Lore of the Kitchen, Harold McGee. A really well-written guide to food, "scientific" in that it describes foods using scientific terms, not "scientific" in the sense of nutrition-reductionism. Sort of a Hacker's Guide to Culinary Experimentation.

On Deck

• I Am A Strange Loop, Douglas Hofstadter


• Diamond Age, or, A Young Lady's Illustrated Primer, Neal Stephenson


• Vaccine, Arthur Allen


• Jonathan Strange & Mr. Norrell, Susanna Clarke


• On Intelligence, Jeff Hawkins


• Dante's Inferno (anybody got recommendations about which translator to read?)