Search Results: "ag"

1 May 2014

MJ Ray: The Kelly Lessons in About 1555 Characters

So the Kelly report of the independent review into the events leading to the Co-operative Bank s capital shortfall was published yesterday. During the day, I was putting odd bits from it out in 140 characters with the hashtags #coops #kellylessons. Here they are in one more permanent place. How many of these lessons has your organisation whether a co-op or not learned?
  1. Running a full-service bank is a complex business Bank failed to understand the limits of its own capability
  2. The most important task for any board is to put in place the right Executive leadership for the business
  3. Ownership of a regulated bank requires a clearly articulated statement addressing mgmt & gov nance relationship
  4. Failures in board oversight are inevitable if the criteria used to elect do not require the necessary skills
  5. A bank board must include sufficient numbers of technically competent directors
  6. Boards need good m gmt info and to demand it if it is not forthcoming. Failure to obtain explains failings
  7. A bank should develop&implement robust risk gov nce&oversight and an appropriate control framework
  8. IT transformation keep as simple as poss , phase delivery.., deploy the right resources, plan for contingencies
  9. Bank should have paid closer attention and responded with greater urgency to what the Regulator told it
  10. Pay careful attention to the advice of external advisors. The Group ignored well-founded inconvenient advice
  11. Postponing dealing with problems is almost never a sustainable solution.
  12. Values need to be translated into meaningful guidance The Bank s ethical positioning should be more apparent
  13. Mantras about scale and ethics are no substitute for strategies grounded in a real understanding
  14. Talent management is critical Lack of capability driven by weaknesses in its recruitment&subsequent m gmt
  15. Tolerating culture of underperformance, weak transparency and a lack of accountability, constrains an organisation
Are there other lessons that you would add?

Andrew Pollock: [life] Day 93: A whole lot of running around

This morning Zoe woke up again at around 4am and ended up in bed with me. I don't even remember why she woke up, and neither does she, but she's assuring me it won't happen tomorrow morning. We'll see. As a result of the disturbed night's sleep, we had a bit of a slow start to the day. Zoe was happy to go off and watch some TV after she woke up for the day, and that let me have a bit more of a doze before I got up, which made things vaguely better for me. ABC 4 Kids has been showing a lot of ads for Ha Ha Hairies, which airs at 10:20am, lately, and it's one of the shows that isn't available on iView. Zoe had been lamenting that she never got to see it, and asking me if she could. Today the schedule was fairly open, so I made sure we were home at 10:20am. That involved a quick dash out to Woolies first to get a few bits and pieces for Zoe's birthday party. While Zoe watched the Ha Ha Hairies, I did some bulk egg hard boiling in the oven. After the Ha Ha Hairies and a little bit of general mucking around, we drove out to Spotlight to pick up the helium tank I'd rented. Zoe nearly fell asleep on the way out there. We picked up the helium tank and headed back home. That errand alone probably took a bit over an hour all up. We got back home and had lunch, but by the time all of that was out of the way, Zoe seemed to have missed the window for her nap. She did have a bit of a rest in bed, flipping through her library books, and I got to read some of my book as well, so that was nice. During that time, I got the call from Bunkers saying they were about half an hour out with the delivery of Zoe's bunk bed (my birthday present for her). That worked out well, as it was towards the start of the two hour window they'd advised me of. The bunk bed was delivered and then we popped out to Overflow to see if they had any food covers for the party food (they did) so we picked up a few of them. Today I learned that "As Seen On TV" is trademarked, and so "Similar To As Seen On TV" is the trademark dodging thing to put on cheap knock-offs. As Overflow is two doors down from Petbarn, we stopped in there as well and grabbed some more kitty litter. One does not just pop into Petbarn with Zoe, so we spent some time there looking at the fish and assorting aquarium paraphernalia. They also had some hermit crabs now too. On the way back home, we stopped in at (a different) Woolies to pick up the half slab of chocolate mudcake that I'd ordered for Zoe's birthday cake. I'd decided that the upright Minion cake I'd initially wanted to do was just way too adventurous for my abilities and not a good use of my time (and the quotes I'd sought for outsourcing it had come in at over $300). I scaled things back to just a flat slab Minion, which may still exceed my cake decorating abilities, but we'll find out tomorrow. There'd been a miscommunication at Woolworths, and my half slab hadn't been boxed up and wasn't ready for my collection. All the bakery staff had already gone home, and I didn't really want to come back tomorrow, because I had this crazy idea of possibly starting on the cake tonight (not going to happen), so a couple of non-bakery staff had to find the cake and figure out how to extract a full slab from the baking tray and cut it in half and box it up. It provided some entertainment for Zoe and I. We finally got home, and I rehashed some frozen leftovers for dinner. I decided to try something different for the bath time and bed time routine to see if it'd reduce procrastination. I got Zoe to pick out the three books she wanted to read at bed time before we got to story time, so we'd have something concrete to negotiate with. I also threw in the possibility of a "bonus story" if she didn't muck around. It seemed to work, and we had a fairly streamlined bath time. There's no doubt she was pretty tired today, and she went to bed without any fuss, so I'm hopeful that we'll have a good night tonight.

30 April 2014

Chris Lamb: Marlon Brando in the Lake District

Alan How:
There's an Italian restaurant somewhere in the Lake District in the north of England. And if you can imagine, there are hills, lots of rain, lakes, and so on and so forth. And inside this Italian restaurant is a huge picture a wall-sized mural of Marlon Brando. Now, I asked my students once: Why Marlon Brando? Well he's The Godfather! I don't think he was a Godfather, you know... But he was in that film, wasn't he? It was called The Godfather. Ah, that film from 40 years ago, virtually.. 1970-something? Yes, yes, but he was The Godfather then, wasn't he? You mean if was a mafiosi? He was a leading figure in gangsterland in New York? Well, yes, he was The Godfather, they keep saying, ... and he was Italian. Well, no, actually he was American... So you get this regular kind of placing and misplacing of the real, ie. a very large American actor who played in a film called The Godfather about American gangsters, or Italian-American gangsters, nothing to do with godfathers in Christianity, in the north of England, stuck on a huge wall in a restaurant. All of which tells us that it's an Italian restaurant. And we don't demure, we don't say "no, that's all untrue", we just take it for granted: "Yeah, that's what it means - it's an Italian restaurant". And it's that kind of slippage between the real and the imagined or the true and the fictional which Baudrillard thinks is becoming inceasingly characteristic of how our society goes on.

Wouter Verhelst: Code of Conduct accepted

It's taken a while to get here, but the code of conduct that I set out to produce about a year ago now has been voted on. The result which has been released earlier this week is that the code of conduct has been accepted, but that future updates would require another GR. Although not my personal preference, it's pretty much what I expected. I still think allowing the DPL to update the code of conduct in the future would be preferable over having to go through another GR (after all, if the DPL does something silly, we have ways of reverting that decision); but regardless, the fact that the code of conduct is accepted is, in my opinion, a major step forward for Debian. Thanks to everyone who voted!

Russell Coker: Links April 2014

Yves Rossy is the Jetman, he flys with a wing and four jet engines strapped to his body, he gave an interesting TED talk about flying along with some exciting videos [1]. Larry Brilliant gave an informative and inspiring TED talk about stopping pandemics [2]. I thought that Smallpox was the last disease to be eradicated but I was wrong. Michael Shermer gave an interesting TED talk about pattern recognition and self deception [3]. It s a pity that the kissing prank shown at the end only pranked women, they should be less sexist and prank men too. Raffaello D Andrea gave an interesting TED presentation about Athletic quadcopters [4]. It s very impressive and has the potential for several new human/machine sports. Lisa D wrote an insightful article about Prejudice Spillover discussing the way that people who aren t in minority groups only seem to care about injustice when a member of the majority is targetted by mistake [5]. Ron Garret wrote an insightful post about the Divine Right of Billionaires which debunks some stupid arguments by a billionaire [6]. Ron says that it s often instructive to examine incorrect arguments, especially when those arguments are advanced by smart people and demonstrates it in this post. Lisa D wrote an interesting post about her problems with financial aid bureaucracy [7]. She intended the post to be a personal one about her situation, but I think it illustrates problems with the various aid programs. If aid was available to her with less bureaucracy then she would be doing paid work, completing her studies, and heading towards post-graduate studies. Mark Shuttleworth wrote an insightful article about ACPI, security, and device tree [8]. It s the first time I ve seen a good argument for device tree. TED presented an interesting video-conference interview with Edward Snowden [9]. It s unusually long by TED standards but definitely worth watching. Tom Meagher (who s wife was raped and murdered two years ago) wrote an insightful article about rape culture [10]. Key Lay (the Victorian Chief Commissioner of Police) wrote a good article encouraging men to act to stop violence against women [11]. It s particularly noteworthy when a senior police officer speaks out about this given the difficulties women have had in reporting such crimes to police. Emily Baker wrote an insightful article about the lack of support for soldiers who survive war [12]. A lot of attention and money is spent remembering the soldiers who died in the field but little on those who live suffer afterwards, more soldiers die from suicide than enemy fire. Daniel Pocock wrote an informative article about the failings of SMS authentication for online banking [13]. While he has good points I think he s a little extreme. Stopping the least competent attackers is still a significant benefit as most potential attackers aren t that competent. Jess Zimmerman wrote an interesting article for Time about the Not All Men argument that is a current trend in derailing discussions about the treatment of women [14]. The Belle Jar has an insightful article Why Won t You Educate Me About Feminism about some ways that men pretend to care about the treatment of women [15]. Jon Evans wrote an article for Tech Crunch about the Honywell Bubble Count measure of diversity in people you follow on social media [16]. Currently on Twitter I follow 57 accounts of which 15 are companies and organisations, so I follow 42 people. I follow 13 women 31%, for a visible minority group other than my own it s 2/42 or 5%, for people who live in other countries I think it s 8/42 (although it s difficult to determine where some people live) which is 19%. So my Honywell number is 55. The Top Stocks forum has an interesting post by a Coal Seam Gas (CSG) worker [17]. It seems that CSG is even worse than I thought. Ashe Dryden wrote an informative post for Model View Culture about the backlash that members of minority groups (primarily women) receive when they speak out [18].

Mirco Bauer: Smuxi 0.11 "Distractions" Release

And here we go again! We're proud to announce the new version of Smuxi, release 0.11 "Distractions". During the development, 11 bug reports and 2 feature requests in 112 commits were worked on. Notable highlights in this release are:

User Interface Enhancements
  • The chat list can be shrunken. This is especially handy with XMPP/Jabber and long group chat identifiers.
  • The highlight counter is now a separate column. This enhances the vertical alignment with other highlights and guarantees to be visible even if the chat name was truncated.

Multi Identity Support Smuxi cares for user feedback. Multi identity support was the most voted feature and thus it has been implemented! Now you can please your schizo^Wdesire to use different nicks, users and real names depending on the server. Simply edit the server in preferences and change the details.

Message Patterns Everybody knows text can be boring because it is all just text. Nothing can sidetrack you except reading that bare text. Text often has recurring patterns from which something useful and interactive can be created. For example, someone writes:
Hey meebey, do you know RFC2812?
RFCs are a recurring pattern with a distinct number behind it and are real references to something in the internet (collection of protocol specifications). So I would usually fire up a browser tab, copy/paste or type RFC2812 into my favorite search engine and click the first hit. Then I'd reply to the question afterwards. But with Smuxi's message patters, it turns RFC2812 into a link on which you can simply click to launch the relevant document. Wow this is very cool, but isn't this already happening with http URLs and email addresses? Exactly! Why shouldn't more information be used to create useful things from it? Smuxi message patterns allow you to define text patterns that are transformed into clickable links. This can be used for RFCs, CVEs, bug report numbers (#XXX), git commit hashes and much more. Make good use of your creativity! By default Smuxi comes with built-in message patterns for:
  • URLs
  • heuristic URLs (not starting with http:// etc)
  • email addresses
  • RFCs
  • CVEs
  • Debian Security Advisories (DSA)
  • Many popular bug trackers (GNU, GCC, kernel, Launchpad, freedesktop, GNOME, KDE, Xfce, Debian, Redhat, Novell, Xamarin, openSUSE, Mozilla, Samba, SourceForge, CPAN, boost, Claws and Smuxi)
If you know more general patterns useful for others, please submit them. For a full list of built-in message patterns or how to add your own patterns, head over to the message pattern documentation.

Hooks Enhancements
  • A bug was fixed that prevented hooks from issuing more than one command
  • New hook points:
    • engine/session/on-group-chat-person-added
    • engine/session/on-group-chat-person-removed
    • engine/session/on-group-chat-person-updated
  • New hook variables:
    • CMD
    • CMD_PARAMETER
    • CMD_CHARACTER
    • PROTOCOL_MANAGER_PRESENCE_STATUS: Unknown, Offline, Online, Away

Twitter Enhancements As of 14 Jan 2014, Twitter disallows unencrypted HTTP requests which broke Smuxi's Twitter support. Smuxi is now making exclusively encrypted requests (HTTPS) and thus works with Twitter again.

JabbR (Beta) Enhancements
  • Messages now raise Smuxi hooks
  • The Validate certificate setting is now correctly honored.

Updated Translations Smuxi should now be in your language, including:
  • Initial complete Dutch (Jeroen Baten)

Behind the Scenes
  • New Smuxi git repository @ GNOME
  • Cleaner XMPP code (Oliver Schneider)
  • Smuxi's STFL text frontend is doing a graceful shutdown on quit (Calvin B))
  • New sexy website! We hope you like it :)

Contributors Contributors to this release are the following people:
  • Mirco Bauer (98 commits)
  • Oliver Schneider (6 commits)
  • Calvin B (6 commits)
  • Andr s G. Aragoneses (1 commit)
  • Jeroen Baten (translations)
Thank you very much for your contributions to Smuxi! Want it? Go here and grab it right now!

Posted Mon Apr 14 13:23:29 2014

Andrew Pollock: [life] Day 92: Kindergarten, cleaning and more birthday party preparation

I'm mostly back into my normal routine now. Next week should be spot on. Today, after my chiropractic adjustment and another walk to the post office to collect another package, I got stuck into cleaning the house. I got that mostly done before my massage, and knocked out the rest of it before I picked up Zoe from Kindergarten. Zoe seems to have successfully dropped her day time nap at Kindergarten now, which certainly makes a huge difference to getting out of the place on time. I'd underestimated the number of kids coming to Zoe's birthday party, so I needed to get some extra goody bags made up, so we headed directly out to Westfield Carindale to raid the The Reject Shop for some more bits and pieces. After we got home from that, Zoe watched a bit of TV and helped me assemble the extra bags, and then we had dinner. After some epic procrastination (on Zoe's behalf) I managed to get her to bed approximately on time. I really need to try some different approaches to getting through the bath time routine, because it's just taking too long. I gave myself a couple of time outs because I could see the situation deteriorating if I didn't. It's unhelpful that my blog seems to be the third hit in Google at the moment for "positive parent procrastination". I don't have the answers.

Christine Spang: becoming a better speaker

Last week, in the spirit of always getting better, I asked Twitter how to practice saying "um" less while speaking. Here's what I learned. Most people suggested to practice intentionally inserting pauses instead of saying "um". Various strategies include voice acting classes, having a friend aid with a buzzer (presumably to help you notice), and to record practice sessions as well as the real deal. Nagle suggested that meditation helped him, which makes sense to me as I've experienced meditation helping me be more mindful in many different areas of my life, including mundane things like noticing that I've touched something that's probably not that clean and remembering not to touch my face until I wash them. Wilfully directing mindfulness toward noticing how I speak is something I'm really stoked about, though it's easy to get swept away in a default "performance mode" in front of a crowd. Hendrick pointed out that Cognitive Behavioural Therapy is the principle behind changing speech behaviour and is a great starting point for more research. This is going to be really useful next time I'm practicing for a talk! Thanks @zmagg, @hendricklee, @bcrypt, @ebroder, @mscain, and @nagle5000 for playing. :) (original Twitter thread)

29 April 2014

Guido G nther: Bits from the 7th Debian groupware meeting

The seventh Debian Groupware Meeting was held in the LinuxHotel, Essen, Germany. We had one remote hacker from NYC which brings the number of attendants up to 9. This is a short summary of what happened during the weekend: Since we had a nice mix of first time Debian contributors, Debian Maintainers and Debian Developers we had lots of room for discussion and co-working which made this an exciting weekend. Groupphoto by Carsten Sch nert

Gunnar Wolf: Split regarding Docker

I have heard many good things about Docker, and decided to give it a spin on my systems. I think application-level virtualization has a lot to offer to my workflow... But the process to understand and later adopt it has left me somewhat heart-torn. Docker is clearly great technology, but its documentation is... Condescending and completely out of line with what I have grown used to in my years using Linux. First, there is so much simplistic self-praise sprinkled throughout it. There is almost no page I landed on that does not mention how user-friendly and user-centric Docker's commandline arguments are They let you talk in almost plain1 English. What they don't mention is that... Well, that's the way of basically every command-line tool. Of course, as soon as you start specifying details to it, the plain-Englishness starts dilluting into a more realistic English-inspiredness... Then... Things that go against our historical culture. It is often said that Windows documentation tends to be repetitive because users don't have the patience to read a full document. And our man pages are succint and to the point, because in our culture it is expected that users know how to search for the bit of information they are after. But reading documentation that's so excited with itself and praises again and again the same values and virtues, but never gets to the point I am interested in getting at (be it deployment, interoperation, description of the in-disk images+overlays layout, or anything moderately technical) never gets there... makes me quite unhappy. Last (for now)... Such a continuous sales pitch, an insistence on the good virtues, makes me wary of something they might be hiding. Anyway, at least for now, I just wanted to play a bit with it; I will wait at least until there is a backport to the stable Debian version before I consider moving my LXC VMs setup over to Docker (and a backport does not seem trivial to achieve, as Docker has several updated low-level dependencies we are unlikely to see in Wheezy). But I had to vent this. OK, now go back to your regular work ;-)

Joey Hess: the real Brazil

(click to enlarge)
"This is the real Brazil" -- Fernao After 3 days of travel, including 22 hours driving from Brasilia to the coast of Bahia, I can't say much more. A few things not pictured above.. The two hours of car-swallowing potholes in an arrow-straight highway in a flat plain, playing chicken against oncoming trucks. Night swim in the river in Correntina, followed by a whole grilled fish and ice cold guarana. Bliss. Push starting the car in a small cattle-farming village when it wouldn't start. The first sight of ocean waves and the drum circle last night.

Petter Reinholdtsen: Half the Coverity issues in Gnash fixed in the next release

I've been following the Gnash project for quite a while now. It is a free software implementation of Adobe Flash, both a standalone player and a browser plugin. Gnash implement support for the AVM1 format (and not the newer AVM2 format - see Lightspark for that one), allowing several flash based sites to work. Thanks to the friendly developers at Youtube, it also work with Youtube videos, because the Javascript code at Youtube detect Gnash and serve a AVM1 player to those users. :) Would be great if someone found time to implement AVM2 support, but it has not happened yet. If you install both Lightspark and Gnash, Lightspark will invoke Gnash if it find a AVM1 flash file, so you can get both handled as free software. Unfortunately, Lightspark so far only implement a small subset of AVM2, and many sites do not work yet. A few months ago, I started looking at Coverity, the static source checker used to find heaps and heaps of bugs in free software (thanks to the donation of a scanning service to free software projects by the company developing this non-free code checker), and Gnash was one of the projects I decided to check out. Coverity is able to find lock errors, memory errors, dead code and more. A few days ago they even extended it to also be able to find the heartbleed bug in OpenSSL. There are heaps of checks being done on the instrumented code, and the amount of bogus warnings is quite low compared to the other static code checkers I have tested over the years. Since a few weeks ago, I've been working with the other Gnash developers squashing bugs discovered by Coverity. I was quite happy today when I checked the current status and saw that of the 777 issues detected so far, 374 are marked as fixed. This make me confident that the next Gnash release will be more stable and more dependable than the previous one. Most of the reported issues were and are in the test suite, but it also found a few in the rest of the code. If you want to help out, you find us on the gnash-dev mailing list and on the #gnash channel on irc.freenode.net IRC server.

Russell Coker: Autism and the Treatment of Women Again

Background I ve previously written about the claim that people use Autism as an excuse for bad behavior [1]. In summary it doesn t and such claims instead lead to people not being assessed for Autism. I ve also previously written about empathy and Autism in the context of discussions about conference sexual harassment [2]. The main point is that anyone who s going to blame empathy disorders for the widespread mistreatment of women in society and divert the subject from the actions of average men to men in minority groups isn t demonstrating empathy. Discussions of the actions of average men are so often derailed to cover Autism that the Geek Feminism Wiki has a page about the issue of blaming Autism [3]. The Latest Issue Last year Shanley Kane wrote an informative article for Medium titled What Can Men Do about the treatment of women in the IT industry [4]. It s a good article, I recommend reading it. As an aside @shanley s twitter feed is worth reading [5]. In response to Shanley s article Jeff Atwood wrote an article of the same title this year which covered lots of other things [6]. He writes about Autism but doesn t seem to realise that officially Asperger Syndrome is now Autism according to DSM-V (they decided that separate diagnosis of Autism, Asperger Syndrome, and PDD-NOS were too difficult and merged them). Asperger Syndrome is now a term that refers to historic issues (IE research that was published before DSM-V) and slang use. Gender and the Autism Spectrum Jeff claims that autism skews heavily towards males at a 4:1 ratio and cites the Epidemiology of Autism Wikipedia page as a reference. Firstly that page isn t a great reference, I fixed one major error (which was obviously wrong to anyone who knows anything about Autism and also contradicted the cited reference) in the first section while writing this post. The Wikipedia page cites a PDF about the Epidemiology of Autism that claims the 4.3:1 ratio of boys to girls [7]. However that PDF is a summary of other articles and the one which originated the 4.3:1 claim is behind a paywall. One thing that is worth noting in the PDF is that the section containing the 4.3:1 claim also references claims about correlations between race and Autism and studies contradicting such claims it notes the possibility of ascertainment bias . I think that anyone who reads that section should immediately consider the possibility of ascertainment bias in regard to the gender ratio. Most people who are diagnosed with Autism are diagnosed as children. An Autism diagnosis of a child is quite subjective, an important part is an IQ test (where the psychologist interprets the intent of the child in the many cases where answers aren t clear) to compare social skills with IQ. So whether a child is diagnosed is determined by the psychologist s impression of the child s IQ vs the impression of their social skills. Whether a child is even taken for assessment depends on whether they act in a way that s considered to be obviously different. Any child who is suspected of being on the Autism Spectrum will be compared other children who have been diagnosed (IE mostly boys) and this will probably increase the probability that a boy will be assessed. So an Aspie girl might not be assessed because she acts like other Aspie girls not like the Aspie boys her parents and teachers have seen. The way kids act is not solely determined by neuro-type. Our society expects and encourages boys to be louder than girls and take longer and more frequent turns to speak, this is so widespread that I don t think it s possible for parents to avoid it if their kids are exposed to the outside world. Because of this boys who would be diagnosed with Asperger Syndrome by DSM-IV tend to act in ways that are obviously different from other kids. While the combination of Autism and the the social expectations on girls tends to result in girls who are quiet, shy, and apologetic. The fact that girls are less obviously different and that their differences cause fewer difficulties for parents and teachers makes them less likely to be assessed. Note that the differences in behavior of boys and girls who have been diagnosed is noted by the professionals (and was discussed at a conference on AsperGirls that my wife attended) while the idea that this affects assessment rates is my theory. Jeff also cites the book The Essential Difference: Male And Female Brains And The Truth About Autism by Professor Simon Baron-Cohen (who s (in)famous for his Extreme Male Brain theory). The first thing to note about the Extreme Male Brain theory are that it depends almost entirely on the 4.3:1 ratio of males to females on the Autism Spectrum (which is dubious as I noted above). The only other evidence in support of it is subjective studies of children which suffer from the same cultural issues this is why double blind tests should be used whenever possible. The book Delusions of Gender by Cordelia Fine [8] debunks Simon Baron-Cohen s work among other things. The look inside feature of the Amazon page for Delusions of Gender allows you to read about Simon Baron-Cohen s work [9]. Now even if the Extreme Male Brain theory had any merit it would be a really bad idea to cite it (or a book based on it) if you want to make things better for women in the IT industry. Cordelia s book debunks the science and also shows how such claims about supposed essential difference are taken as exclusionary. The Problem with Jeff Atwood Jeff suggests in his post that men should listen to women. Then he and his followers have a huge flame-war with many women over twitter during which which he tweeted Trying to diversify my follows by following any female voices that engaged me in a civil, constructive way recently . If you only listen to women who agree with you then that doesn t really count as listening to women. When you have a stated policy of only listening to women who agree then it seems to be more about limiting what women may feel free to say around you. The Geek Feminism wiki page about the Tone Argument [10] says the following: One way in which the tone argument frequently manifests itself is as a call for civility. A way to gauge whether a request for civility is sincere or not is to ask whether the person asking for civility has more power along whatever axes are contextually relevant (see Intersectionality) than the person being called incivil , less power, or equal power. Often, people who have the privilege of being listened to and taken seriously level accusations of incivility as a silencing tactic, and label as incivil any speech or behavior that questions their privilege. For example, some men label any feminist thought or speech as hostile or impolite; there is no way for anybody to question male power or privilege without being called rude or aggressive. Likewise, some white people label any critical discussion of race, particularly when initiated by people of color, as incivil. Writing about one topic is also a really good idea. A blog post titled What Can Men Do should be about things that men can do. Not about Autism, speculation about supposed inherent differences between men and women which are based on bad research, gender diversity in various occupations, etc. Following up a post on What Can Men Do with discussion (in blog comments and twitter) about what women should do before they are allowed to join the conversation is ridiculous. Jeff s blog post says that men should listen to women, excluding women based on the tone argument is gross hypocrisy. Swearing Jeff makes a big deal of the fact that Shanley uses some profane language in her tweets. This combines a couple of different ways of silencing women. It s quite common for women to be held to a high standard of ladylike behavior, while men get a free pass on doing the same thing. One example of this is the Geek Feminism article about the results of Sarah Sharp s request for civility in the Linux kernel community [11]. That s not an isolated incident, to the best of my recollection in 20+ years my local Linux Users Group has had only one debate about profanity on mailing lists in that case a woman (who is no longer active in the group) was criticised for using lesser profanity than men used both before and after with no comment (as an experiment I used some gratuitous profanity a couple of weeks later and no-one commented). There is also a common difference in interpretation of expressions of emotion, when a woman seems angry then she invariably has men tell her to change her approach (even when there are obvious reasons for her anger) while when a man is angry the possibility that other people shouldn t make him angry will usually be considered. The issues related to the treatment of women have had a large affect on Shanley s life and her friend s lives. It s quite understandable that she is angry about this. Her use of profanity in tweets seems appropriate to the situation. Other Links Newsweek s Gentlemen in Technology article has a section about Jeff [12], it s interesting to note his history of deleting tweets and editing his post. I presume he will change his post in response to mine and not make any note of the differences. Jacob Kaplan-Moss wrote a good rebuttal to Jeff s post [13]. It s a good article and has some other relevant links that are worth reading.

Andrew Pollock: [life] Day 91: Kindergarten, a successful assault on my to do list, haircuts and venus fly traps

I hate the days when I wake up at odd hours for no good reason. This morning I woke up at 4:30am briefly, with no idea why. It makes me wonder if there was some sort of external noise, and that's what woke Zoe up yesterday morning. I got myself going at a reasonable hour this morning, and decided to walk to the Bulimba post office to collect a package that was waiting for me. It was a nice enough morning for a walk, and I'm glad I decided to do it. Along the way, I observed multiple grandmothers walking their grandchildren to school. I've been thinking a lot about next year lately. I feel very strongly about Zoe not having to go into after school care. It seems that one of the new societal norms is the grandparents have to step in with the school transportation and after school care. That's not going to be particularly practical in our situation though, so I'm currently leaning towards seeking some sort of flexible employment next year that will allow me to be able to be available after Zoe finishes school. I was fairly motivated to get stuck into my to do list after my walk. A long standing item was to cancel one of my remaining US credit cards, and the time difference worked out well to do that, so I finally took care of that. I then realised it was a good time for the US East Coast, so I did a Hangout with one of my best friends in New York. It was great to have a catch up. After that, I finished off my US tax return, and also sorted out some other stuff that needed finishing off. I had to go to the Valley to find a FedEx location, so I drove over there, and on the way back stopped off in Bulimba to get some Mother's Day cards. By that stage it was about time to pick up Zoe from Kindergarten, so I quickly grabbed some lunch and then drove over to pick her up. She didn't nap again today, so that made our departure from Kindergarten nice and easy. I'd booked both of us in for haircuts at 3pm, so we got home with enough time for Zoe to ride her scooter to the hairdresser. We had our haircuts and Zoe had a bit of a play in the play corner, and we headed back home. I'd bought a venus fly trap from Bunnings last week while we were picking up other bits and pieces. I wanted to show Zoe how they worked, so we watched a few YouTube videos. This one was particularly good. After that, we went down to the rubbish skip with our fly trap to see if we could catch any flies in it, but Zoe quickly lost interest. So we headed back upstairs, and triggered one with a toothpick. I probably could have done this on a Friday and called it a Science Friday activity with a botany bent. After that, we just watched some TV together on the couch until Sarah arrived to pick her up.

28 April 2014

C.J. Adams-Collier: Wheezy 7.5 is out

And my ISO archive is out of date again. *sigh* Luckily, apt-mirror has reduced the time required to upgrade all of my machines significantly ;-)
cjac@foxtrot:~$ date ; sudo lsb_release -a
Mon Apr 28 13:56:16 PDT 2014
[sudo] password for cjac: 
No LSB modules are available.
Distributor ID:	Debian
Description:	Debian GNU/Linux 7.4 (wheezy)
Release:	7.4
Codename:	wheezy
cjac@foxtrot:~$ date ; sudo lsb_release -a
Mon Apr 28 14:02:20 PDT 2014
No LSB modules are available.
Distributor ID:	Debian
Description:	Debian GNU/Linux 7.5 (wheezy)
Release:	7.5
Codename:	wheezy

Daniel Pocock: SMS logins: an illusion of security

The IT security world is still reeling from the impact of the OpenSSL Heartbleed bug. Thanks to the bug, many experts have been reviewing other technologies to try and find similar risks. While Heartbleed was hidden away in the depths of the OpenSSL code base, another major security risk has been hiding in plain sight: SMS authentication for web site logins. Remarkably, a number of firms have started giving customers the ability to receive single-use passwords over SMS for logging into their secure web sites. Some have even insisted that customers can no longer log in without it, denying customers the right to make an important choice about their own security preferences. Unfortunately, SMS is no substitute to the one-time-passwords generated using proper authentication tokens or the use of other strong authentication schemes such as cryptographic smart cards. Even telephone companies themselves advise that SMS should not be used to secure financial transactions. Ocean's 11 in real life: exploiting the weakest link in the chain To deliver single-use SMS passwords, the SMS must travel through various networks from the firm's headquarters, to a wholesale SMS gateway, international SMS network and finally down the line of the local phone company. In comparison, properly certified token devices generate a code inside the device in the palm of your hand. The code only travels from the screen to your eyes. In a litany of frauds coming in all shapes and sizes, telephone networks have been exploited over and over again because they are almost always the weakest link in the chain. Using the mobile SMS network for authentication is not building on solid ground - some experts even feel it is downright stupidity. One of the most serious examples was the theft of $150,000,000 from a pension fund deposited with JP Morgan: it was described as a real-life case of Ocean's 11. The authentication was meant to be a phone call rather than an SMS: a phone company employee who was in on the scam duly ensured the call never reached the correct place. The insecurity of traditional telephone networks has been on display for all the world to see in the ongoing trial of News Corporation executives for phone hacking. If journalists from a tabloid newspaper can allegedly hack a dozen phones before their first cigarette of the day, is it really wise to use an insecure technology like SMS as the cornerstone of a security system for authorizing transactions? A fraud recently played out on many credit card holders in the UK exploited a low-tech feature of the phone system to trick people to believe they were safe by "calling back" to their bank. A plethora of new attack vectors The staggering reality of the situation is that attackers don't even have to directly hack their victim's phones to access SMS messages. As the Android API documentation demonstrates, SMS reception is notified to all apps in real-time. Apps can process the messages even when the phone is sleeping and the message is not read by the user. Just consider all the apps on a phone that have requested permission to read incoming messages. There was an uproar recently when a new version of the Facebook app started demanding permissions to read incoming SMS. The app can't be installed if the user doesn't agree to these new permissions. WhatsApp, another popular app that has SMS access rights, was recently exposed in a major security scandal which revealed they use a phone's IMEI number as the password. When people install an app like Tinder (which does not yet request SMS access) is the security of their bank account likely to be at the front of their mind? Even if Facebook intends no harm, they have opened the floodgates by further de-sensitizing users to the risks of giving apps un-necessary access to their data. These companies are looking for every piece of data that could give them an edge in their customer profiling and marketing programs. Having real-time access to your SMS is a powerful way for them to understand your activities and feelings at every moment in the day. To facilitate these data analysis techniques, replicating and archiving your messages into their cloud databases (whether you can see them there or not) is par for the course. The cloud, of course, has become a virtual smorgasboard for cyber-criminals, including both hackers and occasionally insiders wanting to peek at private data or harvest it en-masse. Social networking and communication sites are built on a philosophy of sharing data to create interaction and excitement. Unfortunately, this is orthogonal to the needs of security. In this context, the telephone network itself may no longer be the weakest link in the chain. The diligent attacker only needs to look for the cloud operator with an unplugged security hole and use their system as a stepping stone to read any SMS they want, when they want. Would you notice a stray SMS? Maybe you feel that you would notice a stray SMS carrying a login code for your bank account. Would you always be able to react faster than the criminal however? Thanks to social networks, or location data inadvertently leaked by other apps the attacker can easily work out whether you are on holiday, at the gym, at a party or sleeping or in some other situation where you are not likely to check messages immediately. If you receive a flood of SMS spam messages (deliberately sent by an attacker) in the middle of the night and you put your phone into silent mode and ignore it, you may well miss one message that was a login to your bank account. SMS technology was never designed for secure activities. The inconvenience of SMS While security is a headline issue these days, it is also worth reflecting on the inconvenience of SMS in some situations. Travel is at the top of the list: SMS doesn't work universally when abroad. These are usually the times when the only way to access the bank is through the web site. After dealing with the irritations of the hotel or airport wifi registration, do you really need more stress from your bank's systems too? For some networks, SMS can be delayed by hours or days, sometimes never arriving at all. Many people swap their SIM cards when travelling to avoid the excessive roaming charges and there is extra inconvenience in swapping SIM cards back again just to log in to a bank account. Worst of all, if you are tethering with a SIM card from the country you are visiting, then it is impossible for you to receive the SMS message from the bank on your regular SIM card while simultaneously maintaining the SSL connection to their web site over your new SIM card. Other problems like a flat battery, water damage or PIN permanently blocked by children playing with the phone can also leave you without access to your bank account for varying lengths of time. Is there any up-side to SMS authentication? The only potential benefit to SMS authentication is that it weeds out some of the most amateur attempts to compromise your bank account, but this is a false sense of security and it opens up new attack vectors through the cloud as we have just demonstrated. For all other purposes, it smells like a new form of security theater. A more likely reason why it has become popular amongst some firms is that many lenders want to ensure they have mobile phone numbers to contact customers when loan or credit card payments are missed. Making the mobile phone number mandatory for login ensures they almost always have the correct phone number for almost 100% of customers. It is not clear that this benefit justifies the failure to provide proper security and the inconvenience when travelling though. Opting out Next time you log in to a web site, if the firm does try to enrol you in an SMS authentication scheme, it may be a good idea to click the "No thanks" option. If you have already been registered into an SMS authentication scheme, fill out the online complaint form and inform the firm that you will only accept a proper authentication token or cryptographic smart card. These solutions are tried and tested and they are the correct tool for the job.

Martin Pitt: Booting Ubuntu with systemd: Now in Utopic

Hot on the heels of my previous annoucement of my systemd PPA for trusty, I m now happy to announce that the latest systemd 204-10ubuntu1 just landed in Utopic, after sorting out enough of the current uninstallability in -proposed. The other fixes (bluez, resolvconf, lightdm, etc.) already landed a few days ago. Compared to the PPA these have a lot of other fixes and cleanups, due to the excellent hackfest that we held last weekend. So, upgrade today and let us know about problems in bugs tagged systemd-boot . I think systemd in current utopic works well enough to not break a developer s day to day workflow, so we can now start parallelizing the work of identifying packages which only have upstart jobs and provide corresponding systemd units (or SysV script). Also, this hasn t yet been tested on the phone at all, I m sure that it ll require quite some work (e. g. lxc-android-config has a lot of upstart jobs). To clarify, there is nofixed date/plan/deadline when this will be done, in particular it might well last more than one release cycle. So we ll release (i. e. switch to it as a default) when it s ready :-)

Evgeni Golov: Debian Bug Squashing Party Salzburg 2014

bsp2014_small This weekend, Bernd Zeimetz organized a BSP at the offices of conova in Salzburg, Austria. Three days of discussions, bugfixes, sparc removals and a lot of fun and laughter. We squashed a total of 87 bugs: 66 bugs affecting Jessie/Sid were closed, 9 downgraded and 8 closed via removals. As people tend to care about (old)stable, 3 bugs were fixed in Wheezy and one in Squeeze. These numbers might be not totaly correct, as were kinda creative at counting Marga promised a talk about an introduction to properly counting bugs using the Haus vom Nikolaus algorithm to the base of 7 . IMG_20140427_182902 Speaking of numbers, I touched the following bugs (not all RC): A couple of (non-free) pictures are available at Uwe s salzburg-cityguide.at. Thanks again to Bernd for organizing and conova and credativ for sponsoring!

Andrew Pollock: [life] Day 90: Kindergarten, and a motivational slump

My alternative option to quitting my day job so I could spend more time with Zoe was to take three months leave without pay. That wasn't really a great option, because it would mean that Zoe would only get one term of Kindergarten, and then I'd be back at work. Well today is the day that I'd go back to work if I took 3 months leave without pay. So far, I have zero regrets from doing the stay year-long at home Dad thing. At the end of the first week, I was absolutely exhausted, and a little worried that I'd bitten off more than I could chew, but since that point, I've found my stride and now I'm mostly just worried about what I'm going to do with myself next year. I'm really happy with the range of activities that I've been able to do with Zoe in the past 90 days. For this term, I'm going to do a combination of repeating some of the things we've done previously (Zoe's already asking to go ice skating again), and introduce her to a few new things that we didn't get a chance to do last term. As it starts to cool down a little bit more, we'll be looking around for more indoor activities to do, as well. Today though, I had a bit of a motivational slump. Zoe woke up, briefly, at 4:30am. I can't even remmeber why. I was smack bang in the middle of some serious REM sleep, so I found getting up to attend to her particularly jarring. I was a bit sluggish this morning as a result, and Zoe was also doing some spectacular procrastination. That coupled with rain meant we were a bit late getting to Kindergarten. The drop off itself went pretty well, and I drove home and had a late shower. There was a myriad of things I could have been doing, but I mostly just made a bunch of phone calls to organise things, did some more planning for Zoe's birthday party this Saturday, and waited for pick up time to roll around. I'll need to do a better job of being self-disciplined tomorrow. Kindergarten pick up was fine. I've been encouraging Zoe to reconsider napping at rest time, and the last two times I've picked her up, she hasn't napped, which has made for a much easier departure, and she hasn't been noticeably worse for wear for it. We went to take a look at the park we're having her birthday party in on Saturday, just to get a lie of the land in terms of tables and BBQs, and then we went to the Valley to clear my PO box. After that we went to the dance store in the Valley to get a leotard, socks and stockings for her ballet class. By the time we got home from all of that, there was only about an hour before Sarah was due to pick Zoe up, so she watched a bit of TV, and then we played hide and seek for a bit, and watered the seeds we've planted. I skipped yoga tonight because I'm still on lifting restrictions, and decided to skip Meatless Monday as well and hang out with my friend Michael and eat all the ribs I could handle. Boy was that an eating binge.

27 April 2014

Daniel Pocock: AirBNB hosts scanning identity documents and passports?

We recently had a vacation in Italy and used AirBNB to book our accommodation in three different cities we visited. We've used AirBNB quite a few times now but we had a new experience this time: one of the hosts told me she makes a scan of the passport of each guest. Sitting on the dinner table was a shiny new looking handheld scanner similar to this: I was tempted to ask if she also wanted my fingerprints and a DNA sample too. Not wanting to be too offensive though, I simply told her that there was no way she would be making a copy of our documents. I tried to explain it to her in terms that she would understand: that AirBNB had already verified my identity and that AirBNB automatically gives her insurance (Italy is included) and she doesn't need a copy of my passport to be eligible for the insurance. At best, I suggested, she would be welcome to look at the passport to see that the name matches the AirBNB account - but no copies under any circumstances. A common problem A quick search in Google reveals we weren't the first people to have such an experience with a host. However, the AirBNB FAQ has no definite comment on the topic. I wrote to AirBNB's safety team and explained the risks with copying documents onto home computers and they are now considering adding something about this issue to their policies and FAQ. I would suggest that anybody else who is asked for a copy of an identity document should also fill in the safety report form and ask AirBNB to publish a firm policy prohibiting hosts from demanding copies of identity documents. Just what is at risk? Just how bad could it be? Some of the following risks come to mind:
  • The host's computer is sold, sent for repair or stolen and the passport images all end up in the hands of strangers.
  • Viruses and trojans designed to search hard disks for sensitive documents can quickly recognise a passport image. Such viruses are far more likely to hit a home computer than one of those computers used by passport scanners at an airport or bank.
  • Maybe the host even has children or housemates who access the same computer.
  • The host may actually be making themself a target by keeping a cache of these documents - it would be a fairly low-tech hack for a criminal to look through AirBNB listings for hosts who explicitly mention they want to copy an identity document at check-in.
Did the world really get safer since September 2011? Ever since the horrors of 09/11/2011, many people have felt an urge to try and make the world safer. Simultaneously, the rise of cheap technology has made it easy for people to take these things way too far. Everywhere from bed and breakfasts to luggage storage companies are now trying to scan these documents at every opportunity. Having electronic copies of identity documents floating around in so many different places, many of them on poorly maintained computers that are used by staff to surf the web when they are not busy, is actually a huge increase in the risk of identity fraud. A good proportion of these companies are not even required to scan/copy identity documents - for some of them it is sufficient for them to simply look at the document, just as a train conductor looks at a ticket. Many are simply scanning the documents because management have realized this is the most efficient way to accurately build up a marketing database including customer date of birth (which is harder to ask for directly). There was significant outrage a few years ago when Mossad was accused of using passport images presumably acquired at Israeli airports to give fake identities to a hit-squad. The quality of passport images now available in the hard disk of a typical AirBNB host or bed'n'breakfast are now likely to be of a higher quality and yet available for misappropriation by a far wider proportion of (cyber-)criminals.

Next.

Previous.