Monday, February 21, 2011

Proudly Presenting: Serene Logician

Over the last years, I've spent quite some time thinking about security and, in particular, social engineering. It's something that fascinates me for the same reasons that I like mathematics and stage magic: All those things are about finding missing links in an alleged chain of evidence.

In mathematics, a missing link in a chain of evidence simply means that a proof is incomplete.

In stage magic, a missing link is what allows a magician to produce an illusion of actual magic, by demonstrating to the audience in 20 ways how he has no chance of manipulating something -- while he manipulates it in the 21st way. Indeed, stage magic is often just about providing so much proof that the audience doesn't notice any more that the chain of proof still didn't go from one end to the other. (Rest assured that whenever a stage magician says "Now I put this here so that you can make sure that I don't exchange it", he has already exchanged it long ago. And then proceeds to demonstrate in spectacular ways how he really does not exchange it again.)

What a social engineer does is not much different, and again, the crux is that somewhere in the chain of evidence there must be a missing link. Just think of a fake plumber in front of your door who can show you an ID with his photo and the name of "his" company. You can verify that the photo and his face match. You can verify that the name and his name tag match. You can verify that the hologram on the ID card is real. You can verify that the company exists. You can verify that the phone number on the ID card matches the real phone number of the company. You can phone the company and verify that they have an employee of that name. Maybe they can even confirm that he is supposed to come to you today. And still that man in front of your door has never ever worked for that company. Where's the missing link?

Anyways, I have a thing for finding such missing links, and obviously also a certain skill for it. And given that I'm planning to write about those more frequently now, I've decided to dedicate a blog to them.

Proudly presenting:

You can expect some presenting of basic principles, and a lot of ranting about the daily security lunacies. Posting frequency will vary and I'm not committing myself to any schedule, but there are some postings already in planning, and from experience I run across a post-worthy example every few weeks.

I'd also like to express my sincere apologies to those of you who are already reading my other blogs (plural) for adding another one to the list. On the upside, it's a public one so you can just add it to Google Reader and don't have to open yet another tab for it.

-- Birgit

P.S.: The missing link is the ID card. There's no way to prove that it's genuine, since you most probably have no idea how an ID card of that company is supposed to look like.

The company's confirmation that this employee is really scheduled to visit you can be achieved by calling the company beforehand, pretending to be you (i.e., the visited person) and really requesting the real employee of that name to come to you. When this appointment is then canceled last-minute, chances are high that the secretary at the company isn't notified about the cancellation yet when you call her, and will confirm the appointment.

Friday, February 18, 2011

A cheer to freeware


Every time I re-setup my computer I realize that more and more freeware is running on it. In former times, setting up a computer meant inserting 20 CD-ROMs one after another -- MS Windows, MS Word, MS Office, Paint Shop Pro, ... --, today setting up means to me: First installing Windows, then downloading the most recent versions of all other programs.

Therefore, a cheer to freeware -- which by the way is according to certain sources in the USA a very communist construct ;) --, thanks to which I by now use hardly any proprietary software any more except for Windows.

Here's a list of great freeware programs (or in some cases shareware or demo versions) that are usually installed on my computers:



Basics:
Acrobat Reader / Foxit Reader
Reading .pdf files

GhostView / GhostScript
Reading .ps files

PDF24 Creator
Creating and editing of .pdf files

pdf995
Creating .pdf files by a printer driver

TortoiseSVN
Version control with SVN

CDBurnerXP
Burning CDs and DVDs

7-Zip
File compression program for (almost) all formats

cygwin
Linux emulator

DOSBox
DOS emulator



Creating and editing of documents:
nodepad++
Text editor and source code editor

LibreOffice
Office programs: Text editing, spreadsheet processing, presentations, ...

MikTeX
Compilation of LaTeX documents

WinShell
LaTeX editor

Asymptote
Programming language and compiler for creation of vector graphics

GeoGebra / Euklid DynaGeo
Creation and editing of interactive geometry sketches



Programming:
eclipse
Development environment

Java JDK
Java (development kit and Virtual Machine)

Visual C++ Express
C++ (development environment and compiler)

Python
Python

SWI Prolog
Prolog (development environment and compiler)



Graphics:
IrfanView
Display of image files

Gimp
Image editing

Paint.net
Image editing

Inkscape
Editor for vector graphics

autostitch
Assembling large images from multiple photos (image stitching)



Music and multimedia:
iTunes
Music playback, download and playback of podcasts, managing of files on an iPod

VLC Media Player
Playback of videos and DVDs

Winamp
Music playback

Amarok
Music playback

VirtualDub
Video recording and editing

NoteWorthy Composer (Demo)
Creation of sheets of music



Internet:
Firefox
Browser

Chrome
Browser

Thunderbird
Email and newsgroup client

IMAPSize
Backup of IMAP email accounts

PuTTY
SSH and Telnet client

WinSCP
FTP and SFTP client with GUI

pidgin / qip
Instant messenger (for ICQ, AIM, ...)

ChatZilla
IRC client

Skype
Skype client (for internet telephony)

Apache
Webserver (for local testing of homepages)

Vuze
client for peer-to-peer filesharing



Antivirus:
Avira AntiVir
Anti-virus software

Spybot
Anti-spyware program



Datenbanken:
MySQL
MySQL data base system

NaviCat Lite
GUI for MySQL



lG Birgit


Edit (2011-02-18): Add Foxit Reader and PDF24 Creator.

Edit (2011-02-24): Update OpenOffice.org to LibreOffice.

Sunday, February 13, 2011

Personenschaden

Ich hatte schon vor Ewigkeiten angekündigt, wie sehr ich es liebe, mich über Euphemismen auszulassen, und heute ist endlich ein passender Anlass dafür. Und weil's so schön ist, beginne ich gleich mit einem von meiner persönlichen Top-10-Liste der schönsten Euphemismen.

Das Wort des Tages lautet: "Personenschaden".

"Personenschaden" ist ein Wort, das unwillkürlich an "Wildschaden" erinnert, und auch genau so verwendet wird: Nämlich dann, wenn eine Person vor einen fahrenden Zug gelaufen ist. Meist vorsätzlich.

"Der Zug hat Verspätung wegen Personenschaden" heißt daher meist so viel wie: "Der Zug hat Verspätung, weil jemand vor den Zug gesprungen ist und wir gerade dabei sind, seine Überreste mit dem Hochdruckreiniger aus dem Fahrwerk zu sprühen."

Nahe verwandt übrigens: "Sie ist vor den Zug gegangen." Was eine ungleich harmlosere Beschreibung ist als "Sie hat beschlossen, ihrem Leben ein Ende zu setzen, und dabei noch einen unschuldigen Zugfahrer zu traumatisieren, indem sie ihm bei voller Fahrt vor den Zug gesprungen ist."

Zu den nennenswerten Zahlen und Fakten: Allein in Deutschland finden im Durchschnitt jede Woche 15 Schienensuizide statt, mit einer leichten Häufung im April und September sowie an Montagen und Dienstagen. Im Laufe seiner Dienstzeit erlebt ein durchschnittlicher deutscher Lokführer 2 bis 3 Suizide. Etwa jeder elfte Zugführer macht ein Mal im Leben eine schwere posttraumatische Belastungsstörung durch, ein Drittel davon bleibt dauerhaft arbeitsunfähig. Die Deutsche Bahn unterhält ein eigenes Sanatorium für Lokführer, die durch Schienensuizide traumatisiert wurden.

Den Euphemismus gibt es übrigens aus demselben Grund, aus dem man auch trotz der erschreckend hohen Anzahl solcher Fälle so selten davon hört: Weil aus Angst vor Nachahmungen bewusst nicht darüber berichtet wird -- siehe Werther-Effekt.

Nicht, dass die Euphemismen-Tretmühle nicht ohnehin schon längst zugeschlagen hätte. Der neue Begriff lautet daher jetzt "Notarzteinsatz am Gleis". Und bedeutet immer noch "Zusammenkratzen von Leichenteilen".

Tuesday, February 8, 2011

Schachrätsel


Wie holt Weiß am Zug hier den entscheidenden Vorteil?

-- Birgit

Monday, January 31, 2011

Life -- A review

Life is a game, some people say. Well, if it's a game, then it has deserved a review.

I shall assume that most people are familiar with the basic rules, so I'll skip directly to the discussion about some concepts, some strategies, and replay value.

Some flawed concept

There are various concepts that are frowned upon in games, and for a reason. Unfortunately, life sports quite a few of them.

One big factor is randomness. There are various game elements that appear to be completely random (in spite of actually following certain hidden rules), and, worse than that, unnecessarily random, and not adding much to the game play.

Let's start with random starting positions. While random setup helps to keep game play varied, in this case the random starting positions just have too much influence on the kind of options a player has and their winning chances. Some starting positions are just too strong and others too weak. A player starting in certain regions of Africa for example has low chances of going for an academic career, and almost no chance of getting far ahead on the money track. Also, in many cases, the starting position already more or less determines the entire strategy and outlook of a player, and sometimes leaves very little choice. The most egregious cases here are of course those where a player is forced into a certain role and possibly even killed before even getting old enough to take own decisions, let alone reach age of consent. Child soldiers, child pornography and child prostitution are the worst (and unfortunately not exactly rare) cases here. But even those aside, for example players starting in conflict regions or very religious societies usually have very low chances of completely staying out of those things, even after reaching adulthood.

Closely related to that is a certain running leader problem, especially in terms of power and money. Players who are at some point ahead in one of these fields usually will gather more and more, while players starting low have almost no chance of catching up.

Similarly, random player attributes have an unduly large influence. The most prominent example here is gender, which is randomly assigned to players when they start playing, and even though there are some special rules that will allow changing it later, they have so many drawbacks that few people will actually use them. Closely related to that is sexual orientation, though that is one random factor that I personally find quite interesting, because it gives some players a kind of side quest without completely spoiling the game experience for them if they don't complete it. Still, depending on the starting position it might be too much of a disadvantage in some situations, especially in those where public display of queer orientation is threatened with severe social consequences and even death penalty.

Another completely unbalanced random player attribute is disability, both physical and mental. Physical disability such as blindness or dwarfism can have a huge impact on the options available to a player, like for example career choices. As far as mental disabilities are concerned, I wouldn't dare evaluating how much they really influence the player's game experience for the better or the worse, but I certainly find the concept unnecessary.

One more very random element is love, a game mechanism that more or less randomly adds strong emotional connections between players. Worse than that, these connections don't necessarily go both ways; In fact, they surprisingly often don't. Which wouldn't be so bad, if one-way love connections didn't have such detrimental effects on affected players. Reciprocal connections on the other hand usually offer a very big boost to both involved players. Not surprisingly, many players therefore consider this concept one of the best things about the game, even though it reduces predictability. But given how random everything is already, a little bit of extra randomness is probably a small price to pay.

The one concept that truly sucks however and makes playing utterly unpleasant at times is player elimination. Interestingly though, in contrast to other games with player elimination that I have played, the big problem with player elimination in life is not that the eliminated players sitting out are bored -- at least not that I'm aware of --, but rather the negative effect that the elimination of a player has on the players remaining in the game.


Discussion of Strategies

As with many complex games, the best strategies are often very hard to figure out. It's already quite complicated to find the reasonably good ones.

   Pure strategies

As far as life is concerned, many players seem to go for money as their main winning strategy. While that strategy by itself is not horribly bad, I personally have the feeling that those players are missing quite a bit of the game play. Also, looking at the outcomes of players who go for that strategy, it seems to stagnate at some point rather than going infinitely upwards, and can even genuinely backfire in some cases.

Another popular but in my humble opinion very much overrated strategy are drugs. They might give a very short immediate boost, but on the long run the strategy always shows an overall downhill trend. So far I haven't met a single player for whom the strategy ever worked out.

Love is a third strategy that is used often, with the player concentrating all efforts on finding and retaining a permanent love relationship. Given how random the concept of love is (as described above), this appears an ill-conceived idea, and while it goes well often enough, it indeed also often goes horribly and painfully wrong, to the point of players dedicating more resources than reasonably justifiable or even comprehensible to gaining, preserving or regaining love. The possible end results are stalking, pathological jealousy, erotomania, suicide, and a whole branch of psychotherapists making a living of it.

Escapism is the fourth of the big strategies, usually achieved through excessive computer gaming and/or submersion in imaginary worlds. In combination with the drug strategy it can lead to long phases of almost complete loss of connection with the outside world. In combination with the love strategy it is expressed through excessive intake of mediocre literature such as Rosamunde Pilcher and soap operas, combined with the firm belief in their realism. It can also lead to sickly sweet plans of marrying in white and living happily ever after, usually without ever accomplishing them. While many players go through a phase of escapism during their transition from childhood to adulthood, continuing the strategy beyond that age can lead to drastically reduced chances of actual accomplishment in the game. Disturbingly, the strategy is just good enough that most players who get stuck in it at some point decide to actively try to perpetuate it. And indeed abandoning the strategy at a later stage often comes with rather severe consequences -- such as realizing how many years of their life they already wasted with it --, which ironically makes continuing the strategy a very tempting choice.

Closely related is the strategy of complete submersion in work, with the only exception that instead of imaginary worlds and problems, real ones are used. The most important positive factor here is constant positive feedback from the immediate environment. The big drawback is that the strategy requires a lot of time and energy and leaves little space for change or even choice. Again, the strategy is just good enough that many players choose to stick with it, even though it stagnates soon and has little chance of achieving high results. On the upside, it has also a low risk of complete failure and can thus be considered a rather safe strategy.

A strategy that is almost diametrically opposite to the previous strategy is trying to enjoy life as it is without putting any effort into changing anything about it, or even into maintaining the status quo. As mentioned in the discussion about random starting position above, some strategies are not available everywhere, and this one can only be used effectively in regions with a strong social support system, i.e., Europe. In those situations, the main drawback of the strategy really is that it is frowned upon by other players (because it drains their resources) and might therefore lead to rather adverse reactions by them. Also, it gives very little positive feedback or direct reward. For those two reasons, the strategy is only usable for players who have a thick skin amongst their random attributes, as well as a rather strong self-esteem that doesn't need positive feedback for retention. For players who have those attributes and live in a suitable region, the strategy can work out very well, though.

Diametrically opposite to that (and therefore again close to the work strategy) is the constant strive for approval, respect and/or attention from the environment. The "disease to please" is one form, another one is the "disease to impress". Different as those two might seem, what they and all related strategies have in common is that they heavily depend on positive feedback from the social group. While those strategies work well as long as this positive feedback can be achieved, they drain quite some energy, and on the long run heavily erode self-esteem. Given that many of the other strategies presented here require self-esteem to work properly, it's often hard to get away from this strategy after having used it for some time. But also using this strategy for a longer time has many disadvantages, because it needs a constant increase in intensity to work. This is mostly due to the environment getting used to the player's behaviour and requiring higher dosages of it in order to still give the same amount of positive feedback. For example, people might compliment someone on being slim, but after a while they get used to it, so in order for them to still notice it, the person in question needs to become even slimmer. For someone depending on this strategy, this might well be a jump start into anorexia nervosa. Other frequently found extreme forms are codependency (also known as helper syndrome), workaholism, plastic surgery (taken to the extreme by certain celebrities), various forms of attention seeking, and of course loss of any kind of individuality.

Adventure seeking finally is a strategy that is popular especially amongst younger players, and usually pursued either by extreme sports or extensive traveling. While a good addition to any of the previous strategy, it's barely usable as a stand-alone strategy, mostly because the world at some point runs out of [reasonably safe] sports or [reasonably safe] places.

Many other popular strategies are very similar to those already described. Going for power for example is very similar to going for money, with similar advantages and drawbacks. Religion is mostly a more community oriented version of escapism. Excessive partying doubles as drug usage and attention seeking. Focus on learning is similar to the working strategy. Extreme altruism is another variant on the approval seeking strategy, and can double as working strategy (in social work) and even triple as escapism by concentrating on other persons' problems instead of the own ones. Gambling and other behavioural addictions are close to drug usage, both in effects and outlook. Spending a lot of time on the Internet can slide between escapism and approval/attention seeking, depending on the online activities. (Bloggers such as me seek approval, trolls seek attention, and youtube watchers seek distraction from their own lifes.) Intense sex seeking behaviour [outside of relationships] can either be a very cynical form of the love strategy, or a variant of approval seeking. Hopeless romanticism is a mixture of the love strategy and escapism. Strategies based on friends and family are closely related to the love strategy. And so on.

   Mixed strategies

Now that I've presented a bunch of strategies that don't work, let's look into strategies that do. As with many games, the strategies that work best are mixed strategies. Looking at all the strategies above, they all only go wrong in their extreme forms, but can give good results as long as their drawbacks can be absorbed somehow.

Take love for example. The big problem here is not that the strategy is inherently flawed, it's just that it can go down very far in unlucky circumstances. It's therefore very dangerous as a pure strategy, but can work very well if combined with another strategy to fall back to in case things go wrong. Indeed some of the strongest strategies I've seen put a very strong emphasis on love, but always have a backup strategy ready and can pull out when things go badly. In short, love can be a very valuable part of a mixed strategy, as long as a player "knows when to fold 'em". Admittedly, most of us probably need to fall hard once or twice before learning that hope is not a strategy (though hopeless romantics will argue about that).

Similar to a good finance portfolio, a good life strategy therefore contains a lot of very different aspects, which might well mean combining all of the pure strategies mentioned before. A good portfolio might for example contain some "safe" strategies, such as work or learning, and some risky but profitable ones like love or adventure seeking.

   Tactics

Reminder for the not so game theory savvy people out there: Strategy is the long term plan, tactics is the short term procedure used to carry out the strategy. Some of these tactics could also be considered smaller strategies, since they are not broad enough to be used as pure strategies, but are rather long-term for tactics.

Other than strategies, the available tactics in life are rather manageable, but often underestimated. Some examples of notable tactics in life are:
  • Health care. Almost obligatory part of every strategy.
  • Humour. Very valuable for almost all strategies (except maybe religion), but often underrated.
  • Self-confidence. Also valuable in virtually all strategies.
  • Relaxation, inner calmness. Popular especially in eastern traditions, useful in almost all strategies.
  • Distraction. Basically a short-term version of escapism, and as such quite useful in some situations.
  • Self-pity. Efficient for cushioning setbacks, but counterproductive when used excessively.
  • Social interaction. Almost all strategies involve a lot of interaction amongst humans and therefore benefit from interaction skills.
  • Empathy. Closely related, it is also valuable in virtually all strategies.
  • Honesty. Roughly balanced between positive and negative effects. If used consequently, the positive effects will after some time start to prevail, and can therefore be part of a long term strategy.
  • Arrogance, devaluation. Frequently used as a counter mechanism in strategies that drain self-esteem. Helps to create a false feeling of self-esteem by looking down onto others, but causes enough other problems on its own, especially in strategies dependent on positive feedback from other people.
  • Passive-aggressive behaviour. Wide spread, though not very effective.
  • Denial. Prevents some of the negative effects of realizing that a strategy went wrong, but also prevents or at least reduces motivation for change.
  • Copying. Imitating another player's strategy as a substitute for developing one for your own. Requires similar goals and player attributes in order to work at all, and is dangerous even in those cases. Can also be played as a stand-alone strategy, or, more precisely, as a tactics without a strategy to serve. Depending on whether one or more persons are copied it's either akin to following someone else home after having forgotten one's own address, or randomly following people in a shopping mall hoping to find what you are looking for, without even knowing what you are looking for.
  • Perfectionism. While it sometimes can improve things, it often is just a huge waste of time. (For example, it just made me spend a lot more time onto this posting than I had planned.)
  • Last but certainly not least: Reflection. Helps evaluating the current situation and fine tuning or modifying both strategy and tactics.

One game option that should not go unmentioned at this point is suicide, i.e. a voluntary premature opt-out of the game. I generally wouldn't consider it a good option unless you don't mind missing a significant part of the game, your current game score is already below zero and it's very likely that from that point it will only go further down, or at least stay significantly far below zero for a significantly long time. Of course, "significant" here is a very subjective measure. Suicide certainly doesn't give a positive end result, but I acknowledge that in some situations, the best thing to hope for is to end non-negative. That being said, I personally have the feeling that many people are opting for it too quickly as a fast way to reset their score to zero, rather than trying to go through the negative phase and getting back into the positive region again.


Replay value

What kind of replay options are available depends a lot on the religious system used. In some systems, for example Christianity and Atheism, there is basically no replay possible. Christianity offers a kind of follow-up game though that I haven't tested yet.

Other systems offer replay, either with or without preservation of information. While some players fancy the idea of starting over new while keeping all the information gathered in the first play, I personally think that making up your strategy as you go along is part of the fun of the game.

The alternative is starting over without the gathered information (or simply in an environment where the gathered information is useless, which can be achieved quite effectively by random starting positions and values). The second game would therefore start basically with the same preconditions as the first. While I wouldn't mind another round under these conditions, I don't really see the point.

Rather interesting however is the karma variant, in which the starting position in the next game depends to some extent on the performance in the previous one, making it somewhat similar to card games like Career Poker.

Verdict

Life is an extremely complex game, and figuring out good strategies is in fact one of the most interesting things about it. As with many other games, how much fun you have playing it depends a lot on how you play it and how well you play. Let's face it, Chess is no fun either when you have no idea what's going on, and/or when you throw a tantrum about every lost piece.

Still, there is a lot of randomness and a lot of unbalanced concepts. Even things that follow rules often appear to happen randomly. Don't get me wrong, randomness can very well keep a game interesting, but in this case it's just too much for my taste, especially because there is no effective mechanism to level it out. Also the imbalance between randomly assigned player attributes is just gross.

I very much like the basic idea of the game and most of the time enjoyed playing it so far, but at this stage I'd consider it an early prototype at best.

-- Birgit

Wednesday, December 29, 2010

Circle of Excellence

Man darf gratulieren: Ich bin im Circle of Excellence 2011! :-)

Alle Termine stehen zwar noch nicht fest, aber Mitte Jänner geht es einmal los mit einem Kick Off Meeting, dann zwei Wochen später Peer Meeting, und dann noch ein ganzes Wochenende Team Building. Außerdem soll's im Laufe des Jahres ein paar Workshops und Career Coachings geben, dazu das eine oder andere Business Lunch. Ob's auch Termine mit deutschen Namen geben wird, weiß ich nicht. ;)

lG Birgit

Tuesday, December 28, 2010

Proudly presenting: The Google Content API for Shopping

Many people have been asking me what I was doing at Google this summer, and I couldn't answer for confidentiality reasons.

Now I can.

Proudly presenting: The Google Content API for Shopping

In particular, I was working on the integration of the Content API with the new Google API Client Library for Java, and wrote most of the Content API Developer's Guide for Java, as well as the downloadable sample programs. The latter are basically are a task specific extension to the Google API Client Library for Java, which means that a decently big part of the code I wrote this summer is actually publicly available now (along with all programming sins I might have committed in it).

I also worked on the closely related Search API for Shopping -- the Content API and Search API together are to replace the former Base API --, implementing the search use-case for Google Affiliate Network users.

Everything I did beyond that will have to remain confidential.

Some general information on the two new APIs can be found here and here.

-- Birgit