Dominic Sayers

Mutual societies and apocalyptic events

Back at the dawn of time (2006), I wrote a series of posts to record some things I believed in. These were things I believed without being able to prove they were true - naked belief. I'm happy to say I still hold all these beliefs. Not that I cling to opinions when the facts change - I'm with Keynes on that one. But history has not demonstrated that any of these beliefs are wrong. In fact, history has started to provide some evidence in favour of some of these beliefs.

Mutual societies

Today news emerged of the Dunfermline Building Society's failure as a going concern. I claim this actually reinforces my belief that mutual societies should be some sort of protected species. What went wrong seems to be the the Dunfermline stopped acting in the long-term interests of its members and started behaving as if it had shareholders. Making aggressive commercial loans and approving risky mortgages is not what a mutual society should be doing (unless it's a mutual society of capital markets professionals). So my belief is refined somewhat: mutual societies should be encouraged by (for example) favourable tax legislation but their activities should be constrained by some sort of covenant that members are made aware of when they join.

Apocalyptic internet event

You're mad! was the usual reaction when I tried to persuade the pezzonovanti at my last company that there was a seismic event waiting to happen in the financial services industry. Turns out I was right, but I'm not claiming to have predicted the sub-prime crisis. My event was to do with data security and it hasn't happened yet. But the bots are gathering, and they are being expoited commercially in an ever more sophisticated way. The datapocalypse is coming. Don't say I didn't warn you. There's more than one black swan.

Trying to recover my compromised Hotmail account

[Edited to add: Microsoft Live support resolved this issue very swiftly and professionally. I now have control of my Hotmail account back.] Somebody, let us call him Anthony Ikpe, has hijacked my Hotmail account and sent a begging letter to everybody in my address book. A transparent ruse but apologies to everybody who got this message. Needless to say I am not stuck in West Africa nor do I need an urgent transfer of funds to help get me home. If you would like to send me money then please do so, but don't send it to an address in Nigeria. I don't know how Anthony Ikpe was able to get access to my account, but he has managed to change the password, change the alternate email address and change the challenge-response questions so I cannot get back control of the account by the usual means. My old password was not a strong one, but nor was it an easily-guessable one. I suspect he has somehow spoofed the password reset system, which would be a security issue for Microsoft if it is true. My Hotmail address is the one I publish publicly - the Hotmail account is designed to be the one that gets attacked. My friends, family and colleagues know that it's not the address I normally use. I also use it for buying things online so that the resulting marketing messages don't bother me. However, if I'm in the middle of a buying something it assumes a temporary importance. And I am indeed using my Hotmail account quite heavily at the moment. Or not, as it turns out. Inconvenient then, and I'd like to get it back if possible. And I'd certainly like to stop Mr Ikpe from reading the messages I'm currently getting on that account. So I am trying to contact Microsoft to let them know what has happened and see if anything can be done. Attempt 1 I click on the Help link on the Hotmail home page. Yay! there's a link for "What do I do if I think someone is using my Windows Live ID? ". I click it. It gives me another link to "Report to Microsoft" any suspicious activity. I click it. It leads to a Technet page with another link telling me to fill in a form on this page: Helpful Information for Microsoft Passport Network I click the link. It takes me back to the Hotmail help page. Presumably Microsoft think their customers are so stupid they will continue round this loop for ever without noticing they aren't getting anywhere. Attempt 2 I call Microsoft UK. After patiently navigating their call centre menus, I arrive at the Hotmail options. For billing enquiries please press 1. For all other enquiries please go to http://uk.msn.com My first reaction is Gaaah! But surprisingly there is a form on the MSN site that allows you to report Hotmail security issues. I filled in the form and submitted it. The waiting begins.

More on open source and security

Now Wired and TechDirt have chimed in on the same theme, that voting machines can only be acknowledged to be secure if the source code for their software is publically available. This isn't quite the same as open source, of course. They are not suggesting that the code should be publically changeable. Wired makes the valid point that scrutiny of the source code ought to be (and quite possibly is) a constitutional right. Also I didn't know that Australia had already done this two years ago.

The Economist on open source and security

I haven't yet attempted to support my belief that open source code is the only secure code, it remains a postulate. External support comes not just from Bruce Schneier et alii but this week also from The Economist. Unfortunately the online version of the article is hidden behind a paywall, but if you happen to be a subscriber then check it out here.

It's only a sentence at the end of the article, and I'm not sure the writer has any particular authority on the subject, but hey, it's The Economist :-)

Beliefs (5): Open source code is the only secure code

There is no point in depending on security through obscurity. It is possible to build a secure system even though everybody knows how it works. In this context, I also believe it should be a constitutional right for Americans to be able to see the code for the voting machines that register their electoral votes. If such machines are introduced in my country I will not use one until I have independent assurance that they are fair and secure.

Beliefs (4): There is a substantial risk of a catastrophic internet event

Despite all their investment in perimeter security, major corporate organisations are under a real threat of losing business or even losing their business. The corporate world has built a connected interdependent system that is based on a single technological platform. Anybody who believes that platform is not able to be compromised, or that nobody is interested in doing so, is living in a fantasy world. The evidence is public and the logic is simple.

Climate change

Some simple logic that is causing me to furrow my brow. Please, if you can refute one of my premises or dispute any of my conclusions then let me know. Thinking about Microsoft Windows, Microsoft Internet Explorer and Microsoft Office: (1) Security vulnerabilities continue to be found in these products today (2) Forthcoming releases of these products are subject to the same patches as the current releases THEREFORE (1+2) (A) Unpatched vulnerabilities still exist in current and future versions of these products. Now, (3) Security patches, virus checkers and firewalls protect against known vulnerabilities THEREFORE (A+3) (B) We have no protection against an exploit of an unpatched vulnerability. Furthermore, (4) Microsoft Windows and Microsoft Office have around 100% market share on the corporate desktop (5) Many people and organizations have a financial or political interest in attacking or threatening to attack wealthy corporations. (6) Some of these organizations have substantial resources to mount a sophisticated attack THEREFORE (B+4+5+6) (C) There are organizations planning to attack the corporate desktop using an unpatched vulnerability for financial or political gain. (D) There is considerable risk of a severely damaging attack What is perplexing me is the unwillingness of any corporation I know to do something about this. I am talking about an attack that could threaten the viability of a major global corporation. Top headline on the evening news. Pundits talking domesday scenarios. Some organizations have publicly announced moves to an open source desktop platform (Telstra, City of Munich etc.) but this has always been for cost reasons. Why isn't this the most talked about issue in IT? The only reason I can think of is the analogy with climate change: (a) the threat increases slowly, and there is no natural trigger for action (b) the cost of mitigating the threat is substantial (c) the mitigation is not guaranteed to work (d) the cost is incurred today and the benefit is gained tomorrow or the day after (e) it is boring I want to discuss this some more. Any contributions gratefully received.