Elphaba's Hideaway

Eureka! It's supply and demand, stupid!

2010-07-20T21:21:00.000-07:00

I've been twisting for a very long time over the whole 'vendors should pay for vulns' mantra that has recently been enthusiastically revived by a bunch of independent security researchers who, to the best of my knowledge, have never actually worked for a software vendor to understand the engineering realities of developing enterprise software.

Tonight I realized why vendors don't need to pay a dime, and it has nothing to do with vendors buying silence or two researchers finding the same bug independently and the second researcher going Full Disclosure on the vendor because the first researcher already collected the bounty.

We can all stop debating what a critical remote code execution bug is going to be worth when there is an open market for vulnerabilities. An open market requires competition. And there will not be competition. Who is going to buy Apple bugs? Apple. Microsoft sure as hell isn't going to buy them, not without a whole lot of up close and personal attention from the nice folks at the DOJ. So let's say Apple offers $10 per RCE. Whaddya gonna do about it? Whine? Go sell it to iDefense? YOU CAN DO THAT TODAY.

So simple it makes me giggle that I didn't see it before. Econ101.

~E

We're All Gonna Die Someday

2010-07-04T17:59:00.000-07:00

That title wouldn't typically be associated with optimism. Bear with me here. Lately I have had a number of reminders of my mortality, all in the span of about two months. It has been a bit overwhelming and has forced me to consider how I am living, and what is important to me. The time I have left is shorter than the time I have traveled. The 'how would you live your life if you knew you only had a short amount of time left' theory is popular in movies and books, and even something easy to say you are going to do. It is hard to live though. It is really easy to allow fear to lead you to settle for the known, for something comfortable, something good enough. Fear can make you run, but fear can also make you stand still. I spent 2009 standing still. I was so afraid I would never find what I want, so afraid I had made mistakes, so afraid I would settle, I was too afraid to even try.

I am not afraid of dying. I am afraid of dying with regrets for the things I didn't do, I am afraid of settling for 'good enough'. I don't want to look back in regret on the time I had, and wonder if i wasted it. A tolerable life is not enough. I've thrown my world into total upheaval to find more than that. I want bliss, I want joy, I want growth and new experiences and exploration. I want to see the world, I want to experience all life has to offer. That is going to take time and is almost certainly be a hard road and I can't do it if I am too afraid to go outside and expose myself to it. If I don't get on the road, I'll NEVER get to where I want to go. And where I want to go will be worth it. And that is why I am optimistic. Don't get me wrong, I destabilize a bit every time I get a visceral reminder of the fact that time is moving quickly and there is still a lot left that I want to do with my life. I'm scared I won't get there. But I look with a new respect at what I have, the happiness I have, and find opportunities to experience new things every day. And I owe it to myself to continue actively living my life as best I can to achieve my dreams.

I'm going to get there. And if there is some unforseen tragic accident in which I die tomorrow, it will be knowing that I lived as fully as I could to achieve my dreams.

~Elphie

fanfuckingtastic

2010-07-02T14:25:00.000-07:00

I notice I am swearing a lot lately. A lot more than I used to. It actually makes me a little uncomfortable, and I'm working on cutting back on the F-bombs. But dammit Jim, I'm an analyst, not a linguist, so I broke down my last blogpost and discovered the following things:

ONE:
1,222 words
16 swear words*

that means just 1.3% cussing. That doesn't seem so bad.

TWO:
I copied my last blogpost and pasted it into a Word doc to get the wordcount and GODDAMMIT IE8 SUCKS ASS for not having a spellcheck function. Hello, it's a 2009 product, who keeps cutting this goddamned feature? Why do I have to write my blog in Word so I can have a spellcheck feature and then copy it into the browser? I can't possibly be the only person generating content on the web.

Workaround: Use FireFox. *sigh* I just wish FF didn't crash so damn often.

~Elphie

*douchebag not counted as swearing

(this blogpost contains 3% cussing)

Fuck You, 2009.

2010-06-30T23:09:00.000-07:00

2009 was a bad year.

No, let me rephrase that.

2009 was a totally shitty year.

That might not be an adequate description either.

2009 was without a doubt the hardest and worst year of my entire life, where I saw some of the darkest days I have ever experienced.

I am glad it is over.

I have been thinking a lot lately about writing about 2009. I couldn't write about it at the time, I was all emo and shit, it would have just annoyed you. Hell, it annoyed me so much I quit writing in my journal. I'm not going to go back and dig all that up to spew here. The short rundown is that everything was going sideways on the fasttrack to fucked up, and a lot of it was totally out of my control. My career was totally fucked, I'd gone from working for one awful manager in a totally dysfunctional team to reporting to what could possibly be the most arrogant elitist misogynistic douchebag in the company who wouldn't have hired me and totally changed the job I had been hired to do by my the prior team manager (who I think I only worked for for about a month before he left the team). My personal life was a train wreck, compounded by the fact that I felt completely incompetent by the decaying orbit of my career and the still smouldering crater of my divorce on the personal landscape. I ended up going through a lot of therapy and on anti-anxiety and anti-depressant medications to try and re-set my brain, but the fact that I was depressed and out of control of my neurotransmitters made me feel like a failure - why couldn't I just get happy?

Things started getting better when I quit my job, funny but being unemployed let me get off the anti-anxiety meds. I took five months off and lived off savings while trying to get my shit back together. Today I've got a solid job and I'm proving to myself again that I'm not just a one-trick pony who got lucky and was one of management's darlings for awhile, but truly competent and useful. I've worked through a lot of my personal issues and while I won't lie and pretend everything is exactly how I dreamed it would be, I'm healthy and happy again and have been off the anti-depressants for 2 months now.

So why the hell am I blogging about this at all? Am I looking for pity? To create drama? Send secret passive aggressive messages to people? No on all counts (let's face it, that bit about the misogynist douchebag was hardly passive, and I'd tell him that to his face if I ran into him). I'm writing about this because writing is part of who I am. If you go back and read the blog's history, I write about a lot of things, but there is a thread going through much of it that relates to my personal journey of self-awareness, and my search for happy. And I've been journeying a lot lately, so I expect I'll be spending a fair amount of time here. I don't know if anyone reads this or cares, but writing and publishing it makes me feel better. There are some things I am intensely private about by choice. But a lot of things I have a need to express, because keeping them inside feels shameful when they shouldn't be. And if you want to judge me for my experiences or feelings or the fact that I'm sharing them with the world, fuck you. This is who I am, and I don't need negative energy in my life. You should stop reading my blog.

So 2009 sucked ass. There were times that I wanted to run away and start over - new town, new life, new job, maybe even a new name, new hair, new everything - anything that would make me be anyone but me. Everything was so fucked up, I just wanted to try again, get a second chance to do things right. But that wouldn't have actually fixed anything. I would have just moved all my emotional shit to a new geography. I had to work through it. And working through it SUCKED. There were friends who helped me when I would let them, friends who brought me smoothies when I couldn't eat anything, friends who would talk to me for hours while I cried, hell I even re-established a relationship with my mom, who I hadn't seen in 9 years but ended up talking to near daily. And while I NEVER EVER want another year like 2009, I learned a lot for it and am a healthier person today for having experienced it.

Possibly the most important lesson I learned was to let go of things I can't control. Stress is inefficient and a waste of energy in many cases. Missed your flight? Well, not a whole hell of a lot you can do except rebook and wait. No point getting upset about it, it doesn't change the situation one bit. May as well get a snack and something to read, and settle down in the airport for some people watching. So many things that used to annoy / aggravate / upset / stress me out, they all seem pretty small potatos now. I've returned to my prior state of being a hopeful optimist, but gained the traits of being much more laid back and relaxed in general about things.

Part of learning to let go of things I can't control was understanding that even if I can understand WHY something is the way it is doesn't mean there is a damn thing I can do about it. Life is not an engingeering problem to be solved. I was trying to figure out WHY things were the way they were, thinking if I could measure and quantify that, I could do something to fix it. And the inability to fix things and make myself get better was making me feel like a failure.

But some things can never be understood. And even if they could be, they still aren't things in your power to change. Sometimes you can do everything right, and you still don't get the outcome you wanted due to variables outside of your control. Shit happens. Doesn't mean you failed. In fact, I probably stay in shitty situations too long because I think if I work harder at fixing it I can make things better, but maybe the reality is that THAT is the failure. Failure to recognize the writing on the wall and walk away from an unfixable situation before hitting rock bottom. Dunno. I don't know that I'll ever be able to balance walking away with the feeling that giving up is a sort of personal failure. We'll see.

For now, I'm just thankful I came out of 2009 stronger and healthier, and while I was broken in almost every way concievable during it, it didn't break me forever. I am glad I was able to learn something from all the darkness. I am thankful that 2010 is a better year. And I am thankful for the people I love, and the people who love me. That is enough.

~Elphie

CanSecWest

2010-03-26T23:38:00.000-07:00

Single track, super smart technical content (well, except maybe the idiot from McAfee), high quality attendees... This is a good conference.

Charlie Miller's talk on fuzzing was interesting from an analytic point of view, showing the curve that illustrates the point of diminishing returns for fuzzing and the volume of failures you will have in order to achieve a few successes (exploits). Key take away for vendors: keep fuzzing. A lot. Because if you don't, someone else will.

Pwn2Own was open its usual 3 days but all the exploits were on day 1 again. iPhone was the only phone that was hacked, and three of the four browsers were hacked (IE8, FireFox, Safari). I carry an iPhone, dammit. Thinking about switching from FF to Chrome though. I doubt it is bulletproof, but if no one is targeting it because it's market share is too small, I'm ok taking advantage of that security-through-obscurity for now.

Stupid Boys

2010-03-26T23:13:00.000-07:00

I have a female coworker who is a badass tools developer. And at CanSec not only was it assumed she must not be here for the conference (female), but that she was the shiatsu massage therapist stationed at the con (Asian).

Eventually this retarded attitude at conferences has got to change. There were so many women at CanSec that Dragos ran out of ladies jackets and had to rush order more. Speaking of which, the jackets are pretty awesome. Probably the best con swag I've gotten in my 7 years of attending security conferences.

I get it now

2010-02-21T22:17:00.000-08:00

You seem very well
things look peaceful
I'm not quite as well
I thought you should know

Hurt is easier to swallow than anger. Alanis probably figured she was going to give herself cancer or some shit if she didn't get the rage out somehow.

the things people can't talk about

2010-02-12T19:36:00.000-08:00

It is hard to keep things hidden inside. It is painful and sad and it hurts, because the act of keeping something secret somehow invalidates it, makes it feel dirty and shameful even when it shouldn't be. Whether your hiding it to protect yourself or to protect someone else, the outcome is the same.

When a person hurts inside and they don't want to show it, they form a defensive shell and don't let people in. It is safer that way. They act like everything is fine, like they are bulletproof, like nothing ever bothers them. They project confidence and happiness, and they save their tears for in private where no one can see and suspect they are vulnerable.

And while they protect themselves, they struggle with feeling like they are being artificial, unauthentic, disingenuous. Identity becomes fractured between public and private. They hate who they are becoming but they feel they have no other choice. Who they are and who they present to the world are different things. And eventually this becomes routine, the new normal. Life goes on.

Someday, if they are lucky, the pressure gets released and they find themselves in a time and place with people where they have the opportunity to be themselves with and they don't have to hide (if they have the courage). They don't have to be ashamed. Hermey gets to be the dentist.

Dream Rehab

2010-02-10T21:47:00.000-08:00

I strongly believe in self determination and that you have the ability to make your future what you want it to be. But there isn't a damn thing you can do to change the actions or decisions of other people involved no matter how hard you try. That doesn't make you a failure, just a dreamer who can't see reality. Sometimes things change and you can't see it, you only see what they were and not what they are. It is hard to let go of hope. I have more experience in this area than I'd like. It is hard to accept the death of your dreams. It hurts a lot, and the bigger the hurt the longer it takes to recover. But you move on because there isn't really any other option. As they say in The Shawshank Redemption, "time to get busy livin, or get busy dyin".

Bioethics, meets Sports

2009-09-10T18:42:00.000-07:00

Wow. I'm fascinated to see what comes of the case of Caster Semeyna. She is an 18 year old female who apparently is sterile, as she has internal male testes instead of ovaries. But she apparently also has a uterus. She is dominating her track events because she has massive amounts of testosterone, but is not guilty of steroid use and hasn't broken any competition rules.

So now what? Let her continue to compete against women? Make her compete against men? Don't let her compete at all? She is at an advantage compared to the other women, but is it truly "unfair" if nature made her that way? Is it any more unfair than a swimmer with ridiculously large flipper like feet, or a bicyclist with unusually large heart/lungs?

I'm curious about the chromosomal tests that were run. Regardless, a very interesting situation.

A little birdy told me

2009-08-26T15:42:00.000-07:00

I may, or may not, tweet from time to time.

Secret hopes

2009-08-20T14:54:00.000-07:00

Is it wrong that I secretly hope Michael Jackson staged his death so he can launch the most groundbreaking comeback tour ever? That is the only thing that makes his passing remotely interesting to me. Sorry for his kids and all, but he hasn't been culturally relevant in years. To me, at this point he is just a person like everyone else who died that day.

and your little dog too...

2009-08-16T18:36:00.000-07:00

If the owner of the yapsack outside doesn't do something soon, today might be the day I finally put down Toto.

Microsoft Live has no respect for users privacy choices

2008-12-17T00:21:00.000-08:00

I am a member of a small private blog that discusses matters of a highly personal nature. There are a couple dozen members. The blog was hosted on spaces.live.com, which recently upgraded its services/UI. As part of this upgrade, the ability to comment anonymously on blogposts was removed. Anonymous comments can be abused by spammers, I get that, its why I moderate comments here on the Hideaway. But on a blog with restricted membership I think the threat of spam is about nil. Is having a system intelligent enough to respect user privacy in that situation too much to ask for though? Lemme see… IF blog has restricted membership ALLOW blog owner to SELECT whether or not to allow members to comment anonymously. Yeah, that's some wicked complicated logic. But whatever, new policy moving forward, I can live with that. Sucks as people are less likely to comment and engage in supportive discussion - I know I'll think a little more carefully about what I comment since I am personally identified - but at least I know that going in.

But no, it isn't that easy. Because Live went and applied the policy retroactively so all the anonymous comments posted in the past NOW EXPOSE THE COMMENTER'S NAME. Thankfully the blog owner noticed this and shut the blog down completely. Apparently un-selecting the 'use my profile' box and entering a pseudonym for your comment is entirely unsupported now AND they were tracking commenters identity on the back end anyway, so now with no warning what-so-ever to users, the privacy choice users made to un-select that box has been reversed.

Did I mention I'm pissed off?

I will NEVER, NEVER use a Live blog/mashup/cloud offering again. I'd ditch the email too if I didn't need it for my gamertag. Asstards.

~Elphie

Sex and Technology

2008-08-18T20:59:00.000-07:00

If you've read much of the Hideaway you know I find human behavior and identity to be fascinating. And you know i'm a total nerd. So the geektastic question I am going to address in today's blog entry is why is Cherry 2000 culturally relevant?

Cherry 2000 was a bad 1987 movie that has attained cult status - no doubt helped by semi-regular lustful references to the Cherry 2000 by Crow and Tom Servo on MST3K. Cherry 2000 wasn't the first movie to feature a humanoid sex robot (ok, technically an android), Blade Runner in 1982 had Pris the replicant. But Pris *looked* like a whore.

Cherry 2000 looked like the girl next door, and wasn't just an animated sex doll but the main character's wife-substitute.

When the main character breaks his wife/doll, he puts her personality/memory on a chip and sets out in search of a new body to house 'her'. But being a sentimental human, he wants the same model - not any old female shell to house his beloved memory chip, he wants the exact same doll, because the human has fallen in love with his android and is emotionally attached to both the physical representation of her as a person as well as her 'personality'. (of course the entire movie is set up so he instead abandons his wife/doll in the desert and falls in love with a REAL woman, a pre-Antonio Banderas Melanie Griffith.) But go back a sentence or two, where I talk about how he has fallen in love with the artificial human - THIS is one of the things that makes Cherry 2000 different from Pris or Gigalo Joe (AI). Cherry is loved. She is in a relationship, as much as she can be given that she is property and not programmed to consider independence (or really anything other than subservience) an option. Cherry, Pris and Joe are all designed and programmed to be sex partners for humans, but Cherry 2000 is the only one who is truly owned (the second difference). Pris and Joe are prostitutes, but have freedom to move about in society and choose their partners/activities/home/relationships. Cherry is property. And IMO this makes her far less human than Pris or Joe, despite the fact that she appears to have the more conventional and respectable/stable life. She has no free will, and that makes her less human than the other human substitutes.

So why is the creation of human sex substitutes so common in the future vision? Is it technology for technology's sake? Misogeny run amok? I think it is just that sex is fun, but people are complicated and STD's are a bitch. But if we've evolved enough to create complex human substitutes, shouldn't we have evolved enough to change our attitudes about sex between consenting adults and by and large not need the sex robots? Sure, the hideously ugly or those into really whacked out kinks that they can't find willing partners for would still need/want these dolls, but what would drive a human into the bed of a machine versus a true flesh and blood human offering the same services? Pure skill? (Not to say that skill isn't desirable; after all, Data rocked Lt. Yar's world). If that is the primary criteria for sex android evolution, there damn well better be Joe models and not just Cherry and Pris.

What I hated about Black Hat this year

2008-08-12T10:46:00.000-07:00

I’m on my way home from Black Hat and I have to say, some things have improved since CMP bought the conference a couple years ago. But that is a different blogpost. This is about the things that SUCK now. Like the vendors. Now vendors in and of themselves aren’t so bad when they have technical representation at their booth to talk to con attendees about their products or services. It’s the Booth Bunnies, or in some cases, the Booth Whores, that I find offensive. I’ve gone on record in the past about hating RSA because of the obnoxious marketing overload. I really hope Black Hat isn’t going that direction. I understand that the majority of Black Hat attendees are male, but it is still horribly annoying to watch companies use Cherry 2000 style bimbos try to lure potential customers to their booth based on sex appeal. And the mere fact that booth bunnies exist on the con floor makes it harder to be a woman in this industry and not have the gen pop assume you must be there purely as eye candy.

McAfee had the Security Barbie style booth bunny. I guess to distract you from the fact that their product sucks. I wonder if she comes with the Malibu Beach House.

Cenzic had a Booth Bunny ACROSS the hall from their booth (very sneaky!) stopping people walking by with “are you interested in Web Application Security?” and handing them puzzle pieces you could take to their booth and possibly win a prize. This was really funny, since I was walking with someone who works for one of their competitors (and has better products). As expected, I didn’t win anything. At least she wasn’t dressed up like a tart.

Some company had a Booth Bunny dressed as a Vegas showgirl, which I can at least respect for its theme appropriateness, even if I still hate the Booth Bunny philosophy. She was running different games where people answered questions to win prizes.

The most egregious offender was EdgeOS. When I stopped to snap a picture (and lets be clear, this was the best looking of the three Booth Whores I saw there), one of the guys working the booth asked if I’d gotten an invitation to their Saturday night party. Here is how the conversation went:

EOS Guy: hey, have you gotten an invitation to our party yet?
Me: No.
EOS Guy: you haven’t? how’d that happen? (this was kind of creepy the way he said it)
Me: probably because I didn’t stop by your booth to chat up your booth bunnies for one.
EOS Guy: they aren’t booth bunnies.
Me: no? when they wear pleather they aren’t called booth bunnies anymore?
EOS Guy: no, they’re booth babes (hands me invitation to party)
Me: whatever you call them, they make it harder to be a woman in this industry. (walks away)

You might think calling them Booth Whores is a bit harsh and judgmental. Maybe Goth Booth Bunnies is more sensitive. But this was the most direct sexual marketing I’ve seen at a non-sex industry conference, and if you get paid to dress like that, stick party invitations in your bra, and leverage sexual energy to get geek boys to stop at the booth of your temporary employer, I’d say you are selling your body for profit. AKA whoring.

Anyway, I assume the pleather girls were on display at the EdgeOS party, I don’t know for sure because I didn’t go. If I had, I’d have been the bitchy attendee who just spent the evening giving the hosts and their pleather clad prickteases shit all night, and I didn’t want to waste my time on that even if they were buying the drinks.

Just in case there is some confusion let me be clear: I have no problem with pleather, fetish wear, or pretty girls. That isn’t what I’m complaining about. When vendors bring in booth bunnies it perpetuates the stereotype that the women at cons are not there for the con itself. I have a problem with the fact that every conference I attend, at least one person assumes I must be marketing, PR, or sales. All of those fields are useful and I respect the marketing, PR, and sales people where I work. The problem is that people assume I am something I am not based on my gender. They assume I can’t possibly do anything technical or relevant to their work because I’m female. And that fucking pisses me off. Let me repeat: It isn’t that I don’t respect marketing professionals, its that I get pissed at the discrimination and bias. I understand that guys are surprised I’m a geek, that I game, that I quote sci-fi movies and know what Do Androids Dream of Electric Sheep led to. I understand that compared to the average woman you might meet in the mall or coffee shop, I’m an anomoly. But at a security conference, why WOULDN’T I be just like everyone else there?

Other things I hated:
Dan Kaminsky getting a pwnie. Black Hat overhyped his talk in a frenzy of media whoredom, then he got kicked in the balls by being awarded the most overhyped talk pwnie. He worked his ass off on this issue, did all the right things to try and protect people, and instead of earning the respect he deserved, he got made fun of.

Smells Like Teen Spirit transitioning to Saturday Night Fever. FAIL

French press sniffing creds

Snacktime crowds clogging the halls, making movement impossible

Talks that span 2 hours. I don’t want to commit 2 hours to one talk. C’mon people, tighten it up. There are too many interesting things to see to put all my eggs in one basket for 2 talks. By having a 2 hour talk you are not competing with 4 other tracks, you are competing with 8.

Not enough time or space to talk with everyone I wanted to. The size of Black Hat is a blessing and a curse. You see everyone in one place, where you might only see half as many people you want to at a smaller con. But everyone is circulating so there isn’t time for talking with any one person very much. There are a great many people I wish I’d had time to sit down and talk with more.

What I liked about Black Hat this year

2008-08-12T10:27:00.000-07:00

THE TALKS!!
Dan Kaminsky’s It's The End of the Cache As We Know It. (come on, you know you can't help thinking 'And I Feel Fine' after reading that) Standing room only, Dan’s grandma’s session cookies, talk content, speaker energy, enthusiasm. I <3 Dan. If I could adopt a big brother, it would be Dan.

Bruce Potter’s talk on Net Flow analysis. Super interesting, well presented.

Mark Dowd and Alexander Sotirov’s talk on Bypassing Windows Vista Memory Protections. They’re wicked smaht.

LT. Col. Greg Conti’s talk on visual forensics analysis - I am a sucker for visual representation of any data...

Christopher Hoff's Four Horsemen of the Virtualizaton Security Apocolypse.

I know, my review of the talks is pretty light here, but I don't have to write a trip report for the general public so quitcherbitchen. If you're so interested, you should have gone to the talks yourself.

THE OTHER STUFF
Registration check in lines are sooooo much better than in years past, more lines, move faster, yay. But having a separate line to get your delegate bag is a bit inefficient for attendees.

Box lunch option. Now if only they’d offer a ‘no lunch’ ticket. I don’t even care if it costs the same as a ‘with lunch’ registration. I never eat at the con, whether it’s a box lunch or plated meal. I feel bad wasting the food.

Overall, compared to when I first started attending Black Hat many years ago, the con feels more professional. Talks start and end pretty much on time, I didn’t see any real AV difficulties, logistically things seemed pretty smooth. Awwww, Black Hat is growing up!

Lobster and crab dumpling things, sushi, and sliders at a vendor party. Best party food all week.

The conference continues to grow and mature. I’m excited to see that, big conferences are a great initiation ground for new security professionals who may not know about or understand yet the value of smaller cons like ShmooCon or Toorcon, and a great ‘reunion’ spot for people who may talk via IM/Twitter/Facebook/MySpace/IRC/email/whatever all the time but only see each other IRL a few times a year at cons. But the size of Black Hat is a blessing and a curse. You see everyone in one place, where you might only see half as many people you want to at a smaller con. But everyone is circulating so there isn’t time for talking with any one person very much.

Wall of Sheep. A DefCon staple, nice to see it at Black Hat too. Baaaaaaaaa.

Not really about Black Hat, but a Vegas thing: there is now one cab company that takes credit cards in Vegas. w00t. I hate carrying cash.

$32K raised for EFF between Black Hat and Defcon. nice.

Several people arranged hotel suite Rock Band parties in the evenings. That is awesome. !..!,

See y’all again in 2009. Wouldn’t miss it.

The bitch is back

2008-08-12T10:21:00.000-07:00

The majority of the last year of my life has been kind of fucked up, during which time I stopped blogging. I'm not saying it's unfucked yet, just that I'm getting used to the chaos and am making an effort to return to the blog. It will take me a few days to get the Hideaway in order and clean up properly for visitors, so I hope you'll check back in soon.

updates. finally.

2007-11-01T14:32:00.000-07:00

conference calendar updated, and the blogroll. I know, I've been ignoring you for a few months. But David Litchfield is blogging now. I figured that alone was worth a post.

Device warns you if you're boring or irritating

2007-06-06T21:32:00.000-07:00

Wouldn't a gadget that warned you when you were being boring help you in your social interactions with others? Then you wouldn't have to rely on your own faulty human perception. Kind of like a Garmin for the navigationally challenged.

heh, so any thoughts on who should get one? Could make conferences a lot more tolerable...

~Elphie

w00t

2007-05-23T14:26:00.000-07:00

Another new conference in the fold. WOOT, the Workshop On Offensive Technology is launching this summer in conjunction with USENIX. While WOOT sounds extremely cool and the advisory panel is made up of uber smart people, having six conferences on three continents in August makes for some serious competition for top speakers as well as attendee dollars. WOOT is invite only though, so they might win on leet factor.

Don't count Jeff Moss out though - looks like he is planning 8 (that's right, EIGHT) tracks at Black Hat Vegas this summer. So their cfp must be doing pretty well if they can project that much content with a straight face...

~Elphie

Do no evil. Unless its really profitable.

2007-05-23T09:34:00.000-07:00

OEM's have long been known to install craplets that frustrate and annoy end users in order to beef up their razor thin hardware margins. These craplets are difficult to remove and generally not well tested or certified by (insert OS developer here), which leads to the potential for them to introduce security vulnerabilities. But now Google has teamed up with Dell to create Yet Another Miserable User Experience.

GOOG - for shame. You have forsaken users for your own avarice.

~Elphie

words of wisdom from the Frag Dolls

2007-05-08T08:55:00.000-07:00

A couple weekends ago I was playing an online game with some friends (hi Vyxxen and Strix!) and we got to chatting about being a girl gamer. One of my friends had just that evening been chatted up by another player, and things started innocently enough. But before she knew it, he was describing himself and asking her for a description of herself, asking if she was hot, etc. This sucks for a girl. There you are, having fun in a game, chatting with someone who you might be able to trade items with or help out on a quest, and next thing you know he is telling you he has great pecs and likes rockclimbing. If you aren't interested in enabling the world of one-hand-typers, yet want to be friendly and not piss someone off who might trash talk you as a bitch in forums and the game, how do you politely get out of this discussion? Really, if you know, please tell me! I don't feel like I should have to pretend to be a guy online to avoid this sort of thing.

Valkerie over at the Frag Dolls has some words of wisdom, but they are more for the guys than helping the girls out of this situation. Check out The Top 10 Most UNORIGINAL Things You Can Say to a Girl Gamer.

~Elphie

"virtual" online gambling safe... for now.

2007-04-19T16:22:00.000-07:00

First, let me make it clear that I never intended to be a Second Life blogger. I've never even played Second Life. But when I look at my tags and see just how many Second Life posts I've made, well, I've got to face facts. I've become a SL blogger. SL is just so perfectly hedonistic, such a funny little experiment of human interaction and behavior in a technical environment, how could I resist? Here you have a place where people can be the person they want to be, not the person they are. They can do the socially unacceptable - they could run down the virtual street virtually naked and still go to work the next day. So how DO people behave when you minimize or eliminate consequences? Hm, maybe I should go visit SL just to peoplewatch... I'm such a voyeur.

Anyhow, I recently read that the Feds visited Second Life to check out the gambling. Of course online gambling is illegal in most states of the USA, but people are gambling on SL and winning REAL money. For some reason though, that's ok. For now.

Honestly, I think everyone (including the Feds) knows that 'virtual' gambling with real money is still gambling, and is therefore illegal. But if the Feds decide to take that position, how can they police it, aside from taking SL off the net?

"...Linden Lab could potentially face criminal charges under the 1970 Illegal Gambling Business Act or the Unlawful Internet Gambling Enforcement Act. The latter law, passed last year, takes aim at credit card companies and other electronic funds transfers that enable Internet gambling."

..."Linden Lab's rules prohibit illegal activity.

"It's not always clear to us whether a 3-D simulation of a casino is the same thing as a casino, legally speaking, and it's not clear to the law enforcement authorities we have asked," Yoon* said.

Even if the law were clear, he said the company would have no way to monitor or prevent gambling in Second Life."

*Ginsu Yoon, until recently Linden Lab's general counsel and currently vice president for business affairs

And if online gambling is illegal in SL, what about the prostitution? Sure, I know, the prostitution in SL is also virtual, no bodily fluids exchanged, just some one handed typing. It's about as dangerous as renting porn or watching pay-per-view sex webcams. But that is changing too. Technology continues to evolve, thanks to human ingenuity (and the fact that hardware doesn't complain about your leaving the toilet seat up/down). There is a growing field I can't type without laughing, you'll just have to read about it here. But as products like this are developed (Note: that link is NOT safe for work), and a virtual prostitute and virtual John can push keyboard buttons to stimulate each other's bodies in reality, where does that fall in the definition of netsex and prostitution?

As always, many questions, few answers. Except 42. I've got that answer.

~Elphie

Why anonymity is necessary

2007-04-19T15:39:00.000-07:00

Because in some parts of the world, dissenting opinions can get you put in prison.

From the New York Times:

...Yahoo has come under particularly sharp criticism. Human rights groups say that Yahoo has helped identify at least four people, including the journalist Shi Tao in 2004, who have since been imprisoned for voicing dissent in cyberspace.

In other parts of the world, you can lose your job. oh wait, that's right here... If you are hard core about protecting your anonymity, here are a few tips from the EFF.

~Elphie

Con Calendar updated

2007-04-10T22:15:00.000-07:00

I took some time tonight to update the conference calendar - LOTS of interesting new stuff. IT Underground is going to Dublin... London is getting yet another confab that looks to have good potential, it will be interesting to see what overlap (if any) the Black and White Ball will have with EUSecWest and UnCon. BAD ELPHIE, I didn't get HITB Dubai on the list until after the event, my deepest apologies to the HITB crew (not that any of them read this, but still...) The third CONfidence happens in Krakow Poland in May. Perhaps most interesting is the new conference in Asia, VNSeCon in Ho Chi Minh City, Vietnam. VIET-freaking-Nam! That's awesome. We're everywhere.

When I have time I'm going to try to create a section for some of the smaller meet-up events like ChiSec, BeanSec, Atlanta's SIP, etc. But no time for that this week.

Did I miss an event? Let me know!

~Elphie

RFID Guardian

2007-04-10T22:14:00.000-07:00

This isn't super new, but I just ran across it last week. Pretty interesting, if you are paranoid about RFID security like I am.

The RFID Guardian Project is a collaborative project focused upon providing security and privacy in Radio Frequency Identification (RFID) systems. The goals of our project are to:
Investigate the security and privacy threats faced by RFID systems
Design and implement real solutions against these threats
Investigate the associated technological and legal issues
The namesake of our project is the RFID Guardian: a mobile battery-powered device that offers personal RFID security and privacy management. One the focuses of our project is to build an RFID Guardian prototype.

Our group also performed the first-ever research on RFID Malware.

~Elphie

AAAAAAAAARGH!!

2007-04-09T13:54:00.000-07:00

From the headlines... Bloggers call for a code of manners? Call for an end to anonymous commenting? (remember, people think anonymity is the enemy here)

I agree, bloggers should be able to delete comments from their blogs without facing accusations of censorship - IF the comments are offensive or pure flame-bait without merit. Censorship happens when you delete comments that merely disagree with you. I don't think rampant comment censorship is spawning the Blog Civility movement though.

I'm with Scoble, the proposed 'code of manners' is not something I'm willing to sign on for. Not because I'm pro-harassment, but because I'm anti-regulation, and the crazy social pressure that is resulting from it. What's more, I'm not willing to post their stupid 'Anything Goes' logo on my site, because that suggests that I recognize their program's legitimacy in policing the manners of the blogosphere. Bullshit. And yes, Mr. O'Reilly, I'd be willing to say that to you in person.

Bloggers are not so freaking special that they need a code of manners to govern their conduct. Civility cannot be regulated into existence. What we need is some basic courtesy in the world. Disagreements are disagreements. You don't post photos of the people you dislike in violent or sexually explicit ways, you don't drag their families into it, you don't make threats. Grow up people. It's called the Golden Rule. Check it out.

annoyed,
~Elphie

Welcome to First Life

2007-03-30T09:20:00.000-07:00

I've posted a couple times now about Second Life. So I've got to show you the funniest parody I've seen. "First Life is a 3D analog world where server lag does not exist". Check it out for an end of week chuckle.

~Elphie

Weekend geekery

2007-03-30T08:25:00.000-07:00

I pre-ordered the LOTRO MMO game and will be click/slash/looting my way through middle earth this weekend. w00t!

~E

ShmooCon rawks!

2007-03-29T14:44:00.000-07:00

ShmooCon 2007 is over, and what an awesome conference! There is just too much good stuff and not enough time. The talks were great, the networking in the halls was wonderful and usually led to deeper intellecutal discussions over coffee/lunch/dinner. The conference is well organized (well, a slight hiccup delayed registration a bit but not too bad overall) and as always, the parties were fun. Even the weather was fantastic. It is such a solid conference, I can't do justice to it in words. Suffice to say I'll be back again next year for sure. Snaps to the Shmoo Group for another great year.

~E

not everyone who owns a ski mask is a criminal

2007-03-29T11:13:00.000-07:00

ok, so that is a ridiculous blog title. but it illustrates the dangerous oversimplification we tend to fall into when discussing societal issues.

Mike Rothman says anonymity is for cowards. To borrow a quote, I call bullshit on that. Anonymity is nothing more than a technique to promote privacy and safety. Do cowards use it to threaten and intimidate others? Yes. Do criminals use it to carry out illegal action? Yes. But that doesn't make everyone who tries to protect their privacy a coward or a criminal. People have a right to share their opinions without advertising their personal information to the world. Many people don't want their personal opinions to be misquoted or presented as if they are officially representing their employer – should they be forced to stay out of the public discussion of a topic as a result? Anonymity has often been used by people who fear retribution from those who disagree or disapprove of their statements or philosophies. All these people deserve anonymity and to not be called cowardly.

Being anonymous is a choice, one that becomes even more attractive when you see what has happened to Kathy Sierra. If she blogged anonymously, she might not feel in as much danger as she does now. Am I blaming her? Absolutely not. She has a right to speak her mind openly without being threatened and abused, and the people who have harassed her should be held accountable. I can't imagine being in her position, I'd be terrified out of my mind. But that is one of the reasons that I try to retain some anonymity.

The Kathy Sierra situation has ignited the blogosphere in a way that HD Moore and his new tool Torment haven't. Earlier this month HD announced a rough set of tools that allows anyone operating a Tor server to attempt to track the source of network data. Moore's goal in creating the tool was to track criminals such as child pornographers, and he says he plans to turn the tools over to law enforcement to use. Can his tool be mis-used and the personal privacy of legitimate Tor users be compromised? Yes, sort of. (read the entire article to see some of the limitations of the tool). Is everyone who uses Tor a criminal? No, that is not what anyone is saying here - and if you are, then shame on you for oversimplifying a complex social issue.

Until we establish a utopian nirvana where anyone can trust everyone, and honest disagreements don't result in retribution/bloodshed, there will always be a need for anonymity. The key is to find ways to work together to protect innocent users while making it possible to catch and stop the people who have figured out how to leverage anonymity and privacy tools for criminal or abusive purposes.

~Elphie

A message from your friends at the Institute of Self Determination

2007-03-15T21:41:00.000-07:00

- Do you feel like you lack control over your schedule?
- Have you had to cancel things in your personal life with short notice due to last minute business travel?
- Are you burnt out on conferences?
- Have you delivered presentations to low priority audiences in the middle of nowhere?

If you answered yes to at least two of the questions above, you might be asking how this happened to you and what you can do about it. You might be hoping leet haxors broke into your scheduling application to send you off to Boise at a moment's notice - you can simply rebuild your box and do a better job defending it in the future. But unfortunately, you my friend are victim to something far more nefarious. You are pwned by PR.

Our experts at the Institute of Self Determination have developed several strategies to cope with situations like this. Many of our clients lack the ability to simply tell their PR department NO to that next business trip. They don't want to look like an ass or be the bad guy. Or maybe they are not in a power position to say no without losing their job. Here are our four most popular self-help programs:

1. Cloning - send your replicants out to do the speaking engagements you don't want to do. This has become more difficult since villainsupply.com went out of business. They were by far the most reputable of the Evil Villain cabals that thumbed their noses at political ramifications of scientific experiments on humans. Of course there are rumors that villainsupply has merely gone deeper underground to protect their plots for world domination. Unfortunately we cannot confirm or deny this rumor or we'd have to kill you later. Our clients have to find their own cloning firm, but once they do we'll help them train and store their replicants as well as deal with the psychological trauma of losing their sense of individuality.

2. Teflon - PR requests slide off you onto someone else. We can help you develop a strategy to find, mentor, and train a flock of lackeys to send off in your place the next time a travel request comes your way. Why be randomized yourself, when you can delegate that randomization to someone else?

3. White lies - the sick parent/pet excuse. While weak, sometimes it is just easier to feign personal obligations that require you to stay home. We can help you craft a believable story that isn't so complicated you screw it up and get caught. Note that this is just a temporary solution to the pwnership problem to buy you a reprieve.

4. Acceptance - the final stage of grieving. If none of the above options work for you, we can counsel you on ways to accept your PR biatch status. Lets face it, unless you use your spine, become utterly incompetent or quit your job, PR will keep pimping you out. It will be easier on you if you learn to accept your Media Whore situation and quit fighting it.

The Institute of Self Determination is accredited in multiple temporal dimensions, provides services worldwide, and offers a variety of payment plan options. Don't let your PR department push you around any more! Contact the Institute of Self Determination and start down the road towards a more self-determined life today!

++++++++++++++++

hee hee hee. This is for a friend. He knows who he is.

~Elphie

Happy Pi Day

2007-03-14T09:40:00.000-07:00

It only comes once a year, what are you doing to celebrate?

http://www.piday.org/

Me, I'm having pie.

~Elphie

Justice Department, internet surveillance, and security theater...

2007-03-08T15:58:00.000-08:00

Last week I read that the Bush administration has accelerated its Internet surveillance push by proposing that Web sites must keep records of who uploads photographs or videos in case police determine the content is illegal and choose to investigate.

First, there are serious privacy concerns here. To be clear, I am all for catching criminals, I just don't like the idea of this info being datamined under the very broad auspices of the Patriot Act. Think I'm paranoid?

Often invoking terrorism and child pornography as justifications, the administration has argued that Internet providers must install backdoors for surveillance and has called for routers to be redesigned for easier eavesdropping.

yeah, there is a reason I don't fully trust our government. Plus, most web businesses already have healthy data retention policies and have a strong track record of responding to subpoenas from law enforcement.

But I also feel like it is a no brainer to say this is little more than security theater, something that will inconvenience honest folks, and potentially invade their privacy and civil rights. Yes, some bad people will go to jail for child porn. But only those who don't do their porn uploads from a university or public library. That's right, the proposal excludes them. Why? Because they are safe already from such things? Because they already do user logging of uploads? no.

"There's a PR concern with including the libraries, so we're not going to include them," the participant quoted the Justice Department as saying. "We know we're going to get a pushback, so we're not going to do that."

That's right, too much pushback. So we won't do it.

If it isn't an important enough issue to force in libraries, why are we even discussing the issue anywhere else? Either it is important, or it isn't. Pick one.

~Elphie

Techno Firefly Video

2007-03-08T09:17:00.000-08:00

This morning I found this on YouTube. I think it ROCKS. If you haven't seen Firefly you might not get as much out of it though.

Wonder if I can find it with higher quality video somewhere... the special effects in the original footage are awesome but suffer in this format...

~Elphie

A retraction

2007-03-08T09:11:00.000-08:00

In my last post I asked Adam (the Emergent Chaos bandleader) to set up trackbacks on their blog. Why? because I'm lazy. I had no idea that 99% of the trackbacks they used to get were spam; I can see why they disabled them. Moderating that mess takes way more time than my crossposting occasionally, so I withdraw my request on the grounds that it is just too selfish even for me.

Damn spammers.

~E

Does Social Engineering = Fraud?

2007-03-06T21:45:00.000-08:00

With all the conference blogging I've been doing lately, I haven't blogged about something I read in February that I've been thinking a fair amount about. Mordaxus over at Emergent Chaos made a compelling argument to get rid of cutesy names for attacks like pharming, phishing, pretexting as they are exclusionary jargon that prevent people from understanding the issues at hand. Overall I totally agree with him on the exclusionary jargon ban, though I will miss saying w00t.

However, something in the post has been occupying my thoughts for some time now (obviously), and my consternation gets worse every time I hear another person toss out 'social engineering = fraud' with disdain and disgust, like only an uneducated plebe would use the term social engineering anymore.

Social engineering != fraud all of the time. Sometimes fraud is just fraud, like counterfeiting currency. And sometimes social engineering is just social engineering, like dressing nicely, smiling sincerely, and treating the ticketing agent like a human being so you stand out from the masses of annoying and frustrated travelers as a Nice Person That Should Be Upgraded To A Premium Seat Without Having To Ask. That isn't fraud, that is understanding something about psychology and sociology that you apply in human interactions to help yourself come out ahead. Social engineering is a concept, a practice if you will, that can be used for malicious purposes, but in and of itself does not require lying, misleading, deception or fraud!

So I would suggest that saying 'social engineering is a con job' is an oversimplification that contributes to shallow thought by the masses. Like calling all of these populations:

- people who find security vulnerabilities and report them
- people who write POC code
- people who reverse engineer security patches
- people who write/release worms
- people who steal your credit card number and passwords via keystroke loggers and a botnet

'hackers'.

Too much jargon and exclusionary language is bad, but so is oversimplification. Should people be afraid of botherders? yes. Do they need to fear and revile security researchers? no. Well, not all of them anyway. (ha ha, it's a joke people)

~Elphie

(Adam, it would be super if you were able to hook up trackbacks on EC so I don't feel the compulsion to crosspost a comment on your blog to my own so it appears in both places. you know, with all your free time.)

On deck... Security Opus

2007-03-05T14:53:00.000-08:00

Black Hat Fed and EUSecWest are done, so the next big con coming up is Security Opus. Though to be honest, everyone I know is talking about ShmooCon. The Security Opus speaker agenda is decent - you know anything with Window Snyder has to be rad - but as far as conferences go it just isn't as big or as affordable as Shmoo. The Shmoo schedule and speaker list is now posted (though I'm told there is at least one more talk that is going to be added) and it looks like a great con. As usual, I always plan to attend way more talks than I actually make it to. Should be hella fun. And I have to say that the Shmoo organizers are fracking geniuses. That's right, once again they are wise enough to schedule the first speakers at 10am. Thank you, ShmooCon organizers, for recognizing that no one attending ShmooCon goes to sleep at a 'reasonable' hour.

Don't have a ticket for ShmooCon? There were a few on eBay this morning...

~Elphie
unofficial ShmooCon fangirl

Monster Names

2007-03-05T14:51:00.000-08:00

Get Your Monster Name

Responsibility runs both ways

2007-02-28T11:34:00.000-08:00

If you read Emergent Chaos (and if you don't, you need to add it to your reading list right now) you've already seen that the RFID talk Chris Paget was scheduled to deliver at Black Hat Federal is back on.

Apparently HID doesn't have a Webster's dictionary, because they now claim they didn't demand that the talk be pulled.

"HID Global did not threaten IOActive or Chris Paget, its Director of Research and Development, to stop its presentation at the Black Hat event being held in Washington, DC on Wednesday, February 28, 2007."

and

"Under no circumstance has HID asked IOActive or Mr. Paget to cancel their presentation. In fact, we were surprised by their decision to cancel the presentation and to attribute the cancellation to a threat from HID. This was not, and never was, HID’s position."

*cough* *cough* bullshit *cough*

You can read the entire letter HID sent here, but here are a couple snippets:

We understand … that you intend to publicly present and publish additional information about your spoofer at the Black Hat convention … We believe such presentation will subject you to further liability …

…hereby demand that you refrain from publishing any information at any public forum including the upcoming Black Hat convention…

that sounds like a demand/threat to me...

Anyway, this is all very interesting but it is distracting us from the real issue of responsibility. I personally believe that researchers have a responsibility to work with vendors to resolve security issues in a way that protects customers. But I also believe that vendors have a responsibility too, a responsibility to make sure that they are doing everything they can to stay on top of known vulnerabilities in their products, provide customers with workarounds and mitigations, and ultimately create more secure products. RFID vulnerabilities have been publicly known since 2005, Paget's presentation is not really NEW (even Jeff Moss calls it "largely a rehash of known issues, intended more as an introduction").

And remember, HID claims “cloning is simply not a credible threat”.

Long ago (in a galaxy far, far away) the only way to get vendors to fix security problems was to report them publicly and shame them into a fix. Today, vendors (most of them anyway) try to work with researchers to fix vulnerabilities and protect their customers. What keeps me up at night after events like this is the fear that more vendors will choose to ignore vulnerabilities and try to strong arm researchers into silence about the flaws in their products, and that will be used to further justify full disclosure. I don't want to live in a world where only way to get a vulnerability fixed is to drop it anonymously to a mailing list and hope the good guys fix it before the bad guys leverage it.

yearning for utopia,
~Elphie

Black Hat Federal this week

2007-02-26T10:59:00.000-08:00

If I were there, I'd definitely make a point of seeing Jose Nazario and Ollie Whitehouse. Both are delivering fairly new talks on the con circuit, and look like interesting stuff. If you catch either of the talks, let me know what you think?

Also, if you haven't heard already about the Chris Paget talk that has been withdrawn from the conference, go read this now. Then go make a donation to the ACLU for being the good guys.

Y'all know I'm a big supporter of responsible disclosure, but when I read things like this, I have to shake my head and wonder what the vendor is thinking.

"These systems are installed all over the place. It's not just HID, but lots of companies, and there hasn't been a problem. Now we've got a person who's saying let's get publicity for our company and show everyone how to do it, and it puts everyone at risk. Where's the sense of responsibility?" Carroll said.

Yes, where is the sense of responsibility? Such as HID's responsiblity for delivering on their promise of a security solution to customers? Does HID deserve an opportunity to work with researchers to fix their security problems and protect customers? Absolutely. But these vulnerabilities have been widely known for over a year, and until now have been pooh-poohed by HID.

She [Kathleen Carroll, a spokeswoman for HID's Government Relations group] said that the company has long been aware that its proximity cards are vulnerable to hacking but does not believe that the cards are as vulnerable as Paget suggests.

"For someone to be able to surreptitiously read a card, they'd have to get within two or three inches and get into the same plane as the card," Carroll said.

HID is also concerned that Paget's demonstration will popularize the vulnerabilities in its proximity cards and endanger its many customers.

You can't have it both ways. Either you don't take it seriously as something to fix (in which case a conference talk is no real threat), or you do take it seriously and would have developed some sort of strategy or plan to solve the problem. Make up your mind.

Asked why HID hasn't addressed the issue in more recent proximity card systems, after knowledge of RFID threats became common, Carroll said that doing so would cause "major upheaval" among customers.

oh yeah, because their customers are really just shopping for a bit of security theater; something that keeps the lamer criminals out. I'm sure they would rather have a physical security system that can be trivially compromised by a skilled/motivated attacker using publicly known vulns than do what it takes to actually have a secure physical security system...

bah. makes me cranky.

~Elphie

Muppet Matrix

2007-02-15T11:54:00.000-08:00

Yes, its the unholy alliance of the Muppets and The Matrix. Three ITT Tech (Louisville KY) students made this video for their 3-D graphics rendering course. Good stuff: Agent Smith, Neo, Cipher. Not so good stuff: Miss Piggy's ears are a bit long and make her look a more rabbitish than porcine. And I know that Miss Piggy is the sole female in the primary Muppets cast, but there is something just fundamentally wrong with putting her in Trinity's vinyl catsuit.

As always, Beaker is my hero.

~Elphie

Updated the con calendar...

2007-02-05T20:49:00.000-08:00

okay, so I think I got most of the conferences for the first half of 2007 updated... DAMN there is a lot going on in February-March-April! You'll notice that I don't discriminate, small regional cons (notacon, carolinacon, outerz0ne) all the way up to big events (Black Hat, RSA) are listed. If you're a semi-professional con spaker with a fresh and interesting topic, you can stay pretty busy if you like to travel.

~Elphie

ShmooCon is uber1337

2007-02-01T11:45:00.000-08:00

Didn't I tell you that ShmooCon would sell out quickly? Turns out that as I was posting this, they were just 60 seconds away from being sold out. Over 300 tickets gone in a little over 13 minutes, and this based purely on con reputation - the speaker list isn't even public yet! Congratulations to the ShmooCon team for putting together such a kick-ass event, I can't wait to see what they have in store for us this year.

~Elphie

conferences...

2007-02-01T09:12:00.000-08:00

ok, so I'll make an effort to do a better job keeping the conference calendar up to date in 2007. promise.

For those of you who don't already have tickets to ShmooCon in late March, you better get on the ball. The last lot went on sale about 15 minutes ago and I expect will sell out quickly. Naturally I didn't post this until I had my tickets purchased and confirmed. heh. See you there.

~Elphie

In memoriam: James Kim, 1971-2006

2006-12-06T14:08:00.000-08:00

Today is a very sad day in the tech community. Words are inadequate to express my sorrow and sympathy for the Kim family.

heartbroken,

~Elphie

more freaky prophylaxis

2006-12-04T21:02:00.000-08:00

Thanks to a Hideaway reader for pointing out this rather disturbing prophylaxis option that I hadn't heard about yet... if the men's birth control pill doesn't work for you, try the spray on condom from Germany. That's right, a spray on condom. Stop action, pull out your aerosol bottle, spray it on, wait for it to solidify, and resume activities. That's right, solidify. It's kind of like Magic Shell for your wee (not Wii). I'm kind of curious how you remove it since it has been sprayed on and formed a seal with the skin. Not curious enough to volunteer as a product tester though.

But if you prefer to push prophylaxis to the XX member of your coupling, China has released a condom in a can for femmes to the market. I guess technically it isn't spray ON, but you get the idea. NO IDEA whatsoever how you remove that when you're done... The company promotes using it daily - I sure hope they did some medical testing of that; it really doesn't seem like a good idea to me to be applying a physical membrane to your innards on a daily basis.

Public health is important, and new developments that give people more options to prevent unwanted pregnancy and sexually transmitted diseases is a very good thing. But you really have to wonder what the hell product developers are thinking sometimes. New discoveries are interesting, but new discoveries people can/will actually use are worth their weight in platinum.

~Elphie

science for science sake?

2006-11-28T20:38:00.000-08:00

Scientists are developing a birth control pill for men. This single dose, hormone-free drug would prevent the ejaculation of sperm. This isn't something men would have to remember to take every day like women do, but they do have to plan ahead enough to take it "a few hours before having sex".

The pill, a single dose taken a few hours before having sex, affects contraction of the muscles that control ejaculation, but wouldn't interfere with performance or orgasm sensation, researchers at King's College London say. The result is a dry ejaculation.

yeeaaaah. A dry ejaculation may sound great if you're the one who always has to sleep on the wet spot on the sheets, but otherwise it doesn't sound all that pleasant. I suppose this might be something a couple might choose to do. Maybe. But the woman better be damn sure he really took it and took it at the right time. Sure, unwanted pregnancy is something guys want to avoid, but not quite as much as women want to avoid it. The chicken and the pig both contribute to breakfast, but the pig has a much more vested stake in the whole operation. (not tracking on the metaphor? hint: men=chickens, women=pigs).

Unfortunately, the only population I can see this drug really taking off with is rapists who don't want to leave DNA evidence behind, and aren't so considerate as to protect their victims from STDs with a condom. There's a cheery thought now, hmmm?

alas, I expect that this feminist liberating bit of scientific discovery will in practice, go nowhere. hurrah for scientific exploration though! perhaps in 10 (50?) years what we learn from this research will be put to some amazing and super important use...

~Elphie

time folds

2006-11-22T21:34:00.000-08:00

I swear that it feels like just a few days since I posted last. But somehow 22 days have passed. Must have been a fold in the space-time continuum and I skipped ahead.

Just two marginally interesting thoughts today:

HD Moore and the Metasploit kids are teh shiznit. How cool must it be to be so l33t, your ideas are copied not just once but twice?

The three people who planned ahead and stood in line for the Wii release at Target, who got one of the 69 guaranteed boxes, and then after all that gave up and released their Wii's to the first three alternates - WHAT THE HELL IS WRONG WITH YOU? Are you that fickle and addle-brained that after all that, you changed your mind? Are you so stupid that you didn't realize what you were in line for? I didn't see the alternates offer you a bribe or payoff... You people scare me more than the freaks who gave up their jobs to sit outside a Best Buy for four days to get the PS3. They are losers. You 3 Wii-nies are random and unpredictable - and therefore potentially dangerous. psychos.

Have a happy TOSgiving. Just remember: don't OD on tryptophan and then drive. And for gods sake, if you make a turducken, I don't want to hear about it. Its just a freakishly wrong abomination of foodstuffs that illustrates the excesses of modern American culture.

~Elphie

Happy Halloween!

2006-10-31T09:10:00.000-08:00

May your cauldron never run dry!

And while I'm making Halloween wishes... May the curses of a thousand angry warlocks, shamen, and witch doctors be rained down on the heads of the politicians who have their automated recordings calling my house at all times of day and leaving stupid messages on my answering machine. Curses also on the survey takers who call trying to find out who I'm voting for. Seriously. Six calls a day plus all the damn junk mail they are filling my recycle bin with - its just too much. There needs to be a political 'don't call' list where you can proactively make it known that your mind is already made up and there is no point in their wasting time or resources contacting you about their campaign. Just a week more of this harassment...

~Elphie

Oh DOJ, what have you done?

2006-10-30T15:31:00.000-08:00

Remember the time when the internet was no holds barred, take no prisoners competitive? A time when dot.coms flourished or failed, when pets had a place to shop (because pets can't drive!), and 10 foot tall e's were left on Netscape's front lawn to help motivate their employees to develop the best browser they could?

Alas, we are in a kinder, gentler era now. The IE team sends Mozilla a cake to congratulate them on the relase of Firefox 2. A cake. How is such friendly competition supposed to instill indignant anger in the FF development team? This must be a brilliant tactic by the borg to demotivate Mozilla employees by disarming them with kindness... that's just as plausible as there being a message in the sequence of the black/white frosting blobs...

I say to you Mozilla developers, rise up in your cubicles and shout in anger at those Redmond rascals who only coughed up the budget to send you a quarter sheet cake that will only feed a small fraction of your numbers. They didn't even send ice cream. What good is cake without ice cream?!? By the gods, the only thing more insulting would have been if they'd sent you a dozen cupcakes. Get back to your keyboards and code with the fury of those who have been scorned!

hahahahaha
~Elphie

cake photo source: http://fredericiana.com/2006/10/24/from-redmond-with-love/

More reasons to love autumn...

2006-10-30T14:12:00.000-08:00

and for Tony to call me a geek.

1. Punkin Chunkin. Lets be clear, if you get drunk and destroy pumpkins by using them for target practice with your shotgun, that's redneck. If you take the time to build a trebuchet to launch your pumpkins vast distances and watch them explode upon impact with the ground, that's geeky. Sure, compressed air cannons are widely used for squash launching, but I prefer the trebuchet for artillery larger than my fist (maybe some other time I'll tell you all about my potato launcher and we can debate the combustible properties of Right Guard vs. Aqua Net).

You don't have to live in Delaware to enjoy Punkin Chunkin, you can find pumpkin launching in most rural areas, often at U-Pick pumpkin patches. Recognizing the lucrative business in tourist attractions like corn mazes, the pumpkin farmers have found a new way to sell their crop. After all, you may only buy one or two pumpkins for jack-o-lanters, but I bet you'll buy 8 or 10 just to see how far they'll shoot.

2. Pumpkin Bowling. This is fun for all ages. Of course adults often find it more fun when liquor is involved, just be sure your scorekeeper is relatively sober and immune to bribery by the other teams. You need a few smallish pumpkins, something you can palm fairly well and more or less spherical in shape. You don't want to use 10-16 pound pumpkins; you aren't going to be drilling finger holes in them (some websites recommend this, but it makes the game a lot messier, and beer bottles are slippery when you've got pumpkin guts on your hands). You'll also need 5-10 water bottles for pins (some people use empty 2-liter bottles filled with sand, but that's a lot more effort). I recommend playing on the lawn; you can play on concrete but you go through a lot more pumpkins that way. It's more fun than it sounds, and dorky shoes are completely optional.

Yes, I've done both. And no, I haven't gone cow tipping. Despite what you may have seen on Heathers, it takes more than two people to tip a cow. Do you realize how heavy cows are?

Happy Halloweenie

~Elphie

pumpkin trebuchet photo source: http://orca.bcnewsgroup.com/gallery/pumpkinfling/PB020875

A culinary experiment

2006-10-23T12:14:00.000-07:00

This weekend I made Mudder's Milk, following the recipe found on the official Serenity movie website. Look under Shepherd Book in the Flash website for the cookbook if you're curious how (or why) Tigers Milk bars, oatmeal, sarsaparilla, root beer, and YooHoo are combined to make anything remotely edible. And if you've ever mixed up this recipe and have test results of your own to share, please let me know.

I took the concoction with me to a party Saturday, to wish some fellow Browncoats safe travels as they are moving cross-country this week. Quite a few partygoers imbibed - both Browncoats and those who've never flown the Firefly 'verse - and said it was good. I don't think they were just being polite, since they actually drank it all from their cups. A few folks added Kahlua and had a second cup. I my optimism improved seeing this; based on the smell and knowing what went into it I'd expected it to be utterly foul. So I poured myself a glass (yeah, I used my friends as test subjects to sample it before I tried it).

Test results: my friends are either devoid of tastebuds, kwong-juh duh (nuts), or both.

Seriously, I thought this swill was horrific. It was probably the pepperminty aftertaste that killed it for me. I took one sip and dumped mine out. I'm a big Firefly fan, but that was just too much. Then again, if I'm the only one grossed out, maybe I'm the insane one. Maybe it was just the worst possible chaser for the ultra-yummy brownie I'd just eaten. Whatever, I don't expect I'll make it again, except maybe as a joke if we are going to a sci-fi themed party.

~Elphie

Chevron seven... (b)locked

2006-10-19T15:16:00.000-07:00

Legos. SG-1. The Goa'uld wish they were this cool.

Check out the blocky chappa'ai. Its a replicators dream.

~Elphie

IE7 Released today

2006-10-18T19:29:00.000-07:00

go download it, fool.

http://www.microsoft.com/windows/ie/default.mspx

~Elphie

distracting the audience

2006-10-18T19:10:00.000-07:00

While misdirecting the audience's attention works well in magic shows, I don't think "forget how much we suck, these other people suck worse. really." is a terribly effective PR strategy. But what do I know, I'm not a marketing expert.

"As you might imagine, we are upset at Windows for not being more hardy against such viruses, and even more upset with ourselves for not catching it," Apple said on its site.

The chutzpa does make me laugh though. After all, your immune system really should be stronger to fight the SARS I brought into your home when you invited me to dinner last week. I bet you don't even take vitamin C. You're bringing illness on yourself really. You should seek psychiatric help, you're obviously suffering from Munchausen Syndrome.

I've said it before and I'll say it again, I like Apple, but they are kidding themselves if they really believe that they are superior when it comes to security. Based on what I've seen in the world, I'd say EVERYONE sucks. Hell, if a critical system like electronic voting boxes can't be locked down, what chances does a commercial app have?

~Elphie

Daily Show Geeks for sale

2006-10-09T20:44:00.000-07:00

if you chuckle at John Hodgman selling himself as the nerdy (but lovable!) PC in the Mac ad campaign, and you enjoy the Trendspotting segments on The Daily Show, you'll probably enjoy Clearification. It is by far the strangest marketing I've ever seen from Microsoft. Not that I'm saying its a bad thing. Microsoft's ads generally suck ass. This is kind of funny, even if it is random and off the wall. Enjoy.

~Elphie

All God's creatures, fresh off the grill...

2006-09-25T09:11:00.000-07:00

come on down to Mr.Meaty, where friends meet to eat meat.

I thought Mr.Meaty was pretty funny, in a juvenile, Beavis & Butthead sort of way. The franchise manager in the Buffalo Burrito episode cracks me up. Nickelodeon did a good job (along with Mr. Meaty creators) to pick the first 2 episodes. Buffalo Burrito focused on the store and introduces the manager & owner, while the second episode was more mall focused - the girls who hang out there and the saleslady at Pantosphere make their debut as Parkerina tries to find out 'why the ladies are hatin' on the Josh'. Just one unresolved question: why is a 1/4 Seagull w/ fries on the seafood menu? Seems more like a poultry entree to me. hah!

Of course the REALLY interesting thing about this show is how the public has reacted. There are vegetarian groups petitioning Nickelodeon to pull the show. I'm guessing they didn't even watch it first. If anything, the show makes fast food seem even grosser; it certainly didn't encourage me to go out to eat at my local mall food court. Mr. Meaty is about two teenage boys who have a typical teenage job - working at a fast food restaurant. While I respect the protesters right to peacefully assemble, I think they are being a bit ridiculous.

And while on the topic of fast food... why is it that a McDonald's cheeseburger is $0.99 but a double cheeseburger is only a penny more on the $1 menu? Is the meat really that cheap? Are buns and pickles more expensive than I thought? Is the profit margin on the single cheeseburger insanely high, while the double is being sold at a loss?

Even more mind boggling, a double cheeseburger weighs in at 460 calories, while two single cheeseburgers are 620 (and would cost you an extra $0.98). There are 160 calories in the extra bun, pickles, and condiments? That would mean that the meat and cheese in a double cheeseburger is just 300 calories - the same as a grande Caffè Mocha(no whip) from Starbucks. yikes.

~Elphie

being an early adopter

2006-09-22T14:07:00.000-07:00

yeah, check it out, two blog posts on the same day. where are the porcine aviators?

I have a bit of an elitist geek thing going on with my television watching habits. Often I ride the early wave of a show that ultimately becomes uber popular (X-Files, Crocodile Hunter, Mythbusters, Junkyard Wars, CSI, Battlestar Galactica) and can later feel superior to the masses because I 'called it' and watched the very first episodes before the water cooler buzz got going and made it popular. But sometimes it sucks when a show you fall in love with doesn't get renewed for a second season (Firefly, Freaks & Geeks, John Doe, Conquest). And of course it also sucks when a show that rocks becomes so popular that it starts sucking as the network start interferings more and more (Junkyard Wars) or they start running out of plot (X-Files, Stargate SG-1)

So here are my predictions for the new season based on years of being an early adopter of cool television:

My big bet: Nickelodeon is about to debut a show that will fill the same niche that Ren & Stimpy, Crank Yankers, and Space Ghost have filled. Tonight is the first episode of a puppet based program called Mr. Meaty. Its interesting to note that as with so many of the really great offbeat shows, this isn't produced in the USA. I've only seen the previews on TV, but I've got Tivo fired up to record it. I guess I'll know tomorrow if I'm right on this. But if parents in Canada are trying to get the show banned, it can't be all bad. heh.

Eureka is a new SciFi original that appeals to the geek in all of us - the premise is that there is a secret town in the USA (called Eureka) where all the scientific geniuses live and do their research. As with all scientific research, things sometimes go BOOM in the lab. The technology is creatively visionary like Star Trek used to be, and who wouldn't like to live in a place where its cool to be ridiculously smart? Its fun to watch, and SciFi isn't under the pressure the big basic cable networks are to produce big winners so it might be on the air long enough to pick up a reasonable following. You should start watching if you aren't already. Just don't trust the redhead.

I've seen a couple episodes of Standoff, and it isn't bad. It stars Ron Livingston (Office Space) and Gina Torres (Firefly) so I have to admit to being kind of biased. It is all about crisis negotiators, and has real promise if they can manage to keep the stories interesting - it has high risk of becoming repetitive, and just because Law & Order can stay alive for 16 years of the same thing every week, doesn't mean this will.

Not a new show but a new season, Survivor 13 is edgy, dividing tribes along ethnic lines was pretty risky. But I have found it to be a fascinating social experiment. The only tribe to not feel pressure to perform well to represent their entire race? The Caucasians (Raro). The only tribe (so far) to throw a challenge to kick 1 of their 5 team members off? The Latinos (Aitu). The strongest, most cohesive, and hottest tribe? The Asians (Puka). All in all the first two episodes have been pretty interesting; this Survivor rises above the typical boring high school style angst with this new cultural-bonding twist so you know a human nature and personal identity student like me can't resist watching.

Other shows I am watching and look forward to seeing develop over the next few episodes: Jericho, Shark, Heroes, and Kidnapped (I liked the first episode & think it is good, but success depends in part on audience saturation - competition is the established Without a Trace and the new Vanished, a conspiracy filled show which can't seem to decide if it is about OC style drama, politics, or kidnapping).

So go set your Tivo for some new shows and let me know what you think.

~Elphie

Happy Autumn

2006-09-22T13:23:00.000-07:00

Tonight is the Autumnal Equinox. huzzah. I love autumn. The crispness in the air invokes a Pavlovian reaction in me. I've always loved fall. Growing up I loved the sense of newness and anticipation of a new school year - yeah, I was a smarty-pants academic geek. So why was I looking forward to another year of being reminded daily that I wasn't one of the popular kids? All I can say is that sometimes when it appears that someone is running towards a cliff, they are actually running away from the herd of stampeeding buffalo.

Now that I'm older, the excitement and anticipation of fall remain, but for all different reasons. I love the crispness in the air, the clear blue fall sky, the leafpeeping, the autumn fashion (sweaters! boots! tweed!), the holidays (having social justification to wear costumes out of the house RULES)... I always overspend in the fall, my seasonal enthusiasm translates into retail recklessness as I refresh my closet and kitchen with warm comforts that exude a sense of family. Never will you see placemats and fabric napkins on my table but in the fall. I don't do spring cleaning, I do fall cleaning. And most of my culinary adventures are in autumn - I make amazing butternut squash bisque, moroccan roast lamb, beef vegetable stew, and roast carrots.

Winter is fine, I love Christmastime almost as much as the turn of summer to fall. And you can't beat the eggnog lattes. :) Spring is okay, summer is nice, but no season positively affects my mood like the fall does.

So I hope you are having a lovely last day of summer, and are looking forward to autumn as much as I am.

~Elphie

a sheila in mourning

2006-09-05T16:08:00.000-07:00

Today after a long weekend away from all devices that transmit news and current events, I was deeply saddened to learn of the death of Steve "Crocodile Hunter" Irwin. I've been watching Croc Hunter since his first episode (1992) of tracking, capturing, and relocating rogue crocs in the backwaters of Australia with his dog Sui. Before he was famous, he was just the crazy Aussie guy who jumped on the back of crocs and talked about conservation. So when I read that Steve was killed in a freak snorkling accident by a sting ray, I took it pretty personally. I feel terrible for him and his family. What a terrible way to die. And what a reminder that life is precious, and temporary. If the sting ray had struck six inches away, he might have hit Steve's arm or belly with his stinger - not a direct hit to the heart.

While I weep for the Irwin family (Steve leaves behind his wife Terri, daughter Bindi and son Bob), one can only be thankful that Steve appears to have led a full and exciting life, and had the opportunity to share his love of nature with so many people around the world. At the time of this blogging, the Australia Zoo website is inaccessible, probably inadverdantly DoS'ed by all the fans visiting the site to mourn Steve's passing.

S'long Steve, you'll be missed.

~Elphie

Slanket Store is open again...

2006-08-11T10:40:00.000-07:00

I mentioned the Slanket before, when it was sold out. But they're back. w00t.

~E

It was a beautiful day, the sun beat down...

2006-07-27T20:15:00.000-07:00

...I had the radio on, I was drivin'

On a recent day when the weather was gorgeous I was passed on the freeway by a couple motorcycles. The thought that immediately ran through my head was: "I should learn to ride a motorcycle, that looks like a lot of fun on a day like today."

I'm not talking some anemic Vespa or I'm-overcompensating-for-something chopper. Elphie is all about agility and would be in the market for something sleeker, say a Ducati. I've got over a dozen friends who ride motorcycles, so the social support network is already in place. There are many winding country roads that are bike friendly. And hey, it's another excuse to buy leather clothes.

But it only took about 10 seconds of seriously thinking about taking lessons before I remembered why I don't already know how to ride a motorcycle.

I'm afraid of speed.

Perhaps more accurately, I'm a control freak and in most cases speed feels out of control to me. No, the cruising speed of an airplane or driving 90 mph on a stretch of deserted desert highway doesn't faze me at all. But you'll never find me on a roller coaster, skydiving, or riding a motorcycle. At least, not without a significant amount of valium in my system. Think horse tranquilizer quantities.

So I should just get a convertible and put the top down on beautiful sunny days. If you'd like to contribute to the convertible fund (or just flat out get me one) you'll always get shotgun... (Let's just ignore the fact that there aren't any passenger seats in a coupe other than shotgun so you can just feel special about getting to sit next to me while we fly down the highway or cruise through the city on a sunny day.)

~Elphie

quitcherbitchen

2006-07-08T23:58:00.000-07:00

The life of an international chinchilla smuggler is not always easy or predictable. Sometimes I am just too busy flitting through the seedy underworld of exotic pet trade to expatriate my furry leetle amigos and dodging customs agents to blog much. Its not like I can just FedEx them to their new homes around the world - though we all know I'd never use FedEx, they have no sense of humor.

While offline and transporting cargo, I am reading The Presentation of Self in Everyday Life. If I'm going to mither on about identity here on the Hideaway, I should probably do a bit of organized reading on the topic. Surely there will be more soul-searching posts once I'm done feeding my brain.

In the meantime, a lot of interesting stuff has happened in the world. Dan Kaminsky has an interesting article about Net Neutrality on ComputerWorld that I highly recommend reading. Once you've read that, check out Adam Shostack's thoughts on how net neutrality impacts innovation. Adam, if you get someone to make chocolate toothpaste, I will soooooo buy some. HD Moore has announced July as the Month of Browser Bugs, I guess it is like the Year of the Dog for software. HD is a smart guy, and while I'm quite sure he is looking at all browsers, it does appear that Microsoft might have pissed him off a bit recently... whoops. surely unintentional, seeing as they've invited him to speak at not one but two of their hoity-toity BlueHat events...

There was something else interesting but I've temporarily forgotten what it was, and I've got to get back to the chinchillas. Another time...

~Elphie

IE interview

2006-06-20T15:39:00.000-07:00

Window Snyder of Matasano posted an interview of IE Lead Program Manager Christopher Vaughan on their blog today - its a worthwhile read, so I'm not going to bother paraphrasing. Check it out yourself!

~Elphie

I Do Not Want What I Have Not Got. (Really?)

2006-06-14T08:08:00.000-07:00

Did Sinead O’Connor reach the pinnacle of human existence where she truly does not want what she has not got, or is she just in self denial and living in holier-than-thou martyrdom? I suppose there is a possible middle ground, she is a total and complete sellout, writing something to tug at the heartstrings just to sell albums... :) Regardless, I don’t know ANYONE who doesn’t want SOMETHING that they don’t currently have. There is a reason lust and greed are two of the seven deadly sins, and ‘thou shalt not covet’ is in the 10 commandments. People have wanted things that they don’t possess for as long as there have been people.

I’m not talking just about physical desire/lust, though that is obviously one form of wanting. I’m talking about the basic premise of wanting. Wanting in and of itself isn’t bad. I want world peace – which is not a bad thing to want. But no one’s appetites stop at altruism (even mine), and what people want isn’t always materialistic. Wanting to be a leader in your community/church/office, wanting killer abs, wanting to screw around with that hot guy/girl you met at BlahLocation – we are a species born and raised to want what we have not got. And what we want is tied directly back to our self-identity (or identities).

I believe that there are two kinds of wanting. Routine desire for things you don’t have is pretty normal. The problem is when you take a look around your life and realize maybe all the things you’ve accomplished – while what you wanted at one point in your life – are no longer things you are interested in. Not just that you have the Audi A4 and really want the A8, but that you have the Audi A4 and instead want a Harley Davidson. This is a nice big highway billboard sign of impending identity crisis 50 miles ahead, do not miss, not for the squeamish or depressed, something you just don't want to miss.

So now the things you want out of life (family, freedom, career, possessions, etc) are so completely different from the things you have, you can’t figure out what to do about it. Do you give up everything you have and start over, or do you find the peppermint schnapps the Claus's didn't share with Rudy & Hermey and continue to live the life you previously bought into?

Ultimately though, wanting is still being driven by identity, not the reverse. And identity is so much more than just your social security number/name/credit rating. We display who we are to the outside world through our appearance, our belongings, our behavior. But the essence of who we are is something much harder to pin down, measure, or quantify - even to ourselves. In the words of the ancient Greeks:

Know thyself
The unexamined life is not worth living

But the road of self inquiry is not an easy one to navigate, and isn't necessarily a joy ride. Some get lost. Others turn back. Some run off the road into a ravine and perish. Some never leave home to begin with, preferring to stick with the comfortable routine they know than explore the unknown because change is scary and stressful. There is a significant amount of discomfort in realizing your life itches like an ill-fitting suit you’ve outgrown, and as you shed your old skin, the new you coming out is something else entirely.

Life is a process of becoming, a combination of states we have to go through. Where people fail is that they wish to elect a state and remain in it. This is a kind of death.
~Anais Nin, "Winter of Artifice"
"All the world's a stage And all the men and women merely players; They have their exits and their entrances, And one man in his time plays many parts"
~William Shakespeare, "As You Like It"

As a student of human nature, I find the whole topic of identity fascinating. But unlike Anais and William, I am not convinced that everyone needs to travel a lifelong path of self examination to change states, or to reconcile their various personas, or uncover some repressed or hidden true self. There are people who are so comfortable in their current skin that they are exactly who they appear - to everyone. Family, friends, strangers and co-workers all know one person, who knows themselves and most importantly is happy with who they are. I'm not sure if I actually know any of these people, but I'm sure they must exist. :) I think I need to do more international travel and spend more time embedded in foreign cultures around the world. I'm sure there are very different identity paradigms to learn about and explore than those in the western cultures I've been raised in.

~Elphie

Sex in Videogames Conference

2006-06-13T09:53:00.000-07:00

Wish I'd known about the First Annual Sex in Videogames Conference ahead of time... I'd have taken some time off work to personally attend. Maybe next year since the conference agenda topics look pretty interesting from a sociological perspective.

The Sex in Video Games Conference: Exploring the Business of Digital Erotic Entertainment. This unique conference will focus on the design, development, and technology of sex in video games from a national as well as international perspective. In addition, this conference will also have a strong focus on business matchmaking and networking. During the conference's two day run, it will feature numerous lectures and keynotes, a machinima art show (erotic art and movies derived from video games) as well as panel discussions with leaders in video game and adult video game development.

If, like me, you didn't attend this conference, Wired has an interesting writeup on one of the panels and the focus on how to make pornographic videogames into a viable business, what some of the barriers are to success (porn is usually low investment/high profit, while game development is high investment, pre-existing notions of what is adult entertainment) etc.

The Friday keynote sounds like it might have been pretty interesting.

Sheri Graner Ray has been announced as the keynote for Friday, June 9.
Ms. Graner Ray is an accomplished game designer with 16 years experience in the video game industry and is the author of “Gender Inclusive Game Design: Expanding the Market.” She will be speaking on how to make adult games that appeal to women, using her research on creating games that appeal to women to specifically discuss what women would want to see within the adult game space.
According to Brenda Brathwaite, Game Designer and Chairperson of the Sex in Video Games Conference, “everyone knows Sheri as the expert on gender issues in video games. I'm really looking forward to how she applies that body of knowledge to adult games. The same lessons she teaches mainstream developers will apply to adult content developers, too. Who doesn't want a bigger audience?”
Suzanne Freyjadis-Chuberka, President of Evergreen Events, agrees that, “Sheri Graner Ray is a well respected authority on the issues of what attracts women to games and her insight into this area will be invaluable for developers of adult oriented games."

IMO one of the main reasons to have a diverse workforce in the field of software development (not just sex games but any application) is so you are designing and developing products that will appeal to and be usable by a diverse customer base. It isn't about affirmative action, it is about creating the best product for the broadest audience.

~Elphie

In the immortal words of Pete Townshend, ‘Who are you?”

2006-06-13T08:21:00.000-07:00

Before continuing yesterday's post about identity, I want to point out something tangentially related to virtual identities that amuses me. I've written before about Second Life, and how I don't get the attraction (outside of financial gain). Guess what - I'm not the only one who doesn't get it. Chris Pirillo has a funny blog post about his first Second Life experience - I laughed out loud reading it. Chris is no dummy when it comes to computers, so the fact that he ended up with a box on his head is extra amusing to me.

Ok, so back to identity. I've been talking with a few friends about this topic for months now, and while the discussion has been fascinating (to me at least), I am not claiming to offer any revolutionary new answers or insights on the topic.

So why do people end up with multiple identities (and I'm not talking about clinical schizophrenia)? Several months ago I had a conversation with a friend about not underestimating people’s personas based on what you see in public. I asserted that some people are exactly who they appear. They are comfortable in their skin, in their identity. Conservative or freak, they are exactly who they seem to be. But not everyone can do that. For starters, society would have a hard time functioning if everyone ignored decorum and rules and said and did whatever they felt like. So while it feels unnatural to be this conflicted and have a personality different from the veneer you show the world, it is often necessary.

Let’s face it, if Hermey had wanted to be a plastic surgeon instead of a dentist, he and Rudolph could have avoided their whole journey with Yukon Cornelius and the Island of Misfit Toys. Rudolph was different due to evolution or (as his father and other reindeer thought) a birth defect. The other reindeer shunned him even though his being different was completely out of his control. Hermey was a more egregious offender to society’s working order: he CHOSE to pursue a deviant career path from his peers. He wasn’t born a dentist, he had the nerve to choose that path instead of testing rubber duckies or whatever else the elf-master made him do in the little-people sweatshop. Either way, Rudolph and Hermey couldn’t fit in with North Pole society (though I’m thinking if Mr. & Mrs. Claus had been a little more liberal in sharing their peppermint schnapps they could have dulled their independent identities enough to make a go of it) so they struck out on their own. While the North Pole society depicted is a bit simplistic in its monoculture, the basic premise isn’t all that different from reality.

At a very basic level we push deviants to the fringes, underground, and that allows the rest of us to feel normal and safe. People are generally uncomfortable with things they don’t understand. So for a lot of people it is easier to mold themselves to fit in even if it isn’t who they are. It is a peculiarity of human society around the world that is started in our childhood as kids take sides and ostracize the ‘different’ kids, so we learn early in life to fit in. Later in adolescence even the 'non-conformists' (emo, goth, mod, punk, whatever) really do conform to one another – they listen to the right music, wear the right clothing to fit in with their tribe. Because isolation isn’t safe. If you are isolated from your tribe and get injured or have a bad season hunting you could die. It isn’t so drastic today because you can just go to the grocery store, but the basic premise of survival of the fittest comes back into play.

So what happens next is an interesting twist - identity drives materialism. People want things because they want to fit in. People in Miami don’t want the best pickup truck on the block like people in Topeka do, because it doesn’t help them fit into their tribe. Rudolph wanted a ‘normal nose’, because he wanted to fit in. You could argue that is a sign he is a weak person, er, deer, because he didn’t have the chutzpa to be himself – even if that meant being different. It isn’t easy to be on the outside looking in (as anyone who was unpopular in high school can tell you) but when even your parents don't understand or accept you for who you are, well, that increases the pressure to fit in tremendously.

next: I Do Not Want What I Have Not Got. (Really?)

~Elphie

The competition for internet domination continues...

2006-06-12T16:13:00.000-07:00

Google or MySpace? Who is your money on for internet overlord? (and for chuckles, who do you think has better security?)

In the red corner... Google is moving to compete with eBay with an online auction offering that sports the spectacularly innovative name 'GBuy'. (yes, that was sarcasm) If not successful, I forsee a plethora of 'g'bye' jokes in their future. If it is successful, maybe the next new Video Professor title will be Introduction to GBuy (sorry, but I think the fact that there was demand for a class on how to use eBay is the saddest thing I've ever heard. It's eBay people. How hard is it?)

And in the blue corner... MySpace is trying to attract the LinkedIn and Monster.com crowd by adding MySpace Careers. This isn't necessarily a terrible idea... for those compelled to publicly display their popularity and social connectivity by creating accounts on MySpace, Friendster, and LinkedIn, this could be a chance to merge multiple online identities, cut down on accounts and passwords to remember and manage.

On the other hand, for people who don't want their personal and professional lives to bleed into one another, this isn't really any help at all. More and more recruiters and hiring managers are looking up job candidates online (both in MySpace and through your garden variety googlestalking) and using the information learned in their candidate profiles and interviews. Which if you've maintained a wholly professional online profile isn't a problem. But if you and your college buddies put up pictures of your latest keg party and get comments on your profile from the girls you partied with this weekend about what a stud you are, you might not want the general manager for one of the big 5 accounting firms you just applied at seeing you extra, uhm, happy, out at the club with your posse and getting the impression you're just a party animal boozer who is going to be late due to hangovers on a regular basis. And it isn't just the party animals that worry about identifying their personal lives to potential employers. Use your personal blog to connect with other members of your spiritual community? Discuss your kids latest adventures and your wish to adopt more kids from overseas? All personal details that aren't relevant to a job, but can still color someone's impression of you as a job candidate.

As always, the topic of identity interests me. Personal, professional, public, private. How can one effectively firewall their personal and professional identities? How do you handle things when your worlds collide? And what happens if your personal identity is best kept anonymous from family, neighbors and employers, but some of the people in your personal circle are also in your professional circle? Sure, a lot of people on planet earth only have one identity and the idea of having more than one is shocking and alien to them, something only a criminal would do. But many people have found that it is easier to fit into mainstream society if they isolate their personal pursuits from their employer, colleagues, and customers. You'd be amazed how many doctors and lawyers are swingers or into BDSM. Yes, your mild mannered dermatologist might like getting freaky on the weekends in leather and submission games, and you'd never guess it.

Obviously it is challenging when your personal and professional relationships start overlapping, and even harder when some of those identities cross the public/private barrier. Thus the need for pseudonyms, to help protect personal identity - and not just in the online world, this happens every day in 'real' life too. But how many identities are too many to have? How to you truly maintain anonymity if needed in one or more? And what happens when you start to have an identity crisis, unsure which one is the real you, which one takes priority over the others? I have friends struggling with this very issue every day, mediating internal debates between conflicting personas that are chafing at co-existing and resisting a life of eternal compromise. All outstanding future discussion topics for the blog seeing as this didn't start off as a post about identity but about new internet properties from two of the big internet players on the scene today. :)

Coming soon: In the immortal words of Pete Townshend, ‘Who are you?”

~Elphie

Black Hat Vegas Speaker Schedule Posted!!

2006-06-03T22:56:00.000-07:00

Check it out - looks like an awesome lineup. Very impressive...

~Elphie

new meaning for 'soda fountain'

2006-06-03T22:10:00.000-07:00

Can't make it to Black Hat Vegas this year (lamer)? Cheer yourself up a bit by watching this outstanding abuse of carbonated beverages - you can pretend its the fountain show at the Bellagio.

Thanks D for the url. Very funny stuff.

~Elphie

Fun stuff for a Friday

2006-06-02T20:50:00.000-07:00

Far more portable and office appropriate than my potato cannon (if you saw it, you'd understand why it isn't just a potato 'gun'), this paper clip trebuchet is a fun diversion and doesn't require as much investment in propellant and ammo.

Wired News compiled a list of the 10 worst engineering mistakes. There are no software engineering mistakes on the list - it is made up of civil, mechanical, industrial, and some electrical engineering. Surprisingly, Galloping Gertie didn't make the list.

Insider trading at Google is spiking in May. Wonder what that means.

~Elphie

Internet mental health index

2006-05-30T21:06:00.000-07:00

From a pure geek perspective this is one of the coolest things I've seen on the internet lately.

Since August 2005, We Feel Fine has been harvesting human feelings from a large number of weblogs. Blog data comes from a variety of online sources, including LiveJournal, MSN Spaces, MySpace, Blogger, Flickr, Technorati, Feedster, Ice Rocket, and Google. Every few minutes, the system searches the world's newly posted blog entries for occurrences of the phrases "I feel" and "I am feeling". When it finds such a phrase, it records the full sentence, up to the period, and identifies the "feeling" expressed in that sentence (e.g. sad, happy, depressed, etc.). Because blogs are structured in largely standard ways, the age, gender, and geographical location of the author can often be extracted and saved along with the sentence, as can the local weather conditions at the time the sentence was written. All of this information is saved.

Pretty neat technology, eh? As a result of the We Feel Fine project, one is reminded that there are likely a number of other people around the world who feel the same way you do - something often forgotten in monocultures and regional/demographic sub-cultures of multi-cultural populations. If urban Americans and rural Chinese share some of the same experiences and emotions, maybe that means that on the micro-societal level the goths and the jocks really aren't that different underneath the eyeliner and jerseys? We could have cats and dogs living together before you know it as we break down the stereotypes that separate us and start building relationships on our shared human experience!

Unfortunately, before we all break out into song and belt out a verse of "I'd Like to Teach the World to Sing", there is inevitably a downside to this. I'm a bit freaked out by the privacy aspect of such a massive data collection endeavor.

Because a high percentage of all blogs are hosted by one of several large blogging companies (Blogger, MySpace, MSN Spaces, LiveJournal, etc), the URL format of many blog posts can be used to extract the username of the post's author. Given the author's username, we can automatically traverse the given blogging site to find that user's profile page. From the profile page, we can often extract the age, gender, country, state, and city of the blog's owner. Given the country, state, and city, we can then retrieve the local weather conditions for that city at the time the post was written. We extract and save as much of this information as we can, along with the post.

They also save any photo associated with the post. I'm suddenly having second (well, okay, third) thoughts about blogging at all. If nothing else now I've got an F word I'll do my best to avoid using here in the future.

~Elphie

Back from blogcation

2006-05-27T23:14:00.000-07:00

tan, rested, and ready to resume blogging...

Someone anonymously submitted a comment to my recent posting about game consoles that pointed to this article about MSN's George Foreman strategy for naming. Instead of approving the comment where it would be buried in a post, I'm making it our featured topic for today (hey, its my first day back, cut me some slack). I'm assuming this is another entry in the 'unfortunate name' category because I picked on Nintendo's Wii (if you play with it too much I've heard that you'll grow hair on the palms of your hands). While a valid example, it's just too easy to pick on MSN. I mean really, this is the group responsible for the iLoo.

That said, the unfortunate-name-game is fun. What else ya got? Don't just restrict yourself to computer technology. Think globally, but do your research first so you don't look like a retard - the Chevy Nova is just an urban legend.

~Elphie

By the way, out of respect for my reader's privacy and valuable time (creating throwaway anonymous gmail accounts takes time) I've changed the blog settings so you don't have to register with Blogger to make a comment. But to cut down on spam I do still moderate comments.

Diebold backdoor a "feature"

2006-05-17T19:32:00.000-07:00

Backdoor Found in Diebold Voting Machines (actually, three backdoors - read the article.) The part I find most eligible for blog fodder is this:

A Diebold spokesman did not dispute Hursti's findings, but said that Black Box Voting was making too much of the matter because the systems are intended to remain in the hands of trusted election officials.

"What they're proposing as a vulnerability is actually a functionality of the system," said spokesman David Bear. "Instead of recognizing the advantages of the technology, we keep ringing up 'what if' scenarios that serve no purpose other than to confuse and in some instances frighten voters."

Okay, here are my favorite flawed assumptions:

1. you can trust voting officials. I think the fact that air marshals have been convicted of smuggling drugs on flights is pretty clear indication that federal security screening of its employees is not an accurate indicator of ethics/morals/trustworthiness.

2. no one with malicious intentions will at any time, in any precinct, ever have access to one of the machines. And if you believe that, you should know that "gullible" is not in the dictionary, immediately join the campaign to Save the Naugas (do you realize how many are slaughtered each year to make Nauga-hide dentist chairs?), and be advised that there really are people in Nigeria legitimately trying to transfer money.

3. to the best of my knowledge, no one has explained yet why the back doors were programmed in, and what legitimate 'functionality' they serve. Did the programmer pass the same 'security' screening and trustworthiness rating scale as the election officials?

Bah, whole thing makes me cranky.

~Elphie

The enemy of my enemy is my friend...

2006-05-16T21:46:00.000-07:00

Microsoft names the Nintendo Wii as their recommended secondary gaming system. Nintendo, not Sony's Playstation 3. Duh. If you have been paying any attention you might have noticed that Playstation and XBox are fierce competitors in the game console space so this won't be much of a surprise to you.

Sony names the Nintendo Wii as their recommended secondary gaming system. Nintendo, not Microsoft's XBox 360. Duh*2. If you have been paying any attention you might have noticed that Playstation and XBox are fierce competitors in the game console space so this won't be much of a surprise to you. (deja vu!). On top of that, in the article Sony tries to make a case for the lofty PS3 price tag with the whole Blue Ray justification. Some folks just aren't buying that argument though, and I must admit that I tend to agree...

So in a moment of blinding clarity and insight, one blogger points out: doesn't that mean that the Nintendo Wii will be the primary gaming system with the most market share, and Sony and Microsoft will be the secondary systems? uhm, well, it depends on whose marketing team you are on.

I think though that primary and secondary console crowns shouldn't be driven purely by market share but mind share. I've got an XBox 360, and expect I'll get a Wii (despite the truly unfortunate name). But which will I spend more time playing? That is the true measure of which console is master and which is slave.

wii wii wii, all the way home
~Elphie

No patch for human stupidity

2006-05-14T22:31:00.000-07:00

The New Yorker recently ran a story about a 57 year old Vietnam vet Christian psychotherapist who not only fell for a 419 scam, but ended up being prosecuted, convicted, and sentenced to two years in prison. He spent over $40,000 of his own money and owes $600,000 in restitution for fraud committed over five years trying to help the "Abacha's".

I think I am supposed to feel sorry for this guy who was swindled, but I don't. He deserves every last thing that happened to him. Seriously. When interviewed post-conviction/pre-incarceration:

When I asked Worley what he wished he had done differently, he didn’t answer directly. Instead, he spoke about hoping that the Abachas would get back in touch with him. However, before they could resume work on the multimillion-dollar transfer, he expected them to send the six hundred thousand dollars that he needs for restitution.
“What if they sent you a check?” Barbara [Worley's wife] demanded. “Would you put it in the bank to see if it cleared again?”
“Yeah.”
“John!” she said.
“I don’t know,” Worley said finally, sounding defeated. “I have to have time to think about what I would do in that situation.”
“My husband is naïve,” she explained to me. “He trusts people.”

Honey, your husband isn't naive, he is a freaking idiot.

There are some people who think they are fighting back against the Nigerian con artists who are taking advantage of hapless marks/rubes/fools by wasting the time and money of the con men. Check it out.

I'm not convinced this is really doing anything to minimize or prevent fraud, but I guess if they have the time to kill and find it entertaining, who am I to criticize. Some people juggle goslings.

~Elphie

Some people have waaaaay too much time on their hands

2006-05-12T20:57:00.000-07:00

For centuries, creative people given time and resources have produced amazing things.

On the other hand, some creative people use their time this way:

these things are also amazing in their own way; after all, Lord of the Peeps is far more entertaining than an aqueduct. But I suspect these don't possess the same durability and cultural impact as Persistence of Memory...

~Elphie

life can be so entertaining...

2006-05-11T15:17:00.000-07:00

Is it social engineering? performance art? civil disobedience? I don't know - but what I do know is that it is damn funny.

You may have already read on Slashdot or Gizmodo or about the roughly 80 people who one at a time entered a Best Buy wearing blue polo shirts and khaki pants (similar to the employee uniforms), dispersed through the store, and then stood around "waiting for my girl/boy friend". Of course the reason this is getting attention is that the organizers were smart enough to plan it well and documented the whole stunt here. Its creative. Its amusing. Its something people can rally around. And its something to stick it to the man, to thumb your nose at the establishment and say "I can wear whatever I want wherever I want and I can bring all my friends along dressed just like me, and you can't really do anything about it". The only leg the store had to stand on was that the participants weren't shopping and therefore could technically be considered loitering. Had the 80 people all had legitimate purchases to make, would Best Buy have still kicked them out? It would be an interesting twist on the social experiment if you are thinkng of trying something similar.

The best reactions from the Best Buy employees described in the article are:

"Security guards and managers started talking to each other frantically on their walkie-talkies and headsets. 'Thomas Crown Affair! Thomas Crown Affair!,' one employee shouted. They were worried that were using our fake uniforms to stage some type of elaborate heist.
and
Both security guards loudly advanced their own theories about what was going on. One security guard didn't know who the group was, but suspected that it was some cult, because, "They all have that zombie look in their eyes. They just stand there staring at nothing." They also argued about if the prank was funny or not. One did not think it was funny at all and the other said he thought it was "kinda funny," and tried to explain the humor, "What if you went into Home Depot and there were all these people wearing orange aprons all over the store?"

What if indeed. PLEASE NOTE: I am in no way advocating impersonation of police officers, firefighers, lifeguards, doctors, or any other uniform which could lead to human injury or suffering if mistaken for the genuine article. But what really is the harm if everyone wore red shirts and khaki pants to Target? Green aprons in Starbucks? Rented Roman Centurion costumes and wandered around Caesar's Palace?

I understand why security guards and management would freak out at any of these establishments. They feel out of control, they have no idea what is going on, they fear theft and manipulation, or acts by the imposters that will reflect on their establishment. I suspect Caesar's Palace would have the least tolerance and have the best organized and professional response. But all the same, what can they really do? What if you were just so freaking excited about the hotel theme and all the money you won at the craps table you decided to wear a toga and celebrate Caesar with the 30 guys there for your bachelor party? Would they really ask you all to leave? What if it were Halloween?

As usual, I have no answers or great insight. I just find the entire situation to be fascinating and thought I'd point it out to Hideaway readers. The reactions of customers, of employees, of management - fun stuff to observe for any student of human nature.

~Elphie

content only matters if the audience is listening

2006-05-09T09:23:00.000-07:00

I have an office job and I attend a lot of conferences. Those two things mean that I end up seeing a lot of presentations. A few are very good. Some are very bad and lead many to the belief that slideware is evil. Most are mediocre. So I’m only going to say this once: if you are giving a presentation you owe it to your audience to stop hiding behind the ‘I’m an engineering geek who can’t make a slick slide deck or speak to people engagingly’ excuse. I’m not saying you need to go get an MBA and have m4d ppt skillz, but for gods sake don’t read the damn slides to me. I am capable of reading on my own, and if I feel like I could have given your presentation for you with the deck and 20 minutes prep time, then you are wasting the time of your audience and insulting their intelligence.

Now I’m not claiming to be a slidedeck guru, but here are a couple links to things I’ve found useful, and suspect most presenters could learn from.

Presentation Zen (humorous AND educational, a virtual treasure trove)
Making a (Power)Point of Not Being Tiresome

And to lighten things up a bit more…

The Many Uses of Power Point
http://www.theregister.co.uk/2006/01/26/public_speaking_advice/

yeaaaah, that last one, I’m not sure what to call it so the URL will have to do. But trust me when I say it is pretty damn funny, and advice everyone I know would love to take regardless of whether they do any public speaking or not. :)

~Elphie

We'll get around to making first contact as soon as I clear this level...

2006-05-08T12:05:00.000-07:00

I've been meaning to make this post for a week now... seeing as I'm now taking abuse for not keeping up to date on blogging, I figure I better eat lunch at my desk and get down to business...

On May 1, Seed Magazine published a fascinating article by evolutionary psychologist Geoffrey Miller. Dr. Miller suggests that the reason we haven't made contact with aliens is because they too have created x-boxes and other diversions such as porn, and are no longer investing time and energy in things like space exploration.

Basically, I think the aliens don't blow themselves up; they just get addicted to computer games. They forget to send radio signals or colonize space because they're too busy with runaway consumerism and virtual-reality narcissism. They don't need Sentinels to enslave them in a Matrix; they do it to themselves, just as we are doing today. Once they turn inwards to chase their shiny pennies of pleasure, they lose the cosmic plot. They become like a self-stimulating rat, pressing a bar to deliver electricity to its brain's ventral tegmental area, which stimulates its nucleus accumbens to release dopamine, which feels…ever so good.

Obviously the larger message is that we here on Earth have messed up our priorities and need more rocket scientists and fewer game developers. The article ultimately ends up being fairly anti-technology and anti-consumerism, suggesting that the only people who will survive long term are the super-family oriented breeders who eschew trivial diversions like computer games or even reading novels.

The article is right up my alley - the intersection of humanity and technology. I've wondered for years if advances in electronic communication were really bringing the global community together, or isolating us from real people and real life just outside our door. But even I'm not as big a cynic as Miller appears to be. Sure, you have people becoming so engrossed in virtual life that they are living fraudulent existences, creating in some case multiple personas for the identity they want to portray to others and carrying on 'relationships' with people they not only have never met, but never will meet. All the while not interfacing with the real people just down the street and developing real relationships which result in reproduction of our species. But on the other hand, you have people who do not have the means to travel learning about far off cultures and becoming better global citizens for this expanded understanding, or meeting their soul mates on eHarmony or whatever the matchmaking website du jour is. Technology itself isn't a bad thing, it is people's lack of willingness to live in reality and the allure of an ideal existence that leads to mixed up priorities. And that sounds like a problem that will happen regardless of what the particular diversion is (computer gaming, porn, television, etc). The path to enlightenment is not the rejection of all entertainment, it is finding a way to make entertainment an inspiration for real life action instead of a substitute for it.

Of course I would very much like to meet aliens or colonize another planet (or even our own moon for heaven's sake) during my lifetime. That would be cool. So kids, stop playing Oblivion and get back to your telescopes and dreams of becoming an astronaut when you grow up. Maybe by then we'll have political leaders in place that will actually put some funding behind space programs... OOOH, and cloning and hybridization, that's pretty slick cutting edge research too. Go study genetics and biology if space exploration doesn't do it for you. Remember Dark Angel? See if you can't do that in a non-evil way. See? Entertainment for real life inspiration. hah.

~Elphie

No, I'm not hitting the nitrous oxide today...

2006-04-28T15:04:00.000-07:00

the maniacal laughing is merely a by-product of amusement overload. Three unbelievably funny things have presented themselves to me today.

1. Elphie iz tha most K-to-tha-izzick ass brotha playa evah.
http://sites.gizoogle.com/index2.php?url=http://elphabawest.blogspot.com
plug in your favorite website and join the hyena club. Seriously, me n tha homeys be bout to vomit we be laughin so H-to-tha-izzard.

2. Chain email run amok.
I got a chain email from a friend today. Normally I'd just delete it without reading it, but this one was too damn funny. I swear to god, it is an underwear pyramid scheme. That's right. If I send person #1 a pair of new panties, add my name to the list, and send out six new copies, I should (in theory) receive 36 pairs of new panties in return. I'm sorry, but this is just funny. I might open a PO Box under a pseudonym and play along just for the social experiment angle. If I do, I'll let you know if I actually get any undies or just more junk mail from Val-u-pak.

3. Your thoughts are your password.
Am I the only one envisioning Monty Python here?

Bridgekeeper: Stop. What... is your name?
Galahad: Sir Galahad of Camelot.
Bridgekeeper: What... is your quest?
Galahad: I seek the Grail.
Bridgekeeper: What... is your favourite colour?
Galahad: Blue. No, yel...
[he is also thrown over the edge]

And if that isn't tickling your funny bone, try this.

oh man, if I don't stop laughing I'm going to get hiccups...

~Elphie

Confessions of an OCD blogger...

2006-04-19T22:04:00.000-07:00

I've been blogging for two months now, and figure it is time for an admission (the first step to recovery?) My name is Elphaba and I'm addicted to blogging. I've got probably 5 topics saved up to blog about in the future. And I find myself thinking in blog. Things I read and experience get translated into potential future blog entries in my head. I have to exercise tremendous self-discipline to not make multiple posts in a day sometimes when I find several really interesting things to yammer on about. So even if no one was reading the Hideaway but me, I don't think I'd be able to give it up at this point.

This shouldn't be a surprise to me or anyone who knows me - I'm fairly obsessive about all my other hobbies. But I tried blogging about 2 years ago and it didn't stick. I was irregular about posting and did it primarily as an obligation to family and friends. A painful chore at best. But this blog is totally different. I'm really enjoying writing it, because I'm writing what I want. And I'm enjoying how writing it is changing me. I'm writing more now in my everyday life as a result, and feel like I'm thinking about things in a different light.

So thanks for reading here at the Hideaway so I don't have to feel like the crazy cat lady who talks to herself all the time. Hope you enjoy reading it at least half as much as I enjoy writing it.

~Elphie

I hate girl clubs... but not this one.

2006-04-18T20:58:00.000-07:00

I've never been a fan of women's career networking groups, women's conferences, sororities, etc. I espoused a 'suck it up and play with the boys' attitude for the vast majority of my life. Most of my friends in life are/have been guys, and its been that way for as long as I can remember. I firmly believe that by creating a special group, you make yourself more different, not more equal. Besides, girls can be bitchy and irrational. How can you be friends with people like that?

That said, I've learned in the last year that not all girl groups are bad. I think this comes from the fact that I've seen crappy things happen in the workplace to insanely smart, hardworking female engineers that were just not fair - and without a network of women to ask the advice of and share experience with, these women would have been totally isolated in dealing with the situation.

QUICK DISCLAIMER: So you'll see on the con calendar that I've listed the Executive Women's Forum in Information Security - which might make no sense now that I've broadly bashed women's conferences/organizations. Here is why I think EWF is cool: having been to a ton of conferences, EWF is different because everyone is trying to build each other up (and I don't mean self esteem but skills, business opptys, etc). I've never seen so much positive group energy and trust. I've only been to EWF once because the typical attendee base and content really isn't an applicable fit for my role in 'the industry' but it was still a good experience overall, and a conference I've recommended to a few colleagues. And if you are wondering if an all women's conference is boring in the evenings after the malls close, let me just say that unlike men, women don't need members of the opposite sex around to party their asses off until all hours of the night.

The reason this post started to begin with is that this weekend I found another all-girl group that not only merits a 'not bad' rating from me, but is getting added to my fave sites list.

FragDolls

Yes, thats right, FragDolls. Girl gamers don't have to be dumpy nerds or ecclectic comic book addicts who start gaming to hang with the geek boys. Girl gamers can be hot. Some might say that they are objectifying themselves, using their bodies to get ahead/noticed... well DUH. But 'so what' I say! Being hot, knowing you're hot, and *appropriately* leveraging that advantage is not a crime and doesn't make you a bad person. I'm sure professional women in uncomfortable business suits and sensible shoes are likely horrified by this statement... :)

But here is why I think FragDolls is a great thing for the feminist movement (whatever the hell that means): if hot, smart girls are gaming - and maybe even beating the pants off the boys - it starts becoming socially acceptable for girls to get into gaming and technology. If this catches on, maybe someday it will be cool for chicks to have badass code-fu instead of being varsity cheerleaders, and go to college not for psychology or social work or english lit but for computer science or electrical engineering degrees.

That and I don't have to feel like quite so much of a dork for being a hard core PC gamer. My last job I'd come in to work on Monday and co-workers would ask about my weekend - when I'd tell them (with great enthusiasm) about how we played Age of Empires at a LAN party until 3am every night they'd look at me like I was a freak of nature. One of them asked once "you know you're a girl, right?". Damn right I'm a girl. I'm a FragDoll.

~Elphie

Layer1 this weekend

2006-04-13T23:44:00.000-07:00

The third of the badass con trifecta in the lower 48, Layer1 is in Pasadena CA this weekend. A solid quality (and reasonably priced, thanks Noid & crew) con like ToorCon and ShmooCon, Layer1 has some great speakers lined up for attendees. The talks by Billy Hoffman, David 'H1kari' Hulton & Johnny Cache, Strom Carlson, and Luiz Eduardo Dos Santos top my list of stuff to see...

~Elphie

are you kidding me? part deux

2006-04-12T09:48:00.000-07:00

wow, the post on computer sex games generated a lot of comments. Only one here on the blog, but quite a few more via email or IM. Apparently I'm not the only geek that finds human nature and the intersection of technology and sexuality to be interesting, though that is no surprise really. For decades people have been fascinated by this topic, though typically in a more sex-cyborg to human equation (see Cherry 2000 - Pamela Gidley, Blade Runner - Darryl Hannah's Pris, or AI - Jude Law's Gigolo Joe) than the current technology-facilitating-human-to-human sexual interaction trend.

One reader sent me this link, which is a fascinating article about virtual prostitutes in Second Life (SL), an oft-cited MMO used for college-level coursework in the design of digital spaces, in art and architecture, and in media studies and sociology. SL has over 148,000 citizens.

In the article there is a quote from a guy who has paid real money for online tricks in SL which I think reflects my confusion from my prior post:

"Walking around in a virtual world matters. The girl you meet might take you to a sleazy motel or a scary dungeon, or maybe she'll show you someplace you haven't been before--stuff you won't get on the phone. Nonetheless, language is cardinal; complex computer interfaces often become obstacles to satisfying cybersex."

This last statement makes total sense to me. Netsex has a long text based tradition that started in bbs chat sessions in the early 90's - I know because I was on ISCA bbs a lot and eventually had to put "NO NETSEX" in my profile to keep the creeps away. but interaction was all txt based. Unless you were a killer ascii artist there were no graphics to go along with the conversation besides old school emoticons.

In many ways this is the book vs. movie argument. Some people prefer books to tv/movies because there is a lot left up to the reader's imagination - in movies you have to live within someone else's reality and run the risk of disappointment in their interpretation of the authors work. Ever see a movie after reading a book and think "that was *so* the wrong actor for that character"?

So its the GUI component (yeah, I prefer books) and the fact that people are plunking down $$$ for the games discussed in my prior post that I don't understand. The idea that you would buy a game purely for anonymous online sex (not even a complex virtual world like Second Life) and that would be a worthwhile investment over a free technology like IM or chat rooms just doesn't compute. But Second Life is created to be a robust virtual reality, where people can mingle and share ideas, exchange goods, etc. As such, it has a thriving economy. And like any society the world over, the oldest-profession has a place in this virtual world with brothels, pimps, and prostitutes running businesses that derive real life profit from their services - some SL brothels are estimated to earn $47K (in REAL money) a month. Ah, capitalism. This seems like a viable business model based on proven sociological models of cross-cultural human interaction.

~Elphie

are you kidding me?

2006-04-10T15:13:00.000-07:00

Online games replace monsters with sex
Explicit virtual playgrounds give new meaning to 'multiplayer'

This strikes me as strangely funny, in a bizarro-world sort of way. If life has got you down, if you aren't scoring with the ladies (or men) in reality, you can practice your technique and boost your ego with a virtual pick-up scenario. There have to be npc's in it to make up for the gender imbalance in the playspace - because I have a sneaking suspicion there will be more guys playing than girls. If so, I wonder just how 'easy' this game is. Are the npc's programmed with emotional baggage like the real players? Are there npc's who will turn your avatar down if you aren't in their preferred ethnic/age/etc group? If your name is Dan, will that infuriate the rebound npc girl who was just dumped by her cheating bf Dan and will she throw her virtual cosmo in your virtual face?

While certainly a creative marriage of technology and entertainment, I'm not convinced there is a viable (or at least successful) business here. There are a few obvious stumbling blocks to this new 'adults only' gaming becoming a successful entertainment medium. For starters, what woman is going to play this? Sure, there is the excitement of the flirting with someone over the network, the hookup, etc, but women aren't generally known for being avid porn viewers. And I can't really imagine the point of a point-and-click game where you've just taken off your shirt not because you are upgrading your armor, but because you are making out with some other character. Does the shirt disappear into your inventory or get thrown on the floor in a crumpled heap? How much is graphical versus text based? Do you control character climax? if so, how weird is that? Is there a big O button to click? Are the game controls simple enough for one hand operation? (oh come on, we all know you would have thought of that on your own eventually.)

I suppose if you are involved in a lot of chat-room sex this could take things to the next level by adding a visual component - some of these games are already available as text-only offerings. You'll now have a little idealized character you can pretend is you, hooking up with people who are pretending to be their little idealized characters, and the whole world is thin athletic and pretty and there are no repurcussions for visiting the make-your-own porn room with a guy you just met at the virtual bar this evening. I'm just guessing, but I'm pretty sure they won't have virtual gonorrhea or virtual pregnancies in this game, any more than they would have virtual premature ejaculation or virtual erectile dysfunction. Because the beauty of virtual reality in a computer game is that it isn't reality at all - it is an ideal state of being you can project. It is, for all intents and purposes, the Matrix. It is getting to be whoever you want people to see you as. So what if you are home in a dirty sweatshirt and old track pants eating ice cream straight from the carton? The people on the other end of the game think you're a badass hot chick in a vinyl catsuit and long coat.

virtually,
~Elphie

I'd like to buy an 0, HOPE6, BSOD, Captain Obvious and media whoring...

2006-04-07T09:04:00.000-07:00

Let's start with CanSecWest, and the vulnerability commercialization panel they had on Wednesday. There was much spirited debate but no end agreement between the parties... takes me back to ShmooCon and the BOF panel on training... but I digress.

In the press, Michael Sutton is quoted as saying that vendors need to pay for vulns, and later in the article a customer states he expects vendors to pay for vulns as well.

"The only economic model that does not make sense to me is the vendor's," Sutton said. "They get to know about a vulnerabilities ahead of time, but they are unwilling to pay for them."

Let's blithely assume for a moment that vendors and researchers could agree on the dollar value of a vulnerability (ROTFLMAO). There is still a big problem with the 'buying vulnerabilities protects customers' argument: if Oracle buys a vuln from David Litchfield, Oracle now owns the vuln. That means that they don't EVER have to fix it if they don't want to. I'm not just picking on Oracle - this is true of ANY vendor. They wouldn't be buying vulns, they'd be buying silence. And that would just piss everyone off - hell, that's why full disclosure practices started to begin with - the only way to get a vendor to fix a security bug was to publicly shame them with it. So I wholeheartedly disagree that vendors buying bugs would make me as a computer user any safer.

I have no problem with reputable third parties buying vulnerabilities and working with vendors to protect customers. I'll admit I think Tipping Point's ZDI program does a better job of that than iDefense's VCP program simply because iDefense's customers leak their confidential advisories all the time before patches are available. But these programs do play an important role in the security ecosystem that benefit customers, researchers, and vendors.

Other stuff:

Dates for HOPE number 6 have been announced - July 21-23, just a week or so before Black Hat Vegas. Of course I've added HOPE to the upcoming cons list...

Check this out - I've heard most people aren't having much trouble with Apple's Boot Camp beta, but this guy managed to get the legendary Blue Screen of Death. I haven't seen that on one of my boxes in over five years. Wow. Comments on the blog suggest that this was a known bug in the beta relating to iSight... doh!

Adam Shostack makes some interesting observations on recent media regarding rootkits on the Emergent Chaos blog. Yeah, he is right, this is a Captain Obvious type of situation where everyone in the security space already knew that rootkits were a big dangerous problem. But I think (or at least hope) the point of the Microsoft presentation at InfoSecWorld in FL that spurred the eweek article was to educate less security savvy customers about threats we are facing today and give guidance on how to deal with them. Adam also mentions the extremely cool work being done by John Heasman of NGS on ACPI BIOS rootkits that was presented not only at Black Hat Federal, but Black Hat Amsterdam and will again be presented in May at the Computer and Enterprise Investigations Conference. Right now it is super cutting edge stuff - so maybe if John gives the talk often enough, more people will pay attention (and by someone I don't mean the bad guys). After giving the talk at Black Hat Federal in January, Rob Lemos ran a story which quoted Greg Hoglund as saying:

"It is going to be about one month before malware comes out to take advantage of this," said Greg Hoglund, CEO of reverse engineering firm HBGary and editor of Rootkit.com. "This is so easy to do. You have widely available tools, free compilers for the ACPI language, and high-level languages to write the code in."

It would be a shame if the security industry didn't pay attention in January to John's early warning and is surprised when malicious bios rootkits emerge.

And since I've mentioned CEIC, I may as well throw a shameless plug out for Vinnie Liu's talk on Defeating Forensic Analysis (with his business partner Patrick Stach) on Thursday May 4 at the con. Vinnie is a very smart guy - if you are attending CEIC, I'd definitely attend their session. I'm such a groupie I'd go to NV just to see this talk, but I think that would violate the restraining order...

~Elphie

I always feel like somebody's watching me*

2006-04-06T09:21:00.000-07:00

Disney Phone Service For Kids Has Parents In Mind
Wall Street Journal - 4/5/2006
Disney is unveiling a mobile cellphone service that gives parents the ability to track the whereabouts of their children and control how and when they use their phone.

OK, so maybe I'm more paranoid about privacy than the average parent. But I don't really want Disney to know/have access to where kids go and tracking their habits or patterns. That seems like an insanely rich data source for planning future marketing etc of their other products. Not to mention I think is is creepy that they could have a captive audience to push sms messages to about their new theme park rides or movies or toy in their "exclusive content for both kids and parents". I'm not anti-Disney, I'd be just as weirded out if Nickelodeon or Sesame Street were doing this...

Maybe we should all get a few and start going to shooting ranges, military bases, porn shops, fetish clubs, strip bars, casinos, etc just to screw with their data... give them to truckers on trans-continential routes just for giggles...

~Elphie

*Rockwell, 1984

Mac's officially go both ways now...

2006-04-05T07:55:00.000-07:00

This is AWESOME. If you are one of the three people who read my blog regularly, you know I'm a fan of Mac hardware already, I'm just not willing to give up my Windows OS...

Apple's Boot Camp beta installs WinXP
Apple today introduced Boot Camp, new public beta software that enables Intel-based Macs to run Windows XP. Available as a download beginning today, Boot Camp allows users with a Microsoft Windows XP installation disc to install Windows XP on an Intel-based Mac, and once installation is complete, users can restart their computer to run either Mac OS X or Windows XP.

I think it is brilliant that Mac is taking steps to enable the Windows platform to run on their hardware. My next box is sooooo going to be a Mac...

~Elphie

I feel so much safer...

2006-04-03T14:38:00.000-07:00

2 air marshals plead guilty to drug smuggling
Marshals accepted $15,000 in return for carrying cocaine on Vegas flight
The marshals admitted they accepted $15,000 to use their positions as air marshals to bypass airport security and smuggle 15 pounds of cocaine.

I feel so much safer knowing I get the full body grope, er, patdown, every time I fly to make sure I don't have a shiv hidden in my underwire bra, while these guys who are paid law enforcement officials (who presumably passed background checks to get their jobs) circumvent security screening with the substance they've been told is cocaine. Because you can always trust criminals. If the drug dealers said it was cocaine, I'm sure it was. There wouldn't have been anything else hidden in that package. The only criminals that create elaborate double-cross diversions to hide a more heinous crime are on fictional TV shows, right?

And while we are talking about hiding things from people... why not put that secret passageway in your house like you've always dreamed of? Colonel Mustard won't find you with that damn lead pipe as you covertly move from the study to the kitchen! DIY kits start at just $1500, though I'm guessing that is just for a fancy bookcase with hidden space behind it, not a full room-to-room passage. Still, how cool would it be to twist a candlestick and have your fireplace rotate open to reveal a hidden room? The challenge would be to not show it off to all your geek friends and defeat the purpose of a SECRET room. Of course if all your plushophilia stuff is hidden in there, maybe you'll be extra motivated to keep it secret after all...

~Elphie

I'm speechless

2006-03-30T07:07:00.000-08:00

Not as in gobsmacked and unable to find words, but actually unable to speak.

No, this is not the sign you've been looking for that there is a spiritual power answering your prayers. I just have a very nasty head cold.

So I'm sitting on my sofa looking helpless and cute with my laptop and fuzzy pink slippers wishing I had bought a Slanket before they sold out this season. I also find myself occasionally wishing I were 12 again and my mom was going to bring me some chicken noodle soup and maybe an oatmeal raisin cookie. But then I remember that when I was 12 there was no such thing as a laptop. Heck, the Colecovision was still considered bitchen then, and the first Nintendo Entertainment System wasn't even out. There was no direcTV or tivo, so I'd be stuck watching Bewitched reruns and The Joker's Wild, and whatever other crap we got on our 83 channels of ecstasy.

So I guess having to get my own soup isn't such a big deal when I've got a laptop, direcTV, tivo, pay per view, a DVD player, PC games, and an xbox to keep myself entertained.

~Elphie

CanSecWest is coming up...

2006-03-29T13:50:00.000-08:00

If you haven't checked out CanSecWest yet, I highly recommend it. It is next weekend in Vancouver BC so time is short to make your plans, but the speaker list is solid and the crowd is always high on the clueful meter if you can make it.

And if you attend cons just to party your ass off, well, you can do that at CSW too. My fave DJ, Keith, will be tearing things up Wednesday April 5 at 686. If you are skipping CSW but attending NotACon (after all, Cleveland rocks I'm told) he'll be there too on April 7-8.

~Elphie

Microsoft's New Public Bug Database

2006-03-28T10:10:00.000-08:00

Yes, you read that correctly.

Microsoft creates public bug database for IE
"Many customers have asked us about having a better way to enter IE bugs. It is asked, 'Why don't you have Bugzilla like Firefox or other groups do?' We haven't always had a good answer, except it is something that the IE team has never done before," Al Billings, a member of the IE project team, wrote in a Microsoft blog Friday.

"After much discussion in the team, we've decided that people are right and that we should have a public way for people to give us feedback or make product suggestions," he wrote.

If you have a violent allergic reaction to all things Microsoft, you'll be able to find something snarky to say about this. IMHO, it is nice to see the old dog learn a new trick. Bash their intentions, make fun of them for following instead of innovating, but at least give them credit for opening their minds to learn from the outside world and finding a way to do something that a year ago was so totally counter to their philosophy it appeared impossible.

~Elphie

AIDS prevention option on the horizon?

2006-03-27T16:56:00.000-08:00

AIDS drugs promise prevention in a bottle
Pricey pill combo could keep at-risk populations from catching the virus
ATLANTA - Twenty-five years after the first AIDS cases jolted the world, scientists think they soon may have a pill that people could take to keep from getting the virus that causes the global killer.

My initial gut reaction: how cool! another scientific breakthrough making the world a healthier place!

My second thought: condoms are cheaper. and will people really remember to take the pills every day?

Ah yes, the cynic shines through the temporary haze of euphoria.

Sure, if you are an African woman condoms might be hard to get or insist your partner use. But since most African villages can't get adequate supplies of basic antibiotics, I'm not counting on them being able to afford anti-AIDS drugs for all the women to take daily on a prophyalactic basis.

Drug combo costs $650 a month
Expense also could limit use of the drugs.
Gilead donated them for the studies and sells them in poor countries at cost — 57 cents a pill for tenofovir and 87 cents for Truvada, the combination drug. That's more than the cost of condoms, available for pennies and donated by the truckload in Africa, but often unused.

well look at that, I'm not the only one who figured out the economic problem. but wait...

And in the Atlanta labs where Heneine, Folks and others are still minding the monkeys, "the level of enthusiasm is pretty high," Heneine said. "This is very promising. For us to be involved in a potential solution to the big HIV crisis and pandemic is very exciting."

Sure, finding a way to prevent HIV/AIDS is very exciting. But the public health holy grail is a one-time vaccine (with no side effects naturally), not an expensive daily drug cocktail that is harder and more expensive to acquire than condoms. The researchers - while totally reasonable to be excited by the scientific accomplishment - are missing the point. They see themselves finding a potential solution to the big HIV pandemic, but what they are forgetting is that a potential solution already exists. Solutions are only good if people actually use them.

sadly,
~Elphie

Free Movie Weekend

2006-03-24T23:28:00.000-08:00

Recently we had free HBO and Cinemax, so we tivo’ed a bunch of movies to watch later. My advice from this experience: don’t watch Flight of the Phoenix. Unless of course you have time to kill with no other diversions and it is free. It wasn’t a BAD movie like WaterWorld or The Postman, or a painfully terrible movie like The Cube or Hypercube, but it was 2 hours of time I’ll never reclaim. Basic premise: plane goes down in a sandstorm somewhere in the Chinese or Mongolian desert. Rescue is unlikely and food/water is limited. A few people you don’t care about die, more people you don’t care about live. The creepy random guy convinces them that they can use the crashed plane pieces to rebuild an airworthy craft and save themselves. Fortunately the passengers were all oil rig workers and skilled in hard labor, welding, etc. None of the characters are memorable enough for me to know their names, even while watching the movie. The only decent acting is by Giovanni Ribisi who is doing a great job with a weak script/plot, but just when you think the movie will get interesting and go Dead Calm on you and someone will have to kill Giovanni before he gets all Billy Zane psycho, the writers throw in a cheesy happy ending where even the nutjob is a hero and all the passengers are harnessed onto the wings flying out of the desert. Riiiiight.

Second movie watched: I Robot. I’ll admit, even being the sci-fi geek I am, I haven’t read much Asimov and went into the movie knowing nothing about the book though I expect I’ll pick it up and give it a read once I catch up on all the other reading I’ve got lined up. It actually wasn’t bad – at least, it was better than I’d expected. To be fair, I didn’t have high expectations of a Will Smith blockbuster sci-fi remake – figured it would be more mass-market entertainment like Men In Black than hard sci-fi like A.I. or Blade Runner (and if you haven’t read Phillip K. Dick’s Do Androids Dream of Electric Sheep, SHAME ON YOU). Anyway, Will Smith movies are generally entertaining and this was no exception. I think it is unlikely to become a classic but at least I wouldn’t have been pissed if I’d spent money to see it in the theater.

Since we’re talking about movies, here is my list of movies I think everyone with more than half a brain should see. Not all are sci-fi/fantasy, some are twisted psychological dramas…:

Blade Runner
A Clockwork Orange
Naked Lunch
Serenity (and the 13 episode prequel tv series Firefly)
Memento
ClosetLand
A.I.
Alien quadrilogy
LOTR Trilogy (Extended Directors Editions!)

Yeah, I’m a reformed ST:TNG fan but let’s be honest, Trek movies aren’t all that great. And while I will always be a huge X-Phile, it is hard to watch the movie without the tv show momentum to feed the conspiracy drama and yummy sexual tension between Mulder and Scully (will they ever kiss? Yes! Oh no, she is passing out! Denied again!). And don’t pretend you were immune to it and it’s just a chick thing – we all know that Scully was a babe and you wanted to kiss her until she forgot that whole rational, ‘there has to be a scientific explanation’ act too.

If you are horrified I left 2001: A Space Odyssey or Star Wars off the list, you are far more of a dork than I am. Congratulations. Your Official Dork King Certificate is in the mail. Really, it is. You should go stand by the mailbox now and wait for it to arrive so you can frame and hang it before your friends come over for your weekly Dungeons and Dragons game. They will all be soooo jealous. In fact, if you want to put on your Storm Trooper costume first, I’m sure your mail delivery person will be extra impressed and take more care in the future to not mangle your envelopes or carelessly put your mail in the annoying cat-lady neighbor’s mailbox.

Maybe sometime I’ll list chick flicks you can rent to score points with your girl. Though if you are a certified Dork King you probably don’t have a girl…

~Elphie

Innovations that have made my week...

2006-03-16T08:44:00.000-08:00

First, I am stoked that someone has gotten WinXP to run on the new Intel Macs. Lets face it: Mac hardware is sexy. I'll be getting a new box when Windows Vista comes out, and this is the first step towards the possibility of that box being a Mac instead of a PC. (I know, I could get a Mac now and run OSX or Virtual PC, but I'm addicted to a number of Windows based applications and the idea of Windows running natively on a Mac is just too cool).

Forgetting for a moment my own future hardware purchases, I'm even more excited by what this means for the computer hardware industry as a whole. PC manufacturers are going to be forced to innovate and come up with better design to compete with Apple. And that is a good thing for everyone if you ask me. (for a chuckle, here is an example of Apple's m4d d3sign 5killz. You'll have to install Google Video Player - if someone has a link to this in Windows Media Player or any other media players, please send it to me and I'll add the links)

Second bit of news I feel the need to rave about is a significant advance in cancer prevention, reproductive health, and public health in general. In 2005 a vaccine for Human Papilloma Virus (HPV) was developed which should be available in the US in the second half of 2006.

HPV is extremely common. Half of all sexually active women between 18 and 22 in the US are infected (another way to think about this: more women have HPV than graduate college). HPV is harmless in 90% of cases. Unfortunately, some strains of HPV significantly increase a woman's risk for cervical cancer - HPV-16 for example is found in 50% of cervical cancers, and about a dozen other HPV types are involved in most other cases of the disease. An estimated 250,000 women die worldwide from cervical cancer each year.

It is in the news again because human trials of the vaccine have started in Australia and drug companies are starting to submit vaccines for US FDA approval - the first drug is expected to be approved in June 2006. Unfortunately there is resistance to a widespread vaccination program when the vaccines become available. This vaccine, if given to boys and girls (boys may not get cervical cancer, but they are rather instrumental in spreading HPV so it makes sense to me that they should also get the vaccine) could eradicate HPV from the planet as we have done with other infectious diseases in the past. The controversy is that the vaccine needs to be given before an individual becomes sexually active - and very few parents are comfortable acknowledging that their little angels are fooling around at age 13. But IMHO the bigger barrier to widespread vaccination is the fact that this isn't being viewed as a cancer vaccine but an STD vaccine - and we all know that there are cultural, religious, and political groups the world over which feel that "abstinence only" is the only approach to take when it comes to STDs.

The technology used to create the HPV vaccine is pretty neat - and this is one of the first medical advances to PREVENT cancer that I recall seeing. Sure, chemo and radiation might help once you've got it, and we all know that behavioral changes will prevent skin or lung cancer, but this is the first 'magic shot' for cancer prevention. Hooray for science.

~Elphie

if enough people subscribe, can I win a new boom box?

2006-03-12T15:10:00.000-08:00

at least with RSS I don't have to go door to door to get subscribers.

http://feeds.feedburner.com/ElphabasHideaway
http://elphabawest.blogspot.com/atom.xml

I'm not sure anything I have to say is all that important... but who am I to criticize your choice in reading materials?

~Elphie

Seven things I've learned this week

2006-03-11T11:55:00.000-08:00

1. I shouldn't drive while listening to the Black Eyed Peas Monkey Business CD. I seem to be incapable of doing so without dancing in my seat and taking my hands off the wheel.

2. Very smart people don't read email instructions when sober. So giving the instructions again (even in writing) when they are intoxicated has limited effectiveness.

3. If you have a lot to get done, insomnia can be your friend.

4. Sometimes my instincts are right, and fighting for them pays off.

5. Sometimes my impulses are wrong and I should just walk away.

6. The people I work with are awesome, and I can count on them. (I knew this already, but this week was a great reminder)

7. Get the cell phone number of your limo driver, particularly if you are going to get out of the car and expect them to be there when you want to get back in.

Of course I learned quite a few other cool things this week, including several nifty tricks that will make my job easier and more interesting. I didn't think it was even possible for the Best Job In The World to get any better... heh.

~Elphie