I am sure that free Internet access was not part of the deal at the budget hotel I am staying at in London. Holly House Hotel, as recomended by Carl is tiny, but the price of 23 punds per night for bed and breakfast is only 3 pounds more than a dorm room elsewhere in Victoria - so very much worth it. And the free Internet access is a bonus! I just wonder whose access point this is - there does not seem to be any businesses around this area.
I know I have told a few people about the "trams" that shuttle people between various terminals at Dulles International Airport in Washington D.C. Because of how the airport has grown, some of the terminals are actually more or less in the middle of the airfield and while there is a subway system under development, the current mechanism is essentially some kind of a basket on some very big wheels. I was going to post a pic of the "tram" as well as of the hotel and the view from my room - but the net connection is quite slow so uploading pics not going to well.
On another front, I finally bought an iPod after threatening to do so for so long. The new models have an amazing battery life - I charged it up and transfered some music onto it before I left the hotel yesterday. I used it for most of the journey and when I got to the hotel in london, some 26 hours later, there was still some battery life left! The claimed 20 hours is thus not far off the mark - I am very impressed.
12 November 2005
11 November 2005
Reflections: The Hilton
So as I prepare to leave the US, I thought I should make an appropriate post from the lobby of the hotel. For a big brand, expensive hotel, the price and the service certainly do not match. The rooms are certainly nothing spectacular (although the view was great), there are no complementary services (even WiFi needs to be paid for ... got it for free due to the conference), food is expensive, no windows and the taps are confusing. Comparing the "Hilton Alexandria Mark Center" to the "Quality Hotel Lisboa", the Quality Hotel had free WiFi, great free breakfast, a huge King Size bed, a wide variety of TV channels and all this for half the price.
But the quality to price ratio is not the only problem - the hotel is more or less in the middle of nowhere. The next nearest hotel is a mile away and across the highway. There is nothing to do outside the hotel and while there is a free shuttle service to the nearest metro, it's just not that convenient. The conference was great, but the venue could have been a lot better.
But the quality to price ratio is not the only problem - the hotel is more or less in the middle of nowhere. The next nearest hotel is a mile away and across the highway. There is nothing to do outside the hotel and while there is a free shuttle service to the nearest metro, it's just not that convenient. The conference was great, but the venue could have been a lot better.
CCS Day 3: Main Conference Day 3 (really funky stuff)
So this is the last day of the conference and is usually the time for some of the less interesting papers to be presented (like my ISSA paper this year). But instead, the sessions proved to be by far the most interesting with some really amazing results/approaches/concepts with sometimes frightening possible consequences. That said, there were still some boring talks - so I will just ignore them.
I missed the first paper of the day by opting for an extended breakfast (and because I woke up slightly late) but I am glad I didn't miss the second - a talk on a different reputation mechanism for online auctions - in particular looking at the idea of trying to find out if some power sellers (basically people who make a living out of eBay) are actively colluding to push up prices. While their investigation was based on real world data (100k+ auction bids IIRC), the results are still largely theoretical as they haven't proved conclusively if their suspicions are correct. The approach and analysis was still very cool.
The next talk was equally interesting - the paper investigated the correctness of results generated in the clients of P2P grid applications like SETI@HOME. The results are slightly negative in the sense that correctness cannot be guaranteed but they did introduce a lot of formalisms that can be used to reduce possible errors. Their approach is particularly interesting as correctness of client results (in terms of a dishonest client) have been effectively ignored by the HPC community.
The next few talks were rather uninteresting, although a key exchange mechanism using password authentication (PAKE) was quite interesting. The last talk of session 2 on proxy resigning (a very counter intuitive concept in the first place) was very interesting and the paper does present some challenges that need to be solved. I am however not a cryptographer - and I don't think I could solve the challenge.
The next 7 papers were all brilliant. The first paper was an investigation into automation of LSM kernel hooks for Linux. Very interesting as some of the reasons we did not use LSM in the kernel level DRM controller are addressed although I am not sure if LSM would be a better option to the current approach. The next two papers were essentially buffer overflow prevention techniques. The first from Microsoft Research (which used Linux for some of the testing) presented a mechanism to prevent buffer overflow attacks without patching the defect! A very cool approach although architecture bound; but they did have a cool demo. The second was an approach to ovecome buffer overflow attacks that use format string attacks with C/C++ programs. Again - no need to modify source code - but this is not for binaries - code needs to be recompiled.
And then we come to the last session focusing on attacks and some really good work. The first paper was an improvement for dictionary attack targeting hashed password files with no salt values (apache, windows). Currently the attack focuses on human memorable passwords (which are the most common passwords) and most importantly the attack takes a few seconds!
The second paper was probably the coolest and an attack that has no real solution. The paper discussed keyboard logging through simply recording the sound of keys being pressed! Ok, at the moment, it is limited to a limited number of keys - but they have an amazing 90%+ character recognition, and with some funky Markov models they manage to get over 85% word recognition. Go check out http://www.keyboard-emanations.org for more detail!
So while the first two papers attacked individual users, the third paper brought down the Internet with minimal effort by exploiting effectively a flaw in TCP. In TCP, data flow is controlled using ACKs. However, it is this very fact that is used confuse an honest client to flood the network and thus create a DoS attack. Although the attack is very much theoretical, it does seem very much plausible. And all current servers utilising TCP are vulnerable!
And then the last paper - again very interesting, although I think it is very much limited to the USA as opposed to its global claims. Basically, it is an attack on GSM networks using SMS flooding, but I think many of the features of the attack depends on how GSM networks are set up - and would not really affect the rest of the world. Hmmm .... maybe there's a paper in there - a paper on examining the practicality of their attack in the rest of the world.
I missed the first paper of the day by opting for an extended breakfast (and because I woke up slightly late) but I am glad I didn't miss the second - a talk on a different reputation mechanism for online auctions - in particular looking at the idea of trying to find out if some power sellers (basically people who make a living out of eBay) are actively colluding to push up prices. While their investigation was based on real world data (100k+ auction bids IIRC), the results are still largely theoretical as they haven't proved conclusively if their suspicions are correct. The approach and analysis was still very cool.
The next talk was equally interesting - the paper investigated the correctness of results generated in the clients of P2P grid applications like SETI@HOME. The results are slightly negative in the sense that correctness cannot be guaranteed but they did introduce a lot of formalisms that can be used to reduce possible errors. Their approach is particularly interesting as correctness of client results (in terms of a dishonest client) have been effectively ignored by the HPC community.
The next few talks were rather uninteresting, although a key exchange mechanism using password authentication (PAKE) was quite interesting. The last talk of session 2 on proxy resigning (a very counter intuitive concept in the first place) was very interesting and the paper does present some challenges that need to be solved. I am however not a cryptographer - and I don't think I could solve the challenge.
The next 7 papers were all brilliant. The first paper was an investigation into automation of LSM kernel hooks for Linux. Very interesting as some of the reasons we did not use LSM in the kernel level DRM controller are addressed although I am not sure if LSM would be a better option to the current approach. The next two papers were essentially buffer overflow prevention techniques. The first from Microsoft Research (which used Linux for some of the testing) presented a mechanism to prevent buffer overflow attacks without patching the defect! A very cool approach although architecture bound; but they did have a cool demo. The second was an approach to ovecome buffer overflow attacks that use format string attacks with C/C++ programs. Again - no need to modify source code - but this is not for binaries - code needs to be recompiled.
And then we come to the last session focusing on attacks and some really good work. The first paper was an improvement for dictionary attack targeting hashed password files with no salt values (apache, windows). Currently the attack focuses on human memorable passwords (which are the most common passwords) and most importantly the attack takes a few seconds!
The second paper was probably the coolest and an attack that has no real solution. The paper discussed keyboard logging through simply recording the sound of keys being pressed! Ok, at the moment, it is limited to a limited number of keys - but they have an amazing 90%+ character recognition, and with some funky Markov models they manage to get over 85% word recognition. Go check out http://www.keyboard-emanations.org for more detail!
So while the first two papers attacked individual users, the third paper brought down the Internet with minimal effort by exploiting effectively a flaw in TCP. In TCP, data flow is controlled using ACKs. However, it is this very fact that is used confuse an honest client to flood the network and thus create a DoS attack. Although the attack is very much theoretical, it does seem very much plausible. And all current servers utilising TCP are vulnerable!
And then the last paper - again very interesting, although I think it is very much limited to the USA as opposed to its global claims. Basically, it is an attack on GSM networks using SMS flooding, but I think many of the features of the attack depends on how GSM networks are set up - and would not really affect the rest of the world. Hmmm .... maybe there's a paper in there - a paper on examining the practicality of their attack in the rest of the world.
10 November 2005
CCS Day 2: Main Conference Day 2
The first two sessions for the day promised some very interesting talks focusing on authentication and access control. Unfortunately, while the results of the papers discussed could have been brilliant, the presentations were dead boring and not much of value. Did manage to get some ideas down on paper on user authentication for my DRM framework - so the morning was not totally lost.
There are two tracks in the conference - the research and industry tracks; and I decided that at least one session should be in the industry track. The tutorial on secure programming in C/C++ was very interesting, especially as it was given by a member of the C standardising body. It is quite amazing how easy it is easy to screw up when coding in C/C++ but I can't really say I learned anything new - after all the overall conclusion was that secure coding in C/C++ is very difficult if not impossible ...
The last session of the day which focused on intrusion detection was by far the most interesting session today. Three of the four papers focused on detection and prevention of buffer overflow attacks and some really interesting ideas. The last paper was also very cool on a mechanism to counter DoS attacks when using overlay networks (overlay networks are similar to annonymiser proxies).
There are two tracks in the conference - the research and industry tracks; and I decided that at least one session should be in the industry track. The tutorial on secure programming in C/C++ was very interesting, especially as it was given by a member of the C standardising body. It is quite amazing how easy it is easy to screw up when coding in C/C++ but I can't really say I learned anything new - after all the overall conclusion was that secure coding in C/C++ is very difficult if not impossible ...
The last session of the day which focused on intrusion detection was by far the most interesting session today. Three of the four papers focused on detection and prevention of buffer overflow attacks and some really interesting ideas. The last paper was also very cool on a mechanism to counter DoS attacks when using overlay networks (overlay networks are similar to annonymiser proxies).
09 November 2005
CCS Day 1: Main Conference Day 1
So the conference begins officially ... and it seems a lot smaller than last year. However that could just be because of the much larger venues than last year. However, I am still convinced that this year's program is shorter ... I should try to count the sessions etc when I get back.
The keynote speaker was high profile - a previous NSA administrator and currently working at the US' department of homeland security. However, with the exception of a few interesting facts (like a really funky testbed) the talk was really boring. Unfortunately, many of the talks later in the day were just as boring.
The first few talks were very theoretical in nature, but were generally interesting. These talks included proofs for secure 802.11i designs and trust protocols. However, the two most interesting talks of the day (in my opinion) were the last talks - the first looking at an approach to track VOIP calls; even if the packets are encrypted and routed through anonymiser proxies. It was a really cool approach and really funky results. The second talk was somewhat DRM related - it showed a very limited scope implementation of secure database record retrievals - i.e. distribute a database table globally but only allow access to records if the query is detailed enough. It was also a very funky approach and really cool even if it is very limited in its application.
The keynote speaker was high profile - a previous NSA administrator and currently working at the US' department of homeland security. However, with the exception of a few interesting facts (like a really funky testbed) the talk was really boring. Unfortunately, many of the talks later in the day were just as boring.
The first few talks were very theoretical in nature, but were generally interesting. These talks included proofs for secure 802.11i designs and trust protocols. However, the two most interesting talks of the day (in my opinion) were the last talks - the first looking at an approach to track VOIP calls; even if the packets are encrypted and routed through anonymiser proxies. It was a really cool approach and really funky results. The second talk was somewhat DRM related - it showed a very limited scope implementation of secure database record retrievals - i.e. distribute a database table globally but only allow access to records if the query is detailed enough. It was also a very funky approach and really cool even if it is very limited in its application.
08 November 2005
Worst bugs and cooking up a storm
I see that Wired has a few interesting articles on its site this week (its an extended coffee break right now ...). First up - the top 10 worst software bugs so far. There is also a very interesting interview with a Nintendo game architect on a cooking game - perfect for all the budding cooks out there ;)
We have this game with a big wok that you use to cook Chinese food, and it's really interesting to have the meat and vegetables frying in there, and use the controller to flip the food around without it spilling out of the pan
CCS Day 0: DRM Workshop
I was meant to blog the days notes last night - but was too tired. And seeing how boring the keynote speaker for day 1 - a director from Homeland Security - is, I thought it's a good time now.
I was the first presenter of the day - which was quite cool in a way. My presentation went well and was well received although there were no real questions. However, the negotiation idea did get some good remarks. The next paper also had a legal view and pretty much confirmed some of the results of our DRM survey. It was certainly a more interesting approach and so I don't feel that bad that my paper in that arena did not get through ...
In the architectures arena - two interesting points. Pramod Jamkhedkar, who I met last year and had a good contact gave some progress .... maybe I should try to resurrect the contact in that arena. There is also a project in Belgium that is very similar to mine - I aim to learn more and maybe collaborate - could be good. There was also a paper from Motorola - but was rather limited in its application in my view.
The invited talk was from a director at Microsoft - personally I thought too much of it was marketing hype. He did praise Apple a bit - which I found interesting. In the more mathematical arena - two papers - first one on crypto which though interesting was quite difficult to understand, and I am not sure if I did get it in the end. The other paper was a formal proof of one of the key protocols in DRM which is similar to a protocol I make use of - so quite interesting.
The rest of the papers, while interesting were to focused on their respective arenas (like watermarking). It was a good day - hope the rest of the conference is as good. It seems that the conference is actually smaller this year - a lot fewer papers and people for the look of things. It could be due to a new conference called Asia-CCS which is going to be held in March next year. Missed submitting a paper into that one :(
I was the first presenter of the day - which was quite cool in a way. My presentation went well and was well received although there were no real questions. However, the negotiation idea did get some good remarks. The next paper also had a legal view and pretty much confirmed some of the results of our DRM survey. It was certainly a more interesting approach and so I don't feel that bad that my paper in that arena did not get through ...
In the architectures arena - two interesting points. Pramod Jamkhedkar, who I met last year and had a good contact gave some progress .... maybe I should try to resurrect the contact in that arena. There is also a project in Belgium that is very similar to mine - I aim to learn more and maybe collaborate - could be good. There was also a paper from Motorola - but was rather limited in its application in my view.
The invited talk was from a director at Microsoft - personally I thought too much of it was marketing hype. He did praise Apple a bit - which I found interesting. In the more mathematical arena - two papers - first one on crypto which though interesting was quite difficult to understand, and I am not sure if I did get it in the end. The other paper was a formal proof of one of the key protocols in DRM which is similar to a protocol I make use of - so quite interesting.
The rest of the papers, while interesting were to focused on their respective arenas (like watermarking). It was a good day - hope the rest of the conference is as good. It seems that the conference is actually smaller this year - a lot fewer papers and people for the look of things. It could be due to a new conference called Asia-CCS which is going to be held in March next year. Missed submitting a paper into that one :(
07 November 2005
Meaning of Freedom?
Today was essentially a day of doing tourist things; mainly going to places I did not manage to go last time round. Started off at the Arlington Cemetery, interesting if only to realise the extent of the conflicts that the US has been involved in and the number of lives lost. Arlington Cemetery also has a brilliant view of Washington DC; and the autumn colours are beautiful and look even better from the sky.
I also visited two memorials - the Iwo Jima memorial that commemorates the very costly US victory in WW2 and the Roosevelt Island - which is really a nature reserve of sorts. The Iwo Jima memorial reminded me a lot about our DoD and DOW games and puts capture the flag into a whole new perspective. A note on scale - the pedestal is about 3m high.
Smithsonian's American Indian museum is the newest, and since I did not spend a lot of time in it last year I decided to go back. It is one of the most interesting museums; not only because of some really funky displays and the general content of the museum but also the presentation of the content. Unlike many other museums that have tried to showcase culture, the museum has tried to showcase both sides of the story with very little bias in the presentation. For example, most exhibits dealing with cultural clashes have two commentaries - one from each side of the clash and often with contrasting views of the same subject.
And this brings me to the title of the post - a lot of the content in the American Indian museum chronicles their fight to maintain their culture; to fight for the freedom to choose their destiny. It is no different to countries deposing colonial rule or "foreign" occupation. While walking between the Iwo Jima memorial and Roosevelt Island, I stumbled upon "Freedom Park" - a park which claims to chronicle the struggle for freedom. It has a large emphasis on press freedom with a memorial to journalist killed on duty from all corners of the globe (from WW2 IIRC). There are also pieces of the Berlin wall, a bronze statue of South Africa's ballot box from 1994, a casting of Martin Luther King jnr's jail cell door (well one of them), cobble stones from polish war camps in WW2, a broken statue of Lenin, a replica of the "Goddess of Democracy" from Tiananmen Square, a display of banners from the Suffrage movement and a replica of the Freedom statue that sits on top of the US capitol. My criticism of the park is that while there is a celebration of freedom; it is based too much on the fights for the right to vote. Other fights for freedom like the fight against colonialism or the American Indian tribes' fight for recognition and control of their own future are swept aside. And of course the other essential freedoms are
I also visited two memorials - the Iwo Jima memorial that commemorates the very costly US victory in WW2 and the Roosevelt Island - which is really a nature reserve of sorts. The Iwo Jima memorial reminded me a lot about our DoD and DOW games and puts capture the flag into a whole new perspective. A note on scale - the pedestal is about 3m high.
Smithsonian's American Indian museum is the newest, and since I did not spend a lot of time in it last year I decided to go back. It is one of the most interesting museums; not only because of some really funky displays and the general content of the museum but also the presentation of the content. Unlike many other museums that have tried to showcase culture, the museum has tried to showcase both sides of the story with very little bias in the presentation. For example, most exhibits dealing with cultural clashes have two commentaries - one from each side of the clash and often with contrasting views of the same subject.
And this brings me to the title of the post - a lot of the content in the American Indian museum chronicles their fight to maintain their culture; to fight for the freedom to choose their destiny. It is no different to countries deposing colonial rule or "foreign" occupation. While walking between the Iwo Jima memorial and Roosevelt Island, I stumbled upon "Freedom Park" - a park which claims to chronicle the struggle for freedom. It has a large emphasis on press freedom with a memorial to journalist killed on duty from all corners of the globe (from WW2 IIRC). There are also pieces of the Berlin wall, a bronze statue of South Africa's ballot box from 1994, a casting of Martin Luther King jnr's jail cell door (well one of them), cobble stones from polish war camps in WW2, a broken statue of Lenin, a replica of the "Goddess of Democracy" from Tiananmen Square, a display of banners from the Suffrage movement and a replica of the Freedom statue that sits on top of the US capitol. My criticism of the park is that while there is a celebration of freedom; it is based too much on the fights for the right to vote. Other fights for freedom like the fight against colonialism or the American Indian tribes' fight for recognition and control of their own future are swept aside. And of course the other essential freedoms are
06 November 2005
Broken Promises
This post was supposed to be made 10 700 m above the sky on a 747 from Frankfurt to Washington DC. It has been years since I was last on a 747 - 12/13 years if my memory is correct (and that is rather untrustworthy) - but I don't remember it being this cramped ... I have probably had better leg room in Kulula or EasyJet and the plane seats 10 on each row (in economy anyway)! The connection is a Boeing initiative (www.connexionbyboeing.com) and is rather pricey ... but they gave away US$ 10 vouchers before boarding, so I am not paying anything. The $10 buys 30 minutes "airtime" by the way ... definitely the most expensive WiFi rates I have used. But as the title suggests - it did not work - and the stewardess put it nicely - its an old plane - and only new planes, ironically mostly Airbuses, have the functionality.
A few more comments on Frankfurt Main airport - they have an outside observation deck; although I could not work out how to get there; but did see a lot of people milling about. It also features casinos but they seem to be rather empty (although being 11am could have had an impact on that point). And the airport is huge and there are literally queues of planes landing and taking off - it is quite a sight. But the fact remains, its a crap airport to wait for planes ...
Another point I forgot to mention in the last post - the pilot did a nice flyover round False Bay, Cape Point and Table Mountain - which was very cool to see from the air - although there was quite a bit of cloud cover by Cape Point. According to the pilot, this is a popular feature of the flight.
Lunch on the flight was better than the Cape Town flight but that does not really say much - a rather bland Roast Chicken fillet with roast potatoes, salad and and some fruit cake. At least they use real cutlery ;) No attractive female passengers next to me - just an old couple returning home - friendly though (and the old lady is reading Harry Potter). There seems to be a lot of Indians on this plane ... and many assume that I am also from India, which I find a bit amusing. And talking about food and Indian passengers ... can they be fussy. An old man and his wife across the aisle raised up a fuss about what constitutes a Hindu meal ... he settled for the chicken in the end which I found puzzling and polished off a few beers and a wine to boot. And for you wine connoisseurs, they serve it in plastic glasses .. not even in fake glasses like SAA!
Getting from the airport to the hotel proved to be costlier than I hoped and more time consuming to boot - still beat the price of a taxi directly from the airport. The only notable incident on the train - two teens playing Magic the Gathering on the train ... a game that I though took both a lot of space and a lot of time; but I last played it about 10 years ago. The hotel mixed up my reservation a bit - so ended up scoring two free meals for tomorrow (as a show of regret for their follies I suppose) - but hey I am not complaining. And now I need sleep ...
A few more comments on Frankfurt Main airport - they have an outside observation deck; although I could not work out how to get there; but did see a lot of people milling about. It also features casinos but they seem to be rather empty (although being 11am could have had an impact on that point). And the airport is huge and there are literally queues of planes landing and taking off - it is quite a sight. But the fact remains, its a crap airport to wait for planes ...
Another point I forgot to mention in the last post - the pilot did a nice flyover round False Bay, Cape Point and Table Mountain - which was very cool to see from the air - although there was quite a bit of cloud cover by Cape Point. According to the pilot, this is a popular feature of the flight.
Lunch on the flight was better than the Cape Town flight but that does not really say much - a rather bland Roast Chicken fillet with roast potatoes, salad and and some fruit cake. At least they use real cutlery ;) No attractive female passengers next to me - just an old couple returning home - friendly though (and the old lady is reading Harry Potter). There seems to be a lot of Indians on this plane ... and many assume that I am also from India, which I find a bit amusing. And talking about food and Indian passengers ... can they be fussy. An old man and his wife across the aisle raised up a fuss about what constitutes a Hindu meal ... he settled for the chicken in the end which I found puzzling and polished off a few beers and a wine to boot. And for you wine connoisseurs, they serve it in plastic glasses .. not even in fake glasses like SAA!
Getting from the airport to the hotel proved to be costlier than I hoped and more time consuming to boot - still beat the price of a taxi directly from the airport. The only notable incident on the train - two teens playing Magic the Gathering on the train ... a game that I though took both a lot of space and a lot of time; but I last played it about 10 years ago. The hotel mixed up my reservation a bit - so ended up scoring two free meals for tomorrow (as a show of regret for their follies I suppose) - but hey I am not complaining. And now I need sleep ...
Subscribe to:
Posts (Atom)