Watch the bits go bye!

More Infosec stuffing:

Haven't brushed up on 'information geometry' yet ;) but this reminds me of what I was trying to map out with raw real data here:
http://static.flickr.com/47/174233556_2c39eb159b_o.jpg

Long rambling post lives here if anyone is interested, but very network centric and is garrulous and overblown: http://bsdosx.blogspot.com/2006/06/byo-rfc.html

Basically, should we be mapping everything real time at the data object and/or flow level from an operational perspective. Could every managed node actively stream back data? Should there be secure management covert channels ( Think Sebek http://www.honeynet.org/tools/sebek/sebek_intro.png ) to constantly feed back a nodes state, message passing and flows?

When you think about it, are nodes too independent and not surveilled enough? Rather than configure something to monitor/watch them (Openview, IDS, Argus), assuming initial trust, could they *constantly* advertise/disseminate statistical/session data that could be base lined (other than syslog/SNMP traps etc)? Am thinking initial zeroconf and MANETS style operation here, or MMORPG gaming clients? libkstat on steroids?

I know Verdasys have Digital Guardian, CA have Audit... but will Enterprise Digital Rights Management scale, or does it have the same problems as PKI.

Surveillance and Adhocracy scale. With utility computing, servers will move and be re-purposed and the clients are already on the move.

Future, past and present.

I'm brewing a post about the future, as I think we are somewhat
entrenched in the past and present.

For the moment the powers that be are waking up to support the object
level security model, until reductionist thought strikes again :) I
guess we'll always have data at rest, data being utilised and the
resulting message passing or flows.

Anyway onwards and upwards.

a) Van Jacobson (Research Fellow at PARC) talks about new paradigms
and security problems from the network up. Jump to 38 minutes in, as
the start is a history lesson, albeit frames the old paradigms and
ensuing discussion extremely well.


http://video.google.com/videoplay?docid=-6972678839686672840

Thanks Wade. Props to http://www.blog.wi.id.au/

b) Also, when looking at things like new paradigms for computing.
[Stargate replicators anyone]?

Neil Gershenfeld (MIT Director for Bits and Atoms) The beckoning
promise of personal fabrication.

http://www.ted.com/index.php/talks/view/id/90

"We don't need to keep having a digital revolution"


Personal note: I especially love the fact that the Google video is
subtitled and that at the time there was a person signing for the
deaf. We need to cater for all walks of life as per the colour blind
discussions on visualising data. It shouldn't just be about 'survival
of the most adaptable'. Is Future Shock and technology going to
implement an unconscious eugenics program?

The Holy Grail?

"Loosely coupled, rich internet applications and media delivered via infinitely scalable and secure utility computing to mobile thin clients in mesh environments."

I invite suggestions for my description. I invite comments and criticisms.

Note: Must keep to one sentence though ;)

Time for a smile.

This kid breakdancing is the first thing in a while to make me laugh out loud, enjoy!



Another brief smile is here.

Maybe there is something weird in the ether today, but here is another one.

Infosec the video.

Video Link



Rob Thomas has been a hero of mine ever since reading him on the First.org private lists. He founded (http://www.cymru.com/) Team Cymru. He features in this video, along with Richard A. Clarke.

Good to see the Department of Homeland Security training up the United States Secret Service. Geo-political boundaries anyone?

Rob first opened my eyes to the fact that something like a GSR ( Cisco 12000 Series Internet Routers ) could be 0wned and used to bounce or generate malicious traffic. Can you actually imagine a box with multiple OC-48 ( and above ) POS interfaces ready to do some miscreants bidding? “im4 g0nn4 p4x0r j00!”

More ForwardEdgeII training videos!

I love it...

Just re-read one of my links to recent testimony given by Dan Geer to the US Department of Homeland Security's Sub-Commitee on Emerging Threats, Cybersecurity, and Science and Technology.

Quote from page 2:

"Information security is perhaps the hardest technical field on the planet."

F**kin' A.

(I, or even he may seem biased, but those in the know will wholeheartedly agree.)

Q.E.D.

Infosec, what's the fuss?

Collections of quotes.

I had emailed these around recently, you gettin' any warm and fuzzies?

The religion of the future will be a cosmic religion. It should
transcend personal God and avoid dogma and theology. Covering both the
natural and the spiritual, it should be based on a religious sense
arising from the experience of all things natural and spiritual as a
meaningful unity. Buddhism answers this description. If there is any
religion that could cope with modern scientific needs it would be
Buddhism. (Albert Einstein)

A human being is part of the whole called by us universe ... We
experience ourselves, our thoughts and feelings as something separate
from the rest. A kind of optical delusion of consciousness. This
delusion is a kind of prison for us, restricting us to our personal
desires and to affection for a few persons nearest to us. Our task
must be to free ourselves from the prison by widening our circle of
compassion to embrace all living creatures and the whole of nature in
its beauty. The true value of a human being is determined by the
measure and the sense in which they have obtained liberation from the
self. We shall require a substantially new manner of thinking if
humanity is to survive. (Albert Einstein)

The most beautiful and most profound experience is the sensation of
the mystical. It is the sower of all true science. He to whom this
emotion is a stranger, who can no longer wonder and stand rapt in awe,
is as good as dead. To know that what is impenetrable to us really
exists, manifesting itself as the highest wisdom and the most radiant
beauty which our dull faculties can comprehend only in their primitive
forms - this knowledge, this feeling is at the center of true
religiousness.
( Albert Einstein - The Merging of Spirit and Science)

Reality cannot be found except in One single source, because of the
interconnection of all things with one another. (Leibniz, 1670)

All things are parts of one single system, which is called Nature; the
individual life is good when it is in harmony with Nature. (Zeno)

But also really like Wade's quote page [ http://tumblr.wi.id.au/ ]as it has a similar theme.

Game theories for the World

Should we all be playing non-zero-sum games?

In the words of author Robert Wright (TED talk), "players with linked fortunes tend to cooperate for mutual benefit", and "All the salvation of the world requires is the intelligent pursuit of self interest in a disciplined and careful way".

Moral evolution is required via appreciation for the interconnectedness of all things.

I have been thinking for quite some time now that games like Sim City are required as part of a more subtle education system to help to teach kids about interdependence and how societies and civilisation actually works. Also, if kids aren't creating entertainment any longer and just consuming entertainment while mimicking the wrong role models , surely as a society we are responsible for re-architecting how they perceive society and should introduce different paradigms to their learning and living. We have indeed outsourced almost all thought, decision making and learning to the mass media while demonstrating mostly the negative traits of human nature such as greed, intolerance and lack of discipline. We breed autonomic consumers.

Personally I believe we should be getting kids to game with things like Sim City, A Force More Powerful and FoodForce . Imagine a multiplayer non-zero-sum game akin to Command and Conquer where the only answer was to negotiate and collaborate rather than mutual assured destruction. Let them play it out over the course of a term in teams and hopefully like WOPR they would come to realise the best strategy!

We are either unconsciously breeding a new generation unequipped for the present/future day or we can consciously adapt to the increasing rate of change in the world and move out of the outdated and inept mass-industrialised focussed educational structure to a more modular digitally orientated autodidactic framework.

"Welcome to the internet my friend."

Unequal, unstable, unsustainable... yet interdependent...

Working on this... but for now Bill Clinton sums it up http://www.ted.com/index.php/talks/view/id/85

Should TED talks not be required viewing for our youngsters?

Good things, when short, are twice as good.

If you know anything about information security, claim to, or even have a passing interest; then this 3 page PDF document will reinforce, refresh, and explain concisely the issues we face.

"The Committee on Homeland Security's Subcommittee on Emerging
Threats, Cybersecurity, and Science and Technology will hold a
hearing entitled "Addressing the Nation's Cybersecurity Challenges:
Reducing Vulnerabilities Requires Strategic Investment and Immediate
Action." Witnesses include Dr. Daniel E. Geer, Jr., Principal, Geer
Risk Services, LLC; ........."
....

Dan's testimony is here:

http://geer.tinho.net/geer.housetestimony.070423.PDF

Security metrics, expertise supply, increasing risk due to intelligent attacks, information sharing (my personal favourite) and accountability as opposed to access control.

Note: You may be interested also in some of Dan's other publications:
1. "Data Loss Prevention" [http://www.verdasys.com/pdf/dlp_whitepaper.pdf]
2. "Securing the Point of Use" [http://www.verdasys.com/pdf/SecurePOS.pdf]
3. "Convergence" [http://geer.tinho.net/ieee.geer.0606.pdf] of physical and digital security.
4. "The Evolution of Security" [http://geer.tinho.net/acm.geer.0704.pdf]

Pull up those bre[e|a]ches...

In response to a post of Drazen's, quoting Peter Benson on Disclosure Laws; http://beastorbuddha.blogspot.com/2007/04/disclosure-laws-impacts-and-things-to.html

I offer the rant below.


I love this kind of topic, merely to highlight the macro and micro issues. One must look outside ones own discipline to find answers, as sometimes becoming too specialised does not allow one to 'see the forest, for the trees', more often than not.

I would like to try and answer the issue if I may with some history, a dash of the present and a dab of the future.

History:
This is what's starting to happen in our society and industry in terms of complexity and economics http://dieoff.org/page134.htm . Even though this paper is focussed on natural ecosystems and civilizations; the internet and composing networks are a wonderfully rich representative ecosystem existing in our civilization.

As complexity increases there is increased energy needed in any system. This either produces new paradigms which address diminishing marginal returns, or the system collapses under the weight of trying to address the complexity. Thus what is required is either non-reductionist thought to address the complexity, e.g. "Defense in Depth" (which happens to be extremely costly), or a reduction in complexity and type of energy required in trying to solve the problems, resulting in a new paradigm or paradigms. To introduce the next paragraph I thought I'd quote Marcus Ranum (http://www.ranum.com/) "Your job, as a security practitioner, is to question - if not outright challenge - the conventional wisdom and the status quo. After all, if the conventional wisdom was working, the rate of systems being compromised would be going down, wouldn't it?"

Present: Quality and Cost Benefit Analysis

Sometimes when you have been travelling along a certain path, there are a few signposts as to why you are potentially lost.
http://www.ranum.com/security/computer_security/editorials/master-tzu/

http://www.ranum.com/security/computer_security/editorials/dumb/

Future:
Personally I believe the tools and processes are out there, but the enumeration of the problem is somewhat incorrect and being hampered by the 'old guard' of IT who actually don't really get it! They are suffering extreme forms of 'Future Shock' (http://en.wikipedia.org/wiki/Future_Shock) "too much change in too short a period of time"... This is in fact a wider social issue that is very hard to address as people are afraid to challenge the status-quo or can't affect change within their existing roles. This must happen more quickly rather than allowing a generational 'breed out' of the less savvy CIO's, CTO's, CSO's and below, as things are speeding up and not slowing down. This will only occur with economic motivations. Economics is based on theories of scarcity and the perceived value of goods and services. We are having huge issues in evaluating data over it's lifecycle and putting a price on the ensuing issues and costs of a breach, disclosure or unintended manipulation of data.

As Grace Murray Hopper, USN (Ret) points out;

'Some day, on the corporate balance sheet,
there will be an entry which reads,“Information”;
for in most cases, the information is more valuable
than the hardware which processes it. '

Dan Geer re-introduces this in his wonderful paper "The Shrinking Perimeter: Making the Case for Data-Level Risk Management", which argues for object level protection and data valuation, which opens with the previous quote. (http://www.verdasys.com/pdf/ShrinkPerim.pdf )

Another interesting topic is that of time and physics at play in our new world. Time based security and convergence argues for new paradigms. (Convergence, Dan Geer http://geer.tinho.net/ieee.geer.0606.pdf) and highlights new effects of this highly connected information based economy.

To understand the infrastructure and ecosystems out there, one must constantly sample and baseline traffic in the face of constant change. Some change is valid, some invalid. One cannot manage what one cannot measure, and change management is at the heart of it all. Metrics need to be standardised upon and individual nodes or systems need to become simpler e.g. more easily defined and controlled.

MTTR (Mean Time To Repair, http://en.wikipedia.org/wiki/Mean_time_to_repair) for example, requires that one actually knows something is at first broken and/or performing incorrectly (be it malicious or benign!).

Even though technology changes, the challenge of information management stays the same.

Sampling and surveillance, tied to regulation and compliance? Whose pocket gets hurt and what can they then do about it? Does a public shaming exact the financial penalties warranted or is public memory short lived when entities change and reform as different companies?

I do believe it's the start of building a baseline awareness. But honestly, without a form of Total Information Awareness, massive indexing and far reaching information asset management, how do you know:

a) what you've lost
b) when you've lost it
c) how you've lost it
d) how not to lose it again

Where does the burden of liability fall and how big is the carrot or stick?
Hopefully we don't start to litigate. http://www.ranum.com/security/computer_security/editorials/lawyers/index.html

I am beginning to be more optimistic with good folks like SA (http://www.security-assessment.com/) on the case!

Spring has sprung, the grass has riz, I wonder where the RFID ...

I recently got a new ePassport with an RFID chip installed. I would have gotten a legacy passport sooner had I been actively following Ireland's rollout schedule for ePassports. As I only provided the minimum amount of information e.g. old passport, photos and basic identity information, I am not currently deeply worried, however the potential to:

a) read my information
b) write new information
c) clone my identity
d) at some future time add more biometric information
e) remotely fingerprint the passport nationality

led me to re-read some work being carried out on RFID security and the encryption algorithms and key material being used or not used as the case may be. The term PKI ( Public Key Infrastructure ) has been bandied about, however who owns and controls the root key(s) and how is the local key derived. What is the key strength, who owns or controls them? Can I read my own info? How secure is their BAC ( Basic Access Control ), not very it seems? Issues abound in passports, credit cards and building or system access cards whereby proximity readers are employed.

Right now I would like to disable the chip completely, but I believe this to be a crime. Maybe I can coax it to gently fail? What is the MTBF ( Mean Time Between Failures ) for the RFID chips in Irish passports? The UK ones seem to be fairly short. http://www.theregister.co.uk/2007/02/07/nao_epassport_report/

Passports cloned at BlackHat : http://www.wired.com/science/discoveries/news/2006/08/71521

Bruce Shneier commentary http://www.schneier.com/crypto-gram-0610.html#3

Tools and Information from RFIdiot http://www.rfidiot.org/

NO2ID.net http://www.no2id.net/

Electronic Frontier Foundation http://www.eff.org/Privacy/

RFID Security and Privacy http://www.rfid-cusp.org/ Also, 1G Vulnerabilities in Credit Cards

Potential misuse via a targetted IED ( Improvised Explosive Device ) http://www.youtube.com/watch?v=-XXaqraF7pI

Paper on RFID card security : http://www.riscure.com/2_news/200604%20CardsAsiaSing%20ePassport%20Privacy.pdf

Basic countermeasures !
( Thinking about reducing skimming attempts through shielding! )
RFID SHIELD http://www.rfid-shield.com/
DIFRwear http://difrwear.com/

The Elves and the Shoemaker ( Part 1 )

Q. When is your reality not your reality?
A. When it's somebody else's?

So excuse the existentialism for a moment and permit me if you will, to step back from the issue to elaborate more clearly my opinion of the forces at work at a deeper level. At no time in history has the rate of change, the terms of reference and the paradigms been so extraordinarily different as they are currently, especially for knowledge based/information economies, or other businesses and organisations that rely upon or use Information Technology.

As William Gibson said, "the future is already here , it's just unevenly distributed".

For some this creates an exciting, ever-changing, ever-learning environment in which one can in some ways actively contribute and watch the future unfold in 'realtime' like never before. In no other discipline (I use the term 'discipline' lightly ...) is this rate of change as pronounced as it is in Information Security/Protection/Assurance ... where one must be constantly abreast of new technologies and engaged in a never-ending cyber arms race in an effort to help defend an organisation's assets from malicious attack or unintended breaches in data and service integrity, confidentiality or availability. A mammoth task even in smaller organisations.

EDS may have tried to herd cats, but we in Infosec try to repel alien invasions, uncover national conspiracies, protect and serve, and offer matrix style A-team vigilantism served up with a side order of business acumen and a portion of savoir faire. Fun until you realise your noble pursuit of protecting the weak and innocent, fighting the forces of evil and saving the world from itself isn't necessarily shared by all elves. Funny that ... the naivety in thinking that there were no lazy, apathetic IT elves ... the realisation that all the IT elves must do their work to a certain level of quality and assurance for your work to even begin to be worthwhile, measurable, or at least have the other elves believe you when you tell them of the 'dark magic' that counteracts the good elven magic they are so used to (this of course without demonstrating 'dark magic' on production or development systems as we meanwhile wait for the 'dark elves' to try all manner of 'dark magic' until they install 'dark doors' that are practically untraceable ...)

For many in business, even in IT itself, it is easier to allow the elves to get on with their daily magic and then work with the ensuing results, embracing without question the supposed increases in productivity and efficiency.

Most beings work on a macro layer and let the elves create and dabble in even more elven magic to ensure the lower level elves and base magics behave themselves. What we don't know can't and shouldn't hurt us right?

Let's take an administrator, management entity or executive in the Grimm Brothers Ltd. shoe business as a potential test subject. They are constantly worried about profit, share value, productivity and efficiency (as they might be in any business). They don't actually need to fully grasp how the increases in output and efficiency are achieved by the latest and greatest elves and magic, just that they work and work well. Unfortunately conveying and measuring the potential pitfalls and complexity of using this magic is extremely hard to explain to anyone who doesn't have a grasp of the most basic and rudimentary tenets of elven magic. Problems are compounded by the outsourcing of elven work to other cheaper elven lands, or insisting upon the use of increasingly complex and esoteric elven magic - without keeping some local elves in reserve to do quality assurance, vendor management or governance. Somehow all elves should be trusted with all magic and unfortunately unmanageable and unmeasurable SLA's (Service Level Agreements) cannot and do not incur penalties. Increasingly and understandably management want to connect their business directly to 'other' realms in the hope of increased sales and access to more B2E (Business-to-Elf) services ...

Unfortunately these realms also contain both good and bad elves, dark magic ... and all number of mythical and mysterious self replicating evil beasties and other magical creatures.

One mis-spoken elven incantation (depending upon the situation and circumstance) can cause terrible horrors and cripple a shoe business, reducing them back to cobblers. Rumour has it that a certain shoe business continued to make a full month's worth of shoes in the wrong realm without anyone noticing, while the offending bad elf pocketed the money and sold the incantation to other bad elves to use on other similarly connected shoe businesses for fun and profit.

In what I will call 'standard industries', people, resources, inputs/outputs, and the processes in between have, for centuries, been producing products and services with ever more efficient physical world means. Problems were addressed with mainly conventional wisdom and experience was garnered slowly but surely. Information's potential for utility was dictated by its storage, processing, quantity and speed of access. There was time to learn and slowly adapt to changing markets and conditions. Knowledge was passed on and people generally knew what was going on (or at least you could look under the hood and somewhat infer the mechanism and physics of the system). There was no need for knowledge of the other 'realms' or of extra sneaky elven escapades. In fact way back then there were no elves and no magic!

I think society is now approaching the Shoe Event Horizon?

Hopefully this goes some way to highlighting the levels of abstraction, complexity and lack of care in use of even the most basic elven magic ... the fact that elven magic is almost ubiquitous in every aspect of modern society and becoming even more so, should be a warning flag of sorts. I am still a little iffy on how my fridge works ... thermodynamics and all that, but I'm damned sure no other realm's dark elven magic will leak in through my freezer box, monitor me and empty my online bank account.

a) Forest from the trees: Micro vs Macro

Where do IT Security managers/analysts/admins really sit in the hierarchy of the business? Are they perceived as generating value or just scaremongering? Do they actually understand the business themselves? How many cowboys are there currently in this business and do these professionals still have an active foot in the 'real' business generation of value? Are the security vendors only interested in selling more kit? Is it worth building robust products and services with longevity that won't necessarily generate repeat business, entail a support contract or restrict usage and try to enforce over zealous licensing requirements?

Are we generating more complexity every second, introducing more nodes and depth of code rather than reducing it and improving the quality? Is this really an increase in efficiency and manageability? How many layers of abstraction and protocols before one gets to the data object?

b) Understanding the business: Bottom lines and risk management?

I agree that the technically orientated need to understand the business more, but the business guys need to understand the technical aspects of the platforms and systems they employ also. Maybe the security guys need to have security relationship managers facing off to other parts of IT and the business, or would this just complicate matters? Must each security dude/manager be a CSO and CTO in their own right? Are we asking too much or too little?

How can one employ risk management techniques without first understanding the flows and business processes, rather than just the distinct packets and security posture of systems in isolation. How does one map a business that is changing at such a fast pace 'under the hood' as it relates to operating systems, custom code, new rollouts, decomissioning etc. How up-to-date and intergal is your DNS, logging, NTP, routing, host database and asset management? How integrated and aware are your change management and operational monitoring systems? How much confidence do you have in all this information and the dudes, dudettes or elves performing the changes? And is this all required across the board from SME's and up?

c) Culture and generational: Youth vs. Age and wisdom of both?

Who wants the equivalent of a spotty youth or young buck trying to convey a different paradigm of the world to a well established businessperson who has made their mark and 'understands' the business fully? Many questions abound here ... how long has one been in their role, are they keeping up-to-date, do they actually care, is it all too much and how often is 'the changing of the guard' occurring in the higher echelons of a business?

d) Communication and quantification: Describing and conveying risk?

You can't manage what you can't measure. What metrics are available or employed to convey meaning and progress? How do you value your data, systems, IP flows and business systems other than the physical asset values? How do you translate these abstract concepts and systems to other business decision makers? Are analogies a poor substitute for direct real evidence? So at the end of the day, what you are going to communicate precedes the how.

“Some day, on the corporate balance sheet, there will be an entry which reads, 'Information'; for in most cases, the information is more valuable than the hardware which processes it.”
Grace Murray Hopper

Metrics, metrics, metrics ... what, how, where and when to measure? How do you enumerate the risks? Some progress is being made, but we are at a very early stage. Definitions are still somewhat wishy washy, frameworks are like standards... 'the beauty is that there are so many to choose from'.

When IT products and commercial code are more regulated and built with greater tolerances we'll all be in a better place.... see here!

e) Rate of Change and Future Shock: Telescoping, new paradigms and new physics?

A while back on the Security Metrics mailing list I started a debate on the new world physics employed when dealing with Information Security/Protection. Dan Geer had a great paper on the issue of time and the geographic, physical and technical issues faced in cyberspace versus the physical world. I highly recommend it.

Executives, managers and all aspects of business (including elves) are experiencing 'Future Shock'; which is basically a 'culture shock' in our own society and time, where the rate of change constantly removes our terms of reference and leaves us alienated. Are you still trying to ride the wave of information overload and how do you hope to address it? Or are you starved of the quality of data you require to make effective and critical judgements for your life, liberty and the pursuit of business/happiness?

Do we really need more elves and magic right now?

It's much clearer now.

This explains many of my previous posts and some I am actually working on right now regarding 'Future Shock', e.g. moving towards a:

http://en.wikipedia.org/wiki/Technological_singularity

Funny how lots of research, conversations and other material leads you to the same conclusion after having come from many paths. Back to TED and Ray Kurzwell http://www.ted.com/tedtalks/tedtalksplayer.cfm?key=r_kurzweil

Are Biology and Technology the keys? Kevin Kelly on TED
http://www.ted.com/tedtalks/tedtalksplayer.cfm?key=k_kelly

This has only strengthened my resolve to find balance, master the mind, and address certain internal needs. Where are we racing to and what happens when we get there?

Does Eamonn Healy know? Telescopic Evolution
( Another excerpt from Richard Linklater's Waking Life )

Interconnectedness and transcience abound.

With Peak Oil ( ABC Video ) a seemingly plausible near term future on earth, should we not all be planning ahead and focussing on what really matters in life?

I think perhaps searching for a middle ground between permaculture and IT will be my path / purpose.

$$$ I have love in my tummy....

Just passing on the concept of passive income... though some seem more active to me in the long run :)

• Create Passive Income ( GeniusTypes.com )
  
• Blogging Manual ( GeniusTypes.com )
• Money from your blog ( StevePavlina.com )
  
• Six Figure Blogger ( Problogger.net )
• LinkBaiting ( www.SEOegghead.com )
• SuccessFromTheNest
  

Some other options:

• Revver.com
• iStockphoto.com
  

A World of Sheep?

Found this http://www.thesheepmarket.com/ while passing 'The Brain of Wade's post on information and Web2.0

It says many things to me about: possibilities, art, waste, control, tools and the most ironic thing of all.... many people in this world are SHEEP! It's time to wake up.

Required reading? Code v2.0

http://codev2.cc/ Free PDF download: http://codev2.cc/download+remix/

Amazon Description:
"There's a common belief that cyberspace cannot be regulated-that it is, in its very essence, immune from the government's (or anyone else's) control. Code, first published in 2000, argues that this belief is wrong. It is not in the nature of cyberspace to be unregulable; cyberspace has no "nature." It only has code-the software and hardware that make cyberspace what it is. That code can create a place of freedom-as the original architecture of the Net did-or a place of oppressive control. Under the influence of commerce, cyberpsace is becoming a highly regulable space, where behavior is much more tightly controlled than in real space. But that's not inevitable either. We can-we must-choose what kind of cyberspace we want and what freedoms we will guarantee. These choices are all about architecture: about what kind of code will govern cyberspace, and who will control it. In this realm, code is the most significant form of law, and it is up to lawyers, policymakers, and especially citizens to decide what values that code embodies."

Aside:

From http://www.paulgraham.com/opensource.html

"To me the most demoralizing aspect of the traditional office is that
you're supposed to be there at certain times. There are usually a few
people in a company who really have to, but the reason most employees
work fixed hours is that the company can't measure their productivity.

The basic idea behind office hours is that if you can't make people
work, you can at least prevent them from having fun. If employees have
to be in the building a certain number of hours a day, and are
forbidden to do non-work things while there, then they must be
working. In theory. In practice they spend a lot of their time in a
no-man's land, where they're neither working nor having fun."

Muhuhuhuhuh..hahahahahah!

"Alex Jones" in "Waking Life" by Richard Linklater

Here's also a great automated presentation about Copyright and free culture from none other than Lawrence Lessig http://lessig.org/freeculture/free.html

Ask yourself, what' life going to be like, in the future for your kids?

Synchronicity... again?

I came upon this ( http://www.worldchanging.com/book/ ) from the excellent TED talks ( http://www.ted.com/tedtalks/ ) and TED blog.... randomly clicking on Architecture.