Wired News: Feds Rethinking RFID Passport

It looks like enough bad publicity and folks in the know asking, "what the hell were you thinking?", was enough to get the State Department to reconsider their RFID plan for passports. They still want RFID chips, but they are now open to encrypting the data and placing the decryption key information on the passport. Decrypting the data would require scanning the passport (i.e., physical contact, like swiping a credit card). This allows the holder to know when his or her data is being read. It of course doesn't explain the need for the RFID chip in the first place.

CIO Today: Network Security - Apple Mythology and Desktop Security

A very well-written article at CIO Today, linked from the title above. The author makes one of the first mentions I've heard in a trade journal of the security risks of Intel hardware, regardless of OS, and the benefits of switching to non-Intel (e.g., PowerPC) hardware, again regardless of OS. He also attempts to drive a stake through the heart of the "Macs are expensive" myth. The closing quote from the article:

In other words, if security concerns are your most important driver for desktop change, and Microsoft Office compatibility is your most significant barrier, then switching to Macs actually offers you the best of all possible worlds. Microsoft Office on Unix/Risc with a better GUI, longer product life, some cash savings and a performance bonus thrown in.

Computerworld: What IT Women Want

Computerworld had a discussion with a group of "highly successful businesswomen" after their participation in a forum sponsored by the New Jersey chapter of the Society for Information Management. They discussed the (declining) participation of women in information technology careers. Some interesting points, with editorial comments from yours truly:

• The very familiar forecast of massive looming shortage of professionals. You know, folks are always saying that there will be a shortage of computer professionals X years from now, where X>0 and never seems to decrease. Yes, developers were getting some pretty outrageous benefits during the dot com bubble, but that was merely a symptom of a mania, not a structural shortage of workers. Not to say that a career in CS or IT isn't a good choice, but a "35 million-person labor shortage" by 2031 is just a crazy forecast (like the dot com forecasts of Dow 20K).
• "If I get a call from a client and there's a crisis, but the next call is the nurse at my child's school, am I going to hop on a plane and fly to Chicago or get in the car and drive to the school? Many women would choose to go to the child. If society wants women to make that choice, how do we handle that in terms of our need to excel in our careers?" And why would we expect a man to ditch his kid and get to work? Society's mouth may say "choose to go to the child," but its lips say, "get your priorities straight" (the job should come first).
• Much of the discussion focused on hiring and career development, rather than the front end of the pipeline: why fewer and fewer women are choosing CS and IT careers.

Improving SCI submissions: A mathematical theory of citing

What with all the recent talk about fake CS papers, the linked physics paper caught my attention. I don't mean that I think the paper is fake, merely that it raises some interesting possibilities for improving the quality of fake papers (in terms of the statistics of their citations).

A CS gotcha

As Suresh at The Geomblog alerts, those unethical grad students who wrote SCIgen have been found out and their paper post hoc rejected. At least they got their money back. They are still looking to present at the conference, so if you've got a paper accepted and weren't planning to attend, please contact them. In his reply to the students, Prof. Nagib Callaos says:

I am not sure how unethical are these bogus submissions, and if there is some way to detect all of them in a large conference.

He's probably right that there is no way to ensure that no paper built upon falsified results gets ever accepted, but I know how patently bogus papers can be detected: by actually reviewing them. A reviewer who reads the submissions will be able to detect, for example two papers, combined sentence by sentence, so that the text alternates line by line between two topics.

The life of an academic

A bit of a common thread in today's reading:

I'm doing something wrong. In the past few months, my weekly schedule has filled up with back-to-back appointments. I'm wedging meetings in everywhere. I don't even have time to eat. Aren't professors supposed to spend all their time outside of class at the corner cafe discussing Chomsky over espressos and cigarettes? With summers off, so that the discussion can be continued at a cafe in Provence?
    -- A Gentleman's C, "What's wrong with this picture?"

I’m stressed out. I’ve been stressed out for a long time now. I can’t even recall last time I was laid back.
    -- Daniel Lemire’s blog, "Managing stress: I want to live past 50"

Competition can be a good thing: thinking about our colleagues' work can goad us to achievements that we otherwise wouldn't have reached or would have reached months or years later. But at what price? We see competitive athletes risking their health with steroids as a relatively new phenomenon, but sacrificing one's health has been de rigeur in academia for a long time. And we can't even say, like a businessperson might, that there are financial rewards for this. And yet, the extraordinary has now become the expected, as it becomes not uncommon to hear things such as (from a colleague at an anonymous science department), "We wouldn't hire a woman unless she's already won a Nobel Prize. Women just don't work hard enough." There it is: the expectation that university faculty will sacrifice their personal lives, their family lives, their health, to get out another paper, another grant proposal, be on another committee, (and at some schools) teach another course.

Intelligent Design Humor

I just about fell out of my chair laughing when I saw the photo of the "office suite" of the International Society for Complexity, Information, and Design in Princeton, NJ, linked to from this post's title.

Automatic CS Paper Generation and Bogus Conferences

The title above links to a web page about SCIgen - An Automatic CS Paper Generator: a program that generates fake computer science research papers. This came to my attention via an email about a boing boing article about it. The reason I'm blogging about this is that reminded me about my own first encounter with the World Multi-Conference on Systemics, Cybernetics and Informatics, back in 2002. This conference poses as a serious interdisciplinary conference, but actually only seems to serve to make money for the organizers. At the time, I found information about the conference at this web page and this web page (courtesy of the internet wayback machine), the latter which presents a company with the same name as the conference's seemingly permanent General Chair, Nagib Callaos, that has a seminar speaker (follow the "management seminars" link) who seems to be the conference's permanent Program Committee Chair, William Lesso.

As Big Brother goes digital

Amplifying on a previous post of mine, the title links to an article from EE Times about RFID chips in passports. Briefly, the Administration saw that they couldn't get this past Congress, so instead they got the International Civil Aviation Organization to agree to it and used that agreement to get Congress to approve making US passports adhere to the new "international standard". The problem with these chips is twofold:

1. The data is stored unencrypted, so anyone (not just governments) can read it.
2. Because RFID is used (rather than a method requiring physical contact), the data can be retrieved remotely, without knowledge of the passport carrier.

This raises the possibility of such passports being a "dream" for identity thieves and terrorists: the ability to read large amounts of identity information (including nationality) remotely and discreetly. If such technology gets incorporated into daily-use IDs (such as driver's licenses, implicit in the "Real ID Act"), then it becomes feasible for governments and corporations to track the movements of individuals as they pass by RFID readers embedded in doorways, elevators, buses, light poles, whatever.

The story of a plagiarist

Well, it seems I'm late to a party that everyone else has already blogged about and left, but what the hell. The title above links to the start of a story by Nate Kushner about his being contacted by a stranger to write a paper for her to hand in for an assignment in a college course. To make a long story short, idle hands are the Devil's workshop, and Nate writes her a bogus paper, gets her name and college information, and then rats her out.

I, unfortunately, have experience with plagiarism from the receiving end. The method used by this student may have been unusual -- it's an unfortunate fact that there exist web sites that cater to matching plagiarists with people to do their work for hire. (Note to my students: I know about these sites, and troll them for solicitations for my own class assignments.) While I sympathize with the stress that a student may feel (though, in the case here, it seems more likely that this was S.O.P. for the student in question), there is no getting around the fact that plagiarism is as much theft as robbing a convenience store.

Remote device fingerprinting -- a new privacy concern

The linked paper describes a method for uniquely identifying computers from remote locations. This device "fingerprinting" relies on identification of clock skews -- the difference in the rate of "ticking" of a computer's internal clock versus some reference clock -- based on time stamps incorporated into the low-level packets of information that make up internet communications. It turns out that this skew is, to a great extent, unique to each combination of machine and operating system and is reasonably constant despite geographic location and network connectivity. This approach would allow a web site, for instance, to identify client computers without the use of cookies. It would also allow anyone who can attach a computer to a network backbone to scan for a set of computers that are under surveillance. Shades of Carnivore.

The article ends with the following: "Our results compellingly illustrate a fundamental reason why securing real-world systems is so genuinely difficult: it is possible to extract security-relevant signals from data canonically considered to be noise. This aspect renders perfect security elusive, and even more ominously suggests that there remain fundamental properties of networks that we have yet to integrate into our security models." Those of us concerned with our privacy take great care to ensure, for example, that we only allow certain sites to store cookies in our web browsers and that each cookie can only be retrieved by the storing site. In that respect, cookies are fairly privacy/security benign. Methods like those in this paper will require explicit counter-measures. For this particular approach, it appears (judging from the results in Table 5 of the paper) that software can be used to alter the skew, randomizing it to foil fingerprinting. But I wonder about other measurable patterns of computer network activity. It might even be possible to use network activity patterns to identify users, even if they switch computers.

The end of my portable computing problems?

I'm in a bit of a bind regarding portable computing devices. My Powerbook is too big to lug around everywhere. I have a Sharp Zaurus, which is pretty much a full-featured Linux machine in a PDA package. It's still a bit big; I have to carry it around in a belt holster. I have a Sony Ericsson T637 cell phone. It's very small; fits in my pocket. It has alarms and a phone book, but is only about 75% of the way there as far as PDA functions. Part of the reason the cell phone isn't a sufficient PDA platform is software, but part is hardware: a tiny display and painful input method. given the hardware limitations, I don't blame Sony for not including more robust software.

Well, one part of the hardware problem appears to be solved in the near future. The linked New York Times article describes flexible display technology that Philips Polymer Vision will be bringing to the market within a couple years (they apparently will be showing a prototype device in a couple months). Basically, these (initially 5" diagonal) displays can be rolled up inside the body of a device, where a small portion could be exposed to view. You can then pull the full display out when you need it. Finally, a decent-sized display that fits in a (normal) packet.

Maser developer has difficulty understanding conditional probability

I heard the interview linked from this post's title on Morning Edition on National Public Radio this morning, and for a bit, thought I was still semi-conscious. The story was about Dr. Charles Townes who, along with Dr. Arthur Schawlow, developed the maser (microwave amplification by stimulated emission) -- the longer-wavelength precursor to the laser. Dr. Townes shared the 1964 Nobel Prize in Physics for this work.

Now, what stood out as unusual was that the story was about his receiving the "Templeton Prize" for his work in the field of religion.

This prize is awarded by the John Templeton Foundation, an organization devoted to the intersection between science and religion. I've looked through their web site, and they don't seem on the surface to be religious right crazies (if someone ever reads this and knows more, please drop me a line or add a comment). According to this June 2004 article, Townes is on the Templeton Foundation Board of Advisors.

What stuck out in my mind was Townes' comments on what one might call "cosmological intelligent design" (see the last paragraph of this Cornell news story. Basically, like aficionados of "intelligent design" as a stealth way of inserting religion into the biology curriculum, he reasons that the universe must have been designed with life in mind, because it is so improbable that the universe's physical laws would turn out "just right" for life to arise. In fact, it is true that physicists don't currently know why various underlying physical constants have the values they do, thought only fairly narrow ranges would produce universes suitable for life.

This is an old argument against science in general and evolution in particular: that since we can't explain everything right now, that must mean that God set things up. Besides the logical fallacy, there is a fundamental probabilistic fallacy in this. Let's imagine that many, many universes could be created, and only a small fraction would have physical laws suitable for life. to make things concrete, I'll use 0.0001 as a small probability, but any number would work. So, the probability of a suitable universe is P(S) = 0.0001. Let's also assume that, even if the universe is suitable, the probability of life arising is small, too (again, the number actually doesn't matter). This is a conditional probability, the probability of life given we know the universe is suitable, P(L|S) = 0.0001. We also know that life cannot arise if the universe is not suitable, P(L|~S) = 0. So, the a priori probability of life occurring in a universe, before we checked to see if the universe is suitable, is P(L) = P(S) P(L|S) = 10^-8.

What we want to know is the probability that the universe is suitable, given that there is life in it. This is exactly what Townes is having a problem with -- we've already seen that P(S) and P(L) are very small, so there's no way that this suitable universe could have happened "by chance". (Of course, we don't know that it was by chance, but that's beside my point here.) Actually, however, that is not true -- given that we exist (otherwise, we wouldn't be around to be amazed by this improbable-seeming universe), the probability that the universe is suitable is 100%, P(S|L)=1. There are a variety of ways of arriving at this; I'll use Bayes' rule (not the simplest way to do it), but it's really a tautology of the math.

Bayes' rule allows us to reason from evidence back to cause, given that we understand ahead of time how the cause relates to the evidence. For our suitable universe, the rule is:
P(S|L) = P(L|S) P(S)/P(L) = (0.0001)(0.0001)/(10^-8) = 1

As we can see now, the numbers don't matter because P(L) = P(L|S) P(S), which is true because P(L|~S) = 0. In other words, of course we see that the universe is suitable for life; if it weren't suitable, we wouldn't be here! The same reasoning can be applied to evolution. It doesn't matter how improbable the evolution of intelligence is, the fact is that only intelligent life can ponder such matters, and so all such conditional probabilities are actually certainties.

Note added 3/11/2005: There's a great FAQ on the "Anthropic Principle" that you should read, if you're interested in this sort of thing.

[+/-] show/hide the rest of this post

More cool software: Doxygen

Since I teach my students to document their code well, and since I've had long experience of not being able to make heads or tails of my own code after more than a couple days, I've been working on making my own code's documentation more useful. I had been using Apple's HeaderDoc software,

which converts JavaDoc-like comments in code to HTML. It's a bit clunky, but OK. Then, I tried Doxygen, a truly incredible package. First off, it will do almost everything without special markup: UML class diagrams, class hierarchies, call graphs, header include dependency graphs, cross references to called functions, etc. So you can use it to extract code structure to reverse engineer and reuse undocumented source files. Using the Graphviz package, it generates beautiful graphs. If you have comments before each class, method, and variable, all that will automatically get included in the generated documentation. If the comments were to include, for example, XML, it will detect that XML's structure and format it with appropriate indentation. You can also include a wide range of Doxygen-specific markup to create explicit links, file dates and versions, numbered or bulleted lists, mathematical formulas, etc. And, while I'm using it for C++, it works for many different input languages.

Note that I haven't mentioned output format. That's because Doxygen will output just about anything you'd want: HTML (with and without frames), LATEX, RTF (for MS Word), Postscript, PDF (with hyperlinks), compressed HTML (for Windows Help), and Unix man pages. The original source code can be included with the documentation, which means the HTML output is really an absolutely complete documentation web site for the project. The output can be completely customized to "brand" the documentation as you like. The only downside I see is that you must rebuild all of the documentation, rather than just the documentation for a changed file (probably unavoidable, given that the software automatically determines and documents interdependencies). If you write code, I think you'll agree that Doxygen will make your work look good.

[+/-] show/hide the rest of this post

Cool software: SnipSnap

I've been contemplating the use of blogs and their ilk for something other than feeding my egotism. More specifically, one of the weaknesses of the blog format is that it is only organized chronologically. Yes, you can create indices in some blog software, and since every post has a permanent link, you can freely interlink them. But, generally speaking, there's a fair amount of effort involved in maintaining those additional links, plus the time needed to administer your own blog software (which is why I'm using Blogger).

Well, I ran across some software this week that fixes most of these issues: SnipSnap.

SnipSnap is a combination of blog and wiki software. If you're not familiar with wiki software, you can think of it as very flexible, simple knowledge/content management software. Articles placed in the wiki can be interconnected based on their titles (more or less), hierarchically, and by assigned labels (at the least). Articles placed in the blog are organized chronologically and also by title and label. Wiki software emphasizes customizability, with users typically empowered to edit most any document and even changing the the site's organization. Everything can be stored in a backend database. Anyway, if you already knew about wikis then the foregoing sounded pretty lame; if you didn't, it may have piqued your interest.

The great things about SnipSnap are that it is cross platform (written in Java) and incredibly easy to install and get up and running. if you don't want to customize it much, it literally takes about five minutes (at most) from binary installation to up and running. I installed it on my home file server and spent more time playing with it to have it place its data where I wanted it, run under a non-privileged user, and set up an ssh tunnel through the firewall. As I evaluate how it fits into our workflow, my wife and I will use it to store recipes, notes about the kids' education (homeworks, tests, etc.), various records (for example, notes from doctors visits), software development notes (UML diagrams, debugging and design notes), research lab book entries (what was done, results), etc., etc. I'd eventually be interested in incorporating it into my research lab. There are only two things missing that I might want: real calendaring (schedule future events, set notifications, later edit them to note results -- all with the usual organization and linking ability) and more comprehensive security options (option to login before seeing anything, per-item or hierarchy level access control). Some aspects of these may already exist as contributed plugins; I haven't had time to look into everything about it yet (it's easy enough to get going that there has been no need to). And it's open source.

[+/-] show/hide the rest of this post