Category Archives: Ze Rest of Ze Ztuffm

Writing InfoSec Fiction

Leave a reply

When I first started serious creative writing efforts back in 1997, I had no idea that, 20 years later, I’d be writing about how to write InfoSec fiction. Not only did I not even know how to write fiction, period, InfoSec was pretty much a matter of having an antivirus program and locking the doors to the server rooms. And firewalls, I remember we had just started to have firewalls back then.

Well, enough reminiscing and pondering about how I found myself to be where I am now. I have a purpose, best I get to it.

First off, let’s cover how to write well. It’s not all that difficult. Here are the rules of good writing, as they were taught to me by good writers.

1. Show, don’t tell.

2. Nouns and verbs always beat adjectives and adverbs.

3. Some things are better left to the reader’s imagination.

4. Dialogue should sound like dialogue.

5. Get rid of as many “to be” verbs as you can.

1. Show, don’t tell… that’s the toughest one of all, because we want to explain our thoughts in great detail. Well, that’s technical writing, not fiction writing. How many stories, especially science fiction stories, have gotten bogged down because the characters start explaining all. the. things. The readers will figure out how stuff works as it gets used, don’t worry. Saying “The zapotron ray carved a massive opening into the reactor core, yet none of the radioactivity leaked out” is preferable to the characters spending multiple paragraphs about zapotron technology and why it would be preferable in this situation as compared to, say, an unobtanium battering ram.

In that above example, did I myself go into those technologies? I did not. And yet, each reader now has an idea about them. Show, don’t tell. If I do any more here, I’m telling, not showing, and I’m not about to slide into hypocrisy like that.

2. Nouns and verbs… Rushing beats running quickly. The giant beats the really tall and really big guy. If you have to use an adjective or adverb, make sure it’s not with a plain noun or verb. The exception to this would be in dialogue, where if a person is likely to violate good rules of writing in his or her speech, then it’s good writing to have the character talk that way.

3. Leaving things to the imagination… what’s more scary, the huge hairy spider looming over your right shoulder or… that… THING! AAAAAHH! IT’S COMING FOR YOU! RUN! RUN TOWARDS THE SPIDER!

See what I did there? Consider this an extension of “show, don’t tell.” As I tried to make something scarier than the gigantic spider, I conjured up a notion of something so awful and immediately threatening that your best hope was to run towards the very thing I suggested was fearsome at the beginning of the comparison. And now, by telling all about how I did that trick, I took all the fun out of it. Show, don’t tell, that’s the moral, here. That, and run towards the spider if you’re in that situation, for God’s sake.

Imagination is best when you want to create feeling and mood in your reader. Sometimes, it means ending a story before they want it to end, but, hey, that’s life and good writing.

4. Dialogue… there’s external dialogue. Like my English teacher once said, “When other characters speak, they can reveal so much more with carefully-chosen words, which you want on your side when you fight against Godless Commies.”

Then there’s internal dialogue. One option is to just explain things, but in a dialogue-y way, where you bend words and stuff like that. Stuff that drove my ultra-right English teacher up the wall. Or you can italicize. How do I reconcile my relationship to my English teacher? I mean, she was brilliant, taught me all I needed to know about grammar and writing… but that shrine dedicated to Mussolini in the back of the room? Really? Mrs. Paganini was a complicated person, that was for certain…

Above all, dialogue needs to sound like people talking. Stylistically, if a new character speaks, start a new paragraph. Try to not have a character say too much in one go, it can lose readers.

“You think those ideas work all the time?” a reader asked.

“They’ve served me well,” I said.

“How do I know this isn’t more of Mrs. Paganini’s neo-fascist propaganda?”

I thought a moment. “I guess you can tell it’s not that because one, I’m not wearing a paramilitary uniform, and, two, not once have I spoken about the need to invade either Ethiopia or Albania.”

My reader nodded, satisfied in my answer.

5. Getting rid of “to be” verbs. Remember up in 2, where I talked about nouns and adjectives, how I said “beats” instead of “is better than”? Getting rid of is, are, will be, was, all those “to be” verbs will force you to use actual action words, and that moves the story forward in an interesting way.

***

OK, so those are the rules of good writing. I’d also recommend reading Socrates’ “Poetics” for some tips. It’s a short piece and well worth your time. It’ll also explain why that huge race sequence in “The Phantom Menace” was such a beat-down… put effects ahead of plot and character…

I’d also recommend reading things that help the InfoSec mindset. Look to Eastern Europe for fiction authors and look to trade journals for jumping-off points for stories.

My reading list will include films, but since I use subtitles, I’m still reading them, aren’t I?

Arkady and Boris Strugatsky – Roadside Picnic; Stanislav Lem – Everything he wrote, go for Cyberiad, Solaris, and Memoirs Found in a Bathtub; P.D. Ouspensky – The Strange Life of Ivan Osokin; Vladimir Savchenko – Self-discovery

For the films, go to the Mosfilm YouTube channel and watch Solaris, Stalker, Kin Dza Dza – those are the intro to Soviet sci-fi, which is much more cerebral and psychological than US sci-fi, which tends to resolve issues through violence and/or application of brute physics.

While you’re on Mosfilm, consider also Ivan the Terrible (Ivan Grozny), Ivan Vasilievich Changes Careers, and White Tiger (Belyy Tigr). The first is a pair of films that was Game of Thrones stuff decades before HBO, the second is a wild time-travel romp, the third is about a man who can speak with tanks in WW2.

Also consider the Czech film, “Tomorrow I’ll Wake Up and Scald Myself with Tea”. Why? It’s about things going wrong, and that’s what security is all about.

Once you’re paranoid and twisted in your thinking, you’ll read trade journals and start to get ideas about how things go wrong. You’ll read marketing materials from vendors that promise the moon and see holes in their logic that may deliver a shattered earth instead of a new world. You’ll see reports on outages and mentally explore what’s not reported, how much worse it could be.

Then, you’ll want to write that story.

***

We’ve gone from fiction writing to science fiction writing (briefly) and now we’re ready to deal specifically with InfoSec fiction writing. There are no rules for it yet, because as far as I know, there’s only a handful of people trying to write it, and I’m one of them. So I’ll go into my philosophy, and I’ll try to show instead of tell as much as possible.

The short story is ideal for InfoSec fiction. The short story in sci-fi takes a small concept, a gimmick, and toys around with it. The gimmick is the center of the story, so it won’t last very long at all. It’s not a character, so it shouldn’t be pushed all that far. There will be people and things reacting to, planning to use, and being affected by the gimmick, but the gimmick is the center of attention.

Consider a story about a guy using Internet-enabled footwear that’s also equipped with a flash drive and a toner-like device that can pick up signals from network cables. Fun will be had in the story, but it’s over as soon as he visits the coffee shop and uploads his stolen data to the highest bidder. Maybe it’s over now, but that’s how it goes with the gimmick. It’s a short story, but a merry one.

Writing a longer story runs the risk of getting preachy. If your characters are starting to launch into long dialogues explaining best practices, you are writing an editorial at best and a user manual at worst. If your tale has legs and it’s going to travel into the land of 10-40K words, you’re into novella country, and that demands a different focus for your writing.

Novellas have to be character-centered. This means the focus is not on the technology, but on a person using/affected by the technology. The exposition is about the character in relation to that technology, and the temptation to get preachy will try to overpower you. Resist. Stay with that character and his or her moral journey, as he or she struggles with A Big Decision. For it to be InfoSec related, the Big Decision needs to be related to that technology. A plot in which a jilted lover considers killing his former love becomes an InfoSec plot when he ponders the killing by way of a drone strike, homed in on the former love’s cell phone location… and then, to his horror, he realizes the drone strike took out an innocent because the former lover dropped the phone in the parking lot and the innocent picked it up to go return it to the nearby store’s lost and found. The actual strike and realization would be the climax of the story, unless we want this to be a psychological tale about the killer being caught and being sentenced to work out his problems with an AI counselor… that may have a few flaws in its code…

Novels are big things. If you’ve got the nerve to write an InfoSec novel, good luck with that. If you can keep from preaching and make it all about a group of characters dealing with a world changed by a technology, you’ve got a sci-fi novel. To make it InfoSec, those characters deal with a world changed by the *flaws* in a technology.

That’s the biggest part of InfoSec writing, in my view. We confront the promise of better living through technology and poke at the weaknesses in that premise. We ask what can possibly go wrong and then unleash that vulnerability on our characters. Sometimes, our characters are resilient and deal with the problem. In such cases, I’d recommend no neat and tidy happy ending. The characters dealt with the problem, but now they live in a patched world, and they have to be on their guard just in case the patch introduced a new vulnerability.

An InfoSec writer also has to face a decision whether or not the story will be hard science or more Hollywood in its portrayal of technology. My style leans mostly towards hard science. I want things to be highly accurate. My characters will never ping 10.800.1.1. My characters will never have a program with a GUI that looks like it was designed by a special effects company. My characters plow through huge logfiles, they run Wireshark and pore over the captures, and they get mandatory reboots of their OS at the worst possible times.

But, there are times where I want to go Hollywood. In these stories, I create a fantasyland where all is well, all is good, there is better living through technology for all… except, hey, what’s this little red button do? Ah, it reveals that the makers of this heaven were really humans and there are devils from our own day and age in those futuristic details! Here we are in the year 2877, but the world comes crashing down because the code is backward-compatible to run a DOS 5.0 program… in so doing, I’m able to point out the folly of assuming backward-compatible code is secure, but *without getting preachy*.

I just realized I was getting preachy about not getting preachy, so maybe I should leave the rest to your imaginations and end my essay here.

Or should I say “show, don’t tell” one more time? Where is Clippy to help me finish writing a story when I need him the most?

God and Public-Private Key Cryptography

Leave a reply

Let me begin my essay by saying that I am a Christian, and a member of The Church of Jesus Christ of Latter-day Saints, at that. My religious views are obviously shaped by my religion, but perhaps what I have to say will be of value to other Christians and possibly even to people of other faiths. My core message is that there is a God, He does speak to us, and there are ways in which we can grow in our understanding.

God does not lay all his secrets out, for all to behold at whim and at will. But He does make available methods by which his secrets can be revealed and, more importantly, understood. These methods are available to all, but employing them requires no small amount of effort.

What I am proposing is not Gnosticism, that these secrets are necessary knowledge in order to gain a happier state after death. Rather, salvation is something that can happen independently of deeper understanding and that the deeper understanding is there for those who seek and desire it. Prefer a simpler life? Not a problem with God. But I do propose that even those who think they are living simply may, by virtue of the way in which they live, still receive revelation, understanding, and wisdom because the way in which they live allows them to decrypt messages from God.

The word “decrypt” leads me to my analogy. I hold the view that God speaks to man constantly, but that man does not always receive those messages. What is not received cannot be understood. Therefore, we must be in a state in which we are able to receive a message from God. That means, we take it in and process it, not just toss it out with the junk impressions we ignore constantly throughout the day. How do we attain such a state? It is different for each person, but generally requires a mind ready to be taught any lesson. Whatever else we do to help sensitize ourselves to promptings from the Divine – abstinence, study, repentance – can add to that preparation.

Perhaps the first few messages from God are simple ones – He is there, He loves us, He has something for us to learn that requires we be away from His presence. These can arrive to us in many ways, but when we are ready to hear these messages, we accept them and we seek verification. I believe that God can send that verification, and it is much in the same sort of way that, when we go to a secure website, we validate the certificate presented by that website. The browser receives the certificate and then checks with the certificate authority that issued it and verifies that the certificate is both valid and unexpired. Once those checks have been done, the browser shows the green lock, etc., and allows us in to the secure website. For the sake of the analogy, the cert is truly valid and the browser is not compromised and other “happy path” conditions are satisfied.

Should there be a problem with the cert, the browser displays a warning and either forbids us to go further or only allows us if we are truly determined and know where to click. So it is in our minds. We can hear messages that seem to have a divine origin, but they simply don’t ring true. There is no edification, no clarity, no resonance in them. The same can happen for actual divine messages when we are not prepared to receive them, but that has more to do with our inability to receive the full message. Without a full message, a partial certificate will fail in its validation check.

But, here, we have a message from God and it leads us to feel at peace. We see things, and they make sense. We feel as though something good is coming of this. I believe that the Holy Spirit will also provide a warm feeling, a sensation within the body that arouses it to an emotional response not unlike love. Your faith may have other words or ways to explain this, but nearly all faiths speak of enlightenments, ecstasies, and epiphanies. This is that such thing.

But this is also only the introductory message, one that can be given freely to all who are ready to receive it. What, then, of deeper understandings?

For more secure transactions, for more engaged communications, we need public-private key cryptography. In this, there is a private key that everyone, even God, has. This private key is used for our own encryption. If we say something that we want someone else to understand and perhaps no one else, we use our private key to encrypt the message.

The problem is that no one will be able to decrypt that message without our private key. This is where the public keys enter into the picture. If you give me your public key and I give you mine, we can use the other person’s public keys as we encrypt our messages in such a way that our own private keys are able to decrypt the messages we receive from the trusted person we have exchanged public keys with.

In computing, those public keys must be validated and communications have to be set up in order to have a trust established that allows the exchange of those keys. This is done with packets and such, and I will pass over the technical details. Readers are invited to read more about how public-private key encryption works, if they are curious about the matter.

In life, our exchange of public keys with God is made through covenants. A covenant is a two-way promise in which each party provides something and receives something. We enter into covenants solemnly and, in that solemn moment, God provides us with what we need to begin to understand Him. In my belief, the first covenant is baptism. In other beliefs, it may be a profession of faith or an act of worshipful devotion, but the promise to serve God is made and, in return, God promises to serve us. This is our key exchange.

At this point, we are able to not just get messages from God, but unscramble them. We are able to take what we receive and find deeper meaning in it. We are able to take the deeper meanings and derive wisdom from them. That wisdom, in turn, helps us to live lives of peace and love, even if there is pain and strife around us.

In proper cryptography, keys are renewed from time to time. So it is with God. We must be about the business of renewing our covenants if we wish to continue to receive wisdom from Him. Failing to renew our faith means the messages we do get are not able to uplift us any more because we cannot decrypt them. If we continue in not renewing our faith, we eventually no longer receive those messages as we once did and we may even think that all that communication was imaginary.

But if we do renew our faith, if we do renew our covenants with God, if we strive to keep ourselves clean, if we treat others with respect and care, if we give help to those in need of it, we renew those keys to understanding and we find treasures of yet deeper wisdom.

I would say that a similar thing happens with close friends and people that we love. Our covenants with them lead us to deeper, more meaningful bonds that can serve as an example of the relationship we should have with God. The same love that I have for my wife and the whole of my family teaches me the way in which I must also love my God, for God is love. It is through love that we prepare ourselves to receive Him and His messages and it is through love that we renew our covenants, that we might continue to receive Him and His messages.

Without love, there is no understanding. Without love, we may as well study random letters instead of scriptures. Without love, we may as well listen to static instead of a message of peace. With love, things become much more clear. Though the lives we live may be trimmed in sadness and hardship, love is able to allow us to see that mortality is only a part of our eternal existence, and that with love we are capable of so much more with that eternal existence. Love, renewed love, is the true key to understanding God. Share the keys of love with others, that they might also come to understand God.

Ranking Seinfeld

Leave a reply

Before going to sleep, I like to watch an episode or two of Seinfeld to unwind. I like that series in general because there’s very little in it that gets me in trouble. Shows about married guys making mistakes can be way too stressful, as my wife may transfer the mistake on teevee to me. Not good. No, the guys in Seinfeld are different enough from me that I can count on them to do stuff I’d never do. Hence, it’s great to unwind to.

It’s also one of the best comedy series ever done. Nine seasons of classic comedy. Well, more or less…

See, that’s why I’m ranking them. I have seen other people’s lists and they don’t ring true. They pick episodes because of a cultural impact or because they remember some aspect vividly. I don’t see any criteria used for judging. Without criteria, any system of ranking is flawed. My system is based upon awarding up to 30 points per episode. Here’s how it breaks down:

MAJOR CHARACTERS: Jerry, George, Kramer, and Elaine can each score up to 3 points per episode, one point per third of the episode as a general rule. Truly exceptional blow-ups, outbursts, etc. can warrant a 4th point – so far, I’ve only awarded that 4th major character point in two episodes, one for Kramer dumping cement into a washing machine (exceptional physical comedy) and one for Elaine’s attempted eviction of a do-nothing boyfriend, culminating in her celebrated “Van Wyck” monologue. That’s it. Everything else can top out at three. To earn a point, the major character basically has to have a decent chunk of lines. If all the character does is play straight man, no point for that third.

In the first season, there are episodes in which a major character appears and has nothing but dud lines. That’s the low end of the scale, for sure.

OTHER CHARACTERS: When other characters make life difficult for Jerry and the gang, the show powers ahead with comedy gold. When the other characters just go on dates with Jerry and the gang, the show tanks. This isn’t a relationship comedy. It may be a show about nothing, but we need to see how even crazy, colorful, larger-than-life characters can get sucked into the nothingness. When the others show up and crack wise, the show is richer for it. Up to five points per episode can go towards what other characters do.

DIALOGUE: When we get those extra zingers, the episode scores dialogue points. This is more than just a great scene: this is a great line, that we want to repeat over and over in order to relish. Up to five points per episode go towards the “No soup for you!”-type lines.

SITUATIONS: For a show about nothing, we still need great situations for the characters to not learn from or to grow personally from. These are the situations that become cautionary fables, the plots to collect cans in New York and drive them to Michigan, the plan to buy back the Cadillac from Jack Klompus, the need to bring Mr. Steinbrenner a calzone. Each major character can score a point for a great situation that they fall into: if all the situations tie into each other, or one goes over the top, situation point number 5 can be scored.

PERVERSE ENDING: Season one tied things up by the end of the show and we were left with nothing to talk about during the closing credits. Later seasons realized the potential for having fate deal one last blow to the characters. They would not learn a moral lesson from these things, but they would potentially sharpen their animal instincts in knowing what to avoid in the future. Up to three points can go towards George showing up in the coffee shop wearing a sheet, Susan licking the envelopes, or an Ohio farmgirl pledging her love to Norman…

ENOUGH ALREADY: Penalty points, no limit on them. When I’m watching an episode and going, “Enough already with this” over a scene or a bit, I take a point off. Season one is loaded with these moments of pain as we endure Jerry or George having a normal date with a normal person that’s just going bad by a little bit. We need things going off the rails. We need explosions on the launch pad. We need avalanches and landslides, not rainy weekends in Vermont.

That’s my rubric. It is somewhat subjective, true. However, it allows me to justify my rankings for the shows and to let me see what’s needed to make a show truly epic instead of just good. I’ll write more about my rankings in the coming days, since I’ve got this spreadsheet of numbers and totals and I might as well get into the science of comedy with this data I’m collecting.

New Web Host

Leave a reply

Just moved to a new web host after many great years with my friend, Dave Rolling at Infovue. The seasons change, and he is discontinuing his services. It’s sad that I won’t be getting tech support from a good friend, but life – and the Internet – goes on. Best of luck to Dave and his work, and I know I’ll always fondly remember my 17+ years with his hosting.My new host is bluehost and i got a nice deal from them trough a BlueHost Black Friday Deal.

Are We the Bad Guys?

Leave a reply

This is always a good question to ask. There’s a very wry bit by the British comedy duo Mitchell and Webb (no close relation, I think) in which they portray German SS officers on the Russian Front. One asks, “Are we the baddies?” and then notes how they have skulls on their uniforms, and how that’s never a good sign.

I’m currently touring Civil Rights sites in the USA, and although not all the horrors visited upon those who fought for their rights were done by men with skulls on their uniforms, there were clear signs of “bad guy” behaviors that should have been reviewed and then abandoned by those who did not want to be actual bad guys. Keep in mind that merely fighting other bad guys alone is not sufficient evidence of being a good guy. There are lots of times that bad guys fight other bad guys.

So, here’s a checklist of things that bad guys do. If you are doing them, please stop. If people on your political side are doing them, please get them to stop or, failing that, disavow their extremism vocally and oppose it at every turn, so as not to have your own political position undermined by its association with bad guys. Now, the list:

1. INTIMIDATION… this is a big one. When, in response to a reasoned argument or appeal to mercy, one chooses instead to emphasize one’s power of one form or another, that is intimidation. Bad guys are always doing this thing, and it underlines the lack of justification for a particular position.

2. VIOLENCE… this one is frequently employed when the intimidation fails. If one has to initiate aggression in order to maintain one’s views and preferences, one likely has views and preferences that are wrong. At any rate, concessions won through violence are either tainted, temporary, or both. Winning through violence does not imply that one is right: it merely indicates one is perhaps better-armed and/or more desperate and inhuman in the application of that violence.

3. MISREPRESENTATION… this is insidious, as one appears to be offering one thing, but instead proffers another and then uses that confusion to entrap another person. If this happens accidentally, good people resolve the confusion and apologize sincerely without using the language of the contract or agreement to extract unwilling concessions from the other party. Bad guys do this stuff intentionally most of the time and, should they find a bonus area for entrapment, seize upon that, as well.

Individuals are, of course, capable of much more bad stuff. These three things, however, exemplify what groups of bad guys will do in order to further their agenda and increase their power over others. Take a possible scenario with individuals out of the picture and consider instead a group conflict. Good guys can disagree on a political point of view: they do so without resorting to intimidation, violence, or misrepresentation. An opponent is not necessarily a bad guy.

However, as I noted earlier, if one’s side is doing any of the above things, one may be on the same side as the bad guys. If this is not desirable, consider either a gradual or abrupt shift away from supporting that side. In a recent example, both Trump supporters that initiate violence with protesters and protesters that initiate violence with Trump supporters are bad guys. Protesters and Trump supporters can both be good guys, provided they abstain from intimidation, violence, and misrepresentation.

Why does this make a difference? Well, I hold the view that a person’s actions determine a path that person will follow beyond this mortal existence. There is a value to being a “good guy”, no matter what suffering one endures in this life. For those who built up their power through intimidation, violence, and/or misrepresentation, shame, regret, and sorrow await them in the eternity to come. In that sense, there is great value, nobility, and dignity in heeding the words of those who said that mercifulness, nonviolence, and honesty were principles by which to live one’s life.

So, take some time and ask the question, “Are we the bad guys?” If not, hooray, you’re on the path towards light, love, and joy. If you are, then you have a crisis of the soul ahead of you, either now, later in your life, or when you’re dead and can’t do much about it.

Choose this day whom you will serve.

Happy New Thingy

Leave a reply

The completion of the annual revolution of the earth is marked with celebration and reflection. Our limited mortality prevents us from doing the same when our sun completes a trip around the galactic core or when our galaxy finishes its path around the central attractor of the local cluster… to say nothing of when the local cluster or its containing supercluster complete their cycles. And yet, nature has the biggest bash of all: after the heat death of the universe, quantum tunneling can lead to a release of baryonic matter and energy, in a new big bang event, starting another cycle on its way. Happy New Year, in perspective.