Side Channels

Good news: some nice days in Cambridge.

Bad news: I’m balding.

Todd Shriber contacted, what may be considered, random people online soliciting them to hack into his former college and give his GPA a face lift. He gave them all his personal information, including SSN, and some pictures of local squirrels the “hackers” required as “proof”. They, in turn, put the e-mail correspondence online, of course.

Turns out the idiot works as a communications director for a Montana congressman. He was later fired after his extracurricular contractual endeavors were publicized in sites like reddit.

So, two things. Firstly, not everyone who talks shop is an expert… this applies to real life too. Secondly, if people still have not realized that other people are not who they say they are (in real life too!) they deserve this kind of treatment. The more this happens, the more people be careful what they say or write, mostly in consideration of their future. In our world, where everything is recorded and archived, nothing is forgotten. Memory is cheap. Remember this when, in five years’ time, your potential employer asks you about the time you got drunk, busted, and jailed on new years’ eve, as you detailed with pride on your now moldy myspace page. Old-school cool becomes new-school stupid.

Oh, yeah, some fucker stole my bike; the joy of living in Cambridge. Somehow, uncharacteristically to the island, no security cameras covered the scene.

Good.

Good news I am still alive. Bad news is that I lost the mood to blog, for now.

Doing OK, busy with trying to make some productive progress towards the PhD thing. Been to Spain at the end of September and going to Ireland this coming weekend. In the meantime I attended the 10^th annual “Apple Day” in Cambridge’s Botanic Garden. I sampled many apples (roughly 30 kinds) with the favorite being “Ashmead’s Kernel“, an “old” apple concocted in the 1700 England:

An old English winter russet, medium size, golden-brown skin with the crisp, dense, yellowish flesh, characteristic of russets: sugary and aromatic with intense flavor. Winner of taste tests and has some resistance to scab and cedar apple rust.

(These descriptions remind me of wine labels… they mean absolutely nothing until you’ve had a sip. They are so silly too! But I digress…)

Not much else to publicly report.

High-tech church (Norwich Cathedral): can you spare some credit card? Just slide it in the slot.

“Eat British Beef with Confidence” or, “We’ll do our damn best to keep the existence of mad cow in your beef to ourselves.” I’ve never eaten with my confidence, I wonder what it is like.

(more…)

The other day I was in a hurry for dinner in college; decided it was time to socialize a bit. Got to my bike, front tire completely flat. Fuck. I ran to my flat, got the pump and started working. I was crouched next to my tire pumping in haste. I look aside and see another flat tire staring right at me. I look up. I see a woman with an expression saying “I got a flat tire too. Need pump.” I immediately say, trying to cut on the chit-chat, “look, I’m in a hurry for dinner; I’ll give you the pump, you throw it in the bushes over there when you are done and I’ll pick it up when I return. No, I don’t mind. Really, It’s OK.” She progressed with asking me questions like which college I belonged to and what’s my name (people have the need to show interest in these situations for some reason)… I was answering briskly while keeping polite, still pumping; somehow the energy I expended has not produced the expected tire firmness. Crap; could this be a real, first, flat? I gave her the pump and as I was riding away hoping the air would last the ride, she asked where I was from… “Israel” I answered, hoping to score some points for my country in the PR battle.

The air lasted for about 3.5 minutes. I walked to the lab, then home; I missed dinner. And the pump? Nowhere to be seen. I’m not sure what happened to it, but I can speculate. That’s what happens when I try to be nice.

I invited my group and a few friends to celebrate a good thing that happened to me (I can’t talk about it publicly, so email me privately and I’ll tell you :) It was a good night! We had drinks and then went to a noodle bar. A few drinks in me and I become loud and tenacious, reminiscent of how I used to be in my youth. People refer to it as “the old Saar,” I am told.

Anyway, I had an argument with my supervisor regarding some technicality. He was more adamant about his point, so I let go; he tends to be more right than wrong, so there’s a fair chance I’m mistaken. I concluded, “fine, we’ll all go home and check who was right on wikipedia.” To this he replied, “that just means I’ll have to get home before you and change it!” which I thought was hilarious and definitely deserved to be written about.

Cheers everyone!

(now you are wondering who was right, right? I’m not going to check, but I’m sure Markus will and tell me tomorrow morning if he was right :)

My friend Sabine and I went on another long bike trip around Cambridge. The day started spring and ended winter; I got home soaked after we had tea and scones with clotted cream at the always pleasing Orchard Tea Garden (website) in Grantchester.

I took my camera with me since during the last trips I really wanted to take some pictures to show you. I am fascinated with signs in this country; they obviously make sense for the locals, but I find them odd. For example, did you know what “ecclesiastical” means? I didn’t, and was surprised to see one on the side of a public footpath.

I wonder if the “humped pelican” is indigenous to the area and why, of all the animals in the kingdom it needs a special crossing. Zebra’s are not local, but at least it was obvious what the sign referred to.

And now for some religious comic relief. In Duxford, we found where the gods play and within the village church, this creative last supper scene.

Finally, the huge fields of the bright yellow rapeseed, looked wonderful.

And finally finally, when riding your bike in the spring here, keep your mouth shut. Not for the usual fear of what would come out, but rather what would fly IN.

Some of you may recall previous adventures had at the Cambridge University Library (UL). Today I enjoyed the great weather here on the island and walked to the UL for another visit. The reason: the book I loaned was over due. By a month. You may ask how a punctual guy like me misses a deadline. Firstly, I’m not that punctual; secondly, I didn’t get any late notices. So, not knowing exactly for how long I could have the book loaned for, I just ignored it.

Background: yesterday I went to my college after some weeks that I have not been there. I checked my pigeonhole and saw three (!) late notice letters from the UL. Yes, these were pieces of paper in envelopes sent via regular mail to my college. Who sends late library notices via snail mail anymore? You now know the answer.

Anyway, I enter the library and go to the counter and say “I think this book is a little overdue” (as a tribute to one of the best comedies ever made, UHF, in the scene “Conan the Librarian.”) I knew fully well that there is no reasoning with them, since they got better things to do than be understanding to poor students, so I knew I’ll need to pay the fine, I was just going to have some fun. Conan takes the book and says “yes, 2 pounds.” As I shuffle for the money I say, “you know, you sent the notices to my college, I don’t live there… do you send email notices? “, “well, if you give us your real address then…” (email inquiry ignored) Library:1; Saar:0. Me: “You see, I didn’t know the book was over due…” Conan: “It’s stamped right here on the slip inside the book.” Library++. I went for the kill, “tell me, do you do the e-mail thing?” Stare. Pause. “We don’t send emails.” Although I lost by score, I once again felt an inner victory knowing that I proved to Conan that they are a bit backwards, technology wise at least. I quickly went out back to the sun and the 21^st century.

These were 2 GBP well spent, though. Now I know where to go to get material for this weblog during lull times.

My £50 bike is doing pretty good for, well, a £50 bike. Today I gave it the royal treatment of basking it in WD40. I also removed all the mud that didn’t fall off from riding really fast… in puddles… in the rain. I’ve been out on numerous bike trips with my friend Sabine in the Cambridge area since I got here. Being winter, most trips involved muddy bridleways or fields that made our bikes all clogged; and yes, the wheels stop turning. Basically, mud starts collecting on the wheel like a snowball and then gets collected between it and the mudguard (yes, I’m aware of the irony here.) By design, in these muddy areas there are no slender, rigid objects available to clear these clogs… amazing, but true. One time I had to carry the bike on my back (irony strikes again) up a hill because hunters were behind us and the foreman told us they are about to start shooting so we better get the hell out of there. They were serious, a bunch of birds were hanging and dripping in the back of their truck. The downhill that followed was great for a rain of mud that accelerated from my wheels and a good way to not getting killed.

But the point of this story is this: When biking on this island, carry a stick.

Word is out. The Light Blue Touchpaper weblog by the researchers at the Security Research Group, Computer Lab, U of Cambridge is active. Humbly, I have to say that it was my idea to start the weblog, but most of the setup work was done by the crafty Steven J. Murdoch. I don’t have much to contribute at this point, but probably write articles there every now and then in the future.

It’s bound to be a great security resource, so check it out.

Cambridge university will celebrate its 800th year in a couple of years. Somehow, all the accumulated pre-”digital age” bureaucracy seems to have stuck without much regard to how easy things can be made using what’s called “modern technology.” Sometimes charming, often annoying when you are in a hurry to get things done. No one likes extra bureaucracy.

(note to Helen: You’ll love this one :)

I wanted to check out a book from the great University of Cambridge Library, a landmark of this town with a grand tower that can be seen from afar. In order to gain access to it, I needed to appear in person, student ID at hand… and… the original official letter of acceptance to the university. Now, one would think that I appear as a student on the “network” somewhere, but no, I had to bring a hard copy. From my first visit, when I was refused access (well, they still let me in as a favor, without checkout rights) and informed proper procedures to the time I actually got my act together and produced all evidence… 4 months. But now I really wanted a book. So, finally, I brought the letter and was admitted to the library. Goal #1 accomplished.

I thought the rest would be easy, as I have obtained the classmark (they don’t use the Dewey Decimal Classification, as it was only invented in 1876)… but no. I headed for the “reading room” where I was politely explained the procedure of getting to the sought after book (the explanation came after someone noticed me standing there dumbfounded for a couple of minutes.) Here it is:

1. You take a green form and fill in your details (including physical and email addresses, the classmark and some other bit of information including how many times you had a carrot in the last 48 hours.)
2. Put green form in a little box.
3. Note little sign with a number on it that tells you how many minutes you’ll need to wait for the book to be retrieved for you and be left in a shelf on the other side of the desk. The sign always says “45″.
4. Wait, well, 45 minutes and come back for the book.

No. I waited next to the shelf and it arrived 25 minutes later. I felt a small inner victory that quickly faded away as I realized the complete disregard to my precious time and the fact that I had to fill in my private details on yet another form, whereabouts and use unknown. Wait, it’s not over. I then needed to go to the main counter and officially check the book out. I got out to the fresh air thinking…

Cambridge is a special place.

Haven’t seen the movie, but last night I’ve heard a first person account.

Dan Alon was a promising Israeli fencer and part of the Israeli delegation to the Munich Olympic games in 1972. He survived the September 5th massacre when eight terrorists from the Palestinian group Black September kidnapped the Israeli athletes with a demand to release 200 prisoners from Israeli jails.

Alon has told his story three times, once to his family, once in Oxford and last night here in Cambridge; all within a few weeks. Not being a professional speaker, his telling was raw, touching and frank. I’d like to retell some of the stories you wouldn’t be able to read elsewhere.

Alon, with his methodical style, started with a brief history of his life. He set up the story by telling of his army service, fencing successes and training and friendships with his coach and other members of the delegation.

The German fencing team invited the Israeli fencers for pre-games training; an opportunity eagerly taken. So it happened, the fencers arrived along with their coach, Andre Spitzer, to the Olympic village first. There was one entry to a five unit (each sleeping 6, 2 per room, one of which had a balcony) complex where the whole Israeli delegation would stay. Being first to arrive, they had their choice of rooms. Alon wanted to occupy room #2 and his close friend and coach, Spitzer wanted room #1. They went back-and-forth for a bit but both kept their choices.

The games begun and Alon won several matches and eventually lost to a Brit on his way to the quarter finals. He was devastate; the feeling did not persist long given the following events.

On the day of the attack, Alon tells, Spitzer was in the Netherlands after being given special permission to visit his wife and child there. He promised to return that night. When he got back he told Alon that he missed the train, but despite his wife’s pleas to catch the morning train, they drove to the next stop and missed it again. He persisted and they drove to the next station and eventually got on the train.

At 4:30 that night, the terrorists round up the Israelis. Alon, together with one other fencer and two sport-marksmen congregated in unit #2. At that time they were unsure what was happening, attributing the noise to some delegation’s celebration. When the shooting came closer Alon went to investigate and happened to be back-to-back with a masked terrorist who miraculously did not notice him. They finally understood the grave situation they were in.

The terrorists never opened their unit’s door, which was quite surprising to them at the time. They contemplated using their sharpshooting guns to kill one of the terrorists, but voted against it since it will disclose their location. At one point, the German police was waving at them through the window and nearly giving them away before they signaled them to stop.

They decided to jump over the balcony, at 5 second intervals and run to the German police. They made it. They later found out that the reason why the terrorists never opened their door was that one of the members who was forced to disclose the delegations’ units did not specify #2 and by doing so saved their lives.

The following night they were told that all members of the delegation are out of harm’s way only to be told a few hours later the horrid truth. The eleven athlete-hostages were murdered and among them, Alon’s close friend, Spitzer. The details of the “rescue” attempt fiasco are still debated. Much of the longer term outcomes are similarly still shrouded in secrecy.

Alon quit fencing after the massacre. He did not think it was a bad decision to continue the games since as an athlete he appreciated the effort and dedication it took to get there and did not want to ruin the opportunity for others.

He saw the Spielberg movie and gave it praise saying that the overall details of the kidnapping events were accurate. He did not know about the depicted accuracy of the series of assassinations carried out by the Mossad and other Elite Israeli units following the massacre. He said that contrary to his former beliefs, after seeing the movie, he thinks that economic measures rather than assassinations would have probably been more effective, saying that killing one terrorist does not prevent one or more from replacing him.

I thank Alon for his story and insights and I hope he doesn’t mind me retelling them. It’s a story about tragedy, heroism, friendship, dire failures and the inconsequential-seeming decisions we make that become turning points in our lives, if not, as in this case, a matter of life or death.

I wore a tie twice in my life; once at my high-school graduation and another at a family function long ago where I felt like dressing “up.” I presently own one jacket and no ties. Ties make me feel like a social conformist following the unreasonable rules of tradition and that makes me ill. That suffocating leash-like piece of cloth is so unnatural that it bares no reason why it even came about. I maintain that tradition is nice, but only within reason.

Problem. I’m in Cambridge — the UK one — where a tie is mandatory in official functions (I learned this the hard way.) Do I stand my ground and fight it? Or should I give in, buy a tie and join the line? This ties in (pun intended) a must read lecture by Richard Hamming titled “You and Your Research” from 1986 where among many good things he said:

John Tukey almost always dressed very casually. He would go into an important office and it would take a long time before the other fellow realized that this is a first-class man and he had better listen. For a long time John has had to overcome this kind of hostility. It’s wasted effort! I didn’t say you should conform; I said “The appearance of conforming gets you a long way.” If you chose to assert your ego in any number of ways, “I am going to do it my way,” you pay a small steady price throughout the whole of your professional career. And this, over a whole lifetime, adds up to an enormous amount of needless trouble… And I think John Tukey paid a terrible price needlessly. He was a genius anyhow, but I think it would have been far better, and far simpler, had he been willing to conform a little bit instead of ego asserting. He is going to dress the way he wants all of the time. It applies not only to dress but to a thousand other things; people will continue to fight the system. Not that you shouldn’t occasionally!

Jonathan Kozol said “pick battles big enough to matter, small enough to win” (On Being a Teacher, 1981.) I can’t remember who introduced me to the concept of “picking your battles” but it has been guiding me ever since. When I am faced with a struggle, large or small, I consider the costs and benefits carefully in terms of emotions, time or money and then I choose whether to wage war; most often I conclude it isn’t worth it. I once had a rental dispute that if I had taken to court, I would have most likely won. Even the rewarding feeling of squashing those bastards wasn’t enough to take me through the time and emotion exhaustion of fighting this battle (the system is built for this outcome, but that’s another rant.)

I don’t have principles; I evaluate every new situation on its own ground. Principles are limiting since they don’t allow flowing with the dynamic nature of our living. When people pull out principles without arguments I don’t fight it, but they often lose my respect.

To tie all this in (yes, another) I will buy a tie, an odd one, and wear it where appropriate, it’s not worth the fight.

That’s what my advisor told me as we cycled through a narrow alley downtown Cambridge.

I was downtown this morning as a graduation took progress inside. Of course, I couldn’t go in — mainly due to that fact that I didn’t have a tie, I bet — but I got a glimpse at the people with funny garments and hats inside and on the way there. Appropriately, the place is called “The Old School”, how cool is that? Cambridge is an odd place.

After the long ride on Sunday, something felt odd. My fingers were not functioning correctly; nothing hurt, but I couldn’t get my palm straight and close the gap between my fingers. My pinkies took an angle and just wouldn’t come back no matter how much concentration I put into it. Also, the amount of force I can apply with my fingers diminished. Very odd feeling. I showed this to people and they wouldn’t believe me.

I couldn’t unlock the doors unless I used both hands, clip my fingernails, eat with chopsticks (that was embarrassing) and even using utensils was somewhat difficult. It’s been two days and it just got slightly better. I’m starting to be concerned.

I searched online and read that it is somewhat common for this to happen to avid (not me) bike riders (some say it went away only after 3 months!) I also noticed that I was gripping the handle bars wrong and putting a lot of pressure on the bottom left corner of my palm where the relevant tendons go through.

So riders, pay attention to the handle grip and make sure your arms and wrists are straight without exerting pressure on the palms and change grips as you ride. Some say gloves help too.

I hope this goes away soon.

What would you think if you saw a dish named “Spotted Dick” in a restaurant called “Golden Hind“? Associations are bound to be made. The first is a popular dessert here on the islands (more, more) while the second is a name of a famous ship. Turns out “hind” has many other meanings than, well, “ass.”

Today I was on another long bike ride in Cambridgeshire (~23 miles.) We were told a few castles are on the way… on hills, no less (for reference, this area is completely flat.) We looked, but no castles presented themselves. BUT! I managed to see a small sign on the side of the road pointing to “Giant’s Hill Medieval Castle.” Images of torture and fighting raced through my head (see my Guy Fawkes post) and I was excited to make the turn. Much to my disappointment, on the small mound laid an unfinished castle. By “unfinished,” I mean nothing was there except a mud mound and a moat. Apparently, they built the moat first. Curiously enough, there is a WWI-era base for mounting an anti-aircraft cannon on the mound. Go figure.

I wanted to get a bicycle helmet. I was looking for one that is safe and has a flashlight in the front and those red blinkers in the back. Like many other things, there is just too many choices for my own good. I went into research mode.

Unavoidably, I got to the “Helmets - FAQ.” The following quote belong to the type that grab my attention and I usually tend to believe the assertions they make:

We oppose bicycle helmet laws of any kind because of the damage done in jurisdictions which have them. We do not advocate the use of helmets, but neither do we counsel against their use. It is clear from the evidence we present that cycling is not so dangerous an activity that their use is particularly justified. We wear no special protective headgear for other every day activities such as walking and driving a car, even though our heads are exposed to similar risks for far greater lengths of time.

We have reason to believe the helmet debate has little to do with safety, and much more to do with commercial interest and a specific lifestyle advocacy similar to that which would control what we eat, drink and take into our lungs. If the debate was about reducing the already low frequency of cyclist head injuries, then the principal issue would be about whether manufacturing standards should be modified in order to ensure production of helmets which actually provided a reasonable amount of protection. Really effective helmets would be of such a design (i.e. ugly) and construction that few would buy them. Also, there are downsides to helmet use and scientific reasons to believe they exacerbate injuries in certain types of impacts. At the moment, a discussion on helmet problems is not in the interests of helmet manufacturers.

If the discussion were about bicycle safety then we would be discussing how we can get the cycling public to adopt the most effective and proven method of preventing injuries i.e. responsible behaviour and application of skills when cycling. Cyclist education addresses over 90% of all cycling accidents. To put this in perspective, severe head injuries represent less than 2% of all cycling injuries.

_{(emphasis mine)}

I’m in a dilemma. On the one hand, I’d like to protect my most valuable asset and on the other I want to avoid feeling like a puppet of a sleazy industry; additionally, the helmet might not even protect as well as they want us to believe. There’s also the issue of convenience; no helmet means less hassle and as a bonus, I will still be able to wear my Indiana Jones hat that I love fashioning in the rain.

Regular readers will not be surprised of my next point: unintended consequences of mandatory helmet laws. As the authors rightfully point out in the FAQ:

Studies of the effect on behaviour of other safety equipment {1},{13} show strong correlations between use of safety equipment and increased risk taking. This is the “risk compensation” effect. It has been associated with the use of anti-lock braking systems, car seat belts, automobile air bags, ice hockey helmets, and football helmets. Many mountain bikers admit that they would never subject themselves to the hazards of some trails if they weren’t wearing helmets. Other cyclists have said they enjoy cycling bareheaded but won’t expose themselves to [what they perceive as] higher levels of risk on busy arterial roads unless they are wearing helmets.

(This essay is also worth a read. You may also like to read “Bicycle helmets: review of effectivenesss” by UK’s “Department for Transport.” )

Making people feel safer lead them to take more risk; this is bad when that feeling is based on a false premise.

My current mode of transportation is a used mountain bike I got for 50GBP. It’s a no-frill ride but it does the job. For two weekends now I’ve taken long bike rides and it’s not falling apart (side FYI: we found out that “The National Trust” sites give a discount to people arriving on cycles.) One reason for going cheap is that nearly every new bike in Cambridge gets stolen. They even sell stickers to make the bike look old and used.

I want to discuss some sensitive bike-seat issues. Here’s a quote to get us started (from “bicycle seats explained“:

Pity the poor bicycle seat. Few products in the history of sports have taken such a bum rap. Prostate problems. Numbness. Boils. Infections. Chafing. Even impotency! You name the malady and it’s likely been blamed on the pedaler’s perch.

A certain someone diligently notified me of studies that show that, for men, nose-seats reduce the flow of blood to, well, the equipment and may cause some permanent dysfunction to the, well, performance. This happens to 5-10% of men and it may be a problem if one rides more than 10 hours a week. This got me concerned, of course. I’m not sure what I’m going to do about it, but for now, every time I get reminded of this issue while I ride, I either stand on the pedals or shift to one side or the other.

Next I’ll write about helmets.

Yesterday was “Guy Fawkes Night” here on the island. Havn’t heard of it until a few days ago when they told me… “ahhh Nov. 5th, got to see the fireworks.” I did. There were a lot of people and a fair-like atmosphere with a big traditional bonfire. Was nice. I put a check-mark next to this event and went home. Today I decided to read more of this Fawkes character. Interesting findings, as follows.

Guy Fawkes is most famous for his involvement in the Gunpowder Plot of 1605, which he was placed in charge with executing due to his military and explosives experience. The plot, masterminded by Robert Catesby, was a failed attempt by a group of provincial English Roman Catholic conspirators to kill King James I of England and VI of Scotland, his family, and most of the Protestant aristocracy in one swoop by blowing up the Houses of Parliament during its State Opening.

Guy was caught…

He was tortured over the next few days, after special permission to do so had been granted by the King. Eventually, he revealed the names of his co-conspirators… On January 31, Fawkes, Wintour, and a number of others implicated in the conspiracy were taken to Old Palace Yard in Westminster, where they were hanged, drawn, and quartered.

_{(emphasis mine)}

Now, in case you didn’t click on hanged, drawn, and quartered because you thought it was your traditional run-of-the-mill medieval torture, here is what it actually means:

1. Dragged on a hurdle (a wooden frame) to the place of execution.
2. Hanged by the neck, but removed before death.
3. Disembowelled, and the genitalia and entrails burned before the victim’s eyes; the heart was the last to be removed and was then shown to the victim before the entrails were burned.
4. Beheaded and the body divided into four parts (quartered).

Yes, it hurts (the French version is at the bottom of the page.)

Another anecdotal piece of information is that the popular use of the word “guy” as in “what’s up guy?” is attributed to Guy Fawkes. Besides that, I want one of those funky hats!

Read all the wikipedia articles for more info about this character and about this somewhat odd of a celebration.

Oh, was Fawkes framed???

As expected, things work quite differently here than in the US educational system. I can only speak for my experiences in the computer lab in Cambridge, not of anywhere else on this Island.

First off, and oddly, the computer lab only offers a BS and PhD degrees, both last 3 years. There is not MS program. Yes, I was surprised too. They say that maybe they will start one in 2007. Another piece of odd trivia: after two years of getting your BS, you automatically get a Master’s degree. You don’t even have to be in school, just pay a few pounds and you get the upgrade. It’s an MA, though. So, if someone tells you they have a Master’s from Cambridge ask if it is the A or S flavor (or flavour, depends.) There is some EU initiative for degree unification that is supposed to put an end to this silliness.

There are three terms called Michaelmas (fall,) Lent (winter,) and Easter (Spring.) They last about 7 weeks each. More accurately, the term itself is padded at the beginning and end, but teaching lasts for these 7 weeks. The classes span from 6 to 24 hours and they are distributed in contiguous chunks across the term. All classes take place in 2 lecture halls and are scheduled between 9-13:00. So the schedule is made such that it maximizes resources in the least amount of time.

I sat in one a few classes (there are no class requirements in the PhD program) and noticed that no one asks questions. I inquired with one of the lecturers about this and he told me that they simply can not afford the time to cater for questions; that’s what “supervisions” are for and that’s what I’ll cover next time.