Essays on Adam Caudill

On Privacy Nihilism

Tue, 06 Jan 2026 20:29:22 +0000

Amongst the steady stream of marketing emails for gift cards and other last minute gifts in the days before Christmas, buried in the noise sent when people are least likely to see it, was a notice. It was an all-too-familiar “we take your privacy seriously, but” email. Perfectly timed to make it clear that privacy wasn’t that important.

This wasn’t just my email address being leaked, this was everything. Name, address, income, employer, social security number. Each record stolen was essentially an identity theft kit; everything needed in one place. From a privacy and data security perspective, few things are worse.

Yet the only thing remarkable about my reaction to that notice was that it was entirely unremarkable, more blasé than nonplussed. This was far from the first such notice, not even in the first dozen such notices. This has in fact become so routine that I’ve simply lost count of the number of occurrences thus far, it’s in the dozens.

The state of privacy and data security has become so deficient & dysfunctional that my oldest child had his first data breach notification, revealing his social security number to attackers, at less than 6 months old. He never had a chance to protect his information.

While I’ve focused on - and fought for - user privacy for much of my career, this unending series of failures has changed how I see my own privacy.

Failure Made Personal

As an industry, we have solved some of the hardest technical problems, we’ve devised solutions to many of the thorniest issues, and we’ve created tools and techniques to make finding and fixing issues easier than ever. Annual spending on security is now estimated to be an incredible $200,000,000,000¹. That’s a remarkable number of zeros.

Yet, hacks have far from stopped. But for some, myself included, the caring has.

While I still fight for the privacy of users, I’m generally a privacy nihilist when it comes to my own information. I’ve given up. Call it emotional exhaustion or cynical realism, I’ve accepted that my data has been leaked and stolen so many times that there’s no point in making any extraordinary effort to protect it.

That said, that doesn’t mean we should abandon protecting others, forgetting what we owe each other in a moral sense, or abdicating the responsibility that comes with skills and abilities we’ve developed.

Incentives

We can, and should, do better. We can, and should avoid such absurd situations as babies receiving data breach notifications, yet this is the world that we live in. And I have some thoughts as to why.

In 2018, I drafted an article about a breach - that article wasn’t published at the time - I’d like to share a portion of it here. It seems to have aged fairly well.

There is much said about the cost of a breach, on stock prices to fines, fees, and lawsuits. However there is little agreement on these numbers and there is a common opinion that many of these estimates overstate the cost. One analysis from ~~this year~~ 2018 puts the cost at $141 per record stolen, however looking at the impact to specific well known breaches, this number appears to be vastly higher than the actual cost.

When a business makes budget decisions, they look at many things, from regulatory and contractual requirements to estimates of breach costs (legal, public relations, sales, &c). All of these factors feed into the decision on what can be spent on security while maximising profit. This makes the cost of a breach extremely important: the lower the cost, the easier it is to justify spending less to prevent one. This is an unfortunate reality of business; in every decision there is a certain amount of risk accepted, and reducing that risk by too much means a loss of profits that investors expect to see.

There have been efforts in the United States and around the world to fine those companies that fail to properly protect sensitive data, however at least in the United States, the regulations that have made it into law so far have fairly limited impact. In the case of credit card data being stolen, the issuing banks absorb much of the cost. In some cases the banks are able to recover some of the losses, however the amount recovered isn’t substantial.

In the 2013 Target breach, approximately 40 million cards were exposed, banks sued Target claiming hundreds of millions in losses. Target settled for $106.4M, or roughly $2.66 per card lost. According to the 2016 Target annual report (the most recent available in 2018), the cost of the breach was approximately $300M, though with insurance and tax deductions, this was reduced substantially. This is for a company with around $3B in annual profits. While having 40M cards stolen seems like a devastating breach, the long term cost and impact has been effectively inconsequential.

This leads us to a disturbing realisation if you care about your data: many companies are investing just enough to achieve legal & regulatory compliance, but not enough to keep your data from being stolen.

In the 8 years since I wrote those words, they have weighed on me, and my view of how most companies treat the data they’re entrusted with. Some companies work hard to protect data, limit what they collect, and invest heavily in avoiding the need to send out one of those emails. Others, not so much.

Show me the incentive and I’ll show you the outcome. - Charlie Munger

Incentives are often aligned towards simple solutions, shifting responsibility, compliance often as theatre, and security too often seen as a means to avoid liability instead of achieving actual results.

One of the simplest ways to look at business leadership is that it’s a continuous balancing act of risks. Often, investments are focused on bringing these risks down to the point that the probabilities shift to the favour of the business. Once that’s done, it can be difficult to justify spending more. This is especially true for costs that are largely externalised to other parties, and especially individuals who have little opportunities to resist the imposition of these costs.

The challenge for those in the industry has long been finding ways to protect users, with the resources available.

Fighting the Good Fight

For much of my career I’ve focused on protecting the privacy and security of users, from my work in applied cryptography, to writing and speaking on privacy & data security, and of course, advocating for end-user privacy protections everywhere I go. Not because I’m zealously protecting my own information - that ship has sailed - but because we can and should do a better job of protecting people.

One thing I’ve always loved about the security community is that we will always do everything we can to help others, to protect people, to put in the time, effort, and energy needed to go beyond what should be possible with the resources available. A group of people that still solve problems just because they are hard.

Personally, I’ve little hope for my information, though I will never give up on protecting everyone else. Some who saw the title of this essay likely assumed that this was an abdication of privacy and the need to protect data. I hope you see the point is actually quite different: even if the effort is futile for some of us, the collective effort is more important than ever to achieve results.

We can and should do better.

Gartner forecast - $212B in 2025. ↩︎

Whose Monkeys Are These?

Thu, 01 Jan 2026 08:29:22 +0000

Over the course of my career, I’ve found that there are some principles that are key for people and teams to be effective. One of these is that everything should have an owner. Everything should have someone that is responsible. Everything should have a designated person whose job it is to care about it. This might a be bug or vulnerability reports in software, it could be routine processes, or who responds to certain emails.

When there isn’t clear ownership, things slip through the cracks, things are forgotten about, and minor issues can quickly become anything but minor.

This works well enough for many things where ownership is clear and agreed upon, but things get ugly when that thing is a problem. Here, human nature starts getting in the way, and leads to unfortunate outcomes. In this essay, I’d like to explore how people deal with the problems they see.

Not My Circus, Not My Monkeys

The Polish idiom “nie mój cyrk, nie moje małpy” is, perhaps, my favourite phrasing of the statement “that’s not my problem.” Some variant of this statement is made countless times everyday in Slack threads and email exchanges, sometimes rightfully staying out of other people’s area of responsibility, but far more often, to avoid a problem that they don’t see as theirs to address.

An SEP is something we can’t see, or don’t see, or our brain doesn’t let us see, because we think that it’s somebody else’s problem. That’s what SEP means. Somebody Else’s Problem. The brain just edits it out, it’s like a blind spot. - Douglas Adams, Life, the Universe and Everything

In reality, when problems are found, people react in very different ways. From my experience, there are 3 kinds of people, when they see a problem, they will do one of these things:

Unless it’s clearly theirs, they assume it’s somebody else’s problem and stop thinking about it.
Unless they’re told it’s theirs, they assume it’s somebody else’s problem and stop thinking about it.
Unless they see somebody else handling it, they assume it’s their problem.

When a person says “that’s not my problem,” they are probably in the first group. It’s not clearly theirs, so they drop it, move on, and focus on other things. As they don’t perceive it as their responsibility to address (or ensure that someone else is addressing it), it drops from their mind.

This form of automatic anti-ownership is both understandable, and, to me at least, disappointing. Instead of claiming ownership, at least until a better fitting owner is identified, they avoid making a concerted effort to not have ownership. This strategy greatly increases the odds of the problem slipping through the cracks.

Where the first group exhibits an active aversion to owning issues they see, the second group exhibits an indifference to it. Unless given the order to take ownership, they adopt a more passive approach and pay little heed to this issue unless told to.

This is not to say that anyone in either of the first two groups are avoiding work, or unwilling to take ownership, but that due to the nature of different personality types, incentives, and organisational dynamics, people can be disinclined to adopt a problem that isn’t clearly theirs.

We’ve all seen this, right?

None of these traits though should be particularly surprising to anyone with a non-trivial amount of leadership experience. These are common traits, and lead to common issues, and are simply part of the routine within teams. Enough ~~ink~~ electrons have been spilled covering these archetypes, so I won’t belabour the point on them. Instead, I will focus on the third personality type.

The Cost of Ownership

For those people that assume a problem is theirs unless (or until) they see that someone else is handling it, those that are proactive about accepting ownership, they do so at both visible and invisible costs. It’s these costs and the motivation that pushes them to proactively accept ownership that we will be discussing here.

In general, people that are proactive are seen positively, are more likely to be promoted, are often given greater responsibility. After all, they are already accepting greater responsibility without being asked to.

Ownership: Proactive Acceptance vs. Seeking

Before we move on, I would like to look at a seemingly subtle difference, which is, in reality, an important distinction in both behaviour and motivation.

The archetype - the people - I’m describing here are those that proactively accept ownership of problems they see, though they do not seek ownership. The difference is critical: one accepts what they see, the other seeks to expand what they own. The latter may be seeking greater control or influence, while the former only seeks to ensure that problems are addressed.

This oft misunderstood distinction can lead to conflict or discord, though the motivations are entirely different, as those that seek to expand control are less likely to be motivated to actually address problems, but to leverage problems to achieve other aims. Where those that proactively accept are instead motivated to achieve a resolution to the problem, or at least a resolution to their perceived responsibility for it.

As this essay is a study of how problems are perceived, and not how they can be leveraged, I will not be further exploring those that seek to use problems (and other forces and events) for their advantage.

The Responsibility of Knowledge

For those that proactively accept ownership, they feel a deep sense of responsibility for issues they see, even if they are outside the direct scope of their role. Some portion of this may be rooted in loyalty and concern for their company, some may be linked to a broader sense of what they owe to coworkers, either way, that sense of responsibility is real. It’s also difficult to ignore, creating an unavoidable and inescapable weight once they become aware of a problem.

Once the knowledge of the problem comes into existence, the increasingly oppressive weight of the problem grows. And it will continue to grow until that responsibility is, one way or another, discharged.

This practice tends to result in fewer problems being left until they develop into a large issue, but it weighs on the people that feel obliged to pursue these problems.

The Squeaky Wheel

While the people that are the most dedicated to ensuring success, to avoiding the deferred consequences of ignored problems, also are those that are seen as the squeaky wheel. They are the proverbial messenger that are too often the first in the line of fire. By opting to say something, to acknowledge the problem, to seek a solution or an appropriate owner, they are faced with continuous guilt by association, they are blamed for bringing negativity into discussions.

This creates a singularly unfortunate combination of pressures: the perceived weight of responsibility and the dread of blame and resistance for acknowledging that the problem exists.

When you combine this personality type with certain careers, such as anything in security, a field whose members are often seen as a particular inconvenience when added to a conversation, the results are worse (at least for those that feel compelled to open their mouths).

Yet, for all the benefits of this archetype in terms of results, the self-imposed pressures speed burnout, magnify discontent due to the recurring instances of shooting the messenger, and creates an impenetrable cloud of stress that shades everything. Useful for a team, bad for the person.

Owning a Circus

If you look in the mirror and see the person that has no choice but to adopt each and every unowned problem they encounter: welcome to the annoyingly stressful club. I very much identify with this archetype as well.

Thanks to this deep sense of responsibility, one ends up caring for a substantial number of proverbial monkeys. Though it’s important to understand how much of this pressure is self-inflicted, and not organisationally imposed. More importantly though, it’s important to remember that the vast majority of these problems aren’t actually yours: you don’t own them, you’re a caretaker until the rightful owner is identified.

When viewed through this critical lens, that there is a key distinction between ownership and custody, the pressure is lowered and the path forward is simplified.

If you are in a leadership role, you need to understand which members of your team exercise this type of proactive acceptance, and actively aid them in finding the proper owners of these problems. This work to redirect these problems will substantially lower stress and slow burnout, and will demonstrate that they don’t need to own these issues, only care for them temporarily.

Just as importantly, you need to take due care when discussing these issues to ensure that you don’t create a feeling that they are being seen as a problem themselves. The repeated negative receptions to speaking up eventually creates a constant fear, a latent pressure in every conversation.

For those of us that have shared this lived experience, we need to identify this in others, so that we can leverage our positions & experience to relieve the pressure from others.

Good Faith, Moral Duty, and Selfishness

Wed, 10 Dec 2025 03:23:18 -0500

What do we owe to each other? This is a classic question of moral philosophy, and a critical question that defines how society itself functions. It’s also a key question to understand what role each of us plays to make society successful.

These words were started as society was entering a seismic shift, the COVID-19 pandemic had started, people were dying, fear ran deep, and the disease impacted some far more than others. Some reactions to this crisis were based on what was good for society, others came down to the interests and desires of the individual. The question of what we owe to each other had rarely been so imperative.

I am finishing¹ this as society enters another seismic shift. Fear again runs deep, there will be deaths, people are divided to an extent not seen in generations, and, as like before, some see little or no impact while others are disproportionately affected. The question of what we owe each other has not been more pertinent during my lifetime than it is now.

Before we go on though, I’d like to make one thing clear: this essay is intended to spur thought & consideration, and to encourage readers to research this topic more. There is no possible way that this essay can fully cover the topics discussed here. There are places where a single sentence summarises a specialised area of research that a number of people have dedicated their careers to.

To fully cover these topics in depth, it would be to synthesise the work of hundreds of researchers and lifetimes of effort. As such, this is presented not as a definitive statement on these topics, but an introduction to spur further reading.

Why are we like this?

To discuss this, it’s useful to have an understanding of how and why we got here. If social psychology² isn’t your cup of tea, feel free to skip ahead.

Selfishness

Humans are, arguably, born selfish and self-serving, from crying strategies to prevent competition for resources to the “mine” stage toddlers go through claiming ownership over everything within reach. Within the first years of life, humans show themselves to often be uninterested in the needs or feelings of others - it’s part of our DNA. While each child develops differently, and shows care for others at different points & frequency, this selfishness is something that should be only temporary.

We grow, we realise that others have feelings, we learn to share our toys, we develop empathy & understanding. While we may have an innate predisposition to this behaviour (we do come from a very long line of social creatures), it’s something that must be fostered to develop properly.

As time goes on, our sense of self develops more, and we perceive ourselves not just as an isolated individual, but associate with others around us³. We transition from “I” to “we” - we see ourselves as part of something larger, and we learn what our role is, we learn where we fit in.

Why does this matter?

This growth⁴ is necessary for society to function, and the evolutionary steps to achieve this predate the existence of our species by millions of years. In a world without empathy, understanding, or social connections, it would be a world of violence, hate, no cooperation (such as via governments, businesses, or even farms & small communities). There would be no art, no science, no commerce, nothing but a constant and independent fight for survival.

Society exists and functions solely because we have evolved to think of not only ourselves, but others.

Due to some combination of environment & other external influences, not everyone manages this growth. Their worldview progresses little beyond themselves. Once a person learns that there’s a world beyond their own wants and desires, there’s still a bigger challenge to come.

Us versus Them

People perceive themselves as belonging to a group⁵ (and any number of subgroups⁶), and see everyone else as part of an out-group. Thanks to an interesting psychological effect, people see those in the out-group as more different from themselves than they are, just as they those that are part of the in-group as more similar to themselves than they are.

This perception is a source of out-group homogeneity, the belief that “they” are all the same, interchangeable, whoever “they” are. Conversely, it creates in-group heterogeneity, the view individuals who are part of the in-group are more distinct.

All of this compounds into something interesting, and deeply unfortunate. Our ability to understand people is impacted substantially by our primary group that we identify with. Our ability to see commonalities is driven by that group. Our ability to place ourselves in the shoes of another, to feel empathy, is dictated by that group.

The smaller and more homogeneous that primary in-group is, the harder it is to understand those in the out-group. This is a result of there being fewer points of reference to establish commonalities, fewer opportunities to see things from another point of view.

Out-Group Apathy & Antagonism

This in-group centric worldview leads to something far darker, moral exclusion. Members of a group can see their values, history, norms, and culture as superior to those in the out-group. This leads some to see themselves as superior, and treat those in the out-group as lesser - not deserving, not worthy.

This can range from disregarding others and not considering them at all, to outright dehumanising. This is form of belittling and demeaning groups is all too common, from false narratives to marginalising people and their value and contributions. Among those that see themselves as members of a small and limited in-group, they find little common ground, and consider much of the world as being in an out-group that is lesser than their own.

It is this in-group superiority that has contributed to many of the worst atrocities in human history.

By arguing that those in the out-group are of lesser import, they then descend to arguing that others are not deserving of the same rights they enjoy. When you combine these views, it leads people down the darkest of paths and into the depths of evil humans are capable of.

It can start slowly, with hurtful but otherwise small impacts, steadily growing more overt, more direct, more dangerous, and more destructive actions. We see this today in a variety of ways, and in far more overt ways than would be expected even a few years ago⁷. There’s no reason to believe that this trend is slowing down, much the opposite.

Large vs. Small In-Groups

The smaller and more homogeneous the in-group a person identifies with, the less opportunities a person has to build understanding and empathy with others. If a person’s self-selected in-group is based on highly specific filtering factors (e.g. a combination of nationality, ethnic background, religion, socio-economic status, gender), the more likely a person is to view large portions of the population as an out-group that they have negative perception of.

The broader and less filtered the in-group, the more opportunities for understanding, connection, and empathy. The ultimate - though likely rare - in-group is all humans⁸, without a true out-group.

For me, this belief in the importance of a broad in-group that extends beyond common filtering functions is rooted in a document that I read many years ago, which included a vital line for me:

We exist without skin color, without nationality, without religious bias… Loyd Blankenship, The Conscience of a Hacker

This line resonated with me in a way that few things did; it addressed the view that many of the things that separate of are, in the end, artificial constructs that have little truth. There are things that we have in common, there are things we don’t, but in the ways that matter, we’re all alike.

We’re all people with emotions, hopes, fears, dreams, nightmares. Everything else are those things that make us interesting, give us different perspectives, new ideas, and add to the richness of human interaction.

What We Owe Each Other

This is a question that is responsible for numerous books being written, countless hours of lectures in philosophy classes, and millennia of debate. I will not attempt to summarise this here, but rather address this in more direct terms.

it’s about making choices that benefit not just yourself but also the people around you, fostering a society where everyone can thrive

When the COVID-19 vaccine was made available, I booked my appointment the first day I could. I didn’t do this because I didn’t want to get sick, it was in despite of the fact I knew I would. My body doesn’t react well to many vaccinations; the COVID-19 vaccine had me in bed for the next 4 days and it was well over a week before I was back to normal. I knew what I was signing up for and yet I did it, because I didn’t want to risk getting anyone else sick⁹. A inconvenience for me, for something that could be life or death for someone else. It’s what I owed them. It’s what we owed to each other.

When a friend came out to me as transgender, my response was simply to ask what if there was anything I could do to support them. Why? Because we all deserve respect, we all deserve support from those around us. It’s what I owed them.

When a neighbour was having a yard sale selling things that she obviously needed (such as her baby’s car seat), making it painfully clear that she was desperate for money, I picked out something unimportant for $1, then handed her a $100 bill and told her not to worry about the change. Why? She needed it more than I did. I’ve no idea what was going on in her life, but she needed help, and I could help. It’s what I owed her.

Paying for other people’s groceries when they don’t have enough money at the checkout. Because nobody should be hungry. Paying for other people’s medicine because nobody should go without healthcare. I did these things because it’s what I consider to be the least I could do, because this is the behaviour that we owe to each other. These things deserve no thanks, no credit, not even any acknowledgment. These things should be the minimum that any of us should do, if we are able.

We thrive together, or we fall together. That’s what it means to be part of a society. It means we help each other, we support each other, we respect each other. It’s what we owe to each other.

The Golden Rule

If we do not stop to help each other, what will we become? Jeff Atwood

Most are familiar with the “golden rule” - treat others are you wish to be treated. This is a foundational norm in a healthy society, the root of what’s good & right in the world. This presents the most basic check for right and wrong, one can simply ask themselves the question: how would I feel if the roles were reversed?

Those that fail to ask this most simple question will often act instead in the interest of themselves (directly, or for the perceived benefit of their in-group), and fail to comprehend the true impact of their actions. A simple lesson that most learn by kindergarten, yet so many fail to keep this lesson.

Countless words have been written in an attempt to answer the question, what do we owe each other, though in reality, there is a simple and concise answer: treat others are you wish to be treated.

This was drafted in February of 2025, based on a draft that began in 2020. Much has changed since the first words were written; fears have been realised, polarisation has intensified. This article isn’t intended as a political discussion, as I try to avoid overt politicisation here, but a reflection on the challenges that we face. This is a complex topic, and one that I have sat aside multiple times. I don’t believe that this is a political question, but a growing societal issue, and it’s important to consider the various roots of this problem. ↩︎
While I have a deep interest in - and have spent substantial time studying - both psychology and philosophy, the key areas of focus of this article, please read this as a layperson’s exploration of a complex topic instead of an expert analysis. ↩︎
This is a vast oversimplification, based on self-categorization theory, presented in the simplest possible way for brevity. ↩︎
To be clear on this, this is not a reference to neurodivergent people. Nothing herein is intended in any way to criticise, demean, or otherwise belittle those with autism or are otherwise neurodivergent. If anything here is interpreted otherwise, then I apologise for the lack of clarity. ↩︎
At the highest level, the group is humans with the out-group being anything living that isn’t human. In practice, the group is substantially more specific. ↩︎
The model presented here of a group and various subgroups, may be better thought of as one to many groups with highly divergent cardinality and substantial (but not necessarily complete) intersection between the low cardinality groups to the high cardinality groups. The group/subgroup model is used for simplicity and brevity. ↩︎
There are many examples of the type of destructive and exclusionary behaviour that is occurring in today’s environment, though I do not see either a need to repeat these, nor do I see a reason to elevate these harmful statements by recounting them as part of this essay. Hateful statements do not deserve such dignity. ↩︎
An in-group of everyone is, to me at least, the ideal. However, due to the realities of human experience and the environments that we are raised in, this self-selected in-group is likely less common than I would wish. I do believe though, that an aspirational in-group is not substantially different than the effective in-group, as it represents an intentional effort to understand those outside the effective in-group. ↩︎
One of the people I was worried about exposing to COVID-19 was my father, due to his existing health conditions. He would later be exposed COVID-19 while in a medical facility, passing away soon after the symptoms became apparent. Had I not been diligent in taking precautions, I could have been responsible for accelerating his passing. The decisions we make matter, even when we have to pay a price for them. ↩︎

On AI, Art, Writing, and the Distillation of Creativity

Mon, 31 Mar 2025 00:37:41 -0400

Can generative AI create art? Two years ago I took my first swing at answering that, at least from my perspective.¹ As AI systems become more advanced, this question, and the issues surrounding it have become of greater import. With a new release from OpenAI, it’s become a topic of great passion, and one prime to revisit for me.

I would like to explore this topic more deeply than I did previously, both in terms of cultural impact, and historical context. This is something that is easy to take an emotional position on, though as someone that considers themself an artist, it’s worthy of more nuanced examination. I’ll be touching on art broadly, photography specifically, and unlike my last essay on the topic, I’ll spend some time discussing writing.

The Studio Ghibli Connection

Let’s start with the recent events that has brought this to the fore. OpenAI released an update to their image generation feature, using their newer 4o model, to create images and video that substantially improve over the results of prior models.

Shortly after this release, users discovered that they could direct the system to recreate existing images in the style of the beloved-by-many Studio Ghibli. This became a viral trend, and used for everything from creating cute family photos to the cruelest of political machinations. To say this prompted considerable debate would be an understatement.

Art, and the Unbroken Chain

In my prior post on this topic, I spent some time discussing the definition of art, and how it may apply to generative AI. I broke down each element of the definition, providing arguments for and against. In the end, I settled on something simpler than a technical definition: given that art depends so heavily on the eye, opinion, and perspective of the beholder, it may be best to paraphrase Forest Gump and say simply that “art is as art does.”

There is a great unbroken chain in art, starting with the first people that painted on cave walls, and connects over the millennia to the artists of today. Each and every one building on the work of others. No artist exists in isolation.

Every work of art, starting with those crude lines of the first cave paintings, has built on the knowledge, experience, style, and design of others. Some mimic, some contrast, some defy, and some refine, but all artists build on the work of others.

Even those art forms that create ex nihilo, starting with a blank canvas and an idea, draw from the knowledge, ideas, and visions of others. Each artist collects this knowledge, and distills it into their works.

Photography

I am a photographer, and I don’t mean that in terms of it being a hobby I’ve dabbled in. I was a photojournalist - work that has won awards (and death threats), I’ve paid my bills through sports and portrait photography, I’ve been a professional wedding photographer, and now focus on fine art photography.

I’ve invested a non-trivial portion of my life into this art, and learning everything I can about it. The physics of light, the mechanical design of lenses, the chemistry of film, the electrical engineering of digital sensors. I’ve studied countless images to learn what works and what doesn’t. I’ve studied the psychology of how people perceive photos, model posing, facial expressions, and perspective. I’ve refined my style over decades of effort.

Every image I create is a distillation of that knowledge. It’s the result of everything that I’ve learned, and applying that to a specific scene. When a person generates an image using AI, the AI system understands none of that. Yet, critically, it benefits from that knowledge.

Generative AI is trained on massive troves of data, including millions of photographs.² Through these photographs, this knowledge is effectively transferred by proxy; the system may have no understanding of why, but it does gain the understanding of how. Thanks to this training, generative AI still uses this distilled knowledge.

The Experiment, Redux

In the last essay, I shared an image I created using generative AI; today I include a revised version. The prior version was created in Stable Diffusion, after several hours of effort, this version was recreated with OpenAI’s 4o model.

As was the case previously, this image follows my style, my choices of lenses, my affinity for cityscapes, and of course my love of sharp contrasts. It was the result of substantial effort, and more time than I would invest in most of the photographs that I create. Of course, it’s not perfect, though reality is also rarely perfect.

One could argue that this is nothing but “AI slop” - cheapening the work of photographers, models, tattoo artists, and others. Or one could argue that it’s a new way to create photos with greater flexibility and freedom.

Is this art?

Today, as a photographer, I am as much of a purist as possible while using a digital camera. I use film emulation on the camera to achieve the high-contrast black and white style, and otherwise my photos are untouched. No edits, not even cropping.

While not intended to be a slight against those with a different creative process, I have said many times that “my art is photography, not Photoshop.” The idea of altering the moments I capture after the fact is entirely anathema to me.

To me, an AI generated photo is no different than a real photo that has been heavily edited in Photoshop: it’s the product of a tool, and the artistic value is found in the intent and vision of the person controlling the tool.

Is Photography Even Art?

Today, I would say that this question is absurd, though that’s not always been the case.

while the photograph is the mere mechanical reproduction of the physical features or outlines of some object animate or inanimate, and involves no originality of thought or any novelty in the intellectual operation connected with its visible reproduction in shape of a picture

On March 3rd, 1865, President Abraham Lincoln signed an amendment to the existing copyright laws that extended copyright protection to photographs in the US, a move that was later tested before the Supreme Court. There was a time where there was a real argument that photographs were devoid of creativity.

Charles Baudelaire, in a letter titled “Le Public Moderne et la Photographie” said, in a rather famous quote:

As the photographic industry was the refuge of all failed painters, too ill-equipped or too lazy to complete their studies, this universal infatuation bore not only the character of blindness and imbecility, but also the color of vengeance. […] it is obvious that this industry, by invading the territories of art, has become art’s most mortal enemy […]

Baudelaire was far from alone in attacking photography, and denying its value as a form of art. For painters especially, photography was a problem. Not only did this new technology intrude on their domain of capturing moments and the beauty of the world, it severely impacted their incomes.

Portraiture rapidly changed from paintings, where an artist would charge or weeks or months of work, to photography, where the entire process was down to a couple hours. The steady and reliable incomes that artists counted on to survive simply vanished thanks to a new technology. The parallels here should be obvious.

The Ability to Create

In my last essay, I should an AI generated “painting” based off on an idea I had. You see, despite quite a bit of effort, I have no ability to draw or paint. I understand the techniques, I’ve practiced, but I’m terrible at it. I simply don’t have the ability to translate what I can imagine into something that my hands can produce.

One could argue that lacking that ability, I have no right to create, based on the vision in my mind, art that requires those abilities. One could argue that using a tool to execute that vision renders the result hollow and meaningless, because my hands are unable to execute the details.³ One could argue that the only those with certain abilities should be able to execute their vision.

I would not make these arguments personally; as noted earlier, to me, the artistic value is in the intent and vision of the creator, regardless of the tools they use to execute it.

There is, quite obviously, the question of if a person is just generating something, versus executing on a clear vision. I’ll talk more about that later.

Writing

The social media post that pushed me to write this referred to the text generated by AI as “usually a blathering, vacuous, and erroneous essay disrespectful of the reader’s time.” I’m not going to disagree with that, but I feel like there’s both nuance and context that can be added.

Upon reading that line, the first thing that struck me is how often the same can be said for text written by humans. This is especially true of anything labeled as “thought leadership” or an annoying percentage of LinkedIn posts. Human’s are prone to error, too often don’t check facts, and too rarely are focused on grabbing attention over providing useful information or a perspective that’s actually thought provoking.

A common theme in my career has been serving as a ghost writer for others, providing the first draft of an article that will eventually be published under their name. These articles go through editing processes, they go through PR firms, and along the way, much tends to disappear. Too many of those first drafts, touched only by humans, have become the same “blathering, vacuous, and erroneous essay disrespectful of the reader’s time” that AI is criticised for.

Generative AI is highly effective at distilling what humans create, including both the good and the bad. If it has distilled this tendency in how we write, that may say more about us than it.

In addition to my own work as a ghost writer, I’ve worked with very talented writers doing the same. I’ve seen their early drafts. I’ve worked with them to prepare articles. For articles that broadly fit into the “thought leadership” category, there’s not much difference between their work, and what’s generated by the more advanced chain-of-thought LLMs, when used with a well crafted prompt.

My Break from Fiction

I spend some of my free time writing fiction, some is published here. Mostly dystopian, which I’m guessing isn’t a surprise to anyone reading this.

One of my favourite stories about LLM generated text, and one that started the process of changing how I see AI systems more broadly, came from an idea I had for a short story. It was a novel idea, a bit funny, but a little too absurd to justify the time it makes me to write. I quickly decided that I wasn’t going to pursue it.

Before discarding the idea entirely, I wrote up a detailed prompt for ChatGPT to see what it could do with it.

The result was funny, witty, just the right amount of absurdist, and creative in ways I hadn’t anticipated. Quite frankly, I was shocked by the quality. It was good enough that I stopped writing fiction for nearly a year, because it felt like a waste of time. It wasn’t perfect, but it was at least as good as the first draft of the fiction I’ve written.

I had to wonder if there was a point to writing at all, if an LLM could do in 30 seconds, what took me 40 hours.

Distilling Human Creativity

The power (and arguably terror) of generative AI is the fact that it is the distillation of human creativity. It’s the sum total of what humans have created for centuries.

It reflects us, sometimes in ways that we don’t like, because we don’t like what humans have created. It is, in many ways, a mirror. Why is it good at writing vacuous essays? Because humans have written a lot of them.

Just as we learn from each other, and create from what we’ve learned, so to do these systems. They generate from what they’ve seen, from what we have created. For good and ill.

It’s All About the Prompt

One of the oldest acronyms in computing, GIGO, applies today as much as ever. If you use a tool like Photoshop and randomly click buttons, you may end up with an image, but it will certainly be garbage. If you use generative AI the same way, you’ll get the same result. Garbage in, garbage out.

In my experiments, I’ve found that it’s possible to clearly articulate a vision, a structure, a point, enough detail that you produce something that at least resembles what you wanted. When using chain-of-thought (CoT) LLMs⁴, the results can be quite impressive. They are obviously still far from perfect, but in many cases I’ve seen results on-par with what a person would produce.

From my perspective, the prompts are where you go from garbage to something that may become art. It’s the intent and vision expressed in the prompt; it’s how the tool is used and guided, that imbues the result with meaning.

The difference between Jackson Pollock and a random person throwing paint at a canvas is intent and vision. I think there’s an argument that the same applies to generative AI.

Creative Jobs

While this goes beyond the core scope of this article, I would be remiss to end the article without touching on this more clearly. I recently wrote about the likely impact on jobs from AI, which as noted there will likely impact creative and knowledge-based jobs disproportionately. Just as photography put many painters out of work, so too will AI. It seems to be an unavoidable reality at this point. For many companies, AI will be “good enough” for jobs to be eliminated.

Generative AI has the ability to allow those without certain talents and abilities to create in ways they never could before, and at the same time to destroy the livelihoods of the artists that would have been responsible for that creation in the past. Unlike what happened with the introduction of photography, this isn’t a shift towards fewer people being paid less to achieve the same thing, but may represent a broad elimination of jobs.

As AI systems continue to evolve, the impact will only grow, and I believe that we, as a society, need to make broad changes to avoid the worst outcomes.

In Conclusion

Generative AI is likely many other tools, in that the quality and value of the results are dependent on the quality and value in the inputs. To me at least, it is simply another tool, another means by which people who are willing to put effort into it, can express a vision that may not be practical or even possible otherwise.

It’s also a tool that, when given input of little effort or value, will produce output of little value.

For those that have made it this far, may I offer you something amusing, that you may find thought provoking in unexpected ways. While we talk about the errors and potentially worthless nature of what generative AI creates, may I present something of purely human creation: English as She Is Spoke. The section on “Idiotisms and Proverbs” (p. 58) is quite worth the read.

I suggest reading this original post before completing this one, as it lays out my general perspective on the artistic value of generative AI, which this post builds upon. ↩︎
I will not be touching on the issue of copyright here; it is a complex area of law, and the fair use exception is even more complex due to its nature. Determining if the companies that build AI systems have violated copyright laws is a matter for the courts to decide. Personally, I do believe that there is a solid argument for fair use, based on my understanding of the caselaw in play, I believe that there is also a reasonable argument against it. This is a novel topic, and will require considerable litigation to determine where the fair use line sits. Due to the nature of the fair use exception, the answer can only be found through litigation. ↩︎
My family shares a genetic condition, a rare degenerative neurological disorder, that is most easily compared to Parkinson’s, though progresses slower and eventually stops progressing. One result of which is a small tremor in my hands and limitations on fine motor control. In practice, this, so far, has minimal impact on me, beyond the inability to draw and the need to use camera lenses with some form of optical image stabilisation to compensate for the constant movement of the camera. In the case of arts such as painting and drawing, the limitation goes beyond a lack of talent. ↩︎
Chain-of-thought (CoT) models outperform non-CoT models to such a degree, especially in terms of accuracy, that I don’t use the non-CoT models, except for the most basic of tasks. Using CoT models has fundamentally changed how I view LLMs. ↩︎

When AI Becomes I

Mon, 17 Feb 2025 18:39:48 +0000

One of the many joys of being human, is that we constantly face questions about our existence, from the seemingly simple (why is the sky blue), to the labyrinthine (what is the meaning of life, does pineapple go on pizza). Thanks to growing up watching Star Trek, one of these that has fascinated me is the question of artificial life. Thanks to a character named Data, a character that’s both relatable and entirely different, many have found themselves wondering if that’s what the future holds.

This essay began 3 years ago, when some within Google claimed that they had, unintentionally, created an AI system with sentience. A claim that was quickly met with derision. For me though, it was fascinating - not because of claim itself, but the challenge involved in finding the truth. The challenge of finding incontrovertible proof.

This is a topic that has fascinated me for decades. As we building more advanced systems, build LLMs of such complexity that we no longer truly understand their behaviour, observe nascent signs of emergent behaviour, how we interact with these systems is changing in fundamental ways. Marketing parlance has already started to shift to hiring AI systems. The latest AI agents are being designed to act and be treated as just another member of the team instead of a piece of software. Then there’s the soaring popularity of AI companions.

The anthropomorphisation of AI has well and truly begun, both naturally as a result of advancing technical complexity, and intentionally through the marketing and design of the systems.

The question is, if we reach the point where a technology actually becomes some form of life, can we tell the difference between that, and the human tendency to anthropomorphise?

Biological roots

While we generally believe that we know a great deal about life, organic life, in reality we’ve only scratched the surface. Despite a vast number of years and huge amounts of money, no lab on has been able to achieve abiogenesis. Try as we might, we’ve not been able to create life ex nihilo, to take raw ingredients and create something that’s alive, no matter how simple.

A great deal of effort has been invested into finding LUCA, the last universal common ancestor, the thing all life on Earth evolved from. But we don’t know what came before LUCA, we don’t know where LUCA came from, we don’t know how LUCA started.

And that’s just life of Earth. As research finds ever more evidence of the abundance of organic compounds in the universe, it’s all but certain that life, of some form, exists elsewhere.

Given this limited knowledge of life and how it starts, where the line is between not alive and alive at the most primitive level, it makes one question our ability to recognise it in forms of life that are dramatically different from what we know.

Organic vs. Non-Organic Life

Note: This section was written in part by ChatGPT¹. Given the topic, it seemed only fair.

Organic life, to the extent we understand it, is rooted in biochemical processes - cells that metabolise, reproduce, and evolve over generations beyond count.

This definition is built on a foundation of shared genetic material, chemical reactions, and an intrinsic drive for self-preservation. Organic organisms, from single-celled bacteria to complex mammals, operate on principles of energy transformation and homeostasis, ensuring that life continues through mechanisms honed by billions of years of evolution.

Non-organic life, by contrast, challenges our conventional notions of existence. Imagine a system built not of cells and DNA but of silicon and code, yet still capable of self-maintenance, adaptation, and even self-replication. In this view, life becomes a matter of functional attributes: autonomous goal-setting, emergent complexity, and the ability to interact meaningfully with the environment.

Here, the “metabolism” is digital, the reproduction algorithmic, and the evolution driven by iterative learning and self-modification.

The quest to differentiate organic from non-organic life is - at least - as much philosophical as it is scientific. While organic beings carry the tangible legacy of evolutionary biology, non-organic entities might express their ‘aliveness’ through the spontaneity of novel problem-solving, the emergence of self-awareness, and behaviours that surpass their initial programming.

These traits force us to question whether the essence of life is inherently tied to its physical makeup or if it resides in the dynamic processes that support existence, regardless of their substrate.

Ultimately, the distinction between organic and non-organic life may prove to be more of a spectrum than a binary divide. As artificial intelligence systems evolve, they could begin to display properties we once thought were exclusive to living organisms. This convergence invites us to broaden our definitions and reimagine what it means to be “alive,” suggesting that the journey from being a mere tool to becoming a living entity is as much about expanding our conceptual horizons as it is about technological advancement.

There is a further complication to this, one rooted not in biology but psychology: anthropomorphism. There’s a human tendency to attribute familiar, often comforting, human traits to non-human life and inanimate objects. As we interact with increasingly sophisticated AI systems, our minds are predisposed to see intentions, emotions, or consciousness in behaviours that are simply the result of the system’s complexity.

This bias can obscure objective evaluations, leading us to interpret patterned, algorithm-driven responses as evidence of self-awareness or autonomy. Recognising and mitigating this tendency is essential, not only to avoid overestimating the “aliveness” of AI systems but also to ensure that our criteria for life remain grounded in observable, reproducible phenomena rather than our psychological need to relate to the world in human terms.

What is intelligence, anyway?

This is a word that can be defined easily, but the question itself is incredibly profound, and with substantial implications for how we live today, ignoring the possibility or non-organic life.

the ability to learn, understand, and make judgments or have opinions that are based on reason - Cambridge Dictionary

Each time you give a command to a dog, such as to leave something alone, you are seeing all of these things in action. Each time a dog asks to go outside, once again, you are seeing all of these in action. Each time a cat stands on a shelf, looks at you, and knocks something off, you’re seeing all of these things. If you’ve spent more than a few hours with a parrot, you’ll be amazed at how much they have in common with a human child. This list goes on almost endlessly.

We see non-human intelligence around us constantly. We see non-human sentience around us every day. We see non-human emotion around us every day².

One reason it’s easy for us to recognise these in other animals is that thanks to common ancestors and similar evolutionary pressures, we experience these things in fairly similar ways. While human brains are far more complex, they aren’t so profoundly different that we experience the world in an entirely different way.

When thinking about non-organic life, life that is truly entirely different from us, it might be useful to think about an example of organic life that shows sentience, intelligence, and emotions, but has very little in common with us: octopi.

The octopus may be one of the most fascinating and historically misunderstood animals there is. The Octopus vulgaris has about the same number of neurons as a dog. They can solve complex puzzles, learn patterns, enjoy receiving attention, and even recognise individual faces. Today, these things are known and demonstrable fact. Yet 75 years ago, none of that was understood, and likely wouldn’t have been believed.

Octopi evolved in a way that is so entirely different from us, that we simply didn’t understand them, we didn’t understand their physiology, we didn’t understand their neural system.

I do believe that at some point, humanity will create non-organic life that gains sentience, though I would be surprised if that happens in my lifetime³. I also suspect that it will be like the octopus, in that we don’t recognise it initially. Such a life form would be so far outside our experience, so far outside our understanding, that we simply wouldn’t see it staring us in the face.

The initial draft for most of this section is the product of ChatGPT in Reasoning mode, using the o3-mini model. It has been edited for content and style. The full exchange, including prompts, may be found here. ↩︎
As a society, our respect for the sentience, intelligence, and emotions from non-humans has been something between utterly appalling and appalling. Truth be told, even today, these truths are too often ignored for the sake of convenience. Of course, the same could be said of these things from our fellow humans. ↩︎
I must admit, the more I learn about how LLMs learn and execute chain of thought (CoT) techniques, the more I wonder if we are progressing to this point faster than I expected. I have seen examples of CoT that demonstrate a level of logical analysis at or above the level I would expect from most humans. ↩︎

Millions of Jobs

Thu, 30 Jan 2025 08:57:16 +0000

It has been 20 years since I first used machine learning to solve a complex business problem. The underlying problem was simple: the company was selling a new service and wanted to know who was most likely to buy it. We had millions of records, and each record had hundreds of fields. A vast amount of data, but no idea how to extract insight from it. Countless hours from various data analysts had been invested into finding a pattern, but none was forthcoming. Months turned into years, still no idea of who was most likely to actually buy. Enter machine learning. Over the course of a couple hours one evening, I was testing new techniques with machine learning, and there was the answer. The company met it’s entire monthly sales goal the next day. It found what every human had missed.

This was long before machine learning was rebranded as Artificial Intelligence (AI), but I couldn’t deny the power and potential that it could offer. It was also obvious that once it evolved to the point that it could be broadly applied, it would be a revolution.

We are racing towards that revolution, though to understand what lies ahead, we must first spend a little time understanding the past. This revolution isn’t without precedent, and that precedent is vital to understanding what comes next.

The Industrial Revolution

Going back as far as 1760 may seem irrelevant when talking about the latest technologies that are still in their nascent stages, but the situation was actually quite similar. In a relatively short period of time, new technologies completely changed the way most people worked, how they were paid, how businesses functioned, and both created and destroyed vast numbers of jobs. Without understanding this period of time, without understanding our history, it’s impossible to understand our future.

Looking at textile workers during this time is particularly illustrative. Most of those that spun cotton and wove it into fabrics worked from their homes, working by hand, using simple tools like spinning wheels, slowly and steadily turning raw cotton into a useful product. Over the course of a surprisingly small number of years, some of these workers were in large factories instead, operating dangerous machines, and doing the work of 500 people. Yes, you read that right. A new technology that replaced 500 people that had honed their skills over years, replaced by a machine and a single person. Of those that weren’t hired to keep these machines fed were forced to look for other work, or effectively left the workforce entirely.

This 500 to 1 ratio for cotton spinning is likely the most drastic, and it would be disingenuous to say that these losses were entirely permanent. As these new technologies paid for themselves, businesses invested in more machines to expand their production capacity, which meant hiring more people to keep them fed, plus the occasional work to maintain and repair them. The jobs being created were very different than those they eliminated, with different skill levels, and different pay. The fact that it enabled Britain to effectively compete with India in the production of textiles, despite the fact that wages in India were 1/6th of those in Britain at the time, should tell you everything you need to know about the pay of these new jobs.

Turning this cotton thread into woven fabrics similarly saw massive changes, with a 40 to 1 ratio. A skill carefully developed, replaced by a machine that would do the work of 40 people. This is repeated countless times across various industries, with the new technologies enabling substantially greater efficiency, while costing countless jobs, and creating some number of new, but different, jobs.

This went on, waxing and waning, all the way up to 1913, when manufacturing found the optimal form in Henry Ford’s assembly lines. Turning cars from hand-built & carefully crafted machines, into the ubiquitous mass-produced vehicles we know today.

The trend here is clear and simple: revolutionary technologies and techniques are highly effective at replacing large numbers of workers with specific knowledge and skills, with a smaller number of less skilled workers. Plus creating a few highly skilled workers to support these technologies. Nothing about this is really surprising, and should be well understood, but it’s a preview of what the future holds.

Quiet Part, Out Loud

A world in which human wages crash from AI – logically, necessarily – is a world in which productivity growth goes through the roof, and prices for goods and services crash to near zero. Consumer cornucopia. Everything you need and want for pennies. - Marc Andreessen

The above quote is from a highly active investor in AI companies, and one of the most influential voices in the venture capital community. Before going into the quote, and why this is saying the quiet part out loud, we need to cover some background.

There are two general pricing models for goods and services, the first is the cost to provide the product or service, plus a (small) margin for profit. The second is whatever the market will pay, regardless of cost. In reality, the cost + margin model provides only a floor for what can be charged, while most pricing is based on what the market will pay, optimised for leaving as little money on the table as possible, unless there is so much competitive pressure that the price must be reduced to that floor.

While your milk and eggs have enough competitive pressure to reduce pricing down to cost + margin, while the medications you may take, the electronics you buy, and most other products that you buy are based on what the market will allow, what people are willing to pay. There’s a reason that some medications constantly go up in price and are priced at hundreds of times the manufacturer’s cost - because they can get it. This is the same reason that an Apple macBook costs two to three times that of a PC with equivalent performance - they can get it.

Why is this at all important?

Marc’s point that prices will drop substantially after wages collapse is based on a flawed and dangerous assumption, that goods will be priced on the cost + margin model alone. That simply isn’t how the world works. There’s also the unmentioned issue that to people with no income, it doesn’t matter how cheap products become.

He is likely correct that wages will collapse, that is largely the point. AI, as it’s being developed today, has one purpose: improve efficiency to the point that jobs can be eliminated. This provides allows provides to charge more and more for their products, and results in huge returns for investors.

How wages are likely to collapse is important to consider, as it will almost certainly be a very unevenly distributed collapse. The average income for any given region is likely to drop precariously, primarily as a result of job eliminations. However, we’ve seen that for some roles, such as those building these AI systems are climbing, and there’s no reason to think that will change. Those that can’t be replaced will see great demand and high pay, those that can be replaced, will be left to scramble to find new work.

I believe that there’s good reason to believe this type of stratification will be seen across the board, in all areas impacted by these AI initiatives. Those with certain skills seeing strong demand and high pay, especially at the most senior roles, with greater difficultly for those seeking to enter impacted areas.

Impacts & Future Challenges

Based on the impacts we’re seeing today, and the already signalled advances that we can safely assume will come, there are some things that we can began to make assumptions about, with varying levels of uncertainty and timelines to see these in full effect.

I’d like to talk about those that have been on my mind as I researcher more into where these advances are going. This is far from exhaustive, and may turn out to be incorrect (though I know what outcomes I’d bet on). There’s also a timeline issue that I’d like to acknowledge: some of these could occur next year, others may be a decade away. This is not a short-term analysis, but a long-term look at how these technologies are likely to evolve and impact people.

Software Development

Generally speaking, there are two kinds of developers:

Those that carefully craft their code, attend or speak at conferences, write blog posts pontificating on the correct way to build software, and would often rather leave their job than be forced to write bad code¹.
The other 95%.

The fact is that the vast majority of developers are buried deep in companies, facing tight deadlines, primarily work on line-of-business software, and don’t have time to worry about the best way to do something, because they are too busy just keeping the business running. This silent majority are both the most likely to leverage AI to make their jobs easier, and the most likely to face downsizing as those efficiency improvements allow smaller teams to do the same work.

We are seeing the first steps of what AI will do to software development. The tooling will improve, accuracy will improve, higher-level tools will be built on top of the code generation used today. Many common line-of-business application will eventually be able to be (mostly) generated, needing more oversight and review than active development. It will take a lot longer before the tools become good enough that they’ll start displacing those building commercial software, but commercial software is only a small portion of the software being built today.

Within the next decade, it’s likely that more and more development teams will be replaced by a single business analyst using generative AI to create the internal software powering companies. This builds on trends that have been going on for a decade or more already, though will almost certainly be greatly accelerated in terms of impact.

Creative Arts & Writing

Not long ago, I had an idea for a short story, but it was too ridiculous to invest the time in writing it², so I did the next best thing: I asked ChatGPT to do it. I provided it with the abstract and a couple sentences to explain the plot and message. I waited and expected to get a laugh. What I got was a shock. It was clear, expanded nicely on the idea, and would have passed for thoughtful and creative. I spent months wondering if there was actually a point in writing after this. It did in seconds what I would have spent weeks doing.

This experience if far from unique, and business leaders are seeing that in many cases they can get ‘good enough’ results using current AI tools, compared to paying someone to do the same work. We are seeing this across the web, from journalists being supplanted, AI generated marketing copy everywhere, video games racing to cut costs by using AI generated assets and even replacing voice actors.

Good enough here is critical; in many cases business are fine with a loss of quality when it means that the price to produce a work drops to nearly zero. It’s a powerful motivation, and even a challenge for management to justify paying someone to do work that could be done for free. These roles where a portion of their work can be replaced with ‘good enough’ will see (and are already seeing) some of the earliest impact of AI³. Job opening in these spaces are already seeing increased competition as positions are eliminated.

Truck & Taxi Drivers

While Tesla’s most recent timeline for their long awaited self-driving semi may or may not happen (though I won’t be holding my breath), the fact is that true self-driving vehicles are coming, and coming in mass. There are more than 250,000 taxi drivers in the U.S. today (not counting Uber and other ride-sharing drivers), and a somewhat astounding 3,600,000 professional truck drivers in the country. Most of those jobs are simply doomed. Self-driving vehicles will be able to do the job both with greater efficiency and at a lower cost. With no need to sleep, no need for breaks, these vehicles will quickly wipe out many of these jobs once the technology has sufficiently matured.

Of all industries, professional drivers will likely be hit the hardest by percentage of jobs lost. The industry will be largely obliterated.

Management

Management roles provide both opportunity and challenge for AI replacement. I’ve spent much of my career in management roles, and to be honest, much of the time is simply lost due to things like inefficient communication. So many meetings that could have been an email, so many emails that could have been a couple bullet points, all without losing anything useful. Middle management roles are likely the most vulnerable to being eliminated by AI, as much of the role comes down to overcoming inefficiency. When eliminated, I would expect to see their responsibilities moving up the chain of command, as flatter organisational structures become more popular for their lower costs.

At least one CEO has noted that even he could be replaced by AI.

Information Security

I have been predicting for years that automation will steadily erode more and more work within the security industry. This includes better tooling that reduces work for penetration testers by automating more of the work, and detecting and fixing issues earlier in development cycles. As well as systems to automate a growing percentage of routine work, allowing smaller teams to do more. If you look at the state of the security product market today, this is obvious.

As tooling evolves, and likely evolves at an accelerating pace, the impact on security jobs will likely also accelerate. That said, while these systems will be able to make many of those in security roles substantially more effective, the lack of creativity and ability to perform deep reasoning and analysis will ensure that jobs remain, and are in high demand.

How many jobs will be impacted is difficult to guess, at least based on where things stand today. This is likely the most difficult field to judge due to the various complexities and perceptions⁴ involved.

Plumbing, Construction, Mechanics

Many of the jobs that were once considered the best of white-collar jobs now face greater uncertainty and the worst job stability since these roles came into existence, while some blue-collar jobs are likely more secure than ever.

Plumbers are becoming a new millionaire class, seeing small businesses becoming increasingly successful. This is just one of many jobs that will become more attractive as technology evolves due to the reliable income, constant demand, and job stability.

After the Industrial Revolution, white-collar jobs were often the best paying, most stable, and most desirable. After the AI Revolution, it’s possible that it’s the blue-collar jobs that will start to see competition for jobs, as white-collar jobs evaporate.

Inevitability

This post may have you wondering if I’m actually a Luddite arguing against the evolution of technology. Far from it to be honest, I have spent most of my life pushing technology to the limit. The earliest of early adopters. The cutting edge often old news to me. I’ve always pushed for technical improvement.

I’m also a realist, and having studied history and carefully watching where technology is going, talking about the likely future is critical to be prepaid for it. As much as it’s possible to prepare for revolutionary changes.

While I believe we are still many years from the most important AI breakthrough, Artificial General Intelligence (AGI), though this has largely become a marketing term instead of a technical definition, the fact remains that we are headed to substantial changes. Furthermore, we are headed into this intentionally, with no plan as a society to deal with the repercussions. Leaders on countries are interested in ‘winning’ the race to build the most profitable AI systems, but the impact of deployment hasn’t received any meaningful attention.

Am I predicting an AI disaster?

Many self-proclaimed technologists have spilled endless amounts of ~~ink~~ photons in rising the alarm about how AI could harm humanity, or even destroy us. This is not only of those arguments. We are sufficiently far from building anything truly intelligent, much less intelligent enough to see us as a threat, I don’t see a reason to even entertain these concerns.

My concerns are more immediate, and more focused on how it will impact individuals. If we manage to build a system that is capable of destroying us, and sees us as such a threat that it “feels” the need to take action against us, we’ll have earned the resulting outcome.

The Writing on the Wall

As noted above, I could be wrong, or the process could unfold over decades, instead of the decade or less I’m predicting here. The impact could be less than I expect, or could be drastically worse.

Some things are obvious when viewed objectively, and I hope I’ve provided a useful analysis of these things, and the likely consequences for the future.

To be clear, while it’s possible to read this description is a rather negative way, when I worked as a developer, I counted myself in this group. Don’t take this as a slight, but an acknowledgement that the software development industry is not just us. ↩︎
I do enjoy writing, and based on the feedback I’ve received, it seems to be well received. That said, I don’t write quickly; I spend far too much time rewriting, changing my mind and taking a different approach, and just too much time thinking about what I’d like to actually say. It’s not uncommon for a blog post to evolve over months or even years before I get around to actually finishing it. For short stories and creative writing, it’s far worse. ↩︎
When I talk about the impact of AI on creative works, I’m reminded of George Orwell’s 1984, and the Ministry of Truth’s novel-writing machines that created cheap entertainment for the masses, devoid of any actual creativity. We already see Amazon flooded with generated books, and as these tools become more effective at emulating creativity, it’s not unlikely that some of these will eventually start to perform well. ↩︎
When looking at how roles are impacted, it’s important to look at not only the real-world impact of these technologies, but also the likely perception of business leaders. It’s the perception of business leaders, as well as pressure from investors, that will have the greatest impact on how many positions survive or are created. In some areas, this is easy to see based on public information, for others, it’s more complicated to anticipate the broad perception. ↩︎

Security Is a Shell Game

Sat, 05 Oct 2024 14:59:44 +0000

In the world of security, everything comes down to trust; sooner or later you have to trust something. Often, this something is a human. While we are busy building advanced cryptosystems that will survive the heat death of the universe, sooner or later, digging down layer by layer, you get down to a human and their limited memory. While we may build software, hardware, and other systems to protect this chain of trust, it almost always ends with a human.

I was part of a standards body meeting discussing the security controls of a system, and someone complained that without a certain control, the system would be little more than a shell game. Where the ultimate source of trust was covered in layers and moved around, but never truly secured. They were, of course, correct. Though it’s not because of the missing control, but because the chain of trust ended with a human’s memory.

Any security architecture that involves a human can ultimately be reduced to a shell game, with its strength limited to what a human can readily remember.

It’s not that difficult to design systems that are robust, provable, and provide substantial protection. It’s extremely difficult to design such a system if a human is involved at any point. Human memory is limited, fallible, and degrades over time; thus if a system needs to be accessed by a human, the security of the system will be reduced down to what a human can readily remember. Be it a password, a PIN, or any other secret committed to memory, this will always be the weakest link. A password that one can remember will, without doubt, be of lower entropy and more easily guessed than any other secret used in the system.

When designing a new system, it’s common for there to be many layers, each with its own security properties and trust requirements, each layer assuming that the prior layer is just as secure. Yet, these robust defences, strong proofs, large keys, and detailed trust relationships all end up with the same thing: a secret a human needs to remember. For example, you can build an authentication system that provides a strong proof of identity, great phishing resistance, robust cryptography, and in the end, it’s protected by a password like Winter2024!. Everything is great, until a human enters the picture.

Recovering from Failure

Now, you may ask yourself, why not eliminate the human with hardware? This is why we have hardware security keys, right? In theory, this is the perfect solution, as it eliminates a human’s memory from the chain, and allows every secret in a system to be truly random. There’s a problem though, people don’t have perfect memory and tend to lose things, including hardware.

Once you introduce hardware¹ as the final link in the chain of trust, you face a challenge: what happens when that hardware is lost or broken? There are generally two options here:

Say ’too bad’ and accept that whatever was behind this system you’ve designed is lost.
Implement a recovery mechanism, which adds new links to the chain. Links that end with a human².

Option 1 doesn’t sit well with users (and can have devastating effects), and option 2 doesn’t avoid the problem of relying on a human’s poor memory - it just moves the problem to another part of the system. This is often the case with security, the problem just gets moved because there isn’t a good solution.

This is the point where many otherwise incredibly secure systems show their weaknesses. You can use a secure authentication system like passkeys, strong phishing resistance, randomly generated so they are impossible to guess. Yet the security is reduced to the password for the service you use to sync them (such as an Apple account or password manager) and thus the security of the mechanism to reset that password.

Always the Same Problem

Many years ago when I was becoming more involved in the crypto³ community, one of my favourite questions to ask was how key management should be implemented. What’s the right way to protect that final secret? The answer was always the same: “that’s a good question” followed by quickly changing the topic. The reason is that while it’s easy to hide the ultimate root of trust, add layers, move it around, and build complex systems that would protect against even the most advanced attackers, handling that ultimate key is a very hard problem.

A lot of progress has been made to limit the impact of relying on human memory. Passkeys and password managers allow for far stronger secrets to be used, and with the associated improvements against common attacks such as phishing, this represents a vast amount of progress. However, the same underlying issue still exists.

The fact is that this is an effectively unsolved problem; the solutions could address it add far too much complexity for end users to rely on, and no amount of additional layers or moving the key around will fix it.

Key management has always been the greatest challenge for protecting secrets, and it will continue to be for the foreseeable future. As long as the chain ends with a human, the security of the system will be reduced to what that human can remember.

This isn’t to say that we should stop finding ways to better secure users, data, and the secrets that are critical to protecting them. Incredible progress has been made, and is still being made. Data is better protected today than it’s ever been. That said, that protection is often weaker than we would all like it to be.

This applies equally to hardware surrogates, such as password managers that play the same role that a hardware key would, just with a longer chain of trust involved. ↩︎
This is effectively true, though not strictly true. It’s entirely possible to build recovery systems that rely on additional hardware tokens, though due to the complexity to implement and execute recovery, such mechanisms are far from common. For consumers and the vast majority of enterprise systems, systems like this effectively don’t exist. Only systems that need the highest security and can justify the additional costs and complications consider designs like this. As this post is focused on the common systems that most people are exposed to, any design that’s impractical for broad use won’t be considered. ↩︎
Crypto means cryptography. Yes, that’s a hill I’ll die on. ↩︎

AI: Art Without Expression?

Sat, 22 Apr 2023 21:19:21 +0000

Generative AI¹ is changing the world, and is doing so faster than most of us could realise. While I don’t share the fear that it’ll destroy humanity (something we’re doing quite well at, without help), I do see that it’s having an impact on how we work, how we interact, and will have a growing impact on what jobs survive into the next generation. Just as switchboard operators, pin setters, and lift operators are all essentially extinct today, advances in technology will steadily eliminate some jobs, while creating new ones.

I have much to say on how it impacts developers, writers, graphic artists, and others, though for the moment it’s photographers I’d like to talk about. Photography is my art form of choice, and I’m something of a purest - I don’t edit my photos (other than minor corrections), and they are published just as they were when they left the camera. It’s something I have strong feelings about.

The Quote

I recently saw a quote that pushed me to think more, and to experiment more. I wanted to understand, is what Generative AI produces art, or something else?

You’re Consuming Art That Has No Expression Behind It - Patrick Stump, Fall Out Boy

To start answering this question, we have to look at both how we define art, and how generative AI models are trained, and I’ll start with the later.

AI Models

For a generative AI system to do anything at all, it needs to be trained on a vast quantity of samples - the more samples, the better the results. For a generative AI that produces photorealistic images, that means being trained on huge numbers of photographs. It then takes this vast dataset and uses elements learned from the countless images to produce what it was asked for. These elements are combined in unique ways, based on the description (known as a prompt) that was provided by the user, along with some randomness to produce different & interesting results. How this prompt is structured, what it contains, what’s left out, and what’s indicated as something unwanted all play a role in what is finally created (this is evolving into a new field of its own, prompt engineering).

While the AI system creates the image, it does so based on what the user tells it. It’s useless without training, and it’s aimless without careful decisions from the user.

What is Art?

the conscious use of skill and creative imagination especially in the production of aesthetic objects - Merriam-Webster

There are some important words here that complicate matters for AI, in fact, almost every one of them:

conscious - AI systems aren’t conscious, so they aren’t able to do anything consciously.
skill - AI has great information to work with, far more than what a human could learn from working with more experienced artists, though it has no innate skill, only the ability to combine elements that it’s learned from other’s works.
creative - AI doesn’t create anything that’s truly new, it can only combine what it’s learned.
imagination - Without consciousness, imagination isn’t possible, seeing what doesn’t exist but could isn’t something that software is suited for, and may never be.

If you were to write a definition or art that was intended to ensure that AI could never meet the definition, this is exactly what you would likely arrive at. The definition is broad in meaning, but exacting in the exclusion of anything lacking clear consciousness.

Though, is it actually excluding AI? Let’s take another look at that list, and see how it could be read if we assumed that AI output is art:

conscious - While there’s no good argument for consciousness, the process is not unlike consciousness. The process is deliberate, goal orientated, and structured to complete the task using what it’s learned.
skill - Humans, like all animals, learn from others; our skill is built on the knowledge and experience of others. We learn what works and what doesn’t from others. We learn the foundations of our skills from others. We learn what others appreciate, what’s atheistically pleasing, what works, and what doesn’t, all from others. AI models do something very similar, though at an incredible scale, a scale no human could match.
creative - Humans create things that are unique constantly. This blog post is a unique work, it has never existed in the history of the universe until I wrote it. AI creates unique things as well, while elements may be built from the things it’s learned (not unlike most art today), the output is still entirely unique in the universe.
imagination - AI systems hallucinate fairly often, creating new things that aren’t based on their training, or anything else identifiable. This isn’t quite imagination as human’s know it - though we just may be better at managing it.

As you can see, there’s an argument to be made that it isn’t as simple as some people make it out to be. The expression of a generative AI system don’t directly represent the expression of a human, but it does indirectly represent the expression of millions.

The United States government has been clear that it doesn’t consider non-human expression to be subject to copyright protection, which doesn’t help the argument for this being art.

Though, given that art depends so heavily on the eye, opinion, and perspective of the beholder, it may be best to paraphrase Forest Gump and say simply that “art is as art does.”

The Experiment

What you see above is an image created with Stable Diffusion, while I don’t often shoot portraits, this does align with my style. Creating this image required rendering a few hundred images and the final prompt consists of approximately 50 terms. Creating this image wasn’t a matter of feeding the system a simple command and getting exactly what I was looking for. It was a matter of trial and error, tweaking parameters, adjusting the prompt, steadily improving the image. After hours of work, I had something I was happy with.

This is something that I created, yet was also created by a machine. It is the product on many hours of effort - and honestly more time than I would put into most of the photographs I make. With most portraits, it is a collaboration between photographer and model, though in this case, the model isn’t the human kind.

Is it art?

This is something I’ve struggled with. Looking at my role in the creation, the role of the generative AI, and the role of the countless people that contributed to the model that was used to produce it - it’s complicated. It’s impossible to say that this is purely my creation, as it isn’t. It’s creative, it’s new & unique, it’s my style, and it’s imaginative - from my own imagination, but is it actually art?

Yes. I would argue that generative AI can be a powerful tool for artists to guide creation of otherwise difficult or impossible works - just as Photoshop has been a powerful tool to enable the creation of otherwise difficult or impossible works. When guided by a human with a vision, generative AI can create amazing things that fulfil that vision. Where it becomes complicated is that it can also create something with no vision - just as a 5 year old can create something that is on the surface comparable to a Jackson Pollock work. It’s the vision, the purpose, the message, that separates a pointless creation into art. The tool used for creation is less important that than the vision behind it.

Greater & Lesser Art Forms

Personally, I see art forms as being on a spectrum, with the extremes being the most difficult to create to the least difficult. The most difficult to create are those that require the most skill, the most creativity, the most imagination, and the most consciousness. These are generally those that are creations from nothing, creating from a blank canvas, starting with nothing but a vision. These are the greater art forms, they require a special level of skill, and a special mind.

The lesser art forms allow the artist to start with something, and build on it. For a photographer, this is the world around them - leveraging what people and nature have created. No true photograph is a work of pure creation, but capturing the world from a unique perspective.

What you see here is a “painting” - created with generative AI, and in about 5 minutes. It’s a unique creation, it’s a unique expression, it’s a unique work of art. It’s also a lesser form of art. Unlike a true painting, the level of skill, vision, and imagination are far lower. It may be art, but it’s a lesser form of it. As someone that has little ability to draw or paint, I would be proud of this if it was a creation of my hand - but it isn’t, it’s a few minutes of typing and GPU time.

Generative AI can serve to greatly reduce the skill, investment, effort, and vision required to create something, and in this, the art itself is less meaningful. While it’s possible to invest heavily in achieving a particular vision, the creation is reduced by the reduced influence of the artist. It’s a lesser creation, and its artistic value is thus limited.

Art is Art

Regardless of the tools used to achieve expression, art is about expression and vision. As technology has changed, from simple beads and cave paintings, to generative AI, art has changed with it. Some forms become less popular, new techniques are created, realism comes and goes, but it’s the vision, the expression that matters. Just as photography changed the world of art, replacing paining as the way the world is captured, AI will push art in new directions. As long as there’s a vision guiding the creation, it’s still art.

While I deeply hate the conflation of Machine Learning and Artificial Intelligence (one we’ve been doing for decades, the other, we aren’t there yet), though I’ve given up that fight. I apologise to those still fighting the good fight. ↩︎

On Productivity

Sun, 22 May 2022 19:59:14 +0000

Productivity and efficiency have been passions of mine from a young age, I’m not sure why, but achieving as much as possible, as quickly and efficiently as possible has always driven much of my thoughts, actions, and plans. I was around 10 years old when I learned that there were people that specialised in worker productivity, which led me to researching process design, why restaurants are setup the way they are, the psychology of work and motivation, and a variety of other related topics.

This resulted in a life-long love of psychology, a passion for usable technology, countless hours studying and understanding user experience, and an almost obsessive focus on productivity improvements as a manager.

Inspired by a recent Twitter post, I’d like to share my thoughts, struggles, success, and tools that I’ve found useful over the years.

Write, a Lot

One of the best things you can do for yourself, and for others, is to invest the time to write, and do so in detail. I’ve written before about the importance of writing, and the choice of where you write, though I’d like to offer some specific points for this discussion.

Notes

Writing notes for yourself, or to be shared with others, is critical to being productive. Spending a few minutes during the course of your day can make a remarkable difference in terms of clarity, and your ability to come back and refresh your memory. Look at your notes as an extension of your mind, a way to gain additional storage of details, beyond what your mind can do alone.

I’ve used nearly every major note taking tool on the market, with varying degrees of success.

Logseq - This is my tool of choice, and I’m a huge fan. It’s open-source, all storage is local (but can be synced in a number of ways), and evolving rapidly. In short, it’s a form of wiki that runs locally, it’s an outliner, so everything is a bullet-point list, creates daily journal notes, and it’s all in Markdown for easy editing. This just scratches the surface though, I can’t recommend it enough, if you haven’t tried it, you should.
Roam Research - Before moving to Logseq, this was my tool of choice. It’s similar to Logseq in most of the important ways, though everything is hosted on their servers, and there’s essentially no transparency when it comes to the security of your data. Moving from a traditional note taking tool to Roam was a life changing experience, though a poor mobile experience, constant delays on promised features, and a bizarre and aggressive approach to dealing with users drove me away.
Standard Notes - This is a hosted, but highly secure, solution for your more traditional note taking needs. I’ve been following the effort from its earliest days, and played a role in their first security audit - everything I’ve seen has been impressive. While it didn’t end up meeting my specific needs, I still highly recommend trying it.
Evernote - I’ve used Evernote since 2009 (at the latest), and I still have a substantial amount of content in it. While their security pales in comparison to Standard Notes and Logseq, it’s a robust tool that is extremely useful, especially for certain use cases (such as searching with PDF files). It’s this ability to search that keeps it around in my digital life, though in a steadily diminishing way.

I’ve also used pen & paper (not having it away from the office became too annoying), GoodNotes on my iPad, and even a ReMarkable (which tends to just collect dust for weeks at a time). There have been numerous others that I’ve tried, though didn’t use enough to make this list.

What’s important, is that you find a tool, workflow, something that works for you, and use it consistently. Notes are only valuable when you are consistent in taking them, and referencing them, you have to stick to it to get the most value out of the time invested.

Communications

Brevity is the enemy of clarity. When trying to convey a point to another, brevity isn’t a positive attribute, it opens the door for incorrect assumptions and misunderstandings. I’ve written about the need for effective communication, for respectful communication, and will be writing about communication again soon.

While talking about taking more time when communicating may seem counter to the goals of an article on productivity, it really isn’t. Ineffective and insufficient communication take far more time, attention, and effort to correct than just getting it right the first time. Good communication takes time, time to write, time to read, time to understand - but in the long run, it’s a valuable investment.

Focus Time & Calendar Blocking

The ability to focus on a task and see it through to completion is critical to being productive, and that’s not possible with constant meetings and interruptions. I strongly suggest that everyone should set 1 day a week aside on their calendar just to focus and get things done. No meetings (unless they are critical), avoid instant messaging, and check off as much as possible on your todo list.

For me, this day is Monday. There is an event on my calendar that blocks the entire day, the details of the event are public, and it’s listed as “Important meeting only please” - making it clear that in an emergency, I’m available. This gives me a full day to work on larger tasks, without the normal stream of interruptions.

If you work remotely, put your lunch break on your calendar. This ensures that you have time to eat, relax, refresh, and recharge. When working remotely, and especially across time zones, it’s difficult for people to know when they are stepping on lunch or other breaks, blocking that time on your calendar ensures that it’s respected.

I also have 15 minutes at the end of each day blocked out to update my notes, todo list, and prepare for the next day. This is essentially a wind-down task, allowing me to perform a brain dump before stepping away. The serves to ensure that I make time to do it, and is a reminder that it’s time to call it a day and wrap up.

The other benefit of blocking out time like this is it creates accountability, if only to yourself.

Prioritise, Ruthlessly

Time is precious, and so is mental bandwidth - to make the best use of both of these, prioritise tasks and limit what you try to focus on to just a few things, and the most important things, at any time. Once those are done, look at your list and prioritise again.

If it’s not that important, if it doesn’t move the needle, move it down to a lower priority. If you are trying to work on too many things during a day, you are likely setting yourself up for failure, frustration, and burn out.

If it get’s moved down too far, just drop it completely. Not everything is going to happen, some things are just going to get dropped.

Ruthless prioritisation is difficult, and it requires being able to say no, to push back, and to accept the limitations of your time. This is a skill that is developed over time, but an important one if you actually want to get things done.

Understand your Peaks & Valleys

You have natural, biological rhythms that define when your energy peaks and when it drops, and you need to understand these rhythms. You want to tackle your hardest tasks when you are at your peak, and save the easier tasks for the valleys. This ensures that you are at your best when you are tackling the hardest challenges.

For me, I use RISE, an app that tracks sleep, sleep debt, circadian rhythm, and other useful bits of data. This level of insight has helped me to better plan my days, and improve how I work.

Understand your Motivations, Passions, and Challenges

You are an amazingly complex being, and most people really don’t understand how or why they do what they do. For example, why do people play the lottery? Because random rewards (intermittent reinforcement) are more effective than predictable rewards. Just as random punishments (intermittent negative reinforcement) can create a culture of fear and doubt more quickly than consistent punishments.

If you feel like your work is making a difference, the time will be more productive, where if you feel like it’s pointless or meaningless, it’s likely that the work will take longer and the time spent less productive.

If you suffer from an anxiety disorder (something amazingly common in the security industry), you may avoid tasks that would otherwise be simple and straightforward, because it’s uncomfortable. This can cause delays (which cause further issues), result in communication failures, and a variety of other problems. You need to understand how this impacts your work, how it impacts your motivation, and then you can begin adjusting for it.

If you suffer from ADHD, there are a variety of issues that can pop up, all of which impact how you work. You may be subject to hyperfocus, which causes you to get lost in a task, at the cost of all else. You may find it difficult to stay focused on a single task, causing you to jump around constantly. You may find it difficult to stay organised and manage time efficiently. As with the impact of anxiety, you need to understand how these symptoms impact you, so that you can adjust your day and your planning to compensate.

Only with an understanding of how you work can you optimise for what drives you, what holds you back¹, what makes you want to start work in the morning, and what makes you count the minutes till the day is over. You are the only person that can build a workflow that’s suited for you, and makes you as productive as possible.

Just Do It.

If a task is only going to take a few minutes², just do it now. Don’t write it down, don’t add it to your list, just get it done and move on with your day. These little tasks take up mental bandwidth, slow down prioritisation, and add to the burden of making real progress.

Whatever you’re doing, you can afford those few minutes, and it’s an investment in making the rest of your day easier.

Build Confidence, then Build Wins

Don’t start with the hardest tasks, either your day, or a new project, start instead with easy wins, the low-hanging fruit. As you work through the easier tasks, you build confidence, understanding, insight, and context, so that when you do take on the hardest parts, your mind is in an ideal position to tackle it.

Saving the hardest for when you’ve built up confidence sets you up for success (a tip I learned from an art conservator), and when aligned with your peak energy for the day, you’ll find that it’s easier and quicker than expected.

Work Hard, Play Hard

When you are working, minimise distractions, focus on specific tasks, take breaks to refresh, and move on to the next. When you are working on a specific task, try to avoid instant messaging, email, Twitter, and anything else that will draw your attention away. Focus as much as you can, and move on. While this can sometimes be a challenge, avoid distractions is a key to improved productivity.

When possible, group your meetings so that you can power through them, and then go back to focused work. Having meetings scattered through the day, with 30 minute breaks is a great way to generate a lot of wasted time.

When you are done working for the day, be done. Step away, go do something you enjoy. As a workaholic, this is certainly something I struggle with, but working more hours doesn’t translate into getting more done - working more hours just means that you are more tired, less focused, and less productive. You need to get away from work and do other things to recharge to be as productive as possible.

Dedicate time to hobbies and passions, make time for the activities and people you love.

I call out anxiety and ADHD as I live with both of these, and have had to find ways to manage the symptoms as best I can. Sometimes I do this effectively, sometimes I’ve utterly failed. It’s a challenge, but you must understand yourself to be able to change things in a way that works for you. ↩︎
Some say the cutoff for these do it now tasks should be 2 minutes, others say five minutes, what matters is that you set a limit that works for you, and follow it as consistently as you can. ↩︎

Taking Responsibility for the Spotlight

Sat, 25 Sep 2021 17:27:42 +0000

Today, something happened that made me think carefully about my platform, my time in the spotlight, and how to best leverage my position to help others. Hopefully, you’ll find this to be thought-provoking and consider your own position and how it can be used.

Your Platform & Your Responsibility

As a leader, there’s an undeniable responsibility to help others. This may mean being a mentor to someone just joining the industry, or giving opportunities to someone that would otherwise not get the break they need. As someone that’s been fortunate enough to earn leadership roles and something of a reputation in the field, I’m keenly aware of the responsibilities on my shoulders.

There are many things expected of those in positions of power, being a wise leader, compassionate and protective, leveraging the position to help others instead of greed and attention. But, unfortunately, so many that have built a name have become consumed by their ego, and lost sight of their responsibilities to the community and the world.

Understanding Your Platform & Power

Be it in professional or social venues, there is an undeniable influence that comes with the exposure of being known or having an important title. This platform can be ignored, sitting dormant and benefitting none, it can be abused to cause harm, it can be used to boost one’s ego or bank account. However, that platform can also be used to help others, drawing attention to causes that matter, to people who deserve to be heard, lift others up, and give them a chance.

An idle word by some can make or break a career, or even make or break a person.

The platform we each have can be a tool for good or evil; it’s up to us to understand our influence and how to best use it.

A Case Study: The Manager Looking for Brides

A dear friend of mine, who passed away far too soon, once shared a story from early in her career that she had never shared publicly. Hopefully, she wouldn’t mind me telling it here.

She worked as a developer for a government agency, one of the few that are often seen as a goal to work for; a place kids aspire to build a career at. She was very good at her job (she was one of the most brilliant people I ever met), and her performance reviews reflected the value she added. When she was eligible for a promotion, she had every reason to believe she would get it. However, when she met with her manager to talk about it, not only was she passed over, he made her question all of her decisions and questioned her own value.

He explained that she not only didn’t get the promotion, but she wouldn’t be getting one in the future. It had nothing to do with her technical ability, soft skills, or anything else. It had to do with the reason he had hired her in the first place.

You see, this manager firmly believed that a woman’s place was at home, waiting on her husband. The only things he thought a woman should do is take care of her husband’s house and carry his babies.

The office she worked in was in the middle of nowhere, and people found very few reasons to stay — especially younger men. Unless they had settled down with a family, that is. This manager had developed a strategy to keep his male developers from moving away to better jobs, hire young & attractive women, and hope they would turn into brides.

She was hired for the sole purpose of being an anchor, to keep a man from moving away. Not for her intellect, ability, knowledge, but her looks and ability to bear children.

In a two-minute conversation, he broke her spirit, her hope for the future, her career goals, and her belief in herself. Words from those in a position of power can be devastatingly powerful.

The Event

During a meeting to discuss an upcoming webinar, I was asked if I would be the only speaker; my photo and bio would be posted, I would be the one on camera, it would promote my name just a little bit more. This isn’t anything new for me; I’ve been working to build a name in the field for years, establishing myself as a trustworthy source of information and insight. But an important thought ran through my mind before I could answer the question.

It wasn’t a question of who could do it better (I’m sure anyone involved would do great), or how to best leverage just a bit more exposure for myself, or who would enjoy it more; none of these crossed my mind. Instead, it was a question of who would be best served by more time in the spotlight.

I’ve tried to help everyone I can; I’ve tried to be fair, compassionate, I’m a fierce protector of my team, I listen to the experts on my team — though I’m not sure now, looking back, that I’ve done as much as I could to share the spotlight.

For those newer to the field, those less represented, those that too often feel they are alone in this industry, the spotlight can be important to building their own name, and showing others that there is room for them too. Three women on the team volunteered to help with the project; I don’t need the spotlight, but it could have far more impact for them.

The last thing the world needs is yet another webinar led by a relatively stereotypical boring white security guy — what is needed is for those less represented to be given a chance to get ahead, build their name, and show others that there’s room & opportunities. In a split second, I could claim this particular spotlight for myself, share it with others, or hand it to them, so it’s their own.

I handed it to them, so they are front & center.

As leaders, we have many of these decisions to make, simple things that can make a massive difference to those we work with. When we look for them, look for chances to elevate others, there’s no shortage of opportunities or people that deserve them. What we do lack, as an industry, is enough people that are keeping their eyes open and leveraging their position to lift instead of belittling.

Looking for opportunities to place someone else in the spotlight comes at no harm to leaders, and helps to create future leaders. This isn’t some substantial sacrifice as would seem from the number of people that don’t even try; it’s just a matter of awareness of your position and ability to impact others positively. Unfortunately, this awareness of impact, both of words and actions, is missing more often than it should ¹.

To be a great leader, you have to lift everyone up, give them the chance to grow, the opportunity to be better. If you do your job right, you’ll create leaders that are better than you; that’s not a failure on your part, it’s success, it means the future will be better.

We all have obligations to others and the future. We all have a duty to leave the world better than we found it.

I recently wrote about the unintentional impact of words in “Communicating With Respect” — it’s too common for a person to misinterpret something that is said due to issues with communication style and tone. ↩︎

Communicating With Respect

Fri, 24 Sep 2021 20:31:09 +0000

Communication can be a real challenge; working across cultures, backgrounds, experiences, and perspectives can result in different interpretations — and this is under the best of circumstances. However, when it’s written communication, the challenge is multiplied due to the lack of feedback cues from facial expressions, body language, and the like. These challenges make it exceedingly easy to create a situation where what a person hears is entirely different from what the speaker (or writer) intended.

These disconnects can create many negative impacts & make productive communication impossible. When communicating as a professional, there are a number of things to keep in mind, a few of which I’ve collected here.

Perception is Reality

What you intend is effectively irrelevant when communicating with others; it’s their perception that matters, as that’s what they will act on. For example, you may intend to be supportive, and it could instead be seen as patronizing. You may intend to say something that spurs conversation and instead shut it down. Perhaps you intend to take a strong position on something you care about, but in the process, you come across as a bully. These perceptual mismatches are all too easy to create through less than ideal communication, and, likely, we’ve all confused our listeners many times by making mistakes like these. When a person reacts to your communication, they can only infer your intent - and it can be drastically different than your actual intent.

Just because the intent was good doesn’t mean that the result will be; philosophy has an entire school of thought about this, consequentialism. In consequentialism, one’s intent isn’t considered when determining if an act (or lack of action) is right or wrong. Only the result it produces is considered. If you do something with the honest intention to do good, but it works out to cause more harm than good, then the action was wrong. While consequentialism is about morals, it also works for communication. How a person perceives what you have to say matters, not the intent in your mind while saying it.

With so much that can go wrong, we must be diligent in placing ourselves in the recipient’s shoes — try to do our best to see how something would be perceived, and adjust as needed to minimize the risk of them coming away with a different meaning. Of course, it’s impossible to get this correct 100% of the time, but it is possible to try 100% of the time.

Words Matter

Words have meanings, often more than one, and sometimes different meanings to different groups. What may seem innocent to one group, may be insulting or demeaning to another. What may be a minor expression of opinion to one, maybe inflammatory or aggressive to another. Thus, our choice of words is critical to ensuring that our communications achieve our intent, instead of leaving the meaning up to the ambiguity of inference, or worse, creating a perception entirely at odds with the original purpose.

The use of inflammatory terminology, calling an entity evil, for example, can send discourse into dangerous territory and lead to people feeling attacked or bullied. It can lead to shutting down a conversation or leave it spiraling out of control, becoming ever more problematic. If you find yourself using any of the following, you should likely reconsider your word choice.

Always, Never, Everyone, No-one, Best, Worst - This is a sign of oversimplification and generalization.
Overstatements & Exaggerations - Statements should be fact-based, clear, and accurate.
Extreme Words - The use of words that evoke extremes (evil, obnoxious, devil, etc.) set the stage for hostility and degradation of discourse.
Name Calling - While one wouldn’t generally do this in a professional context, it happens more often than it should, especially when referring to external entities. This is another dangerous territory, and can have particularly harmful effects even when the target isn’t part of the conversation.
Implications - It is easy to make assumptions about the feelings and positions of the recipient, and imply certain things without directly stating them. This can lead to varying understandings, and even outright wrong interpretations when those assumptions are incorrect.
Omissions - By omitting details, such as other facts, different opinions, mitigating factors, and the like, it’s possible to create an inaccurate view, and create a variety of interpretations among those with portions of the missing information.
Facts vs. Opinions - There are places and times that opinions are perfectly appropriate, but they need to be expressed as what they are, opinions. Care should be taken to avoid a listener (or reader) confusing opinion for fact. This is particularly important for professional opinions versus personal opinions; my personal opinion of something may be quite different from my professional opinion of the same thing. Professional opinions are held to a higher standard and are more influential; as such, it’s vital that they not be mixed.

Sexist language, racist, homophobic, transphobic, and so many other categories should be avoided at all costs, even when quoting another source. There are many types of exclusionary and offensive language, all of which are harmful regardless of who the intended target is, or if the intended target ever hears it. Generally speaking, if you have to ask if it could be offensive, it’s best to look for other options (or completely reevaluate what you are saying).

Words Have Meaning

As the speaker, the onus is on you to understand what a statement means and how different people could understand it. At times, people will use a term that they believe to be innocent, but is problematic. While the intent isn’t to offend, it doesn’t make the use of such a term less offensive. This requires a conscious effort to understand different groups and how they use terminology, soliciting and listening to feedback. A constant process of education to ensure that your understanding of a term is accurate and not offensive.

This requires self-awareness, sensitivity to others, and the willingness to invest in being a better and more effective communicator. Not everyone does this naturally; for some, this is a more significant and more conscious effort, though it’s an effort that is necessary.

Given that perception is the reality to the listener, it’s imperative to make this investment and clearly understand every word and its various meanings.

Don’t Close the Door

Professional and respectful discourse should be encouraged; this means being open to contrary views, opinions, and perspectives. Unfortunately, it’s all too easy to shut down a conversation through poorly considered communication, leaving others involved with no desire to continuing to engage. Even worse, it can create an environment where ideas and opinions are withheld out of fear of the response. When the door for respectful and honest communication is closed, it comes at a cost — great ideas that are never considered, new perspectives that go unheard, useful information goes unshared, and the potential for adversarial relationships to develop.

There’s no expectation for everyone to always agree, but everyone deserves to be heard, and have their thoughts and ideas fairly considered. This is impossible when they are reluctant to share them because of poor and ineffective communication styles. Progress isn’t made when ideas are suppressed; success isn’t achieved when thoughts are held up by fear.

Discourse should be open, honest, and respectful. Anything less than this is an error that should be addressed as quickly as possible, lest a culture of fear and isolation develop.

Everyone Deserves Respect

Every person, regardless of innate trait or choice, deserves to be treated with respect, deserves to be heard, deserves to work without fear, or degradation, or condescension, or a thousand other things that place barriers, restrictions, limits, or otherwise hold them back from being their best. There’s never a valid reason for being disrespectful in professional communication or a professional environment (or, frankly, in any communication or environment).

Think about how the people you are communicating with will feel, what they will think, how your words will impact them. Try to understand the world from their perspective and consider your words in that light; this can often expose issues that would otherwise be missed; empathy is crucial to good communication. Coming to a conversation from a point of empathy allows you to understand issues and challenges easier, will enable you to find better solutions, and more quickly come to a shared understanding. If you engage without empathy, without understanding the other parties, you are not only working with woefully incomplete information, you are allowing your own biases and opinions to color the discussion. This likely means you are missing crucial points that could be addressed if you were working with a better understanding, and more open to their perspective.

It is your duty, no matter your role, to treat everyone with respect, including hearing them (not just letting them speak) and engaging in a good-faith manner. Nothing less than that should be accepted.

Hearing vs. Allowing Speech

Allowing a person to speak is a simple and inactive task; hearing them, on the other hand, is an active task that requires several things:

Paying attention to what they are saying and how.
Understanding their perspective, challenges, and issues.
Setting aside your biases and preconceived notions so that you can empathize and actually understand them.
Reserving judgement until you are fully informed, instead of making decisions or forming positions based on incomplete information.

If you don’t make an effort to actually hear a person, you are doing them and everyone else a disservice, and you are not truly engaged; if you are in a conversation just to support your own views and opinions, you are almost certainly speaking without adequate insight to form a meaningful position. Thus, you’re doing more harm than good. While you may still come to a position that disagrees with others you are communicating with, this position should be born of careful consideration of all relevant information, not just the information you came into it with.

Conclusion

Take time to think about what you say, how others will feel, and you’ll be able to engage at a more meaningful level. This does require effort, but it’s a worthy investment, and you owe it to those you work with. These more meaningful conversations lead to better results, better ideas, better solutions, better relationships, and a better environment.

Everyone deserves respect, and it should be demonstrated in how you communicate.

On Software Subscriptions

Sun, 12 Sep 2021 06:39:33 +0000

Like many in this field, I am always looking for ways to improve my workflow, improve my productivity, achieve more. Part of this is evaluating new tools that help me get work done, tools that become critical to my process. While looking at something that could be useful, I had a startling realization — but there are a couple of things I’d like to cover first.

Supporting What You Love

I always try to pay for things that make my life better and support businesses that give me real value. When I worked in an office, I would always eat lunch at locally-owned restaurants; I wanted them to succeed, I wanted them to stay in business, so they got my money. There are many things that I pay for that I don’t have to, but I want them to keep making my life better. I don’t need to pay for a Twitter client, but I do. I don’t need to pay for a note-taking tool, but I do. I don’t need to pay for a to-do list tool, but I do.

You see where this is going. There are a lot of ways to keep a few dollars in your pocket, but this comes with the risk of that tool that’s making each day just a tiny bit better going away sooner. Support businesses that make your life better and invest in their future, so they will still be around.

Tools I Use & Love

I use several tools every day that make me better at what I do, more effective & productive. I’m sharing these because they make life better for me, but there’s also an interesting point here.

Roam Research (Subscription) - This app has been close to life-changing; being able to easily extend my memory has had a remarkable impact. While it’s easy to see this as just another note-taking tool, until you’ve used it, you don’t know what you’re missing out on.
TweetBot (Subscription) - I spend a fair bit of time on Twitter, and this is by far the best interface available, no ads, no refreshing while you’re reading, no nonsense. If it weren’t for TweetBot, I probably would have given up on Twitter.
Remember the Milk (Subscription) - I’ve been a paying user of RTM for quite a few years and use it for everything. From reminding me to take out the trash to tracking long-term projects. It’s been an essential part of my work from the first day I used it.
Ulysses (Subscription) - Undoubtedly the best dedicated writing app on the market, especially for truly long-form writing projects. Excellent focused interface, and a pleasure to use.
1Password (Subscription) - While it shouldn’t be a surprise that I use 1Password given that I work for them, I was a paying customer for several years before I joined the company. This is the first application that gets installed when I get a new device, and holds my entire life, COVID-19 vaccination card, driver’s license, social security numbers for my whole family, all of my credit cards. You name it. I don’t use 1Password because I work for them; I work for them because I use 1Password.
Evernote (Subscription) - While I mainly use Roam for capturing notes, I have used Evernote since 2008, and there are some use cases where nothing else competes. The use of OCR to allow searching within documents has made it vital for me, as it allows me to quickly find important information in a vast archive.
iA Writer (One-Time Fee) - For larger projects, I find Ulysses to be the best option, though for smaller efforts (like this post), I’ve found iA Writer to be a better and more natural fit. Great focused writing environment (even beyond what Ulysses offers), and just the right feature set to do what you need to, without any clutter or complications.
JetBrains Developer Tools (Subscription) - Almost all of my development work is done in one of their tools, so I’ve subscribed to their “All Products Pack” for almost seven years. Every time I see the transaction hit my credit card, I honestly smile. The value for the money I’m spending is just incredible. (They offer free licenses for open-source developers — but I love the products enough that I’d rather pay for them.)
Adobe Photography Plan (Subscription) - Given my history as a photojournalist and my continuing love of photography as an art, having good tools to manage and correct photos is important.

All of these are important to me, and have a profound impact on not just my ability to work efficiently, but also impact my hobbies, and my day-to-day life in important ways.

Evaluating Things

The “Things” application is a popular and extremely well-reviewed task manager — and I’m always looking to up my game — so I thought I’d check it out. A critical aspect of my workflow is the ability to work from a variety of devices:

MacBook Pro - My primary work device, though large and hot, so it typically stays on my desk.
iPhone - I spend a surprising amount of time working from just my phone, because it gives me access to everything I need for a number of my tasks.
iPad - My iPad is my go-to device when I’m writing or need to get away from my desk.

Looking at reviews, checking out features, seeing what people are saying about it, everything looked like it would be a viable option. Then I saw something that was surprising, but moreso, my immediate reaction surprised me even more.

The macOS app is $49.99, the iPhone app is another $9.99, and the iPad app is $19.99 — that’s $79.97 for all three platforms. Thankfully, they offer a trial for the macOS application, but given my workflow, just using that trial wouldn’t be enough to know if it would work for me. I need to use all three to understand if it makes things better.

Before I go on, I want to make it clear that I have no problem spending the money on good tools; their impact on productivity and quality of life is often more than worth it.

When I saw the fact that each platform is priced separately, my immediate reaction was comprised of two things:

Disappointment at needing to spend almost $80 just to know if it’s worth spending money on it.
Disappointment and surprise that they didn’t offer a subscription.

The fact that my immediate reaction was disappointment that they weren’t offering a subscription rather surprised me.

The Move to Subscriptions

Looking at the list of the most critical tools in my life today, all but one are subscription-based. Some of them have always been subscriptions, but a number started out selling licenses at a one-time fee, then later switched pricing models. Given that only one still charges a one-time fee, it’s clear just how powerful this trend is.

But why? Why are so many companies moving to this pricing model?

A few important factors apply to this decision; some are obvious, and some aren’t. Let’s compare a few of the key differences between the two models, and how they impact the business and ultimately impact the user.

Revenue predictability — there are some substantial differences in how predicable the flow of cash is between these two models, which has a considerable impact on how a business operates:
- Subscriptions: This shouldn’t come as a surprise; companies like to know how much money they are going to bring in. Keeping in mind that the national average (U.S.) for a Software Engineer (according to Glassdoor) ranges from $108,000 to $141,000+ depending on level (though it can be substantially more), it’s good to know if you’ll be able to make payroll. This is just one of many places where being able to guess how much money will be coming in makes a big difference.
- One-time Fee: Unlike subscriptions, the one-time fee model makes it much harder to predict revenue, and thus makes it more difficult for a company to invest in the future (as they need to keep larger cash reserves). This leads to slower growth, fewer features, less support, and a variety of other decisions that can be bad for end-users. This also leads to some interesting risks, such as a new macOS release breaks a key feature, and you miss your ship date — does this put the company at risk of depleting its cash reserves?
Spending control & predictability - One difference often cited when comparing these models is control of spending and predictability of spending:
- Subscriptions: Costs are predictable, typically billed monthly or annually. It’s easy to understand what you’re spending and when it’ll happen; that said, you have no choice about these regular payments if you wish to keep using it.
- One-time Fee: Some like the fact that with one-time fees, they get to decide when they are spending money on a product, instead of having recurring charges. Of course, you don’t know when a new version will come out, or if it’ll have the killer feature you’ve been waiting for, so there is control but less predictability.
When do new features get released - due to the differences in business models that the different pricing models drive, there are fundamental differences in how new features get into the hands of users.
- Subscriptions: New features are typically released as soon as they are ready, with no need to wait. This gets improvements into the user’s hands as quickly as possible, constantly improving the value proposition.
- One-time Fee: Every time you build a new feature, you have to ask if it goes into the current version or is held back for the next paid upgrade. This means that users are missing out on what they want while companies save up new features until they have enough to justify a paid upgrade. Then, instead of releasing new features when they are ready, they get held back to produce more income.
Support - supporting users in these two models is rather different, and given the cost of providing quality support, it can make a big difference.
- Subscriptions: It’s easier to keep the majority of users on the latest version, with all the known bug fixes in place — this keeps support costs down and quality high.
- One-time Fee: There is likely a broader range of versions in use (as some users won’t pay for the upgrade), leading to more customer support work and longer resolution times. This can put a business in a difficult position, deciding how much to invest in fixes for old versions that aren’t generating any revenue, when to cut off support for older versions, or what level of support is tolerable given the demands of supporting multiple versions. All of this leads to customers having a less than ideal support experience.
Is a paid upgrade just a money grab? When a new paid upgrade is released, you have some users who will immediately pay, but you’ll also have some who think it’s just a way to get more revenue. Is it being released because it’s ready, or because the company needs to make payroll? Every paid upgrade will make some people happy, but will destroy the hard-earned goodwill with others.

Many more points could be added here, though it’s clear that the one-time fee model comes at a cost for both the company and the customer — for little, if any, advantage. The one-time fee model really is a relic of the days when software was shipped on a floppy disk (a 3D-printed save icon for the younger crowd). It wasn’t used in the past because it was the best model, but it was the only practical option.

Moving to subscriptions delivers more value & delivers it faster. While not everyone is happy with this model, there’s no denying that it’s where the industry is heading — and increasingly, what customers expect. Much to my surprise, it’s what I’ve come to expect.

Win by Building for Failure

Sun, 22 Aug 2021 19:30:33 +0000

Systems fail; it doesn’t matter what the system is. Something will fail sooner or later. When you design a system, are you focused on the happy path, or are you building with the possibility of failure in mind?

If you suffered a data breach tomorrow, what would the impact be? Does the system prevent loss by design, or does it just fall apart? Can you easily minimize loss and damage, or would an attacker have free rein once they get in? How would your customers or clients be impacted?

Going Down the Wrong (Happy) Path

These are essential questions that should be asked when you are working on a new system, but too often, it’s the happy path that gets all the attention. That path where nothing is unusual or exceptional, where you get to show off your skills and make everyone excited. Here’s the thing about building a system that can withstand failure: most of the important work should never be noticed and never excite anyone — at least if you did the job right.

Designing for the happy path is easy, it’s comfortable, it makes for great demos and glowing reviews. But, unfortunately, it’s also a path to disaster. The reality is that things do go wrong; sooner or later, something will push you off that happy path.

If you want something that can stand the test of time, and give your customers the assurances they deserve, you need to build for failure.

Defining Building for Failure

It’s all about defense in depth and resilience; it’s designing an architecture that anticipates failure modes and includes mitigations in the core of the design (not as an afterthought to please an auditor). Great systems fail gracefully, not just in the face of common issues, but also in the face of attackers.

While I may be biased, my favorite example is one of the more critical security features that my employer (1Password) uses: the Secret Key. This is a high-entropy string that is mixed into the authentication process by the client, and thus is required to access an account or derive the encryption keys to access data. This provides a very important security property: if someone gains access to the 1Password database, they have no hope of getting into a user’s data. Because 1Password never has the Secret Key, the database is useless alone — only when you have the data, the user’s password, and the Secret Key can data be accessed.

This is building for failure; while 1Password doesn’t expect to be breached (and never has been), the system is designed so that if it ever happened, users would be protected.

How this can be implemented obviously varies depending on the system, but using additional defenses such as cryptographic controls (i.e., keys that you don’t control) can add substantial protection. In addition, ensuring you have proper monitoring, alerting, and segregation of your infrastructure can slow an attacker down, or prevent them from pivoting to more valuable targets — and this has to apply as much to a rogue employee as it does to an outside attacker. There are a number of these steps that should be taken to ensure that if an attacker is able to get in, they don’t get anything valuable.

What’s important here though, is that it requires changing the way you think about threats to your customers in an important but non-obvious way — you are always a threat to them. When you design with that in mind, seeing yourself as one of the threats, you can build more robust systems that are far more likely to withstand attacks. It’s this perspective that allows you to see with better clarity how you can defend your customers most effectively. I’m not saying that you shouldn’t trust your employees; while insider attacks do happen, they aren’t that common. I’m arguing for a change in perspective so that it doesn’t matter who the malicious actor is.

When you define a threat model — even an informal one — always include yourself as one of the threat actors. While your intentions may be pure, there could be a breach of your systems, a rogue employee, demands from a hostile government, or a thousand other things that make you a genuine threat to your customers.

Honesty & Transparency

During a job interview a few years ago, I was asked a question that I had never heard before; it struck me as interesting as there was only one possible answer¹.

When is it okay to lie to a customer?

I paused for a moment to think this through; the singular answer was so obvious that I wondered if I had missed something. I replied with “never,” and then we discussed the question at length — it turns out that a surprising number of people see no problem with deceiving customers, or identify countless exceptions or justifications.

Never, ever, for any reason at all, ever lie to a customer.

There is no easier way to destroy trust, to kill longstanding relationships, eliminate goodwill, and poison future prospects. Customers value honesty, and even moreso when it’s painful. It’s easy to lie, to keep secrets, to hide damaging information; while being honest can be quite difficult — but, as with all things in life, there’s a price to be paid for taking the easy option.

When something goes wrong, own it. Be transparent, be open, be honest, and give your customers the information they need². There may be pain in the short-term, but long-term, you earn respect for how you handle painful situations.

Blameless Remediation

When something does go wrong, how do you respond? Is it a hunt for who to blame, or is it an opportunity to learn? Placing blame is not only ineffective, it’s actively harmful — people will protect themselves at the cost of their employer or users if they have to. They will shift blame, withhold information, hide errors, or even hide breaches when they think their job is on the line.

There are two ways to view these events:

A human error, where blame is assigned, and punishment is needed.
A systems failure, where learning and improvements are needed.

One of these leads to a loss of talent and a deeply hostile and dysfunctional environment, and the other leads to continuous improvement. If you are building with a long-term view, only one of these is rational.

Blame should never be placed on an individual³, but instead seen as a flaw in the system that allowed the error to progress to the point that it had an impact. If you call out those involved by name anywhere in the process, you are almost certainly doing it wrong.

While certain information is needed to ensure a proper understanding of an issue, such as the Pull Request that introduced the issue, the focus should not be on who was involved, but instead on the specific details of when it was introduced, if policies were followed, and what’s wrong that allowed the issue to go unnoticed. Again, the focus should not be on the individuals, but the process.

To foster an open and effective environment, everyone needs to feel comfortable presenting the bad news; nobody should ever feel fear when something goes wrong.

It’s a learning opportunity, and one too valuable to waste.

Conclusion

While nobody expects to suffer a painful security failure, it’s vital to build for them from the beginning. By doing this, by seeing yourself as part of the threat model, you build a system that is far more able to withstand attacks than a system build under the assumption that everything will always go right.

It’s more work to build with failure in mind, progress seems slower, designs are more complex, you spend countless hours on details that will hopefully never matter — but in the moment they do matter, they will change everything. Sometimes engineering secure systems is thankless work, but it’s vital if you care about your customers.

I take a utilitarian view of the world, and try to apply this philosophy to all my actions. While automatically seeing a lie as morally wrong may seem closer to deontological than consequentialist, the long-term impact is almost always net-negative when considering second-order effects of a lie. A lie may seem to be a net-positive in the short-term as it may deflect initial negative reactions. However, in the long-term, it creates a cascading series of further deceptions, a significant risk of discovery, and a much stronger negative reaction when the deception fails — thus creating a more substantial net-negative impact than the truth possibly could. This has been your philosophy lesson for the day; thank you for attending. ↩︎
As I wrote in “Responsible Disclosure Is Wrong” the priority must always be making decisions in the best interest of the user. This is not always simple; one must balance the need to alert users, and the risk of enabling more attacks. This requires a careful case-by-case analysis based on the unique factors of the event, as no two security incidents are identical. No matter what is done though, the interest of the user must always be the singular driving factor. ↩︎
Some argue that those involved in an incident should be removed from their position, and excluded from future positions — this is a deeply flawed view, and one I addressed in “Best Practices vs Inane Practices” in particularly brutal form. ↩︎

Parasitic & Symbiotic Business Models

Sun, 22 Aug 2021 16:46:06 +0000

Does your business model thrive as your customer thrives, or does it drain the life from your customers? After a recent¹ conversation on the impact of improved privacy tools (i.e., the eventual elimination of third-party tracking cookies), I realized that the most significant effect of these improvements would be to companies with a parasitic business model. A business model which I see no problem in disrupting.

For many years, the web has existed as an advertiser’s dream² — minimal privacy limitations, technical controls that had little impact, and a strong lobbying arm that has been able to derail many efforts to improve the situation. Now, this is not to say that all advertising is evil, but that it’s ripe for abuse by those that get too greedy. In many cases, this has opened the door to parasitic business models that offer no real value, and in fact, only extract value from the end-user.

What is a Parasitic Business Model?

A great example of this is data aggregators and location tracking; services that exist to collect, connect, extend, and sell data about users. Too often, this is done without the user having any idea that it’s happening — much less having willfully agreed to it. This business model relies on the ability to collect vast amounts of data on users, and build profiles that can be sold to others, primarily for ad targeting & tracking.

There is no inherent benefit to the user for this activity; it doesn’t enable better services, or allow them to access the applications that collect this data at a lower cost. The value to an application developer is relatively small compared to other revenue sources, as the data they collect has fairly little value of its own. It becomes valuable when it is merged with other datasets that the aggregator has acquired; it is this merging that creates value from noise. So we have a user giving up personal information (often unwittingly) for no benefit, some financial benefit for the application developer (though less than other viable revenue streams), and the bulk of the benefit going to the company collecting and selling the data.

You have to ask, what does this business model add to the end user’s experience? Do they benefit from the relationship, or are they being used in the relationship? If you study the business model these companies employ, it’s clear that only one party benefits, and it’s not the user.

This is just one example of this type of business model that focuses on growth at the cost of the user. As improvements are mode to technical controls around privacy that are now being pushed by browser makers (such as implementing SameSite=Lax by default), life will steadily become more difficult for businesses in parasitic relationships.

Healthy Business Relationships

A healthy business relationship should be symbiotic for all parties involved; each party becoming happier & healthier as the relationship develops, and thriving due to the relationship — not in spite of it. These relationships often have a few key traits:

Each party is fully aware of the relationship; no parties are being intentionally hidden.
Transactions are mutually beneficial; for example, paying for a service that provides value to the user. The service receives revenue to compensate them for the service, and the user gains the use of something that they see as valuable to them.
Each party has the opportunity to gain greater value from the relationship as the other parties thrive. To continue the paid service example, as the service receives revenue, it is able to invest more in improving the service, providing even greater value.

These symbiotic relationships are a win for everyone involved, unlike parasitic relationships that are full of quick profit for one party and nothing but loss for the other. While parasitic business models do indeed lead to greater short-term profits, there is no loyalty developed, there is no long-term health in relationships, and the business model can break at any time with changes to technology.

In a symbiotic business model, the relationship develops over time, becoming stronger — customers become more loyal, more interested and invested, more passionate, and turn into promoters and ambassadors. Revenue climbs more slowly, but that growth is more likely to continue and expand long-term. This is a relationship built on mutual respect and benefit.

The Costs of a Parasitic Business Relationship

When you are engaged with a parasitic entity, knowingly or otherwise, there are costs involved. For users, this can be anything from a loss of privacy, revealing secrets, bypassing legal safeguards, or even risking personal safety. For businesses, there are repetitional risks — failing to respect the privacy of users can lead to a substantial backlash. There are also monetary risks for failing to follow legal requirements. And a variety of others — the list keeps going.

There’s only one winner here, just as with any parasitic relationship. Placing these risks and burdens on users is not just risky for a business; it is, in my opinion, highly unethical. Regardless of legal status, it’s morally wrong to exploit users who are acting in good faith and put them at risk for a quick profit — and there are some companies that have turned this practice into a business.

Because of how these relationships are structured, end-users are too often unaware of the relationship and how it impacts them; they aren’t in a position to make an informed decision. Likewise, businesses enter these relationships without an accurate understanding of how data is used, and sometimes without even understanding what data is being collected³ — and may not gain that understanding until it’s been abused and they are in the news.

In Conclusion

Some business models should be disrupted, as they are fundamentally against the interests of those they interact with. This is not to say that all advertising, analytics, monitoring, or other similar systems are evil or immoral — but some very much are. It is those, those that have become too greedy, those that have abandoned morals for easy profit, those that harm others for their own benefit, those are the ones that need to have their business models disrupted.

Businesses have an ethical obligation to protect those they have a relationship with (directly or indirectly), not exploit them.

By recent, I mean last November when I started writing this blog post. At the time of the original draft, there was a lot of discussion around Google’s push for privacy improvements in the browser; it’s in this context that this was written. ↩︎
It should be noted that the golden age of digital advertising and the golden age of mass surveillance occurred at the same time. The implications of this fact should be clear. ↩︎
It’s especially true for SDKs provided by third parties; their actual behavior isn’t understood, nor is the privacy impact. Blindly incorporating an SDK into an application can easily result in substantial security and privacy risks. ↩︎

Declaring War on Ransomware

Sun, 04 Jul 2021 05:52:33 +0000

It’s time for everyone from the industry, developers, and the government to declare war on ransomware and make it as hard as possible for them to ply their insidious trade. There have been false starts and baby steps, diligent fighters without enough resources, and vendors that have only given a nod to the issue. It’s time to use every tool reasonably available to stop this scourge.

For so many in the industry that have dedicated so much of their time and effort to this fight, this statement may seem to diminish their efforts, but that is not my intent. The story here is that for too long, this issue hasn’t been addressed seriously by too many, and it’s time for that to change.

Today’s Ransomware Landscape

To understand where we are today, it’s important to look at how ransomware has evolved over the years.

Ransomware has been around for many years, starting no later than 1989 with the AIDS Trojan, which targeted the healthcare industry and charged $189 per infected machine (via a P.O. Box in Panama). If we fast forward to the mid-2000s, ransomware was becoming more popular, and the fee being extorted was up to $300 per machine — a decent payday for not much work. Then, jumping ahead to 2013, we see the introduction of CryptoLocker, which charged $400 per device. But CryptoLocker was different from others in a significant way; it provided proof that there was serious money to be made — estimated to be up to $27 million. This changed the game.

As the years have gone by, the ransom demanded has increased quite significantly, with payments in the millions now being so common as to barely warrant notice. Of the major players, DarkSide is reported to have pulled in $90 million, Ryuk is estimated to have made $150 million, REvil has made $100 million, and Maze comes in at $75 million.

The profit these attackers make is simply extraordinary, and this has changed tactics and created a dangerous business model.

In the past, ransomware attacks were largely untargeted, going after anything that stumbled across them. The operators didn’t concern themselves with who they hit or how much money they had. Now, it’s very much about finding companies with weak security and taking them for as much money as possible. Ransomware moved from opportunistic to targeted, and the profits have soared.

Another significant change is the move to ransomware as a Service (RaaS), professional teams developing the ransomware and providing it to attackers that find vulnerable targets and deploys it. While one may talk about a group such as REvil conducting an attack, the reality is more complex. REvil provides software and a service to the actual attackers, and then the profit is split between them. This has allowed a division of work, the development of better ransomware, and allowed attackers to focus on finding vulnerabilities (instead of needing to write code for the ransomware first). All in all, this is a logical evolution from a business perspective.

A final note to set the stage for what’s going on today is that many of these RaaS operators treat their enterprises as genuine businesses; legality isn’t part of the equation for them.

Paying Ransom Hurts Everyone

When a ransom is paid, everyone suffers. Funneling money to criminals allows them to expand, finance new attacks, recruit more people, and continue their crusade to make the world a little more dangerous.

While some may find themselves in a position where, due to their organization’s failures, they have no hope but to pay the ransom and hope the criminals actually help them, they do so at the cost to everyone. Funding criminal enterprises is, without question, morally wrong — it’s also self-defeating as it reverts funds away from better investments, and provides additional resources that will be used for future attacks. Just because an organization has paid the ransom doesn’t mean that the gang will leave them alone forever.

Each dollar that these gangs receive makes the world a little worse, and a little more dangerous for everyone. Each dollar they receive enables them to do more damage. Each dollar they receive motivates them to do it again.

Disrupting their business model must be a key goal of everyone involved, and that means making sure they receive as little money as possible.

Fighting on Multiple Fronts

There is no silver bullet that will suddenly bring this problem to a halt; it needs to be addressed on a number of fronts simultaneously. This requires actions on the part of all stakeholders, and requires this action to be taken quickly and effectively. While ransomware will never be eliminated, the growing profits and increasing impact of attacks make it clear that not enough is being done.

Technical

The industry, the entire technology sector, has largely failed to address this issue adequately. While some progress has been made, it’s still far too easy to successfully execute these attacks.

Platforms

O.S. vendors should be investing far more heavily in sandboxing applications, limiting their ability to quietly access all of the data on a system. Something akin to AppArmor on all platforms would go a long way to limiting what these destructive tools can do.

Vendors should also reevaluate the traditional tiered approach to permissions, where system management functions also permit access to files and information that is unlikely to be needed. The principle of least privilege isn’t appropriately applied in O.S. permission models; instead of giving administrative users only the necessary access to perform the specific tasks needed, administrative users are often able to access things they have no real need to, greatly increasing the attack surface. Instead of tiers of administrative users, each level gaining more access, there should be a greater focus on types of administrative users, with each being limited to the least privileges possible. The concept of all-powerful user accounts is, and always has been, a mistake.

Platform vendors have a responsibility to address this issue and implement reasonable controls that limit what malicious software can do; while there are commercial tools that address these concerns, it’s the platform itself that should be providing more robust protection and providing organizations with a safe by default environment.

MSPs, Services, MDM, & Integrations

Too often, the keys to the kingdom are passed out freely, creating massive new attack vectors. The Kaseya attack is an excellent example of this; the attackers leveraged the privileged access that the Kaseya VSA product has to attack MSPs, and then used their access to attack their clients. This type of excessively privileged scenario creates such a large attack surface that an organization’s security because entirely dependent on a third party.

As above, there should be a greater focus on properly adhering to the principle of least privilege and minimizing the risks and attack surfaces created. Too often, such integrations require levels of access and privilege that genuinely aren’t needed; this needs to change.

When a third party takes on privileged access to a client, they accept a substantial responsibility, one that not enough take as seriously as they should.

IT & Infrastructure Management

I.T. is a mess. It’s that simple. In the decades that the field has had to evolve, many of the same problems persist from year to year, decade to decade.

The tools to manage systems in a secure way are often inadequate or introduce their own issues (here’s a fun example). Corners are often cut, taking the easier approach over the more secure approach; it’s easier, it’s faster, and often results in fewer complaints. In penetration tests, it’s common that the tester gains a substantial degree of access due to countless errors and missing controls. The list of issues goes on and on.

To gain the upper hand, organizations need to invest in making resilient networks that are both resistant to attacks and able to recover quickly.

Where’s the Backup?

An absolutely critical change that needs to occur is that backups should be protected, readily available, and tested. The fastest way to recover from a ransomware attack is restoring the encrypted data from backup; it doesn’t require approvals, payments, or supporting international criminal gangs.

Every organization should implement a robust backup strategy to recover effectively and efficiently if they are victimized. Too often, backups are nonexistent or untested and fail when needed — if there’s one thing that organizations take from these attacks, it should be how important it is to get backups right.

There’s no legitimate excuse to get this one wrong.

Endpoint Security Vendors

Slow, invasive, error-prone, ineffective, expensive, productivity inhibitors, privacy nightmares, security threats — these are just some of the ways I’ve heard endpoint security products described over the years. Unfortunately, this field has a real problem. This isn’t just a perception issue; it’s a real problem that professionals see every day.

It’s fairly uncommon to hear genuinely go things about an endpoint security product from those that work with them regularly. For all the marketing hype and bluster, they often fail to do the one thing they are meant for, and too often have a huge attack surface and excessive privileges that can lead to attacks that wouldn’t otherwise be possible.

These vendors need to look at their products and listen to the feedback that those in the field have been shouting at them for years. Then, stop spending so much of their budgets on impressing the C-suite and focus on building something that really does make the world a safer place. This is a field with substantial potential, but has failed to live up to it.

Legal

While there are substantial consequences to these crimes, prosecutions are still too rare. Greater international cooptation is needed, and there need to be more significant penalties for the gangs and all of those that support them — especially those that touch their money.

Cryptocurrency exchanges that handle money that came from an attack (and that have a reasonable way of learning this) should be targeted aggressively, making these ransomware gangs too toxic to work with. Making it harder for them to launder their money effectively will reduce their profits and thus their motivation and ability to finance future attacks.

The entire support infrastructure for these gangs should be targeted with all available tools.

Financial

Governments have a strong interest in stopping these attacks, from protecting national security and critical infrastructure to economic stability. Governments also have powerful tools at their disposal that can aid in this fight. I will focus on the U.S. government here, but there are typically equivalents for other countries.

Disrupting the business model that these criminal enterprises are based on should be a key goal for governments; by attacking the ability to easily profit from attacks, it’s possible to reduce the motivation and increase the risk for those involved. While there are many ways to fight this scourge, this is one that can be enacted quickly and is likely to have a notable impact.

In 2020, the Office of Foreign Assets Control (or OFAC) issued guidance pointing out the risk to companies that pay ransomware, as they may be violating sanctions that the government has implemented. This guidance was released following the 2019 decision to sanction Evil Corp for their attacks; though since then, this tool has been underutilized.

To stem the flow of easy profits, the government needs to take quick and decisive action against these gangs — reducing their profits and making their companies less attractive targets.

Implementing sweeping sanctions against known gangs, their members, and those known to support them. Targeting their support infrastructure, be it cryptocurrency exchanges, infrastructure providers, or even nation-states, will make these groups too dangerous to work with safely. While they may go further underground, anything that makes it more challenging to collect profits is a win for all.
OFAC should only grant licenses to allow payment when there is a demonstrated need and substantial impact. This shouldn’t be a rubber stamp process, but instead, one that demands proof that it’s vital that the victim works with the attacker to recover.
The IRS has proposed a reporting requirement that would demand that companies treat cryptocurrency transactions like cash transactions; thus, a transaction worth over $10,000 would have to be reported. This would help to identify these crimes, and support the sanction effort.

There are a variety of other tools the government could leverage, but these have precedent and allow enough flexibility to minimize the risk of unintended harm to victims.

Prohibition vs. Regulation

There are some that wish to implement a blanket ban on ransom payments, or even cryptocurrency itself, as a way of addressing this problem — this would be a mistake.

If these payments were made illegal with no opportunity to seek approval when there’s no other practical option, victims would be left in an impossible position. Face the loss of critical systems and perhaps face complete collapse, or violate the law. If they chose the latter, they would expose themselves and their organization to criminal penalties, and would open the door to ongoing blackmail to keep the payment secret. This would be an absurd outcome.

Proper regulation can achieve the goal of making targets less attractive without the risk of turning victims into criminals. Of course, it will require striking a careful balance, but it’s a safer route than an outright ban.

In Summary

The war on ransomware will never truly be won, and the fight will go on forever. However, the rate of successful attacks demonstrates how urgent it is that more be done, and that we all take steps to fight them.

As I said above, there’s no silver bullet, but there is a lot we can do.

On Automatic Updates and Supply Chain Attacks

Sat, 03 Jul 2021 17:58:44 +0000

Once again, a supply chain attack is in the news; this time, it’s a ransomware attack against Kaseya which has impacted hundreds if not thousands of businesses. According to Kevin Beaumont, the attackers used a 0day vulnerability in the Kaseya VSA appliance to deploy a fake update to all systems it managed; that update is actually the REvil ransomware. As this is a VSA is used by Managed Service Providers (MSPs), this resulted in an attack not just on the MSPs but also their customers.

This event raises an interesting question on update mechanisms and how they play into supply chain attacks. This is what we’ll be discussing today.

A History of Abuse

Update mechanisms have been leveraged by attackers for many years and have, in some cases, had a substantial impact:

The Passwordstate attack used updates to insert malicious code that stole credentials.
The attack on SolarWinds pushed malware via updates to steal data from a variety of organizations, including the U.S. government.
NotPetya resulted in massive damage and was deployed via a backdoored version of M.E.Doc, once again delivered as an update.
Flame, perhaps the most famous example of this type of attack, leveraged the Windows Update system to deploy its malware.

These are but a few notable examples of incidents where an update mechanism is used to deploy some form of malware. Given this, one has to ask, are updates and especially auto-update mechanisms even safe to use?

Why Automatic Updates Exist

Update mechanisms, automatic or otherwise, exists for a couple of primary reasons:

Ensuring that users are on a recent version, if not the latest. This allows developers to focus their efforts only on newer versions, which simplifies support, reduces the need to deal with compatibility, and gives users the latest and greatest features quickly.
Ensuring that users have the latest security fixes and improvements installed, to reduce the risk of being attacked by a known issue and provide additional protections.

It’s a well-understood fact that users aren’t good at manually installing updates, even when there are important security fixes. As such, there is a high likelihood that users will be rather behind the most recent version, and this is where automatic updates come in. By updating automatically, users don’t have to think about it, security teams don’t have to worry about it, and users get the best protection with the least effort.

The importance of updates should be clear to everyone, and the use of automatic updates plays an essential role in getting these updates deployed in a timely manner.

Security Updates Aren’t Just Fixes

Before going on, I’d like to digress for a moment to address something that is too often overlooked. When most people think of a security update, they assume it fixes a vulnerability that was discovered — though that’s not always the case.

Updates may include additional hardening, which doesn’t address a known vulnerability, but instead adds extra protection to prevent exploitation or mitigate unknown vulnerabilities. This is more important than many people realize, as in some cases, these hardening improvements can block entire classes of vulnerabilities.

Such improvements don’t have a CVE, as they don’t represent a flaw, but without them, there may be an additional risk. Too often, these updates are skipped in manual update systems because it’s not clear enough what it does.

Accidental Fixes

Another issue that is overlooked is how often vulnerabilities that are unknown or unreported are fixed unintentionally during refactoring or other code changes. Some updates may contain important security fixes; it’s just that the developer doesn’t know it.

One of the advantages of always using the latest version is that it increases the odds of these accidental fixes.

This fact may be surprising to those that don’t regularly work in vulnerability research, but it’s more common than one would expect.

The Importance of Securing Update Infrastructure

To implement any update mechanism, and especially an auto-update mechanism, it’s vital that the infrastructure be hardened as much as possible, and the fewest number of people possible have access to it. There are few assets in a development shop more critical to protecting users than this infrastructure.

Servers must be locked down, psychical access restricted, code carefully reviewed, and operating system & software fully up to date.

Penetration testing should be conducted regularly, of not only the update infrastructure itself, but the entire system from end to end. For example, access to version control systems, build systems, signing systems, deployment & update systems, update notification, and update installation. Every step needs to be carefully reviewed and tested to ensure that there’s minimal risk of an attacker being able to influence what’s released.

Weighing the Risks

The challenge now is this, how do the risks compare to the rewards? While this could be a case for a complete threat modeling exercise, I believe that there is an easier way to analyze this.

While some notable examples were listed above, the reality is that these attacks, while happening at an increasing pace, are still quite uncommon. After all, would we be having this discussion otherwise? Moreover, given how often auto-updating works, and the fact that with proper controls in place, the odds of a successful attack are small, there is a particularly strong argument that the rewards do indeed outweigh the risks involved.

While no system can achieve 100% security (give or take), we can achieve a high level of security by following the proper practices. It’s cutting corners and failing to properly invest in security that often leads to successful attacks against these mechanisms. While it’s true there’s risk, in reality, far more attacks are prevented than triggered.

Crew Resource Management for Security Teams

Fri, 25 Jun 2021 21:21:24 +0000

Over the last year or so, I’ve become quite a fan of Air Disasters, a television show dedicated to analyzing plane crashes and similar incidents. As I watched the show, I started seeing many ways that the lessons and procedures around aircraft safety also apply to running a security team; this valuable and hard-won wisdom, often born out of tragedy, can be of significant impact if appropriately applied. In this article, I will explore Crew Resource Management and how it can be applied to Information Security to make teams run better. Hopefully, these insights help you achieve more and fulfill the critical missions we are entrusted with.

What is Crew Resource Management?

In 1977, the deadliest airline disaster in history occurred at Tenerife, when two 747s (KLM 4805 and Pan Am 1736) collied and cost 583 people their lives; this happened for a variety of reasons, though would have been prevented if the captain had listened to his team. The following year United flight 173 crashed on the way to Portland, Oregon; the flight crashed because the captain was distracted by a malfunctioning landing gear and ran out of fuel (despite warnings from the crew). These accidents are the direct result of human errors, which account for as many as 80% of all accidents. These events, along with many others, led to the development and implementation of Crew Resource Management (CRM) and forever changed the way airliners are operated.

The implementation of CRM has drastically reduced the number of accidents that occur and has made air travel vastly safer than decades ago.

The value of these lessons has been applied in a number of other areas, such as firefighting, ship operations, air traffic control, healthcare, and others. To not take advantage of these lessons would be a missed opportunity for the security community to advance our practices.

What, exactly, is CRM?

CRM is intended to address a number of human factors, which is to say, preventing or mitigating entire classes of human errors through training focused on group dynamics, leadership, interpersonal communication, and decision-making. The focus is on seven specific areas:

Mission Analysis
Situational Awareness
Communication
Adaptability / Flexibility
Decision Making
Assertiveness
Leadership

These will be discussed in more detail below.

It should be noted that CRM alone is not a silver bullet; CRM compliments technical skills — to quote an FAA document on the topic:

Demonstrated mastery of CRM concepts cannot overcome a lack of proficiency. Similarly, high technical proficiency cannot guarantee safe operations in the absence of effective crew coordination.

CRM Focus Areas

As CRM focuses on several different areas, we’ll look at each individually and discuss how they apply to our security work and the environments we work in.

Mission Analysis

A leader is responsible for understanding the task at hand, and all its potential risks and benefits, and developing plans to safely meet the objectives.

When setting out on any task, it’s critical to fully understand not only the work, but what could go wrong. It’s disturbingly easy to create new issues in the process of trying to fix something; not understanding the implications of a change is responsible for a substantial number of security issues.

Situational Awareness

Loss of awareness of what’s happening around you can easily end in tragedy. Situational awareness must be a constant state of understanding what’s happening, combined with the alertness to notice changes.

Understanding what’s going on can be quite a challenge, especially in a complex and fast-moving environment — but when we lose sight of what’s going on, there’s a substantial risk of things going wrong. There are, thankfully, some warning signs that we can watch for to identify when we risk losing our situational awareness.

Ambiguity

Do we understand the details clearly? Do we have enough information to make a sound decision? Can we trust the information we have? Can it be interpreted in more than one way?

All of these are warning signs that we aren’t working with sufficient information, and caution is required. While we can’t be paralyzed by bad data, we must evaluate what we know carefully and move ahead with care.

Distraction / Overload

Can you focus on the task at hand, or are you constantly being pulled in multiple directions at once? Can you complete your work correctly, or are you constantly leaving things half-done? Do you know where you left off from your last task?

If we can’t focus and complete routine tasks because of so many other things happening, it becomes impossible for us to understand what’s going on and where things stand. While we have to remain flexible to changing priorities, we can’t push ourselves so far that we lose sight of where we are.

Fixation

On the opposite side of distraction is fixation, becoming so focused on a single task that we can no longer see the big picture — missing important information and events because we become blind to everything else.

This is particularly dangerous as it makes it easy to be confident that things are under control, when in reality, we have no idea what’s actually happening.

Complacency

If we become too comfortable that everything is going well, we can let our guard down and miss the signs that something is going wrong. It’s vital that we are always alert and watching for signs of trouble — constantly aware of what’s going on, and the risks that these events present.

Unresolved Discrepancy

When something is odd, do you follow it down to the root cause, or ignore it and focus on other tasks? If we ignore things that aren’t right, we may miss important information about what’s going on — these discrepancies are essential clues to help us establish and maintain awareness. We can’t ignore things when they don’t add up; there’s always a reason for these situations, and we need to understand what it is.

Lack of Control

In aircraft terms, it would be “nobody is flying the plane” — in our world, we would say that nobody is actually in charge. This can be anything from abandoned tickets to a lack of leadership, a failure to ensure that the work that needs to be done is actually being done. Thanks to huge backlogs and understaffed teams, it’s easy for security to become disconnected from the rest of the company. Projects and tasks move forward without anyone from security involved — and this is a setup for failure.

While I don’t suggest that security should be in control of everything, but I do suggest that without security being involved, efforts can go in any direction because nobody is guiding the security properties or handling the threats that arise.

Communication

One of the most vital skills, if not the most critical skill, in working in a team environment is effective communication. In reality, we are all communicating constantly, but too often, communication isn’t actually effective, and as a result, things can quickly go wrong because the information isn’t received as intended. There can be a wide variety of reasons, on either side, that causes these simple breakdowns in understanding — but the result can be incredibly damaging as it increases the likelihood of an error and makes it impossible for us to act effectively.

One method that CRM teaches is to use a 5-step process to make an assertive statement:

Opening - A clear statement to indicate who the message is directed towards to ensure that you have their attention.
State the Concern - Clearly articulate what it is that you think is wrong, what you’ve seen, or what you’re worried about.
State the Problem - Now that you’ve made it clear what you’re worried about, explain the issue as you understand it. This helps to ensure that both parties are on the same page.
Solution - Offer a solution to address the problem. Make it clear that action is needed and that you are suggesting a specific course of action to address the issue.
Agreement - Clearly ask for approval or consent to implement the suggested solution.

All of these components play an essential role in communicating an issue and determining how to respond to it; if any element is left out, there may be confusion about what’s going on, why something would be done, or if the solution should be implemented. This technique also opens the door to further discussion around other solutions, as it ensures that everyone has the same understanding of what’s going on and what options may exist.

It’s important to understand that many factors play into effective communication. Developing this skill may require changes to personal habits, as well as changes to culture to allow this type of communication to exist and be effective.

Communication Failure Types

There are many ways that communication attempts can go wrong, and thankfully for us, some of these have been documented to help us avoid them ourselves and spot them when they occur. We’ll focus on both errors from the person providing the information, and receiving the information.

Provider

There are a variety of ways that we can fail to effectively communicate information when we are trying to provide it to another, such as:

No frame of reference - If you provide information without context or to a person who doesn’t possess the knowledge you assume, they may not understand the information or processes it as intended.
Missing information - If there is information or ambiguity, it’s easy for the receiver to come away with a different or incorrect understanding.
Inserting bias or opinion - If you include your personal opinion or show signs of bias, the information may seem less trustworthy, and the facts may not be accepted as such. It’s essential to keep personal views out of critical communication or clarify what’s a fact and what’s opinion.
Body language & tone - When speaking face to face, it’s important to be mindful of our body language and tone, as we may unintentionally alter the message or how it’s perceived.
Unwillingness to repeat - In high-stress situations, there is often a desire to move quickly and not waste time, and repeating something can undoubtedly feel like wasting time. However, we must be willing to repeat, in full, as needed to ensure that everyone understands what we are trying to convey. Many errors are introduced by repeating information and leaving bits out during that process.
Disrespectful or hostile communication - If the message is perceived (regardless of intent) in a disrespectful or aggressive manner, it’s unlikely that effective communication will occur. While it’s easy to become upset in times of high stress, this can lead to compounding mistakes and make a situation harder to recover from.

Receiver

Just as there are many errors that the provider can make, there is also a number that the receiver can make:

Prejudice - If we make up our mind before understanding all of the information, it will impact and change our understanding and lead to new mistakes. It’s essential to have as complete a picture of the situation as possible before proceeding.
Attention - It’s far too easy to become distracted or not give a person full attention. This can lead to missing important parts of a message and either not understanding the situation or having a flawed understanding. Listening requires concentration and focus, and this fact must not be ignored.
Thinking ahead - In our field, it’s easy to hear someone and start to extrapolate or make assumptions about where they are going — if these assumptions are incorrect, it can lead to adverse outcomes. If you hear someone say “let me finish” or “hear me out,” it’s a clear warning that this is occurring.
Ignoring non-verbal cues - People communicate in a variety of ways, including voice tone and body language. These additional methods may contain valuable insight or other information that isn’t being presented verbally; it’s important to pay attention to these and adjust our understanding accordingly.
Clarification - Failing to ask for clarification, failing to seek more details, failing to gain a useful understanding all lead to making a situation more complicated. There’s no shame in asking someone to explain; while we may feel like we should already know something, missing the chance to gain understanding and moving ahead with a flawed perspective makes things worse.
Disrespectful or hostile communication - Knee-jerk reactions are often incorrect and lead to further mistakes. Becoming angry or seeking to assign blame often lead to additional errors. Information should be received and carefully considered, and thoughtful responses given.

Managing Tone

When communicating with others, especially during a high-pressure event, it’s important to be aware of the tone we use and avoid charged language. If we accuse someone of making a mistake, or making a suggestion that isn’t wise, we put that person on the defensive, and communication becomes ineffective.

The focus must be on addressing the situation, not on placing blame on anyone. Making this mistake can easily take a situation and make it far worse.

It doesn’t matter who’s to blame; what matters is how we respond.

Adaptability / Flexibility

Adaptability/Flexibility refers to the ability to alter one’s course of action contingent upon or as a function of another’s action and/or situational demands.

In most cases, it’s best to have clear procedures that are followed; this allows everyone to understand their role and know exactly what’s expected of them — that is, until procedures aren’t enough. No matter how well we plan, what procedures and policies we enact, there will always be situations where we need to adapt. There will always be situations where we need to adjust rapidly, alter plans or behavior, find ways to help others, and find constructive options under pressure.

Decision Making

Effective decision-making refers to the ability to use logical and sound judgment based on the information available.

Making sound decisions is quite obviously critical to our work, and there are a few guidelines that CRM offers us to make better decisions:

Accessing the problem.
Verifying information.
Identifying solutions.
Anticipating consequences of decisions.
Telling others of the decision and rationale.
Evaluating the decision.

These should be fairly familiar as they also factor into the guidelines for effective communication that we covered above; good decision-making and effective communication are very closely linked. Without effective communication, good decision-making isn’t possible.

Imperfect Information

While the best decisions occur when everyone is fully informed and has a clear understanding of the situation, the reality is that these situations are rare. Most decisions are made with information missing. While sometimes derided, there is an apt quote that explains this well:

… there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns—the ones we don’t know we don’t know. - Donald Rumsfeld

There are things we know and understand, there are things we don’t know or don’t understand (but we recognize they exist), and things that we don’t know and have no idea that we don’t know. When evaluating information, it’s important to keep this in mind, as this concept plays a vital role in determining what is and what isn’t actionable.

Assertiveness

Assertiveness refers to the willingness to actively participate, and the ability to state and maintain your position, until convinced by the facts (not the authority or personality of another) that your position is wrong.

This is a particular challenge in our field due to the variety of personality types that exist, and how many people are excessively assertive (often without realizing) or are too introverted to be comfortable being assertive. While this is a challenge, it’s one that must be addressed.

CRM gives us a few ways that team members can assert themselves:

Providing relevant information without being asked.
Making suggestions.
Asking questions as necessary.
Confronting ambiguities.
Maintaining their position when challenged.
Stating opinions on decisions/procedures.
Refusing an unreasonable request.

Of course, it’s important to remember that, as discussed above, all communication needs to be respectful, and being assertive does not mean that the chain of command can be ignored. Team members should be empowered to do the right thing, though leaders are ultimately responsible for everything a team does.

Most conservative response rule

Occasionally there is a disagreement in the cockpit that cannot be resolved due to lack of information. It is best to agree in advance to take the most conservative action in these situations until additional information is available.

What happens when there are multiple options (with different outcomes), and we aren’t sure which path to take? Following a rule like this helps to provide guidance and settle disagreements so that progress can be made quickly.

Two challenge rule

In extreme situations, if the pilot does not respond to two demands (e.g., “Waveoff, waveoff!”),the copilot should take the controls.

Does everyone on the team know what to do when they don’t get a response? When there’s no reaction (leaders are unavailable, for example), is there a way to handle issues, or does everything freeze until a leader is finally available?

In fast-moving situations, it’s crucial that everyone knows what to do and is able to act, even when others don’t.

Sandbag syndrome

The Sandbag Syndrome is based on a comforting premise that one or more other crew members have the situation under control and are looking out for your best interest. It can be experienced by any crew position, resulting in that person being “along for the ride.”

This is likely the most critical part of assertiveness, as it’s incredibly common and creates many problems. Assuming that someone else will handle something works fairly often, because someone else may well handle it — but there’s no way to be confident; it could be missed completely. Each and every team member should assume ownership for issues that they see, even if it’s just confirming that someone else is actually aware.

This is not to say that people that fall into this trap are lazy or avoiding work, but they may be uncomfortable jumping in, they may not be sure who is responsible (if anyone), or maybe they are worried about what happens if something goes wrong. There are a hundred reasons that someone will sit back and expect someone else to do something, but it’s a problem waiting to happen.

If there is a single thing that should be achieved encouraging assertiveness, it’s addressing this specific problem.

Leadership

Leadership is the ability to direct and coordinate the activities of other crew members and to stimulate the crew to work together as a team.
Being a good leader involves inspiring your crew to work up to their potential; a good leader can bring out the best in their crew. The leader is in control of the situation and has certain responsibilities.

Let’s start by looking at what CRM tells us a leader should be able to do:

Direct and coordinate the crew’s activities.
Delegate tasks.
Make sure the crew understands what is expected of them.
Focus attention on the crucial aspects of the situation.
Keep crew members informed of the mission information.
Ask crew members for mission-relevant information.
Provide feedback to the crew on their performance.
Create and maintain a professional atmosphere.

None of these should come as a surprise; this is a brief but accurate portrayal of what leadership is. Though there’s much more to being a good leader than a few bullet points, a topic I’ve written about before.

Authority

In CRM, authority is reinforced through a few practices:

Ensuring mission effectiveness.
Fostering respectful communication.
Establishing clearly defined goals.
Including crew input.
Establishing clear assignments.

As a leader, it’s essential to take responsibility and ownership while also listening to your team and taking full advantage of their knowledge and perspective. Establishing and maintaining authority does not mean excluding others, but acknowledging responsibility.

Mentoring

Every leader is responsible for mentoring those on their team, sharing knowledge and experience they’ve gained to help their team members grow. This helps to ensure that the team not only maintains technical competence but helps to establish trust in leaders.

Conflict Resolution

Conflicts can and (and do) arise in every team, and can lead to growth if appropriately handled. It’s up to the team leader to resolve conflicts and act as a mediator when needed. It’s important to listen attentively, don’t become emotionally involved, and gain a clear understanding of the underlying cause of the conflict.

Followership

In an organization, essentially everyone is a follower, even if they are a leader as well. As such, it’s essential to understand how to follow effectively in addition to leading effectively. Being an effective follower isn’t passive, but a conscious effort and one that requires one accept certain responsibilities, such as:

Respecting authority.
Keeping ego in check.
Properly balancing respect and assertiveness.
Requesting clear assignments.
Reporting on the status of tasks honestly and clearly disclosing any issues.
Acknowledging mistakes.

Under the CRM model, followers are empowered to challenge leaders when a situation demands it, but this is dependent on followers exercising this right responsibly.

Hazardous Attitudes

Keeping an eye out for hazardous attitudes — attitudes that can lead to mistakes — is helpful to spot issues before they happen. Some examples are:

Anti-authority: “Don’t tell me.”
Impulsivity: “Do it quickly.”
Invulnerability: “It won’t happen to me.”
Machismo: “I can do it.”
Resignation: “What’s the use?”
Pressing: “Let’s hurry up so we can go home.”
Airshow syndrome: “I’m going to look amazing!”

Personal Factors

It’s vital as a leader to understand that you are working with humans, not machines. Many factors heavily impact how well a person works, such as:

Hunger or thirst.
Fear of punishment or failure.
Noise.
Anxiety.
Drugs or alcohol.
Fatigue.
Outside stress.

When working with your team, it’s important to remember that these factors may exist and may be impacting them in ways that aren’t immediately obvious.

Conclusion

I do hope that this has been useful and thought-provoking. While not everything in CRM applies quite the same way to the situations we face, hopefully, you can find ways to use these lessons in your own work. There are a vast number of resources on CRM, and I encourage you to look into it more.

Leading Experts

Tue, 01 Dec 2020 00:19:48 +0000

A friend of mine recently asked for my thoughts on leading people who have more experience or expertise in a topic than they do; this is an important question and one that I felt deserved more thought and exploration. Leading people can be difficult, but when leading people that know more than you do about a given topic, it’s a different challenge. This was particularly well-timed, as I’ve found myself in just that situation, as I’ve just hired a specialist in incident response. While I’m fairly confident in my knowledge there, it pales in comparison to hers.

I’ll try to explore the issue and how it can be anything from different to difficult to effectively lead, when you are the one that needs to know more.

It’s easy when you’re the expert

Often in technical fields, those with the most expertise are promoted to lead those in the same field – as such, the leader has the most experience to draw on and the greatest level of knowledge. This gives those leaders a certain degree of additional confidence, as they can rely not only on the information they receive from their team, but also on their own knowledge and experience. This allows decisions to be made faster, with greater assurance that it’s correct, and hopefully, with the best possible information available.

In the real world, it’s not quite so simple. Leaders may overestimate the extent of their knowledge; they may fail to properly value the knowledge their team brings to the conversation; they may grow overconfident.

While we hope that leadership skills are present or will develop, the fact is that – most of the time – the people with the greatest knowledge and skill will be moved into leadership roles. They will have a team, and they will need to listen to them to achieve success. Leading from the front, when you’re at the forefront, is fairly easy. Leading when you know how much you don’t know is harder.

Encouraging disagreement

I would like to digress for a moment to talk about disagreements. If you are a leader, and someone on your team disagrees with you – it’s a good thing. Some people view a disagreement as a challenge to their knowledge or their authority; some will go so far as to call disagreement insubordination. In fact, it’s an opportunity. Treating it as anything less is a waste, harming both you and your team.

When a decision is challenged, it presents an opportunity for a couple of different things to happen:

You learn something. Maybe there was something that you missed, didn’t think of, or weren’t aware of. Maybe there’s more going on, maybe there’s been a breakthrough, maybe there’s a perspective to the problem that you hadn’t seen. While admitting you’re wrong can be difficult, it’s necessary to learn. Only by finding your own weaknesses can you become stronger. Only by learning about your blindspots can you learn to see more.
They learn something. There may be factors, perspectives, or details that they weren’t aware of. This gives you a chance to share your knowledge to make them better, more effective, stronger.

These disagreements should always be handled with respect, by all involved, but they represent an important opening for growth. Don’t discourage disagreement, don’t become defensive, don’t guard your position – open the door to ideas, grow as a team.

Listening to the experts

As a leader, it’s critical to surround yourself with smart people, and when possible, hire people smarter than you. What’s more challenging is to step back and accept that for all your knowledge and experience, they may know more than you. The ego is a powerful thing, and setting it aside isn’t always easy. Being proud of accomplishments is a good thing; letting your ego get in the way of being a good leader isn’t.

First, it’s important to understand the value in your team, the expertise they bring, and actively acknowledge that value. When you hire an expert, let them know that you both understand what they are bringing to the table, and how much you appreciate that expertise. When their expertise exceeds your own, this is vital. If you fail to do this, they may feel unwelcome, undervalued, unappreciated. When they share their knowledge and experience, they are helping you, don’t forget that.

Second, understand the limits of your own knowledge. If you believe that you know more than anyone else, you are not only almost certainly wrong, but you are actively harming your team. The best managers bring smart people together, give them the tools and support they need, then stay out of the way. You must understand how your knowledge overlaps, and see where it doesn’t, so that you can leverage your team to make sure that you are operating with the best information available. We all have our limits; we all have blindspots – I know I do.

Third, listen. It’s that simple. Listen. When you have a team full of smart people, you are the best leader when you leverage everyone’s combined knowledge, not just your own. Get their opinions, get their thoughts, get their perspectives, and then, and only then, make decisions. Get the best information available, and then you can take informed actions.

Leading by committee versus leading by knowledge

I shall digress, again, to attempt to make a clear point: listening to others isn’t leading by committee; it’s leading by knowledge. The collective knowledge of a team, with the knowledge of experts and specialists in their field, is greater, more accurate, and more impactful than the knowledge of any individual. This isn’t to say that a leader shouldn’t make decisions – as a leader, that’s the responsibility. However, it’s also the responsibility of a leader to make fully informed decisions. Fully informed decisions are never made in a vacuum.

It’s sometimes slower, it’s sometimes more complicated, it’s sometimes harder, but it’s better.

Giving everyone a seat at the table

There is no greater wasted opportunity, or greater harm to a team, than to ignore knowledgable voices. For a team to do well, every person, from the most junior to the most senior, deserves a seat at the table, a chance to be heard, to teach, or to learn. Give everyone a seat at the table.

Developers, Developers, Developers

Sat, 28 Nov 2020 08:02:35 +0000

Note: This was written in 2012, but not published at the time. The point is still valid, perhaps moreso than ever and deserves to be made publicly. The content has been updated as appropriate, though the core of this article remains intact from the 2012 draft. I would like to note that this doesn’t apply to every environment, there are some where developers are very knowledgeable about security, and write code with minimal issues – my current employer happens to be one of those rare & exciting places. I hope that some of these issues have improved over the last 8 years, though in many places, these issues are alive and well.

During a server migration, an ASP.NET application was discovered¹ that no members of the team were aware of²; this mystery application was old, broken, undocumented, and a surprise to all involved. It was partially deployed, in that some key files had been removed at some point during its history which prevented it from executing properly. While not currently functional, there was no way to know when it had last worked or what it was used for – it was a surprise for all involved. As this was on a production server, I researched the application, both to understand what this application was, and if it had presented any risk to the company.

I found quickly that the code for the application wasn’t present in the company’s source control system – I had personally overseen the migration from an older system to the current system, and knew for a fact that everything had been imported. Not being there meant that it had never been added to source control in the first place. Thankfully for me, most of the source code files were available on the server (along with older source files for a Classic ASP version of the application); not ideal, but enough to get a decent idea of what was going on.

Within the first five minutes of the review, I spot a SQL command being built from strings that were pulled from user input, no validation, no sanitization. SQL injection in the most classic form. This was the first of many issues found in the hours that followed. As I worked though the code, it was clear that security wasn’t a consideration when this application was built.

This application was public facing, and had been in production for a number of years, and nobody had noticed the glaring vulnerabilities. They even survived a rewrite from Classic ASP to ASP.NET, the vulnerabilities persisted despite rewrite and at least a couple years of maintenance. Seemingly unnoticed by attackers, thankfully.

While this specific application had an unusually high number of vulnerabilities for such a small application, seeing this sort of thing is nothing new. It’s not really even enough to get excited about anymore, and I wouldn’t have, if it wasn’t for something else I’ve been thinking about recently.

Developers

My heart sits in two worlds, torn between my love of creating things, and a passion for breaking things. Because of this, I tend to have a somewhat different perspective on issues from some others in either the security or development realm. I’ve built a career on combining these passions to create better software, regardless of the type of team (red or blue) I’m working with.

Developers are extremely good at finding solutions to problems, and at figuring out how to make things work, but too often are profoundly poor at understanding how it will be attacked in the wild. Thinking like at attacker is something that doesn’t come naturally to most – it’s a skill that takes time to develop, and unfortunately many developers are never given the chance to do that. Security education for developers has always been an issue (as I’ve noted before), too few developers are given even a basic introduction to secure development practices in college and public example code is often riddled with errors. Because of this, vulnerabilities are common and work in the various security fields is plentiful.

There are many methodologies and techniques for addressing security issues during the development process, yet they don’t seem to work in many environments – they are too expensive, too complex, too slow, etc. Many of the issues won’t be discovered until the security professionals get involved, including the simple issues that never should have been created. Much time has been spent, and much hot air expelled, in the quest for a solution to this problem – debating who’s at fault, and who’s responsible for fixing it. Yet, here in ~~2012~~ 2020, SQL injection is still alive and well.

There was a tweet that really made me think more about this problem:

@redrail1 You can't keep blaming developers … yes they're PART of the problem but if they are, why haven't WE solved "them" yet?

— Rafał Łoś (@Wh1t3Rabbit) September 20, 2012

As both a security professional and developer, and as someone that truly loves development and the development community, I had to admit something painful: we suck.

Why does this keep happening?!?

Some of this may be cultural, in some environments the view is that security belongs to the security people, not the developers. Of course, that couldn’t be more wrong. Too often though, that’s the mentality, developers that don’t take real ownership of their security bugs. There’s a testing phase in the SDLC, and that’s where too many developers believe security fits in. In reality of course, security belongs in every phase of the process.

Developers also tend to be ignorant of how attackers work, of the devastating impact of attacks that are so simple to perform. It’s this ignorance that I believe is the real issue, it’s not laziness or the inability to do the job right, it’s that they really don’t know better. Education continues to fail developers around the world by neglecting to provide useful information on security issues, and the methods and mentality of attackers. I’ve spoken to many developers on security issues, speaking at conferences and leading secure development training classes, what I found was consistent: most developers believe strongly in taking the time and effort to build secure systems, though they lack the knowledge and insight to do it effectively. Without an education in the darker arts of computer science, most are simply unequipped to perform their job properly.

As a security professional, this is were we have to admit something pailful: we’ve failed them.

The security community has done a fantastic job of sharing information (with some caveats), though our efforts to present this information outside of our realm has seen more limited success. Too many developers are still unaware of the implications of their decisions, and the repercussions of seemingly minor changes. The answer to these issues isn’t to be found in expensive products, over-reliance on consultants, or magic boxes with lots of blinking lights, there’s one answer: education. While tools and frameworks are getting better, and making some mistakes harder to make, that only solves part of the problem. Without understanding more about common vulnerabilities, techniques and methods used by attackers, the attacker thought process, and tools that attackers use, these bugs will continue to be introduced, and continue to be missed during changes and peer reviews.

If there was hope, it must lie in the developers.

The code discussed here was discovered in the fall of 2012, when this piece was originally drafted. It is safe to say that this event has long been forgotten by all involved, except as preserved here. ↩︎
Based on the file metadata, it appears that the application had last been updated almost a decade earlier (2002-2003). This meant that not a single member of the current development team was aware of the existence of the application, who wrote it, or what it did. ↩︎

Write Like You Are Running Out of Time

Sat, 28 Nov 2020 01:10:43 +0000

The cultural phenomenon that is Hamilton, brought back to the forefront due to its streaming release, is an artistic feat, but it also serves as an opportunity to refresh our memories on the history behind these characters, and look for opportunities to learn lessons that apply today. This is exactly what I’ve been doing.

For all of his flaws, one thing that I have to respect about Alexander Hamilton (as well as his wife, Eliza) is the understanding of the long-term impact of the written word. Many things fade as the years go on, though few things will last as long, or can be so easily preserved as what you write.

In the play, Hamilton is referred to as someone that is writing like he was running out of time – and history does support that he was a prolific writer. This is a good (though unpleasant) reminder that in reality, we are all running out of time. We each only have a certain (and certainly unknown) amount of time left, we should all apply a certain amount of wisdom to how we use that time.

Of Keystrokes and the ultimate deadline

There are a finite number of keystrokes left in your hands before you die. – Scott Hanselman

If you dedicate much of your time to writing, you may have hundreds of millions of words left that you could write, or tens of millions, or you could, as a couple of my friends have, discover very suddenly that it’s only tens of thousands. There is a finite number of keystrokes left for each of us, and each minute, hour, day, month, year that goes by, that number inexorably drops.

Given that most of us don’t spend 6-8 hours a day writing, the real number of words we will actually write is far lower, and thus those words that we do produce become so much more important.

This is a sad thought, but one that we should acknowledge for a variety of reasons:

No matter how much you try, there’s only so much knowledge you can communicate.
Every tweet, email, blog post, or document consumes some of those limited keystrokes. Is that the best use of those words, is it the best venue, the best way to make that knowledge useful to the future?
Is a reply worth it? Could that effort be better used?
When deciding what to write, is it the best, most useful thing to write about?
When these words are read in 1 year, 5 years, 10 years, 20 years, what will it say about you?

Few things have the potential to live as long as what you write; how you’re remembered may well be defined by the words you leave behind.

Vast Knowledge, Doomed To Nothingness

Many of us that work in technology write in huge quantities, though much is in the form of emails that will eventually be deleted or lost, in internal systems that will never be seen by the outside world, or will eventually be lost as companies close or systems are lost or retired. Too much of the knowledge that we document, and the insights that we share are seen but by a very few.

Most of the words that we write are doomed to be lost. In the vast quantity of knowledge that is committed to the written word every year, so much is lost, forgotten, deleted, and slips out of existence. No matter the value to the future, the insight it could provide, the aid it could provide, it’s locked away in systems that have a limited life and will eventually be gone. Every year, a vast quantity of documented knowledge slips away into nothingness.

Humanity generates an unimaginably vast amount of knowledge every year, yet every year the knowledge lost to humanity is also truly vast.

Finding relevance over the years

As technologists, many of our words have a half-life – as time goes on, their relevance diminishes. A lengthy and well thought out discussion over Slack likely has a half-life of minutes, maybe hours. A debate over technology via email with a coworker? Its half-life is hours to days. Looking at the traffic to this site, the most popular technology-specific article has a half-life of roughly 9 months – every 9 months or so, the number of hits that it gets drops by half. Every day, the carefully crafted words, the deeply thoughtful ideas become less and less valuable.

Some things, though, have a half-life of years; these are the things that continue to matter not just year after year, but one decade to the next.

Venue

One key to writing for long-term value is the choice of venue. Some venues work well, and others are doomed from the start – there’s no chance of it surviving or having much value in the years to come.

Twitter can be fun (when it’s not awful), but between the short format and the minuscule attention span, it’s a terrible place to write.
Slack & Discord are the same; no matter how much thought and care you put into something, it’ll disappear in the mass of other content and be lost.
Email, it depends – email within a company is doomed to a short half-life and doomed to be lost sooner or later.
Email mailing lists and the like are better, in at least there’s a chance that it’ll be preserved and could be found in the future. However, it’s so easy to be lost in the noise, and so likely that it’ll be so difficult to find that it won’t actually provide that much value.
Blogs can be good, but so many come and go that they aren’t seen as stable in general. Accounts get deleted, servers go down, backups are lost, domains expire, and their owners pass away. For example, this blog has been running (on this domain) for 15 years, but how long will it continue should something happen to me?
Academic and industry journals are useful for some content, but only a small portion of what we write during our lives fits this venue’s very specific requirements.
Books are certainly preserved the longest, but they also require a huge amount of work, generally quite focused, and also most technical books have a clear and limited half-life.

These are, of course, just a few examples, there are various others, each with their own pros & cons. There are a variety of services that host public & less public content, though those may close, suffer a data loss, and may or may not be preserved for the future.

When writing, ask yourself which venues are available (obviously things that are work-related have a different list of options), of those, which have the best long term value, and can you use a hybrid approach, writing the content with the most long-term value in one venue and reference that from a shorter-term venue. There have been times that I have written on this blog or a corporate blog, just to support an email – making as much of the valuable content public and useful to others.

Content

Writing about ideas, concepts, problems & their solutions have much more value as the years go on than writing about specific technologies, or even worse, specific versions of a product. While writing that has only short-term use (such as about a version of a product) can be very valuable, but the useful lifespan diminishes quickly; within a year or two, it may be entirely irrelevant. Much ink (or today, electrons) have been spilled on writing for relevance, so I’ll not belabor the point here – I’ll simply say that the words you write that offer the most value are those most focused on high-level issues and ideas, and least on technical options or solutions.

Tomorrow comes, ready or not

It’s so easy to put off to tomorrow what could be done today, and then again, and again. Each delay means that many keystrokes have been lost, words that could have been written, now the opportunity lost and will never be written. We each have a chance to write a legacy that can be remembered for years. It’s up to us to take it.

Essays on Adam Caudill

On Privacy Nihilism

Failure Made Personal

Incentives

Fighting the Good Fight

Whose Monkeys Are These?

Not My Circus, Not My Monkeys

The Cost of Ownership

Ownership: Proactive Acceptance vs. Seeking

The Responsibility of Knowledge

The Squeaky Wheel

Owning a Circus

Good Faith, Moral Duty, and Selfishness

Why are we like this?

Selfishness

Us versus Them

Out-Group Apathy & Antagonism

Large vs. Small In-Groups

What We Owe Each Other

The Golden Rule

On AI, Art, Writing, and the Distillation of Creativity

The Studio Ghibli Connection

Art, and the Unbroken Chain

Photography

The Experiment, Redux

Is this art?

Is Photography Even Art?

The Ability to Create

Writing

My Break from Fiction

Distilling Human Creativity

It’s All About the Prompt

Creative Jobs

In Conclusion

When AI Becomes I

Biological roots

Organic vs. Non-Organic Life

What is intelligence, anyway?

Millions of Jobs

The Industrial Revolution

Quiet Part, Out Loud

Impacts & Future Challenges

Software Development

Creative Arts & Writing

Truck & Taxi Drivers

Management

Information Security

Plumbing, Construction, Mechanics

Inevitability

Am I predicting an AI disaster?

The Writing on the Wall

Security Is a Shell Game

Recovering from Failure

Always the Same Problem

AI: Art Without Expression?

The Quote

AI Models

What is Art?

The Experiment

Is it art?

Greater & Lesser Art Forms

Art is Art

On Productivity

Write, a Lot

Notes

Communications

Focus Time & Calendar Blocking

Prioritise, Ruthlessly

Understand your Peaks & Valleys

Understand your Motivations, Passions, and Challenges

Just Do It.

Build Confidence, then Build Wins

Work Hard, Play Hard

Taking Responsibility for the Spotlight

Your Platform & Your Responsibility

Understanding Your Platform & Power

A Case Study: The Manager Looking for Brides

The Event

Sharing the Spotlight

Communicating With Respect