textiplication.com

I’m not sure which of these is most tempting. 

No, it’s not a steering wheel – it’s Orange Book!

D: Minimal Protection.

Systems that were submitted but failed evaluation.

C: Discretionary Protection

Discretionary protection tends to mean that the user has a lot of power over the security.

C has two rating categories:

C1: Discretionary Security Protection

Based on individuals and groups.

Identification and authentication of individual entries.

Some form of access control.

Protected execution domain, low-privilege processes can’t adversely affect higher-privilege processes.

System’s operational integrity can be validated.

Design doc, test doc, facility manual (helps install and configure properly)

User manuals.

C2: Controlled Access Protection

Users are identified individually.

Security events are audited (lowest mention of auditing – C2) and protected from unauthorized modification.

Resource or object isolation for protection and auditing (below process level)

Object reuse concept – objects are cleaned after use to prevent residual data leakage.

Strict logon and decision-making on object access requests.

Division B: Mandatory protection

MAC is enforced by means of labels.

Based on Bell-LaPadula, must use a reference monitor.

B1: Labeled Security.

Each data object bears a classification label.

Each subject must bear a clearance label.

Data leaving system also bears a security label.

Policy is based on an informal statement.

Design is reviewed and verified.

B2: Structured Protection.

Policy is clearly defined and documented.

Subjects and devices require labels.

No covert channels.

Trusted path for logon and authentication

Subject communicated directly with the application or OS.

There are no trapdoors.

Operator and admin functions are segregated

Distinct address spaces for each process.

Covert channel analysis.

B3: Security Domains

More granularity in the protection mechanisms.

Protection mechanisms exclude code that does not implement the policy.

Reference monitor components must be small and testable.

Ref monitor must be tamperproof.

Security admin role is clearly defined.

Recover from failures without reduction in security.

Starts and loads from an initial secure state.

Division A: Verified Protection.

Formal methods used to ensure control of subjects and objects.

A1: Verified design

B3 + formal methods.

Stringent change verification.

I had a great time at Boskone this year.  Chris was on a bunch of panels, including a fabulous digital art discussion with Stephan Martiniere, Dave Seeley, and Alan Beck.  I had terrific conversations with Dani Kollin (co-author of the forthcoming Unincorporated Man[ordered]), Alisa Kwitney Sheckley (Robert Sheckley’s daughter!OMG!), and Rosemary Kirstein (author of the fabulous Steerswoman series), whom I’ve been looking forward to meeting for years.

Cons are always so inspiring. I started two new short stories this weekend, and even wrote a thousand words or so on Hack.  I find it tough to balance short story effort  against novel effort – finishing a short story is quck gratification, but the novel won’t write itself.  I guess I’m doing all right as long as I’m writing.

http://www.myspace.com/heartlessbastards

That is all.

http://www.washingtonpost.com/wp-dyn/content/article/2009/01/26/AR2009012601831.html

Mercury in high-fructose corn syrup. Nine of twenty samples.

One in three brand-name foods contained mercury.

The use of mercury-contaminated caustic soda in the production of HFCS is common. The contamination occurs when mercury cells are used to produce caustic soda.

OK, how many of you are happier knowing that the manufacture of high-fructose corn syrup involves a substance called “caustic soda”?  How many of you wouldn’t be any happier about that even if the caustic soda never contained mercury? 

Was there a person who said, “you know, it’ll probably be just fine to use the caustic soda with the mercury in it?”

Shades of leaded wine in ancient Rome.  History will not be kind to us, if anyone’s left around to write it.

Patent number: 4656917
Filing date: Jul 30, 1985
Issue date: Apr 14, 1987
Inventor: Edward L. Van Halen
Primary Examiner: David Warren

http://www.google.com/patents?vid=USPAT4656917

Yes, it’s real.

The supporting device is constructed and arranged for supporting the musical instrument on the player to permit total freedom of the player’s hands to play the instrument in a completely new way, thus allowing the player to create new techniques and sounds previously unknown to any player.

[Italics added.  USPTO doesn't do italics, even on that which is entirely rad.]

The hair is purely illustrative, and a practitioner sufficiently practiced in the art will be able to determine many other hairstyles for which the invention works equally well.

http://gamu-toys.info/sonota/sw/obama/obama.html

Gets better the further down you scroll.

Yes, it is a reflection of how bored I am, after four days on the couch, that I’m watching actual television shows.

Day 4 out after ankle surgery, and I’m watching Leverage on DVR, mainly because this guy (who wrote this) is one of the executive producers.  I’ve been reading Kung Fu Monkey for years – ever since Crazification Factor, and it’s been fun trying to figure out from the blog who John Rogers is and what he does because he does so many different things.  I mean, Transformers, Blue Beetle, looks like he worked on the Cosby Show, and for the longest time I thought he was Yet Another Hilarious Liberal Blogger, one who didn’t post very often.

It’s been interesting watching Leverage, because I don’t watch much TV.  After all John’s posts on TV series sausage-making, I was curious how the show would turn out.  I was hugely disappointed by the first episode, which lays some pipe on how the group gets together, none of which I bought.  Not the characters, not the relationships, not the story, nada. It was all so quick, so shallow, so idiot-driven, that I couldn’t take it seriously.  “Television shows,” I said to myself, and didn’t watch further.  It took until I was laid up with the ankle to watch some of the episodes recorded since, and now I’m kinda hooked, and now I get it.  TV shows RELY on the fact that you’re coming back next week.  There’s no way they can do setting, characters, and plot in one short show, especially with all the commercials they have to show.

And, tentacles, do they show a lot of commercials.  If there were no DVR, I’d never be able to watch the sucker.  Even on fast fast-forward, the commercial breaks are almost more than I can stand.  And – memo to TV industry DVR haters – I still know what every one of them is for.  You watch the commercials REALLY intently when you’re FF’ing to make sure that you don’t skip over the next bit of show.

That is, music I’ve acquired in 2009.

Here we are, almost halfway through the month, and I’ve already bought/downloaded (eMusic) the following albums since 1/1:

1/13 – MGMT – Oracular Spectacular

1/13 – Kimya Dawson – Remember that I love you

1/11 – Joseph Arthur and the Lonely Astronauts – Temporary People

1/8 – Mr. Scruff – Ninja Tuna

1/8 – Kimya Dawson – Hidden Vagenda

1/8 – Juana Molina – Un Dia

1/4 – Laura Veirs – Two Beers Veirs

1/4 – Quasimoto – The Unseen

1/2 – The Presets – Blow Up

1/2 – Breakestra – Hit the Floor

So I’ve been going a little overboard.  That’s 119 tracks in 15 days, suggesting I’ll need a couple new hard drives by the end of the year.  

My favorites of these so far are:

Kimya Dawson – wordy, fearsomely smart, profane, progressive.  It was worth leaving the useless iTunes “genre” column in the display to discover that Apple classifies her under “Country”.  Toby Keith fans may pass right on by, though.
Yeah, I first heard her in the Juno soundtrack, too.

Juana Molina – Blurry loops of beautiful vocals, and I can’t understand a word.  An eMusic recommendation.

Breakestra – Throwback funk, with Chali 2na rapping on one track.  Why can’t we ever get more than one track of Chali 2na on any album? Another eMusic recommendation

Mr. Scruff and MGMT are promising, but I haven’t listened to them enough yet.