From the Mind of Trevor Stone

The New York Times published a set of articles this week about U.S. military efforts to hack North Korean weapon systems to stymie the regime's goal of demonstrating an ICBM which could deliver a nuclear bomb to a city in the United States. The attempts so far seem to have been fairly successful, causing failures in most launch attempts of the current generation of North Korean rockets.

While the political and military tactics in this particular case and how the North Koreans may react or retaliate are fascinating, I'd like to take a step back and look at the bigger picture. The U.S. military is using "cyberweapons" and committing what one might term "cyberwarriors" in an offensive operation attacking infrastructure developed by a foreign state. This is also not a new policy: ample evidence indicates that U.S. and Israeli intelligence agencies built and deployed the Stuxnet worm to cause physical damage to nuclear centrifuges at Natanz in Iran, setting the Iranian government's nuclear ambitions back by a few years (and driving them batty in the process). The Stuxnet attack was authorized by George W. Bush and reauthorized by Barack Obama. The North Korean attacks were authorized by the Obama administration (probably the president himself) and is now under the direction of the Trump administration.

In many ways a "cyberweapon" is just a collection of software vulnerabilities packaged in a way that helps the attacker obtain information from or disrupt the operations of a particular network or computer system run by a target. A cyberwarrior and a common hacker use, by and large, the same tools–they differ primarily in motives and focus. The same vulnerability in, say, Microsoft Windows can be exploited to steal bank account credentials or to further infect an industrial control system and disrupt a nuclear fuel operation. The Stuxnet attack on Natanz and the current North Koraen attacks have had significant physical-world effects: large and dangerous objects were destroyed. Criminal and ideological hackers have thus far focused on digital payloads–stealing data, transferring money–but there's nothing preventing non-government attackers from creating havoc in the physical world, from disabling the power grid to releasing a flood of water from a dam to potentially triggering a nuclear meltdown.

Unlike the military hardware of the last century, governments, businesses, and individuals around the world generally use the same software and hardware from a small group of companies with worldwide scope. The Microsoft Windows on laptops, Android on smartphones, and firmware in Cisco routers is code that's used by people in every country. By and large, there's no "Iranian software," "North Korean software," or "American software"–with the Internet, it's all "world software." Every security bug that a military or intelligence agency discovers but doesn't disclose is one that goes unpatched by the vendor and could be exploited by another government or crime gang, harming the citizens, businesses, and government agencies that the military and spy agencies are tasked with protecting. This presents a particular problem for an organization like the NSA which have an explicit commitment to both defend American computer and communication networks while intercepting foreign communications of interest.

Physical war and military operations are, in large part, studied and debated in the open. The public and our elected representatives don't know the details of all military plans and technologies, but we're broadly aware of where military force is being used offensively and defensively and what sorts of tools and tactics we're comfortable with the military using. The country is able to have a public debate about topics like whether we should invade a country, how much money we're willing to spend to achieve military objectives, and whether we consider torture or cluster bombs to be acceptable tools of war making. (The pro-war advocates are often able to start their framing of the issues well before the public starts to engage in the debate, so we tend not to have a very effective public debate, but the opportunity is still there.)

"Cyberwar" and offensive security compromises by the government, by contrast, have been conducted under a thick veil of government secrecy. The people of the United States and our representatives in Congress have not had an opportunity to have a public debate about whether we're comfortable with the military, without declaring war, instigating digital battles with sovereign states. We haven't had a proper conversation about what sorts of cyberattacks we're comfortable and which are beyond the pale. We haven't effectively discussed the balance between concealing and weaponizing computer vulnerabilities for attack and defending our country's digital infrastructure by helping companies patch software when intelligence agencies find bugs. And we really haven't come to grips with what we'll do when a "cyberweapon" targeted at a narrow military objective is too effective and causes unintended damage elsewhere on the Internet, including to American assets. We also haven't taken an opportunity to establish treaties governing digital offensive activities, so other nations may take a cue from U.S. operations and decide that hacking is a legitimate tactic and invest in their own "cyberarmies" which attack and hurt American computer networks.

There are reasonable arguments both in favor of and opposed to offensive military hacking. Proponents can point out that a well-executed cyberattack has the potential to achieve its objective cheaper and with a lot less loss of life than a conventional military operation. Opponents can point out that a hacking operation that gets out of hand–as the Stuxnet worm did, infecting millions of computers around the world–it's a lot more work to halt than just calling off the bombers and withdrawing the troops. But so far these debates have been held quietly behind closed government doors and in memoranda stamped Top Secret. The public doesn't know what conclusions were reached and their interests were not well represented. Once Congress is done with their current project of attacking affordable health care and defunding public agencies, it would be great if they could demand that military, intelligence, and executive agencies include the American people in the conversation about the rules of engagement for offensive hacking. I'm not holding my breath, though.

Anyone interested in this topic should watch the fantastic documentary Zer0 Days. It features a detailed technical explanation of how the worm works from the security researchers who studied it (and impressive cinematic techniques to make this explanation engaging), insights from anonymous NSA employees, and some remarkably frank on-the-record interviews with government officials. I'd read the initial reporting on Stuxnet in 2010, but the movie exposed several fascinating facets of the story of which I was unaware. The interviews with government-associated figures help shape the views I expressed above, and some of the officials seem to share my position.

Bruce Schneier often writes well about this subject, too.

There's been a lot of noise in developer circles recently about Apple's new unusual iPhone developers agreement, particularly section 3.3.1. Briefly, Apple declared that you're not allowed to write iPhone/iPad/iPod software unless you use their tools to do it. Specifically, you're not allowed to write it using a level of abstraction that lets the application easily run on other devices like Androids, Windows Mobile phones, and BlackBerries.

A lot of people said this new change was targeted at Adobe, creators of Flash, a system for creating multimedia content that will work the same on any browser with their plugin installed. While the sorts of folks who comment loudly on this sort of thing have no love lost for Flash, being told how not to write software is a good way to rile up whole nests of developers.

Steve Jobs recently wrote an explanation of why he doesn't want Flash on the iPhone. He starts by painting Flash as a closed system -- Adobe controls the authoring tools and the play environment. He contrasts this with the open standards of HTML5, CSS, and JavaScript, the technologies at the front of most websites. The great thing about HTML is that anyone can create stuff in it and anyone can access it with a browser tailored to their device's peculiarities. So far, so good.

But then Jobs completely undermines his discussion of the openness of the web by saying the most important reason they don't want Flash is that they think the applications with the best user experiences were written to take advantage of everything the iPhone (or Mac or whatever) offers. He suggests that it's best for the users if all iPhone apps are developed using Apple's tools:

Our motivation is simple – we want to provide the most advanced and innovative platform to our deAvelopers, and we want them to stand directly on the shoulders of this platform and create the best apps the world has ever seen.

In other words, you can stand directly on Apple's shoulders, but you'd better not stand on the shoulders of someone standing on Apple's shoulders. If some clever company invents a new way of writing really great apps, the only way iPhone users will get the benefit of that innovation is if Apple deigns to adopt it.

Yet when you visit a website on the iPad, Apple doesn't stop you because the site's designers didn't adhere to Apple's user interface guidelines or because they used a tool like GWT to make the JavaScript work for all browsers. So if somebody wants to write an app that can run on iPhones, Androids, BlackBerries, and who knows what else, their choices are to write it twice: once for the iPhone and once for everything else. Or they can take Steve Jobs's advice and write it once for the web and bypass Apple's restricted platform. If they do the latter, they don't have to wait in App Store limbo, they can include porn if they want, and Apple doesn't take a cut of their profits. What's the down side?

So which is it, Steve? Are open standards the key to a good development environment and a good software ecosystem? Or is a single company controlling the platform the way to go?

Personally, I'm happy with my Android device which allows you to stand on as many shoulders as you like. It's shoulders all the way down.

From a 1986 interview with Bill Gates for the book Programmers At Work:

Features are kind of crummy in a way, because the more features you have, the bigger the manual is. And features are only beneficial if people take the time to use them, whereas speed–if you can print the pages faster, or show it on the screen faster, or recalc it faster–that’s worth an incredible amount. If you can give the users a few simple commands and make the program efficient enough to do what they want with those few commands, then you’re much better off.

A decade later, Microsoft seemed to have abandoned this philosophy wholesale. They became synonymous with feature bloat (from my perspective, MS Office usability peaked in about 1997) and software that ran slower with every release. Gates has had one of the sharpest minds for the business of computing and presumably realized that features outsell performance, particularly in enterprise which is where the real money is.

Installing Ubuntu updates this morning, the details included the line
Unpacking replacement wine...

Maybe the original wine turned to vinegar. Or maybe someone dropped a case and we had to scramble to have enough for the party.

Software design is the art of placing rugs about your house in such a way that nobody notices what's been swept underneath them.

If a poor and despised Indian tried to get a job at a company testing Java software they would throw him out with a ClassCasteException.

Microsoft PowerPoint is a curious program chock full of features to make your presentation look absolutely ridiculous.