Security on the Internet
I was originally going to write about how stupid FAFSA is, as that’s really what I’m annoyed with right now, but perhaps later I will. I have been distracted by coming to the blog and seeing another thousand comments awaiting moderation for me about poker and porno.
Maybe I hadn’t been clear as to how this worked before, but I have unfortunately had to turn off the ability to immediately post comments to my blog, instead they have to wait my approval. This is good, because it means that I (eventually) read every single one of them, but the problem stems from a few “bad apples” on the Internet who have decided to abuse the ability to publish comments to blogs by getting together a few computers and “comment spamming” blogs with links to various sites we would never knowingly go to. These sites then rise in the rankings for search engines like Yahoo, MSN and Google because more sites are linking to them.
So unfortunately I have to delete them manually. This was entertaining at first, but now is a dull drudgery identical to the one I have to perform on my email which as you might guess is well-spammed. Unfortunately, just as the case with email, it is nearly impossible to stop all spam as the system wasn’t designed to be used to verify the sender’s address and to accept it based on their legitimacy.
However what comment spam exposes is the fact that email is not the only place this sort of junk is posted, it is posted nearly everywhere on every medium on the Internet. The main problem is that the Internet and most other computer networks for that matter were never designed for the sort of stresses they are being put through right now. But why not? Why didn’t someone forsee the ability to forge the sender’s address information and send mail to millions of recipients? Well the simple fact of the matter is that programmers are, by and large limited by time and budget.
What really surprises me is that not a single organization or agency has stepped up to take care of the problem. When cars became popular, highways became necessary. When air travel was popular, traffic control was necessary. Yet the Internet has enjoyed a relatively regulation free existence despite its well-known DoD birth and childhood.
I think that a lot of this has to do with the importance placed on the Internet’s need for anonyminity. And frankly I like the anonymous nature of the Internet when it works for me. But I do not like the idea that there is literally no way to find the identity of people who are criminally annoying if not criminals.
It would seem that the only way to remain socially anonymous and yet prevent annoying people from doing annoying things would be to make computers more intelligent, to prevent them from doing the things that we all find annoying. There is, in fact, an architecture developed by Intel and Microsoft that would at least stop most spyware, adware, and zombie computers who annoy their owners and other Internet users by preventing, in hardware, the execution of programs which are not verified to be safe with a digital signature unique to that program. Of course this would require independent verification from a very powerful third party but would prevent most spyware from running.
But, guess who hates the idea of that sort of a system: computer geeks. We don’t like the idea of a third party that determines what we can and can’t do with our computers. And we don’t want our personal identity associated with our actions online either. We think that the burden should fall, well, somewhere else. Probably on the service provider, but frankly we haven’t thought that far ahead and really just don’t want anything to change.
And yet, we sit here bitching. The real reason nothing has been done is because of the stalemate created by the nerds who made the Internet. They don’t want to make it more professional and more legitimate and because of this a lot of important problems are being addressed in technologically complicated and inefficent ways (although these ways definitely sell computers and software).
Take for example, spam filtering. The current style of spam filtering relies on commercial software the looks at all the properties of every single message one by one and analyze the sender, the sender’s ip address, the subject, body, keywords, URLs, photos, and so on in a very complex algorithm, and often it is “artificial intelligence” style with constantly changing learned criteria from previous messages that were marked spam by users. This is certainly an impressive waste of computing power, but why can’t email be verified back to a single person or computer whose trust could be verified.
This would require a lot of forethought and planning to change over, but it is certainly easier than a faulty algorithm that has perhaps 98% accuracy while also dropping 1% of legitimate mail.
However, this doesn’t solve comment spam. Nor would it solve the sorts of spam that we haven’t even encountered yet. Nearly any medium could be spammed. Text messages, cell phone calls, web sites, the list is endless. What is really needed is, unfortunately, not verification of the computer, but verification of the intent of the human pressing the button. While it may seem draconian, as long as people can easily use media to present unwanted material to people, usually at little or no cost to themselves, we will continue to be annoyed. More importantly, we will continue to be hacked, hassled, and harmed.
The only real solution to preventing abuse on a network is establishing a multitiered system of trust, which requires first a system of authentication (verifying someone’s identity) followed by authorization (allowing them to do something or access something), and accounting (recording what and when they do things). This sort of system, shortened to AAA, is the basis of most computer security systems and is brutally effective in most cases. It is over 20 years old and by no means my creation.
However, AAA is completely lacking on the Internet, because of the self imposed condition of annoyminity that we computer geeks are forcing on the populace at large because of our ideals. It is time to drop the romantic idea of an annoymous medium and start imposing some classic security design on the Internet, and frankly the sooner the better.
Anyone can feel free to remind me of this in twenty years when we live under fear of the thought police and big brother, I realize the pandora’s box I may be suggesting, but I am not sure the current pandora’s box is any better than this one. At the very least we are protecting the most vulnerable and least protected by preventing criminals from taking advantage of their insecurity.
As for FAFSA, I believe that only the government can create such ridiculous forms with illogical and arbitrary requirements. Despite the fact that I am independent and provide for myself with my own job, according to questions 48-54 of the dear FAFSA, I am required to give them all the information for my parents since I was born after January 1, 1982. Nowhere in the ridiculous form did it as if I lived on my own, paid my own bills, claimed myself, was not dependent, and so on. However, had I been married and 18 I would have been considered independent. I’m not sure that I can even comprehend the logic behind this… but unfortunately it screws my chances of government grants.
Further it uses the ridiculous tax returns, which frankly smack to me of old boy system bureaucracy. Why is it that business owners can deduct nearly everything while employed folks are stuck footing the bill? Oh bother, I could continue but why. Anyway, FAFSA is in for better or worse.









