There was a shooting in Toronto tonight around 5:30, one young woman killed, about 5 shot and injured. It is horrible, and I was there. I went to pick up a new camera, but before I could, madness took to the streets as people started to run for cover. The shooting apparently occured in a night club (78 murders in Toronto so far this year; 52 by gunfire -- twice as many as last year). After the situation stabalized, I went and picked up my camera, and took a few photos (I was going to say shots, but that's not very funny). The bodies had been taken away within 30 minutes, but the scene was still very surreal. Have a look in the December 2005 Gallery for some more photos (some on page 1 and page 2). Most shots have no flash (i.e. hand held) at night, with a 12.8 Megapixel Canon EOS 5D and a the Canon 28-70 2.8L lens (big honking thing). To save space, pics in the Gallery will be 1280 pixels wide in their longest dimension (this camera's RAW files are somewhere between 12 and 19 megs each! (I think)).

The world is a tricky place. Stay safe.

Hey, I'm presenting at ACSAC in beautiful Tucson Arizona (whose slogan should be "Oh my God, it's full of stars" (even though I prefer "oh my star, it's full of Gods"). Michael Abrams of MITRE will be chairing the portion of the conference I'm a part of.

The conference runs from Dec 5th thru the 9th and seems interesting. My presentation will be on BDL - Baseline Description Language, a langauge I invented for specifying the rules by which network traffic can be clustered into fuzzy gramatical sentences, and subsequently visualized. The work is promising, and maybe next year I won't need to look at ports and IP's anymore -- instead I'll be able to look in more meaningful symbolic ways.

Since two of my passions are information security and computer music, I even tried writing rules to classify audio. Not working as well yet, but there is hope.

A lot of the work on BDL came from a brain seed planted by inventor of Fuzzy Logic Lotfi Zadeh in a gripping lecture in Waterloo several years ago. I've been following his work for some years prior to that, and over the last two years have greatly enjoyed his "computing with words and perceptions" paper, and the work around it.

Anyway, if you have the time, do pop by the conference. If you're interested in the topic, drop me a line and we can discuss it. It's a novel approach that offers good symbolic classification power that I've not seen elsewhere. If you have a lot of network data or other signal data, and need to make some sense of it, do give me a shout.

I'll post pictures when I get back.

Oooh, I finally won a bet with my friend Gus. We make bets all the time.

Gus is funny, for it's *reallllly* hard to convince him if you've won, even if you have won. Under these rules, I usually don't win. It's always a gentleman's bet (1 buck). This last bet was on a subtle point of public key vs. symmetric key cryptographic algorithms. My point was that the RSA algorithm is peculiar in that EITHER the public or private keys can be used to encrypt OR decrypt -- this is not true of all public key algorithms (e.g. Elliptic Curve). In this way the keys are 'symmetrical', although of course, it's not a symmetric key algorithm like DES (which has only one key that must be guarded).

Gus, being formidable, works hard to try to get out of paying me anything, for any reason--but this time he 'fessed up, and did a Maple test, which finally resulted in me being a whole dollar (Canadian) richer! Have a look at the web page Gus made (Maple export) (read Gus's conclusion). W00T!

I've just applied the Geeklog 1.3.11sr1 security patch. I can't believe it's been available for about a month and I didn't even know about it. Anyone know of a vulnerability update service that just tells you about stuff you have, instead of all the crazy stuff you don't have?

I still like Geeklog, but have started using WebGUI on another project. It's pretty cool. If you need an instant web-site with good CMS, check it out. Also check out CMS Matrix, which lets you find the best CMS software for your needs. Cool stuff! Hey, I should get to bed.

Operating System Battle: Since Solaris 10 now is free, and is indeed a mighty operating system [A $500-million investment produced the most advanced operating system ever built—now offered FREE to you.], I decided I'm gonna try it out. I even bought a new box for it. It's going to compete for 'favorite child status' against a fresh Gentoo uber minimalist install.

Network Uncertainty: I feel I need to rationalize my home network, as it's grown kind of large and its complexity is worrying me and I've kind of forgotten what services are running on my machine (but unfortunately, Nessus hasn't).

Security: From a security perspective, things are not so bad, but Nessus shows a few things I've relaxed in order to make life easier: a few music share exports, some insecure X Windows, DCE distributed computing environment services, etc... Gotta patch those holes. Also, the Mandrake server that runs this web site has a broken package update manager, so that's also worrysome, so it's hard to update the puppy with the new 'Mandriva' that Mandrake has become. A new WinXP box Nessus scan shows an odd guest account issue, even though all the baseline scans pass, all patches applied, and Guest is off on the PC. Lots of stuff to patch and figure. I should get a buddy to 'audit' my network once I'm done.

On the storage front: I've converted most all of my CD and DVD (and VHS, and Audio Tape) collection to raw data files on my SAN -- most, for I've only got about 500 GB free now, and I need to buy more space. I'm very saddened at the DVDDecrypter news (it was taken down by the man). I originally wanted to store all the WAVE files and raw DVD's on my SAN with no quality loss, but wow it eats up space. I'm wondering if I should encode at least some of DVD's with DivX or something that can at least keep the menu structure working. It's against my philosophy, but it's cheaper than buying another SAN chassis.

I was looking at Coraid, which was written up in LinuxJournal recently. They make products which let you put drives directly on the LAN. Instead of iSCSI, one has ATAoE, and it's pretty simple to set up. I'm looking at the fiesability two 7.5TB racks. Problem is there's no hierarchal file system, snap shots, gui utilities for volume management, etc... It's just a Linux 2.6 kernel and a bunch of disks. Performance would be 'fine' I think. Another issue is that even though CORAID's solution is cheaper, I originally went to a SAN so I could have a unified storage management model for the house, and the optics of two storage models are less than pleasing (except on the wallet?).

Single Sign-on: Another goal I want to achieve is to implement a single sign-on solution with some biometric controls. I've been messing around with a few solutions, but they all take a lot of time to install and get working on all the different platforms. It seems if one can't install Single Sign-on at home, then how the heck can a big company do it? I think I need to hire a competent sysadmin (anyone want the job?) to get it all up while I hot tub and drink margaritas. Overall, I am looking for a sysadmin, so drop me a line if you're a superstar.

Outbound Load Balancing: Finally, I want to get real outbound load balancing working. I've got a DSL and Cable connection at the house, and occasionally one or the other does go down. I had a kind of flakey solution running some time ago using Linux, but the configuration was very complicated, and one afternoon I leaned on my keyboard in 'Vi' and apparently deleted something critical and that was about it for outbound load balancing.

Cables everywhere: Then there's the problem of Gigabit upstairs.... I have this long cable running from upstairs to downstairs right through the house. It's silly. People trip on it while they use the stairs. My mother yells at me about it when she visits. There's so much to do!

So I just sat the CISM exam. Had to get up at 5:30 and drive to Toronto. The drive was really pretty with all sorts of tree fog in the lower planes. Quite beautiful actually. And the Coffee Time coffee was also above-par.

One thing which did tick me off is I wasn't the first one to leave the exam hall. About 400 people were in the exam hall (around 30 or so for the CISM, all the rest for the CISA). I was #4 to finish. Rock on PAULSOP.COM! There was one ultra-dork-dork that stood out during the exam. Not only did he ask a dumb question ("can I write notes in my question book"), but DURING THE EXAM, he stood up and asked the entire room of 400+ people if they could 'stop coughing' so he could concentrate. I laughed out 'boo hoo' and was getting ready to PAULSOP.COM thump him, but instead I just whipped an eraser at him and everyone laughed. I certainly didn't need an eraser, as I was not making any mistakes. If I didn't have better things to do after the test (saw some street-artist friends on Queen Street) then I'd have stuck around and given him a wedgie afterwards all east-coast style... er. I mean grade-school style.

Hot Tip: The key to studying for exams is to do it from inside a Hot Tub. Yes, the study materials get disheveled, and your head can get sun-burned (hot tubs are best in the day, yes it's true), but the power of the chemicals combined with the heat (i futzed with the eeprom on my hot tub to increase the tempeature to crazy levels), bubbles, and the radioactive sun really magnify your brains capacity. Perhaps about a billion times. (pinkie in my mouth Dr. Evil style).

Another key to studying is to not over-do it. Study for 20 minutes, and then read Linux Journal for 1/2 an hour, have an ice cream, and clean up the Kitchen. Then you can possibly handle another 10 minutes. After that, you should sleep, reflect, and try to invent the entire cosmology of the next chapter -- i.e. anticipate what the writers will try to hit you with next. If you're reading differentiation, invent integration while you dream.

Finally, studying is always enhanced by driving to the lake (without your study materials). This is known in scholarly circles as the 'lake effect': Scholarly article from National Institute of Health.

I went up to Conestogo Lake with my best friend Gus, who brought with him book on Group Theory (and a Linux Journal, and a Nuts and Volts), and was always mumbling something about Abelian groups, how awfully big the Monster Group is. BTW, the monster group is also called the friendly giant group. It was constructed in 1982 by Robert Griess as a group of rotations in 196,833-dimensional space (way more than 3D). Here is a picture of the monster group, projected on Cthulhu space:

We also had an argument about standard notation, and then we suddenly realized we were in agreement.

So that's how to study. Get on it!

So there are no viruses in any of the 492768 files scanned by the Anti-Virus scanners -- no viruses, no spyware, ... nada ...

These files go back to about 1995, and the last time I had virus scanned them all was about 2 years ago. Even back then, there were no viruses detected (just a few false positive macro virus things in hacking source code). I don't know why I don't have viruses -- just lucky I guess! (please, universe, don't take this post as an invitation to infect me...)

I'm alltogether unconvinced that paying Symantec $24.95 is the right thing to do. It's not the money -- it just doesn't feeeeel right. Instead, i'll try one of those free anti-virus programs (maybe AVG or Panda). Btw -- they don't even say how 'long' a subscription lasts for. they just let you 'renew' it -- spooky.

I'm giving a talk at Kitchener Waterloo Software Quality Association today on the topic of testing for software vulnerabilities. Kitchener Waterloo has a lot of great software companies like: Adobe, Open Text, Research in Motion, Intellitactics, Sybase, etc... many of which are sure to be there. Come if you can. [Schedule]. I'll post my presentation later in the files section.