I just saw that the folks at MacUpdate have announced their MacUpdate Promo Holiday Bundle. Big deal, eh?

Well, they do these bundles a couple times a year. A bunch of cool software for US$49. I’ve bought a couple of their bundles in the past, and they tend to be pretty good -- I find myself using about 50% of the software in each bundle.

But I decided to write about this bundle, where I’ve not done that in the past. What caught my eye was two of my favorite Mac apps in this one bundle: RapidWeaver and MacGourmet Deluxe.

These are two of my absolute must have apps on my Mac. I use RapidWeaver to edit this web site, as well as my company site and a number of others. It’s a great, easy to use WYSIWYG web site content management tool. Awesome stuff.

And I keep all my recipes organized in MacGourmet Deluxe. In the last year or so using it, I’ve grown to rely on it as well. Magnificent.

Each of these tools costs about as much as the bundle by themselves. At the bundle price, it’s a bargain -- even if you don’t make use of any of the other things in the bundle.

I should point out I have absolutely no connection with any of these vendors. I’m simply a very happy customer. Your mileage may vary.

Cheers,

Ken

Yup, it’s that day again. My friend Lisa posted the following photo card out on Facebook, but it’s “from” Beau and Maggie.

It’ll be a relaxing day here with my wife and hounds, followed by a dinner at a nearby restaurant that’s said to rival Citronelle. But first, a nice medium-long mountain bike ride...

Cheers,

Ken

Today I announced the 1st annual FIRST team competition. It’s an idea I’ve been contemplating for some time, and I am ecstatic that we’re really going to make it happen.

Inspired by the Summer of Code initiative that my friends over at OWASP have done for the last couple of years, I pushed for a project competition among the member teams that make up FIRST. It’s a non-profit community of security teams that I’ve supported for many years.

The competition is among team pairs, who will propose interesting projects that will then be owned by FIRST, but available to all in an open source sense. I designed it so that it encourages cross-sector team collaboration, especially among academic and commercial teams. The winning team gets some project funding to do what their proposal says, as well as assistance in attending our annual conference -- the next one will be held in Kyoto, Japan in June 2009.

It’ll take a few months for everything to happen, but I really hope it can turn into an annual thing, much like OWASP’s Summer of Code.

Cheers,

Ken

Last week while I was in London, I was a guest on Gary McGraw’s Silver Bullet podcast. The podcast is available for download here. Drop me a line and let me know what you think of it!

Cheers,

Ken

So, just for fun and grins, I decided to play with Twitter a bit.

Twitter is a simple social networking site where people can post short 1-line messages, called “tweets”, explaining to friends what’s going on their lives. Once you register (for free), you can post updates as well as follow updates posted by your own friends.

Not sure if it’s going to be something I’ll stick with, but what the heck, I thought I’d try it out. I do enjoy posting longer updates here, and have no plans of stopping that. But Twitter is different. You can post from mobile phones, PDAs, etc. You can even post to your Twitter account by SMS, which makes it really simple to post short bursts.

That said, my Twitter page can be seen here. Feel free to register to “follow” it -- and send me your own Twitter page so I can follow that.

Cheers,

Ken

Someone asked me recently to define something that has become a tradition in my house: “Bistro Friday”. That’s a tall order, but let me give it a whirl.

I presume you all know what “Friday” is, so that should come as no surprise. “Bistro” is defined in the dictionary quite simply as “a small restaurant”. But “a small restaurant on Friday” is not the sum of these two simple parts, I’m afraid.

So, a little historical perspective first, to put things into context. A few years back, we started inviting some friends to join us for Friday evening chow. It seemed especially fitting in the summer months when Friday evenings in the DC metro area are often packed with tail lights, exhaust fumes, and angry motorists. And, since a few of our friends live quite some distance outside of the area, and we’re just outside of the famed “DC Beltway”, it seemed downright humane to open our doors for some friendly food, wine, and camaraderie.

That simple notion is the origin of the tradition, but it’s grown and transmogrified over the years. To a point, in fact, where I can no longer cite one simple definition. I can, however, talk about some of the guiding principles, so let’s explore those.

1. Fun. First and foremost, Bistro Friday is intended to be a fun time when friends can get together and enjoy each others’ company. Laugh and talk. And laugh. The door (and table) is always open to friends who want to stop in. Invitations are rarely sent. The only thing we ask is that you let us know you’re coming, so we can be sure to have enough food for all. (I’m confident we won’t run out of wine.)
2. Simple or fancy. There’s no single recipe for what to make. Sometimes it’s simple fare -- like tonight’s barbecued buffalo burgers. Other times it’s a little fancier -- like my Low Country Chicken and Grits. Sometimes it’s comfort food we’ve all had a thousand times -- like my pulled pork.
3. Experimentation. Bistro Friday isn’t meant to be formal, even if the recipe(s) is on the “fancy” side of things. We’re always free to experiment with recipes and try new things. Sometimes they work; sometimes not so much. But we always learn from them, succeed or fail miserably.
4. Made by hand. One of my kitchen mantras is “no shortcuts”. That’s not entirely true -- we don’t raise our own cattle, for example, for beef. We don’t grow everything. But I always strive to swim upstream up the supply chain as much as I can. For example, I make my own bread, almost always. I rarely accept something like a sauce from a jar or can, preferring to make my own whenever feasible. Tonight’s buffalo burgers will be served on home made buns. I grow several herbs out on our deck during the growing months. Those are spotlighted whenever they’re fresh and plentiful.
5. Celebrate the season. From April until October, we go to our local Farmers’ Market pretty much every Friday at 1600 hrs, to get fresh local produce, cheese, and ice cream for the evening (and weekend). Like the Italians, we do our best to get and to celebrate whatever is in season at the moment. I generally seek to avoid food that has been shipped thousands of miles (though I’ll violate this rule for convenience sometimes).

Those are some of the things that are important to me about our Bistro Friday tradition. To be sure, it has enriched our lives over the years, and it’s something I’d encourage anyone and everyone to try. Open up your home and heart, and reap the many rewards.

Cheers,

Ken

Just a brief follow-up to my last posting here...

On my last ride of the (short) week, I encountered “roadie-boy” again, but this time we were traveling in opposite directions. He nodded to me, however, and I returned the friendly gesture. I’m no doubt reading too much into it, but I interpreted it as a nod of respect. :-) Either way, it was a befitting end to a fun week of riding and beaching.

Cheers,

Ken

We’re back once again in the Outer Banks (OBX) of North Carolina, enjoying a few days of fun in the sun with Caren’s sister and family. It’s always a fun trip. We get a nice big house up at the northern end of the area, just north of Corolla Light House. It’s a bit crazy with 5 couples and about 8 or 10 toddlers running around -- generally screaming or sleeping, and the kids are even worse.

Anyway, one of my favorite activities here is to hop on my bike and go for a nice longish ride. My daily ride at home is quite hilly (about 27 km, with 500 metres of aggregated ascent). Here, things are pretty flat. So, I put a pair of “skinnies” on my bike -- slim tires for the flat road conditions here. Also by comparison, I generally average about 17-18 km/h on my daily ride, but here I’m finding 25 km/h is quite feasible to maintain, even on my “fully” -- full suspension mountain bike.

So, today I headed out for a ride after we took the hounds on the beach for a romp and made a breakfast that couldn’t be beat. At just 44 km, I didn’t go insane, but I did enjoy the ride very much. Then the fun began...

On my ride north, I’d just come out of one of the subdivisions around Pine Island when I encountered a “roadie” -- a road bike. The rider was sporting full roadie gear, including elbow rests and aerodynamic head gear. I wasn’t trying to show him up or anything, but I pretty quickly caught up with him. I drafted him for a km or so, but then he slowed down to rest his legs a bit and I all but catapulted past him. It’s a pretty safe but general rule that roadies do NOT like being passed by mountain bikes, and being passed by a “fully” is about as full an affront as one could find.

Sure enough, within a couple km, he wanted to show me that he wasn’t going to be beaten by a fully. Zoom, he passed. He certainly had every advantage, and I was just there for a fun ride, so no problem. But then, by Tim Buck II, I had caught up to him again. He seemed a bit surprised, but no big deal. Then, he swerved a bit to avoid a car coming out of a coffee shop and zoom, I launched past him again. He was NOT pleased.

To avoid a nuclear showdown, I pulled into the next beach community and rode for about 5 km parallel to the highway. Figuring I’d averted a full fledged war, I left the subdivision and got back on the highway. There he was again... This was too good to let go.

I quickly caught up with him by Corolla Light, when he slowed down to turn into his own (presumably) subdivision. I had to brake a bit to avoid him, and he quickly looked back at me when he heard the noise. The look on his face was completely priceless. He was a beaten man. But, I am after all a gent-ul-mun, so I refrained from passing him outright. I was out for a leisurely vacation ride, after all.

It was about as much fun as I could have on two wheels -- at least with my pants on. Another GREAT day in the OBX!

Anyway, here’s a Google Earth image of my 44 km ride below for your amusement -- click on the image to download the Google Earth KML file and view it in your own Google Earth browser. (I use a Garmin Edge 205 GPS on my bike to track my rides. Together with a wonderful software package called Ascent, I can quickly export Google Earth XML files to visualize my rides. It’s lots of fun.)

Cheers,

Ken

FYI, I was heavily quoted in a Computer World article on email privacy in the workplace recently. The article, by Sharon Gaudin, was prompted by a recent arrest in Philadelphia when a TV news anchor snooped on a co-anchor’s email messages. Serves him right!

Cheers,

Ken

Perhaps it wasn't THE best shower ever, but it certainly seemed like it was.

I have a bunch of hours to spend here in Tokyo's "NRT" airport.  I've been here in the United lounge many times -- I LOVE the beer machines! -- but never with this much time on my hands.  So I explored a bit.  I've seen the shower suites in the past, but you have to sign up for them, and I always figured they'd be snooty with my upgraded busines class seat and not a full-fare "C" seat.

But my upgrade came through with time to spare; I got a business class boarding pass; I figured I'd give it a go. Worst they can do is say no and make me feel like a second class miserable, pathetic excuse for a human being.

I’m happy to report there was not a hint of snooty.  Just a "would you care for a shower today, sir?" and "here is a complimentary amenity kit".  Went to my shower suite, put the sign up, and locked the door.  The suites aren't spacious, but they're not small either.  Kind of the size of a normal American bathroom.  A sink, a commode, and a BIG shower stall.  The shower stall is walk-in.  Heck, you could drive a small car into it.

And it's not cheap and nasty either.  All the fixtures are top notch Gröhe equipment.  I set my shower temperature and turned the pressure knob to 11 and...  and...  it was rapture.

After the 7 hour night flight from Kuala Lumpur -- at the end of a particularly long business day, I should add -- and knowing I have another 15 hours of flight time ahead of me, this was EXACTLY what I needed.

The amenity kit included shampoo, conditioner, shower gel, razor, shaving cream, toothbrush, toothpaste, comb, and some eau de toilette (always sounds better than "toilet water").  Nothing fancy, but nothing cheap either.

Just two minor complaints.  The bath towel was neither large nor absorbent.  Perhaps adequate for drying a hairless chihuahua after he’s run around a bit, but NOT so for drying an American male. Fortunately, the paper towels were more than absorbent to augment.

Second, the disposable razor.  Note to self: Dispose it first and THEN shave (with the razor in your dop kit) and there will be substantially less bloodshed.

Other than that, it was utterly delightful.  I plan on stopping through NRT more often on these southeast Asia trips in the future, that's for sure!

Cheers,

Ken

If Kuala Lumpur, Malaysia were to somehow have a (US) football team go to the super duper big game in January, what would I serve?

Huh? “Has he gone insane?!,” you must be asking. A fair question, but let me explain.

I’m sitting here in Kuala Lumpur on a business trip. With a 12-hour time zone shift, my body’s circadian clock has been understandably askew, but I’m dealing with it. (It’s not my first time...) So, I was clicking through the TV stations in my hotel room. What caught my eye was a chef in a kitchen preparing a positively drool-worthy meal. I watched...

It turned out to be a story about some chefs in Jerusalem who periodically got together with their peers and prepared meals for them. The catch: the chefs were Palestinian as well as Jewish. They prepared meals and then described each dish’s history for their peers. The crux of the story was that they were fostering peace through culinary and historical understanding of each other’s foods. The message was 100% one of peaceful coexistence. I was captivated and completely ate up the story, if not the dishes.

What TV station do you suppose carried this story? Al Jazeera. That’s right, Al Jazeera. The English version of Al Jazeera is broadcast around the world from right here in Kuala Lumpur. I was shocked. This can’t be the station that my countrymen have warned me about. They were carrying a message not of extremism and violence, but of peace and coexistence. (I wish I could say the same for my own country’s news outlets.) Wow.

So, that got me thinking back to here, Kuala Lumpur. Each year for the big football game, we throw a party where we serve food from each team’s city. I always try to select meals that speak to the city. Things they’re known for. Pittsburgh-style sandwiches with french fries AND cole slaw right on the sandwich, just like they serve in da ‘Burgh, for example.

What would I serve for KL? (Of course, the fact that they don’t have a team is not even relevant.)

Last night, my host took me to dinner and asked me what I wanted to eat. I said that I’d like to try something that is uniquely Malaysian and -- even better -- uniquely Kuala Lumpur(ian). A challenge...

We went to a Malaysian restaurant and had a couple local dishes. Main course was a coconut rice dish that was fabulous. The rice is cooked with coconut milk and has a fabulous savory flavor to it. Alongside they had a curry sauce smothered chicken and beef dish. Also fabulous. The spices are fresh and vibrant, which I’d expect in this part of the world. I also had a bean dish that they said few westerners would eat. The beans were crisp and fresh, and about the size of fava beans. They were in a red sauce that was intensely flavorful and clearly spiced to kill small children and tourists. Wow.

The food was fantastic. I tried to find out a bit of the “history” of each dish, but was not successful, other than that each dish is traditional and uniquely Malaysian...or perhaps Indonesian, depending on whom you ask. Great. ;-\

But it’s a great question to ask. I heartily suggest you try it whenever you travel. Find the dish(es) that the region/city is known for. Ask the locals what dish a visitor MUST try before leaving. And be prepared for an adventure.

Understanding, knowledge, peace, coexistence, spice, flavor, mmmmmm....

Cheers,

Ken

I have managed to not succumb to iPhone fever for a year. I still have, but I did recently get an iPod Touch with a new Mac (as part of Apple’s “Back to School”) special program. It’s NOT an iPhone, but the user interface is nearly identical.

After using it for just a few days, I can say this: the iPhone/Touch user interface is downright revolutionary. Awesome in every way. Why? After all, on paper, there are many other products that are as good or better than both. My answer is simple: it’s the software. Pure and simple. Apple “gets it” when it comes to software.

In my year of resisting temptation to buy an iPhone -- and I should point out that my only real reason has been that I’m a T-Mobile USA user, not an AT&T Wireless user, and I simply didn’t want the hassle of change -- I’ve been using a Blackberry 8800. On paper, the specs of this and several other Blackberry devices are substantively similar to the iPhone’s. But that’s positively where any comparison would stop dead in its tracks.

The user interface of the Blackberry is simply neanderthal compared to the iPhone. The ease of using the iPhone is staggering when you compare it with the Blackberry. The browser is based on Safari, and it works. It’s not perfect, but it really does do a great job. The Blackberry browser, by comparison, is an embarassment. Even when I dropped in the third party (but free) Opera Mini 4.1 browser, the browsing experience on the Blackberry is horrid in comparison.

I’m not sure if Blackberry and other smart phone manufacturers are aware of just how far forward Apple has leaped ahead of them in terms of usability, but if they’re not aware, then they’re fools. It is a quantum leap forward, without a doubt.

And again, it is the software that makes the difference. All you iPhone competitors out there take note. With the 3G iPhone rolling out, I predict they are going to not just rule this market, but they are going to shatter the competition. Between the 3G networking speed, the enterprise friendly features (like Exchange connectivity), and the new price point, the only non-iPhone people are going to be people who have never tried an iPhone.

You’re on notice.

I’ve been doing information security stuff for over 20 years now. My consulting/training company just turned 5 years old. One thing I’ve seen repeatedly is how often we (security folk) make the same mistakes.

In my eSecurityPlanet/Datamation column this month, I address that problem and provide a couple of pointers to help us learn from history a bit. Hope you find it useful.

Cheers,

Ken

Perhaps my very favorite thing about living in Virginia is the May/June honeysuckle season. I've often had the itch to move somewhere else--Savannah, Tuscany, Rhone valley, Kaua'i, you name it--but even if I did, I'd have to be back here for a couple weeks every year to experience this miracle of nature.

The air is warming up. The leaves are fully green. The grass is green. And then out comes the honeysuckle to play. It is an almost cloyingly sweet smell in the air, and once you've experienced it, it stays with you for the rest of your life.

It is a flowering vine that thrives in the US Southeast. The flowers look like this (from Wikipedia):



Today is a prime example of honeysuckle at its peak. I just went for a mountain bike ride on this 18C (that's about 65 degrees in neanderthal units), 43% humidity, and essentially cloudless sky day. The smell of the honeysuckle hit me immediately as I walked my bike past the honeysuckle vine behind my house -- we planted the vine there when we moved here in 1995, so that I could enjoy days just like this. And then throughout my ride, each time I rode near a vine, boom there it was. Utterly fabulous.

Even my beloved Kaua`i, for all its tropical splendor and glory, doesn't have anything that can touch Virginia honeysuckle. The sad part is that it's only in full bloom for a couple weeks. When the heat cranks up here by mid-June, the flowers die quickly. I still get whiffs of it from time to time when I take my bike out just after sunrise, which is about the only bearably not-hot part of the day by July, but it's nothing as strong as it is now.

The vine itself is pretty, but most people wouldn't even give it a second look. It's all about the smell in the air.

Viva la honeysuckle!

Cheers,

Ken

This week wasn't any ordinary Bistro Friday. Nope, I spent my BF in beautiful, tropical, stinkin hot, Singapore.

I've been here since Sunday doing work for a customer. Earlier in the week, we went out to dinner for some excellent local cuisine, served at an absolutely amazing multi-cultural buffet at the nearby Grand Hyatt hotel. Everything was completely top notch, as I'd expect from a Grand Hyatt.

During the dinner, we were talking about the different foods of the world, and I--perhaps somewhat foolishly--said how culinarily adventurous I am. I like to try just about anything. Well, I do draw the line now and then, but for the most part, if it doesn't involve things that I just can't ethically accept, then I'll try things.

She asked me if I'd ever tried Durian. I hadn't, but I had heard of it on an episode of Anthony Bourdain's "No Reservations". (I really like that show. Among other reasons, it's the only travel/food show I know of with a parental warning at the beginning. Apart from that, I largely agree with the culinary adventures Bourdain goes on, and seek them out whenever I'm in the regions he covers -- case in point, durian.)

Then she said, "we'll go get some durian on Friday after work, then." Had I gone too far? Had I spoken more than I'm willing to do? After all, some of the write-ups I've read about durian are pretty extreme (and funny). Plus, durian is literally illegal in public places here in Singapore. There are signs outside the subway stations saying "No Durians" with a little silhouette of the poor fruit. Oh no... This is no bluff, I thought.

But Bistro Friday came, and I hopped into the taxi to go to one of the local fruit mongers where durian is sold. The fruit monger is on a side street in the red light district where I'm quite sure not many tourists go. But, as soon as we got out of the taxi, I knew we were in the right place.

It's an open air--mercifully--fruit market with stacks and stacks and stacks of the beloved durian fruit, which is only in season during April and May. Each fruit is roughly the size of a cantaloupe.

They are spiny on the outside, which is actually where the name comes from. (From the Malaysian word for thorn, which is quite similar to the Afrikaans word for thorn, I might add.)




Other than the spiny outside, they look harmless enough, but don't let looks deceive. The smell is really powerful.

The fruit monger selected a ripe durian for us and kindly opened it for us to eat. The smell only gets more intense when the fruit is opened up, by the way.

I somewhat reluctantly went ahead and took my first bite--WOW! I immediately forgot that I was eating something that smelled like rotten, stewing, sewage and recognized why they call this the king of fruits. I'm a durian believer, instantly.

The flavor is kind of like vanilla pudding, flavored with almonds. It is soft, succulent, and unlike any flavor you'd expect to find in a fruit pod. Simply amazing.

So, when you find your way to Singapore, you absolutely MUST seek out this much-maligned fruit. It is so very worth the effort!

Cheers from Singapore,

Ken

I'm sitting here in San Diego's Lindbergh Field airport, waiting for my red-eye flight home. (Then I have a short weekend at home before heading back on the road to Singapore...)

I had a magnificent meal tonight at one of my favorite San Diego restaurants, Parallel 33. Absolutely highly recommended! If you're in the area and are looking for a cuisine that will excite you to the core, you've got to go here!

But that's not why I'm writing this journal entry tonight.

I'm writing this because of my experience here in the United "red carpet" lounge. After my P33 meal, I rolled down the hill to Lindbergh Field, dropped off my car, changed into more casual clothes, and came here to the lounge to relax for a bit before braving the all-night flight home. Big deal.

Well, that's what I *thought*, anyway. Big deal. When I presented my card to the receptionist, she asked me, "do you drink beer". My first thought, after "will you marry me," was "um...occasionally...w-h-y?" She explained that she needed to decide which beers to stock here in the lounge and was looking for some customer opinions. Now my antennae went on full alert. "Of course, I'd be *happy* to 'take one for the team' and act as your guinea pig."

Alas, that's not what she was looking for. But, it wasn't all bad either. She had a list of about 500 beers to choose from and was hoping to narrow it down to 3 or 4. She asked me things like, "what's the difference between an ale and a pilsner?" AND SHE WAS GENUINELY INTERESTED IN THE ANSWERS!

Now, I was convinced that something I'd eaten at P33 was somehow hallucinogenic, but I braved on. I suggested a line-up of a couple heavier beers (Pete's Wicked Ale and Newcastle Brown) and a couple lighter beers (Heineken and Sapporo). I explained it would be a good line-up of several nationalities and styles. She seemed happy with the choices, filled out the order form, and said "done".

My only remaining dilemma is that it'll be another 4 months before I'm back in town. I'll have to stock up on RCC drink vouchers between now and then so I can enjoy a couple when I'm back -- to wash down another magnificent meal at P33, of course!

Seriously, P33 is one of the very few restaurants I've experienced where I'm NEVER bored and ALWAYS enjoy their offerings. The menu is never the same twice. I savor meandering through the menu -- READING it, that is. If only I could down 10 (or so) appetizers and 10 main courses...

Tonight I started with an ahi (tuna) poke, washed back with a Ken Forrester chenin blanc from Cape Town. That, followed by a seared scallop main course with lentils, caramelized pearl onions, squash, and chanterelle mushrooms, washed back with a glass of temperanillo from Spain's Ribero del Duero region. All that, followed by a Turkish coffee. Absolutely magnificent!

Cheers,

Ken

I'm here on the gorgeous island of Kaua'i. It's the oldest of the Hawai'ian islands and is about as close to perfect as any place on earth I've ever experienced. Check out my photo gallery if you're interested, but to further illustrate, here are a couple of my highlights from yesterday:

1. Played 18 holes of golf yesterday at Po'ipu Bay. A fabulous course that's about a mile from where we stay. It hosted the PGA Grand Slam event for about 8 years or so. Perfect sunny day.
2. Went to my favorite sunset spot, at Po'ipu Beach. Saw a monk seal sleeping on the beach. We stood about 10 feet from him/her and watched this "aquatic basset hound" snooze away.
3. While watching the sunset, a small wedding party walked onto the beach and got married right in front of us, just as the sun was setting. When the ceremony ended, the entire beach crowd applauded wildly.
4. Came back to the condo for some wonderful barbecued chicken, washed back by a Chilean cabernet sauvignon.

So, perhaps these aren't things that interest you much, but they all add up to R&R perfection in my book. And all the more reason why I so thoroughly soak up my two weeks here in paradise every couple years. Not nearly long or frequent enough, but any time here is time well spent.

Aloha,

Ken

Anyone who ever reads this journal knows I spend quite a lot of time traveling. I know many many airlines, airports, and airport lounges far too well.

So, I'm always looking for ways to optimize my travel experiences. Some of the things that I value when I travel are comfort, customer service, and low stress situations. Expediency is good as well, but I'd much rather spend a few extra minutes if it means traveling in relaxed comfort. Running through airports, scrambling to make connecting flights, and such are NOT on my short list of fun things to do. They're not even on my VERY LONG list of fun things to do.

So, along came CLEAR, also known as the TSA's "registered traveler program". Now, although I don't mind spending a few extra minutes in the name of comfort, standing in long airport security queues is definitely NOT what I meant. So, when I first heard that CLEAR was coming to my home airports (Dulles and Reagan National), I was all over it. I gladly forked over the US$28 registration fee and the US$100 annual fee to give this new program a fair shake.

I've now used CLEAR three times, as I sit here in San Francisco airport bound for Osaka, Japan. Although 3 falls far short of a sufficient sample population, my 3 experiences have been in 3 different airports. So, I figured I'd drop a few short notes here about my preliminary experiences. I'll post something more substantive once I've been using the program for 6 months or so, so the program itself has a fair amount of time to go through its own startup pains and such. (Note, too, that I'll also describe the exhaustive registration process later.)

1. My first CLEAR experience was in Reagan National, flying up to New York City for a couple days' business. The main security line was quite short that day, but I thought I'd give it a shot in any case. I was greeted by a CLEAR agent who verified my ID, CLEAR card, and boarding pass. She walked me to the CLEAR terminal where I inserted my CLEAR card and provided a fingerprint scan to validate my identity. Once passed, I was greeted by another CLEAR agent who again validated my ID, CLEAR card, and boarding pass. She walked me through the x-ray and metal detector security screening process, "helping" me remove my laptop and such. Overall score: slower than regular security line and far less convenient.
2. This time, I was flying here to San Francisco from Dulles. The mid-afternoon security line at Dulles was already relatively long, but they do have a "premium passengers" line that is usually a bit shorter than the one the unwashed masses take. I went to the premium line, but did not see any mention of CLEAR, so I asked the clerk. He directed me to the CLEAR line downstairs. Odd...but what the heck, I went downstairs and there was the line--only, it was shared with flight crew, airport employees, and CLEAR travelers. (It was the "service entrance" by any other name.) The flight crews seemed to visibly take a dim view of us in the CLEAR line, who got to jump to the front of the queue. But I got through it. The ID checking was similar to the one at Reagan, but I only had to present my ID once.
3. Third time's the charm, right? Here in the San Francisco international terminal, I tried it again. Here, the security queue was quite significant already. There is a CLEAR lane to the side of the regular lanes. I was the only person in the CLEAR "line". Same ID checking; same fingerprint scanning. Then the CLEAR agent took me to a separate table where I removed my laptop, jacket, and shoes. She then put my bags and bins in the x-ray queue ahead of the rest of the passengers and directed me to a metal detector ahead of the rest of the passengers. I clearly (no pun intended...) got through the airport security in record time, and it was a far less hectic process than the one we're all used to.

Even us "elite" CLEAR folks still have to go through metal detectors and run our stuff through x-ray scanners. That's just fine in my book. But, if SFO's process is any indicator, the process is getting pretty smooth. I hope that Dulles and National follow suit in the convenience factor I experienced here.

Now, I have to say that I had an uneasy feeling "jumping" the queue in front of the flight crews yesterday and all the other passengers today. But, I suppose I do that all the time when I use the United 1K check-ins and such.

So, while I will stop short of calling the program an unmitigated success, I see some promise in it, at least from my perspective. Things that simplify my life, reduce my stress levels, and/or save me time are a good thing. CLEAR seems like it might achieve all three, but I'll withhold final judgment until the system has had time to get into a steady state of operations.

Cheers,

Ken

Most anyone who knows me also knows I spend a lot of time traveling. Ever since starting my consulting practice, I've stuck with the strategy that keeping my travel business on one set of vendors is the best approach. This doesn't always work, but most of the time it does.

In particular, as a result of my "customer loyalty," I'm a United Airlines "1K," a Marriott Gold, a Hyatt Gold, and a Hertz 5-Star Gold customer.

I really believe that this is the best approach--though not necessarily these vendors--for anyone who spends a fair amount of time on the road. Here's why.

Coming home from a business trip to Belgium on Sunday, I had booked an economy class seat on United. In fact, I was boarded and settled into my "economy plus" seat, all ready to go. (I save my gratis upgrades for really long and/or overnight flights, whenever I can.) As passengers were entering the cabin, one of the gate agents approached me and gave me a new boarding pass, in business class, and said, "thanks for all your business!". Naturally, I gratefully accepted and changed seats.

This upgrade was unsolicited and unexpected. No doubt, United did it for space management, but the point is they didn't have to do it. I truly had the feeling that they do appreciate my business. That's what it takes. (I should add that the exact same thing happened on my return from Amsterdam nearly a year ago, after my cycling tour of Holland with my dad.)

Similarly, with the other vendors I frequent, I often get unsolicited upgrades and such. Marriott also guarantees me a room. If none is available, they put me up elsewhere at their expense.

It's the little things like this that keep me coming back, and they know it.

On the other hand, I know that these vendors all have their blemishes. Sometimes I get furious at them for one reason or another. But even when things go wrong, they tend to fix them in my favor. Coming home from Mexico last July, a weather delay forced me to miss my connecting flight--the last of the day--out of Chicago. United put me in the airport Hilton, which is walking distance away, at their expense and apologized for my inconvenience.

If you must spend as much time on the road as I do, I'm convinced this is the best way to do it.

Cheers,

Ken

If you read my writings here from time to time, you've probably heard me talk about my recent experiments with email security, as well as my laments about users who would choose to select the proverbial dancing pigs instead of security.

Well, that was not the case here in Belgium this week at the OWASP regional chapter meeting. As I said here, I've been over here in Leuven, Belgium this week for SecAppDev. Well, at Tuesday's regional OWASP chapter meeting, I volunteered to assure any attendees' CAcert.org or Thawte.com x.509 security certificates, fully expecting a "turn-out" of just one or two folks. Instead, I ended up with a line of people during the session break. I ended up with some 12 identities to verify on the CAcert.org site.

I was utterly amazed and, frankly, encouraged by the experience. Admittedly, these folks were already security-minded technologists, or they wouldn't be attending a meeting of the Open Web Application Security Project, but even still, it's nice to see that there really are people who want to improve the state of email security.

Very nice, thanks guys!

Cheers,

Ken

Laughter really is the best medicine. Throughout my life, I've always done my best to find ways to laugh at things, situations, and life in general, even when others don't. Perhaps it stems from growing up watching Wile E. Coyote, Foghorn Leghorn, and that bunch every Saturday morning, darn near without exception.

Two recent situations really brought this to the forefront for me. I was on a business trip in Boston a few days ago. When I got to the Hertz facility, my car wasn't ready and they couldn't find my reservation. Fortunately, I had a couple cars to choose from, however. The clerk asked me which I'd prefer of [4 or 5 generic cars whose names I don't recall]. I replied, "whichever one has the highest top speed." Turns out that was NOT the answer she was looking for, and she was pretty thoroughly humorless about the situation.

The other situation was actually earlier in the day. I was applying for the TSA's new CLEAR traveler program. I'd already finished the on-line registration, and then I had to appear at one of the registration facilities in person. I did this at my local airport, Reagan National. They scanned my fingerprints, both irises, facial pattern, etc. I came this (see my hand) close to saying something like, "what, no rectal scan?!". Well, perhaps it was a good thing I hesitated...

What does this have to do with...well, anything? Pretty much nothing. It's just an attitude thing. I feel humor is an essential element of life, like air, food, and absinthe. Perhaps that's something we should all try to do a bit more of--the humor, not necessarily the absinthe.

Cheers,

Ken

During the SecAppDev class next month in Leuven, Belgium, there's also going to be a regional OWASP meeting on 4 March 2008.  I've been asked to join in and present a short session comparing various secure development methodologies (Microsoft's SDL, Cigital's "Touchpoints", and OWASP's own CLASP, mainly).  If you're in the area, I hope you'll join us.  Local details are available on OWASP's Belgium chapter site.

And, if any of you are in the Leuven area and care to chat, let me know. I'd be happy to meet you for a beer at one of the local pubs. My favorite is Domus, but I'll even "slum" it and go to one of the myriad of pubs serving Stella or some such for a worthy cause.

While I'm there, I'll also be doing a CAcert / Thawte x.509 "signing".  So, if you're using either of these free x.509 certificate services, and are still trying to get the 50 assurance points necessary to have your real name on your certificates, stop by with two forms of government-issued ID (and photocopies, if using Thawte -- not necessary for CAcert).  I'll be happy to help out with either/both 10 Thawte points or 35 CAcert points.  No charge, of course.

Cheers,

Ken

There's an old saying in the information security community: give the users the choice between security and dancing pigs, and they'll go with dancing pigs every single time. Perhaps it's a bit of an exaggeration, but it does make a good point.

Now, translate that to the "phishing age," and you have some insight into why phishing is so darned effective, at least from the attackers' perspectives. They are raking in the cash, and with little chance of being brought to justice. Great.

Then, a few days ago on a business trip to Prague, a friend of mine showed me the graphic image below that made me laugh hysterically. It really illustrates why phishing is so effective.



How many people do you know who might actually enter the data? What if this info came up in (say) a google search result list? What if it was delivered via email into your inbox, seemingly from your bank? How many people would fall for it? (Note: it's not a real attack. It's just an image to illustrate a point.)

Just goes to show you, old PT Barnum couldn't possibly have imagined how optimistic he was, when you factor in Internet and the unwashed masses. There's way more than just one sucker born every minute!

Cheers,

Ken

I'm a huge fan of GPS. I've used one in my car for 8 years now; I have one on my mountain bike (principally to track my workouts, not to navigate). They're awesome. What a magnificent product for consumers, and it came from the U.S. military. However, while today's consumer products can help many drivers, I've seen them make some drivers worse. WAY worse. Here's how...

I often use a sedan service to get to/from airports when I'm traveling. I've noticed in the last year that my service provider has outfitted all of their cars with dashboard GPS devices, like the ones from Garmin, Tom Tom, and Magellan. Great stuff, and they're finally at a price/usability point for many average consumers.

The problem comes in when the driver follows the directions given by the GPS too closely, and fails to exercise common sense -- like reading the traffic signs. There's one BIG intersection, in particular, near my house that drives me insane when I get one of "these" drivers. It's the highway intersection of I-95, I-395, and the DC Beltway, I-495. This intersection, also known as the "Springfield Mixing Bowl," has recently gone through an EIGHT-year redesign.

You guessed it, most GPS devices still know the OLD "mixing bowl," not the new one.

TWICE now, my driver has followed the GPS directions precisely only to take us on a significant and unplanned tour. Today's drive to Dulles airport included a drive in DOWNTOWN DC, past the Lincoln memorial. This detour added close to 30 minutes to my drive. If I hadn't planned for a long airport wait time, I could well have gotten into serious timing problems.

But more to the point, in each case, the highway signs clearly (to me) indicated where the driver should have gone, but the driver listened instead to the GPS. THIS is the problem.

GPS is great, but they work best for drivers who already have a fair "feel" for the vicinity and know more-or-less where they're going. When you blindly follow the GPS directions, you're bound to go places you hadn't intended, and perhaps didn't want.

So yes, it still helps to be a good human navigator if you want to use a computer to help. The GPS software is improving rapidly, so perhaps some of this will improve with time, but for now, pay attention to the street signs FIRST and THEN to the GPS.

Cheers,

Ken

A couple months ago, I wrote here about email security and how I'd become a "notary" for the free email certificate service provided by Thawte. Well, that's unchanged, but thanks to a colleague who alerted me to another free certificate service provided by CAcert (also see their Wikipedia page here), I was able to become recognized as a CAcert identity assurer using my Thawte credentials.

More of the same, you say? Well, only to some extent. CAcert differs from Thawte in many ways. For one thing, they're a completely free and open certificate provider, which I have to salute. Using their service, I can also generate server keys, which is handy. (That's right, completely free SSL certificates for my web sites!) Additionally, they will sign existing PGP/GPG keys for their users, which is a nice addition to my GPG key signatures.

Is there a downside? Well, not much, but if one is to be found, it's that CAcert's root certificates aren't yet in everyone's browser and email certificate repositories, as shipped by their operating system or browser vendors. That's changing, but for now, CAcert users will from time to time find people who cannot verify their identities. That's disappointing, but as I said, it's changing.

Why bother? Well, if email security is important to you, the answer should be self-evident. If it's not, consider the SSL certificate argument. When you connect to (say) your bank, your browser uses SSL to encrypt your session with the bank, in all likelihood. Your browser is also validating their authenticity by looking at the bank's X.509 server certificate and ensuring that you are indeed talking to your bank, and not some rogue site run by some phishing miscreants aimed at stealing your money. With an email certificate, you can provide that same time of identity assurance to people you send emails to. It also enables sharing of encrypted emails if both parties have a certificate, but just the identity validation alone is worth the price of admission, in my opinion.

Oh, and that "price of admission," in the cases of Thawte or CAcert, is US$0. They are free services.

The question you should be asking is why NOT bother? Seriously. Some people find signed email and "dealing with certificates" to be difficult, confusing, not worth it, etc. You may be one of those people. It's my opinion that those attitudes are not well founded with the reality of how bad the state of email security is these days. Imagine if all your friends and colleagues used validated email identities, and you were able to tell your emailer to delete all non-signed emails. Voilá, no more spam. That's something that we security folk refer to as "white listing".

Enough blather for now. I urge anyone and everyone who reads this to go out and get a free certificate from Thawte and/or CAcert. Then spend the time to get your identity validated by a couple Thawte "notaries" and/or CAcert assurers. It's well worth the effort.

Cheers,

Ken

For my birthday, I got a really neat book about the wine cork industry from my brother-in-law. Great stuff. And wow, were the points made in the book brought home for me last night?!

We went out to dinner at a local Italian restaurant. Nothing fancy, but pleasant. In fact, we were largely there to root for a band that featured a co-worker/friend of one of our friends. I was in charge of making the wine selection. I found two interesting wines on the list, by one of my favorite Tuscan producers, Cennatoio. (We visited the winery when we were in Tuscany in September, 2003.) I ordered a simple sangiovese, their "All'omo il Vino," a nice 100% sangiovese IGT.

Out came the wine... The waiter poured me a small amount to taste and...you guessed it, it was corked. I explained this to the waiter and he seemed dumfounded, so he called over the manager. To my shock and horror, the manager insisted on tasting it also. He (seemingly reluctantly) agreed that it was "off," but said it was their last All'omo, so I'd have to select a different one. (I was preparing for him to say it was fine, but that would have resulted in a situation neither of us would have enjoyed.) He pointed me to what he called a comparable "sangiovese" on the wine list, but it wasn't a sangiovese at all. So I pored through the list myself and decided on the All'omo's big brother, Cennatoio's Chianti Classico Riserva from 2001. A bit more expensive, but I didn't mind if we got a good wine.

Same process, same taste test, same results... I said to the manager, "you're going to hate me for this, but this wine is equally corked". By now, I could tell the manager was not a happy guy, and he again insisted on tasting it for himself. Again, he reluctantly agreed.

Two corked wines in a row. Two wines from a superb winery that were undrinkable because of an industry that has a roughly 4-5% failure rate. I've had both wines numerous times, and I know I love both. But in their wet cardboard TCA-tainted state, they were horrid.

I don't blame the restaurant for anything except the manager's bizarre performance of second-guessing his customer. And I obviously don't blame Cennatoio.

Corks are evil. The sooner we all realize that, the better off we'll all be. TCA, the chemical responsible for most "tainted" wines, is a blight on this otherwise wonderful industry that cannot and must not be tolerated. Corks are almost always to blame. We MUST demand better.

Some wineries and even countries have been leading the charge to move from cork to other stoppers. Try finding a New Zealand wine that's not sealed with a "Stelvin enclosure" (that's fancy wine-speak for "screw cap"). Although those not in the know may scoff at screw caps, you're FAR less likely to have a TCA-tainted wine from one. (It can still happen, if the TCA is introduced during the wine making or aging process, but the likelihood starts to approach zero now.)

So, next time you look at a wine that's sealed with a screw cap or a synthetic cork, please join me in saluting the winery's courage and support them in their efforts to rid the planet of corks. Corks are evil.

Cheers,

Ken