It's no secret that I like food. I fear sitting down and figuring out how much money I spend in a year on eating out! A big part of eating out is that I never really learned or took the time to really try to bake or cook. Sure, I'd sometimes make cookies from a tube around Christmas or help someone else mix stuff but I never would try it myself. Things like 'a dash of' or 'a pinch of' always frustrated me when reading recipes. I'm an engineer! I want to understand what that means!

Susannah Wesley, a really good friend of mine who not that long ago reconnected with me, recently decided it was time for me to start baking/cooking and started to send me recipes. My thought was that I'd try them out someday but didn't really know when that day would come. The thing is she gets what she wants and she wanted me to bake/cook ... in about a week I was in the kitchen happily making food!

The first thing we made was a fudge coffee pie. Susannah spent the entire time with me coaching me on how to make it. It's a good thing too because, being the first thing I ever really baked, I'm positive it would not have come together! The only issue that I encountered was a brief period of thinking my stove was trying to kill me. It's a gas stove and my emergency alarm went off for a few seconds warning of a gas leak. I really didn't want my obituary to say I was bested by an appliance!







But that isn't where we stopped! Next up was a quiche! Susannah told me what I should go buy and I went out to pick up some more ingredients. It didn't take long and I was back in the kitchen making something I'd be eating happily for days! I at first assumed that the result was not healthy at all, but she explained to me that we used ingredients that actually make it less bad for you.







After a few days it was time to start baking again. This time it was using mine and her favorite fruit: Strawberries. She told me how to make the pie in a similar fashion that she grew up having in Florida. Notice the strawberries pointing up! This one didn't take as long as the previous two but was just as tasty. I almost was able to sneak away with taking a piece but I got caught...







Today Susannah told me I should make some food for dinner and I brought up stir fry. I ran up to Whole Foods and picked up a bunch of veggies and cooking ingredients to give it a go. I wasn't totally sure what I needed but I gave it my best shot. While not the best thing I've made it still was good (and a lot of veggies).



Next up I think I'll be trying to make Susannah's father's famous chilli (though it might be to advanced for me at this point). So far I've had a blast learning, baking, cooking and talking with Susannah! I also enjoy the whole eating part.

I also need to update my blog more often.

#!/usr/bin/env python
"""
Terrible but works way to find out info about mobile clients.
"""
import re
import sys
import urllib
import yaml

from lxml import etree


rx = re.compile('\{.*\}')
no_tabs = re.compile("[\t\n]*")
no_li = re.compile('li ')

xml = etree.XML(urllib.urlopen(sys.argv[1]).read())

results = {}
prev_key = None

for ele in xml.iter():
    if type(ele.tag) is type(""):
        tag = rx.sub('', ele.tag)
        text = no_tabs.sub('', str(ele.text))
        if tag == "Bag":
            continue
        if tag == "li":
            try:
                results[prev_key].append(text)
            except:
                results[prev_key] = []
                results[prev_key].append(text)
        else:
            prev_key = tag
            results[tag] = text
print yaml.dump(results, default_flow_style=False)

$ python wtf.py http://device.sprintpcs.com/HTC/APA9292KT/latest
AcceptDownloadableSoftware: 'Yes'
AdvertisingCapable: N/A
AntiSpam: 'No'
AntiSpamVendor: N/A
AntiVirus: 'No'
AntiVirusVendor: N/A
AudioCodecsForDecoding:
- mp3
- aac
- aac+
- eaac+
- amr-nb
- amr-wb
- qcelp
- wma
- evrc
- midi
AudioCodecsForEncoding:
- AMR-NB
- QCELP
AudioInputEncoder:
- gzip
- deflate
AudioJack: 3.5mm
BitsPerPixel: '16'
BrowserName: Android Browser
BrowserPortalVersion: ''
BrowserVersion: Eclair 2.0
CPU: ARM11
CamcorderResolution: 1280x720
CamcorderZoomCapable: 'Yes'
CameraBuiltInFlash: 2x power LED
CameraHighestImageResolution: 3624x2488
CameraMegaPixels: 8M
CameraZoomCapable: 'Yes'
CcppAccept:
- application/vnd.oma.drm.rights+xml
- application/ogg
- application/smil
- application/vnd.oma.drm.message
- application/vnd.wap.mms-message
- application/vnd.wap.multipart.alternative
- application/vnd.wap.multipart.mixed
- application/vnd.wap.multipart.related
- application/vnd.wap.sic
- application/vnd.wap.xhtml+xml
- application/vnd.oma.dd+xml
- application/java-archive
- audio/aac
- audio/amr
- audio/imelody
- audio/mid
- audio/midi
- audio/mp3
- audio/mpeg3
- audio/mpeg
- audio/mpg
- audio/x-mpeg3
- audio/x-mpeg
- audio/x-mpg
- audio/x-mid
- audio/x-midi
- audio/x-mp3
- image/gif
- image/jpeg
- image/jpg
- image/png
- image/vnd.wap.wbmp
- video/mpeg4
- video/mp4
- text/plain
- text/html
CcppAccept-Charset:
- ISO-10646-UCS-2
- ISO-8859-1
- US-ASCII
- UTF-8
CcppAccept-Language: ''
ColorCapable: 'Yes'
CommerceCapable: N/A
ConnectionManagerVendor: N/A
ConnectionManagerVersion: N/A
DataNetworkTypes:
- IS2000
- EVDO
- WiMax
- WiFi
Description: ''
DeviceIdentifierType:
- MEID
DeviceType: Android Touch
DiagnosticsClientVendor: CIQ
DiagnosticsClientVersion: 3.2.18
DiagnosticsProtocolVersion: 3.2.18
DownStreamBufferSize: None
DownloadableBrowserApps:
- 'No'
DownloadableSoftwareSupport:
- application/java-archive
EmailCapable: 'Yes'
EmbeddedApplicationsCapable: 'Yes'
ExternalMemoryMaxSize: 32GB SDHC
ExternalMemorySlot: 'Yes'
FirmwareVersionWiMAXRadioModule: 4.6.2.1 build22766
FixedVoIPCapable: 'No'
FotaClientVendor: SmithMicro
FotaClientVersion: ''
FotaProtocolVersion: 1.5.1
FramesCapable: 'Yes'
GLMSClientVendor: ''
GLMSClientVersion: ''
GLMSProtocolVersion: ''
GPSChipsetModel: '8650'
GPSChipsetVendor: Qualcomm
GamingCapable: 'Yes'
HardwareVersion: '1.0'
IMVideoCallingCapable: 'No'
IOTAProtocolVersion: N/A
ImageCapable: 'Yes'
InputCharSet:
- US-ASCII
- UTF-8
- ISO-8859-1
- ISO-10646-UCS-2
IntelligentSearchCapable: 'Yes'
JVMVersion:
- N/A
JavaAppletEnabled: 'Yes'
JavaEnabled: 'No'
JavaPlatform:
- N/A
JavaScriptEnabled: 'Yes'
Keyboard: TouchKeypad
LBSCapable: 'Yes'
MI-UICapable: ''
MI-UIVersion: ''
ManufacturerWiMAXRadioModule: SEQUANS
MobileOriginatedSmsSupport: 'Yes'
MobileTVORVODCapable: 'Yes'
Model: '9292'
ModelWiMAXRadioModule: SQN1210
MultimediaEncoder: Qualcomm Qcamcorder
MultimediaEncoderDisplaySize:
- '800x480 '
- '640x480 '
- '320x240 '
- '176x144 '
- 128x96
MultimediaEncodingSupport: ''
MultimediaFileFormatForDecoder:
- MPEG4
- 3GP
- 3G2
- AAC
- AMR
- MID
- MP3
- WMA
- WMV
MultimediaFileFormatForEncoder:
- MPEG4
- 3GP
- 3G2
MultimediaMaximumBitRateForEncoding: 5000 kbps
MultimediaMaximumBitRateForPlayback: 5000 kps
MultimediaMaximumBitRateForStreaming: 1200 kbps
MultimediaMaximumFrameRateForEncoding: 24 fps
MultimediaMaximumFrameRateForPlayback: 30 fps
MultimediaMaximumFrameRateForStreaming: '30 fps                '
MultimediaPlaybackSupport: ''
MultimediaPlayer: 'Yes'
MultimediaStreamingSupport: ''
MultimediaVideoDisplaySize:
- '800x480 '
NavigationSupport:
- Touch Screen
NumberOfSoftKeys: '0'
OMADMCapable: 'Yes'
OMADMVendor: SmithMicro
OMADMVersion: '2.0'
OSName: Android
OSVendor: QUALCOMM
OSVersion: QSD8650/Eclair
OnDemandCapable: ''
OnDemandVersion: ''
OutputCharSet:
- US-ASCII
- UTF-8
- ISO-8859-1
- ISO-10646-UCS-2
PictureMailSupport: 'Yes'
PixelAspectRatio: 1x1
PreferenceForFrames: 'Yes'
PssVersion: 3GPP-R6
Push-Accept:
- text/plain
Push-Accept-AppID:
- None
- None
Push-Accept-Encoding:
- base64
Push-MsgSize: '4096'
RDF: ''
RadioCapable: 'yes'
ScreenSize: 480x800
ScreenSizeChar: 25x21
SecuritySupport:
- SSL-3.0
- TLS-1.0
Seq:
- en-us
- es-us
SoftwareNumber: 3.26.651.6
SoundOutputCapable: 'Yes'
SprintMcdVersion: 3.5.4
StandardFontProportional: 'Yes'
SupportedApplications:
- Album
- Browser
- Calculator
- Calendar
- Camcorder
- Camera
- Dialer
- FlashLite Plug-in for Browser
- Footprints
- HTC Sync
- Lock Screen
- Mail
- Messages
- Microsoft Exchange ActiveSync
- Music (integrate with Ringto Trimmer)
- OOBE
- PDF Viewer
- People
- Quickoffice
- Settings
- Social Network
- Stocks
- Windows Media Streaming Player
- Teeter
- Voice Recorder
- Weather
- World Clock
- Amazon MP3
- Sprint Navigation
- Remote Diagnostic
- Sprint TV
- NFL
- NASCAR
- Voice Dialer
- Visual Voicemail
SupportedBearers:
- IS2000/rel0
TablesCapable: 'Yes'
TextInputCapable: 'Yes'
TotalDeviceFlash: 1GB ROM
TotalDeviceMemory: 512MB RAM
UpStreamBufferSize: None
VOIPAnalogJacks: ZERO
Vendor: HTC
VideoCodecsForDecoding:
- MPEG4 simple profile
- H.263 Profile 0
- H.264 Baseline
- Motion-JPEG
VideoCodecsForEncoding:
- MPEG4
- H263
VideoMailSupport: 'Yes'
VoiceChatCapable: 'Yes'
VoiceInputCapable: 'Yes'
WapDeviceClass: C
WapVersion: '2.0'
WmlDeckSize: ''
WmlVersion:
- None
XhtmlModules:
- Mobule-based XHTML W3C Recommendation
XhtmlVersion: XHTML-Basic/1.0
component: ''
type: None

Ice cream in the future is terrifying!!

This image was sent to me some time ago by a friend. I gimped out some parts to keep this Mitch fella from having a problem. This was found right next to a phone that was open for usage. My biggest question (other than WHY?!?) is could he really not remember usernames and passwords which are variations on his name?!

Before I start let me give you this warning: I'm tired, cranky and need a nap. I also badly need a shower. Now enjoy my mad rambling ...

Many companies have implemented or are implementing the ITIL Framework within their organization. That usually is a good thing. If done right it brings a common, repeatable process that can be done and tracked for accuracy. Of course, this also can be done wrong which creates gates and bottlenecks, process for process sake, overhead, confusion and special cases in the name of pragmatism .. but I'm not going to talk about that here. I do want to talk about a common idea that seems to tie back with ITIL in many cases and that is IT is the vendor, the business is the customer.

When one thinks of the business/customer relationship usually one simple aspect of it comes to mind. That one aspect is that the customer gets what the customer wants (aka the customer is always right). If the customer is not happy they will go somewhere else. If the customer can get it cheaper elsewhere they will go elsewhere. Generally this is a good thing. It means that there is competition and the lowest price with the highest quality product or service will keep driving other vendors to match or find related services to enhance their products. But how does this actually fit with Information Security within IT and it's greater Business unit(s)?

The short answer is it does not :-) (surprise!). In some ways ITIL attempts to remedy (no pun intended) this with ITIL Security Management which holds true to the CIA triad and requires that InfoSec have documented policies that the company follows (among other things). ITIL Security Management can work, but what about the customer, do they want this?

Here is where things break down in my opinion. When it comes to purchasing a product or service in the real world the burden and effects are on the customer. For instance, if someone buys a chainsaw it will give them a warnings about how they should use it (and how not to use it). The customer can still cut his leg off, but that is the customers fault, the vendor is not responsible nor is hurt by the action (yes, there are exceptions where legal action is taken against a company who didn't provide a disclaimer or warning ...). Using a service example, if someone takes a taxi, opens the door in transit and falls out it's not the taxis fault ... the customer did the action and suffers the burden and effects of the action. It's easy to look at the examples and say they are simple and don't apply ... everyone knows not to fall out of a moving car or take a chainsaw to the leg. It's common sense not to hurt yourself! One could says the same thing about opening up that PDF from an unknown sender too yet business users do this all of the time. This is where the first issue comes into play: The Customer (aka the business) believes they know how to use the tools properly and safely. Of course some can, but a good many of them can not and fall in the camp of being lucky (or pwned and unlucky enough not to know). So how does a traditional vendor tell their customer they are acting risky? If it is a product vendor they will more than likely send a notice or a fix to the customer to let them know there is an issue. They can use the fix or continue using the problematic product at their own risk. If it is a service vendor then sadly the answer is they don't unless it also puts the vendor at risk. If it does put the vendor at risk the action is to usually cut service or, at the very least, cripple the service in such a way that the customer can not cause any harm to the vendor.I don't know about you but I can't see that conversation going well if it's IT as the vendor and the Business as the customer ... unless it's so painfully obvious that someones great grandfather could understand is an issue the customer will get their way. Even if one takes the product route of things, the customer still must use said fix but in the case of a company failure to use the fix can be disastrous to everyone, not just them.

The second issue is that of process. I'm going to use an ITIL implementation as an example but this can be for any process. Let's say that someone from a large printing companies InfoSec group has found an issue. To make things simple, let's say it's a public issue found in Adobe software (there have been tons of them in the last year or so). The company in question gets PDF's from reporters, advertisers, managers, spammers, etc.. This means the the member of InfoSec needs to put in a change request to get the software updated to a safe patched version. Problem is, this will take some time. In fact, it may never get done as the customer may complain they don't have time for petty upgrades ... they have "real" work to do. Putting aside that "real" work probably means 30-40% of their day surfing Facebook and Twitter, this is obviously a problem. The customer does not want to take the small inconvenience to protect themselves and the company. If this is something that IT can do without the need to involve the users then the change will likely be held up in process while it goes through multiple approval layers by people who don't really understand the issue at hand (either way meaning the fix will be delayed increasing the time of vulnerability), which brings us to the third issue.

The third issue is that of the education of those who make the decisions. A good manager understands what his people do on a day to day basis. They also understand the basics of how they do it and what the results mean. They understand more than just 'this is bad' or 'this is good'. In terms of Information Security, simple concepts like data exfiltration or why cross-site scripting is a problem are a must just like understanding basic economics is needed for a manager of a finance department. The problem lies in that as you go up, the understanding of basic concepts goes down. This is not because the people get dumber as you go up (well, hopefully not :-)) but because they have a larger amount of information they should understand. The natural response is to understand all of it in such a shallow manor that you essential understand none of it. By the time you hit those who are actually approving changes basic concepts may seem like abstract tech talk or, even worse, unintelligible alien language (run far away if this is the case ...). Add in that pressure from the customer and politics at this layer and things get tougher. How can any InfoSec engineer work in a situation like that and be productive? By the time the update is approved there is a good chance there is already one or more updates to the same piece of software that need to be applied. Get ready to go through the explanation process again even if it is the exact same issue.

There are more reasons I'm sure. I've been thinking about this for months trying to find a good way that it could actually work and I'm at a total loss. The only way I can see IT InfoSec and Business Units working in unison is if they work together and not in a vendor/customer or master/slave relationship. It seems I'm not the only one with this thought. For instance, Ivar Jacobson has written about breaking out of Business as the Customer mentality.

The next time the business as the customer asks for this:


and you catch them doing this:


... either cry and plan the funeral or smile and bring dead fish to throw in with them.