No, I did not give him a cell phone. Didn't want to lose it. And no, I didn't trail him, like a mommy private eye. I trusted him to figure out that he should take the Lexington Avenue subway down, and the 34th Street crosstown bus home. If he couldn't do that, I trusted him to ask a stranger. And then I even trusted that stranger not to think, "Gee, I was about to catch my train home, but now I think I'll abduct this adorable child instead."

Long story short: My son got home, ecstatic with independence.

Long story longer, and analyzed, to boot: Half the people I've told this episode to now want to turn me in for child abuse. As if keeping kids under lock and key and helmet and cell phone and nanny and surveillance is the right way to rear kids. It's not. It's debilitating -- for us and for them.

It's amazing how our fears blind us. The mother and son appeared on The Today Show, where they both continued to explain why it wasn't an unreasonable thing to do:

And that was Skenazy's point in her column: The era is long past when Times Square was a fetid sump and taking a walk in Central Park after dark was tantamount to committing suicide. Recent federal statistics show New York to be one of the safest cities in the nation -- right up there with Provo, Utah, in fact.

"Times are back to 1963," Skenzay said. "It's safe. It's a great time to be a kid in the city."

The problem is that people read about children who are abducted and murdered and fear takes over, she said. And she doesn't think fear should rule our lives.

Of course, The Today Show interviewer didn't get it:

Dr. Ruth Peters, a parenting expert and TODAY Show contributor, agreed that children should be allowed independent experiences, but felt there are better -- and safer -- ways to have them than the one Skenazy chose.

"I'm not so much concerned that he's going to be abducted, but there's a lot of people who would rough him up," she said. "There's some bullies and things like that. He could have gotten the same experience in a safer manner."

"It's safe to go on the subway," Skenazy replied. "It's safe to be a kid. It's safe to ride your bike on the streets. We're like brainwashed because of all the stories we hear that it isn't safe. But those are the exceptions. That's why they make it to the news. This is like, 'Boy boils egg.' He did something that any 9-year-old could do."

Here's an audio interview with Skenazy.

I am reminded of this great graphic depicting childhood independence diminishing over four generations.

Dear friend Opher Etzion responds to my post Betting on the SOA Horse with a discussion on how SOA, EDA and CEP are technically orthogonal, concluding:

“Event Processing can have different interactions with SOA, and when IBM’s announcements in this area will be available you’ll realize that there are different entry points. Event processing can also work in legacy and non-SOA environment.”

Richard Veryard, who also kindly reads my blog (and Opher’s blog) replies with Technological Perfecta where he opines,

“I think there are some mutual dependencies between these technologies, but they are what I call soft dependencies.”

Opher, Richard, you guys are technically right, but you are blogging orthogonally to the message in Betting on the SOA Horse.

First of all, my post was not a technical discussion, it was a discussion about business, marketing, timing positioning and the software industry in general. Therefore, it is a bit humorously orthogonal to reply to a marketing metaphor about investments, competition, software postioning and horse racing with architectual posts about technology and how they are related or interdependent.

In a nutshell, here is why….

Candidly speaking, despite what many analysts want you to believe, end users rarely build “SOAs” “EDAs” or CEPs”. End users have IT budgets to solve business problems with the most cost effective technology they can find; and they do not care (if they have a clue) what cute three letter acronyms have been created by analysts to describe momentum in the software market. Sorry, it is true really.

For example, I remember when I was in Tokyo where the very capable and conservatively risk adverse Japanese executives told me time and time again, “We don’t care about SOA we simply want to integrate our systems.” They were quick to remind me, “You guys in America must realize we don’t care what the western analysts, supported by software companies, say. They have a conflict-of-interest anyway and they are not end users. What we care about are mature technologies with solid reference clients and proven implementations.”

By the way, this is one reason I admire Japanese business so much. They are not impressed with handwaving hyperbole. They just want to see results. In other words, “Prove it, don’t just say it.” The devil is in the details, as they say. The Japanese are highly skillful at cutting through the smoke-and-mirrors. I think this is one reason the Japanese are among the leaders in so many industry sectors, but that is a blog story for another day.

To this point, if you are in front of customers and you are pushing SOA because your software company has “bet the farm” on positioning themselves as an SOA company, you are making a mistake. Three letter acronyms and technology jargon do not solve business problems. In fact, for the most part, they are a red-herring. The same is true of EDA and CEP. This was the main message in my post Betting on the SOA Horse.

How do I make such a statement?

Because for over 20 years I have worked as a consultant working on the opposite side of the table of hungry software vendors who come into our house (organization) tossing out buzzwords, acronyms, and jargon. My job was solving real business problems, not selling software. We used to wonder when all the scrabble and babble the software companies were tossing at us was going to turn into a business language that solves a real business problems easily, rapidly and economically. That day never came.

Then, I made a conscious decision to take a break from a long career of consulting to get an insiders perspective on, and perhaps even transform, the software industry. This experience, working for a software company, was an eye-opener, and one I am most likely not to repeat. I have never been interested in selling softare. I am interested in real business solutions.

Candidly speaking again, many software companies tend to live in “La La Land”.

They create go-to-market strategies based on jargon, buzzwords and three letter acronyms that have very little to do with understanding their customer’s business problems, risks, and culture. They spin and position and reposition in a land of smoke-and-mirrors happy to sell you a gold disk of “the-answers-to-all-your-problems.” They leave you the gold disk, and your business problem, as they drive away, looking at you in the rear view mirror as they count the revenue from their victorious campaign.

These same companies bet on jargon like SOA, EDA, CEP, BAM and they hedge their bets with different combinations of the above, the theme of my post Betting on the SOA Horse, which was not a technology nor architectural discussion, in any way.

Is it any real wonder why SOA has become, for the most part, complex, vendor-driven jargon barely making a dent in the real-world, whereas social-networking and other grass-roots user-driven technologies, most without trendy three letter acronyms, has left SOA in the dust for the past few years?

Transport command and control systems are commonly designed by engineers with little exposure or knowledge about security using commodity electronics and a little native wit. The apparent ease with which Lodz's tram network was hacked, even by these low standards, is still a bit of an eye opener.

Problems with the signalling system on Lodz's tram network became apparent on Tuesday when a driver attempting to steer his vehicle to the right was involuntarily taken to the left. As a result the rear wagon of the train jumped the rails and collided with another passing tram. Transport staff immediately suspected outside interference.

Here's Steve Bellovin:

The device is described in the original article as a modified TV remote control. Presumably, this means that the points are normally controlled by IR signals; what he did was learn the coding and perhaps the light frequency and amplitude needed. This makes a lot of sense; it lets tram drivers control where their trains go, rather than relying on an automated system or some such. Indeed, the article notes "a city tram driver tried to steer his vehicle to the right, but found himself helpless to stop it swerving to the left instead."

The lesson here is that security by obscurity, combined with physical security of the equipment, wasn't enough. This kid jumped whatever fences there were, and reverse-engineered the IR control protocol. Then he was able to play "trains" with real trains.

I thought about it for a minute, and decided I rather buy a new one rather than sit around and wait on them for two months.  First though, I looked around online for a fix and saw that quite a few people were having the same problem.  Everyone had an opinion on what the problem was and what to do about it, so I decided to do a couple of things: replace the thermal compound on the CPU and GPU and extend the fan shroud over the GPU using cardboard from a cereal box wrapped in aluminum foil and attached to the existing fan shroud.

That fix worked like a champ until today, when the rear fan on the GPU completely died.  I don’t know if it started to fail 2 days ago and finally quit, or if the fan controller is cutting the fan off intermittently.  I have a plan to fix it either way though.  I ordered a replacement Talismoon fan from llama.com and found a spot on the board to solder it to, which will circumvent the variable speed fan controller. 

The replacement fans are supposedly quitter, but they will be moving from a 5V variable speed controller to a 12V power source.  I hope it ends up with about the same noise profile, but at least I’ll have a functioning XBOX when Halo 3 is released in a few weeks.

Security incidents are sometimes a blessing in disguise. It compels you to act. There is a tendency among upper management to blame security team for security incidents.  Knee jerk reactions such as CIO firing the CSO or the CSO firing the security team members should be avoided. The facts around the event should be enumerated and the incident should be dealt with pragmatically  [refer Pragmatic CSO: Step #8 Contain the Problem]. Security incidents are  “breakdowns”.  When there is a nasty security incidents here are some facts:

1. There is a business cost associated with the incident.
2. There is a vulnerability that has been exploited by a threat agent.
3. The vulnerability could be:
• Unknown
• Known but accepted
• Known but Ignored
4. The incident needs to be handled with due care.
5. Either you have a well defined incident handling plan or you are shooting from your hips [remember P-CSO The Incident Playbook] .

Scenario 1: The vulnerability that resulted in the incident was known and was accepted. Remediation: Deal with the incident and then re-visit the rationale of why this was accepted in the first place.  This highlights the importance of documentation such as business risk acceptance form; this will help to cover your rear during security incidents. Make sure to get a business risk acceptance form signed by the business owner.  An example is a business owner signs a business risk acceptance form if there is no budget to mitigate the vulnerability.

Scenario 2: The vulnerability that resulted in the incident was an unknown. Remediation:  Deal with the incident and create a mitigation plan for this newly known vulnerability going forward.

Scenario 3: The vulnerability that resulted in the incident was ignored. Remediation: Deal with the incident and revisit why the vulnerability was chosen to be ignored in the first place.  It may be possible that you end up making a decision of not ignoring this vulnerability.

In all the above scenarios you have to deal with the security incident, this emphasizes the importance of a sound incident handling plan.  Putting an incident handling plan is fairly simple. Document what you need to do and whom to escalate to, then communicate the incident management plan to the relevant actors and stick to plan when incident does happen.

Here is simple example of what needs to be done for an Earthquake incident:

-             Identify a structurally safe place inside the home to take shelter or identify an open safe place near your house where you can rush

-             Decide on a family meeting place, where all family members get together

-             Enough food for a week

-             Two dozen water bottles etc...