Disclaimer: everything I write is of course my own opinion, current at the time I write it. I do not have access to some higher truth (and indeed I doubt such beast exists[link]), but I keep an open mind and if you care about me or some of the the topics I care about and you think I'm wrong in anything you see on these pages, tell me about it and we can discuss it. I like consensus, but I change my mind only under consistent argumentation.
This is a temporary station for my comments on various topics until they find their way into a paper or some other form of more formal presentation. I write these from the scraps of paper where I put them when the idea comes, or I simply dump some email exchange I had with someone on the topic. For now I have comments on:
For more of my writing, you may check my Literature area.
Radu: On-line email services are pretty safe. If the company that offers it does its job well, no virus can hide in the software-generated message (which is just an HTML page that stays on my computer for 5 minutes while I read the message, then expires.)
---- Andrew Brook
Andy: ... and if you open an attachment?
Radu: I'm careful with attachments. Attachment-based viruses use human gullibility as their spreading vector. Protection is easy as 1,2,3:
Andy: The first page comes up when you open the message, the one which used to say 'Part 1', which when you click on it brings up the the telltale pseudo-message (some mailers open it automatically)
Radu: Those mailers should not be trusted. I hate Outlook for this precise reason.
Andy: 1. This worm uses a variety of extensions.
Radu: The most primitive form of polymorphism. Some rogue code is taught to "mutate" automatically, following a pattern or (pseudo)randomly. This one mutates a couple of things: the cover (the text it generates to fool the human into opening the attachment), the two wrappers (the system wrapper: "extension" and the payload wrapper: the code that actually does the work) and also it picks files of certain types to mask its passage.
Fortunately, it does not seem to mutate the 'feet' of the worm. Actually the whole code looks like it's put together by a college student. It doesn't have any of the elegance of real hacker work.
Andy: What is interesting and I think not yet commented on elsewhere...
Radu: Yes, it is commented on in any security-related newsgroup, discussion list or FAQ. There are plenty of extensions that the system will recognize as executables, and it seems like each version of Windows creates new ones.
Andy: ...is that they all have two extensions, the original document extension and (I suspect) one added by the worm.
Radu: Correct. To be precise, this worm uses files of types: .doc, .jpg, .mpg, .pdf, .png, .ps, .mov, .zip to mask its passage. The list is exhaustive, I got it from the code :)
Andy: The added ones include: .com, .lnk, and .pif . I wonder if there others.
Radu: Complete list for this worm: .pif, .lnk, .bat, .exe, .com
Andy: So you need to make your rule a *whole* lot more complicated at least.
Radu: Right. I know that there are other extensions which could be used to trick the system into running the code. Maybe I should work a little on my rules and post a complete set on my web site. :)
Andy: 2. Your web mailer is not catching all the malignant code.
Radu: Sure it's not. But at least it allows me to choose what I open and what I don't. AND any harmful code resides on the mail server and not on my computer.
Andy: At least two messages have got by it.
Radu: The old-fashioned ones. My guess is that the one that was caught was using some form of server-side Java 'feet'.
Andy: [ViruScan] is catching some versions of the worm, however, which is good. I don't know if Carleton scans incoming attachments for viruses.
Radu: I'll repeat: no scanner can catch polymorphic viruses, or new versions for which the scanner doesn't have signatures.
Andy: 3. Your web mailer is opening the first attachment. Isn't this risky in itself?
Radu: No. That is an "attachment" because it is html format. It's done so in order to "blind" the user into opening the actual attachment out of inertia.
Andy: On the .bmp file you sent: it shows as 528K in the mailer but only 385K saved to disk.
Radu: Any binary file is "hex-ed", transformed into text-only format before being sent through email. That is usually done by transforming 8-bit bytes into 7-bit ones, thus effectively increasing the size of the file by 1/8 and a little more for the header and footer.
For more on hackers, you can read this bit.
Most people are lazy. They go to software to do things they can't do by other means, or if they want to do it faster or more accurately. But who writes the software? Programmers, who are even lazier (that's why we're programmers, right?) So they write software their way: they are trained to think very much like the computers they work with (because they are continuously facing the limitations of computers), and they understand them too well; also they deal with piles and piles of algorythms and half-baked standards, they work under pressure, in teams where the credit gets distributed very rarely in fair ways, most of the time they don't get with the people they're writing for and the feedback gets lost in hierarchical bottlenecks, and so on. There are many reasons why user interfaces suck. What is obvious, though, is that in the process of understanding and working with the computer, they lose track of the human needs and limitations their software was supposed to address. Or if they don't, they struggle for a while against the bureaucracy that's making a much better living on their backs, until either they crack under pressure or they go out to try to make a living for themselves. And sometimes the giants crush them, sometimes they buy them out, and very rarely do concepts like Anderson's HTML or Kai Krause's novel interfaces make it to the general public, only to be later integrated in "the machine" or forgotten when their champion tires of the fight.
On Thu, 24 January 2002, "Richard F. Dillon" wrote: > "It's my experience that neither users nor customers can articulate what > it is they want, nor can they evaluate it when they see it." What do you > think? Alan Cooper makes a big distinction between interface designer and > interaction designer. What do you think?
From my experience it's true that customers (e.g. management people, IT support personnel, etc.) have no idea what features the actual users need and the users themselves have a hard time articulating what they need or even suggesting ways their needs may be met.
The evaluation side is trickier: nobody can properly evaluate a complex piece of software or a complex interface in the short span theoretically allocated to confirmation studies. Sometimes it takes weeks only to get even an inkling of what a package like a DBMS system allows, and that if you have prior experience with other DBMS packages or if you really *know* the principles of DBMS. Same for editors (programming, text, graphical, sound), process controllers, etc.
On the distinction between interaction and interface, I think he chose his terms badly. I think I ran into the distinction he means while I was working at StudioVISIA, a professional Web editing company where I was supposed to coordinate a couple of excellent artists and a bunch of programmers. Obviously all interfaces do is facilitate interaction. But a good functional-oriented designer does not necessarily have the artistic prowess necessary for arranging functional controls and extra gingles'n'bells in an aesthetic layout. The same way, an artist may not know how to choose the right labels for controls, or select the right control type for the right job, etc. A truly usable interface should be both easy to use AND pleasant to work with, but it's almost impossible to find someone who really thinks both functionally and artistically. Make sure you have a sound card, a Flash plugin, and take a look at http://www.giger.com The interface (top and left) took 3 artists and 5 programmers, and it's still being re-evaluated :)