October 2003 archive

Job hunting blues

I read an old article in the Chicago Tribune on how job-hunters are just so screwed. Bad news on all fronts: you're best bet is to try to salvage something of your career. Your best job may be behind you, they said.

For me, that's probably true. I most likely peaked, at least money-wise, at INFOSEC. Since they don't have any project management work (or any other type of work), I suppose that this was still a smart decision. Better to leave than to get let go. Everyone is still feeling good about ol' manasclerk.

Enemy Ace Archives just arrived!

I bought the Enemy Ace Archives volume from Galatic Greg's, our local comic/gaming shop here in NW Indiana. Enemy Ace was a comic book anti-hero created by Bob Kanigher, a WWII veterans. The Ace is the German WWI fighter pilot Baron Hans von Hammer. He was enigmatic to the readers in the 1960s when he first appeared: he was both the enemy shooting down allies and not much of a gung-ho fighter, driven more by duty than by belief. His abilities at war won him the nickname "killing machine" and drove the other pilots away. He lived alone in his duty and honor, always knowing that tomorrow it could be him falling to the earth in a firey winged coffin, that "the sky is the killer of us all".

Orphans of God

I've been reading these blogs by the youth ministry folks, and looking at some of the materials from World Harvest Mission's Sonship program. I'm a lot more engaged about these things than I am in the issues of IT security. Sorry, clients!

Sonship raises the issue of being an "orphan of God", if I can borrow the phrase from Mark Heard. I act like "God helps those who take care of themselves" is a Christian principle from the holy scriptures. (It's not: check and see for yourself since 75% of American thinks that it is.) "That's thinking like an orphan," Jack said. Orphans think that they have to do everything on their own. Sums me up pretty well.

Student Evaluations: Why They're Useless

Block has a piece in Flawless Consulting Fieldbook & Companion where he talks about training evaluations. I've done my fair share of training -- I used to do a short courses on EPA and OSHA compliance all over the U.S. -- and I have gotten a goodly number of reviews. I even ended up with the highest average of anyone in my firm, even though I was twenty years junior to the rest of them. I happen to be very charismatic as an instructor.

Block argues that evaluations are usually set up with a particular bias "that cause is in the front of the room [with the speaker] and is in the audience. . . It is our elitist, leadership compulsion reinforced by an entertainment-and-spectator culture that leads us in this direciton." (Emphasis in the original) Thus, we ask questions that reinforce the idea that the speaker is responsible for the teaching and that the audience are passive receivers of learning. He continues, questioning the reasons behind evaluations, arguing here as he does elsewhere that learning and change must come from within through a personal struggle.

Not Burning These Guys

I didn't intend to burn these youth ministry guys: they have a hard row to hoe. I'd hate to be in youth ministry, even though I loved working with the junior high kids over the years. Still, if you're not part of the solution, you're part of the problem. There are a lot of inner-city, devastatingly poor neighbourhoods that would welcome a committed, I'm-not-gonna-leave youth worker.

Maybe I'll tell you later about meeting the real deal, a nurse-practitioner from the UK who ran a hospital in Uganda, gave the current president his first job, and now has to go to the presidential palace all the time, which she does with delight at seeing him succeed and heavy heart when she feels God edging her to say something about a policy. The real deal stays through it all. The real deal only becomes clear after 10, 25, or 50 years.

Running to BL Again

Yep, I have another short-term contract interview through the INFOSEC boys. This may actually last for several months. I'd love to be fulltime with someone again.

Sure I do.

On Friday, our friend in Brussels called us to see if we were going to come over for Christmas. They want us to come over, spend Christmas Eve and Day with them in Brussels, then convoy over to Switzerland (P's native land) to spend vacation in a chalet talking and just hanging. (So what if the girls are going to bring headphones and mpeg players? So am I.) I told her that we want to go, but that God is going to have to make it happen for us, and that I would appreciate it if she prayed that God would give me work to pay for the trip. Friday evening I checked the laptop and got word from the INFOSEC boss that they might have a multi-month gig in BL.

I'm pretty sure that if I asked for a change in the weather, God would give it to me. It makes me nervous about asking for things, because I get what I ask for. Except the stuff that would make my life easier. I could play the lottery and win $100M but I would still have the same problems. Plus all the ones from becoming suddenly rich.

Just a comment, then.

Do We Need Youth Ministry? Do We Need Anything?

Referenced blogs by youth ministry folks
Liquid Thinking
Andy Bryne's The Area
Reimagine Youth Ministry

I've been reading some blogs on youth ministry in the Christian church. It all started with the Steve Taylor download page -- what a great site! It led me to an article in Youth Worker where Steve, who used to be a CCM singer, talks about the false dichotomy of Entertainer vs. Minister of the Gospel. This led me to an article on the question "Do We Need Youth Ministry?", which in turn led to these fascinating blogs.

These guys are definitely concerned about the Church Eternal, about the life of the Christian. They ache for something more, for the reality of Christ not some political institution. They have been burned by churh-people who wanted power, who wanted to use them, who wanted them to do the parenting that they were afraid to do. They have been burned by parishioners who wanted someone else to walk the narrow road for them. They're bitter and hurt and cowards.

I'm just as big a coward as they are. It takes one to know one.

Prevacid and such

My brother has become an interesting expert on weird health problems as a result of my sister-in-law's problems. We were talking about problems with the way doctors prescribe things and he mentioned the acid reducers, like Prevacid and Prilosec. He pointed out that the stomach has a trapdoor at the top that stays open until it gets a signal that there is a bunch of acid in the stomach and then it shuts. The problem with people having acid reflux may not be that they have too much acid, he says, but that they don't have enough: the flap doesn't shut because it never gets a strong enough signal. It may be more about our diet -- corn-fed instead of grass-fed beef, etc.

It got me thinking about a lot of these issues. Western medicine looks at things from a component mentality: each part of your body is treated as a separate issue. Eastern medicine looks at things holistically, from a systems perspective. I remember seeing the Chicago eastern medicine college folks. My guru spent 45 minutes asking me about all types of things, seemingly unrelated to my problems. Big difference from my usual doctor.

I have acid reflux -- my problem is a genetic defect in the flap that means it never actually closes very tightly -- and I remember going to a specialist. He made me wait an hour in the emergency room, an hour in the room, and then thirty minutes in the middle of the examination as he did something else. His report to my GP -- she was the best doctor I've ever had -- took as long as his examination. It was cursory, quick and effcient. For him. And it didn't solve my problem. My GP, who was educated in Europe, has a more systemic view of health and took his information and put together a good plan.

I wonder what would happen if we looked at our health as a system state rather than the sum of its parts.

"I Want To Be a Hero"

A long time ago, my best friend (and later, best man) taught me a song that for all the world sounded like he owned it: "But the practical side / Said the question was still / "When you grow up what will you be?" / I want to be a hero / Hero / It's a nice-boy notion that the real world's gonna destroy / Hero / It's a Marvel comic book, Saturday matinee, fairy tale, boy". He sang it with a plaintive insistence, a throbbing set of piano chords to echo his soul. Yeah. It rang a note with me. You see, I wanted to be a hero.

I read a lot of comics as a kid and for good reason: I lived in a pretty dull world. The heroes of comics, of classic tales, of The Heroes. "Death is as light as a feather, but duty weighs upon me like a mountain." To be a hero, an idol. To do something that redeems, that saves.

And here I learn that I can't save anybody. It's just not going to happen. "Growing older you'll find / That illusions are bought / And the hero you thought you'd be / Was just another zero / I want to be a hero".

There's only one who can save, and it sure as hell isn't me. And it kills me to know, that I'm never going to be a hero. I'm just this guy. I'm just another bum on the el, trying to get a seat so he's doesn't smell like the gym when he gets to work.

I wanted to be a hero. I still do. The song ends differently, though. And maybe that's the point.

-- manasclerk

HP External DVD+R for US$200!

I went with a buddy of mine whose wife is an academic to get an external hard drive. He wanted to go to Best Buy, but since I have found them to be very reluctant to honor their guarantee ("Satisfaction Guaranteed, As Long As It's Ours!"), so I suggested we pop next door and see what Office Depot had. The guy there was incredibly helpful (and was an adult of voting age plus some) and pointed out the external HP drive that was on sale. Firewire and USB 2 all in one package. The speed was acceptable, so I went for it, springing for the Belkin USB/Firewire card while I was there -- only US$29 and it included a USB 2 cable. Woohooo!

SACMAT 2003 has arrived!

ACM SIGSAC's proceedings from the 8th Symposium on Access Control Models and Technologies has shown up in the office finally. Just a quick glance through suggests that there are several articles worth noting. The lads from Teesside have an interesting paper on the Tees Confidentiality Model and there a couple of papers on Role Engineering. RE seems to be a sorely underperformed process; if I had to guess, I'd reckon it was because it requires a knowledge of security models and the business itself. I'll write up a couple of reviews as I plow through things. There are about 230 pages to wade through so don't expect miracles.

If you're busting to get an authorization engine up and running, I suggest looking at the AZN work. The NIST standard is very useful in many ways, but you'll have a difficult time implementing anything based on it.

I'd love to see a presentation on some real-world examples of RBAC implementations. The ones that I've been associated with are closer to anarchy than the implementation of a standard, complete with spaghetti code.

-- manasclerk

Yes, Virginia: IT Doesn't Matter

What's mentioned:

There's still a lot of buzz around Nicholas G. Carr's article in May 2003's Harvard Business Review, "IT Doesn't Matter". I'm somewhat surprised that people actually think that IT investment in and of itself will provide competitive advantage. I've worked in the IT industry for almost a decade now and I can't think of any project I've been on that gave the company competitve advantage, at least for very long. The best you could hope for with commercial products is to be first to market, own it and fight off the bottom feeders as you move out the next big thing. I saw a competitor in the hazardous materials safety products industry do that with great success. With internal projects, you're mostly just keeping the wolves at bay.

Too much mix

HenriettaHyde made some pretty good points: she says that this is just too all over the place to be an interesting blog. Which is probably true. I mean, why would IT Security go along with reviews of Sgt Rock? Maybe I'll follow her advice and move a lot of this stuff over to another blog. At least separate out the ITSec stuff, which would be a great service to all mankind.

RBACblog, anyone? How about "Access Control and Authorization Technologies"?

- manasclerk

And, yes, I know that the other tabs don't work

The links are broken. I admit it. I'm too lazy to fix them right now.

So quit harping about it!

New About page is up

I finally got this stuff done and posted. My ftp client is so thankful to still be useful, especially since it is no longer a supported application. I think that the owners went belly-up. Still, it's a Win32 app that works fine under Win2K.

I'm sure that everyone will find what they want in the About section. Just click the little About tab above.

Looking for Kearns

I woke up this morning, dismal. The Bloated Goat of Despair had returned, mocking me in all its gassy deadness. It got bad. It got ugly. Damned Bloated Goat! (And, no, that wasn't swearing.)

It seemed like I was right where the bloated goat of despair wanted me: scared and unable to move. My experience is that the most effective way to neutralize is not to beat them -- takes too much time -- but to get them to render themselves ineffective, too uncertain to move. "Action is action, effendi."

You just gotta keep in mind who you are. You just gotta keep in mind who makes you who you are.

I got my knack back. I am a force that scares the shit out of that damned goat. He knows it, I know it. And one day I'm going to send his stinking carcass back to the eternal dismal pit that spawned hiim.

Selah.

So let's get back to kicking butt and taking names.

A thousand thanks, Ken Kearns. Your comments on the empoweru thing slapped me in the face. The goat says "you gotta get someone else to do something, someone else to follow." To hell with that! I got my heart back, and it was bought with an eternal price by someone who could pay. No way for it to get unredeemed -- the green stamp redemption only works one way. I know who I am, I know who He is.

Goat, he's not still dead. So what are you going to do about it?

Time to jump back in the fray. HAWKAAAH!

-- manasclerk

Job hunting

More bad news: apparently I did something to piss off INFOSEC's client on the last gig I had with them. I've actually been blacklisted by that department. The guys at INFOSEC aren't mad: this is a strange person running that group at their client. She's Peter Principalled and is running scared.

The scary thing is that I was counting on getting some room to maneuver from these short-term contracts with INFOSEC. Yeah, I know that this is not what I want to do with my life, and that's probably the point. I want something different. It's not that IT Security consulting -- or anything IT-related -- is stupid, or lacks creativity or is inherently bad. It just doesn't play to my strengths. Unfortunately, after years of working in these dead-end jobs that pay a pretty good amount of money, I don't have a lead on how to move out of it.

New look, finally

I've been putting off using Dreamweaver for about four years. This gave me an excuse to pull out Ultradev suite and see what the old versions of Dreamweaver and Fireworks could do. I think it came out OK for a demo tape.

It took me way too long to figure out that I was missing a small file for the popups. I haven't actually done much with HTML since about the time MS Internet Exploder came out. I started out as a web master when the big browser war was between UI's Mosaic and Cornell's Cello. Those were the days. None of this visual appearance for us. Nope, just good, plain Republican pages. I wrote an entire catalog site in late 1994 entirely in pico. I hadn't learned how to use vi yet. (I know, I know: I wasn't a Computer Sciences major, and I avoided the psych classes that made me give up my precious DOS -- and yes, I was using Compaq DOS 2.x back then. I also used IBM's when I could score it. Ah, that wonderful dual floppy, green screen, less than 640kB systems. I remember when I got access to a PC XT! An XT! It had a hard drive! Since then, I've tried to forget all that I've ever known about computers with such amazing success that I'm an IT security consultant.

- manasclerk

Anchoring a Mirror to a Plaster Wall

It's amazing how hard it is to get good information about how to anchor something to a plaster wall. The Natural Handyman's site (does he not sound like some sort of carpenter who works naked?) had a great article on what to use where and when. I was using molly bolts for my heavy stuff, but I used toggles instead, along with a really good art hook, based on his advice.

-manasclerk

School of Rock

M and I convinced L to babysit his twins so that we could hit the big city to see a movie. We ended up in a monaural movie theater and saw Jack Black's School of Rock. Other than the poor sound quality in this theater, the movie was a good time. It had some sort of soul that Terminator 3 so sadly lacked (as you may recall me blogging on and on about). Jack Black takes up a lot of screen time, of course, but Joan Cusack does her best role to date as the principal of Horace Green prep school, where Black poses as a substitute teacher. The kids are all incredible, too, even the ones who weren't really acting -- it seemed to be more like kids. You'll probably be seeing many of these kids in drug rehabs later as succeess goes to their heads.

-- manasclerk

Still no work on that contract

I think that it has been tabled indefinitely. Which means that I will never make any money off of it. Time to move on. I'm thinking of asking DH to assist me if I can grab some work from this startup. I wouldn't mind being paid a bit for financial writing again. And DH used to be a marketing director for a finance company, albeit not quite in these guys' league.

J and D, and D

So, I was going to just name this post "J & D" to refer to J, who has the distinct honor of being the first guy that I ever best manned for, and D, who has the distinct honor of being the first guy I ever ushered for. But J married a D (different full name, same initial) and I didn't want any confusion. Aren't you glad I cleared that up?

Clearing up the client contract thingy

L's going off to a Writers' Group with a previous winner of the National Book Award (really) so I thought I would take half a mo' and clear up what seems to be a confusion about this client contract.

1. It is not a contract with my usual employer, who always, always gets these things right. We're subbing to INFOSEC for goodwill.


2. The guy who sold the contract is a great guy, but he worked in Strategy Consulting and not IT Consulting. He's never done an security risk assessment and he's never had to deliver an IT product while consulting, although he used to work in IT a few years ago as an internal.


3. That being said, he never gave the client a good idea of what we needed to do the job, things like network diagrams, application specifications, access to administrators, etc.


4. So he asked me to put this together and send it to the client.


5. The client freaked and put us off for at least two weeks.


6. I've been putting off other work because I had this lined up and it was going to be a few grand.

I have been able to review Flawless Consulting Fieldbook & Companion: A Guide To Understanding Your Expertise. I am once again drawn into the fray with it and I'll put up some of my ideas.

-- manasclerk

Bloated Goat of Despair Goes Visiting

Because the of the absolutely rude comments judetheobscure23 sent me, I have dispatched the Bloated Goat of Despair to haunt him for the next week. Nothing in it should sound like I just wanted some time away from that blasted apparition. The goat, of course, has not been as satisfied with his work life has had previously been the case. I admit to being fat-headed enough to believe that I have made this hell-spawn's life an undead hell. If that is possible.

Anyway, please enjoy, o judetheobscure23! May the Bloated Goat of Despair float eyelessly beside your bed, bleating his off-tune curses on your offspring, occasionally bursting from the ever-increasing gases of decomposition within his body.

Next time I'm changing your tax records.

Contract Blues Redux

The client sent me an email over the weekend saying that he can't make it happen on Monday and we'll have to put off this contract until later. Which of course means that the damned Bloated Goat of Despair is going to be a pain in the ass.

Words fail me. I should never have put together that doc to let them know what I needed to complete this contract. And you know that I won't have any work until they get this thing off the ground.

I may go visit my folks' riverhouse in West Virginia. Although we can't seem to take more than a couple of days in the other's house, visiting it when they aren't there seems OK. They don't even mind coming over here.

Lutheran Vespers with Walt Wangerin, Jr.

The Rev. Prof. Wangerin is a local out here in Indiana. He teaches at Valparaiso University in Valparaiso, we he is also the "famous writer" in residence. He also hosts Lutheran Vespers, a half-hour radio program from the Evangelical Lutheran Church in America (ELCA). It's worthwhile to even grab a copy of one of his programs.

L got me hooked on his talks. He's a great storyteller, and a very pastoral pastor, although he does not currently lead a church. I wish that I had heard his talk on that bright, terrible 11th day of September.

Highly recommended.

-- manasclerk

Julie's story

I haven't thought of it in a long time, but a friend was telling me some bad news and there it was in front of me again. I was young, the rules weren't publicized yet and we didn't know what to do. The names are all changed, because we were guilty.

Back when I was in college, I would meet a group for for general prayer to God every Sunday night. One night, when I was in my fourth year, Susan told us that there was something she needed to talk to us about. She swore us to secrecy that nothing would leave this room in the chapel. I should have known that this would be bad.

Power of knowing who you are

I've avoided the power metaphor or hook for too long, I'd guess. Truth is, the power of knowing who I am haunts me.

Know who you are.

Web risk assessment update

I finally found ou that my audit is going to be pretty small -- and under NT. This will be easy. Ah, cracking another box of Auntie Entee's box of goodies.

I'm getting some pushback from the bosses at INFOSEC about what I'm requesting. Pretty much the normal stuff: all informaiton about servers, first born children, social security and credit card numbers, tax returns for the last three years, you know, what you'd expect.

I'll see how this is going. I just learned that it was not an overall web assessment but just on these three servers. I can do this in three days.

That bastard bloated goat of despair

On other news, I saw the bloated goat of despair hanging around my windows last night again. These apparitions are getting pretty damned pushy. Pretty soon the demented duck of death will be commandeering the remote and watching the outdoor channel. It's not the apparitions themselves that really bother me. It's the odor and mess that they leave. Luckily, the bluebird of happiness was over visiting L and beat the stuffing out of the bloated goat of despair. Boy that was funny! He exploded over everything! Of course, the bluebird left without cleaning up the mess. I just called over the hungry dogs of war and let them go ape. If I ever have kids, I gotta get a dog: they cleaned up everything. Of course, now the room smells like dog spit, but that's what Lysol is for.

Not that him blowing up into a thousand pieces will keep him from rising from the dead and floating outside my bedroom window bleating like the zombie ruminant it is. I tried the twelve-gauge on him (her?) the first time. It's amazing how much damage a shotgun with steel shot can do at close range to a floating apparition of evil. Whoever said that gun ownership should be outlawed hasn't had an infestation of evil apparitions before. Nothing like it to send the little critters scattering.

They come back, of course, and after awhile you have a lot of holes in your walls and windows and your neighbor's calling you a child murderer and all, so I had to ratchet the shotgun fun back. I still use it on them, but only when I'm out at the cabin or in the woods. I think that some of them actually enjoy being blasted back to the hell that spawned them.

-- manasclerk

Secuirty Assessment blues

INFOSEC has sold me as the lead on a security assessment of web-based applications for a Chicago-based health care provider. Although I do have the CISSP, I can't say that I'm particularly qualified for this audit. I do understand the process side of things -- I got my CISSP based on my experience in Single Sign-On with a large bank and lots of processes & procedures experience with security. It's not that I haven't done audits before; I've done pre-audits for ISO 9001 acreditation, and worked on safety and environmental audits several years ago. Still, I can't say that I know all that much about the technical aspects of web security. I can tell you whether or not you've put things together securely (how you handle sensitive data like credit cards, how you deal with passwords, what you do with SSO products, etc.) but I'm not that comfortable trying to crack the place.

I should just script the whole thing.

What if it were true?

Do you remember when you were a kid and you imagined that you didn't belong to your parents, but you really were a royal son or daughter, stolen at birth or given up to adoption because of some terrible tragedy? What if it were true? What if you had a secret destiny as great as you thought it was when you were little?

What if it were true?

Laptop Cooling update

I'm still using the AOC laptop cooling and it works like a charm. But I still ahve the laptop freeze up (black screen of nothing, although the machine seems to still be powered) when I use the Adaptec USB 2 PC-card with my IOGear external hard drive (a Hitachi in the IOGear 2.5" enclosure).

It turns out that lots of people have had problems with Dell Inspiron and the USB connections. Even on new ones. I wonder if it is something to do with the BIOS? I still believe that it is a cooling issue, if I have two cards (NIC and USB) in the PCMCIA slots, it just overheats in the cards which causes a fault of some sort. Still, I'd like to know. I only get the failure when I have my NIC and USB cards in at the same time. Apparently.

Spent the weekend with the 'rents

L and I went over to see my brother, who was doing the 15 hr drive to return some stuff to my folks. All in all, it was an OK trip, but we always stay a day too long. A weekend is about all I can do nowadays.

The Power of the Church Eternal

I am a deacon in a denomination of the presbyterianism, the Presbyterian Churches in American (PCA). It's pretty conservative, all told, holding to old line confessions and traditional church polity. Mostly I've enjoyed being a part of it, but I have to confess that after my two-year hiatus while sojourning in Indiana, I'm beginning to wonder whether I believe that its polity is consistent with growing Christians.

BRRR!!!

It's freezing cold in northern Indiana tonight. October 1/2 and it feels like Thanksgiving. We're even maybe getting flurries tomorrow. Amazing.

What CEO Skills Really Work

From Nohria, Joyce & Roberson, "What Really Works", Harvard Business Review, [July 2003], pp. 42-51.

1. Build relationships with people at every level. Most mid-level managers can't do this. Upper management needs to reach down and see the people in the middle. They have an important purpose, but they can also derail your business quite easily.


2. Inspire the rest of the management team to do (1).


3. Spot opportunities and problems early.