ntietz

Identity theft is a huge problem, costing Americans more than $4.5 billion in 2012. Identity theft victims frequently lose time and money and undergo significant mental hardships while dealing with the fallout. It can happen a few different ways, but one large attack vector is through the identity verification process. Every time your identity is verified, one of the following mechanisms is probably used: - an array of challenge questions ("what were your last two addresses?") - submitting a copy of a physical document (passport or id card) - providing your Social Security number (SSN) All of these come with problems. They are subject to two main attack vectors: social engineering, where a bad actor may trick you into giving up this information to them directly; or bad actors within a legitimate organization that you have to provide the information to. The second attack vector is far more insidious, since you cannot do anything to prevent it. If you submit your SSN with a form at your local community college and an employee handling the form copies it down, it is lost -- but you had no choice and had to include the SSN. Let's back up. What's the big problem here? Why are these mechanisms weak? There are two classical problems in secure communications: authentication and encryption. Authentication is proving your identity. Encryption is protecting a message from all but the intended recipients. Together, these let you send messages which cannot be intercepted and can be demonstrated to be from you, not an impostor. Traditional identity verification mechanisms are just means of authenticating your requests. These are based on shared information. Essentially, both Alice and Bob must have the same information to verify that Alice really is who she claims to be. Here's the problem: that means that Bob can then go to Mark and say "Hi, I'm Alice, here's proof!" and Mark would be fooled. Solving this problem requires switching to an asymmetric information system. This is the same way that your bank's website proves that it is legitimate. A central authority, called the certificate authority (CA), issues a certificate to the bank. The bank holds private information it can use to sign a message (their private key), and then your browser checks the signature using the public certificate from the CA. No one else can impersonate the bank, because no one else has the bank's private key. We can do the same thing for identity verification for people. With a central "Personal Identity Authority" (such a name evokes some dystopian imagery), we could issue every person a private and public key. The public keys would all be recorded so that anyone could see everyone else's public keys, but private keys would be held only be each individual. Then, identity proof would be done by a simple process. Imagine that Bob wants to verify Alice's identity: 1. Bob would send Alice a short message (randomly generated, and unique each time). 2. Alice would encrypt this message using her private key and send it back to Bob. 3. Bob would retrieve Alice's public key and use it to decrypt Alice's message. 4. If the received message matches the original one, then Alice is who she claims to be. This system would be technically sound and would result in both far more secure identities and much higher confidence identity verification. However, it comes with problems of its own. - Software systems would be necessary to implement the system. People can't encrypt random messages with large keys by hand. These systems are not awfully difficult to make (in fact, they already exist) but getting them integrated into everyone's phone, laptop, browser, and all the services they use, would be a significantly challenging endeavor. - People would lose their private keys. If someone breaks their laptop or phone and their private key is lost, how would a new one be reissued? If you can use an old technique, like your SSN, to get a new key, then what would stop an attacker from simply pretending to be you and getting a new public/private key pair associated with your identity? - People can have their private keys stolen. This could happen through security holes in their laptops and phones, or through social engineering to convince people to give up their private keys voluntarily. - A great deal of trust is now placed in one central authority. This authority must be trusted not just to manage your identity, but also to be responsible with a lot of information. All requests for your public key would be signals that you are authenticating in different places (Facebook wants your public key? That is a signal that you just used Facebook.), so the central authority would have a new wealth of tracking data. I hope that within my lifetime, I can see symmetric information stop being used for identity verification. However, I also hope that these issues can be solved well before we implement any such system.

As an undergraduate, I always imagined that I would someday move to the SF Bay Area to live in the heart of the software industry. With this in mind, in my final semester at Kent State, I joined a Silicon Valley startup as their third engineer1. The staff at that time was split: one founder and one engineer were in Mountain View, CA; one founder and one engineer were in Ohio; and one engineer was remote. Nearly every month in the first year, I flew out to the Silicon Valley office to work with the engineers out there. Since then, we have grown to have a technical staff of about 20 people. We are split pretty evenly between the Silicon Valley office and the Ohio office. I spend most of my time in the Ohio office, but I do commute to the Silicon Valley one occasionally. Nearly every time I go out to California, my coworkers ask me the usual question: "so, when are you moving to California?" It seems like for people in the Valley, moving to California is such an obvious choice that it isn't even a question of if I'll move, but when. However, I truly love the Midwest and that I want to stay here for as long as I can. It's not for everyone, but it is for me and maybe it is for you. ## It is affordable In San Francisco, the median one-bedroom apartment costs $3,120 / month. In Kent, Ohio, a really nice one-bedroom apartment will cost you at most $1000 / month. Salaries are much higher in the Valley than in Ohio, but even a low salary in Ohio can get you a very nice apartment. ## There is lots to do Another argument that's used is that "Ohio is in the middle of nowhere" implying that there is nothing to do here and life is boring, surrounded by cornfields. On the contrary, there is actually a ton to do in Ohio. Here's a tiny sampling of what I like: - Cleveland gets all the Broadway shows once they go off Broadway, but at about half the cost - We have great music here, including the world-renowned Cleveland Jazz Orchestra, and tons of bands come through - We have some great sports teams (hi, OSU) and a ton of great sports fans (hi, Browns fans) - We have great food at very affordable prices Actually, I haven't found anything I could do out in the Valley that I could not also do back in Ohio, except maybe get killer sushi. ## Midwesterners are Great People More than anything else, I love the people in the Midwest. Here's why: - Our people are incredibly polite and caring. Out here, people greet you on the sidewalk even if they don't know you. Neighbors will come help push your car out of the snowbank it got stuck in. Cars will let let you merge when they don't have to. - Our people are, well, scrappy: even though the Browns continue to lose, year after year, you will find no fans more loyal than the Browns fans2. This attitude is carried through most things we do: even if you fail over and over, you just keep trying and hoping. On balance, I haven't found nicer people than in the Midwest. ## The Weather Not many people would claim that Ohio's weather is great, but count me among them. Our winters are fairly harsh and cold, but they make you truly appreciate spring when it comes. All the non-winter seasons are really nice: spring is pleasant and life is blossoming around you; summer is warm and laid-back; and fall is brisk and beautiful, with the leaves all changing colors. ## Great Universities Despite popular opinion, the great universities aren't limited to the two coasts: we have UW-Madison, UIUC, Northwestern, and OSU, to name just a few. (Carnegie Mellon is also nearby, even though it isn't technically in the Midwest.) ## The Pace of Life On both coasts, the pace of life is really, really high: you just go, go, go and work constantly. If you go to a restaurant or coffee shop, people around you are probably all talking something work related, because people don't slow down very much. In the Midwest, though, people take a much more relaxed pace. If you go to a coffee shop, you'll find people talking about real life things, not work. Maybe they're talking about a book they read in their free time! This is one of the things I love most about the Midwest - people actually turn off work mode sometimes and go relax. I firmly believe that, even in spite of this, people are not less productive here than in the Valley, because even though we may put in fewer hours, those hours are more energetic and we are more recharged. --- The Midwest is a beautiful place filled with beautiful people. Don't write it off just because it isn't the heart of Silicon Valley - there is still a lot of good stuff and good work being done in this part of the country. Come visit, stay for a while. --- 1 My company is in stealth mode and has requested that we not talk about the company publicly at this time. When that changes, I might have more to say about the company. Note: I can talk to individuals one-on-one if anyone is curious. 2 We have fans on every continent including Antarctica.

I just finished reading Bruce Schneier's latest book, "Data and Goliath." I was apprehensive at first -- I'm a big fan of Schneier's posts online, but I found this randomly at the library and I was hoping not to be disappointed. In the end, it was well worth the read. The book was split into three parts. In Part One, he discusses what a world of constant mass surveillance looks like. He illustrates what data everyone is leaking through ordinary activities, how people can and are monitored, and how this data can be used. In Part Two, he explains what is at stake: what the political and economic losses of surveillance are both in the US and abroad. And in Part Three, he explains what can be done about this in a three prong fashion: what the government should do; what corporations should do; and what we, the people, should do. All throughout, he provided compelling examples and illustrations, as well as footnotes with additional references (although, confusingly, these are not referenced inline but are merely listed at the end). There were many compelling points in this book, and I can't list them here, but I want to call attention to one in particular. He puts out a call to action for the tech community to (paradoxically) create surveillance tools for the government to use - the argument being that "if we want organizations like the NSA to protect our privacy, we're going to have to give them new ways to perform their intelligence jobs". Overall, I think he did a great job making these issues available for a non-technical audience. It was written in a way that will be open to everyone inside or outside the tech community. This book is a must-read in today's surveillance-filled world: buy it for your friends, get it from the library. Spread the word.

Here's something we don't talk about enough: burnout sucks and it can happen to any one of us. We need to talk about it. We need to know how to deal with it and recover from it. And we need to recognize that everyone can come back from it, stronger than ever. In the software industry, we are subject to lots of pressure, long hours, and emotionally taxing work1. These are stressful and very difficult to deal with, and can ultimately lead to burnout. I hope those reading this have not had to deal with it, but I sadly suspect that most of you have (or will). I know that I have, and more than once. The first time I experienced burnout was in 2012, when I ambitiously chose to take on not one, but two, undergraduate research projects simultaneously. Some people may thrive in this environment, but it ended up reducing me to tears and ultimately leading me out of academia and into industry2. The second time I experienced burnout was in 2014. I was working for a startup which I believed in 100%3. Any job comes with stress and can have long hours (especially for a young software engineer who does not know how to set boundaries), and since I believed 100% in the company, I sacrificed too much while having no other outlet for my stress. This stress culminated in me lying on the floor of my house, in tears, broken. Something had to change. Either I would find a way to deal with the stress, or I would have to find a new industry to work in, because this was simply not sustainable. Almost without thought, I walked over to the door, laced up my Nike running shoes, and went and ran the first damn mile I had run in a long, long time. The more my feet hit the pavement, the more my stress melted away, and by the time I was done I felt like a normal human being again. The repetitive, meditative nature of running melted it all away (and the endorphins didn't hurt, either). It took me a long time to recover from burnout in 2012 and in 2014, but I did it, and I came back stronger for it each time. I now know how to set boundaries, how to relax and have a life outside of work, and I've adopted a hobby that will keep improving my health for a long time. And I joined a great company doing some stuff I really care about, but I'm also really sure that the changes I've made will ensure I stay a strong, healthy engineer for years to come. Unfortunately, my experiences here are not unique. If you are fighting with burnout right now, please, join me: go for a run, or a bike ride, or a long walk (no phone allowed). Your mind will be clearer and it will be one small step on the road to recovery (if not, at least you still got some exercise!). (And if you need someone to talk to, get in touch.) If you have gone through burnout or fought with mental illness, I beg of you: post your story and share it wide. As an industry, we have a responsibility to protect each others' health, physical and mental. A big part of that is sharing our stories and our coping mechanisms so no one has to feel alone, trapped, or hopeless. +++ 1 Personally, I find programming to be nearly constant emotional whiplash: the successes make me feel really great, and the roadblocks and failures make me feel really awful. Anecdotally, many of my coworkers have felt same way. 2 I recently revisited this decision, and tried out grad school. Fairly quickly, I determined once again it was the wrong choice for me, but it was good to make this decision again when not experiencing burnout. 3 It is still my belief that GraphSQL has essentially the best graph computing platform out there. Adam, please make a public release soon! I want to play with it again!

In 2010, the news broke that Harriton High School, in a suburb of Philadelphia, was activating webcams on student laptops1. When they were at home. In their bedrooms. They captured photos while students were in private spaces, where they never expected to be watched. A few days ago, I heard about another school that is also surveilling their students: AltSchool. They are taking a very different approach: the cameras are visible and are there to help improve education, to conduct research and find out how to more effectively educate our students. On the face of it, it looks like AltSchool is doing something noble. At the very least, the surface level does not appear to be immoral, let alone nearly as repugnant as what was done at Harriton High School. And in some ways, that is true: the surveillance itself does not appear to be leading to negatives here, and it passes the minimum bar of informing all involved parties. However, there is an insidious side effect, and one which is far worse: it will acclimate the students to a surveillance state. In our society we are fighting a battle for our privacy right now, and in many ways, the next generation will be the one to seal the deal. Either they will embrace and extend privacy tools and policy, or they will embrace and extend government and corporate surveillance. By exposing our children to pervasive surveillance during their most formative years, we risk permanently shifting the balance toward surveillance and numbing our children to its dangers. Don't get me wrong, I think that there is room for massive improvement in education. However, the solution ought to include positive new technology, like better adaptive learning tools. We are better than this. We can innovate and create great new tools that will help, or even revolutionize, our children's education. But if we want to do that, we need to do it ethically and ensure that we do not accidentally harm society while trying to help it. The ACM has a code of ethics for software engineers. From it: "Approve software only if they have a well-founded belief that it is safe, meets specifications, passes appropriate tests, and does not diminish quality of life, diminish privacy or harm the environment. The ultimate effect of the work should be to the public good."2. I welcome you to think and comment about this: if we subject our children to pervasive surveillance, will that lead to less privacy? Is that to the public good? +++ 1 More information is available on Wikipedia. 2 I tried to put this as a block quote in my Markdown, but it wasn't rendering as one -- anyone know how to get that working? Is it a problem with my theme?