As someone who has been involved in fixing a number of terrible situations
involving computers, and as someone who has not been involved in the DIA
fiasco, other than as a fascinated observer, I'm sure that when the book is
written on this, we'll find that there is ample blame for all of the parties
involved in the project.  Small groups of people make small messes.  To get a
really large mess, you need a large group of people working for many
organizations.  Anyone, or any reporter, claiming to know the source of the
problems as this stage, is either quite naive or has an axe to grind.

I think Bear Giles misses the point (in RISKS 16.01) about simple software
errors leading to massive, unintended consequences.  The issue is not (just)
syntax checkers. Sure, we've got 'em...So what?  The issue is that in a
mechanical or analog system a small error in the input or operation
generally leads to a small **and traceable** error in the output.  But in a
digital system, especially a software-based digital system that can experience
memory or data corruption, a small error in the input or operation can have
huge **and virtually untraceable** errors in the output.  I seem to recall
that it was indeed a small error that brought down the AT&T long-distance
switching system. I have to agree with the writer on this one.

Finally, judging by the number of bar-coded labels that I have to rip off my
luggage, many airports must use bar-code readers. I have to believe that this
piece of airport technology is reasonably mature.  Finally, common sense says
it has got to be more reliable to bar-code the luggage than the carts.

Paul Green, Sr. Technical Consultant, Stratus Computer, Inc., Marlboro, MA
01752    Paul_Green@vos.stratus.com, PaulGreen@aol.com    (508) 460-2557

Subject: Followup on credit card policies (re: "Streetwise Guide ...")

PGN asked me to summarise the responses to my comments in the review of "The
Streetwise Guide to PCs" by Jerome/Taylor.  I had suspected that it might be a
bit controversial, but I was surprised that the only substantive comments I
received were in regard to the difference between Canadian and American law
regarding credit card purchases.  The most apposite information was from Bear
Giles 

ABC Nightline re LaMacchia
"Mich Kabay [NCSA]" <75300.3232@CompuServe.COM>
04 May 94 06:20:39 EDT
On 02 May 1994, ABC News _Nightline_ aired a program entitled, "Law and Order
on the Information Superhighway_, which focused on the case of David
LaMacchia, an MIT student accused of wire fraud for allegedly having run a BBS
which permitted traffic in stolen software.

The host was Chris Wallace, substituting for Ted Koppel.

I ordered a transcript of the program from Journal Graphics, Inc. / 1535 Grant
Street / Denver, CO 80203 / phone 303-831-9000 / fax 303-831-8901.

The transcript is copyright (c) 1994 American Broadcasting Companies, Inc. and
therefore I can provide only an abstract.

   [I received the entire abstract from Mich, who also provided me with an
   annotated version, which is included here.  My apologies if I omitted
   anything necessary for understanding.  However, because Mich included
   chunks of the abstract before each of his annotations, I could not run
   both the full abstract and the annotated version.  PGN]

U.S. Attorney Donald Stern accuses David LaMacchia of having tolerated the
exchange of stolen software worth more than $1 million.  Prof. Laurence Tribe
of Harvard University Law School questions the implications of such an
accusation; he argues that LaMacchia's BBS should be accorded the legal status
of a common carrier, thus exculpating the owner of crimes committed through
his communications channel.

Analysis of the Nightline program about David LaMacchia and the software
exchange BBS:

[set flame = on]

<

Risks of electronic door locks for automobiles
Paul Wallich 
Wed, 4 May 1994 21:56:20 -0400 (EDT)
The underlying risk of electronic car door locks is that the state of the
lock depends on what a microprocessor believes rather than whether
someone has turned a key or pushed a latch button. In addition to the
obvious failure modes (do you need a working battery to unlock the car?)
the manufacturer can also program in more complex lock behavior. Drivers
and passengers may find out the full range of lock states only when
bitten by a previously unknown "feature".

For example, last week I drove a two-door Chevy Cavalier that unlocks both
doors when the ignition is turned off. Makes it harder to lock keys in the
car, but could also pose a risk of theft if you don't notice.  Compared to the
Buick Century I was driving for a few days prior to that (and you'll
understand why shortly), the Cavalier's behavior is positively benign.

During a sudden spring blizzard at 2,500 meters in Northwest New Mexico, I
discovered the Buick's quirk. I went onto the shoulder to avoid a pickup and
trailer that had decided to stop in the middle of the road during a brief
zero-visibility whiteout, and found myself stuck in a newly-minted snowbank.
So I turned on the hazard flashers and went to see how hard it would be to dig
out. Since I had left the engine running, the doors locked automatically
behind me (I later verified that this is a "well-known" behavior to the rental
agents in Albuquerque). The risks of standing outside a locked car in driving
snow on a lightly-traveled mountain road (wearing clothing more suitable for
low-altitude desert) should be obvious. Without the timely passage of two
other tourists (bound from a monastery near Abiquiu to a commune at Taos) this
posting might not have been possible.

I was somewhat taken aback to note that it took the tow-truck operator less
than a minute to unlock the car, equipped only with a small pry bar and a bent
steel rod. So the electronic locking mechanism does not seem to add security.

During the mechanical era, auto manufacturers figured out various way to make
it difficult or impossible to lock your keys in a car; it's not a good sign
that they seem to be relearning those lessons from scratch.




Report problems with the web pages to the maintainer