9 stories
·
1 follower

Cracking the Lens: Targeting HTTP's Hidden Attack-Surface

1 Share
@media all { .page-break { display: none; } } Modern websites are browsed through a lens of transparent systems built to enhance performance, extract analytics and supply numerous additional services. This almost invisible attack surface has been largely overlooked for years. In this paper, I'll show how to use malformed requests and esoteric headers to coax these systems into revealing
Read the whole story
rbdixon
1190 days ago
reply
Atlanta, Georgia
Share this story
Delete

Friedman Comments on Yardley

1 Comment

This is William Friedman's highly annotated copy of Herbert Yardley's book, The American Black Chamber.

Read the whole story
rbdixon
1318 days ago
reply
I enjoyed this book when I read it years ago.
Atlanta, Georgia
Share this story
Delete

Should Chevron be reconsidered? A federal judge thinks so. - The Washington Post

3 Comments

Is the doctrine of Chevron deference compatible with traditional notions of constitutional separation of powers? Legal academics (and at least one justice) have begun to raise questions about the propriety and desirability of the Chevron doctrine — the doctrine that provides that courts must defer to permissible agency interpretations of ambiguous statutory language.

Yesterday, in a concurring opinion in Gutierrez-Brizuela v. Lynch, the Honorable Neil Gorsuch of the U.S. Court of Appeals for the 10th Circuit joined those who think it is time to reconsider Chevron. His concurring opinion begins:

There’s an elephant in the room with us today. We have studiously attempted to work our way around it and even left it unremarked. But the fact is Chevron and Brand X permit executive bureaucracies to swallow huge amounts of core judicial and legislative power and concentrate federal power in a way that seems more than a little difficult to square with the Constitution of the framers’ design. Maybe the time has come to face the behemoth. . . .

It continues further on:

Precisely to avoid the possibility of allowing politicized decisionmakers to decide cases and controversies about the meaning of existing laws, the framers sought to ensure that judicial judgments “may not lawfully be revised, overturned or refused faith and credit by” the elected branches of government. . . . Yet this deliberate design, this separation of functions aimed to ensure a neutral decisionmaker for the people’s disputes, faces more than a little pressure from Brand X. Under Brand X’s terms, after all, courts are required to overrule their own declarations about the meaning of existing law in favor of interpretations dictated by executive agencies. Nat’l Cable & Telecomms. Ass’n v. Brand X Internet Servs., 545 U.S. 967, 982-85 (2005). By Brand X’s own telling, this means a judicial declaration of the law’s meaning in a case or controversy before it is not “authoritative,” id. at 983, but is instead subject to revision by a politically accountable branch of government. . . .

Yet even as now semi-tamed (at least in this circuit), Brand X still risks trampling the constitutional design by affording executive agencies license to overrule a judicial declaration of the law’s meaning prospectively, just as legislation might — and all without the inconvenience of having to engage the legislative processes the Constitution prescribes. A form of Lawmaking Made Easy, one that permits all too easy intrusions on the liberty of the people. . . .

In the Administrative Procedure Act (APA), Congress vested the courts with the power to “interpret . . . statutory provisions” and overturn agency action inconsistent with those interpretations. 5 U.S.C. § 706. Congress assigned the courts much the same job in the immigration field where we happen to find ourselves today. 8 U.S.C. § 1252(a)(2)(D). And there’s good reason to think that legislative assignments like these are often constitutionally compelled. After all, the question whether Congress has or hasn’t vested a private legal right in an individual “is, in its nature, judicial, and must be tried by the judicial authority.” Marbury v. Madison, 5 U.S. (1 Cranch) 137, 167 (1803) . . . Yet, rather than completing the task expressly assigned to us, rather than “interpret[ing] . . . statutory provisions,” declaring what the law is, and overturning inconsistent agency action, Chevron step two tells us we must allow an executive agency to resolve the meaning of any ambiguous statutory provision. In this way, Chevron seems no less than a judge-made doctrine for the abdication of the judicial duty. Of course, some role remains for judges even under Chevron. At Chevron step one, judges decide whether the statute is “ambiguous,” and at step two they decide whether the agency’s view is “reasonable.” But where in all this does a court interpret the law and say what it is? When does a court independently decide what the statute means and whether it has or has not vested a legal right in a person? Where Chevron applies that job seems to have gone extinct. . . .

Whatever the agency may be doing under Chevron, the problem remains that courts are not fulfilling their duty to interpret the law and declare invalid agency actions inconsistent with those interpretations in the cases and controversies that come before them. A duty expressly assigned to them by the APA and one often likely compelled by the Constitution itself. That’s a problem for the judiciary. And it is a problem for the people whose liberties may now be impaired not by an independent decisionmaker seeking to declare the law’s meaning as fairly as possible — the decisionmaker promised to them by law — but by an avowedly politicized administrative agent seeking to pursue whatever policy whim may rule the day. . . .

Chevron invests the power to decide the meaning of the law, and to do so with legislative policy goals in mind, in the very entity charged with enforcing the law. Under its terms, an administrative agency may set and revise policy (legislative), override adverse judicial determinations (judicial), and exercise enforcement discretion (executive). Add to this the fact that today many administrative agencies “wield[] vast power” and are overseen by political appointees (but often receive little effective oversight from the chief executive to whom they nominally report), and you have a pretty potent mix. . . . Under any conception of our separation of powers, I would have thought powerful and centralized authorities like today’s administrative agencies would have warranted less deference from other branches, not more. None of this is to suggest that Chevron is “the very definition of tyranny.” But on any account it certainly seems to have added prodigious new powers to an already titanic administrative state — and spawned along the way more than a few due process and equal protection problems of the sort documented in the court’s opinion today . . .  It’s an arrangement, too, that seems pretty hard to square with the Constitution of the founders’ design and, as Justice Frankfurter once observed, “[t]he accretion of dangerous power does not come in a day. It does come, however slowly, from the generative force of unchecked disregard of the restrictions” imposed by the Constitution. Youngstown Sheet & Tube Co. v. Sawyer, 343 U.S. 579, 594 (1952) (Frankfurter, J., concurring). . . .

And it concludes:

What would happen in a world without Chevron? If this goliath of modern administrative law were to fall? Surely Congress could and would continue to pass statutes for executive agencies to enforce. And just as surely agencies could and would continue to offer guidance on how they intend to enforce those statutes. The only difference would be that courts would then fulfill their duty to exercise their independent judgment about what the law is. Of course, courts could and would consult agency views and apply the agency’s interpretation when it accords with the best reading of a statute. But de novo judicial review of the law’s meaning would limit the ability of an agency to alter and amend existing law. It would avoid the due process and equal protection problems of the kind documented in our decisions. It would promote reliance interests by allowing citizens to organize their affairs with some assurance that the rug will not be pulled from under them tomorrow, the next day, or after the next election. And an agency’s recourse for a judicial declaration of the law’s meaning that it dislikes would be precisely the recourse the Constitution prescribes — an appeal to higher judicial authority or a new law enacted consistent with bicameralism and presentment. We managed to live with the administrative state before Chevron. We could do it again. Put simply, it seems to me that in a world without Chevron very little would change — except perhaps the most important things.

I’ve excerpted Judge Gorsuch’s 22-page concurrence extensively, but the whole thing is worth a read. As far as administrative law stuff goes, it’s a great read (even if, I must confess, I am not yet convinced of the argument). It presents a compact and powerful argument.

Judge Gorsuch’s provocative concurrence is not all that Gutierrez-Brizuela offers for administrative law folk. The majority opinion (which Judge Gorsuch also wrote) addresses an important and interesting question about the interaction of judicial and agency interpretations under Chevron and Brand X. Specifically, the opinion addresses whether agency interpretations of ambiguous statutory language that conflict with (and effectively trump) prior judicial opinions of such language should apply retroactively — an issue the 10th Circuit has struggled with before.

As Judge Gorsuch explains in the introduction to his opinion for the court:

We recently confronted the thorny problem what to do when an executive agency, exercising delegated legislative authority, seeks to overrule a judicial precedent interpreting a congressional statute. In our constitutional history, after all, judicial declarations of what the law is haven’t often been thought subject to revision by the executive, let alone by an executive endowed with delegated legislative authority. Still, in recent years the Supreme Court has instructed us that, when a statute is ambiguous and an executive agency’s interpretation is reasonable, the agency may indeed exercise delegated legislative authority to overrule a judicial precedent in favor of the agency’s preferred interpretation. See Chevron, U.S.A., Inc. v. Nat. Res. Def. Council, Inc., 467 U.S. 837 (1984); Nat’l Cable & Telecomms. Ass’n v. Brand X Internet Servs. (Brand X), 545 U.S. 967 (2005). And that development required us to confront this question: accepting that an agency may overrule a court, may it do so not only prospectively but also retroactively, applying its new rule to completed conduct that transpired at a time when the contrary judicial precedent appeared to control? De Niz Robles v. Lynch, 803 F.3d 1165 (10th Cir. 2015). Now that curious question has returned, this time with a twist.

The 10th Circuit had previously concluded that the agency’s interpretation applies prospectively. The “twist” here is whether this rule applies when the action in question occurs after the agency has issued an interpretation that overrules a prior judicial interpretation, but before that interpretation has been reviewed and upheld in the relevant court. In other words, during that period, are individuals subject to the agency’s authority bound by the prevailing judicial interpretation or the new agency interpretation? According to the 10th Circuit, until the court has the opportunity to review the agency’s new interpretation, the judicial interpretation applies as binding precedent in the relevant jurisdiction.

It’s an interesting question, and one that benefits greatly from Judge Gorsuch’s clear and thoughtful explication. It’s also one, as Judge Gorsuch’s concurrence highlights, that should cause us to think about the role of deference to federal agencies within our system of separation of powers — and, in this case, prompted him to think about the wisdom of deference to an agency’s statutory interpretations.

UPDATE: For what it’s worth, I am more in the “mend it, don’t end it” camp when it comes to Chevron. That is, I believe Chevron needs to be constrained, but I am not convinced that it should be overruled. I summarized my views at the recent Missouri Law Review symposium on the administrative state. A draft of the resulting essay is here.   For more in this vein, see this article I co-authored with Nathan Sales.

Read the whole story
rbdixon
1365 days ago
reply
Excellent find. Thank you for sharing.
Atlanta, Georgia
satadru
1365 days ago
reply
From August 2016...
New York, NY
Share this story
Delete
1 public comment
mareino
1364 days ago
reply
He wants to replace the opinions of experts acting under the direction of elected officials with his own opinions, subject to no oversight by any elected officials. That's really all I need to know about where the court would head under him.
Washington, District of Columbia
satadru
1364 days ago
Ugh. Thanks.

FAA orders new 787 electrical fix to prevent power failure

1 Comment
All Boeing 787 operators will be required to periodically deactivate the electrical system to avoid a problem with a newly-discovered software bug that could cause the aircraft to lose alternating current (AC) power, the US Federal Aviation Administration says in a new airworthiness directive. The agency adopted the final rule after Boeing reported the results of a laboratory test showing a total loss of power is possible if the generator control units run continuously for eight months, says the FAA’s 30 April notice in the Federal Register.
Read the whole story
rbdixon
2009 days ago
reply
Please try rebooting the plane.
Atlanta, Georgia
Share this story
Delete

Surviving Data Science "at the Speed of Hype"

1 Comment
Being in the world of big data and data science, I see a lot of stuff like this: 

Analytics at the speed of big data:
Computing at the speed of innovation:
Big Data at the speed of light?
Big data at the speed of thought! Now that's more like it...
And my personal favorite, big data....at the speed of big data.
There is this idea endemic to the marketing of data science that big data analysis can happen quickly, supporting an innovative and rapidly changing company. But in my experience and in the experience of many of the analysts I know, this marketing idea bears little resemblance to reality.

Over the course of my career, I've built optimization models for a number of businesses, some large, like Royal Caribbean or Coke, some smaller, like MailChimp circa 2012. And the one thing I've learned about optimization models, for example, is that as soon as you've "finished" coding and deploying your model the business changes right under your nose, rendering your model fundamentally useless. And you have to change the optimization model to address the new process. 

Once upon a time, I built a model for Dell that optimized the distribution of their chassis and monitors from China to their fulfillment centers in the U.S. Over and over again, my team worked on customizing our model to Dell's supply chain. The moment the project was over...Dell closed down a factory and jacked the formulation. Now, we had done some things to make the model robust in such scenarios (made factories a flexible set in the ILOG OPL code for example). But nonetheless, the model was messed up, and someone needed to fix it.

And this example was for a relatively large and stable company. Dell sure moves slower than, say, a tech startup. But with each passing year, the young, turbulent company seems more the norm than the old rigid enterprise. The speed at which businesses are changing is accelerating.

And most data science models that are of any degree of sophistication, require stability.

A good demand forecast might need several seasonal cycles of historical data.

A good optimization model requires an ironed out process (manufacturing, logistics, customer support, etc.).

A good predictive model requires a stable set of inputs with a predictable range of values that won't drift away from the training set. And the response variable needs to remain of organizational interest.

Process stability and "speed of BLAH" are not awesome bedfellows. Supervised AI models hate pivoting. When a business is changing a lot, that means processes get monkeyed with. Maybe customer support starts working in different shifts, maybe a new product gets released or prices are changed and that shifts demand from historical levels, or maybe your customer base changes to a younger demographic than your ML models have training data for targeting. 



Whatever the change may be, younger, smaller companies mean more turbulence and less opportunity for monolithic analytics projects.

And that is not primarily a tool problem.

A lot of vendors want to cast the problem as a technological one. That if only you had the right tools then your analytics could stay ahead of the changing business in time for your data to inform the change rather than lag behind it.

This is bullshit. As Kevin Hillstrom put it recently:
In other words, it's very hard for sophisticated analytics software and techniques running on "big data" to run out in front of your changing business and radically benefit it.

The most sophisticated analytics systems we have examples of run on stable problems. For example, ad targeting at Facebook and Google. This business model isn't changing much, and when it does, it's financially worth it to modify the model.

Airline scheduling. Oil exploration. High frequency trading.

For a model operating on these problems, the rules of the game are fairly established and the potential revenue gains/losses are substantial.

But what about forecasting demand for your new bedazzled chip clip on Etsy? What about predicting who's a fraudster lurking within your online marketplace? Is your business stable enough and the revenue potential high enough to keep someone constantly working on "analytics at the speed of big data" to use a model in this context? 

Analytics at the speed of meat and potatoes

You know what can keep up with a rapidly changing business?

Solid summary analysis of data. Especially when conducted by an analyst who's paying attention, can identify what's happening in the business, and can communicate their analysis in that chaotic context.

Boring, I know. But if you're a nomad living out of a yurt, you dig a hole, not a sewer system.

Simple analyses don't require huge models that get blown away when the business changes. Just yesterday I pulled a bunch of medians out of a system here at MailChimp. What is the median time it takes for 50% of a user's clicks to come in after they've sent an email campaign? I can pull that, I can communicate it. And I can even give some color commentary on why that value is important to our business. (It lends perspective to our default A/B test length for example.)

If you want to move at the speed of "now, light, big data, thought, stuff," pick your big data analytics battles. If your business is currently too chaotic to support a complex model, don't build one. Focus on providing solid, simple analysis until an opportunity arises that is revenue-important enough and stable enough to merit the type of investment a full-fledged data science modeling effort requires.


But how do I feel good about my graduate degree if all I'm doing is pulling a median?

If your goal is to positively impact the business, not to build a clustering algorithm that leverages storm and the Twitter API, you'll be OK.
Read the whole story
rbdixon
2099 days ago
reply
Best quote: On picking the right level of analysis for the business need is "...if you're a nomad living out of a yurt, you dig a hole, not a sewer system."
Atlanta, Georgia
Share this story
Delete

Recap: AirWatch Chairman’s Keynote at Venture Atlanta 2013

1 Comment

Editor’s Note: David Moeller is the CEO of CodeGuard. This is his recap of Alan Dabbiere’s keynote on Day 2 of Venture Atlanta 2013. 

 

Alan Dabbiere founded Manhattan Associates and led the company through a successful IPO in the 1990s. The company is now valued at nearly $2 billion. And Dabbiere is in the process of doing it again. He is the chairman of AirWatch, which raised a $200M Series A round at a valuation over a billion earlier this year. The company currently has 1,500 employees and expects to have 3,000 by the end of next year. His entrepreneurial career, devoid of any failures and containing two grand slams, is so extraordinary it is hard to believe.

 

His keynote at Venture Atlanta has been on my calendar for months. Startups are hard, the grind is tough, and when you’re in the trenches like I have been for the last few years, you look everywhere for strategy, tactics, and perspective that can help you make it a little further. Therefore, when given the chance to learn from one of the best, I jumped at it.

 

The Entrepreneur’s Personal Playbook

  1. Find Your Way. And Master It.
  2. Best Person in the Right Job
  3. Show up. And Listen.
  4. No Excuses

 

The Entrepreneur’s Business Playbook

  1. Define A Market You Can Monopolize: Be a Monopoly
  2. Hire the Right People
  3. Be Willing to Change
  4. Don’t Forget the Carcasses. Differentiate and Endure

 

The Entrepreneur’s Personal Playbook

 1.      Find Your Way. And Master It.

As a high school wrestler, Dabbiere utilized only two moves. Rather than relying upon an extensive repertoire, he focused on developing and refining those two. Even though his opponents knew his two moves, they could not stop him, as his two moves were too effective. He identified a path and then mastered it, similar to the greatest insurance salesman of all time.

 

The obituary of the greatest insurance salesman told a story of a small, quiet, reserved man who would show a flipchart to prospective customers, with 2 pennies taped to the first page, and a $100 bill taped to the next. It was not flashy, nor was he, but his presentation was remarkably effective. That salesman found something that worked for him. Don’t worry about copying others – find what works for you. And then dig in and master it. Also be willing to prepare yourself for future personal development needs.

 

As an undergraduate, Dabbiere realized that communicating to groups might be important in the future. Since teachers routinely addressed crowds, Dabbiere pursued a teaching assistant position in the only subject he considered himself capable, Fortran programming. There are little things you can do that will drive success, and they aren’t necessarily fun.

 

2. Best Person in the Right Job

Manhattan Associates Version 1.0 had a different cast. After subsidizing the company with his own capital, Alan was approached by his four co-founders, who wanted to reduce his ownership from 50% to 20%. He instead offered them 100% of the company and left. These individuals were the wrong people. The right people can be wrong, though, if the stage of the company is not a fit.

 

Alan’s top salesperson from Manhattan came to AirWatch to lead the sales team, but the missionary sales needed – highly educational, lots of rejection, and not lots of sales –  just wasn’t a fit. While Dabbiere absolutely recruited an “A” player, the growth phase of the company dictated the need for a different person. It took Dabbiere five years to grow to 30 employees, and then just three years to grow to 500. The type of person hired shifted as the company grew.

 

3. Show Up. And Listen.

When Manhattan Associates was running low on capital, Dabbiere approached the CEO of Jockey with prototype software, and Jockey International ended up as the first client to deploy the PkMS (Pick Ticket Management System). And in the process, he listened to additional requests the CEO made, which were incorporated into the product.

 

Feedback from customers is different than feedback from those who aren’t buying from you. Starting in 1989, Manhattan Associates leveraged Indian software developers, long before outsourced development became the norm. Many doubted this approach, but Dabbiere didn’t worry about the naysayers, as the income from paying customers spoke louder.

 

Showing up doesn’t just help to drive sales, it helps to drive morale. Leadership by example is inspiring. At AirWatch, John Marshall and Dabbiere went to trade shows and sold to coffee shops. They did everything they expected of the employees and more, and this helped to drive a performance culture.

 

4. No Excuses.

As the startup CEO, you can change everything. There is no such thing as a bad business. If you have the nicest house in a bad neighborhood, then move. That is your choice. Do something. You can define your market. There are other areas/sub-markets that you can focus on. Be tenacious and don’t give up.

 

Whether at cocktail parties or with customers, Dabbiere’s passion for logistics was unquestioned. What about entrepreneurs without passion for their industry? Develop a passionate hatred for losing and that will get you through. Bobby Knight stated that he had coached many players with “the will to win. But few with the will to practice to win.”

The Entrepreneur’s Business Playbook

 

1. Define A Market That You Can Monopolize: Be a Monopoly

Manhattan Associates started with printing & picking tickets, then scanning for accuracy, and then advanced ship notice. The important thing is that they did not pursue these in parallel, but in series – sequentially. They started with a beachhead niche they could own. This allowed them to declare victory in the territory they defined. By executing a narrow and focused strategy, they developed a monopoly, similar to conquering Australia in the game “Risk”.

 

2. Hire the Right People

There are three types of people: (1) those that can’t get it done, (2) those that can get it done, but need direction, and (3) those that can get it done with no direction. It is members of the last group that are essential in the early stages. At AirWatch there is little hierarchy and no “VP” titles. This is intentional as they attempt to only hire the self-starting type of person. Hire people who will ask for forgiveness rather than permission. Micromanaging isn’t needed if you hire the right people: “Don’t buy a dog and bark for it”, Dabbiere says.

 

How do you get the incredible 3rd type of people? At Manhattan, Dabbiere was intentional about utilizing recruiting to create a mystique around the company. He “over-recruited” and rejected most candidates. This created an aura of exclusivity that Manhattan was the place to go. Dabbiere would bring potential hires on sales calls to meet him, and this was a differentiator. Other tactics involve hiring for passion in the industry and pursuing hard workers.

 

And when thinking about where to hire, Dabbiere advocates looking at Atlanta for three reasons: the time zone allows for greater productivity, the airport provides easy access to customers, and Georgia Tech is a tremendous feeder for engineers.

 

3. Be Willing To Change

“The fish that follows every shiny thing it sees in the ocean will starve.” Be willing to pivot but don’t chase everything. While attending tradeshows for Wandering WiFi and learning a really tough business, wireless networks management for small businesses, Dabbiere and Marshall discovered a new potential business – they identified mobile device management as a sector with explosive growth. And seeing the potential they went for it. Sometimes there is too much planning and focus on business plans, says Dabbiere. Be willing to throw the plan out of the window. React. Sense and see what is happening and adjust.

 

4. Don’t Forget the Carcasses. Differentiate and Endure

Companies that forgot to grow, scale, market, and leverage what they do will end up as carcasses along the roadside; companies that did not know how to differentiate. There are many, many carcasses. What is one reason that Dabbiere thinks Manhattan did not become a carcass? Differentiation in messaging and focus.

 

What was the differentiator at Manhattan? Pick, pack, and save labor? That is what all of their competitors stated. But Manhattan “guaranteed compliance for the top 100 retailers”, and this contrasted starkly with their competitors. And they communicated their differentiator to their existing and potential customers. And it worked.

 

Manhattan Associates succeeded in differentiating themselves, but they did not stop with owning a niche. They added product lines, bought businesses, and took risks, growing the business. They had a real message and willingness to scale, and sometimes that isn’t enough.

 

There will be bad days and bad periods. From 1990 to when Manhattan IPO’ed in 1999 there wasn’t a single bad day. Profitable from day one, there had not been any missteps. Failures, though, are an important part of developing resilience, says Dabbiere. It was tough for the team at Manhattan after the IPO when they had bad days. They didn’t know how to deal with them at first, and now embrace those types of challenges, as a means of increasing resiliency.

 

Summary

Dabbiere delivered. His credibility allowed him to reach through the noise and speak truth to the technology community of entrepreneurs, investors, and service providers. He provided a thorough execution guide, and answered the questions his talk generated. Hiring “A” players isn’t a new strategy, but Dabbiere provided tactics: generate exclusivity, differentiate in recruiting, and leverage your strengths. Again and again, he challenged the crowd – don’t just find your way. Master it. Don’t just find your niche. Scale. And he never said what the entrepreneurs were thinking – “If you are scared it can’t be done, I’m proof.” Be tenacious and don’t give up. Make Dabbiere proud.

Read the whole story
rbdixon
2554 days ago
reply
Best quote: “The fish that follows every shiny thing it sees in the ocean will starve.”
Atlanta, Georgia
Share this story
Delete
Next Page of Stories