Fwd: Major bug called 'Heartbleed' exposes Internet data

classic Classic list List threaded Threaded
88 messages Options
12345
Reply | Threaded
Open this post in threaded view
|

Fwd: Major bug called 'Heartbleed' exposes Internet data

Owen Densmore
Administrator

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Re: Fwd: Major bug called 'Heartbleed' exposes Internet data

Carl Tollander
So the folks who compromised your home router are looking forward to quite a harvest when you upgrade all your passwords at once, including those you don't normally use.

Herding buffalo towards the cliff.

On 4/9/14, 9:23 PM, Owen Densmore wrote:


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Re: Fwd: Major bug called 'Heartbleed' exposes Internet data

Owen Densmore
Administrator
For those of us using Twitter, #Heartbleed is getting heavy use, and oddly, there are some good conversations.


On Wed, Apr 9, 2014 at 10:10 PM, Carl Tollander <[hidden email]> wrote:
So the folks who compromised your home router are looking forward to quite a harvest when you upgrade all your passwords at once, including those you don't normally use.

Herding buffalo towards the cliff.


On 4/9/14, 9:23 PM, Owen Densmore wrote:
============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Re: Major bug called 'Heartbleed' exposes Internet data

Barry MacKichan
In reply to this post by Owen Densmore
It is a major PITA. Certificates on affected servers (which include
Amazon EC2 Linus servers) may have had their private keys exposed, so
certificates have to be reissued with different keys. This is,
apparently, a major bottleneck.

—Barry



On 9 Apr 2014, at 21:23, Owen Densmore wrote:

> Worth knowing about:
>
> http://www.washingtonpost.com/news/morning-mix/wp/2014/04/09/major-bug-called-heartbleed-exposes-data-across-the-internet/
>
> Pretty serious crypto flaw.
>
> [image: Inline image 1]
> -- Owen
>
> [image.png]
> ============================================================
> FRIAM Applied Complexity Group listserv
> Meets Fridays 9a-11:30 at cafe at St. John's College
> to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Re: Major bug called 'Heartbleed' exposes Internet data

Owen Densmore
Administrator
Hi Barry.  How would the private keys be exposed?  The pub/priv computation is done locally, right?

BTW: All node servers are secure due to their ssl config turning off the "heartbeat" option.  NodeWeekly:
Node 0.8.x and 0.10.2+ Not Vulnerable to Heartbleed Issue  Popular Node versions aren’t exposed to the Heartbleed vulnerability as the heartbeat extension was turned off in a Node commit a year ago. Yay.
GITHUB

   -- Owen


On Thu, Apr 10, 2014 at 9:51 AM, Barry MacKichan <[hidden email]> wrote:
It is a major PITA. Certificates on affected servers (which include Amazon EC2 Linus servers) may have had their private keys exposed, so certificates have to be reissued with different keys. This is, apparently, a major bottleneck.

—Barry




On 9 Apr 2014, at 21:23, Owen Densmore wrote:

Worth knowing about:

http://www.washingtonpost.com/news/morning-mix/wp/2014/04/09/major-bug-called-heartbleed-exposes-data-across-the-internet/

Pretty serious crypto flaw.

[image: Inline image 1]
-- Owen

[image.png]

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Re: Major bug called 'Heartbleed' exposes Internet data

Owen Densmore
Administrator
Fairly useful scanner software created to test for vulnerability.

   -- Owen


On Thu, Apr 10, 2014 at 10:05 AM, Owen Densmore <[hidden email]> wrote:
Hi Barry.  How would the private keys be exposed?  The pub/priv computation is done locally, right?

BTW: All node servers are secure due to their ssl config turning off the "heartbeat" option.  NodeWeekly:
Node 0.8.x and 0.10.2+ Not Vulnerable to Heartbleed Issue  Popular Node versions aren’t exposed to the Heartbleed vulnerability as the heartbeat extension was turned off in a Node commit a year ago. Yay.
GITHUB

   -- Owen


On Thu, Apr 10, 2014 at 9:51 AM, Barry MacKichan <[hidden email]> wrote:
It is a major PITA. Certificates on affected servers (which include Amazon EC2 Linus servers) may have had their private keys exposed, so certificates have to be reissued with different keys. This is, apparently, a major bottleneck.

—Barry




On 9 Apr 2014, at 21:23, Owen Densmore wrote:

Worth knowing about:

http://www.washingtonpost.com/news/morning-mix/wp/2014/04/09/major-bug-called-heartbleed-exposes-data-across-the-internet/

Pretty serious crypto flaw.

[image: Inline image 1]
-- Owen

[image.png]

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com



============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Re: Major bug called 'Heartbleed' exposes Internet data

Steve Smith
In reply to this post by Barry MacKichan
And some fundamental "truths" about information entropy are even being questioned:
http://newsoffice.mit.edu/2013/encryption-is-less-secure-than-we-thought-0814

And a "new" method offered for generating keys which is reputed to not be vulnerable to brute-force attacks, based on coupled systems:
http://journals.aps.org/prx/abstract/10.1103/PhysRevX.4.011026
http://www.gizmag.com/human-biology-unbreakable-encryption/31504/
https://www.schneier.com/blog/archives/2014/04/unbreakable_enc.html
It is a major PITA. Certificates on affected servers (which include Amazon EC2 Linus servers) may have had their private keys exposed, so certificates have to be reissued with different keys. This is, apparently, a major bottleneck.

—Barry



On 9 Apr 2014, at 21:23, Owen Densmore wrote:

Worth knowing about:

http://www.washingtonpost.com/news/morning-mix/wp/2014/04/09/major-bug-called-heartbleed-exposes-data-across-the-internet/

Pretty serious crypto flaw.

[image: Inline image 1]
-- Owen

[image.png]
============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com



============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Re: Major bug called 'Heartbleed' exposes Internet data

joshua@stigmergic.net
In reply to this post by Owen Densmore
according to 

apparently the bug gives access to 64K chunk of ram on the server.  The private key might be in that chunk,  but probably won’t be…  however you will get different chunks over time so if you wait long enough you might end up with a chunk that has a private key or someone’s password.

—joshua
 
On Apr 10, 2014, at 10:05 AM, Owen Densmore <[hidden email]> wrote:

Hi Barry.  How would the private keys be exposed?  The pub/priv computation is done locally, right?

BTW: All node servers are secure due to their ssl config turning off the "heartbeat" option.  NodeWeekly:
Node 0.8.x and 0.10.2+ Not Vulnerable to Heartbleed Issue  Popular Node versions aren’t exposed to the Heartbleed vulnerability as the heartbeat extension was turned off in a Node commit a year ago. Yay.
GITHUB

   -- Owen


On Thu, Apr 10, 2014 at 9:51 AM, Barry MacKichan <[hidden email]> wrote:
It is a major PITA. Certificates on affected servers (which include Amazon EC2 Linus servers) may have had their private keys exposed, so certificates have to be reissued with different keys. This is, apparently, a major bottleneck.

—Barry




On 9 Apr 2014, at 21:23, Owen Densmore wrote:

Worth knowing about:

http://www.washingtonpost.com/news/morning-mix/wp/2014/04/09/major-bug-called-heartbleed-exposes-data-across-the-internet/

Pretty serious crypto flaw.

[image: Inline image 1]
-- Owen

[image.png]

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Re: Major bug called 'Heartbleed' exposes Internet data

Barry MacKichan
Yes. That is my understanding.
We could put our web store back on line with the old certificate, but it
is theoretically possible* that someone has been able to find the
private key. Right now, we are playing it safe. It it takes several days
for our re-issued certificate to get signed, well...

—Barry

*But unlikely considering that any hackers have several million other
honeypots to hack.


On 10 Apr 2014, at 10:20, Joshua Thorp wrote:

> according to 
> [https://www.schneier.com/blog/archives/2014/04/heartbleed.html](https://www.schneier.com/blog/archives/2014/04/heartbleed.html)
> [http://security.stackexchange.com/questions/55382/heartbleed-read-only-the-next-64k-and-hyping-the-threat](http://security.stackexchange.com/questions/55382/heartbleed-read-only-the-next-64k-and-hyping-the-threat)
>
>
> apparently the bug gives access to 64K chunk of ram on the server.
>  The private key might be in that chunk,  but probably won’t be…
>  however you will get different chunks over time so if you wait long
> enough you might end up with a chunk that has a private key or
> someone’s password.
>
>
> —joshua
>  
>
> On Apr 10, 2014, at 10:05 AM, Owen Densmore
> <[[hidden email]](mailto:[hidden email])> wrote:
>
>> Hi Barry.  How would the private keys be exposed?  The pub/priv
>> computation is done locally, right?

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Re: Major bug called 'Heartbleed' exposes Internet data

Barry MacKichan
In reply to this post by Owen Densmore
http://filippo.io/Heartbleed/ has been invaluable.

—Barry

Our vulnerable servers are all Linux Drupal machines on Amazon's EC2.

On 10 Apr 2014, at 10:12, Owen Densmore wrote:

> Fairly useful scanner software created to test for vulnerability.
> [https://github.com/musalbas/heartbleed-masstest/blob/master/top10000.txt](https://github.com/musalbas/heartbleed-masstest/blob/master/top10000.txt)
>
>
>
>    -- Owen

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Re: Major bug called 'Heartbleed' exposes Internet data

Barry MacKichan
In reply to this post by Owen Densmore
Of course, after our certificate is renewed, we will need to revoke our
current certificate. See this link for some of the consequences of
having millions of certificates revoked at the same time:

http://arstechnica.com/security/2014/04/critical-crypto-bug-exposes-yahoo-mail-passwords-russian-roulette-style/?comments=1&post=26612193#comment-26612193

—Barry




============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Re: Major bug called 'Heartbleed' exposes Internet data

Owen Densmore
Administrator
In reply to this post by joshua@stigmergic.net
The follow-on links are pretty good too.

   -- Owen


On Thu, Apr 10, 2014 at 10:20 AM, Joshua Thorp <[hidden email]> wrote:
according to 

apparently the bug gives access to 64K chunk of ram on the server.  The private key might be in that chunk,  but probably won’t be…  however you will get different chunks over time so if you wait long enough you might end up with a chunk that has a private key or someone’s password.

—joshua
 
On Apr 10, 2014, at 10:05 AM, Owen Densmore <[hidden email]> wrote:

Hi Barry.  How would the private keys be exposed?  The pub/priv computation is done locally, right?

BTW: All node servers are secure due to their ssl config turning off the "heartbeat" option.  NodeWeekly:
Node 0.8.x and 0.10.2+ Not Vulnerable to Heartbleed Issue  Popular Node versions aren’t exposed to the Heartbleed vulnerability as the heartbeat extension was turned off in a Node commit a year ago. Yay.
GITHUB

   -- Owen


On Thu, Apr 10, 2014 at 9:51 AM, Barry MacKichan <[hidden email]> wrote:
It is a major PITA. Certificates on affected servers (which include Amazon EC2 Linus servers) may have had their private keys exposed, so certificates have to be reissued with different keys. This is, apparently, a major bottleneck.

—Barry




On 9 Apr 2014, at 21:23, Owen Densmore wrote:

Worth knowing about:

http://www.washingtonpost.com/news/morning-mix/wp/2014/04/09/major-bug-called-heartbleed-exposes-data-across-the-internet/

Pretty serious crypto flaw.

[image: Inline image 1]
-- Owen

[image.png]

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Re: Major bug called 'Heartbleed' exposes Internet data

Gillian Densmore
Is now a bad time to sugest this might be a 'internet wargames test'?



On Thu, Apr 10, 2014 at 10:47 AM, Owen Densmore <[hidden email]> wrote:
The follow-on links are pretty good too.

   -- Owen


On Thu, Apr 10, 2014 at 10:20 AM, Joshua Thorp <[hidden email]> wrote:
according to 

apparently the bug gives access to 64K chunk of ram on the server.  The private key might be in that chunk,  but probably won’t be…  however you will get different chunks over time so if you wait long enough you might end up with a chunk that has a private key or someone’s password.

—joshua
 
On Apr 10, 2014, at 10:05 AM, Owen Densmore <[hidden email]> wrote:

Hi Barry.  How would the private keys be exposed?  The pub/priv computation is done locally, right?

BTW: All node servers are secure due to their ssl config turning off the "heartbeat" option.  NodeWeekly:
Node 0.8.x and 0.10.2+ Not Vulnerable to Heartbleed Issue  Popular Node versions aren’t exposed to the Heartbleed vulnerability as the heartbeat extension was turned off in a Node commit a year ago. Yay.
GITHUB

   -- Owen


On Thu, Apr 10, 2014 at 9:51 AM, Barry MacKichan <[hidden email]> wrote:
It is a major PITA. Certificates on affected servers (which include Amazon EC2 Linus servers) may have had their private keys exposed, so certificates have to be reissued with different keys. This is, apparently, a major bottleneck.

—Barry




On 9 Apr 2014, at 21:23, Owen Densmore wrote:

Worth knowing about:

http://www.washingtonpost.com/news/morning-mix/wp/2014/04/09/major-bug-called-heartbleed-exposes-data-across-the-internet/

Pretty serious crypto flaw.

[image: Inline image 1]
-- Owen

[image.png]

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Re: Major bug called 'Heartbleed' exposes Internet data

Marcus G. Daniels
In reply to this post by joshua@stigmergic.net
On Thu, 2014-04-10 at 10:20 -0600, Joshua Thorp wrote:

> according to
> https://www.schneier.com/blog/archives/2014/04/heartbleed.html
> http://security.stackexchange.com/questions/55382/heartbleed-read-only-the-next-64k-and-hyping-the-threat
>
>
> apparently the bug gives access to 64K chunk of ram on the server.
>  The private key might be in that chunk,  but probably won’t be…
>  however you will get different chunks over time so if you wait long
> enough you might end up with a chunk that has a private key or
> someone’s password.
>

Not just fraud or identity theft are risks, but lives could be at risk
too...

https://blog.torproject.org/



============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Openness amplifies Inequality?

Steve Smith
In reply to this post by Barry MacKichan
This recent essay by Astra Taylor, with an introduction written by Rebecca Solnit has a decidedly feminist perspective.  Given the huge asymmetry on our own (FRIAM) demographic, I thought this article might be interesting to some here.

She asserts that: “open” in no way means “equal.”  "While the Internet may create space for many voices, it also reflects and often amplifies real-world inequities in striking ways."


Astra makes direct reference to the power-law-distributed nature of web *traffic* with hubs and links which alludes to the general consequences of preferential attachment networks, and other similar systems known to yield power-law distributions (e.g. erosion channels, etc.).    

Despite my own allergic response to strong rhetoric where the "white male" always plays the ultimate villain, I continue to be interested in the topic of gender/racial inequality as a practical matter (I have a wife, two daughters and a granddaughter, and my friends are as likely to be hispanic or native american as lily white).   In parallel, I am also interested in the analysis of social networks as dynamical systems, both in the activity registered on the network and in the formation and evolution *of* the network.

Astra's point that the internet "reflects and amplifies" real-world inequities was very poignant to me, and I think the core of the point.  The digital communication network adjusts various constants regarding time, distance and cost-of-delivery in extreme ways, which in turn can make otherwise relatively *stable* systems relatively *unstable*, or at least out of the time-scales of the human moderators who might have been acting as dynamic balancing elements in the system. 

It is not surprising that the WWW was often referred to as the Wild Wild Web in the early days because it did offer many of the same "freedoms" and "hazards" as the US western "frontier" of post Civil War expansion across the continent.  

I'm not a fan of regulation for it's own sake, nor of quotas, nor censorship, or any of the other obvious "knee jerk" responses to some of the consequences of the inequities which I think I agree come with this kind of open-ness, but that is not to say that I like the inequities even if they are superficially in my favor.  

I'm curious if others here have ideas, opinions or other references that discuss this progressively both as a social phenomenon and perhaps in the abstract as dynamic network form and function?

- Steve

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Re: Openness amplifies Inequality?

Marcus G. Daniels
Astra Taylor writes:

``Those women who do fight their way into the industry often end up
leaving -- their attrition rate is 56%, or double that of men -- and
sexism is a big part of what pushes them out. “I no longer touch code
because I couldn't deal with the constant dismissing and undermining of
even my most basic work by the ‘brogramming’ gulag I worked for,” wrote
one woman in a roundup of answers to the question: Why there are so few
female engineers?''

Women form cliques too.  I'm all for prohibiting all of this (coalition
formation and politics) from the work place, but that's not likely to
happen.  Make it as taboo as sexual harassment.  Some people believe
that this is all part of what gives a team good morale and
communication.  I think that's nonsense.  A good team is made of people
that are engaged in the technical work, and not each other.

My experience is that, in the world of software engineering, women are
often easier to work with then men.  Often they have better listening
skills and better impulse control -- and so there is less of the Not
Invented Here syndrome which plagues so many projects.  But only so many
`family oriented' people will work 12-16 hour days.

Marcus





============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Re: Openness amplifies Inequality?

Steve Smith
Marcus -

Well observed, as usual.

You state:

"My experience is that, in the world of software engineering, women are
often easier to work with then men.  Often they have better listening
skills and better impulse control -- and so there is less of the Not
Invented Here syndrome which plagues so many projects.  But only so many
`family oriented' people will work 12-16 hour days."

When I entered the professional work world, women were already
significantly represented at all levels of Systems/Software Engineering
except maybe management.   During my mid career, many women entered
middle and upper management.  In general I experienced the same things
(better listening skills, impulse control, and other ego-barriers)
compared to men, although, by that time I had mostly arranged to work
with people (men and women) who had transcended most of that, at least
in the context of my teams.

I found women as direct supervisors to be much easier to communicate
with and negotiate the complexities of my own role as
team/project/small-group leader/manager.  While they *could* make the
"hard decisions", they did not seem to feel the need to prove it by
making arbitrary "hard decisions" as some of my male supervisors seemed
compelled to do.  Mine is a very small sample set in a very unique
(National Laboratory) environment, so has little if any more than
anecdotal value.


I'm not so sure about your specific statement:

"I think that's nonsense.  A good team is made of people
that are engaged in the technical work, and not each other."

I do agree that strong cliques may neither be sufficient nor necessary
but anecdotally they do seem to provide some useful side-effects that
support intra-team communication and cooperation.  More than anything, I
find that a "healthy" team can help a new member find resonance with the
teams values and habits (work ethic, quality work product, open
communication, etc.) while an "unhealthy" one can undermine an
individual's natural instincts or choices.

The teams that formed "by circumstance" were often the most effective
and "healthy", the ones formed by "fiat" often never had a chance
(remember the HS habit of making us work in "teams" where there was
always at least  one slacker/bozo?).

In a larger pool of individuals with solid technical skills, a
reasonable work ethic, and a modest sense of quality, I believe that, as
I think you imply, teams can form as needed, independent of any specific
"identity".   I have seen this in action and in at least one case,
watched subteams form and morph effectively  and fluidly from that pool.

I'm not sure what that critical mass is, but it *was* one of the "holy
grails" of SFX, to establish such a pool that could respond to
opportunities quickly, effectively and fluidly.   Of course the work
(and the ability to land it) was also required.  The paradox of chickens
and eggs.

- Steve




> Astra Taylor writes:
>
> ``Those women who do fight their way into the industry often end up
> leaving -- their attrition rate is 56%, or double that of men -- and
> sexism is a big part of what pushes them out. “I no longer touch code
> because I couldn't deal with the constant dismissing and undermining of
> even my most basic work by the ‘brogramming’ gulag I worked for,” wrote
> one woman in a roundup of answers to the question: Why there are so few
> female engineers?''
>
> Women form cliques too.  I'm all for prohibiting all of this (coalition
> formation and politics) from the work place, but that's not likely to
> happen.  Make it as taboo as sexual harassment.  Some people believe
> that this is all part of what gives a team good morale and
> communication.  I think that's nonsense.  A good team is made of people
> that are engaged in the technical work, and not each other.
>
> My experience is that, in the world of software engineering, women are
> often easier to work with then men.  Often they have better listening
> skills and better impulse control -- and so there is less of the Not
> Invented Here syndrome which plagues so many projects.  But only so many
> `family oriented' people will work 12-16 hour days.
>
> Marcus
>
>
>
>
>
> ============================================================
> FRIAM Applied Complexity Group listserv
> Meets Fridays 9a-11:30 at cafe at St. John's College
> to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
>


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Re: Openness amplifies Inequality?

Roger Critchlow-2
In reply to this post by Marcus G. Daniels
So, what's the question here?

You think maybe that the predominance of straight white men in technology is innately right?  That other genders and races aren't capable of doing the job, so all those white male losers and assholes that we have to deal with are objectively the best people for the jobs they hold?

Or are you thinking that maybe all those white male losers got their skills and jobs through some sort of structural inequity that tilted the competition in their favor?  That a kind of in-group altruism is operating here, where white men give each other a pass while agreeing to allow the jerks among them to beat up the women, persons of color, and non-normative gender identities so those uppity not male, not white, not straight competitors have to wade through piles of shit that straight white men never meet?

If you grant that the competition has been tilted in the past and is still tilted the present, by whatever mysterious mechanisms there might be that help some while hindering others, then it's hard to argue that the same mysterious mechanisms won't find their way into the future.

-- rec --



On Thu, Apr 10, 2014 at 12:38 PM, Marcus G. Daniels <[hidden email]> wrote:
Astra Taylor writes:

``Those women who do fight their way into the industry often end up
leaving -- their attrition rate is 56%, or double that of men -- and
sexism is a big part of what pushes them out. “I no longer touch code
because I couldn't deal with the constant dismissing and undermining of
even my most basic work by the ‘brogramming’ gulag I worked for,” wrote
one woman in a roundup of answers to the question: Why there are so few
female engineers?''

Women form cliques too.  I'm all for prohibiting all of this (coalition
formation and politics) from the work place, but that's not likely to
happen.  Make it as taboo as sexual harassment.  Some people believe
that this is all part of what gives a team good morale and
communication.  I think that's nonsense.  A good team is made of people
that are engaged in the technical work, and not each other.

My experience is that, in the world of software engineering, women are
often easier to work with then men.  Often they have better listening
skills and better impulse control -- and so there is less of the Not
Invented Here syndrome which plagues so many projects.  But only so many
`family oriented' people will work 12-16 hour days.

Marcus





============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Re: Openness amplifies Inequality?

Marcus G. Daniels
In reply to this post by Steve Smith
Steve writes:

> More than anything, I
> find that a "healthy" team can help a new member find resonance with the
> teams values and habits (work ethic, quality work product, open
> communication, etc.) while an "unhealthy" one can undermine an
> individual's natural instincts or choices.

I argue that "team values" tend to be an unhealthy concept.  The team
has a goal, and that goal needs to be recognized and pursued -- a
contract or a milestone, etc.  Work toward the goal, don't take undue
advantage or put special burden of particular people to get it done.  
Putting aside fairness and responsibility issues, other values or
affinities (race, gender, recreational preferences) are things that just
distinctions that will create in-group and out-groups, and that (in my
opinion) does more harm that good.  

Doing this will increase diversity of the team, whereas playing the
blacker/whiter/americaner than thou card does the opposite.  What you do
is what should matter, not who you are.

Marcus


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
Reply | Threaded
Open this post in threaded view
|

Re: Openness amplifies Inequality?

Marcus G. Daniels
In reply to this post by Roger Critchlow-2
On Thu, 2014-04-10 at 15:25 -0600, Roger Critchlow wrote:
> So, what's the question here?
[..]
> Or are you thinking that maybe all those white male losers got their
> skills and jobs through some sort of structural inequity that tilted
> the competition in their favor?

There's a third possibility, which is that while there is inequity, the
stereotypical silicon valley brogrammer is actually good at their jobs,
in spite of having this defect.  I would say it is (relative) privilege
that gave them the opportunity to develop the skills they have.  Mostly
what makes software engineers valuable is skill, judgment, and literacy,
and that mostly comes from lots of practice -- which is to say, starting
young.  Being especially intelligent helps, but I think does not fully
replace experience.  

> That a kind of in-group altruism is operating here, where white men
> give each other a pass while agreeing to allow the jerks among them to
> beat up the women, persons of color, and non-normative gender
> identities so those uppity not male, not white, not straight
> competitors have to wade through piles of shit that straight white men
> never meet?

So, if you buy the argument above, then a selection criteria for who to
put in your company is to select someone like yourself: Someone you
understand.  Not for altruistic reasons, but for selfish reasons.  While
perhaps egotistical, it would be a crude way to model how they would
work out.  Credentials like open source experience or education add to
that, but there to there is inequity inherent in those experiences too.
In contrast, doing something unfamiliar could seem riskier.  

Marcus



============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
12345