Thought of the day

Do what you want and be REAL.

There’s no reason to want everybody to like you. Do what you want and let whatever happens happen. Some people will love you. Others will hate you. That’s fine.

Reference: here

I'll be there

Jackson five - I'll Be There, Show 1972

Lyrics:

You and I must make a pact, we must bring salvation back
Where there is love, I'll be there

I'll reach out my hand to you, I'll have faith in all you do
Just call my name and I'll be there

I'll be there to comfort you,
Build my world of dreams around you, I'm so glad that I found you
I'll be there with a love that's strong
I'll be your strength, I'll keep holding on

Let me fill your heart with joy and laughter
Togetherness, well that's all I'm after
Whenever you need me, I'll be there
I'll be there to protect you, with an unselfish love that respects you
Just call my name and I'll be there

If you should ever find someone new, I know he'd better be good to you
'Cause if he doesn't, I'll be there
Don't you know, baby, yeah yeah
I'll be there, I'll be there, just call my name, I'll be there

(Just look over your shoulders, honey - oo)

I'll be there, I'll be there, whenever you need me, I'll be there
Don't you know, baby, yeah yeah

I'll be there, I'll be there, just call my name, I'll be there...

Will you be there

Artist: Michael Jackson (from the Dangerous album, 1991)

One of my favorite songs by him..

Lyrics:
Hold Me
Like The River Jordan
And I Will Then Say To Thee
You Are My Friend

Carry Me
Like You Are My Brother
Love Me Like A Mother
Would You Be There?

Weary
Tell Me Will You Hold Me
When Wrong, Will You Skold Me
When Lost Will You Find Me?

But They Told Me
A Man Should Be Faithful
And Walk When Not Able
And Fight Till The End
But I'm Only Human

Everyone's Taking Control Of Me
Seems That The World's
Got A Role For Me
I'm So Confused
Will You Show To Me
You'll Be There For Me
And Care Enough To Bear Me

(Hold Me) show me
(Lay Your Head Lowly)
told me
(Softly Then Boldly)
(Carry Me There)
I'm Only Human

(Lead Me)
hold me
(Love Me And Feed Me)
ye yeah
(Kiss Me And Free Me)
yeah
(I Will Feel Blessed)
I'm Only Human

(Carry)
Carry
(Carry Me Boldly)
Carry me
(Lift Me Up Slowly)
yeah
(Carry Me There)
I'm Only Human

(Save Me)
need me
(Heal Me And Bathe Me)
lift me up lift me up
(Softly You Say To Me)
(I Will Be There)
I Will Be There

(Lift Me)
i'm gonna care
(Lift Me Up Slowly)
(Carry Me Boldly)
yeah
(Show Me You Care)
Show Me You Care

(Hold Me)
whoooo
(Lay Your Head Lowly)
i git lonly some times
(Softly Then Boldly)
i git lonly
(Carry Me There)
yeah yeah carry me there
yeah yeah yeah
[Spoken]
In Our Darkest Hour
In My Deepest Despair
Will You Still Care?
Will You Be There?
In My Trials
And My Tripulations
Through Our Doubts
And Frustrations
In My Violence
In My Turbulence
Through My Fear
And My Confessions
In My Anguish And My Pain
Through My Joy And My Sorrow
In The Promise Of Another Tomorrow
I'll Never Let You Part
For You're Always In My Heart.

Smile

Artist: Michael Jackson, 1995 ( originally from the 1936 Charlie Chaplin film Modern Times)

Lyrics:
Smile though your heart is aching
Smile even though its breaking
When there are clouds in the sky, you'll get by
If you smile with your fear and sorrow
Smile and maybe tomorrow
You'll find that life is still worthwhile

If you just
Light up your face with gladness
Hide every trace of sadness
Although a tear may be ever so near
That's the time you must keep on trying
Smile, what's the use of crying?
You'll find that life is still worthwhile

If you just
Smile though your heart is aching
Smile even though its breaking
When there are clouds in the sky, you'll get by
If you smile through your fear and sorrow
Smile and maybe tomorrow
You'll find that life is still worthwhile
If you just smile

that's the time you must keep on trying
Smile, what's the use of crying?
You'll find that life is still worthwhile
If you just smile


"A day without a laugh is a wasted day." ~Charles Chaplin

HMAC truncation vulnerability in XML signature

This blog post nicely explains the HMAC truncation security vulnerability in XML digital signature specification. In short the specification allows to truncate the signature to any length. If this length is too small, an adversary can guess the correct truncated HMAC with a high probability and hence the security vulnerability. Specifically, this leads to authentication bypass or forging.

I am not sure if there exists any security proof about truncation (reduces to birthday attack?). Generally speaking, smaller signature provides a higher entropy and hence less information to the attacker. But at the same time, attacker has to guess only a fewer bits. In any case, the truncation should not be less than 80 bits, since below this length is considered to be vulnerable to brute force attacks with the current computational capabilities of adversaries. What if the truncated length is less than half of the length of original MAC output? Then it is succeptible to birthday attacks.

Are you as an application developer vulnerable to this attack?
If you are using an XML digital signature library that allows to set any arbitrary truncation length, you'll need to enforce a minimum safe length depending on the algorithm you are using. The good news is most of the libraries including XML security library have already provided pathes for this. If you are a library developer, you probably want to release a patch to users.

The road not taken

Two roads diverged in a yellow wood,
And sorry I could not travel both
And be one traveler, long I stood
And looked down one as far as I could
To where it bent in the undergrowth;

Then took the other, as just as fair,
And having perhaps the better claim,
Because it was grassy and wanted wear;
Though as for that the passing there
Had worn them really about the same,

And both that morning equally lay
In leaves no step had trodden black.
Oh, I kept the first for another day!
Yet knowing how way leads on to way,
I doubted if I should ever come back.

I shall be telling this with a sigh
Somewhere ages and ages hence:
Two roads diverged in a wood, and I—
I took the one less traveled by,
And that has made all the difference.
- Robert Frost

(literal interpretation, but not ironic [1])

5 simple steps to minimize insider threats

Insiders who have the trust can abuse this trust. I recently listened to an interview with one of my favorite security experts, Bruice Schneier, on this subject. Every organization can/should take the follow 5 steps to minimize/mitigate insider threats.

1. Have only a few trusted people.
By limiting the number of trusted people, you limit the possible threats.

2. Ensure that the trusted people are trustworthy.
For example, background checks, limiting to citizens, bonding employees, etc.

3. Limit (compartmentalize) the trust each person has.
For example, give the key to her cubicle only not to other cubicles, give only user passwords not root password.

4. Give overlapping sphere of trust (Make it compulsory to require two or more people to get the task (usually very sensitive and can have profound consequences) done).
For example, co-signers, secret sharing schemes, if you are a Knight Rider fan, you must have seen that to activate the self-destruction mode on KIT two people's finger prints are required.

5. Detect breach of trust and prosecute. Auditing is used for this purpose. Having an audit system in place may deter people from breaching trust as well as provide evidence if breached. Whatever system in place should be tamper resistant and provide sufficient details of user actions/behavior.

As you might have noticed, these 5 steps are nothing new, but you'll be amazed that many organizations don't have these basics right.