Light On Dark Water

My World

And yours, too, though you may not know it, every time you read a blog, log on to Facebook, or use a service like Gmail or Hotmail. From an IT trade publication:

Cloud computing builds on automated virtualized infrastructures by using extended management software to deliver environments where users can define, provision, and operate their own services in service models such as IaaS [infrastructure as a service], PaaS [platform as a service], or SaaS [software as a service].

Someday I won't have to think about this stuff anymore. 

The industry likes the term "cloud computing," because it sounds nice and sweet and dreamy and simple. It's anything but. Considered from top to bottom, it might be the most complex thing the human race has yet constructed. The quote above is part of a discussion of a particular set of sub-problems associated with the technology.

Be wary of that free WiFi

I don't know how many people who read this blog are in the habit of bringing their laptop or phone to places like Starbucks and using the free wireless Internet. But if you are one of them, you should read this. If you don't want to bother, here's the crucial part:

Firesheep is an incredibly easy to use add-on for the Firefox web browser that, when invoked while connected to any open and unencrypted WiFi hotspot, lists every active web session being conducted by anyone sharing the hotspot, and allows a snooping user to hijack any other user’s online web session logon with a simple double-click of the mouse. The snooper, then logged on and impersonating the victim, can do anything the original logged on user/victim might do.

"open and unencrypted WiFi hotspot" describes the services offered in many coffee shops and restaurants. If you're able to simply walk into the place and connect without any sort of password, this is probably what they have. 

Here's a blog post by the author of the program explaining that he wrote it in hope of forcing web developers and providers to take the fairly elementary precautions required to prevent Firesheep from working. It includes a few screen shots that will make clear what he's talking about, in case you aren't sure.

There is an important exception to what it can do: if you're accessing a web site that encrypts all traffic, which you can ordinarily identify by the fact that the URL displayed in the browser begins with "https" rather than "http," intercepting the data doesn't accomplish anything for the would-be hijacker, because the data is heavily encrypted. So Firesheep is probably not a danger to your bank account, because financial data is almost universally handled with HTTPS now. But Facebook, for instance, does not. Your email provider may not. Etc. If you're just surfing around, reading the news and whatnot, not doing anything personal or embarrassing, on any site that doesn't require that you log in, this doesn't matter--there is no "session" to hijack.

(Hat tip to my wife, who is becoming quite the technologist.)