stay buried, voodoo kitten

stay buried, voodoo kitten

all the things she sent me
inhabit an empty box
in the bottom drawer.

all that's left are memories
of laughing fits amidst
sweat deposits, joy sex.

hidden are the feelings in
the timeline of change
from when we were same.

claw out my eyes with your
loving fingers to let me
be better blind to your love.

fasten now the black halo and sing
a song for my covered ears,
I am deaf to your trembling tone.

blame not my actions in passing
through this race to the inevitable
dead end. we can still be friends.

Security, Privacy, and Policy in a Web 2.0 World: Privacy

Privacy in a Web 2.0 World

Along with security, the introduction of the Web 2.0 has produced a number of user privacy issues. As has been mentioned, many Web 2.0 applications are dependent on user contribution. Such contributions reveal individual pieces of information about the user. When these individual pieces coalesce a number of additional conclusions regarding the user can be deduced. This sorting of relevant user data is often referred to as data mining. Data mining techniques are commonly used by enterprises to improve business and organizational intelligence, however often done so unbeknownst to the user. Data mining can also be used perniciously by those wishing to fraudulently pose as someone else.

Many also feel data mining imposes on one’s privacy and challenges our individual civil liberties. Just recently the National Security Agency (NSA) has been criticized for warrantless surveillance and unlawfully obtaining phone records from a number of large scale telecommunication companies in efforts to combat terrorism. These records were used as tools to devise connections regarding possible terrorist activity. However, many privacy advocates feel this government effort overstepped its boundaries and jeopardized the constitutional rights of U.S citizens. The NSA warrantless surveillance controversy made it blatantly apparent how powerful data mining is and the degree to which it can affect an individual’s privacy.

The coming of Web 2.0 has also spawned a number of new online communities called social networking sites. A social networking service develops on online community for those who share interests and who are intrigued to explore the interests of others. Such Web applications are composed of various mediums for users to interact including messaging, email, chat, blogging, discussion groups, and video or file sharing. These social networking sites generally leave users the option to disclose as much information regarding themselves as they like. As a result, many users are revealing too much personal information not consciously acknowledging the number of potential problems that may arise.

Daniel Solove, a law professor at the George Washington University Law School, discusses in depth a number of significant privacy issues induced by Web 2.0 social networking sites and the evolution of the information age. In his “Taxonomy of Privacy” paper he focuses on four main privacy issues including information collection, information processing, information dissemination, and information invasion followed by the individual problems associated with each primary issue. Some of the main problems that arise corresponding with the Web 2.0 world include unknowledgeable surveillance, uniquely identifying information, secondary use, disclosure and exposure, blackmail, and distortion.

Unknowledgeable surveillance simply refers to the observation of an individual by a third party without informing or obtaining proper consent from the target individual. Instances of unknowledgeable surveillance that become public such as the government’s warrantless surveillance controversy install fear, anxiety, and discomfort in individuals. What if a similar scenario such as the NSA controversy were to take place in the Web 2.0 world?

As we know, many Web 2.0 applications are dependent upon the contribution of user data. What if, hypothetically, these Web 2.0 organizations began to unknowingly share and amalgamate user data from their individual user data pools? They’d be able to data mine immense sums of user data and learn significant information about individual users including their habits, likes, dislikes, vices, etc. But wouldn’t these organizations have to acknowledge this was going on and inform users in their privacy policy? Yes, but chances are it’d be done so inconspicuously. Besides, these organizations regulate themselves so who knows if they’re actually following through with there privacy policy verbatim. Also, how many individuals do you know that actually take the time to read over an organization’s privacy policy before making an account and contributing to the site?

The next privacy issue surrounds exchanging and protecting uniquely identifying information. Uniquely identifying information refers to any form or forms of information that directly correspond to a single individual. Obvious examples include credit card and social security numbers because they are unique to a single individual. Solove states that such identification material “enable us to attempt to verify identity—that the person accessing his/her records is indeed the owner of the account or the subject of the records.” Such uniquely identifying information is very powerful and often sought after by cyber criminals.

In today’s Web 2.0 world users may expose information that can be used to uniquely identify themselves. Social networking sites like MySpace and Facebook leave it to an individual user’s intuition in determining what personal information to publish. It’s conceivable to believe that some of this information disclosed could be rapaciously used to carry out acts of fraud, blackmail or stalking. It’s important for such Web 2.0 sites to protect there users and make sure they don’t reveal too much personal information.

The next Web 2.0 privacy issue worthy of discussion is that of “secondary use”. Solove defines secondary use as “the use of data for purposes unrelated to the purposes for which the data was initially collected without the data subject’s consent.” It is most commonly associated with targeted advertising. In today’s Web 2.0 world a user may submit or contribute some form of data that may reflect his/her particular interests. That user data may be sold or distributed to a third party in order to customize advertisements to better entice the user as a potential consumer.

Instances of secondary use can cause a number of problems. “It creates a dignitary harm, as it involves using information in ways to which a person does not consent and might not find desirable. Secondary uses thwart people’s expectations about how the data they give out will be used” (Solove 520). As a result, users may submit falsified information if they suspect there information will be re-used for other purposes. Such contributions of inaccurate data take away from the beauty and resulting benefits of Web 2.0 application use.

The last privacy issue worth looking at is the concept of distortion. Distortion is defined as “the manipulation of the way a person is perceived and judged by others, and involves the victim being inaccurately exposed to the public” (Solove 547). Inaccurate user data, whether it is submitted by a user or a user’s peers, can dramatically influence the way in which society views an individual. In many cases distortion can result in embarrassment, humiliation, and harm to one’s reputation.

It isn’t difficult to see what potential role distortion of user information can play in our Web 2.0 world. On Facebook or MySpace, if inaccurate data is out there regarding an individual it is accessible to a vast number of other members in the community. Web 2.0 increases the speed at which information can be disseminated meaning an individual’s distorted information can spread rapidly. This makes it very difficult for users to fix their data and get the correct information out there. Users must be careful and monitor the way in which their information is shown and portrayed. It is important to understand that once information is out in cyberspace there’s no turning back.

house of lies and laying

house of lies and laying

The adulterous chimbley sweep
keeps his secrets as safe as his
chimbleys are barren. Karen is
the tenant of 110 North Ave with
her doting dolt husband and her
two and a half children. He met
her when she needed a friend
but instead got a daytime bedmate
who leaves by the end of banker's
hours. The sweep keeps his
appointments but always makes
time for his loveless jaunts up
and down the body of the lost
mother. He once came across the
children who had been let go early
from classes due to blaring sirens
not heard by either false lover. He
picked up his bucket and broom
and played it all cool, but his heart
for the first time beat unevenly
since he'd met the distant lady and
entered her house of lies and laying.

Security, Privacy, and Policy in a Web 2.0 World

I'm currently working on a paper for grad school titled "Security, Privacy, and Policy in a Web 2.0 World". I've decided to post it here in three individual parts, the first corresponding to security, the second to Privacy, and the third (as I'm sure you can guess) Policy in the Web 2.0 world. Without further ado here's the first part of the paper regarding security issues. Note: A full bibliography of sources will be included with the final installment.

---------------------------------------------------
Security, Privacy, and Policy in a Web 2.0 World - Part 1

Introduction

Today’s information age has spawned new digital mediums for rapidly exchanging and disseminating data efficiently throughout the world. Never before has society seen such a yearning for information and the means to go about effectively distributing it. The Internet has provided a ubiquitous gateway for users to implement newly developed tools (Web applications, Web services, etc) that dynamically facilitate the circulation of data. This increased use of Web applications and Web services coincidentally results in the increased distribution of user data. As a result, the need to ensure user security and privacy has never been more prevalent.

Web technology and applications have evolved drastically in recent years. The once static Web has progressed into a dynamic setting with increased user interaction. These dynamic Web applications use client-side scripting to add active elements to the user interface. Recently there has been a significant change in how software developers and end-users implement and use these dynamic Web applications and the Web in general as a platform. This new platform is commonly referred to as “Web 2.0”.

According to Tim O’Reilly, founder of O’Reilly Media, Web 2.0 is defined as “the business revolution in the computer industry caused by the move to the internet as platform, and an attempt to understand the rules for success on that new platform.” The Web 2.0 concept is somewhat ambiguous considering the majority of the technology components used have existed for some time now. Regardless, the term has exploded upon the web community and is considered the next generation of the web.

A number of questions arise surrounding this newly contrived platform. Firstly, how is Web 2.0 portrayed amongst businesses, organizations, and standard internet users? O’Reilly states one “can visualize Web 2.0 as a set of principles and practices that tie together a veritable solar system of sites.” It enables users to better contribute and harness collective intelligence from these once overwhelming Web 1.0 “solar systems” of information. As we know, hyperlinking is the foundation for exploring the web. The Web 2.0 platform improves upon the simplistic hyperlinking concept and enables users to better supply and distribute information more effectively. “Much as synapses form in the brain, with associations becoming stronger through repetition or intensity, the web of connections grows organically as an output of the collective activity of all web users” (O’Reilly).

Businesses and organizations are beginning to proficiently grasp ways to best utilize the newly developed 2.0 platform. It’s become apparent that access to raw data simply doesn’t cut it anymore. Rather instead, the way the raw data is manipulated and analyzed to formulate intelligent conclusions is where the information gold lies. CNET chief development officer, Mark Lewis, states in his July 2007 editorial “When Web 2.0 meets information infrastructure” that “data is not information unless you can find it. But information can't be applied to knowledge in the absence of the means by which to use it. Access must yield meaningful information in order to turn bits of code into valuable and actionable business information.” This information generally provides businesses and organizations the knowledge to determine how to better appeal to and best serve their consumer base.

Additionally, the Web 2.0 platform has become considerably more dependent upon user interaction. Sites such as YouTube, Flickr, Wikipedia, and Digg, as well as social networking sites like MySpace and Facebook rely solely on contributions from users. This increase in user contribution and the dissemination of user information results in a number of privacy issues raising concerns. More than ever, users need to be careful with how much personal information they release. They need to be concerned with how their data is being mined in regards to personal preferences, hobbies, activities, etc. They need to realize that information they release on blogs and forums is accessible to anyone. They need to make sure information they release for one purpose isn’t being used for additional purposes. Most importantly, users need to fully understand and grasp the true significance of privacy issues raised from the newly contrived Web 2.0 world.

Along with privacy, Web 2.0 has also introduced a number of new security issues. Such Web 2.0 sites give users the ability to work with and manipulate data stored on company servers providing extra functionality on the client side. Such sites rely heavily on scripting languages such as JavaScript, Flash, and AJAX making use of the client computer, increasing responsiveness of the application, and reducing server workloads. This additional work being done on the client side results in a number of new threats and attacks companies and organizations need to be aware of. With all the private user information being stored including social security and credit card numbers, security needs to be a primary concern.
The Web 2.0 platform is very powerful, useful, and beneficial on many levels. Its advantages and uses appear to be endless. However, it is important to look at how the coming of Web 2.0 has spawned a new focus in the security industry while simultaneously having signified the importance of user privacy.

Web 2.0 Security

In late 2005 Samy Kamkar created what is now considered the first Web 2.0 worm. The elusive, self-titled “Samy worm” could not be blocked by a firewall and spread so quickly it caused the owners of MySpace to temporarily shut down the site (McMillan). The Samy worm represented a new generation of Web attacks capable of compromising the Web 2.0 infrastructure. It placed significant emphasis on the need for improved security in the Web 2.0 world.

Kamkar says, while looking for a way around MySpace content posting restrictions he discovered a flaw in the way the code had been written. The bug enabled Kamkar the ability to control the browser of anyone who visited his profile. Once the bug was spread from Kamkar’s profile to another user, that user unknowingly had the ability to infect those that were to visit their profile. Within hours the worm originating from Kamkar’s profile page had spread to nearly 1 million additional MySpace users forcing the site to shut down. It is important to realize, the Web 2.0 user connectivity aspect of MySpace enabled the worm to spread at such a rapid rate. Kamkar’s worm is a primary example of the possible unexpected consequences that arise when Web site operators grant users the ability to contribute to their Web properties (McMillan).

The true problem of Web 2.0 security relies on how a user’s browser interacts with the Web. Originally desktops and Web servers were not securely designed to work together. Web 2.0 is placing more responsibility on the interaction between these machines in order to perform new, exciting things for the user. However, these uses differ from their original electronic publishing roots and security strains are beginning to show through.

The main issue with Web 2.0 security lies in the ability for users to run scripts passed site filters. The new platform is so heavily dependent upon user-generated components and client-side functionality that it is difficult for such sites to maintain security over all of the interconnected pieces; interconnected pieces not originally intended to work together. “Now you’ve got multiple gates to defend.” says Seth Bromberger, information security manager with Pacific Gas and Electric Co. in San Francisco. Following are a number of the most common security issues and Web 2.0 attacks with brief explanations as to how they work.

Cross-site scripting (XSS) in AJAX – Cross-site scripting enables an attacker to run malicious JavaScript code from a flawed Web site on a victim’s browser thus compromising information. The Samy worm is a primary example of such an attack in which poorly written AJAX code, which is executed on the client-side, was flawed leaving an opening for an attacker to inject and execute code on a victim’s browser. What makes this attack so troublesome is the fact that AJAX code is executed on the client-side. An attacker simply needs to convince an unsuspecting victim to visit a certain page susceptible to script injection. Cross-site scripting (XSS) has been around for some time, but increased AJAX use in the Web 2.0 world adds a whole new facet to it.

Malicious AJAX code injection – When looking at this attack it is important to know how AJAX calls work. AJAX calls are made silently thus when using an XMLHTTPRequest (XHR) object an end-user would have difficulty acknowledging the fact that the browser has made a call in the first place (Shah). An XMLHTTPRequest is simply an API used by browser scripting languages to transfer XML data between the client-side and server-side using HTTP. XHR is used by most Web 2.0 sites to improve upon responsiveness for dynamic web applications. So, when the browser makes an AJAX call it logs cookies for each request. An attacker could potentially use silent AJAX code from a malicious site to fetch a logged cookie (from a different site) that may possess critical information and then have this information sent back to the attacker’s server.

Client side validation in AJAX routines – AJAX routines are commonly used to do a great deal of work on the client-side primarily corresponding with data and form field validation. It is important that these client-side validation checks also be placed on the server-side as well yet many developers fail to do so (Shah). In many instances attackers can bypass client-side AJAX input validation routines simply by making HTTP POST and GET requests directly to the Web application. These often leave openings for common attacks like SQL injection that could potentially result in the release of vulnerable database information. Again, it’s very important developers validate user input on the server-side as well as the client.

XML Poisoning – Web 2.0 applications often send XML traffic back and forth between the server and a user’s browser. This transportation of XML block data leaves an opening for an attacker to seek out possible ways to “poison” the data being communicated between the user and the server. For instance, an attacker may inject an XML block with a malicious recursive function which produces similar XML nodes over and over again (Shah). This injection of such a recursive function can potentially lead to a denial of service (DoS) on the server. A DoS attack is used to overwhelm a server or other computer resource and leave it unavailable to a potential user or users.

Some attackers use XML poisoning to attack Web services. Web services use a protocol known as SOAP (Simple Object Access Protocol) for exchanging XML messages. Attackers may maliciously modify the parsing logic of a SOAP message (which is essentially just an XML message) to carry out some malevolent act and jeopardize the integrity of an original message.

Lastly, XML poisoning can also be used to modify the XSD or XML Schema. The XSD is an XML document used as a set of rules for other XML documents to conform to. XML documents must adhere to a specific XSD to be considered valid and properly used by the Web service. XML poisoning can potentially allow an attacker to manipulate and change execution flow thus resulting in the compromise of Web service data (XML documents, SOAP message, WSDL documents, etc).

WSDL scanning and enumeration – WSDL (Web Services Description Language) is an XML-based language used to provide a model for describing how to communicate using Web services. WSDL files provide significant information regarding a Web service including technologies used, methods implemented, invocation patterns, etc. Often times Web service developers keep unnecessary functions or methods open in WSDL files which can be detrimental to a Web service if manipulated by an attacker. It is imperative that developers properly limit access to WSDL files as well as close and/or dispose of unnecessary functions.

Web services routing issues – Web Service routing or WS-routing is a specification that provides syntax for defining the end-to-end routing path of a SOAP message. WS-routing transports a SOAP message asynchronously across a variety of protocols (including TCP and HTTP) with a header entry in the SOAP message for determining where it is to be sent (network world). An attacker could potentially use a man-in-the-middle attack (MITM) to intercept these SOAP messages in mid transport and jeopardize the security of the data.

XPATH injection in SOAP messages – XPATH is a language used to query and manipulate XML documents. It can be compared to SQL in that one provides certain parameters and fetches rows and columns of data from a database. These XML documents feed web applications with the data they need to function properly. Often times, these web applications take input from end users and create an XPATH statement to retrieve the necessary data from an XML document. An attacker could potentially inject these XML documents with a malicious XPATH statement and bypass application authentication. Developers can combat XPATH injection with proper input validation before passing authentication data to an XPATH statement (Shah).

RSS / Atom injection – An RSS (Really Simple Syndication) feed is used as a tool to publish frequently updated content. It usually displays headlines from recently posted news stories or updated blog entries. RSS feeds are very commonly used amongst a number of Web 2.0 sites. These feeds are sent from the Web application to the client browser leaving open the opportunity for injection of malicious JavaScript. Often the malicious JavaScript can be written to steal session cookies or install software (such as a Trojan or rootkit).

RIA thick client binary manipulation – Rich Internet Applications (RIA) are powerful user interface features that add richness to Web 2.0 applications. Some RIA tools include Flash, Applets, and Active X tools. Shreeraj Shah of Net-Security states that “the major issue is with session management since it (the RIA client) is running in browser and sharing same session. At the same time since the entire binary component is downloaded to the client location, an attacker can reverse engineer the binary file and decompile the code. It is possible to patch these binaries and bypass some of the authentication logic contained in the code.” Attacks such as this are more difficult than others and generally only done by the most experienced reverse engineers.

Technologies such as AJAX, RIA, RSS, and Web services provide new opportunities for developers to construct a more effective, user friendly, web environment. However, these new development tools and services comprising many Web 2.0 applications invoke a number of new security issues in need of attention. These risks appear to be manageable; however it is important for businesses and organizations to have proper security measures in place at the early states of development for Web 2.0 applications (Ferguson).

the machine takes a break

the machine takes a break

Adam took a load off, took a seat
beside that tree, relieved his feet
that had strolled the sheeted ice
turned growing garden paradise.

He spoke briefly to a wiggling pig,
then sent him off embarrassed, in
the dust of his own pink filth, after
the curl of its tail incited laughter.

Bent backwards with his tripod arms
holding strong, his relaxation harms
no one. He's a pure flesh automaton
without any risk of being put upon.

moon goddess, i am aware

moon goddess, i am aware

let's speak sooner. let's not delay
this cat and cat game, i don't see
any mice at our feet, our paws;
our pauses for dramatic aeffect:
we're two progressives too quick
for such slow southern dialect.

reject standard manners and mores,
sow the seeds of mutual appreciation.
we'll kneel by the creek and wash
our storied overalls with the rocks
we chucked to accomodate new crops.

let's work all day and dance all night
by the light of parked tractor's beams.
let's sing a story to the moon goddess
and let her bless our hearts' harvests.

i know your name, galactic guy

i know your name, galactic guy

don't try to hide behind the guise
of just another displaced poolboy.
i know who you are, i know your name.
you're an animal spirit, you're a madam's toy.

don't draw out the clogs, don't skim
the thin top layer of unmentionables
left floating out for you to find from
the night before, a tuesday night.
who has such a rager on a tuesday?
widows are windows, so transparent.

realizations are naturally after the fact,
so while bending and stretching and flexing
under the white hollywood sun, you don't
even feel a tinge of self-awareness.
she fondles the soda bottle top.

but i know your name, galactic guy.
yours is mine and we share like brothers.

night lightning, yr in deep treble

night lightning, yr in deep treble

what blankets the dream's cape
of the agoraphobe's night terrors?
does she dream realistically of
a claustrophobic's best memory?

answers from nowhere shower
down around the curious boys.
they were taught not to learn,
but rather to hear and accept.

when the burning night lightning
cracks out and thunders down
on unsuspecting antennae, who
explains these scenes to them?

a father's tongue can't fuzz quite
the same as a radical amplifier.

their there

their there

what's the quickest
way to get there from
here? she posed

hardly a pause
for response.

just add
the 't', said she.
what a kidder.

it's moments like those
that he thinks about
later at night when he's
alone, and the phone's
off, and the screen is
empty, and he thinks
about those things then.

the 't' for her, as it
seemed to him, used
to be he. and he is too
himself, thanks to years
of therapy, now to let
her, she, carelessly rob
him his happiness and
faith in expectations.

and then at night, later,
there's nothing left to do
but thank the good word
for its total possession.

dumbest miss teen USA response ever

kings' mothers' children

kings' mothers' children

who told the pearly gates
operator they could let
you in? something was
lost in that translation.

drizzling kingly king doing
those things he'd been
entrusted to enforce. hell
rained on any interference.

ninety nine smiley smiles
line the fence looking in.
they want access to the
mortal sin negating machine.

good luck with that, says
a total saint, i mean a real
good guy - even g-d likes
him - that's sayin' something.

word of the day

aberrant (adj) -

1.	departing from the right, normal, or usual course.

2.	deviating from the ordinary, usual, or normal type; exceptional; abnormal.

(noun) -
3. an aberrant person, thing, group, etc.

G'mornin' Moon

G'mornin' Moon

such bizarre fantasies
overwhelm me, standing
across the street from
the run-down flea-market.

partial consignment, part
of a rich capitol plan on
behalf of those pack-rats
who finally hit rock bottom.

would they understand my
anger? would they claim to
be my friend and then help
me anyway? who needs 'em.

the street lights are under lit
by the orange reflecting highway
that I'm wandering down, hardly
sober. I forgot the concept of time.

and my watch stopped years ago.
if a stranger appraised my gait
and felt safe to pose the conceit,
I'd just point at the sun, dumb.

Dearest Prudence

Dearest Prudence

Dearest Prudence, she's got the willow
trees in attendance looking down on
her, urged by the breeze with its blow
to her embrace by the light of dawn

it's a standard scenario. nature tries
selfishly just the same as humans do,
to be accepted and reflected by
all other inhabitants beautiful.

her face breaks the plane of a puddle
left behind by a late night's rain,
leaving it flustered by her mere
presense, becoming a shivering mirror.

her laws are as much a paradox as
her beauty. she lives to give it all
as her own natural charity. just one
sidelong look is enough to enthrall.

word of the day

engender (verb) -

1.	to produce, cause, or give rise to: Hatred engenders violence.

2.	to beget; procreate.

everywhere science

everywhere science

a starving Darwin ate the last of
an endangered species to survive
and to prove his point. It's not like
they have fast food on that island.
unless you consider the cheetah.

a torn flag is a new flag, and Darwin
saw this to be true, as he'd seen
similar truths before - as he'd seen
them his whole life. an open doorway,
minus the door.

rainbow leaves fell down and he
categorized each new leaf according
to species and religious pertinence.
how could he have foreseen
supertankers and the spruce moose?
such discoveries, inventions, make
a mockery of aviary importance.
birds have a bone to pick with
the wright brothers.

word of the day

burgeon (verb) - to grow or develop quickly; flourish. to put forth, as buds.

groggy ole jesus, sleep fiend

groggy ole jesus, sleep fiend

don't disturb jesus' sleep.
he's not a morning person.
before he's had his coffee
don't tell him anything.

don't tell him the world
is falling apart. don't tell
him to get destroyed tar.
it isn't resonant coupling.

jesus puts his robe on just
the same as everyone else.
one divine leg at a time, tied
off with gifts as gold tassles.

the seperation came when
the disciples saw him buying
beer for the underage kids
without even a fake I.D.

what would it say, anyway?
I'm Jesus from Palestine.
I was born on the first day.
is that a long enough time?

chameleons' day parade

chameleons' day parade

the sun sets on the redacted range.
place blame on those false tenants
who tickled pink flowers glowering.
retreat your feet from following.

shipwreck beach is being reopened
as my trial begins without witness.
fire ants dance for campers witless,
carrying carrion: cumbersome carcass.

mascara shoulders memories replaced,
glad shambles line my pauper's coat
kiss ramifications emerge after the fact
chameleons memorize lines of the act

a big swing from the bambino begins
the motion of turning in the dream-
province of a pre-teen tomboy. She
wets the bed when she feels ashamed.

inmates bemoan their botched robberies
while rotting away, while passing the time,
while timing the pass with broken-glass
faced wrist-watches. they're living to last.

lucky to see the city for the buildings,
clinging to the tire-swing with intent.
when the train stops the forest keeps
moving. the black eye's a merit badge.

greatness

needs salt

needs salt

Alice! Alice! butchers from all over
adjust their stained aprons, stop
the drop of the cleaver to holler
your name from building tops.

they yearn to be burned with your
stinging salvation. preserve their fresh
cuts of heart. use every part. cure
their wounds, pour down on their flesh.

relinquish their need for forty thousand
camels. afford them the years to make
it all better; make it up to you. stand
and stay at the back gate for their sake.

reveal any seal, any approval, any sign
to account for the time, the desire, lost
acquiring only the best cuts, the prime,
they live to deliver, any obstacles crossed.

word of the day

nefarious (adj) - extremely wicked or villainous; iniquitous. Synonyms: flagitious, heinous, infamous; vile, atrocious, execrable.

la nouvelle classe

la nouvelle classe

It's the new class. It's cheap beer
brewed in summer's rain gutters,
cheese sticks, smiles with a sneer.
calcium deposits, hearts aflutter.

it's long sleeves rolled up, it's flip
flops like letter carriers, it's being
broke and broken, living on tips,
smoking the lint, it's dimly seeing.

it's a glass half full of horseshit, it's
a reinvention of intension, pleasure
delaying as art, and art: making hits,
taking hits. it's a glam-slum leisure.

it's a cesspool of those 'friend of a friends.'
a culture afflicted with winter anxiety.
collection of enemies, immune to the end;
low level g-men with sidecar fantasies.

it's the bright day sun and dark glasses,
it's wine glasses and the hot night lights,
it's saving it all up for next weekend,
and flailing like a madman in the fight.

journey to the center

journey to the center

sin's inside. it sits behind your eyes,
behind your smile, your crooked toes.
it blinds bystanders, it's only distraction,
the mask it bares is regaled with a rose.

it dug down deep and made due of the
dark corners of your conscious conscience.
kicked out the old inhabitants and set up.
The black curtains were no coincidence.

you read books like, "how to make magic,"
and "short stories set in ever expanding time."
you feed the spiritually homeless with a hot
plate, a 'you're welcome', and 'you're mine.'

your inescapable mind
spies an opposite situation,
sees an ease and safety in
substituting white lies
as solutions.
cases closed.

your careless spree has robbed me in many
ways, but what you actually have given back:
a view of your true colors. They're ugly colors,
the kinds no one likes. Blacker than black.

who's a dead dog?

who's a dead dog?

The whole wide world's gone off its rocker.
The singer has want for no solos. no bows
or bound roses, ovations or after-parties.
The giant becomes a shut-in, up in his hut.
He's still ill-tempered, but sees no need to
exert any energy, or exhaust his zen-state.
The happy ending has now been replaced
by a relatively adequate middle section
extending forever, to the narrative edge.

five mikes' in a car; speeding literally
up the perfectly planned freeway
(big ups to that particular civil engineer)
eating liquorice and smoking hashish.
Mike who's driving answers his phone,
"the baby weighs forty pounds? I still
can't believe the baby has three arms.
you'd think they'd see something like that
in the sonogram. knees for feet? jesus."

the mike with the hat takes it off. Now
he is indistinguishable from the others.

In the corners of the mikes' eyes, a sign.
It's passing quick but readable in that
blurry kind of way. it reads: "Save us,
Save a life, Save yourself." None of the mikes
know what that company is trying to sell.
The radio blares radio songs. Those kind
parceled down to the lowest common
denominator: You know, those hits. None
of the mikes' know the words to the songs.

A dead dog on the side of the road smiles
and gives a wink, with its one eye left, over
to the passing car. The crawly creatures
eating away at his innards all shake their
behinds and do a ceremonial dance for him.
A rainbow made up of all the colors no one
really likes explodes from the dog's eye,
straight up into the stars. The singer reclaims
his ego but loses his voice, and the Giant falls,
slips off a watery sprout, hitting all the branches
down the descent from the great stalk. The autopsy
done indicates, however, he was dead when he fell.

word of the day

hapless (adj) - unlucky; unfortunate; luckless. Synonyms: miserable, woebegone, wretched, forlorn, pathetic, pitiable.

Digital Watermarking and Steganography

Interestingly, only a couple days after having posted my steganography demo there's been quite a bit of news regarding digital watermarking as a new replacement to the DRM techniques being used today. cnet has the story...

So what's watermarking? It's the insertion of extra data into an audio stream that can help identify where that audio came from. It's not enough to attach data to a digital audio file--users can just burn that file to a CD and then re-rip it, changing the file format and stripping off all the data associated with the original file. (This is also the classic way users get around DRM.) Instead, the data is inserted into the audio track itself. It's inaudible to human ears, but detectible by various other tools.

only joe at the scarecrow saloon

only joe at the scarecrow saloon

It's a late wednesday evening, well
alright, i'll be honest, it's more like
an early afternoon in August. I spell
my name correctly and get the gold
star; The black-light karaoke vixen
steals me, and i'm inside like she
invented the wheel. What a looker. I mean
she knew what to do with a tool-kit,
she could fix anything. Some sad biker
eyes a fire extinguisher intently, he
spends his final dime on a dry draft,
but owns a wealth of pain; A bike named
Nancy, and an ex-wife with the same. He
loves that hog, man alive. Now his eyes
tell tales of when he saw Empire at the drive-in
as a kid with his Pop, and he serious considers
a deep freeze vacation; maybe Nancy will
reconsider and return, to melt him back to life.
So I grab a seat and start doing the half-ass
grandstanding I'm regionally famous for.
I'm chewing the ear of any unfortunate soul
in range to hear. My sad story. My torn sweatshirt.
My mixed emotions over last year's archives.
The moral is that it just doesn't make sense,
for everyone to get a standing ovation,
for no one to feel the various shades of black.
I see that crow across the street; he can't
help but feel fear when lifting up from
his gourmet carcass to view the few
anchored tramps I've managed to fool.

what i'm currently working on

probably won't be many posts from me until i finish a paper that i'm currently working on for grad school. the goal is to have the paper completed and posted here by Friday the 24th (we'll see how that goes). below is the outline and the direction in which i plan to proceed. any feedback/suggestions would be very much appreciated :::glaring skeptically at the five readers that come here:::

Security, Privacy, and Policy in a Web 2.0 World

I. Introduction

A. Few brief statements of the need for security and privacy in today’s information age and increased use of web applications.

B. Description of how web applications have evolved. Explanation of changes in ways software developers and end-users use the web as a platform, the arrival of Web 2.0.

C. Explaining what Web 2.0 is and how it is portrayed amongst internet users.

D. Brief focus on the security and privacy issues surrounding Web 2.0

E. Thesis/Primary Topic Questions: How has the coming of Web 2.0 spawned a new focus in the security industry while simultaneously signifying the importance of user privacy?

II. Body

A. Brief intro of how security and privacy are affected by Web 2.0 feeding into the body of the paper. Mention of the Samy worm of 2005 that spawned the need for a Web 2.0 security movement.

(http://www.pcworld.com/article/id,131215-c,browsersecurity/article.html)

“Hansen, and a group of like-minded white-hat researchers, believes that we're only beginning to see what can go wrong when the security of the new generation of collaborative, Web 2.0 applications gets tested.”

B. Security

1. AJAX issues – AJAX XSS, Malicious AJAX code injection, client side validation in AJAX routines

2. Web Services issues – XML poisoning, WSDL scanning and enumeration, web service routing issues, SOAP parameter manipulation, XPATH injection in SOAP messages

3. Miscellaneous – RSS atom injection, RIA client binary manipulation

(http://www.net-security.org/article.php?id=949&p=1)

(http://networks.silicon.com/webwatch/0,39024667,39168148,00.htm)

4. What are some steps that can be taken to reduce such attacks?

C. Privacy

1. Social Networking Sites – People may disclose too much information leaving the susceptible to fraud, identity theft, stalking, blackmail, extortion, pedophiles etc.

(Solove - http://papers.ssrn.com/sol3/papers.cfm?abstract_id=667622)

2. Increased User interaction with sites and other users – Forums, blogging, social book marking. All mediums enabling a malicious individual to learn more about potential targets.

3. Secondary Use – User information meant to be used for one purpose, used for additional purposes (leading to targeted advertising).

4. Data Mining – Users submitting data may be subject to the science of extracting useful information from large data sets or databases.

D. Policy

1. Security

a. Evaluative Penetration testing

b. Proper Auditing

c. Input Validation

d. Educate developers

2. Privacy

a. Improved Privacy Policies

b. Get away from self-regulation. There needs to be some form of compromise between self-regulation and moderated regulation by a larger governing body (similar to the EU).

III. Conclusion

negative numbers

negative numbers

suddenly, two brutes bust in
from out of nowhere and
start pushing me around.
they say, "what do you do,"
not, "how do you do?"
they want answers, fast.
I nearly faint twice, but
maintain homeostasis.
"I'm a writer, burly sirs,"
I manage to muster.
"writah!" they chortle.
They dance a dance
for my foolishness,
and declare, "dumb kid,
all the money's in numbers."
you alphabet your life it is.

details of the ex-spy's private funeral

details of the ex-spy's private funeral

don't bother asking why I was invited,
I couldn't say anyway: sensitive information,
and though the day's sun kissed flowers delighted -
it's not the kind I'd choose to be buried on.

tall pines cast shadows across the casket's door
as mysterious mourners held down their stare
but noticed every detail of the moment; more
to do with military training than acute despair.

a young boy wearing a beret was introduced
by his mother as 'little X Jr." X's parents,
themselves, were absent, it's true to assume
Gran passed in labor and Pop was a vagrant.

The widowed Mrs. X read quiet the final
prayer - fighting off tears, but lost eventually
and wept before the end, leaving silent,
frozen men with 'fill-in-the-blank' divinity.

Steganography: What is it? Demo and Walkthrough

What is Steganography?

Steganography is defined as the art and science of masking hidden messages in a manner only intelligible to the messenger’s intended receiver. Steganography differs from cryptography in that the existence of the message itself is disguised and unknown to the general observer. In today’s information age, instances of steganographic use generally incorporate the hiding of digital information within various digital files (image, audio, video files).

What is Steganography used for?

Steganography is primarily used as a means to communicate and maintain the confidentiality of private information. A steganographic message is concealed behind a form of covertext. The covertext is simply an apparent message (text, video, audio) acting as a facade, used to conceal an actual steganographic message.

Steganography can also be used for digital watermarking which is a technique used to add hidden copyright and verification material in digital audio, video, or image documents. This idea of digital watermarking is primarily used to combat various forms of copyright infringements.

Instances of steganographic use are powerful and diverse. Along with legitimate uses like digital watermarking, steganography can also be used as a medium for carrying out illegal activity. For instance, individuals may use steganography to distribute child pornography. Drug dealers may use it to exchange drug trade information. Terrorists may use it to covertly devise and carry out devastating attacks. These malevolent uses of steganography enable one to grasp the significance of the concept and acknowledge its importance in the information security field.

Steganography Tools

There are basically two main types of tools in the field of steganography. First, there are the tools used for creating and stealthily deploying hidden steganographic messages in digital files. Secondly, there are tools that are used for steganalysis. Steganalysis is the art and science used to detect hidden steganographic messages in digital content. A steganalysis tool is generally thought of as a forensic statistician used in determining which files, if any, contain a hidden payload.

Steganographic Example and Walkthrough

GIF-It-Up v1.0 is a freeware tool one can find over at www.stegoarchive.com that can be used to inject into/extract hidden data from GIF images.

Step 1: First decide what data it is you wish to hide and then determine which GIF image you wish to hide it in. I’ve chosen to hide the text from the Declaration of Independence in a GIF image of San Francisco.

San_Fran.GIF

The Declaration of Independence

We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator with certain unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness. — That to secure these rights, Governments are instituted among Men, deriving their just powers from the consent of the governed, …

-------Continued---------

Step 2: Run the GIF-It-Up V1.0 program, go to File->Open, and select the image you wish to hide the message in.

Step 3: Once you’ve opened the image in GIF-It-Up go to Inject/Extract->Select file to inject and select the file whose content you wish to have hidden in the image. (In my case, the declaration of independence in the image of San Francisco)

Also, if one so chooses, they have the opportunity to encrypt the text file before hiding it in the image. Simply go to Encryptio->Use Encryption. In this case, when the text is extracted from the image it will be encrypted requiring the user to decrypt the cipher text. This simply adds one more additional layer of security in order to maintain the integrity of the original message.

Step 4: Lastly you’ll want to extract the message from the image to make sure it worked correctly. Go to Inject/Extract->Specify name to extract and give the output file a name. I’ve chosen to name my output file declaration_of_independence.txt and save it to my desktop.

Step 5: Check and confirm that the hidden text was successfully extracted from the GIF image.

Concluding Points of Interest

-It is important to note that the GIF image injected with the hidden text is actually a little smaller than the original. A better steganographic tool would be more discrete, with an inconspicuous change in file size.

Original: 566 KB (614,166 bytes)

Hidden: 599 KB (613,846 bytes)

-With a tool like GIF-It Up, it is in one’s best interest to use a one way hash function to encrypt the original input, that way you'll have a smaller resulting string to inject (anywhere from 6 to N characters depending on the hash function used). The resulting hash output will have fewer characters than the original message; fewer characters means fewer bits injected into the file thus resulting in a less discernable change in file size.

-Steganography tools like GIF-It-Up usually work by storing information in the least significant bits of digitized files. These bits are modified inconspicuously making the changes very difficult for an individual to detect.

-The advantage of steganography over cryptography is that the message itself does not attract attention. With cryptography, the existence of the message is known despite the fact that it may be difficult to decrypt. With steganography, the existence of the message itself is unknown. Only the sender and most likely the intended receiver are aware of the hidden message’s existence.

emotional economy, message digestion

emotional economy, message digestion

Nothing's personal; it's all business.
Take a lesson from your leaders.
They've listened;they know you don't want
a political dictator or totalitarian state.
All people just want to live free
and have what they want, a nice steak
and a fresh street paved yearly,
while you dictate their needs
through appeasement of greed.
The world's in your hands
when you've got 'em by the green,
by the plastic, by their stomaches.

The Government's a sugar daddy,
coming home late with lipstick all over
and others' fates signed, resigned
above that thankless bottom line.

"Who needs what we've got?"
"Who took what we gave?"
Form a long line behind the laws
they told you to ask for, passed,
and used to make you slaves.

Mirna's walkin' to work

Mirna's walkin' to work

Under the umbrella of the melting sky
Mirna yawns, puts on her 'gosh!'-socks
and walks out, oblivious of any eyes
on that late afternoon, early August.

Swishing and dancing past the bums,
barbed gates scraping at her ankles.
She just smiles: seeing the yellow sun
turn her blood a hot strawberry blonde.

She's gorgeous, and bruises up and down.
She's been known to go with the kind of guys
who had a full beard in the womb,
and would consider a dead dirt-bike
in their bed as the ultimate threat.

But she's got no time, not even for them
now, She's just a bang-flash wild smile
and a vague memory of way-out socks.

she's just your typical post-apocalyptic girl,
she's got it all behind black shades paradise.

drowning circus

drowning circus

"If the audience ever
appears detatched
use the World's Fair,
it's good for a laugh."

instructed the ringmaster
to the fumbling clowns
at the first drowning circus.

So they piled in, 20 in all.
The clown car, improbably small.
Oversized shoes and round red noses
pressed against the windows.

A honk was heard, but not from the horn
as the motor sputtered and wheel turned,
moving forward toward the ring,
already inches deep in tears.

that last act was
a show-stopper.

The audience wasn't expecting
such a grande finale, the car
pulled into the center,
and the laughter and cries
exploded immediately.

Certain younger members
were the first to float away,
carried on by the tide of
their parents' hysterics.

Their fates were sealed
with the onset of rain,
their gag flowers were useless,
their seltzer guns in vain.

no home cooking

no home cooking

she - with the scar
from that thing
with the car,
that accident -
she says, speaking
of somebody else -
something she
said to him:
"don't even try
to be all nice
to me now."

I'd heard that one before, too.
Sitting in with the opposing team
I now see the nods of sincerity,
batting gloves holding shoulders,
genuine caring, friendship even.
my heart through my eyes
can't subscribe to the gray glare
shades drawn slowly across
the view from the other side:
the way first-person can be
so overwhelmed over there:
where the lights hit you right
at those particular times
during the day, season, year.

I now understand
why I was so bad.
I now know why
it was easy to lie.
and in those moments
when you're not up,
but you see
others' errors
as your own -
you just want to dig in
deep with your joy spur
and ride fast fast fast
back home

just one...

just one...

just one
of the few
little differences
between
her and a puppy:

no puppy I've known
has even once said:
"thanks for the bone."

ex, ex, oh, oh!

ex, ex, oh, oh!

'the convicts couldn't control themselves.'
it's the truest verse in the whole new bible.
it speaks to all the one singular people.
it's the much hyped debut of the next big thing.

like how my reminders are just
as good as a stage on a cinema,
put up but utterly useless,
especially during
working hours.
and how my closet's just a space
for keeping holey clothes, old worn shoes,
knick-knacks, forgettable memories,
and scary monsters.

If it were all up to me,
I'd be mighty down.
I'd feel like brave failure,
I'd fear being reduced
to a billboard for myself.

That's why we keep God's time
in the fashion of the little hand.
Marching purposefully
with just our reasons,
despite no one actually
ever yelling, "start!", or
firing some funny pistol.

It'd be much easier to be
if we all just started over.
it'd be like fitting the first shape
in that formerly perplexing toy.
it'd be like knowing the feeling
of grains dropping down on you.
it'd be like seeing ex's
together again.
ex, ex, oh, oh!

word of the day

phlegmatic (adj) -

1.	not easily excited to action or display of emotion; apathetic; sluggish.

2.	self-possessed, calm, or composed.

3.	of the nature of or abounding in the humor phlegm.

Synonyms: stoical, cool, cold, uninterested, dull, torpid.

learn from the burnouts

learn from the burnouts

I'm so self-defeating,
I'm like all the drugs
you do, when you forget
to finish the rest.

I'm so narcassistic,
I sit in front of the mirror
adjusting my focus
to better my self-image.

I'm so blue and orange.
I am so breathing and
full of oxygen, I am
a giant burning man.

but I've grown tired
of my own fires;
I am now working towards,
rather - aspiring silently,
to be burnt in effigy.

the second greatest generation

the second greatest generation

a massive fake wading pool packed
with artificial waves and smiles
high fives, low fives, straight-laced denials,
spray-on tans under the sun.

there's an endless lazy river
traveling nowhere but over there,
the consumers are buying the cancer,
a mass march of subliminal victims.

convivial queens eye me queerly,
but not in the good way from them,
like I'm just a half-blood member
of their fashionable anti-establishment.

when it really comes down to it,
Andy Rooney's a raving looney,
Gary Glitter's still a kid toucher,
and Hugh Downs just aint
down for shit anymore.
wash me in their trench memories,
wash me in their glory, their gore.

us chumps who got dumped

us chumps who got dumped

it's sung as an anthem:
us chumps who got dumped
with hearts held for ransom
sit lonely, sit stumped.

it's sung as duet:
since we neither know how
to relive when we met,
we let go for now.

it's sung as a chorus:
we're destined to lay
in graves they made for us
at the end of this day.

it's sung as a solo:
I see past the sunset
I know now what you know
I live to regret it.

kabul beauty school dropout

kabul beauty school dropout

I took a class after the Fall
to spurn the mold that held us all,
(that held my hair, that jailed my stare)
to be born more, to sweep the floor.

to grasp the shears, erase the years,
display my face, untie my ears,
resign my time beside the shrine.
in second term I learned the perm.

my classmates eyed the daring styles
and trends in western magazines,
but I was lost, adrift in seas
of frost-tipped ends and satin weaves.

I skipped my class and traveled back
to where I was brought up.
I stared with fright into the glass.
I couldn't see myself.

wholly holy

wholly holy

half of what i say is lie,
the rest has managed to defy
my original intentions,
becoming cockeyed truths.

I'll be sitting solemn,
vacantly skimming
the atlas of women
in appeasement of
the syrup heads,
with all my lies
hanging nigh
like a black halo,
when suddenly
I need to leave.

on breaks, in back rooms
an astringent figure lurks,
hauling off ominous boxes.
my sherlock side kicks in:
maybe it was him
who writ the glyphs
on the quartlerly reports.

word of the day

iconoclast (noun) -

1.	a breaker or destroyer of images, esp. those set up for religious veneration.

2.	a person who attacks cherished beliefs, traditional institutions, etc., as being based on error or superstition.

way-out in the workplace

way-out in the workplace

pausing a mere moment,
discerning the cliff-drop
of flesh fibers from her
glamorous last defense.

the dialogue drags on
in one and out into
nowhere, an audience
of the deaf and desk-set.

as in older hours, with
an apparent air-grabbed
gravity, she resigns,
"I'm a divorced person."

way-out in the workplace,
we exhume dark futures,
clutching vices like drugs,
and drugs like new days.

word of the day

feign (verb), feigned - to give false appearance or impression. "He feigned illness to avoid going to school."

Message Digesting

I was given a link to this cool message digesting tool and decided to do a quick little write-up on the topic. This is low level explanation and doesn't get into the mathematical inner-workings of hash functionality simply because it's incredibly difficult to understand/teach. I still have nightmares about working through one-way hash functions in my senior year crypto class. Anyway on with the show...

What Are Message Digests?

A message digest is a cryptographic one-way hash function used to convert an input message (or string) of any length into an output string of a certain fixed length. One-way hash functions are designed in such a way that reversing the process or finding a string that hashes to a given value is incredibly difficult. This resulting fixed length sting is dependent on the type of hash function used. A private key is used to encrypt a message digest creating a digital signature used for electronic authentication.

Example

Message:	Specific Hash Function:	Output:
“This is a test.”	Adler32	29970524
“Test.”	Adler32	05ac01cf
“This is a test.”	CRC32	c6c3c95d
“Test.”	CRC32	c67bfe13
“This is a test.”	MD5	120ea8a25e5d487bf68b5f7096440019
“Test.”	MD5	f4020e91252aafd4b18d8acd17f883db

Important to note in the above examples; despite the difference in string lengths for the given message data (‘This is a test.’ - 15 characters, ‘Test.’ - 5 characters) the corresponding hash function output messages have the same – fixed - string length (Adler32 – 8 characters, CRC32 – 8 characters, MD5 – 32 characters).

What are Message Digests used for? What is a digital signature? What is a checksum?

Message digests are used primarily as a means to determine the integrity and authenticity of a file. Message digests determine authenticity by acting as a digital signature or checksum. A digital signature scheme simply refers to cases in which asymmetric cryptography is used to provide a signature for a message in digital, rather than written form, authenticating a sender of a message (can also be used to authenticate the receiver).

A checksum, a commonly used term in the telecom and network management field, is a lucidly simplistic concept that effectively protects the integrity of data by detecting errors in data transmission. Typically a checksum works by adding up the given bit components in a message and checking them again upon the message’s arrival, making sure the values are still the same. This assures that data was not lost or modified in the transmission.

In a perfect word

In a perfect word

Imagine the endless avenues
of thoughts stalled
daily due to
searching for
the perfect word.

I must spend hours,
literally hours, sloshing
the backwoods of my
abused mind like a
stubborn explorer,
positive he left a crumb trail
at the path by that
one particular tree.

Conversations can stretch
for weeks, and I can somehow
retain the constant
numbing pain,
but not the word.

I've forgotten friends
and earned enemies
in pursuit of the perfect word.
I've forgiven criminals
and feigned accusations
out of honest exhaustion.

I've mired
in a muddied redundancy,
staring blankly
ahead at nothing,
but always searching, always...

'discipline'!
the word was 'discipline.'
Now please excuse me,
I have some calls to make.

word of the day

noisome (adj) - offensive or disgusting; harmful or injurious to health Synonyms: putrid, mephitic.

ex-clam nation!

ex-clam nation!

betray your biases.
what have
they done
for you
lately anyway?

they've cloistered your command
and empowered your false resolve.
I bet they wouldn't even notice
if you left them all alone to their own
pitied pigritude; not watched or
bothered, see if they even
open one window,
let alone a whole door.

they're the innate government
you're so aesthetically against.
you're enabling your own graocracy,
but you're not even that old yet.

betray your biases. they'll never
thank you for it later,
but who would expect them to?
certainly not someone
like yourself.

climate control

climate control

it's ultimately intelligent
to limit your daily
climate intake.

you can really only handle
so much. each new
day is a thousand
fresh memories.

and what with all the trees/
people/ animals/ animal-people
you meet in between;
it's quite taxing.

take a break; relax.
remember you don't have to.
there's just one law to break:
limit your climate intake.

word of the day

myriad (noun) - a very great or indefinitely great number of persons or things. Synonyms: innumerable.

po-mo po-em

po-mo po-em

this is a poem. it rhymes.
this poem is not for sale.
but it can be bought or sold
or traded or stolen.
we grow old to forget
and forget to grow old.
this poem reminds.
this poem rhymes.

this poem has no poet.
this poem can't be read.
this poem is blameless
like authorless words
and an island
like one night.
this poem is everything/nothing.
this poem is a stone.

this poem is a code.
this poem is a door.
this poem is a poem;
an invincible beacon.

glossary of the unknown

glossary of the unknown

send and receive
the tableu in action
the unmade bed
the face traced
with a broken finger.

she said to treat her
like a construction vehicle.
she said to watch her
through binoculars.
she said to speak
in dumb demonstration.
she said to believe
it was all just a dream.

send and recieve
last year's calendar
the empty dresser
the lengthy letters
that can't be revised.

she said to feel free
like star-spangled despair.
it seems like a Sunday:
must be the rain.

Symmetric, Asymmetric, and Hybrid Encryption

Symmetric Encryption: Symmetric encryption, also known as single-key and/or private-key encryption, uses a secret key (could be a number, a word, a random string of characters) as a means to modify or mask the content of a given message. A “key” in cryptography simply refers to a piece of information used in completing the operation of a cryptographic algorithm. The key is a necessary tool for encrypting messages and decrypting cipher text. It should be noted, private-key encryption schemes are generally more efficient and less computationally expensive.

Symmetric encryption is the oldest form of encryption and has been used for thousands of years. Former Roman emperor, Julius Caesar, often used various symmetric encryption methods to conceal messages from his enemies. One such method, the rotation cipher, is now commonly referred to as the “Caesar Cipher”. The rotation cipher simply substitutes letters from the alphabet with other letters based on a certain key length.

Symmetric Encryption Example: Rotation Cipher – Key - 2

A

B

C

D

E

F

G

H

I

J

K

L

M

N

O

P

Q

R

S

T

U

V

W

X

Y

Z

C

D

E

F

G

H

I

J

K

L

M

N

O

P

Q

R

S

T

U

V

W

X

Y

Z

A

B

What is most important to understand with symmetric encryption is simply that the same key is used for both the purpose of encrypting and decrypting messages. The use of one key can often make the encryption/decryption process far less complicated. However, there is potential danger in using only one key. If an attacker or man in the middle is able to intercept a symmetrically encrypted message and determine the key, he/she now has the ability to both encrypt and decrypt messages. With this knowledge, an attacker can deceive both the original sender and receiver.

Asymmetric Encryption: Asymmetric encryption, also known as public key encryption, is a cryptographic method in which a user has both a public key and private key. The private key is undisclosed while the public key can be widely distributed. These two keys are related mathematically, often through use of large prime numbers. Despite their mathematical relation, the private key cannot be derived from the public key, at least not by feasible means.

Public key encryption is convenient because a sender and receiver can communicate securely without both needing a common secret key. However, public-key cryptosystems are often computationally expensive due to the manipulation of large primes.

With asymmetric encryption the public key is used as a tool to encrypt the message. The message can then only be decrypted with its corresponding private key. An analogy commonly used to represent the asymmetric encryption scheme is a locked mailbox with a mail slot. A mailbox with a mail slot is accessible to the public allowing anyone to drop off a message. The locked mailbox can be thought of as a public encryption tool safeguarding the message. Only the receiver possessing their private key to the mailbox has access to the message.

In regards to security, it is absolutely necessary that the private key remain private. If the private key were disclosed to an attacker he/she would have the ability to decrypt any messages encrypted with the corresponding public key. Message senders using the public key would have no way of knowing their data was being compromised by a malicious attacker with the private key.

Hybrid Encryption: Hybrid cryptosystems incorporate aspects from both symmetric and asymmetric encryption schemes. These hybrid systems amalgamate the convenience of public-key with the efficiency of private-key.

A hybrid system is basically broken down into two separate cryptosystems; the key encapsulation system and the data encapsulation system. The data encapsulation system which holds the message data is encrypted and decrypted by means of private-key encryption, meaning that both the sender and receiver have the same key. The key encapsulation system on the other hand uses public-key encryption as a means to encrypt/decrypt the key data. This key data, obtained through public-key encryption, is used as the private-key for the data encapsulation system.

For long, complex messages, the majority of the encrypting/decrypting work is done by the more efficient private-key scheme, while the lesser efficient, public-key method, is used to encrypt/decrypt the short key value.

Differences in Symmetric, Asymmetric, and Hybrid Encryption Methods

The differences between the three systems are quite apparent and easily distinguishable. Firstly, symmetric encryption methods use just one key. Both the sender and receiver have the same private key which is used for both encrypting and decrypting messages.

Asymmetric encryption on the other hand uses two different keys. One key is public and accessible to all. This public key allows senders to encrypt their messages. The other key used is a receiver’s private key. This private key is used to decrypt a sender’s corresponding publicly encrypted message.

Lastly, hybrid encryption, being its own entity, uses characteristics from both symmetric and asymmetric encryption schemes. Hybrid uses public-key (asymmetric) encryption for key encapsulation and private-key (symmetric) encryption for data encapsulation.

word of the day

diffident (adj) - lacking self confidence; restrained or reserved in manner. Synonyms: self-conscious, abashed.

For the one this one goes out to

For the one this one goes out to

so many impossible things to say.
reaction is your action regardless.
word swords hurled are useless
when wild instincts become behavior.

please cease forsaking, for my sake.
change is easy when stakes are fatal
and hindsight is a prism where
white light is intention
of the myriad mistakes.

now I've lost even nothing.
I own only empty zero
and several savage memories
that husk the underneath:
the maze of my labor,
destruction and error.
my white face - pale and pure,
covered in paint to be made new
just for you before your mantle,
while you stand blank -
like a sailor with no stories.

Time-Travel for Her Birthday

Time-Travel for Her Birthday

Of course
she was born
on the day
of the dead.
it made sense.

But I should have read
between the screams,
seen through the ghoulish teens
drinking cheap beer
and making their scene.
She, dolled up as the devil,
and me, as marty mcfly.
I wish I had stayed in the future,
been spared the snare of my eye.

But I noticed her
watching me.
Our side glances met
awkwardly;
as they should
from two crooks.

In the mirror of that year,
in a daze that seemed real,
I scratched flesh and drew cries
in selfish efforts to feel.

"If we really became
the parts we played,"
thought often the nights
without sleep,
"how is it you still wear
red like it's blood,
but remain
in the pictures I keep?"

AES 256 - pw: !ladesh!

KGXehb9saQTWQMcjPhpeKRqD9cw6zIKQD7/22Efve8xfOkKWzLocsRyBtS8r7WHT
gtPTqtaH3k308szrOE/THeX0DRXi8Q2D+zgP9Q+oTEQoWbk4OkW7JpjV92avJrAp
0ASHS4BbDb3aULBnqlBbGIAqRnRpf91QK1C18YeeGzuulXY0hjEIqsqWUtD8+uqj
tRRKtFHoZccheNT7/PbUWunjha9zmQ3f34ibQY+IolUGJDvk4Zt+NJHVIbEVd6Kg
8xiijEJr3uu665lkBbuTYzJ4GSEmyiOILZeC+6xtGyz2D6lgkLeT362xSv67Iqpu
sct713c3nzVm37JCQ6eYoRrixAe0C0Vt9Iled6GzGUUZE934BMP3qTW7iLiAsEkc
3pNGYZJx6XXDldgX+i5bhAL+pLHyvpRrejWsIHB0lPZcyg1IWmnnew4XUo3NeXWf
G3E0TIFtQs/kgekeEkF3YOxuWbxdFupzfOapWybwiWTYJwdOR7eTQuEIwO6RN5Nb
f/qvwNBOJy0s9RozBylu3x6MC4gRqpZR2rgbovl8uWYlaz4l6fF/peXCDSHWF2KQ
9GtIJ9Try7S7LcXq4LfJcxOzJ7rOq64L7y4ih5RWG+WworxnPtdGmiGXR/xpcfng
hpzPVhxhydj5TbkjlOYbxergYc5cjSXxgETnBhVWVPan2sBlqeH9xm/xfmO4RNLq
u1xLOgN061CO9+76mdpN6iNsvbFrUwLHwM8Ssoc1qZSEjZgZHBMIT74oktIZ2zXv
vId5ZROwaauhh9S7cCfUTn7pyZSZFET8bkIvfV2BqXB/qODLHyKbo5+YH7ipQRIW
3obYtr/WtiCnVtjjb9FA1o3P4heXVAUvI2WqOKd0Wush+IUSMWziwHTNn4OypuhH
9r3oxAT+bmsk3uMq44bCdWMK8n/vxQC+BRhoINfpjlPm2JjUZE4B0aX8/WD+Gbbt
IxnmXrdrZKdbojA03sCrrVfKXAZcFrZ1SE/NC7hx0y8tBaYAzSib6q6+kNUz6JiR
MxqO9EkBe9V90Fg8Qo7J4jYGhOagSr+arV4IRtSNVV0MnFz0bIsiKksED6UKipsS
aLrIp+qxmk8yX9rsMlK/7Q==

word of the day

rarefy (verb) - to make or become thin; to purify or refine. "His logic was weak leading to further rarefy his argument."