Everybody Wants to Rule the World

A couple of days back, the shiri-tori request on the radio was Tears for Fears' "(Everybody Wants to) Rule the World".

I looked it up on youtube and watched the video again, trying to remember what it once meant.

There was a comment in there, somewhere, something about "those wonderful '80s, when videos didn't have to have anything to do with the lyrics."

No way!

The video was very definitely the lyrics.

"Rule the world." was a meme. But it wasn't about trying to control what other people do.

It was about doing what you wanted, even if you really didn't know exactly what it was you wanted.

Looking cool while you were at it was just extra points.

The last decade or so, we've seen a lot of "[X] Rules". This is the exact opposite.

Controlling others, making everybody else join your project, actually being king of the hill, all of that was minus points.

Ruling the world was about ruling yourself.

powerful programming languages -- php5 and suhosin

PHP5 is pretty powerful.

Powerful languages have a problem. They allow things to happen that the language designer hasn't even imagined. Some of those things sometimes allow mean-spirited sorts of people to attack servers, steal credit card numbers, and make general malicious mischief.

So PHP version 5.3 needed a band-aid, to help the naive web programmer avoid blowing him/herself away with good intentions poorly implemented. The band-aid was called "suhosin".

Unfortunately, the three German engineers who developed suhosin seem to have gotten busy doing other things, according to this post at Arch Linux. And the current suhosin doesn't match the current version of php5. [update: If you fail to follow all of the links Pierre provides, at least look at this mailing list post from one of suhosin's developers.]

I had been thinking about brushing up my php skills, so I had installed php. With the upgrade to 5.4 in Debian wheezy, suhosin doesn't load. Instead, it fills my error log files with complaints of incompatibility.

So I checked, and nothing else gets removed when I remove php5. So I removed it.

When I really need it again, I'll install it again. Maybe by that time the guys who run php will have folded all of the functionality of suhosin into the language itself.

But this is not a solution, it's a knee-jerk reaction. More first-aid fixes that don't really do the full job.

This highlights one of the problems in software architecture: The power of a powerful language is in its expressiveness. To the more expressive a language is, the fewer limits there are to the things which can be expressed in it. But security in current practice requires setting limits. We need to give the programmer power, but we need to take power away from the end user.

There is an inherent conflict here. I mean, sure, we could go the direction taken with Java, using execution policies to tune the expressiveness available in the end-user's context, but that has its own set of traps --

• Will some of the programmers remember to set up the policies?
• Do the programmers understand how the policies are used to secure the system?
• Does the policy end up preventing the end user from doing important things?

It is interesting that there are parallel issues in law, regulation, and government policy.

• Do legislators understand the interaction with law and regulation and the potentials for abusing the laws and regulations?
• How does the government protect the people's security without inducing more chances for treacherous abuse?
• And how can a government make the people secure without excessively limiting their freedoms? 

Systems have complicated interactions. The more complicated the systems are, the more loopholes (ergo, vulnerabilities) they have. This is a known problem with systems, and it applies as much to computer systems as it does to bureaucracies.

The answer of the US Constitution was "Use checks and balances and keep it simple." Both of these principles have been long ago set aside as legislators and special interest groups press for responsive government.

Is there something wrong here?

Can we as general members of society learn enough about systems to pare back the legal kruft that is currently overburdening (and overly burdening) society (and is a primary cause of budget problems, not to mention the bureaucratic abuses that show every sign of continuing to increase)?

Can these principles be applied to computer systems? If they can, how?

I think they can, but I'm not sure anyone reading this would understand. (I'm not intending to insult. No one has time to study every necessary subject, and this particular subject has been advertised by certain special interest groups as unnecessary.)

And it seems no surprise to me that the current trends in systems design seem to be going towards increasing complexity in the provided systems, which parallels the political atmosphere, and is exactly not the solution. Precisely what we should not be doing.

We put power in the end users' hands (quite literally with the new crop of portable information devices that match the supercomputers of a few years ago). We spend a lot of money, time, and effort putting power in the end users' hands. Then we spend a lot of money, time, and effort trying to limit that power to some definition of "right" uses. We are

• Not trying to teach the end user how to use the power wisely. 
• Not trying to show the end user how to get around the traps.
• Not trying to give the end user more power to do right things.
• Not really trying to give the user solutions, just things that we can sell as if they were solutions

We (that is, the primary movers of the industry) don't want to teach the end user anything that would allow him or her to practice the intellectual property that the system designers' (investors and accountants) think should be making profits for the providers.

We can't understand everything the end user wants to do, and we can't predict what would be "safe" or "dangerous" beyond making crude and overly broad walls. (We, as an industry, try to make straitjackets, really, but we fortunately tend to fail to get the user into the straitjackets -- Fortunately, indeed, since success would make us unable to even consider band-aids like suhosin.)

And we (the primary movers of the industry) don't want to believe that end users could really want to use our systems, any more than we want to believe that the end user could understand new and appropriate ways to use our systems.

We don't want to believe that the end users might be smarter than the system designers about what the end user wants to do with the systems.

And yet, it is the only the smart end user that can safely use the system.

Uhm, no, I don't have a happy solution to the problems yet, at least no quick, straightforward patches. The only real solution I can see is not going to be quick, not going to contribute immediately to anyone's bottom line of monetary profit, not going to be considered acceptable to any of the current crop of investors, managers, and accountants.

Putting people in jail for our own misunderstanding.

I should be writing a post on my math and English blog about simple series. Or exercising.

I'm thinking about weev.

Being put in jail for a non-crime under one of the many laws that turns the US national laws into a mockery of law.

And the CFAA. 

How can you respect law when laws like this exist?

Well, okay, specific laws that can't be respected have existed forever. Or, at least, ever since humans started trying to codify law.

Respect for law requires not getting your internal systems tangled up about specific laws that cannot be respected.

Analogy time: Grammar.

People do not speak according to rules of grammar. Grammar exists as our collective attempts to explain how people speak. Explaining how people speak is not, in and of itself, necessary, but grammar is very useful when you try to figure out what people have put in writing, when they aren't around to explain it themselves. (Well, putting in writing includes audio tracks in this modern world.)

Grammar also helps you dig into your own deeper motivations, when you look at something you said or wrote and wonder why?

Tying the analogy to the thought people do not behave according to the laws that people write down. Legislated law exists as an attempt to help us understand, post-facto, how society should respond to what people do. You can't tell whether any particular act will be good or bad until after the act is done. (Often, well after.) That's why the US Constitution is supposed to prevent laws that would make it possible to charge people with crimes they haven't yet committed.

Supposed to. But that is not directly the topic of this rant.

Bad law exists. It always will, as long as humans write law.

We don't want to just turn a blind eye to bad law, but we also don't want the existence of bad law turn us against law-in-general.

I have lots of friends like weev, people who live significant parts of their lives in deliberate contradiction to the written law. If we put all of them in jail, I would be awfully lonely out here.

Yeah, I mean, from the odds I calculate, if we send to jail all the people who have deliberately done things as bad as what weev has just been sentenced for, there would be more people in jail than not.

Examine yourself and ask, have you ever put unknown persons at risk for deliberately breaking a "minor" law, or a law that "should not be a law"?

Putting people at risk is not the question here, the law, and your attitude is the question. The risk is the reason for the question.

If weev should go to jail for the part he played, so should the engineers who designed the database he casually walked into.

Hmm. Put scare quotes on that: "engineers" so-called.

No. Let's not judge them until we can judge their managers. Chances are that management at AT&T played a significant part in putting that travesty of a database live on the web.

They broke laws. Deliberately. For profit, or, at least, to avoid losing the profits somebody in the company had irresponsibly projected. Yeah, we pull the thread and it connects, well, everywhere. Bean-counters who push bad projections, anyone?

But weev is the arrogant one, the one who sticks out. I'd talk about the old ritual of scapegoats, but that would cloud the issues.

The problem is that we misunderstand computers.

Computers are not magic boxes that, if we can figure out the right incantation, will somehow magically fix all of our problems.

Computers consist of three things:

Memory is just fancy paper that can be indexed, and can be re-written (written and erased and written again) at will, at high speed.

The cpu is just the fancy pen that writes and re-writes. And it can calculate. And it can be directed where to write or re-write next. And it is fast.

There are specific features, but there is no magic.

(If there is magic, it is in what we do with them, but that's beside the point.)

We can do good or evil with computers, just like any other tool at our disposal, if we will take the responsibility to learn the tools.

Think about this. If you saw a battered notebook sitting on the sidewalk outside some company's store, what do you do? You probably ignore it. But someone you know might pick it up and notice it belongs to the store. Then what?

There are principles of courtesy that weev ignored. Courtesy is not supposed to be law. When courtesy becomes the law, it ceases to be courtesy. That takes all the meaning out of courtesy, and never fails to codify stuff that ends up out of context, and wrong.

And, had weev followed all the principles of courtesy that have (not yet) been (properly) established, the current record is that he still would have been charged with doing something illegal.

Some people say weev is just grandstanding, just trying to get attention. I could not argue with that, I'm not sure weev himself would argue with it. Is grandstanding such a crime? Is it worth burdening society with four years of keeping him well fed and away from "computers", away from the rest of society out here?

Wherever "out here" is.

social freedoms and the semantics of machines

A boy I know and his parents have arguments over how much time he spends playing video games. The funny thing (one odd thing) is that the parents claim to support social freedoms.

The son, for his part, is in a high-pressure high school over his head. Not so much over his head, but the school is a science/math focus school and his interests are in the people sciences, history, maybe biology, definitely sociology, etc. The games are not just his way of letting off steam. They help him loosen his conscious grip on his understanding enough to let the principles soak in.

He gets the principles, just not fast enough to keep up with the pace of his homework, or the tests. He's always a step or two behind.

So his grades are in the sink.

But when he understands, he understands, as opposed to the average above-average student who mechanically copies the rotework and never really grasps what is going on.

Playing video games at three or four in the morning is a little extreme. Japanese high schools, the ones everyone fights to get into, are not conducive to education.

If the parents recognize that people in generally must be free, why can't they let their own child choose how he attempts to implement his goals?

Actually, more than one family I know is in this vicious cycle.


No time to write this out in small steps:

If there is a reason for people to be different from each other, they have to be free.

If people have to be free, children have to be free to find their own way, even to extremes like playing video games at three and four in the morning.

If they don't have freedom, how do they find the meaning in the things they do?

If they don't find meaning in what they do, what makes them any different from the machines we build?

(This argument appears to contain some logical leaps and some incomplete implications, but tightening up the logic runs into axioms that some people like to quibble excessively over. And I'm out of time.)

Of course, the warning voice of the parents is one of the context elements that helps children find meaning, but parents really need to be conscious of what meanings they help their children find.

Software patent limitations

Let's set aside, for the moment, the arguments about software being maths (because too many people are confused by the mathematicians' argument that the whole world is nothing but mathematics).

[Update: I've started a separate blog for this kind of stuff.]

Patents in the physical realm have something that software patents, in their current state, do not have.

Materials.

Structures.

Included devices.

Yeah, limitations.

If we allowed physical patents like the current version of software patents, we'd have patents claiming "materials that have property P" or "materials that perform function F"; claiming "structures that look like S", "structures that perform function F", or "structures that have property P"; claiming "the inclusion of device D", or "devices that look like S", or "devices that perform function F", or "devices that have property P". Etc.

Those who love freedom make a lot of noise about patents on ideas. We'll set those arguments aside for a moment, too.

Surely we can see the problems here. If this kind of patent were allowed, the first patent on any device that reproduced sound would have covered every device that reproduced sound.

Can't you see that?

First, "This patent claims a device that records a physical representation of sound by capturing audio vibrations via a large membrane moving a needle to cut a groove in some plastic medium." paired with, "This patent claims a device that reproduces sound by transferring vibrations recorded in some plastic medium to a physical membrane."



(Don't forget that "plastic" means something besides poly-urethane here.)

These claims would already have been over-broad. (Compare them with history -- think about cylinders vs. discs.)

But the following claims would also have been allowed, most likely in the same patent.

"This patent claims a device that records any representation of sound in any media." paired with, "This patent claims a device that reproduces sound recorded in any media."

Had these claims been allowed, who would have owned the recording industry?

Lock, stock, and barrel. No, broader than that, even.

The courts are trying to restrict these kinds of patents, but they have no guides.

(Perhaps because too many lawyers who conflate maths with human laws have gotten stuck on the software-is-maths argument, drawing the wrong conclusion. The universe is mathematical, but no human has ever yet been able to define the grand unifying theory. The best general theories we have at present are so convoluted they would be subject to patent under the current patent regime -- if we allow software patents in their current form.)

Patents must, absolutely must have some reasonable limitations to be useful. In physical realm patents, materials, structures, included devices, etc., provide the basis for limits. They prevent the patenting of ideas.

(Okay, I snuck that back in. After I showed one of the many problems with patenting ideas, even complicated ideas. So sue me. Wait, someone is likely to do exactly that, so I should set pejorative aside, as well.)

What would be the parallel in software patents? If we absolutely have to have them. (And I think we probably do, at least until we can get our society freed of the atrocity that is the Berne Convention.)

What would provide the basis for limitation?

Source code.

Programming language provides a parallel to materials.

Modules, both physical and program, provide a parallel to included devices. Thus, the libraries linked in, the run-time environment assumed in the compiler, the compiler itself, the operating system, and the physical CPU and peripherals, all those implementation details presently only waved at by the phrase, "implemented in a computer device" provide essential parts of the missing basis for limitation.

("Implemented in which computer device?", for the sake of all that stands before the court.)

And the source code itself is the equivalent of blue-prints, diagrams, methods of assembly, etc. The source code itself is an essential limiting element, and so often missing, except for some symbolic pseudo-code or programming scrap freed from any actual implementation.

Pseudo-code must be unacceptable as a limiting element in patents. You can say anything you want in pseudo-code, because a human gets to figure out the implementation details later. Pseudo-code provides no basis for limitation.

A software patent absolutely must provide compilable source code, and it must be limited by the source code provided, bugs and all. And limited by the compiling environment and the target execution environment, OS specifics and hardware specifics, etc.

All the details of workable implementation, without which, even a very competent computer scientist is hard pressed to reproduce the subject of the patent. Including compilable source code.

These are the missing limitations in the current versions of software patents, and, until we deal with them properly, software patents cannot fail to provide us with an unworkable legal mess.