Developing Secure Software

Noopur Davis spoke to DC SPIN about developing secure software. Most of her presentation concerned the connection between software quality and security.

The CERT Coordination Center defines a security vulnerability as something that:
- violates an explicit or implicit security policy
- usually caused by a software defect
- similar defects are classified as the same vulnerability
- often causes unexpected behavior

Specifically excluded from this definition of vulnerability:
- Trojan horse programs (evil email attachments)
- viruses and worms (self propagating code)
- intruder tools (scanners, rootkits, etc.)

Vulnerabilities are the defects that permit evil email attachments, viruses, worms, et al, to exist.

Davis’s presentation concentrated on application development, because that is where most of the security vulnerabilities occur. Common security defects include:
- failure to authorize and authenticate users
- failure to encrypt and/or protect sensitive data
- improper error handling
- improper session management

Buffer overloads, which Davis defined as data written beyond the memory capabilities of an application, are by far the most common vulnerability. Software defects that can produce a buffer overflow include:
- declaration error
- logic defects in loop control or conditional expression
- failure to validate input
- interface specification error

Buffer overflows are very serious, as when a malicious hacker modifies a data pointer to seize control of a system.

Sample code was used to illustrate software defects:
void myFunc(int a, char *buf)
{
char str1[10];
char str2[50]
strcopy(str2,buf);
}

In this string copy example, the lack of a check would permit an override of the return address.

void myfunc(char **strNames)
{
char *tmpBuf[MAXNAMES];

for(int i=0; i <=MAXNAMES; i++)
{
tmpBuf[i] = (char *) malloc(MAXNAMELEN);
tmpBuf[i] = strNames[i];
}
}

In this loop example, the loop count is off by one.

Code analysis tools can help; but will not find most defects, and often give error message that are unhelpful. (Technoflak thinks you could devote an entire blog to unhelpful error messages.) Some of the better known code analysis tools are:
RATS
Flawfinder
ITS4
ESC/Java

Davis drew attention to the Fluid project, which has shown promising results.

She referred to the design principles that Saltzer and Schroeder laid out in 1974, and stressed the importance of “separation of privilege: Where feasible, a protection mechanism that requires two keys to unlock it is more robust and flexible than one that allows access to the presenter of only a single key.” She offered user name/password as an example of separation of privilege.

Thus far software vendors have shipped product, and waited for attackers to exploit vulnerabilities before developing fixes. Customers were expected to apply those patches to prevent further damage. Clearly this approach is not working. The BITS organization estimates software vulnerabilities cost its members $400 million annually and the financial sector more than $1 billion.

Testing is not enough; you cannot test quality into software. Inspections and reviews are not enough. Use of software testing tools is not enough. Design principals are not enough. Risk management is not enough. What is needed is a secure software development strategy.

First, there is an urgent need for education, education about the most common security vulnerabilities and the sort of software quality defects that create them.

Second, there is a need for a process that combines the best practices in software engineering, security, and management. The process must be constantly measured to see if it is working well.

Davis began to explain the Team Software Process and how it dramatically increases software quality and reduces security vulnerabilities. Software produced by the Team Software Process averages .06 defects per 1,000 lines of code, versus the industry average of 1 to 7.5 defects per 1,000 lines of code.

Developers using the Team Software Process manage and remove defects throughout the development lifecycle. They use measurement and quality management to monitor and control process. This same process could be used to address security issues.

Implementing best practices is often impeded by scheduling and people issues. The Team Software Process helps to build self-directed teams that make their own plans and commitments and track and manage their work.

Clearly the role of management is crucial. Management must establish organizational policies for secure software development, set measurable goals, provide resources, funding and training. Davis emphasized the need for someone at the project level to focus on security, not simply a chief security officer.

Davis spoke about the measurement framework: schedule, time, size, defects, process quality measures and product quality measures. She said “We don’t know if these are the right measures for security, so we are gathering data.”

The Team Software Process project is researching practices that will reduce the will reduce the software design and implementation defects that produce software vulnerabilities. It is also working to provide the capability to predict the likelihood of latent vulnerabilities in delivered software. The goal is to achieve .06 security vulnerabilities per 1,000 lines of code.

A pilot project is currently underway, with promising results, 96% of the security vulnerabilities were discovered and eliminated.

Davis encouraged attendees to visit the TSP web site and read The Team Software Process in Practice: A Summary of Recent Results.

During the question period one attendee pointed out that it was perfectly possible to write high quality software that is insecure. Davis conceded that software quality does not always equal security; but the opposite is invariably true, poor quality software is rife with security vulnerabilities.

Coming attractions

Mark Mandel, NCC-AIIM President, just sent us the following e-mail:

Please mark your calendar for Friday, June 18, 2004, for the annual Black Tie Optional NCC-AIIM June Social.
 
This year's affair will be held at the International Spy Museum at 800 F St., NW, Washington DC.  The theme for the event is "Shaken, Not Stirred" which is a take-off from the James Bond spy films.  Our speaker is Bob Wood, who is President of the Industry Advisory Council (IAC) and is also President of Topside Consulting Group.
 
The event includes admission to the Spy Museum and dinner at Zola Restaurant.  Don't miss this one-of-a-kind NCC-AIIM June Social!!
 
Stay tuned for more details and registration information in the coming weeks at the NCC-AIIM website.

Cascading Style Sheets Standards Compliance Blues

The Web Standards Project talks about the problems of complying with standards:

We've all been there.

You've got a blog. You've spent hours getting the templates and CSS just right. It even validates. You are the model of a cool, modern, standards aware webblogger.

So you post a new entry to let the world know that you are now compliant. You even include a link to the validation results for your page so your readers can see for themselves. You go out for a drink to celebrate a job well done.

When you get home, your inbox is full. It is all the same thing, from visitors to your site. They're saying that your page doesn't actually validate. "But that can't be" you say "I just got through validating it and I haven't changed the templates since. All I did was post one entry."

XML acronyms got you down?

List of XML and XML related acronyms

Richard Stallman

I want to write again about Richard Stallman’s talk on the origins of the free software movement at the Yorktown High School Libre Users Group. It is, without exception, the most remarkable technology presentation I have ever heard.

Free software goes back to the very beginning of computing, when all programmers referred to themselves as hackers; hacking meant doing things with playful cleverness (ahh, innocent days indeed.) In those days, if you saw something interesting on someone’s screen, you could ask about it and they would tell you where to find the exe file. That enabled anyone to experiment with the program and contribute to human knowledge. The “share spirit” was strongest and most intense at the artificial intelligence laboratory at MIT. Technoflak thought to herself that it must have been an idyllic world for programmers.

The MIT AI lab had a printer that took a long time to print and frequently jammed. The programmer's solution was to write a little program from the printer to each workstation, notifying the user that their printing job was done. If the printer became jammed, a signal would be sent to every workstation, insuring that someone would come and fix the printer. Stallman said that “the end-to-end feedback made the user feel like they were part of the system”.

Sometime around 1980, Xerox contributed a new printer to the laboratory. It was to be Stallman’s first encounter with a proprietary system. When the new printer jammed, it sent no signal to users. It was not uncommon to wait for your printing job to finish, walk up to the printer, and find it jammed. Programmers would fix it, only to have 200 pages of someone else’s work print out, and then jam again. To the programmers, the solution seemed obvious, just ask Xerox for the source code and then write a user-notification program. But Xerox refused to release their precious code and Stallman was furious, his fury undiminished by succeeding years. He learned that there was someone at Carnegie Mellon who had the source code, and so he traveled all the way to Pittsburgh only to be told, “No, I promised I wouldn’t give it to you.” Stallman saw this as a promise that should never be made, for it is a promise that you will not help people.

He emphasized the distinction between information that is technically useful, and information which is legitimately private personal information. (While it isn’t personal, he clearly included information such as ICBM codes as information which is legitimately secret.)

A series of what Stallman described as calamitous events, including Digital’s cancellation of the PDP10, led to the end of his work at MIT. The loss of the PDP10 was especially serious as fifteen years worth of work was blown away. This taught Stallman the importance of having an operating system that was not dependent on specific hardware. All the remaining operating systems were proprietary and he was faced with a quandary. Should he become Shaw’s reasonable man? and accept the change to developing proprietary hardware? To Stallman this meant a life of building walls between people, work that would be shameful. He decided that he had been selected by circumstances to create a free operating system and this was the best thing he could do with his life.

Stallman decided to build on the existing Unix kernel because Unix is not hardware dependent. This decision simplified many design decisions. Because users do not like too much change, his system would be upwardly compatible with Unix and preserve existing user interfaces. Because programmers like to select recursive and humorous names for their programs, he selected the name gnu (gnu-not-unix, pronounced g-nu), because he considered gnu to be the funniest word in the English language. In September of 1984 he produced a text editor, Emacs, and subsequently put Gnu Emacs on an FTP file server. Some programmers did not have access to the Internet (or arpanet, as it was in those days) and they asked Stallman to send a disc with the program. He asked for $150.00 for the program on disc; as he said, when you think of free software, think of free speech, not free beer.

To be free, software must have the four freedoms:

freedom to run as you wish
freedom to to help yourself by making necessary adjustments (access to source code)
freedom to help your neighbor
freedom to help your community, so others can benefit from your work.

If software is missing any of those characteristics, it is not free.

Stallman observed that the spirit of goodwill is the most important aspect of any society. Without at least minimal goodwill, society is unsustainable, and he asked, “What does it mean when powerful institutions undermine this?” In saying this Stallman was leading by example, for can you imagine Ballmer or Gates coming to a high school computer club just because a former student was a member?

He explained the necessity for free software. You must have the freedom to run a program, or you don’t control your computer. You need to be able to study and change the program or simply have blind faith in the developer. Stallman pointed out that it is not unusual for non-free software to have malicious features such as spyware. Even if the developer of non-free software is entirely honorable, it is almost certain the software has bugs. Without the source code the user is helpless. Developers can charge users to fix defective code.

Without freedom three, the freedom to help your neighbor, even those who understand technology, are unable to help those who do not. Those who do not understand computer code, and have no interest in learning, cannot get competitive quotes to fix defective code.

Stallman characterized choosing from competing non-free systems as choosing who is going to manipulate your computer, who is going to be your master.

The original X Windows system had been developed by MIT as free software. Microsoft modified the system and sold it as proprietary. While this was a nice professional success for those who created the original X Windows system, Stallman wanted more for his system, so he created copy left. In the best tradition of playful mischievousness, Stallman used the copyright system to defeat the copyright system.

Linus Torvalds began the development of Linux by asking for help on a usenet group and by 1992 released the first Linux kernel. Stallman characterized it as old fashioned monolithic software and resilient under GNU and said it “carried us across the finish line.”

But the confusion of calling it Linux was a terrible blow to the free software movement. People were using Gnu with Linux added, but didn’t know it. They didn’t know anything about Gnu and the philosophy that created it, and so using Gnu did not lead them to the free software movement. People began to look to Torvalds for leadership, and since Torvalds takes an apolitical view of software, people were not even discussing the philosophy of free software. Stallman lamented that the free software movement must struggle to make its voice heard, even as many more adopt “the practical fruit of our ideals.” If more people knew the philosophy that produced the system, at least some would be drawn to it and make their own contribution. (It should be noted that the Yorktown HS Linux Users Group changed its name to Libre Users Group, in recognition of the true origin of free software.) Stallman built the Gnu system so that “we could live in freedom, and living in freedom is what is important.” The work of the free software movement is not done: thousands of programs are needed to satisfy users.

Stallman talked about the enemies of free software, the Digital Millennium Copyright Act, software patents, and the hostile rulings of the current FCC. Stallman said Microsoft was taking out patents for the express purpose of launching lawsuits. The FCC has prohibited the use of free software to receive TV signals. There have been attempts to add non-free software onto free software. Hardware specifications are secret, so it is difficult to develop free software for hardware.

Stallman poured scorn over the trusted computer initiative, describing it as treacherous computing, for your computer would cease to be a general purpose computer and every operation may require the application developer’s explicit permission.

Stallman ended his presentation with the playful cleverness that has become the mark of all his work, as he proclaimed himself a “saint in the Church of Emacs, whose only teaching is that there is no system but Gnu and Linux is one of its kernels.” He called on the assembled audience to exorcise proprietary software from their computers, use only holy free operating systems and only free software. There was a prolonged standing ovation, unique in my experience in technology presentations.

Amazingly Stallman took questions. He had flown in from Vietnam earlier in the day; how he could be so eloquent under such circumstances is a complete mystery to Technoflak.

One young man asked him what to do if he was given school assignments in proprietary systems. Stallman suggested the student frame it as a moral issue and that his conscience would not permit him to use proprietary software. Others wanted to know how they could support the free software movement, and Stallman suggested that in addition to supporting the Free Software Foundation they also support the Electronic Frontier Foundation.

He spoke about the deliberate confusion of a term like intellectual property and drew the distinctions between patents, copyright and trademark law. He likened the idea of intellectual property law to fluid law. (We do not speak of fluid law of course, as if water, petroleum and fruit juice were governed by related laws.)

Technoflak asked him if the free software foundation was participating in the work of the federal XML work group. He said they do not get involved in standards bodies.

Technoflak has mixed feelings about Stallman’s presentation. Having supped so long on the proprietary APPLE™, this Eve has no desire to go skipping into the free software Eden. Moreover, every single client Technoflak has ever promoted has offered proprietary systems, and she is very proud to be associated with them.

But it would be an error to dismiss Stallman as a mere dreamer. The Gnu system, the system most people refer to as Linux, is a product of his philosophy, that living in freedom means using free software.

Again and again he spoke of the connection between free software and political freedom. “When governments fear the people, that is democracy; when people fear their government, that is tyranny.” Two years ago I would have scoffed at the suggestion that there was a connection, but in view of the controversy over voting machines, I don’t think we can simply dismiss the connection.

Think of the vision Indians must have had to have embraced nonviolence in the 1930’s, when the rest of the world was being sucked into the vortex of war. Think of the courage and spiritual strength that was necessary to believe the British could be made to give up power through a sustained campaign of nonviolent activism. Yet nonviolent resistance prevailed, and has done so in every society that has embraced it, from the American south, to Argentina, to the Philippines, South Africa and across Eastern Europe. Perhaps free software is in the same category, something so far outside our experience that we have a difficult time grasping it, yet once it is embraced on a sustained basis, will become so self-evident that we will wonder that we thought any other way. So, for Richard Stallman, all I can do is repeat the words of Ghandi-

first they ignore you
then they ridicule you
then they fight you
then you win.

Computers, Freedom, and Privacy

Congratulations WTOP News

WTOP News has been nominated for a Webby Award.

Buzzword Blues

Bryant Duhon explains:

Another year, another buzzword. Building steam over the past 12 months, Information lifecycle management has appeared as a new buzzword in the storage industry and is starting to leak over into ECM (Jack Scott’s Around the Corner column in Jan/Feb and Mike Alsup’s article in this issue each mention the term). I know that marketing folks do more than create “buzz,” yet sometimes it seems as if that attempt just muddies the water. All of the major storage vendors have an information lifecycle management strategy. In one sense, this is a positive development in that it exposes the IT world to the complexity of managing information beyond data. However, the concept of matching information’s retrieval needs to the corresponding lowest cost for best access media isn’t new. This seems to be hierarchical storage management gussied up in a brand new suit. And, though it’s hard to argue with the necessity of “cradle-to-grave” management of information, this is not a new concept— talk to your records manager if you don’t believe me. Is this term a replacement for ECM? Complementary? As I write this, I’m not sure. What do you think?

I think the endless stream of new buzzwords confuses and alienates prospects. It bores readers and loses sales. Why do we keep doing it? Presto Vivace was launched with the idea of explaining technology in everyday language.

XML Conference and Exposition 2004

Call for Participation

Proposals in the form of 500-word abstracts submitted into the conference system are due by May 7, 2004 for Conference Presentation and Tutorial submissions. We will have a call for Late-Breaking News and Product submissions, as well as Poster submissions, later in the year.

Spyware

Is there a prize for headlines? Because this writer has certainly earned one: Few solutions pop up at FTC adware workshop

Customers make the best flacks

From KM World:

OrderGenerator helps companies grow their business with an automated customer referral system. It is said to be the first tool of its kind that can gather testimonials and automate customer referrals in a non-push way, while rewarding referrals with a donation to the referrer's cause of choice.

Gadget Blogs and Public Relations

Keith O’Brien has one of the best articles on blogs and their role in marketing that I have seen. PRWeek, which is subscription only, has graciously made this link available to blogosphere.

Gadget blogs gain in popularity and corporate PR begins to take notice

On March 24th, loyal readers of gadget blog Gizmodo were rewarded with some grainy pictures of Danger's hiptop 2, the second generation of popular mobile device that allows users to email, browse the Web, IM, call someone, play video games and, with a camera accessory, take pictures.

The hiptop 2 has not yet been released and the photos, taken from a trade event, were not supposed to be viewed publicly. While not commenting directly about the incident, Susan George, Danger's director of marketing communications said, positively, "It's nice that people are excited about it."

If I were Susan George, I would be ecstatic. What could have more credibility that an amateur photo on a personal web log? Of course if the trade show is just a preview it would be a shame to have a lowly blog get a jump on your product launch, after you have persuaded all those editors to hold your news release. But for viral marketing, blogosphere has no equal.

Here at Presto Vivace we take a ground up approach. Who are your client’s customers? Which publications do they read? Which blogs do they read? That is why Technoflak attends so many meetings, so I know who I am writing for and what has credibility.

Jon Udell on reporters, flacks and blogs

Blog/print synergy: my strategies

Gather expertise. I start with topics to which I bring a certain amount of expertise. Then I leverage what I know (and who I know) to find what I don't know (and who I don't know). Of course in the trade magazine business, there is a whole profession dedicated to helping me do that. When a story appears on the editorial calendar, I'm swamped with phone calls and emails from PR folk who want to supply me with analysts, executives, domain experts, and customers. This isn't necessarily a bad thing. I sometimes accept these opportunities, and in some cases, I learn from them. It's dangerous, though, to be led down the path of least resistance. So I rely on the blog to find other people who have important things to tell me. As you can imagine, this makes PR folk really nervous. It's their job to try to control my story. It's my job to route around that control, and the blog is a tremendously powerful tool for doing that.

I think flacks have to let go of this idea of control, or as my late father used to say, "When you give it to the press, you give it away."

The news is not for sale

Marketers Press for Product Placement in Magazine Text, Call for End of Strict Separation Between Advertising and Editorial Content

The news is not for sale, for the excellent reason that if its sold, its not news anymore. The only thing a news organization has it is its credibility, take that away and public relations is no longer possible. At best, the magazines will lose readers to more credible competitors, including blogosphere. At worst, the arrangement will become public knowledge, and backfire on the participants.

Congratulations to the Washington Post

From Editor and Publisher:

According to a report released by Merrill Lynch last week, The Washington Post Co. "should have one of the best newspaper ad revenue performances of the group during Q1, up 6%" vs. the industry's 3.5% growth. Gannet Co. also could experience a good quarter, up 5.2%.

Let it be an good omen for us all.

Dan Gillmor explains privacy for those who have not received the memo

From Computerworld

It's routine to assume that garnering more data is better. The ability to store everything under the sun is growing along with disk space. If your company sells widgets that end up in consumers' homes and you plan to put radio frequency identification tags on these goods to help make the supply chain more efficient, that's great. But you should be planning now to make sure the tags stop working when they leave the store, because people like me will shout from the rooftops if you don't.

No matter how much data you collect, IT staffs should convince CIOs -- who in turn should convince CEOs -- that it's far better to build more protection into databases early than to attempt to bolt it on later. And they should convince them to support stronger pro-privacy laws while they're at it.

Respecting privacy is good public relations.

Dealing with Unwanted Spyware and Parasites

The end of the open, end-to-end Internet?

From the Washington Post:

"What we're trying to create is a zone on the Internet where mail flows -- where the airlines and Amazons and eBays can send mail and it will arrive cleanly," said John Reid, a spokesman for Spamhaus, a Britain-based nonprofit company trying to reduce the amount of spam online.

A dot-mail domain is a kind of "white list," techie parlance for a compilation of Internet addresses that ISPs and system administrators know is trustworthy. Companies with dot-mail addresses would have to ask e-mail recipients not only for their permission to send them material, but also a confirmation generated by the recipient.

I am not enthusiastic about this approach. It could evolve into a spam railroad for large corporations. As I suggested in my article, Unsolicited Commercial E-mail Blues we need to persuade credit card issuers to stop offering merchant accounts to spammers.

Another spammer for the slammer

Va. Arrests Third Person in Spam Dragnet

Where did all those old Soviet bureaucrats go?

From the sound of things, they work for Google. Via our good friend, Dan Gillmor is this alarming report on Gmail from John Gilmore:

These terms don't restate the law. They sweep it aside.

You agree to accept any future changes to the terms or policies. Any. If you don't agree NOW to all future changes, you can't ever use the service, even now under the current terms.

They can cut you off for any reason, or for no reason. This is not a common carrier.

Memo to Google, anytime you are regarded as today's threat to civil liberties you are on the wrong path.

The Plain English Campaign

8 April 2004 - weekly news update

Ireland's minister for Europe has warned that a lack of plain English could seriously damage the European Union (EU). Speaking at a conference to discuss communication in Europe, Dick Roche said: "If citizens are not better informed about, and engaged in, the EU, the future of the union itself could be threatened."

Technoflak salutes Minister Roche. Presto Vivace was launched with the idea of writing jargon-free copy.

Web Radio

One Nomad is looking at media streaming servers and surrounding technologies. The idea is to study feasibility of low cost Web broadcasting in Kazakh language for Kazakhs abroad.

Technoflak will watch his progress with considerable interest.

TSP User Group Conference 2004

Annual gathering of the PSP/TSP community to share experiences

September 27 and 28, 2004
Sheraton Station Square, Pittsburgh, PA

Call for participation abstracts due: June 1, 2004

Mark Mandel's take on AIIM 2004

The current issue of The Capitol Image has Mark Mandel's review of the recent AIIM show.

Some of NCC-AIIM’s board members received individual recognition:

Company of Fellows

David Noack was recognized as an AIIM Fellow for his contributions over many years.  The Company of Fellows honors individuals in the association who merit recognition and distinction for their outstanding contributions to the Enterprise Content Management industry. Members of the Company of Fellows become lifetime members of the Association.

Also inducted into the Company of Fellows was former board member Pricilla Emery.

Distinguished Service Award

The Distinguished Service Award recognizes individuals whose outstanding service advanced Enterprise Content Management technology through AIIM chapters, national, or international standards development, or other committee activity.

From NCC-AIIM, two individuals were recognized:
Dalton Luz, Politec, Inc. – NCC-AIIM VP of Programs
Carolyn Offutt, U.S. Environmental Protection Agency – NCC-AIIM VP of Education

Congratulations to all.

Security scare for business laptops

From the Financial Times:

Nevertheless, wi-fi is an "incredibly securable technology", Mr. Hollis insists. Users need only disable file-sharing on their laptops and install a firewall to prevent them being hijacked.

Wise words, heed them.

Let it be so

US business confidence seen at 20-year high

Public Relation’s Dirty Little Secret

Why do flacks lie? Because lying is rewarded. Once you plant a lie in the press, they have a vested interest in perpetuating it. This was the basis of the whole Whitewater witch hunt. Any flack who has not read Gene Lyons, Joe Conason, Eric Alterman or Bob Somerby is dangerously naive about press practices.

One of the reasons I let my PRSA membership lapse is because they chose Torie Clark to speak at their 2003 conference. She played a crucial role in tricking the American people into a war and disgracing us before the world, and the Public Relations Society of America could see no better than to invite her to speak at their annual conference. What were they thinking?

Media Relations 2004 has invited William Novelli to speak on the role of the communicator in politics and public policy. He is the creator of the infamous Harry and Louise commercials, second only to the Willie Horton commercial in the annals of duplicitous political advertising. He is presently running AARP into the ground. Why would we want to hear from him?

No one who invites the Torie Clarks and William Novellis of this world to speak at their conference, can pretend to care about honesty in public discourse. So it is little wonder that the unfortunate Karen Ryan does not understand that she did anything wrong.

Lies always catch up with you, whether you are a CEO, Cardinal or even the President. Those of us in public relations must teach our clients to put the best spin on the truth and never resort to deception.

Pulitzer Prizes 2004

Congratulations to Anthony Shadid of the Washington Post and all the winners of the 2004 Pulitzer Prizes.

March meeting of the DC XML Users Group

Last month Karanjit Siyan, from NIST, spoke to the DC XML Users Group about XML schema basics.

W3C schemas are largely replacing DTDs because W3C schemas have better support for namespaces, finer granularity, description of data types, and are more useful for language bridges.

Siyan proceeded to review content models (empty, simple, complex, and mixed) and how they are used in W3C schemas. At the end of his presentation there was a lively discussion about the difficulty of using parsers with W3C schemas.

Diane Lewis of the Office of Justice Programs, was the next speaker. (The DC XML Users Group has a tradition of double features.) Her presentation was wonderfully titled Working towards usable standards at the Dept. of Justice. It is not often you get such hype-free presentations.

For reasons which must be obvious, much of the data at the Dept. of Justice is from statues and pleadings. Unfortunately the Federal Court system puts everything into PDF format, making it difficult to exchange data with other systems. The Justice Dept. also receives are great deal of data from state and local courts and police departments, thus the keen interest in developing, and promoting the adoption of, standards.

During the question period a member of the audience asked about XML and security. After everyone enjoyed a hearty laugh, Lewis explained that security was layered on top of the XML schemas; but that security is an issue that standards bodies need to address. I know the federal XML work group is discussing this very issue.

Small firms land record federal contracts

From the Washington Business Journal:

Small businesses scored a record 25.4 percent of federal agencies' prime contracting dollars last year -- the first time the government met its 23 percent small business procurement goal since 1999.

This is great news. Here at Presto Vivace we have always thought the most innovative work has been done by small firms.

"Buffalo spammer" found guilty of identity theft

A notorious email marketer known as the "Buffalo spammer" was found guilty of identity theft and forgery charges and could face a prison sentence of up to seven years, the New York state attorney general's office said on Thursday.

Three cheers for New York's Attorney General. I first discussed this case in my article Unsolicited Commercial E-mail Blues.