[00:36.420 --> 00:37.540]  Okay.
[00:38.200 --> 00:39.660]  My name is Robert Lemos.
[00:39.880 --> 00:41.980]  I'm a senior editor with ZDNet News.
[00:42.760 --> 00:46.000]  Brock Meeks was going to moderate this panel, but he's not here.
[00:48.040 --> 00:53.760]  Over here on my left, I have Deborah Radcliffe, who is the feature writer of Computer World.
[00:54.500 --> 01:01.680]  And on my right is Doug Mone, who is the streaming media columnist at Boardwatch.
[01:03.900 --> 01:07.300]  You know, at this point, we're pretty much going to just open this up to questions.
[01:07.620 --> 01:18.520]  I'm sure we're going to get kind of lambasted up here, so if you want to step up to the plate and speak, then we'll answer any questions and, I don't know, fend off any criticisms.
[01:21.140 --> 01:22.660]  Do you have a microphone out there for him?
[01:28.330 --> 01:29.750]  We'll figure if no one comes to approve.
[01:38.320 --> 01:38.900]  All right.
[01:39.040 --> 01:45.000]  Since no one wants to step up for questions, why don't we start by giving some bios here.
[01:45.180 --> 01:45.580]  Do you want to start?
[01:46.120 --> 01:46.720]  Oh, yeah, I guess.
[01:49.420 --> 01:49.820]  Cool.
[01:50.160 --> 01:51.840]  Well, my name is Doug Mone.
[01:52.000 --> 01:54.540]  I'm the streaming media columnist for Boardwatch Magazine.
[01:54.760 --> 01:57.740]  I also write features for Boardwatch.
[01:58.540 --> 02:08.820]  One of the reasons why I volunteered for this potential skewering is that I wrote a column about DEFCON for Boardwatch.
[02:09.220 --> 02:22.000]  And I've been going to various hacker conventions, kind of like writing the coattails of my boss, who will remain nameless because some of the statute of limitations things I know about haven't expired yet.
[02:24.800 --> 02:35.540]  And I figured I was best to throw my two cents and worth on this panel because of the fact that I'm a little bit different in terms of media.
[02:36.140 --> 02:38.800]  Boardwatch has traditionally been an independent publication.
[02:39.480 --> 02:44.340]  Has not been owned by the corporate media, as Jello, so aptly put it.
[02:45.200 --> 02:45.960]  Jellie Jello.
[02:50.140 --> 02:50.660]  That's right.
[02:50.800 --> 02:51.220]  Laugh along.
[02:51.420 --> 02:52.100]  It's five o'clock.
[02:52.240 --> 02:52.520]  Very good.
[02:53.660 --> 02:57.260]  Whereas, I guess, my compadres on the other side of the table have been...
[02:57.260 --> 03:03.720]  are basically on a more time-critical publication, meaning that they have a turnaround of a week to two weeks to get stories out.
[03:03.720 --> 03:08.240]  And I guess ZNN is like probably an hour to two hours on the website.
[03:09.360 --> 03:12.800]  Boardwatch, I don't want to make it sound like, oh, yeah, we take plenty of time.
[03:12.920 --> 03:24.760]  But I've got like anywhere from 30 to 45 days to write a story so I can be a little bit more thorough, a little bit more in-depth, sometimes a little bit more creative in terms of covering things.
[03:24.760 --> 03:32.700]  So it gives me a little bit better perspective than somebody like Brock who's got like, you know, on MSNBC, owned by Bill Gates.
[03:32.960 --> 03:37.060]  Now, or some of the other folks up here who have shorter deadlines.
[03:37.800 --> 03:39.700]  But Boardwatch is a print publication.
[03:39.700 --> 03:42.660]  They do do a website, but their website really is...
[03:43.500 --> 03:53.420]  They'll kick me for saying this, but meaningless in the scheme of things because most of what they do is reprint on the website articles that have already been in the print publication.
[03:55.620 --> 03:59.740]  Actually, I guess the first question would be here, but I have to ask them here.
[04:01.480 --> 04:07.600]  When you do research for the story to write and publish on the website, how do you do the research?
[04:07.800 --> 04:12.180]  Do you go to the particular websites or do you go to conventions, do you interview people?
[04:12.380 --> 04:15.380]  How do you validate the claims that people make?
[04:15.540 --> 04:20.000]  How do you validate the ethical abilities of the people before writing a story?
[04:20.720 --> 04:22.200]  Who do you want to answer that question?
[04:23.440 --> 04:24.820]  You can do a little bit.
[04:24.820 --> 04:26.340]  We could get left to right, right to left.
[04:26.680 --> 04:27.220]  How about I start?
[04:27.220 --> 04:27.860]  Ladies first.
[04:28.060 --> 04:28.780]  Okay, there you go.
[04:29.500 --> 04:32.360]  I'll start with a nightmare that just happened to me last week.
[04:33.000 --> 04:40.000]  I filed a hack of the month column, which I do every month for Computer World, on the dangers of using Napster and Rampster together.
[04:40.000 --> 04:43.640]  I had a pretty reputable source, but it wasn't one I used before.
[04:44.380 --> 04:49.300]  And it turns out he left out some fine details like he never did perform the hack like he said he did.
[04:49.300 --> 04:55.860]  He only performed part of the hack, which was a buffer overflow on Napster to show them files that it shouldn't be showing.
[04:56.900 --> 04:59.000]  So I got really slammed by that one.
[04:59.200 --> 05:00.860]  I did fact check through two sources.
[05:01.700 --> 05:07.080]  One was the electronic... it's a Secret Service based ECTF, the Electronic Crimes Task Force.
[05:07.220 --> 05:11.820]  And the other was the Army's Computer Investigation Center in their laboratory.
[05:12.160 --> 05:16.160]  Both of them said that yes, they had heard this could be done, and I still got slammed.
[05:17.040 --> 05:21.760]  Turns out you need a back orifice to get Rapser to do anything that was not included in the column.
[05:22.140 --> 05:26.080]  And I have to eat crow in a major correction that's running on Monday.
[05:26.760 --> 05:32.620]  Most of the time, I go with sources I've used before, who have proved to be technically adept.
[05:33.480 --> 05:42.780]  So what you do is, if you're in the industry long enough, and I've been doing this for six years, you start to get what I would call a cadre of technical sources who are reliable.
[05:42.780 --> 05:50.980]  And whenever I'm doing something that feels a little over my head, I will send a paragraph or two off to some fact-checking bodies.
[05:51.700 --> 05:56.380]  Sands Institute is becoming quite helpful with things like that.
[05:56.560 --> 05:59.200]  ISC Squared is also helping me.
[05:59.300 --> 06:06.540]  They will actually send technical chunks around to the bodies of knowledge that they have through their groups.
[06:06.780 --> 06:15.440]  There's a lot of websites out there now that are very helpful, and the administrators of and the editors of those websites make very good sources.
[06:16.280 --> 06:24.000]  And there's a lot of people who are buried in the hacker community who will only give me their handles, who are also, I've found, very technically helpful.
[06:24.300 --> 06:26.680]  And that's how I do my fact-checking.
[06:28.920 --> 06:32.120]  I'll take that as a question of how do you make your stories accurate.
[06:33.700 --> 06:36.340]  At ZDNet News, we have a much different timeframe.
[06:36.460 --> 06:39.660]  As Doug said, he does an article in about 30 or 45 days.
[06:39.900 --> 06:43.060]  And in that timeframe, I've done about 30 or 50 articles.
[06:44.800 --> 06:51.320]  So accuracy is something that it's very, very difficult, and you need a lot of work in order to get there.
[06:52.340 --> 06:55.620]  There's a couple of things that I do along those lines.
[06:55.620 --> 06:57.300]  One is, as Deborah says, you sources.
[06:58.060 --> 07:00.180]  My sources are a little bit different from hers.
[07:00.920 --> 07:07.040]  I have a lot of people in the security industry as well, who I've talked to on a lot of bases.
[07:07.220 --> 07:10.860]  And as she said, a trusted source is one that we keep going back to.
[07:11.460 --> 07:26.160]  When you get a new claim from someone, you don't, you know, unless it's been already published out there somewhere, and there seems to be some reason to be very quick about it.
[07:27.400 --> 07:31.380]  Generally, we'll take a much longer time to fact check something like that.
[07:31.720 --> 07:38.840]  There's been a lot of claims of new viruses that I cover that we just dropped because, you know, they haven't really panned out.
[07:40.000 --> 07:47.260]  Other than that, at ZDNet, we also have a lot of resources internally as far as computer labs and people who know their stuff.
[07:47.260 --> 07:59.800]  When we got DOS last February, there was a lot of people I could talk to about, you know, what happened, what exactly were the packets coming across the network, and get kind of a breakdown of what happened.
[08:00.220 --> 08:05.940]  So, I guess the short answer to that question would be, you know, how are we accurate?
[08:06.060 --> 08:15.240]  Well, we're accurate because we have the sources, we've been in the business a little while, and we tend to be able to, you know, tell the BS from the good stories.
[08:17.360 --> 08:28.700]  Since I write for a publication that has a relatively leisurely pace compared to the other two up here, you know, I've got a little bit more time to talk with sources.
[08:28.880 --> 08:31.560]  I'm not as time pressured or time critical.
[08:32.200 --> 08:41.660]  And fortunately, I've never been in a case where I've, well, today, where somebody has gone, hey, I have this really hot story for you, and it's something nobody else has.
[08:42.900 --> 08:56.360]  More of my pieces have been something where I've actually had time to sit down and talk with a number of sources, a number of people, go to websites, go to some of the player, go to some of the primary players involved, as well as some people on background,
[08:56.760 --> 09:00.080]  and talk to them and pull together a relatively complete story.
[09:00.080 --> 09:04.220]  And if I've got a chance, you know, to go back and do a little bit more digging.
[09:04.440 --> 09:11.580]  I think one of the things that kind of concerns me when I do write about the hacker community is I've got this little thing around my neck, and it's a little bit more subtle.
[09:11.700 --> 09:12.580]  It's called the press pass.
[09:13.680 --> 09:19.120]  And I have to kind of scratch my head and go, should I have this up front or should I have this up back?
[09:19.120 --> 09:23.700]  Because when I was at DEFCON, you know, people try to play mind games with you.
[09:24.000 --> 09:27.360]  And sometimes people try to play mind games with you because you are the press.
[09:27.840 --> 09:33.160]  And some people try to play mind games with you because they think you're not the press and they just want to jerk your chain.
[09:38.160 --> 09:47.520]  From the website, I also had one other thing in that if you get a story wrong, you are told very quickly and very vehemently that you got the story wrong.
[09:47.520 --> 09:51.840]  And pretty soon... I mean you know it's a great learning experience.
[09:52.160 --> 09:57.920]  If you get one thing wrong, you hear from all the readers out there who are technically adept and who know what they're talking about.
[09:58.120 --> 09:59.480]  And they'll tell you that they got it wrong.
[09:59.780 --> 10:03.740]  And you do a lot of investigation then afterwards as well.
[10:04.040 --> 10:06.200]  As you know, hopefully you've done a lot of investigation beforehand.
[10:06.480 --> 10:15.360]  But in particular, you know, if you get technical detail wrong, you'll get a lot of investigation afterwards and you'll be able to next time around get the story right.
[10:16.100 --> 10:19.000]  Yeah, that's what happened with that story I just did on Napster.
[10:19.180 --> 10:21.060]  It took me almost a week to get it cleared up.
[10:22.240 --> 10:27.320]  Yeah, if people think you've screwed up, you know, they're not afraid in email to let you know about it.
[10:27.940 --> 10:30.840]  They're definitely not afraid to let you know about it and let your editors know about it.
[10:32.640 --> 10:33.540]  Can we take another one?
[10:39.540 --> 10:41.460]  Basically slamming the idea of corporate media.
[10:41.840 --> 10:44.320]  And being a member of the media myself, I write for Forbes.
[10:45.040 --> 10:47.600]  I'd like to know, I'd like you to address the question.
[10:47.920 --> 10:51.920]  Have you ever been told not to cover a story by your so-called corporate masters?
[10:52.660 --> 10:55.880]  You're with a supposedly... I know you guys are part of Meckler Media or something.
[10:56.040 --> 10:58.140]  Yeah, Meckler, Penton, who the hell knows these days?
[10:58.420 --> 10:58.860]  Yeah.
[11:00.420 --> 11:04.160]  The meeting house was at one time owned by SoftBank, which is a major Japanese firm.
[11:04.320 --> 11:05.020]  Still owned.
[11:05.320 --> 11:06.680]  Yeah, Computer World, I believe.
[11:06.900 --> 11:07.340]  IDG.
[11:08.360 --> 11:09.860]  Another major corporate company.
[11:10.020 --> 11:12.840]  Have you ever been told by anybody not to cover a story?
[11:17.880 --> 11:20.640]  Well, I'll take that on a different tangent.
[11:21.500 --> 11:22.740]  I have not...
[11:22.740 --> 11:38.040]  Board Watch, from the days that Jack Rickard, God bless his whiskey-drinking soul, started the company, has had a tradition of independence, and even after being acquired by Meckler Media, and then Meckler being acquired by Penton Media, I guess...
[11:38.040 --> 11:41.560]  Well, not this month, but still holding onto a publication.
[11:42.620 --> 11:45.380]  Board Watch, with its columnists, has made...
[11:45.380 --> 11:48.320]  and as well as with its editors, has maintained a sense of independence.
[11:49.480 --> 12:07.340]  In spite of those two corporate acquisitions, there has been a trend, a disturbing trend within Board Watch, to pander to the corporate interest in terms of advertisers that is being fought internally by the publishers and editors there.
[12:07.840 --> 12:11.960]  But sometimes things creep in and you're just like, what the F is this commercial doing there?
[12:12.640 --> 12:17.600]  I know that from where I write, I have had a different problem.
[12:18.340 --> 12:22.000]  Unlike the other two folks sitting over there, Board Watch is not my primary means of support.
[12:22.380 --> 12:24.220]  I have a day job in another company.
[12:24.680 --> 12:33.660]  And sometimes I find myself writing stuff, or have written stuff, that people within my company have said, well, why the F are you writing about this thing?
[12:33.900 --> 12:35.520]  We haven't signed that account yet.
[12:35.620 --> 12:37.020]  It's like, well, go ahead.
[12:39.100 --> 12:42.640]  But, you know, I think it's a rather unique problem from where I sit right now.
[12:45.240 --> 12:54.260]  I always find it interesting that you see, like in the New York Times, a Microsoft story on their site, and it's critical of Microsoft, and yet there's a Microsoft ad running right down next to it.
[12:55.960 --> 12:58.440]  In ZDNet, there's a couple of things.
[12:58.560 --> 13:05.400]  One is, everyone thinks that we're kind of like the big bad empire, because ZD was so strong in the technical publishing world for so long.
[13:05.400 --> 13:08.100]  But we're actually kind of a rogue entity within ZD.
[13:08.900 --> 13:15.500]  You know, we're much smaller, and now since the breakup, you know, they've sold off the publications and several other parts of it.
[13:15.880 --> 13:17.600]  We actually kind of really do our own thing.
[13:18.200 --> 13:31.460]  I mean, a lot of stories still come from the publications, but the reporters inside ZD, we are not given any direction, or at least any prohibitions from covering any stores.
[13:31.460 --> 13:34.420]  I've never actually been told that I can't cover a store.
[13:34.540 --> 13:45.060]  And actually, when I've been threatened by a couple of companies that there'd be retribution for stories that I've written, I just told them to go see my editors, and it's never come back down to me.
[13:45.060 --> 13:52.920]  So, at ZD9, I think we've gotten a lot of support from our editors to cover the stories that we want to cover.
[13:53.560 --> 13:58.000]  So, it comes down more to who is getting the information to us.
[13:58.940 --> 14:04.520]  After a little while of being in the industry, you can start picking and choosing your stories.
[14:04.520 --> 14:16.540]  But when a new reporter comes in, sometimes he needs a lot of management to make sure that the information that's coming into him is not kind of a PR line, and that he ends up covering or slanting a story towards the people who gave him the information.
[14:17.880 --> 14:22.840]  Computer World has a strong policy about keeping vendors out of the feature stories for the most part.
[14:23.500 --> 14:26.200]  I built my own reputation as a freelancer.
[14:26.380 --> 14:31.700]  I spent a year at Software Magazine about two and a half years ago, and that was a nightmare I care to forget.
[14:32.940 --> 14:35.760]  There was a lot of that going on at Software Magazine.
[14:36.120 --> 14:46.380]  There were problems with funding, and I was specifically once sent as a sacrificial lamb to go cover a new remote control device at Computer Associates.
[14:46.980 --> 14:48.680]  I really resented that.
[14:49.020 --> 14:55.000]  My termination followed immediately after that experience, after I sent a long letter of complaint to the publisher.
[14:56.820 --> 15:02.640]  Now, I'm finding as a staff writer that there's a lot more pressure to pay attention to vendors.
[15:03.240 --> 15:07.600]  And the vendors are the most nauseating part of this whole business.
[15:08.180 --> 15:16.540]  And I literally just, the night before last from here, fired off a letter to my editor saying, I'm not going to talk to vendors anymore unless I need to for the stories I want to write.
[15:16.720 --> 15:18.040]  I've been there for a month.
[15:18.180 --> 15:19.620]  We'll see if they go for it.
[15:19.720 --> 15:21.120]  If they don't, I'll go back to freelancing.
[15:22.860 --> 15:29.720]  The news reporters at Computer World do have to regurgitate a lot of vendor information, and they have to do it on deadline.
[15:30.340 --> 15:31.800]  The schedule is horrendous.
[15:31.940 --> 15:35.020]  They do two to three stories a week, plus stuff for the online section.
[15:35.540 --> 15:37.740]  And I'm just really glad I'm not one of those.
[15:38.960 --> 15:40.660]  I also have to say one other thing.
[15:40.860 --> 15:44.240]  I sometimes sit on the other side of the fence in terms of media buying.
[15:44.240 --> 15:51.180]  And I know that I've had certain publications drop the hint if I actually bought ad space.
[15:51.560 --> 15:53.460]  We may see more ink coverage there.
[15:55.340 --> 16:07.060]  You know, other people at least tell the lie quite truthfully that coverage of stories is not directly linked to how much advertising space that you buy.
[16:08.020 --> 16:10.960]  They tend to link it to dinners at the Palm and other good restaurants.
[16:11.260 --> 16:22.680]  But in other cases, there is a causality link, like it or not, between the amount of advertising that I, as a vendor, might do and the amount of press coverage that I might get.
[16:22.780 --> 16:33.860]  Now, that's different from hackers because, you know, nobody out here is really buying advertising in Computer World or ZD or anything like that.
[16:35.100 --> 16:36.720]  Can I ask another question?
[16:40.610 --> 16:43.250]  How would you like to talk explicit stories?
[16:44.110 --> 16:44.870]  Can I start?
[16:45.290 --> 16:45.430]  Yeah.
[16:45.750 --> 16:56.850]  I'm going for the bigger picture issues, the things that affect my readers the most, the paradigms that are happening in the society as a result of the hands-on work that they're doing with the bits and bytes of it.
[16:56.850 --> 17:07.230]  That's why I cover the hacker scene so much, because even though you folks are perceived as being on the fringe, you're also really working for some social change.
[17:07.350 --> 17:14.670]  And especially this year, I'm seeing some coordination of effort that looks more like political movement to me than random hacking.
[17:15.630 --> 17:24.670]  And it's interesting, too, when I got blasted for the Napster article, every single one, and I must have gotten 150 mails, and I'm not exaggerating, had a hacker handle.
[17:24.850 --> 17:26.230]  And I thought that was very interesting.
[17:26.230 --> 17:30.070]  I forwarded that little tidbit to my editors and said, these are our readers.
[17:31.070 --> 17:32.910]  So, just thought you guys would like to know that.
[17:33.690 --> 17:35.630]  I know what I'm writing about this weekend.
[17:36.710 --> 17:37.430]  No, you're not.
[17:37.870 --> 17:38.610]  Me first.
[17:41.870 --> 17:47.270]  You know, it's kind of interesting, because ZDNet, we're kind of growing now.
[17:47.490 --> 17:54.770]  So, until for a long time, we had a shortage of reporters, but we definitely had far less reporters than there were stories out there.
[17:54.850 --> 17:57.870]  So, I was covering a fairly large beat, including consumer technology.
[17:57.990 --> 18:07.530]  And there's a large difference between a beat that's basically product-oriented, like, you know, consumer technology would be about games, or be about consumer software.
[18:07.910 --> 18:11.670]  You'd have those companies that would come right up to you and tell you, hey, this is what we're doing.
[18:11.770 --> 18:12.690]  This is great.
[18:12.970 --> 18:14.070]  Why don't you cover this?
[18:14.250 --> 18:18.710]  And you would basically, you know, turn on your BS filter and try to pick the right stories out of that.
[18:18.910 --> 18:22.150]  In the security industry, no one wants you to know that they've been hacked.
[18:22.390 --> 18:26.970]  No one wants you to know whether or not, you know, they've just suffered a DOS attack.
[18:26.990 --> 18:32.990]  Actually, though, in February, I had a couple companies that thought suddenly it was a great PR move to start telling you that you had a DOS attack.
[18:34.610 --> 18:39.130]  So, a lot of it comes from an interest in technology.
[18:40.610 --> 18:46.650]  I am actually graduated as an electrical engineer, did some research a long time ago.
[18:46.890 --> 18:48.710]  So, I'm fairly technical.
[18:48.970 --> 18:50.470]  I'm still deeply into that.
[18:50.630 --> 18:54.950]  And a lot of what motivates me as a writer is, you know, love of technology.
[18:55.830 --> 19:05.150]  So, you know, when the CDC does what they do, you know, their kind of performance art in the beginning is not what interests me.
[19:05.210 --> 19:09.950]  It's more the technical aspects or the...
[19:11.130 --> 19:13.230]  Well, actually, it was less than 10% technical.
[19:13.230 --> 19:18.610]  But, you know, be that as it may, that's, you know, that's pretty much what I'm looking for in all of this.
[19:18.730 --> 19:24.810]  And I talk to, you know, I'm on several lists and I talk to a lot of people in the security industry on a regular basis.
[19:24.890 --> 19:26.050]  So, that all helps.
[19:26.070 --> 19:27.310]  So, I guess you do read BudTrack?
[19:27.890 --> 19:29.390]  Oh, I read BudTrack, yeah.
[19:29.510 --> 19:32.590]  But there's, you know, there's better places to find your stories than that as well.
[19:32.670 --> 19:40.190]  I mean, the other problem is that while ZDNet is a technical pub, we are focused a lot on the general business audience.
[19:41.330 --> 19:49.190]  So, you know, the general bugs that are out there, you know, occasionally there are some big ones, but most of them kind of fly beneath our radar.
[19:49.190 --> 19:53.550]  We handle them on other parts of our site like the help or how-to.
[19:55.670 --> 19:59.990]  Well, you know, I heard rumors about an orgy up here in association with conference.
[20:00.930 --> 20:02.610]  Somebody tell me about that off the record.
[20:02.770 --> 20:03.530]  I'd really like to know.
[20:05.570 --> 20:06.850]  I bought a t-shirt.
[20:07.310 --> 20:07.770]  Oh, okay.
[20:10.930 --> 20:11.810]  Good for that.
[20:11.910 --> 20:12.410]  Yeah, anyways.
[20:12.570 --> 20:13.370]  Yeah, where's Mike Shoup?
[20:13.430 --> 20:14.190]  I want to ask him now.
[20:16.070 --> 20:18.450]  Now, I think that the...
[20:19.950 --> 20:22.930]  I've been fortunate enough to be able to pick the stories that I want to write.
[20:24.210 --> 20:33.870]  Occasionally, I've been thrown things where obviously a PR flack or PR shill has come in and said, Oh, yeah, why don't you write us the wonderful story about filling the telco?
[20:34.030 --> 20:35.410]  And it's like, yeah, okay, whatever.
[20:36.290 --> 20:38.870]  And I've been able to go, well, you know, sorry, I don't have time this month.
[20:42.010 --> 20:56.550]  But I've, you know, I think that, again, Board Watch has been rather unique in the fact that we really don't, the columnists really don't coordinate as much as they should.
[20:56.550 --> 20:59.230]  And sometimes we have what's known as Happy Serpendipity.
[20:59.790 --> 21:06.250]  In that last year at DEFCON, I was there and I covered one facet of the story.
[21:06.250 --> 21:14.930]  Tom Stark did a whole thing about back orifice and that scene.
[21:15.250 --> 21:17.970]  And then, I guess, I forget who the third writer was.
[21:18.150 --> 21:27.010]  Also did a different spin on DEFCON based upon what he saw because he was more of a security expert than I was.
[21:27.730 --> 21:29.590]  And sometimes we come out really good.
[21:31.610 --> 21:34.330]  But, fortunately, I'm in an environment where I can pick stories.
[21:34.470 --> 21:37.570]  So if you've got a really good story about something like a carnivore, come see me.
[21:41.050 --> 21:44.010]  Okay, last question first, and then a real question.
[21:44.630 --> 21:47.630]  What operating system do you have at home, operating systems?
[21:48.030 --> 21:53.390]  And also, what do you think of the slash-shot phenomena that sort of roll your own media?
[21:55.570 --> 21:58.590]  I don't know if you've ever seen a site called Corrosion.
[21:58.710 --> 22:00.290]  It's got a five for an S.
[22:01.390 --> 22:05.030]  Basically, the readers actually pick the stories that show up on the front page.
[22:05.190 --> 22:08.430]  What do you guys think about that whole movement?
[22:08.690 --> 22:10.110]  I just want to grab this one really quick.
[22:11.670 --> 22:14.410]  I'll answer those in kind of reverse order first.
[22:15.010 --> 22:27.910]  The slash-shot phenomenon from the perspective of ZDNet and I would imagine other major websites out there is that you have quite a few of your hits coming from...
[22:27.910 --> 22:33.230]  For instance, ZDNet, if you read a story, at the bottom a lot of times will be something called the talk-back section.
[22:33.970 --> 22:36.090]  And we let the readers talk back.
[22:36.270 --> 22:39.850]  And it's interesting because about the same thing that happens on slash-shot happens there.
[22:40.030 --> 22:44.930]  And that is the first three people post about the story and then everybody else posts about the posters.
[22:44.930 --> 22:47.390]  So, you're driving a lot of traffic.
[22:49.690 --> 22:57.150]  In one case, I don't... some of you may remember a column by... I use the word loosely... by John Tachek.
[22:57.350 --> 23:02.130]  That kind of was very, very critical of the open source movement.
[23:02.390 --> 23:06.090]  And he got slammed on both Slasdot and on our site.
[23:06.570 --> 23:11.770]  And we were accused of driving traffic to our site by having a bad columnist.
[23:11.770 --> 23:13.190]  And, you know, that was not the case.
[23:13.190 --> 23:15.630]  But on the other hand, it works.
[23:16.190 --> 23:17.470]  You get a lot of people there.
[23:17.570 --> 23:18.830]  They're just there for the discussion.
[23:19.550 --> 23:24.970]  If you... you know, whether your columnist is good or bad, they tend to talk a lot about it.
[23:25.150 --> 23:32.310]  So, community-based posting, you know, kind of... I mean, Slashdot really isn't even news.
[23:32.430 --> 23:35.970]  They don't write news, but they just bring up the news story of the day and people talk about it.
[23:36.230 --> 23:38.490]  That sort of thing is going to drive a lot of traffic.
[23:38.490 --> 23:41.410]  And I think you'll see it as part of every site in the future.
[23:42.390 --> 23:49.470]  On the first question, I used... I was a Mac fanatic for a long, long time.
[23:52.390 --> 23:54.970]  But, unfortunately, I was also a games fanatic.
[23:55.090 --> 23:56.950]  And the two didn't necessarily go together.
[23:57.230 --> 24:01.150]  So, about three years ago, I got my first Windows box.
[24:01.150 --> 24:04.670]  And about two years ago, I just switched over to Linux.
[24:05.110 --> 24:09.170]  And now my default mode and startup is to start up into Linux.
[24:09.430 --> 24:12.550]  And I bought a laptop and within three hours, I had Linux on it.
[24:12.690 --> 24:14.270]  So, that's what I use.
[24:16.950 --> 24:18.470]  I use Windows 98.
[24:21.570 --> 24:22.850]  Said very meekly.
[24:24.790 --> 24:25.210]  What?
[24:26.150 --> 24:26.750]  Thank you.
[24:27.630 --> 24:30.730]  Oh, I'm still running Apple DOS 3.3 on the 2A.
[24:30.850 --> 24:31.330]  No, just kidding.
[24:35.300 --> 24:36.320]  No, no, no, no.
[24:36.420 --> 24:38.680]  Actually, I have to come out of the closet here and please be gentle.
[24:38.700 --> 24:46.080]  But I do use that Microsoft product, which probably means I'm screwed now, tomorrow.
[24:47.040 --> 24:56.560]  No, but I also, but it's funny because I also try to read mail as much as possible off of a shell prompt off of a Unix machine using Pine.
[24:56.880 --> 24:58.320]  And you may laugh.
[24:58.440 --> 24:59.720]  And you may laugh.
[24:59.880 --> 25:01.000]  But you know what?
[25:01.340 --> 25:04.320]  Nobody screwed me with any goddamn I love you viruses.
[25:06.340 --> 25:13.500]  There's something to be said for being anarchist, not anarchist, archaic in terms of that sort of thing.
[25:13.500 --> 25:20.860]  Because all these newfangled viruses are basically targeted straight at Microsoft.
[25:21.220 --> 25:26.560]  And if you do things in a more archaic fashion, then you're less likely to get screwed.
[25:29.080 --> 25:32.260]  No, I disagree with the word, I mean, archaic.
[25:32.900 --> 25:42.760]  And I think that the concept is as long as you do not use how much you use networks and you use different systems, and not of that way that you've lost.
[25:43.740 --> 25:45.760]  Well, yeah, I can agree with that.
[25:45.820 --> 25:58.980]  I had a good laugh a couple of years ago when I was running a lab of computers, and they all ran VMS using TCP IP, and then Tappan's more virus program.
[25:59.100 --> 25:59.560]  Not virus.
[25:59.820 --> 26:04.220]  His big worm came out and shut down half the world except for my 12 machines at University of Maryland.
[26:05.540 --> 26:05.940]  So...
[26:09.080 --> 26:09.980]  Diversity is good.
[26:10.580 --> 26:11.320]  Slashdot question.
[26:11.620 --> 26:15.340]  I've looked at Slashdot a little bit and just, you know, browse through it.
[26:15.440 --> 26:16.620]  It's like, hey, it's a cool concept.
[26:17.360 --> 26:19.200]  Beyond that, I can't really offer up an opinion.
[26:19.740 --> 26:23.760]  I would like to add one more thing on Slashdot, is that I actually go there every morning.
[26:24.080 --> 26:27.900]  And I take a look at the, you know, what articles they're talking about.
[26:28.040 --> 26:33.500]  And that's one of probably about 12 sites that I browse in the morning to see whether or not there should be anything that I'm covering that day.
[26:37.550 --> 26:38.250]  Anybody else?
[26:40.270 --> 26:41.110]  Bring it on!
[26:42.210 --> 26:42.730]  No tomatoes.
[26:43.030 --> 26:43.930]  Okay, I have to ask the question.
[26:44.030 --> 26:45.390]  Does anybody know where Brock Meeks is?
[26:45.390 --> 26:48.390]  I have to... I mean, if we have to post bail for him...
[26:49.210 --> 26:49.910]  You know, I go...
[26:49.910 --> 26:50.650]  4G!
[26:51.810 --> 26:52.650]  He's probably...
[26:52.650 --> 26:53.890]  That doesn't start until 7.
[26:53.970 --> 26:58.210]  He's probably posting his CDC story while he has all the competition up here talking.
[27:00.990 --> 27:02.650]  This would be geared more towards you.
[27:03.590 --> 27:09.150]  Was there any bias in the writing of ZDNet during the distributed denial of service tax?
[27:09.670 --> 27:12.550]  Was there any pressure to be more critical of them?
[27:12.550 --> 27:19.030]  Because I did notice, if you read the articles, they were a little bit more critical than when they talked about previous attacks of other companies.
[27:19.070 --> 27:22.070]  Was there any, like, internal pressure to be more critical?
[27:23.650 --> 27:25.510]  You know, I didn't get any internal pressure.
[27:25.750 --> 27:30.470]  I actually got a closed-door briefing on what happened exactly.
[27:31.070 --> 27:33.870]  It had to be, you know, on background for all of it.
[27:33.950 --> 27:36.410]  I mean, none of these companies like to talk about what exactly happened.
[27:36.410 --> 27:39.650]  I had a hard time tracking down anybody, including people internally.
[27:41.390 --> 27:53.590]  You know, I have never gotten any pressure from anybody within our site as far as needing to shut down a story or to slant it in a certain way.
[27:54.930 --> 28:00.770]  Occasionally, I tend to be kind of a... I tend to go after the underdog stories.
[28:01.810 --> 28:05.430]  I typically like to, you know, the underdog technology and that sort of thing.
[28:06.430 --> 28:13.830]  And a few times when I've taken a few pot shots at the majors that shouldn't be...
[28:13.830 --> 28:18.210]  I mean, you know, every day you're putting out, or at least in my case, I'm putting out one or two stories.
[28:18.210 --> 28:28.070]  And sometime, you know, as far as objectivity on the reporter's side, I've sometimes strayed from that and the editors have rightfully brought me in line.
[28:28.590 --> 28:34.890]  But aside from that, there hasn't been any censorship or anything like that on the part of ZDNet.
[28:37.910 --> 28:38.430]  Next.
[28:40.290 --> 28:54.650]  I know the media gets kind of beat up for and accused of changing the word hacker, sort of maligning it and changing it in a way that the right has changed the word feminist or the word liberal into something that's just evil and mean and nasty.
[28:55.330 --> 29:01.170]  So I would like to know... I would like to know what your definition of the word hacker is.
[29:01.170 --> 29:02.190]  Can I start?
[29:02.410 --> 29:02.490]  Yep.
[29:02.670 --> 29:10.310]  Those of us who have been covering this for a while, we're constantly using the word cracker when something malicious or illegal is happening.
[29:10.690 --> 29:15.590]  I interchange the word cracker with attacker when there's like the DDOS attack to report.
[29:16.570 --> 29:21.550]  My editors, more times than I can tell you, have changed it back to the word hacker.
[29:21.850 --> 29:26.250]  And as a freelancer, I never got to see my edited copy before it went to press.
[29:26.490 --> 29:37.910]  Now I'm seeing it, it's coming back to me and I have to carefully read everything because even though I thought I educated all of my editors, just in my last hack of the month, it came back, the word cracker had been changed for hacker again.
[29:38.130 --> 29:45.410]  So it's a difficult task to keep everybody on the right definition terms with this in the media.
[29:45.610 --> 29:48.550]  And when you've got new reporters coming in, it's even worse.
[29:51.410 --> 29:53.950]  I actually hate the term cracker.
[29:54.650 --> 29:56.150]  I think it's probably the...
[29:56.910 --> 29:58.750]  I mean, I've had this discussion.
[29:59.030 --> 30:02.610]  There are news groups that I'm on with several other members in the security industry.
[30:02.610 --> 30:07.530]  And we've had long discussions over this because it always comes up once every six months.
[30:07.530 --> 30:17.150]  Someone writes an article and there's a hacker in it and you get maybe, you know, 200 emails from people saying, you know, that's the wrong word of... the wrong choice of words.
[30:17.790 --> 30:27.330]  And for me, it comes down to my definition of hacker is someone who has skill, not only has skill, but has a lot of curiosity.
[30:27.330 --> 30:35.410]  It's going out, it's cracking open machines, you know, looking at the hardware, or, you know, cracking open software and looking at the software.
[30:36.670 --> 30:40.250]  And it's more kind of curiosity that drives them than trying to make a statement.
[30:40.890 --> 30:49.850]  I don't necessarily... I mean, there's hacktivism out there, but I think that's a... your world views are completely irrelevant to whether or not you're a hacker.
[30:50.950 --> 31:05.150]  As far as... but most of the time, actually, when there's a security incident or an attack, I will use network attacker, or I will start using the newfangled words like cyber vandal, or script kids where appropriate.
[31:06.010 --> 31:14.010]  But, you know, it's... it's one of the harder decisions in word choice than, you know, that you have out there when you... when you're writing articles.
[31:15.010 --> 31:33.330]  Well, I think it's interesting because if I take the purest definition, I have to go to the Steven Levy book that, you know, a hacker is someone who likes to solve problems in a technical sense, and it... you know, sometimes people use those skills to solve problems for relevantly benevolent purposes,
[31:33.590 --> 31:36.830]  and sometimes for relatively... relatively malevolent purposes.
[31:37.890 --> 31:41.210]  And I think that takes us down to a second level where...
[31:41.890 --> 31:48.190]  where there is more ethics and more thinking going on within the hacker community, both at DEFCON and here and other places.
[31:48.370 --> 31:53.170]  Whereas, you know, what level... you know, how do you define what a criminal is?
[31:53.170 --> 31:56.470]  I mean, for example... I forget.
[31:56.710 --> 31:58.190]  Not Kevin Mitnick, but the other guy.
[31:58.390 --> 31:59.130]  Kevin Poulsen.
[31:59.330 --> 31:59.870]  Poulsen.
[31:59.970 --> 32:00.610]  Yeah, okay.
[32:00.710 --> 32:13.750]  Poulsen goes... takes control of a phone switch, grabs all the telephone lines to a radio station, and makes himself caller number 100, since he owns all the lines.
[32:13.750 --> 32:15.030]  He can do that quite easily.
[32:15.470 --> 32:16.790]  And wins a Ferrari.
[32:16.790 --> 32:19.470]  Now, that's a very cool hack, okay?
[32:20.050 --> 32:25.730]  But at the same time, there's a certain amount of... you know, is the action that he did criminal?
[32:26.590 --> 32:31.210]  And the answer is, well, taking over the phone switch probably wasn't a legal thing to do.
[32:32.710 --> 32:36.350]  And the reason why I bring back this issue of criminal is that I know that folks like...
[32:36.350 --> 32:56.050]  at 2600 have tried to make Mitnick and other folks poster childs for civil rights and First Amendment rights, but let's not... you know, let's not BS the fact that at some point in time these folks did break laws.
[32:56.050 --> 33:07.790]  And, you know, that... trying to ignore that within the definition of, you know, what you want to call a hacker, you know, you have to call a criminal a criminal sometimes, too.
[33:08.010 --> 33:23.790]  On the other side of the coin, we're starting to see a lot of abuse of the word hacker by both the record industry and by the motion picture industry, who wants to call anybody who uses an MP3 or anybody who wants to use DVD decoding technology.
[33:23.790 --> 33:24.710]  They're criminals.
[33:24.970 --> 33:27.430]  They want to say everybody's a hacker, everybody's an illegal criminal.
[33:27.550 --> 33:28.550]  That's bullshit, too.
[33:28.790 --> 33:29.550]  Yeah, or a pirate.
[33:29.830 --> 33:31.050]  So, you know, they're pirates.
[33:31.210 --> 33:32.210]  They're off to do piracy.
[33:32.370 --> 33:35.370]  And that's the reason why we're going to have a lawsuit on Monday.
[33:35.810 --> 33:43.170]  And it's not because of the fact that this poor kid in Denmark, you know, he's a hacker in the purest sense of the word, but is he a criminal?
[33:43.370 --> 33:44.190]  I don't think so.
[33:44.670 --> 33:47.690]  But, you know, Motion Picture Association would like to take that word hacker.
[33:47.690 --> 33:56.490]  as well as Maria with Napster and say, okay, everybody who does things not according to the corporate way is a criminal.
[33:56.650 --> 33:57.870]  And I think that that's wrong, too.
[33:58.550 --> 34:01.030]  So, there's still going to be a lot of fights.
[34:01.170 --> 34:09.470]  I mean, the battle over what hacker means is still being defined as to who actually owns that term and the shadings on that term.
[34:09.950 --> 34:12.050]  We're going to be fighting about that for any number of years.
[34:13.810 --> 34:15.410]  And hopefully, we'll get...
[34:15.410 --> 34:24.170]  Hopefully, the community that owns that definition will be able to define that, not the corporations such as RIA and MPAA.
[34:25.630 --> 34:30.030]  You know, we'll try to mix that definition up to be shaded in a bad way.
[34:30.930 --> 34:34.970]  A big part of what you have to realize is the people that own that term are sitting in this room.
[34:35.170 --> 34:35.950]  They're your readers.
[34:37.070 --> 34:40.070]  You know, I wrote a number of stories about Kevin Mitnick for Wired News.
[34:40.510 --> 34:44.450]  And my editor changed the term hacker in every instance to the word cracker.
[34:45.250 --> 34:58.490]  And he did that after long conversations and a number of phone calls and some heated exchanges because six people had written him emails saying thank you for using the word cracker instead of using hacker when you talk about these kids.
[34:58.650 --> 34:59.950]  You know, I'm an old school hacker.
[35:00.270 --> 35:05.250]  I was at MIT in the 60s and I did all these wonderful things and they're disparaging my name now.
[35:05.670 --> 35:07.090]  Six emails he got.
[35:07.890 --> 35:20.650]  And I'm sure, you know, after I talked to the people, a number of people wrote back and used, you know, some sort of screwed up hacks or elite speak to say, you know, you're doing it all wrong, fuck you.
[35:21.310 --> 35:22.650]  You don't know what you're talking about.
[35:22.790 --> 35:23.730]  And of course they get ignored.
[35:23.950 --> 35:37.050]  And I think if hackers respond to those kind of stories as readers, as consumers, as part of that network, you talk about getting 150 emails, you send that to your editor, they tend to listen because that's the readership.
[35:37.870 --> 35:43.230]  And I think that that is the way that those kind of changes get made or those kind of influences happen.
[35:44.150 --> 35:59.450]  The other question I wanted to ask each of you is, since there's a lot of concern voiced by hackers about the image of the hacker in the media, I think one of the answers is to get hackers more involved in the reporting process as sources and so on.
[35:59.450 --> 36:02.390]  And I'm wondering if each of you could talk about what makes a good source?
[36:02.990 --> 36:04.950]  What makes a hacker somebody you would rely on?
[36:06.170 --> 36:14.970]  Because, you know, I know a lot of them say I want to educate the press, I want to educate the media, but oftentimes my experience has been some of them you talk to for two hours and there's not a quote you can use.
[36:15.910 --> 36:17.330]  What makes a good source?
[36:17.930 --> 36:25.290]  And what's something that you would like to tell the audience, the hackers that are here, if they have something to add, how do they get that information to you?
[36:27.450 --> 36:38.090]  The first thing is that, you know, stop the bragging and stop the mindless, I can do this, I can do that, and let us know what the relevance is to our readers.
[36:39.290 --> 36:45.050]  I try to talk about things that are really going to affect my readers in their ability to do their jobs.
[36:45.390 --> 36:48.730]  And if you can bring it into that context, it's a lot easier.
[36:48.730 --> 37:10.510]  Also, the technical jargon can be minimized a bit so that the hacks or the exploits or the security bug or the weakness in the software can be explained in terms where we can see what the end result is of that bug or that weakness in the software instead of,
[37:10.630 --> 37:12.270]  I just found this and I did this.
[37:12.270 --> 37:13.690]  What's the end result?
[37:13.910 --> 37:17.350]  You know, is this a widespread problem for my readers?
[37:17.570 --> 37:20.410]  Is this something people are going to take advantage of?
[37:20.570 --> 37:24.970]  Is this just a minuscule little thing that I really don't need to bother with at this moment?
[37:25.550 --> 37:27.050]  Is it a one-two punch?
[37:27.210 --> 37:33.410]  Do you have other elements that could be combined to make this a completely big problem for my readers?
[37:33.950 --> 37:36.130]  And is your information reliable?
[37:36.810 --> 37:39.590]  Do you have someone else I can talk to to verify this?
[37:39.750 --> 37:40.930]  Have you tried this?
[37:41.570 --> 37:43.630]  How do you want me to handle your identity?
[37:44.570 --> 37:51.490]  If it's something that could get you in trouble at work, you need to state that right up front so that we can make sure we protect you as sources as well.
[37:51.970 --> 37:53.990]  Those are pretty much the things I look for.
[37:56.850 --> 37:58.810]  The first thing I definitely look for is integrity.
[37:58.810 --> 38:04.450]  I mean, you're not going to take a source... if you get burned by a source once, you're never going to be going back to them ever again.
[38:05.910 --> 38:10.670]  You know, it is... it's definitely... we're not infallible up here, so... and I'm sure you all know that.
[38:11.970 --> 38:21.910]  But, you know, as far as sources go, you have to develop them, you talk with them a lot, and you try to get a measure of who they are, how far their technical expertise goes.
[38:22.450 --> 38:33.630]  There are a lot of people who claim to be a lot more technical than they are, and you have to be able to kind of weed them out and make sure, you know, that your sources aren't feeding you a line.
[38:33.930 --> 38:40.470]  And there's also, I mean, for myself, I don't know about the others up here, but I tend to put sources into a lot of different categories.
[38:40.890 --> 38:45.810]  There's a few that I keep on deep background and I'll just talk to, to try to sound out stories.
[38:46.210 --> 38:50.170]  They're the people I trust the most and the people that I wouldn't want to, you know...
[38:50.170 --> 38:54.230]  If you need to get a quote, I'm sure I can get a quote from about a hundred different people.
[38:54.230 --> 39:04.190]  But when I really need to understand the story, understand the technology behind the story and what's being used, then you want someone that you can definitely trust and who you know understands the material to go to.
[39:06.390 --> 39:07.190]  Good sources.
[39:08.150 --> 39:11.270]  I'd have to say there are probably like three different aspects.
[39:12.030 --> 39:22.250]  Number one is the ability, forgive me, but to communicate in the English language, at least in such a fashion that I can understand, you know, because I got to go...
[39:22.250 --> 39:27.530]  If you can't explain it to me and relate it to me, what the heck's going on, then I got to go relate that to my readers.
[39:27.650 --> 39:32.930]  And the more obscure you are, the more problems I will have in translation.
[39:34.890 --> 39:39.670]  I think secondly, you've got experience and some unique information.
[39:41.350 --> 39:42.290]  Don't kid yourselves.
[39:42.490 --> 39:44.670]  There are a lot of people with a lot of different stories out there.
[39:45.110 --> 39:53.210]  But if you've got a unique spin on it, or if it's something that I haven't heard from somewhere else, yeah, okay, maybe I'm going to give you, you know, the time of the day versus...
[39:55.170 --> 39:58.810]  versus going, yeah, yeah, whatever, and move on to the next card in my Rolodex.
[40:00.730 --> 40:02.590]  I guess those would be the two ones.
[40:02.690 --> 40:07.050]  Now, we have an interesting special guest where she's social-engineered her way up here.
[40:07.750 --> 40:09.170]  I'll let you introduce yourself.
[40:09.170 --> 40:10.790]  I guess she's the Brock Meeks substitute.
[40:11.970 --> 40:14.350]  Oh, well, I didn't know I was substituting for anybody else.
[40:14.650 --> 40:16.970]  But my name is Vicki Navratulova.
[40:17.290 --> 40:21.170]  All right, for Silicon Prairie, which is the tech magazine for Chicago Tribune.
[40:22.450 --> 40:28.710]  I have a monthly security column, and every other month I'll share a Linux column with this other guy.
[40:29.610 --> 40:30.630]  We skip months.
[40:30.890 --> 40:33.290]  And it's available online and in print for free.
[40:34.690 --> 40:37.130]  I signed up for this panel, like, two days ago.
[40:37.930 --> 40:40.670]  I just realized it was going on now, so that's why I'm late.
[40:41.350 --> 40:52.570]  I come from the background where I have a degree in computer science, and I came from a technical background and then started writing about it, because I used to work for network security for the Tribune.
[40:52.790 --> 41:06.670]  And there I met some people who were looking for writers, especially about technical stuff, because a lot of their business people were being assigned to write tech articles, and then they didn't really understand the gist of what was going on.
[41:06.670 --> 41:15.610]  And they could summarize something or generalize something in a way that they thought would make the issue clearer to people, but instead would just confuse the matter.
[41:15.770 --> 41:19.970]  And all the hacker community would be up in arms saying, how can you say this?
[41:20.070 --> 41:20.870]  It's completely wrong.
[41:20.870 --> 41:31.730]  So, for me, sources... sources, I guess, would just be people I know, people I see on BUGTRAC, the general hacker community stuff.
[41:32.690 --> 41:41.330]  Since I don't really need to ask anybody to explain stuff to me generally in the technical sense, but...
[41:41.830 --> 41:42.970]  Any other questions out there?
[41:43.810 --> 41:44.550]  Bring them on!
[41:44.550 --> 41:46.070]  I'd like to ask another question.
[41:46.490 --> 42:02.550]  You know, last year, in 1998 as well, there was a proliferation of hacker groups, and I'm using both words and quotes, defacing websites and then media...
[42:03.370 --> 42:05.390]  I mean, then spreading it out of proportion.
[42:05.890 --> 42:13.550]  Do you feel that at the moment something like this still attracts the same attention as it was in 1998?
[42:14.770 --> 42:17.610]  where essentially it was a frontline use?
[42:18.530 --> 42:31.130]  Or is it by now something that the people got used to, and something that's just another risk of doing business at most would be considered a nuisance?
[42:32.310 --> 42:34.090]  I'd say, yeah, definitely.
[42:34.630 --> 42:38.230]  It's the easiest thing for somebody to grasp, to understand, is not technical.
[42:38.390 --> 42:41.630]  They can see their website's been changed, and they think that it's disastrous.
[42:41.630 --> 42:47.510]  Even now, if you're a security person, you go to a corporation, and you try and explain to them that they need security, and they'll say, well, why?
[42:47.990 --> 42:49.190]  And what's the worst-case scenario?
[42:49.410 --> 42:53.450]  And you can say, well, your payroll information has been stolen, but it doesn't really seem to hit them.
[42:53.510 --> 42:57.510]  But if you say, your front page will be changed with something, and they'll be like, breasts there!
[42:57.930 --> 42:59.290]  Then it's, you know, a big deal.
[42:59.450 --> 43:00.830]  It's the only thing they really understand.
[43:00.830 --> 43:04.210]  No, the breasts are the orgy this evening, where I'm still trying to find out where it is.
[43:04.310 --> 43:05.610]  But she says it's in seven minutes.
[43:07.190 --> 43:08.350]  Yeah, a couple of things on that.
[43:08.430 --> 43:16.010]  One is, if you go and look at attrition, in last November, there was about something like over 50 web defacements in one day.
[43:16.830 --> 43:19.670]  You know, there's a lot, we're getting a lot of web defacements out there.
[43:19.670 --> 43:26.950]  But if you look at what the coverage is of those defacements, there's not actually all that much coverage out there, percentage-wise.
[43:27.570 --> 43:44.510]  But a different aspect from that, when you see someone like Nike get hacked, or they get DNS to masquerade, or whatever you want to call that particular attack, is that these are things that can really affect the corporate image.
[43:44.510 --> 43:50.430]  And today, more than at any other time in our history, a corporate image has a big dollar value.
[43:50.630 --> 43:55.010]  So these attacks can really be important for business managers out there.
[43:56.590 --> 44:00.430]  I usually only use references in statistics.
[44:00.430 --> 44:06.270]  You know, how many websites got hacked last year, if I'm ever doing anything about protecting your web server.
[44:06.990 --> 44:11.110]  But for the most part, web hacks are like graffiti to us now.
[44:11.990 --> 44:14.230]  It's almost the same with viruses, really.
[44:14.450 --> 44:22.270]  You've got every vendor in the world who makes virus protection comes up with a new virus every day, and they think we should cover it in our hack of the month column, or whatever.
[44:22.970 --> 44:28.250]  And people are starting to sleep on the viruses, and we're starting to sleep on the website hacks, really.
[44:28.610 --> 44:31.110]  We're looking for stuff that's more widespread.
[44:31.750 --> 44:35.590]  It's more damaging to the systems themselves.
[44:36.730 --> 44:38.550]  Well, I think, too, it was rather amusing.
[44:38.710 --> 44:40.970]  I was at DEFCON last year on the first day of DEFCON.
[44:41.170 --> 44:42.070]  Their site was hacked.
[44:43.510 --> 44:45.150]  You know, it's kind of like one of those O.
[44:45.250 --> 44:46.090]  Henry-esque ironies.
[44:47.650 --> 44:49.810]  Either that or somebody at NSA wanted revenge.
[44:51.170 --> 44:56.690]  But seriously, folks, I mean, the, you know, people are starting to wise up about security.
[44:56.690 --> 44:59.130]  And, you know, you have this big rash of coverage.
[44:59.530 --> 45:05.290]  People get wise about security, and they tighten down the bolts in one area, and then they become vulnerable in another area that they haven't looked at.
[45:06.250 --> 45:07.050]  That's evolution.
[45:07.390 --> 45:08.870]  Now, at first it was website hacks.
[45:08.930 --> 45:09.710]  Now it's viruses.
[45:10.890 --> 45:14.850]  You know, next year it'll be something else.
[45:15.170 --> 45:20.830]  As people finally get real on, you know, how to be more secure.
[45:20.830 --> 45:27.670]  But let's face it, most of the guys who were running these sites and then got attacked just didn't have their act together security-wise.
[45:28.210 --> 45:30.850]  And I don't want to say, well, they deserved it.
[45:31.030 --> 45:41.570]  But on the other hand, you know, better that they get hacked by somebody now and locked their doors rather than later where something worse might happen.
[45:42.410 --> 45:44.510]  We probably have time for one or two more questions.
[45:53.910 --> 45:55.290]  I'd like to know that too.
[46:01.710 --> 46:03.810]  There, yeah, there's a big problem with the...
[46:03.810 --> 46:06.510]  I mean, people read things in the media and they think they're true.
[46:06.730 --> 46:08.110]  And the biggest...
[46:10.150 --> 46:11.010]  There you go.
[46:13.810 --> 46:19.830]  You know, one of the biggest problems out there is the numbers problem, especially in the security industry because...
[46:19.830 --> 46:21.350]  And I'll tell you...
[46:21.350 --> 46:25.390]  Well, let me explain it first and then I'll tell you what will probably solve this problem later on.
[46:25.890 --> 46:34.550]  I mean, you look at the Melissa virus, you have people in Korea claiming that, you know, 350,000 computers were hit.
[46:35.290 --> 46:37.130]  Turkey was 250,000.
[46:37.130 --> 46:41.790]  I mean, you have these numbers that were just completely off the cuff from government agencies that probably didn't know any better.
[46:41.950 --> 46:45.230]  And now they have become facts because...
[46:45.230 --> 46:46.910]  And, you know, I don't...
[46:46.910 --> 46:51.250]  I probably think maybe 10% at the most of that number got hit.
[46:52.390 --> 47:01.330]  You know, in doing some research for possible books that I'm doing, it's been very hard to pin down any really significant numbers out there.
[47:01.890 --> 47:06.970]  What I think is going to solve this problem is insurance agencies, surprisingly.
[47:07.950 --> 47:24.050]  These people like to do accounting and when suddenly you're claiming that, you know, Kevin Mitnick just hacked my computers and my source code is worth $80 million, you have to actually go to the insurance agent and say why it's worth $80 million and they don't want to pay you that.
[47:24.230 --> 47:30.010]  So, suddenly you come to a much more realistic figure and I think that will solve most of the problems out there.
[47:30.010 --> 47:33.950]  Now, whether or not the media will actually be able to get access to those figures is a whole different matter.
[47:34.150 --> 47:35.690]  But, anybody else?
[47:35.850 --> 47:37.510]  Oh, I'll throw in my two cents worth.
[47:37.730 --> 47:40.570]  The problem is that a reporter or who...
[47:40.570 --> 47:43.070]  I don't want to diss the two or three other people sitting here, but...
[47:43.070 --> 47:49.490]  They'll call up a group, one of these industry analyst groups, who basically pull numbers out of their rear, frankly.
[47:51.190 --> 47:52.170]  You know, if anybody...
[47:52.550 --> 47:54.350]  And I don't want to say, you know, but...
[47:54.350 --> 48:06.130]  There are people like Forrester, Gartner, other folks that, you know, because they are an analyst group and people and corporations throw a lot of money at them, they generate these numbers that have no basis in reality.
[48:06.390 --> 48:07.410]  And those numbers get quoted.
[48:07.550 --> 48:10.830]  I know because I've had to run down some of those numbers and some of the stories I've run.
[48:10.870 --> 48:12.650]  And I'm like, where the hell do you get this number from?
[48:12.690 --> 48:15.290]  And they're like, well, first of all, I take spaghetti and throw it at the wall.
[48:17.630 --> 48:26.790]  You know, horseshit-like, you know, amount of penetration, you know, of, you know...
[48:27.710 --> 48:29.950]  What is Larry Oracle pimping the other month?
[48:32.390 --> 48:33.830]  Desk, not desktop PCs.
[48:34.590 --> 48:35.410]  Network computers?
[48:35.590 --> 48:36.010]  Thank you.
[48:36.170 --> 48:39.450]  Yeah, NC's, you know, X terms that still haven't come to life.
[48:40.090 --> 48:49.210]  You know, network computers were supposed to be prolific in the home by now and there should be like two to four million of them out there and they're like maybe, you know, two to four of them out there.
[48:49.830 --> 49:00.630]  But I had some guy back two years ago was claiming there's going to be half a million of those things out there by 1998, 99 and his numbers were, you know, they just didn't take off.
[49:01.430 --> 49:02.670]  It's just heinous.
[49:02.670 --> 49:09.110]  I mean, if you really want a frightening experience, find one of these analysts and get him to talk you through how he arrives at one of his numbers.
[49:09.390 --> 49:14.950]  And, you know, it does involve the chicken and entrails, but I think they'd get more accurate answers if it did.
[49:16.210 --> 49:22.590]  There's a couple of sources I go to, but the numbers everybody already knows that I think are slightly more on the up and up.
[49:22.670 --> 49:34.950]  And one is the CSI-FBI survey because they interview 500 plus organizations to find out what their losses were in terms of perceived dollar value, in terms of number of hacks that they discovered into their systems, yada, yada, yada.
[49:35.750 --> 49:39.790]  But those numbers are so regurgitated out there in the industry, you know.
[49:40.170 --> 49:41.390]  ASIS has some numbers.
[49:41.390 --> 49:43.850]  That's the American Society for Industrial Security.
[49:44.070 --> 49:46.770]  Again, they do bonafide surveys.
[49:48.930 --> 49:52.830]  I mean, according to some of those people out here, we should be still recovering from Y2K.
[49:53.490 --> 50:03.630]  I mean, you know, compared to all the horseshit, oh, sorry, all the stuff that we, you know, it's just ridiculous how some of these things are manufactured so they can sell a report.
[50:03.890 --> 50:09.750]  One possible explanation that I got was, it was a combination of, what's your reputation worth if it's public?
[50:10.250 --> 50:11.750]  How do you recoup that?
[50:12.010 --> 50:21.810]  If it was data that was secret, like the network computer, I guess, before all the six companies got into their big tag team fight with Microsoft and it became public?
[50:21.810 --> 50:23.490]  Like, what's the idea worth?
[50:23.690 --> 50:24.970]  What's the patent worth?
[50:25.230 --> 50:28.410]  And so that's the intangible part that I've been told about.
[50:28.510 --> 50:31.510]  And then there's the, how much are you paying your email administrators?
[50:31.910 --> 50:37.070]  How much is your machine software worth if you have to reinstall it or upgrade?
[50:38.390 --> 50:40.890]  How much downtime did you get?
[50:41.030 --> 50:43.550]  How much money could you have been making if the machines weren't running?
[50:44.210 --> 50:47.230]  And a lot of it is probably, you know, incredibly inflated.
[50:47.610 --> 50:51.590]  You have your best business day of the year and it just happened to have been on the day that Melissa hit.
[50:52.090 --> 50:55.330]  And that's the number that they're going to use just to, I guess, cover themselves.
[50:56.330 --> 50:57.470]  We'll take one more question.
[50:59.690 --> 51:01.170]  Come on, let's get some blood on the floor here.
[51:01.530 --> 51:03.010]  Probably not a natural question.
[51:03.190 --> 51:04.190]  Well, with Linux...
[51:05.730 --> 51:07.050]  We'll try to make it two, maybe.
[51:07.250 --> 51:12.970]  With Linux becoming, you know, more or more popular, we can see more BSD related news, open up free and that BSD.
[51:14.350 --> 51:16.630]  Because Red Hat, you know, Linux has become Red Hat.
[51:17.070 --> 51:20.070]  I mean, outside this room, people think of Linux if they think of Red Hat.
[51:21.830 --> 51:24.350]  I would just like to offer two observations there.
[51:24.750 --> 51:31.590]  And that even though I'm a Linux user right now, that I think the best operating system that I've seen from a technical perspective is the BOS.
[51:33.170 --> 51:35.610]  But unfortunately, it got run over by Linux.
[51:35.930 --> 51:44.710]  And I think the same thing is happening somewhat with BSD, except for the fact that it is compatible with Linux.
[51:44.750 --> 51:47.030]  And so it probably has a big chance of surviving.
[51:47.030 --> 51:55.970]  And also the fact that it's kind of looked up to as the perfect version of Unix for the individual user out there.
[51:58.010 --> 52:07.410]  The journalistic community as a whole, by the way, we're really getting on top of the open source movement.
[52:07.890 --> 52:10.890]  And we're really seeing that it is a movement.
[52:11.630 --> 52:14.130]  And my editors just don't think that BSD is hot.
[52:14.130 --> 52:17.630]  They see people going to Linux users' groups and they see people wearing penguins.
[52:17.770 --> 52:19.090]  And they go, you know, penguin, that's cute.
[52:19.230 --> 52:20.130]  I can put that on a cover.
[52:20.230 --> 52:21.170]  People will understand that.
[52:21.390 --> 52:23.070]  Why would people want a picture of a little devil?
[52:23.270 --> 52:24.510]  That's just...
[52:25.290 --> 52:27.490]  Too much trouble for the conservative papers.
[52:27.590 --> 52:30.330]  So you can get in trouble with rednecks in Texas.
[52:31.930 --> 52:33.310]  Pick your right mascot.
[52:34.210 --> 52:34.430]  Yeah.
[52:35.070 --> 52:35.830]  It's all about marketing.
[52:36.030 --> 52:39.770]  Penguin, it's warm, it's fuzzy, and it was once used upon a time for a bulletin board called Opus.
[52:43.070 --> 52:44.870]  But, anyways, I'll skip my comments on that.
[52:44.970 --> 52:49.890]  One day I'm going to have to, like, come off the wagon and try Unix for, like, daily usage.
[52:50.050 --> 52:50.790]  But, anyways, go ahead.
[52:52.410 --> 52:56.170]  You all seem like you guys are the good journalists.
[52:56.330 --> 52:57.410]  We're the bad journalists.
[52:57.410 --> 53:04.030]  And, because you're all, you're all technologically savvy and ethical and smart.
[53:04.270 --> 53:07.650]  And I can tell that you're all thinking when you're speaking with all of us.
[53:08.090 --> 53:27.190]  And so, what are you guys doing to educate your peers about the perceived, not even perceived, but the actual abuses, talking about computer hacking, talking about technology in media and in journalism, especially with regards to corporate ownership of the media?
[53:27.950 --> 53:28.670]  I'll start.
[53:28.850 --> 53:35.430]  I just got hired on at Computer World and I was surprised to find that everybody there was commenting on my articles and how much they learned from them.
[53:36.170 --> 53:51.110]  And I think that, you know, if you can report correctly, if you can be accurate, if you can be clear, and if you're picking a subject that's difficult, like what this is, and you do it right, the articles themselves become an education to other writers.
[53:55.580 --> 53:59.640]  You know, bad journalists, well, it all depends on your focus, really.
[53:59.820 --> 54:05.240]  I mean, if you look at the mainstream media, it's not necessarily that they're bad journalists, it's just that they have to write for a certain audience.
[54:05.520 --> 54:11.260]  And in writing for that audience, a lot of times you simplify things down to a level until they're wrong.
[54:11.260 --> 54:17.360]  A lot of times your editors get a hold of it and they think that they can phrase it another way and it's perfectly correct.
[54:17.620 --> 54:20.140]  And when in fact, when they do it, it makes it completely ridiculous.
[54:21.040 --> 54:22.960]  So there's a lot of different reasons.
[54:23.120 --> 54:32.660]  I mean, I've written articles that made it out there that in the end might not have been my best work for a lot of different reasons.
[54:32.800 --> 54:36.200]  I mean, some of it were those two reasons, others just the deadline pressure.
[54:36.840 --> 54:40.080]  So, you know, in some ways, I can be a bad journalist as well.
[54:40.220 --> 54:42.620]  I mean, I get a lot of emails every day that tell me so.
[54:43.020 --> 54:48.420]  So it comes down to that I think there are definitely some less technical people out there.
[54:48.560 --> 54:56.740]  I would hope that anybody who considers himself a journalist is interested in learning and in doing so that they can eventually handle whatever beat they're assigned to.
[54:56.940 --> 54:57.940]  Can I say one more thing?
[54:58.120 --> 55:05.680]  When he was talking about other journalists and deadlines, I used to work for the Mercury News and every day I had a different subject.
[55:06.240 --> 55:09.980]  Every day I had to become an instant expert on something.
[55:10.640 --> 55:11.980]  And technology is tricky.
[55:12.180 --> 55:20.700]  And if you're talking to mainstream news like CNN or the San Jose Mercury News or the New York Times, this may be the one and only technical story that writer writes ever.
[55:20.700 --> 55:25.880]  And so, by making things in plain English so they can understand it.
[55:26.020 --> 55:27.180]  They have to understand fast.
[55:27.360 --> 55:28.120]  They have to file tonight.
[55:28.660 --> 55:30.400]  Their editors don't know what they're editing.
[55:30.940 --> 55:37.020]  The mainstream media, you're going to find a lot more problems with accuracy out there as opposed to the tech pub industry.
[55:38.260 --> 55:41.800]  Yeah, I've definitely found oversimplification just to be the biggest problem.
[55:41.920 --> 55:44.020]  Trying to make it easier to understand, but then making it wrong.
[55:44.180 --> 55:47.640]  Not understanding that some of this stuff is just, it can't be easily explained.
[55:47.640 --> 55:48.420]  It is complicated.
[55:50.060 --> 55:57.740]  Fortunately, I work for a magazine that actually if I had the chance to read it every month, I'd become more educated, more technically educated in Boardwatch.
[55:57.920 --> 56:17.140]  And I'll freely admit that as much as I'd like to think that I'm hot shit in terms of when I'm writing about streaming media or writing about the hacker industry, I know there's at least three other writers there who are off the top of my head that are better than I do and have a more in-depth knowledge than I do.
[56:17.140 --> 56:20.800]  So you have to be careful and humble at the same time.
[56:21.280 --> 56:25.920]  And while Brock Meeks isn't here and he does worship Satan, he is indeed a good writer.
[56:28.100 --> 56:29.500]  Just kidding about the Satan part.
[56:29.700 --> 56:32.060]  Well, thank you very much for coming and I guess that wraps it up.
[56:32.060 --> 56:32.580]  And I think that's all I could do.
[56:32.580 --> 56:35.160]  Thank you very much.
[56:35.770 --> 56:36.770]  So we'll be able to talk.
[56:37.120 --> 56:37.520]  What?