Vastly Important Notes

A better name

Microsoft announced today that it's new operating system, formerly known by the codename Longhorn, will officially be called "Windows Vista".  Early reactions to the new name have been mixed.  I'm not sure how I feel about the name, but I do like the fact that Microsoft is finally playing off the whole "windows" theme in their branding while giving users a subtle hint at what to expect from the future OS.  Along those same lines, I might have suggested that they go with, "Windows Pane" instead.  Maybe there's still time.

[Update: Thank you, I'll be here all week.]

I've been podcasted

I've never listened to a podcast before; I'm too old, and back in my day we just called them mp3 files. Until today!

InfoWorld's Jon Udell has just podcast (is this the right tense?) an interview with me talking about the convergence of physical and IT security. Forty minutes of hard-rockin' talk on FIPS-201 standards is exactly what all the cool kids will be jamming to while waiting for the, um, ski lift.

Sorry, the air conditioning in our building is down today. I'm going to have words with my landlord about the convergence of sweaty programmers and the withholding of the rent.

Metal detectors at subway stations are probably a bad idea

I just saw a CNN poll which shows that 60-something percent of Americans are in favor of installing metal detectors at subway stations.  This is probably a bad idea for at least three reasons:

1. Metal detectors do not pick up explosives and would not prevent bomb attacks such as those that took place in London this morning or in Madrid last year.  You need explosives detectors for that.  Trained dogs can do a decent job at this, but electronic explosive detectors are currently far too expensive to install most subway entrances.

2. Metal detectors would cause bottlenecks of people lined up to go through them.  Such predictable concentrations of crowds in environments poorly designed to accommodate them are attractive terrorist targets in their own right.

3. Setting up visible but mostly ineffectual security devices such as metal detectors may both desensitize and frustrate regular commuters.  This could reduce situational awareness and make people less likely to cooperate with other, more meaningful, security measures in the future.

We should remember that metal detectors were originally installed at airports to prevent hijackings, not bombings.  There is relatively little danger of someone hijacking a train.

I'm hoping that we'll see a dramatic reduction in both the cost and operating time of electronic explosives detectors over the next few years.  That's a technology that could actually make a difference.  For now, investment in terrorist response capabilities are just as important as investment in terrorist prevention capabilities.  In the case of mass transit, perhaps even more important.

Belated update

I think I've figured out the "DHS smartcards using Bluetooth" flap.  Near as I can tell, there was never any plan to make Bluetooth-enabled cards (which doesn't make any technical sense anyway) or Bluetooth-enable badge holders (which would be just strange).  There was speculation at a public forum about making Bluetooth-connected card readers so that you could read DHS smartcards with, say, a Blackberry.  This is actually not a bad idea.  I think you could overcome the security issues in this use case because Bluetooth would basically be an unsecured conduit between two secure participants (much like the Internet is with SSL).  Either way, I don't think it ever got much past the "wouldn't it be neat if we could..." public-musing phase.

Bottom line: Bluetooth panic around DHS cards is uninformed and unjustified.