External Memory

So, you may have recently read the article on BoingBoing entitled "Your cyberpunk games are dangerous", where Jon Peterson gives you more details about what happened in 1990 when the Secret Service decided to raid Steve Jackson Games, claiming that the book "Cyperbunk" for the role-playing game known as GURPS was actually a manual for terrorists.

But there's another piece to this story that has never been told, so far as I know. This is because I was part of it, and I haven't told it. Until now.

At the time of the raid, I was working in the Pentagon for what later became the Defense Information Systems Agency, and my job title was "Analyst/Terminal Operator" for the World Wide Military Command and Control System, a.k.a., "WWMCCS". We were supporting the Joint Chiefs of Staff, Logistics Directorate (J4), in the Logistics Readiness Center. I had a Top Secret/SCI clearance, and I had been read onto a few compartments.

I had also been doing role-playing games since 9th grade, and I was a fan of several Steve Jackson Games.

A few months after the raid, I had bought every GURPS book I could find (including the infamous "Cyberpunk"), because I wanted to do what I could to help support the company and help get them back on their feet.

One particular book caught my attention. It used a classified code word in the context of explaining what a classified code word was and what it meant. One of the things about classified code words is that their very existence and what they cover is classified at the same level as the material they cover. That particular code word was classified Top Secret, and covered a particular SCI compartment.

Divulging any classified material is a crime, regardless of what that material might be -- just ask Chelsea Manning or Edward Snowden. In this case, since the material was TS/SCI, that meant it was automatically High Treason -- the only "non-violent" crime I know of that is punishable by death.

I found this out while I was directly supporting the LRC during Operation Desert Shield. I think it was sometime in September, 1990. Since I was working full-time supporting the Joint Chiefs of Staff, I wasn't able to go downstairs to talk to my Security Officer who could advise me on the next steps to take. So, I arranged to make a call to him on the STU-III telephone system for handling classified data, and described what I had found -- including title, publisher, reported author, page number, etc.... He confirmed that this was a leak of TS/SCI information, and that I had done my job and that he would notify the appropriate people. That was the last I heard of that incident.

Now, the thing about code words is that they are otherwise normal words. You might find these words used elsewhere in a different context, and that's not a leak of classified information. If the word "Fred" was a code word, then using "Fred" outside of code word context would not be a crime. But exposing "Fred" as a code word would be.

I try very hard not to be a "conspiracy nut". But in the case of the SS raid on SJG, I wonder if maybe they knew about the leak of the classified code word, and they wanted to get information on the real author, and what all else he knew.

This certainly wouldn't be the first case of a government agency cooking up some sort of bizarre cover story that wound up getting blown way out of proportion.

P.S. The irony here is that I have lived in Austin since 2006, but only within the last few months did I learn that SJG is also headquartered here.

I'm sure that many of you will know that nginx is a fast and powerful web server that can do many things, but I've recently had the opportunity to learn how to configure it to act as a front-end proxy for a different web server. I wanted to use a blog post to collect all the useful information that I found that helped me along this process.

Basics

The main website for nginx is ... sparse, although it does contain some useful links. One of the most useful links is for the nginx wiki. Most of the useful information I've found has either come from one part or another of the wiki, or from doing web searches on the topic I was interested in.

The simplest reverse proxy with caching is not too hard to understand, nor is the simplest load-balancer. Putting the two of them together is left as an exercise for the reader. Of course, there's lots of depth in the reverse proxy configuration, and you could easily get lots in trying to decipher the complete proxy module.

SSL

Adding SSL offloading looks quite a bit more complex. Way more complex than it needs to be. If all you want to do is add SSL to the mix, a much easier example can be found in Typical Configurations Overview For Nginx HTTP(S) Reverse Proxy/Web Server.

Encryption Algorithms

Once you get to this point, you might think you were done. But you may run into performance issues, and one of the things you will discover is that nginx is very advanced software, and it defaults to using the latest and most secure encryption algorithms that are available. They also happen to be the slowest encryption algorithms.

In your searches of the web, you may find that nginx sucks at ssl, however with luck you will also quickly discover that with a little tuning of the encryption algorithms, nginx does not suck at ssl. However, you should resist your urge to stop here.

Deeper Understanding

You shouldn't just be blindly implementing what someone else tells you to implement. You should understand some of the reasons behind what they are recommending. Vincent Bernat has a couple of excellent posts on testing various different encryption algorithms in various different web server/SSL proxy configurations, see SSL termination: stunnel, nginx & stud and SSL termination: stunnel, nginx & stud, round 2.

Simon Kuhn goes into even more depth on the encryption algorithms themselves, when and how you should check to see if you should disable assembly-language versions of the algorithms (because the old assembly language versions are actually slower on newer hardware), and how you should go about checking to see what additional encryption performance enhancing features are enabled on your hardware.

SSL Session Re-use

In his first article, Vincent also introduces the concept of SSL session re-use, which can also help significantly speed up your performance. Peter Bengtsson has a more succinct article showing the dramatic performance improvement. However, when terminating SSL at your proxy, you should be aware of the issues raised by Matt Palmer.

Fortunately, Vincent also gives us the RFC5077 tool that he has written to help test whether your web server is set up correctly for SSL session re-use, and it will also tell you what encryption algorithm your web server is selecting.

Development vs. Stable

Of course, enabling HTTP 1.1 "Keep Alive" for SSL session re-use means that you will probably be implementing the "development" version of nginx. Don't let that scare you.

To paraphrase Piotr Sikora from #nginx on irc.freenode.net:

This code is "development" only with regards to how the internals of the API and the headers are implemented (meaning that this deep internal code is still somewhat in flux), but the with regards to runtime stability, it is more than up to the task.

Putting It All Together

The best post I've found so far for taking most of the above information and helping develop a strategy for putting it all together is Setup and Tuning SSL ( https ) in Nginx. This article doesn't cover Vincent's RFC5077 tool (mentioned above), but that's about all it doesn't cover.

Part 2

In Part One I gave you my initial thoughts on these two programs. Now that a few more days have gone by, I thought I'd come back and revisit the matter and see where we are.

Billing

The folks at Mail Stop Mobile have made their program free to use -- just like PaperKarma. In my book, this eliminates one of the advantages that Mail Stop Mobile had -- they were honest about their income model for their software, whereas PaperKarma had me wondering how they were going to pay for all their servers, software, developers, etc.... Now, I'm wondering how either company is going to pay their bills for this. Mail Stop Mobile does have the advantage that they have other fee-based services they offer, so this could theoretically be a "loss leader" for them, but I'd be concerned about how much this would put pressure on them to "upsell" their more expensive services. Advantage: None.

Workflow

With PaperKarma, my work flow has been to take a whole sequence of pictures with my iPhone, edit those pictures (e.g., rotation or cropping with the built-in Photos app, or more advanced editing like de-skewing and color balance with CamScanner+), then go into PaperKarma and select the photos from my picture roll, and keep hitting the "Send and Pick New" button until I'm on the last photo, and then finally hit the "Send and Stop" button. PaperKarma seems to have addressed their server performance issues -- I haven't seen any problems since my initial testing.

However, Mail Stop Mobile doesn't allow me to use other photo or photo editing apps, you have to use their built-in photo function. If they're not going to let me use other photo or photo editing apps, then I would at least like to be able to use some of the standard photo editing functions, as demonstrated by CamScanner. However, using the built-in photo function does mean that my Camera Roll doesn't get filled up with all the pictures of junk mail that I don't want to receive any more, and if you have an auto-upload function for your camera (e.g., iCloud), then this would probably be a better solution for you.

Advantage: Not sure. So long as Mail Stop Mobile can actually figure out what it is that you want them to stop, I guess they don't really need the fancier cropping, rotating, de-skewing, or color balance tools, and it is a simpler program to use -- and it doesn't clutter up your Camera Roll. Only time will tell.

Interface

Mail Stop Mobile is simpler and easier to use, but all they tell you is whether or not a request has been submitted, and if there is a failure they give you the opportunity to try uploading it again. Once it's submitted, you don't get any further feedback from them, unless an advertiser chooses to contact you through their service, requesting confirmation that you really do want to be deleted from their mailing list.

PaperKarma give you more status feedback. They'll tell you just "Pending..." while the submission is being processed and recognized. If the request has been processed and recognized it might still be shown as "Pending...", which I presume means that they're waiting to send out the request or to get a response back as to whether or not you have been taken off the mailing list in question. You'll also see "Success" status or "Failed" status. I'm hoping that "Success" means that you have been taken off the list in question, and I've only ever seen "Failed" when the picture could not be recognized and I needed to take a new picture that was more clear.

Advantage: PaperKarma could win this category outright, if they gave you more details on what "Pending...", "Success", "Failed", etc... actually mean. Until then, I will lean that direction, but I won't declare a final winner in this category.

Results

Well, it's really been much too short a period of time to know how well either program is really doing. It's going to take weeks and months to see whether our volume of junk mail really does decrease. However, I can tell you that initial results are promising. With just the five initial requests uploaded to Mail Stop Mobile, we got one response back from the company that had sent the advertisement who wanted to confirm that we did actually want to get off their mailing list.

I have now submitted 53 total requests to PaperKarma, and I have also gotten a single response from an advertiser through them, also asking for us to confirm that we really did want to get off their mailing list.

One result each is the smallest possible positive result, so we can't make any claims of statistical validity here, but this is at least promising.

Conclusion

Now that Mail Stop Mobile is free to use, I will continue to test it side-by-side with PaperKarma, unless/until I decide that one program is clearly superior. I do like the simplicity and ease-of-use of Mail Stop Mobile, but I like the added functionality and feedback available with PaperKarma.