• • •
The following quote is from an essay I posted to Dave Farber's "Interesting People" list on 6 Jan 2005. Judging from feedback, a lot of people liked the post, and this line in particular. So here we go.
Data is not necessarily information. Information does not necessarily lead to knowledge. And knowledge is not always sufficient to discover truth and breed wisdom.
This quote is about security of computer systems. It appeared in "Computer Recreations: Of Worms, Viruses and Core War" by A. K. Dewdney in Scientific American, March 1989, pp 110. It was later misquoted in the book @Large: The Strange Case of the World's Biggest Internet Invasion by David H. Freedman and Charles C. Mann. (The misquoted version refers to titanium and nerve gas -- I never said anything like that.) The original quote is:
The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards - and even then I have my doubts.
This quote first appeared in print in the first edition of Web Security & Commerce (O'Reilly, 1997, S. Garfinkel & G. Spafford). The quote is on page 9:
Secure web servers are the equivalent of heavy armored cars. The problem is, they are being used to transfer rolls of coins and checks written in crayon by people on park benches to merchants doing business in cardboard boxes from beneath highway bridges. Further, the roads are subject to random detours, anyone with a screwdriver can control the traffic lights, and there are no police.
I originally came up with an abbreviated version of this quote during an invited presentation at SuperComputing 95 (December of 1995) in San Diego. The quote at that time was everything up to the "Further...." and was in reference to using encryption, not secure WWW servers.
In 2002, during an interview for a security magazine about "white hat" hackers, I said the following:
Hats are obvious, behavior isn't. And what is white to one person may be gray to another.
One of my better-known quotes was a 1992 description of Usenet:
Usenet is like a herd of performing elephants with diarrhea -- massive, difficult to redirect, awe-inspiring, entertaining, and a source of mind-boggling amounts of excrement when you least expect it.
I came up with this quote while in the shower one morning. It seemed really profound. I have no idea what inspired it. I first posted the quote to a mailing list, and it then got picked up on some newsgroups.
Another quote about Usenet, and concerning the importance of mailing lists and newsgroups of the time (and now, perhaps, about blogs) was this one from around 1988:
Don't sweat it -- it's not real life. It's only ones and zeroes.
I have since seen this quoted on T-shirts and bumper stickers, but without credit to me.
Around 1987, I formulated my three axioms of Usenet, with corollaries:
- Axiom #1:
- The Usenet is not the real world. The Usenet usually does not even resemble the real world.
- Corollary #1:
- Attempts to change the real world by altering the structure of the Usenet is an attempt to work sympathetic magic -- electronic voodoo.
- Corollary #2:
- Arguing about the significance of newsgroup names and their relation to the way people really think is equivalent to arguing whether it is better to read tea leaves or chicken entrails to divine the future.
- Axiom #2:
- Ability to type on a computer terminal is no guarantee of sanity, intelligence, or common sense.
- Corollary #3:
- An infinite number of monkeys at an infinite number of keyboards could produce something like Usenet.
- Corollary #4:
- They could do a better job of it.
- Axiom #3:
- Sturgeon's Law (90% of everything is crap) applies to Usenet.
- Corollary #5:
- In an unmoderated newsgroup, no one can agree on what constitutes the 10%.
- Corollary #6:
- Nothing guarantees that the 10% isn't crap, too.
I do not remember where I first posted these.
One of my students, Mahesh Tripunitara, has collected analogies that I have used in class, in talks and in advising. He seems to find these amusing, as do the people who contribute to the page.
Updated: 12/18/06
© 2004-2007 E. H. Spafford
spaf@purdue.edu